- Freeradius-Users - lists.freeradius.org

Hardware Requirement for FreeRadius 3.0.8
by Sunil Kulkarni -X (sunikulk - PERSISTENT SYSTEMS INC at Cisco) 05 Jun '15

05 Jun '15

Hello All, I am new for FreeRadius. I am using FreeRadius 3.0.8 version. I wanted to know following: 1. Is there any hardware specific document and post available? 2. Is there any performance benchmark related document? --- Thanks, Sunil Kulkarni

3 2

Compiling Python & FreeRadius 3.x
by Andrew Parisio 04 Jun '15

04 Jun '15

If we use the apt/yum installed versions of python it works, but if we compile python (tried 2.7.3, .6, and .10, installing in /usr/local) and then configure freeradius to look at the compiled versions we are able to get it to work, but as soon as you import a module such as json or boto (the aws sdk) we hit the PyThreadState_Get error. When looking at the strace we have verified that all references to python are to the correct/compiled version, there are no accidental references to the local system version of python. We've tried this in several different environments (internal build tools, clean copies of ubuntu & amazon linux), and have been able to reliably reproduce the same PyThreadState_Get error message, but have been unable to figure out why it's happening. I think it's something to do with the way freeradius is compiled, however it's also possible it's related to the way python itself is compiled but I think that's less likely because we used the same flags used to compile the yum version of python. FYI we can compile freeradus 2.2.x against our compiled python and everything works just fine (but freeradius 2.2.x doesn't support threaded python). This is the script used to build/install python & freeradius on Amazon Linux 2015.03 on EC2: sudo su cd yum update -y yum groupinstall "Development Tools" -y yum install libtalloc-devel openssl-devel -y yum remove python27-devel -y # so there's no way it accidnetally compiles against the system python wget https://www.python.org/ftp/python/2.7.6/Python-2.7.6.tgz wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.8.tar.gz tar -xzvf Python-2.7.6.tgz tar -zxvf freeradius-server-3.0.8.tar.gz PATH=/usr/local/bin:$PATH export PATH PYTHONHOME=/usr/local export PYTHONHOME cd /root/Python-2.7.6 && ./configure --enable-shared LDFLAGS="-Wl,-rpath,/usr/local/lib/python2.7" LINKFORSHARED="-Xlinker --export-dynamic" CPPLAGS="-fPIC -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes" --prefix=/usr/local && make -j16 && make altinstall cd /root/freeradius-server-3.0.8 && ./configure LDFLAGS="-Wl,-rpath,/usr/local/lib/python2.7" BASECFLAGS="-fPIC -Xlinker --export-dynamic" --with-rlm-python-lib-dir=/usr/local/lib/python2.7 --with-rlm-python-include-dir=/usr/local/include/python2.7 && make -j16 && make install cp /usr/local/etc/raddb/mods-available/python /usr/local/etc/raddb/mods-enabled/python echo "import json # comment out this line and radius will run def instantiate(p): print json.dumps({}) print 'YAY!' " > /usr/local/lib/python2.7/site-packages/example.py vi /usr/local/etc/raddb/mods-enabled/python # uncomment the insantiate line (too lazy to sed) then /usr/local/sbin/radiusd -X -xxx stat("/usr/local/lib/python2.7/_locale", 0x7ffd1f05b170) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/_locale.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/_localemodule.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/_locale.py", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/_locale.pyc", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python27.zip", 0x7ffd1f059f10) = -1 ENOENT (No such file or directory) stat("/usr/local/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python27.zip", 0x7ffd1f05aec0) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7/plat-linux2", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/plat-linux2", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/plat-linux2/_locale", 0x7ffd1f05b170) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/plat-linux2/_locale.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/plat-linux2/_localemodule.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/plat-linux2/_locale.py", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/plat-linux2/_locale.pyc", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7/lib-tk", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/lib-tk", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/lib-tk/_locale", 0x7ffd1f05b170) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-tk/_locale.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-tk/_localemodule.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-tk/_locale.py", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-tk/_locale.pyc", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7/lib-old", 0x7ffd1f059f10) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7", {st_mode=S_IFDIR|0755, st_size=20480, ...}) = 0 stat("/usr/local/lib/python2.7/lib-old", 0x7ffd1f05aec0) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7/lib-dynload", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/lib-dynload", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/lib-dynload/_locale", 0x7ffd1f05b170) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-dynload/_locale.so", O_RDONLY) = 5 fstat(5, {st_mode=S_IFREG|0755, st_size=60757, ...}) = 0 open("/usr/local/lib/python2.7/lib-dynload/_locale.so", O_RDONLY|O_CLOEXEC) = 6 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\32\0\0\0\0\0\0"..., 832) = 832 fstat(6, {st_mode=S_IFREG|0755, st_size=60757, ...}) = 0 mmap(NULL, 2116856, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2398e93000 mprotect(0x7f2398e97000, 2097152, PROT_NONE) = 0 mmap(0x7f2399097000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f2399097000 close(6) = 0 write(2, "Fatal Python error: PyThreadStat"..., 57Fatal Python error: PyThreadState_Get: no current thread ) = 57 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(1420, 1420, SIGABRT) = 0 --- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=1420, si_uid=0} --- +++ killed by SIGABRT +++ Aborted Does anybody have any thoughts / suggestions? Thanks!

2 2

permit access on date/hour intervals and policy.conf problem
by Franz Angeli 04 Jun '15

04 Jun '15

Hi, I need to be able to specify an interval of date and time for accessing through a captive portal connected to freeradius; for example testuser can use network from 2015-05-01 17:00:00 to 2015-05-01 18:00:00 i create 3 custom attributes: ATTRIBUTE System-Date 3002 integer ATTRIBUTE Start_Time 3000 integer ATTRIBUTE Stop_Time 3001 integer System-Date to store system data Start_Time to assign a start auth period for user Stop_Time to assign the end of auithentication permission. I use UNIX time for every attribute for provisioning purpose i use Freeradius + MySQL and in my radcheck table i have for example: testuser | Cleartext-Password | := | testuser testuser | Start_Time | := | 1430499600 testuser | Stop_Time | := | 1430503200 to check account validity i add on policy.conf : check_validity { update control { System-Date := "%l" } if (Start_Time > control:System-Date) { update reply { Reply-Message := "account not yet active" } reject } if (Stop_Time < control:System-Date) { update reply { Reply-Message := "account no longer active" } reject } } freeradius start without error, System-Date take the correct value for Date but Start_Time and Stop_Time in this way seems to work with a file not mysql...(yes my default site has check_validity in authorize section) I don't know how use a query to assign database stored value for Start_Time and Stop_TIme, is it possbile? I need some examples... Thanks in advance Franz Angeli

2 12

Freeradius slow start
by absolutely_free＠libero.it 04 Jun '15

04 Jun '15

Hi, I am using freeradius 2.0.4 (official deb package) - unfortunately, this is a very old server with Debian 5. It's a VMware virtual machine with 3 GB ram and 4 vCPU. I noticed that freeradius take very long time to start. Here is strace output of starting pid: # strace -p 3889 Process 3889 attached - interrupt to quit brk(0x12cba000) = 0x12cba000 brk(0x12cdb000) = 0x12cdb000 brk(0x12cfc000) = 0x12cfc000 brk(0x12d1d000) = 0x12d1d000 brk(0x12d3e000) = 0x12d3e000 brk(0x12d5f000) = 0x12d5f000 brk(0x12d80000) = 0x12d80000 brk(0x12da1000) = 0x12da1000 brk(0x12dc2000) = 0x12dc2000 brk(0x12de3000) = 0x12de3000 brk(0x12e04000) = 0x12e04000 brk(0x12e25000) = 0x12e25000 munmap(0xb6caa000, 1052672) = 0 brk(0x12e46000) = 0x12e46000 time(NULL) = 1433373461 brk(0x12e6b000) = 0x12e6b000 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(0, 0, 0xbfe6de50, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(1, 0, 0xbfe6de50, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(2, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(2, 0, 0xbfe6de50, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(2, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(2, 0, 0xbfe6de50, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(18, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(18, 0, 0xbfe6ddf0, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(18, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(18, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(18, 0, 0xbfe6ddf0, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(18, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(19, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(19, 0, 0xbfe6ddf0, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(19, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 ioctl(19, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 _llseek(19, 0, 0xbfe6ddf0, SEEK_CUR) = -1 ESPIPE (Illegal seek) ioctl(19, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0 brk(0x12e8c000) = 0x12e8c000 brk(0x12ead000) = 0x12ead000 brk(0x12ece000) = 0x12ece000 brk(0x12eef000) = 0x12eef000 brk(0x12f10000) = 0x12f10000 brk(0x12f31000) = 0x12f31000 mmap2(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x b6e6d000 brk(0x12f52000) = 0x12f52000 brk(0x12f73000) = 0x12f73000 brk(0x12f94000) = 0x12f94000 brk(0x12fb5000) = 0x12fb5000 brk(0x12fd6000) = 0x12fd6000 brk(0x12ff7000) = 0x12ff7000 mremap(0xb6e6d000, 135168, 266240, MREMAP_MAYMOVE) = 0xb6e2c000 brk(0x13018000) = 0x13018000 brk(0x13039000) = 0x13039000 brk(0x1305a000) = 0x1305a000 brk(0x1307b000) = 0x1307b000 brk(0x1309c000) = 0x1309c000 brk(0x130bd000) = 0x130bd000 brk(0x130de000) = 0x130de000 brk(0x130ff000) = 0x130ff000 brk(0x13120000) = 0x13120000 brk(0x13141000) = 0x13141000 brk(0x13162000) = 0x13162000 brk(0x13183000) = 0x13183000 brk(0x131a4000) = 0x131a4000 mremap(0xb6e2c000, 266240, 528384, MREMAP_MAYMOVE) = 0xb6dab000 brk(0x131c5000) = 0x131c5000 brk(0x131e6000) = 0x131e6000 brk(0x13207000) = 0x13207000 ... ... (many similar lines) brk(0x1f12d000) = 0x1f12d000 brk(0x1f14e000) = 0x1f14e000 brk(0x1f16f000) = 0x1f16f000 munmap(0xb6caa000, 1052672) = 0 time(NULL) = 1433373478 open("/usr/lib/freeradius/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such fi le or directory) open("/lib/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such file or directory ) open("/usr/lib/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such file or direc tory) open("/lib/i486-linux-gnu/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such fi le or directory) open("/usr/lib/i486-linux-gnu/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No suc h file or directory) open("/usr/local/lib/rlm_acct_unique.la", O_RDONLY) = -1 ENOENT (No such file or directory) access("/usr/lib/freeradius/rlm_acct_unique.so", R_OK) = 0 open("/usr/lib/freeradius/rlm_acct_unique.so", O_RDONLY) = 9 read(9, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\7\0\0004\0\0\0\\"..., 512) = 512 fstat64(9, {st_mode=S_IFREG|0644, st_size=6508, ...}) = 0 mmap2(NULL, 9340, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 9, 0) = 0xb6e8 b000 mmap2(0xb6e8d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRIT E, 9, 0x1) = 0xb6e8d000 close(9) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, chil d_tidptr=0xb71976f8) = 3940 exit_group(0) = ? Process 3889 detached Since I notice a very high load on this server (freeradius seems to be to root cause, according to top), I'm looking for some help. Thank you

2 1

Re: Openwrt Sqlite No Write Radacct Table
by bruno d'ambrosio 03 Jun '15

03 Jun '15

Hi Jorge On which version openwrt, sqlite work with freeradius? Best regard Bruno D'Ambrosio ----- Reply message ----- Da: "Jorge Pereira" <jpereiran(a)gmail.com> A: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Oggetto: Openwrt Sqlite No Write Radacct Table Data: gio, giu 4, 2015 00:51 Bruno, this version hás problem. Got it? You need to upgrade. Only this will works. Em 03/06/2015 19:45, "Bruno D'Ambrosio" <brunodambrosio2011(a)hotmail.it> escreveu: > Hi Arran > > Can you help me make it work? > Missing some piece of code to write the query in the database "Sqlite"? > > Best Regard > Bruno D'Ambrosio > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Openwrt Sqlite No Write Radacct Table
by Bruno D'Ambrosio 03 Jun '15

03 Jun '15

Hi Arran Can you help me make it work? Missing some piece of code to write the query in the database "Sqlite"? Best Regard Bruno D'Ambrosio

2 1

Re: Openwrt Sqlite No Write Radacct Table
by Bruno D'Ambrosio 03 Jun '15

03 Jun '15

You can not use it in the version of FreeRADIUS 2?there is a chance to do something? Best Regard Bruno D'Ambrosio

3 2

Openwrt Sqlite No Write Radacct Table
by Bruno D'Ambrosio 03 Jun '15

03 Jun '15

Hi Mate It is for days that I can not solve the problem in subject. I installed "*freeradius****2.2.0-1*" with mod "*sqlite3*" system "*OpenWRT*" version "*attitude_adjustment****/ 12.09*" but after you configure the following files: *- /Sql.conf/** **-/Dialup.conf/** **-/Radius.conf /** **-//Sites/Defaulft/* running the test: *- echo*"Acct-Status-Type=Start,Acct-Session-Id=testing,NAS-IP-Address=127.0.0.1,Client-IP-Address=127.0.0.1,Acct-Unique-Session-Id=test" *|* radclient -c 1 -r 2 -t 1 -x 127.0.0.1 acct testing123 *The table "RADACCT" is not updated.* Below is a small code query written by me, to check a evenutale writing: - *accounting_start_query = "INSERT INTO radacct (radacctid, acctsessionid, acctuniqueid, nasipaddress) \** ** values ('18', 'testing', '5debd18abc4f9899', '127.0.0.1');"* Here's the code of the original query file "Diaulp.conf" (MySQL): *- accounting_start_query = " \** ** INSERT INTO ${acct_table1} \** ** (acctsessionid, acctuniqueid, username, \** ** realm, nasipaddress, nasportid, \** ** nasporttype, acctstarttime, acctstoptime, \** ** acctsessiontime, acctauthentic, connectinfo_start, \** ** connectinfo_stop, acctinputoctets, acctoutputoctets, \** ** calledstationid, callingstationid, acctterminatecause, \** ** servicetype, framedprotocol, framedipaddress, \** ** acctstartdelay, acctstopdelay, xascendsessionsvrkey) \** ** VALUES \** ** ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \** ** '%{SQL-User-Name}', \** ** '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \** ** '%{NAS-Port-Type}', '%S', NULL, \** ** '0', '%{Acct-Authentic}', '%{Connect-Info}', \** ** '', '0', '0', \** ** '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \** ** '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \** ** '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" */You can kindly help me solve this problem?/**/THANKS./* * /Best Regards// //Bruno D'Ambrosio./* *

3 3

Suggestions for a high-scalability
by Jorge Pereira 03 Jun '15

03 Jun '15

Hi people, Nowadays we have two instances of FreeRadius using the latest 3.0.8 that it's configured set to InstanceA and InstanceB and the NAS servers have configured each instance like a redundance/fail-over. But it's expected more then 1 million of connections by day in the next month. And I would like to hear suggestions about what I can do to improve the services. Advices and suggestions are welcome! -- Jorge Pereira

2 1

Use dialup admin to authenticate with certificate
by rints harry 03 Jun '15

03 Jun '15

Hi, Help me how to configure dialup admin or another webgui when I use certificate to authenticate client. I want know a list of user connected , at what NAS. I know it s possible because I see these informations when I use radiusd -X Thx

1 0