- Freeradius-Users - lists.freeradius.org

Doubts about the rlm_replicate
by Jorge Pereira 12 Jun '15

12 Jun '15

Hi, I have a situation that I get a packet "Acct-Start" and then is necessary to duplicate and transform in a "Acct-Interim-Update". but, I should send the second packet "Acct-Interim-Update" after I get the "Accounting-Response" from the first sending "Acct-Start". have someone idea about the solution? My first thought was to add in rlm_replicate the capability to process a "preaccounting" and add some "flag" in the first packet saving in redis cache... but is a madness. I prefer to hear other suggestions! p.s: my radius is a proxy between two others. -- Jorge Pereira

1 0

FreeRADIUS 3.0.7 Segmentation Fault
by Donald Sherker 12 Jun '15

12 Jun '15

We are running FreeRADIUS 3.0.7. FreeRADIUS has been crashing every couple days due to segmentation faults. I enabled core dumps and got a core dump from the seg fault this morning. Using the core dump, what is the best way to determine what is causing the segmentation fault? Thanks, Don

2 3

OpenSSL problems
by Alan DeKok 12 Jun '15

12 Jun '15

A sad note from the HostAP mailing list. OpenSSL has broken the most recent release. The good news is that we've put changes into v3 to detect this kind of nonsense. It refuses to start with a broken OpenSSL. But, this means that if your system auto-upgrades OpenSSL, FreeRADIUS will refuse to start. If you upgrade OpenSSL, you MUST REBUILD FreeRADIUS. This requirement is made because the OpenSSL people hate their end users, and break binary compatibility. --- Please note that the OpenSSL versions released yesterday are not binary compatible with the prior releases due to a quite undesired ABI change (HMAC_CTX size changes). This affects multiple programs using OpenSSL shared libraries, including wpa_supplicant. If you are using wpa_supplicant with OpenSSL as a shared library and update the OpenSSL shared library without rebuilding the wpa_supplicant binary against the new header files from the new OpenSSL version, you may hit memory corruption issues at runtime. Rebuilding wpa_supplicant against the matching OpenSSL version will fix those. Based on a quick test, this issue did not show up in practice for me on 64-bit Ubuntu 14.04 with gcc build due to the HMAC_CTX struct padding done by the compiler. However, on 32-bit Ubuntu 14.04, this did result in memory corruption and process termination due to malloc() memory corruption and/or stack smashing detection. This is an OpenSSL issue and I hope that the previous ABI will be restored in a new release shortly. There is not really anything that wpa_supplicant can do about this apart from doing that rebuild with new OpenSSL header files.

3 3

duplicate acctuniqueid problem
by d tbsky 12 Jun '15

12 Jun '15

Hi: I am testing 802.1x accounting under fr 3.0.8. steps below: 1. use my notebook to login AP. accounting begin. 2. poweroff/poweron the AP. AP send "Accounting on". and previous accounting log closed with "NAS-Reboot".that's good. 3. use my notebook to login AP. fr can not create a new accounting entry, it seems "Acct-Session-Id" will be reused and cause "acctuniqueid" duplicate. error message like below: (11) sql: rlm_sql_mysql: ERROR 1062 (Duplicate entry 'e8db0ea9accf3a44b835ff8a0e5b62c0' for key 'acctuniqueid'): 23000 (11) sql: SQL query returned: need alt query (11) sql: Trying next query... (11) sql: EXPAND UPDATE radacct SET acctstarttime = FROM_UNIXTIME(%{integer:Event-Timestamp})................... then fr will try to update an existing entry instead of log a new entry. is the behavior expected? how can I setup to prevent it? thanks a lot for help! Regards, tbskyd

3 16

freeradius 2.2 / radsecproxy integration
by Alex Sharaz 12 Jun '15

12 Jun '15

Hi, Can anyone point me at a working config showing FR 2.2.x / radsecproxy integration. Thx A

2 3

Writing custom policies
by Randeep 12 Jun '15

12 Jun '15

Hi, I have installled FreeRADIUS Version 2.1.12. I want to give a particular user maximum usage of 30GB in a month. I have enabled the counter.conf. And the NAS is sending the interim updates to the radacct. But where I can give this condition? to compare and respond with a disconnect message? I have to give this in policy.conf? Or in pre-auth session? The thing is in the default radiusd.conf, I'm not able to see this authorize,authentiate, accounting, pre-auth etc. Is this some version specific? Regards, Randeep

1 0

We have plans to 3.0.9?
by Jorge Pereira 11 Jun '15

11 Jun '15

Alan, I would like to know if have plans and date to 3.0.9. -- Jorge Pereira

2 1

ippool configuration
by Randeep 11 Jun '15

11 Jun '15

Hi, I've installed a freeradius server. Now I am trying to configure the ip pool. I have done the following. In /etc/raddb/radiusd.conf I have uncommented $INCLUDE sqlippool.conf In /etc/raddb/sqlippool.conf I have uncommented $INCLUDE sql/mysql/ippool.conf in /etc/raddb/sql/mysql/ippool.conf I haven't made any changes. in /etc/raddb/modules/ippool, I have set the range, netmask etc. But I couldn't understand what exactly is session-db = ${db_dir}/db.ippool and no ip is allocating for the client. I tested it with the debug mode. Couldnt find any logs related to this though. is it possible to see the ip address given to the request in the radtest command line client? Also, This ip pool is for the local ips right? Where we can configure the public IP to private IP mapping? This has to be done on the NAS side? Please help -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore]

1 0

Authentication methods
by Randeep 11 Jun '15

11 Jun '15

Hi, We are implementing a solution with FreeRadius+Mysql+Mikrotik. We need two types of authentication methods. 1. PPPoE 2. Via HTTP. For eg: When a user connects from the laptop, the browser should redirect to a website on which we can enter username & password and authenticate. It would be better if we can do this with an api so that we can use the same api to login to the network from the devices which doesn't support PPPoE. is this possible with FreeRadius. Which protocols I need to enable for this? I need to specify this in radgroupreply? with Framed-Protocol? But two protocol is possible at the same time? Please advice. -- Randeep Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr

2 4

doubts about the functions in the unlang
by Jorge Pereira 11 Jun '15

11 Jun '15

Hi, someone know if have some way to do something like. int-require.by { if (!$1) { update { reply:Reply-Message:= "The $1 is required" } reject } else { noop } } and calling like int-require.by "Acct-Session-Id" -- Jorge Pereira

6 13