- Freeradius-Users - lists.freeradius.org

VLAN assignment with Certificate attributes
by Gérold Mougenel 19 Mar '15

19 Mar '15

Hi, I'm running freeradius 3.0.6. I'm already able to assign a VLAN to the port when my client is authenticated with a couple login/password but is it possible to be done when the client is authenticated via a certificate ? I can't find any ressources on the subject. Thank's for help. *MOUGENEL Gérold* Tel : 06.71.58.47.57

4 9

errors after migration
by Brian 19 Mar '15

19 Mar '15

Hello, I recently migrated my Radius server to a new machine but it's giving me errors now when I try to start it. I had to change permissions in /etc/raddb to 755 in order to get it to start (even 750 wouldn't work) but I know that isn't an ideal long-term solution. I am on CentOS 6.5 with FreeRadius version 2.1.12. Thanks in advance. Wed Mar 18 11:34:55 2015 : Error: rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied Wed Mar 18 11:34:55 2015 : Error: rlm_eap_tls: Error reading certificate file /etc/raddb/certs/server.pem Wed Mar 18 11:34:55 2015 : Error: rlm_eap: Failed to initialize type tls Wed Mar 18 11:34:55 2015 : Error: /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Wed Mar 18 11:34:55 2015 : Error: /etc/raddb/sites-enabled/default[310]: Failed to load module "eap". Wed Mar 18 11:34:55 2015 : Error: /etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Wed Mar 18 11:34:55 2015 : Error: Failed to load virtual server <default>

2 2

sql or radtmp - which best?
by Marcin 19 Mar '15

19 Mar '15

Hi, I starting with freeradius 2.4 with flat files. I've heard that freeradius with flat files works faster than works with sql (postgres or mysql). Which should i chose to accounting users, sql or files? maybye both? In some documents I've read that accountigs should be stored with two tables. one table to online sessions and second table to archive data, but how to split it? In that case when client disconnects i should use two questions to database with different tables, one to delete online sessions and second to insert data to "archive" table. but when we use database we should replicate data, how to synchronize databases? What are the best practices to store users, nas and accounting data, sql or files? -- Pozdrawiam Marcin / nicraM

2 1

Traffic Volume Limit per Month cannot exceed 4Gbytes
by chenjiang 19 Mar '15

19 Mar '15

Hi! Experts I want to achieve user traffic volume limit per month, but found there is a limit for user traffic to exceed 4Gbytes. Below is my DB structure, you could see the "Max-Monthly-Trafficâ groupcheck attribute is 10Gbytes and it type is âvarchar", but it seems system deal it like a âinteger" type, so it cannot exceed 4Gbytes. mysql> desc radgroupcheck; +-----------+------------------+------+-----+---------+---------------- + | Field | Type | Null | Key | Default | Extra | +-----------+------------------+------+-----+---------+---------------- + | id | int(11) unsigned | NO | PRI | NULL | auto_increment | | groupname | varchar(64) | NO | MUL | | | | attribute | varchar(64) | NO | | | | | op | char(2) | NO | | == | | | value | varchar(253) | NO | | | | +-----------+------------------+------+-----+---------+---------------- + 5 rows in set (0.00 sec) mysql> select * from radgroupcheck; +----+--------------------+-----------------------+----+------------+ | id | groupname | attribute | op | value | +----+--------------------+-----------------------+----+------------+ | 1 | disabled | Auth-Type | := | Reject | | 25 | group2 | Max-Monthly-Traffic | := | 10737418240| | 33 | microshield | Acct-Interim-Interval | := | 300 | +----+--------------------+-----------------------+----+------------+ 3 rows in set (0.00 sec) In FreeRADIUS debug mode, we could see that the rlm_sqlcounter âcheck_itemâ is always warpped in 4294967296 just like below: [monthlytrafficcounter] expand: %{sql:SELECT SUM(acctinputoctets+acctoutputoctets) FROM radacct WHERE username='lichan' AND UNIX_TIMESTAMP(acctstarttime) > '1425139200'} -> 7250810110 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user lichan, check_item=2147483648, counter=3955842814 ++[monthlytrafficcounter] returns reject And this always leads users been rejected in authentication procedure. Do you have any experience in this and could shed some light? Thanks for your great help! BR! Chen Jiang Microshield Technology Co., Ltd åäº¬å¸æµ·æ·åºè¥¿ä¸ç¯åè·¯50å·è±ªæå¤§å¦C2åº§18-19å± 100048 (86)10-88518768 (86)18612696123 [1]chenjiang(a)microshield.com.cn References 1. mailto:chenjiang@microshield.com.cn

2 1

Re: Segmentation fault after [peap] Using saved attributes from theoriginal Access-Accept
by chenjiang 19 Mar '15

19 Mar '15

Hi! Experts I want to achieve user traffic volume limit per month, but found there is a limit for user traffic to exceed 4Gbytes. Below is my DB structure, you could see the "Max-Monthly-Trafficâ groupcheck attribute is 10Gbytes and it type is âvarchar", but it seems system deal it like a âinteger" type, so it cannot exceed 4Gbytes. mysql> desc radgroupcheck; +-----------+------------------+------+-----+---------+---------------- + | Field | Type | Null | Key | Default | Extra | +-----------+------------------+------+-----+---------+---------------- + | id | int(11) unsigned | NO | PRI | NULL | auto_increment | | groupname | varchar(64) | NO | MUL | | | | attribute | varchar(64) | NO | | | | | op | char(2) | NO | | == | | | value | varchar(253) | NO | | | | +-----------+------------------+------+-----+---------+---------------- + 5 rows in set (0.00 sec) mysql> select * from radgroupcheck; +----+--------------------+-----------------------+----+------------+ | id | groupname | attribute | op | value | +----+--------------------+-----------------------+----+------------+ | 1 | disabled | Auth-Type | := | Reject | | 25 | group2 | Max-Monthly-Traffic | := | 10737418240| | 33 | microshield | Acct-Interim-Interval | := | 300 | +----+--------------------+-----------------------+----+------------+ 3 rows in set (0.00 sec) In FreeRADIUS debug mode, we could see that the rlm_sqlcounter âcheck_itemâ is always warpped in 4294967296 just like below: [monthlytrafficcounter] expand: %{sql:SELECT SUM(acctinputoctets+acctoutputoctets) FROM radacct WHERE username='lichan' AND UNIX_TIMESTAMP(acctstarttime) > '1425139200'} -> 7250810110 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user lichan, check_item=2147483648, counter=3955842814 ++[monthlytrafficcounter] returns reject And this always leads users been rejected in authentication procedure. Do you have any experience in this and could shed some light? Thanks for your great help! BR! Chen Jiang Microshield Technology Co., Ltd åäº¬å¸æµ·æ·åºè¥¿ä¸ç¯åè·¯50å·è±ªæå¤§å¦C2åº§18-19å± 100048 (86)10-88518768 (86)18612696123 [1]chenjiang(a)microshield.com.cn References 1. mailto:chenjiang@microshield.com.cn

1 0

Segmentation fault after [peap] Using saved attributes from the original Access-Accept
by tom greisch 19 Mar '15

19 Mar '15

Hi together, the first Authentication of a User works fine. If there is a Request for the same User (in a short time intervall) i get the following message "[peap] Using saved attributes from the original Access-Accept". After this Message i get a Segmentation Fault. Any Ideas ? freeradius Version: 2.2.5 (compiled with--with-experimental-modules) OS Version: Debian 8 (Jessie) Output from valgrind: ====================== # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept User-Name = "anonymous" ==46641== Invalid read of size 8 ==46641== at 0x4E4B7E5: pairadd (in /usr/lib/freeradius/libfreeradius-radius-020205.so) ==46641== by 0x7D32618: eaptls_gen_mppe_keys (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7D31257: eaptls_success (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7B26FAB: eaptype_call (eap.c:175) ==46641== by 0x7B2745D: eaptype_select (eap.c:409) ==46641== by 0x7B26A8C: eap_authenticate (rlm_eap.c:327) ==46641== by 0x41C07C: call_modsingle (modcall.c:305) ==46641== by 0x41C07C: modcall_recurse (modcall.c:579) ==46641== by 0x41B9C8: modcall_child (modcall.c:423) ==46641== by 0x41BC68: modcall_recurse (modcall.c:628) ==46641== by 0x41C819: modcall (modcall.c:877) ==46641== by 0x41AD29: indexed_modcall (modules.c:750) ==46641== by 0x40A4EF: rad_check_password (auth.c:382) ==46641== by 0x40A4EF: rad_authenticate (auth.c:667) ==46641== Address 0x70 is not stack'd, malloc'd or (recently) free'd ==46641== ==46641== ==46641== Process terminating with default action of signal 11 (SIGSEGV) ==46641== Access not within mapped region at address 0x70 ==46641== at 0x4E4B7E5: pairadd (in /usr/lib/freeradius/libfreeradius-radius-020205.so) ==46641== by 0x7D32618: eaptls_gen_mppe_keys (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7D31257: eaptls_success (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7B26FAB: eaptype_call (eap.c:175) ==46641== by 0x7B2745D: eaptype_select (eap.c:409) ==46641== by 0x7B26A8C: eap_authenticate (rlm_eap.c:327) ==46641== by 0x41C07C: call_modsingle (modcall.c:305) ==46641== by 0x41C07C: modcall_recurse (modcall.c:579) ==46641== by 0x41B9C8: modcall_child (modcall.c:423) ==46641== by 0x41BC68: modcall_recurse (modcall.c:628) ==46641== by 0x41C819: modcall (modcall.c:877) ==46641== by 0x41AD29: indexed_modcall (modules.c:750) ==46641== by 0x40A4EF: rad_check_password (auth.c:382) ==46641== by 0x40A4EF: rad_authenticate (auth.c:667) ==46641== If you believe this happened as a result of a stack ==46641== overflow in your program's main thread (unlikely but ==46641== possible), you can try to increase the size of the ==46641== main thread stack using the --main-stacksize= flag. ==46641== The main thread stack size used in this run was 8388608. ==46641== ==46641== HEAP SUMMARY: ==46641== in use at exit: 2,789,061 bytes in 54,399 blocks ==46641== total heap usage: 113,115 allocs, 58,716 frees, 7,949,363 bytes allocated ==46641== ==46641== 312 bytes in 1 blocks are possibly lost in loss record 1,029 of 1,259 ==46641== at 0x4C28C20: malloc (vg_replace_malloc.c:296) ==46641== by 0x4E4B496: pairalloc (in /usr/lib/freeradius/libfreeradius-radius-020205.so) ==46641== by 0x4E4CBBB: pairmake (in /usr/lib/freeradius/libfreeradius-radius-020205.so) ==46641== by 0x7D32487: ??? (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7D32618: eaptls_gen_mppe_keys (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7D31257: eaptls_success (in /usr/lib/freeradius/libfreeradius-eap-2.2.5.so) ==46641== by 0x7B26FAB: eaptype_call (eap.c:175) ==46641== by 0x7B2745D: eaptype_select (eap.c:409) ==46641== by 0x7B26A8C: eap_authenticate (rlm_eap.c:327) ==46641== by 0x41C07C: call_modsingle (modcall.c:305) ==46641== by 0x41C07C: modcall_recurse (modcall.c:579) ==46641== by 0x41B9C8: modcall_child (modcall.c:423) ==46641== by 0x41BC68: modcall_recurse (modcall.c:628) ==46641== ==46641== LEAK SUMMARY: ==46641== definitely lost: 0 bytes in 0 blocks ==46641== indirectly lost: 0 bytes in 0 blocks ==46641== possibly lost: 312 bytes in 1 blocks ==46641== still reachable: 2,788,749 bytes in 54,398 blocks ==46641== suppressed: 0 bytes in 0 blocks ==46641== Reachable blocks (those to which a pointer was found) are not shown. ==46641== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==46641== ==46641== For counts of detected and suppressed errors, rerun with: -v ==46641== Use --track-origins=yes to see where uninitialised values come from ==46641== ERROR SUMMARY: 14864 errors from 597 contexts (suppressed: 0 from 0) ==46641== could not unlink /tmp/vgdb-pipe-from-vgdb-to-46641-by-root-on-??? ==46641== could not unlink /tmp/vgdb-pipe-to-vgdb-from-46641-by-root-on-??? ==46641== could not unlink /tmp/vgdb-pipe-shared-mem-vgdb-46641-by-root-on-??? Segmentation fault

3 3

radclient port to node.js
by Michele Pangrazzi 19 Mar '15

19 Mar '15

Hi all, this is just to let you know that I’ve done a basic porting of the radclient <http://freeradius.org/radiusd/man/radclient.html> command to node.js <https://nodejs.org/>. Thanks for reading, Michele

1 1

Crash
by Ben Gatewood 19 Mar '15

19 Mar '15

Had a couple of crashes recently with log signature that looks like this: Tue Mar 17 18:36:05 2015 : Error: ASSERT FAILED src/main/connection.c[1085]: pool->active == pool->num CAUGHT SIGNAL: Aborted Backtrace of last 18 frames: /usr/local/lib/libfreeradius-radius.so(fr_fault+0x127)[0x7f6f83c46425] /usr/local/lib/libfreeradius-server.so(rad_assert_fail+0x53)[0x7f6f83ea2a68] /usr/local/sbin/radiusd[0x435c5d] /usr/local/sbin/radiusd(fr_connection_get+0x1d)[0x435e4c] /usr/local/lib/rlm_sql.so(+0x5ec9)[0x7f6f831ecec9] /usr/local/lib/rlm_sql.so(+0x639a)[0x7f6f831ed39a] /usr/local/sbin/radiusd[0x42799c] /usr/local/sbin/radiusd[0x4280f1] /usr/local/sbin/radiusd[0x427b7c] /usr/local/sbin/radiusd[0x428bb9] /usr/local/sbin/radiusd(modcall+0xa1)[0x429923] /usr/local/sbin/radiusd(indexed_modcall+0x2f0)[0x424ec1] /usr/local/sbin/radiusd(process_accounting+0x22)[0x4272cd] /usr/local/sbin/radiusd(rad_accounting+0xea)[0x40e60e] /usr/local/sbin/radiusd[0x43bddd] /usr/local/sbin/radiusd[0x437bee] /lib64/libpthread.so.0[0x3be42079d1] /lib64/libc.so.6(clone+0x6d)[0x3be3ee8b6d] No panic action set _EXIT(1) CALLED src/lib/debug.c[753]. Last error was: Tue Mar 17 19:39:14 2015 : Info: Debugger not attached? What info do you need to diagnose? Thanks, Ben

2 3

Odd behavior?
by J Kephart 18 Mar '15

18 Mar '15

We're seeing a very odd occurrence on one of our radius servers. To my knowledge, it has only happened once (this morning), but it's the first time it's happened, and we're not entirely sure where to look to find the cause. We're running on a CentOS 6.6 system, with FR v2.1.12, which is the package that is distributed by CentOS/RH. Each day, the logrotate routing rotates the radius.log (and compresses it), and then restarts FR. This morning, however, the radius log showed that the process restarted, but that it did absolutely nothing for the next two hours and 13 minutes. Fri Mar 13 03:27:01 2015 : Info: HUP - loading modules Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "attr_filter.access_reject" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "attr_filter.accounting_response" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "files" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "radutmp" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "suffix" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "mschap" Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "pap" Fri Mar 13 03:27:01 2015 : Info: Loaded virtual server <default> Fri Mar 13 03:27:01 2015 : Info: Loaded virtual server inner-tunnel Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect to radius@xxxxxxxxxxxxxxxxx:3306/radius Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Connected new DB handle, #0 Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Connected new DB handle, #1 Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 ... Following these entries, normal authentication/accounting messages resumed, as they had been doing just prior. Has anyone ever run across this? Any thoughts on how we might track it down? Thanks, Jim

2 3

How to configure dynamic vlan for cisco aironet 1100 series
by Sautron Nick 18 Mar '15

18 Mar '15

Hello, I would to know, how to configure dynamic vlan for cisco aironet 1100 series without web interface please. Best regards

3 3