- Freeradius-Users - lists.freeradius.org

RE: CPU utilization (Stefano PASCALI)
by Rui Ribeiro 02 Aug '14

02 Aug '14

Hi Arnaud, To disable it comment out radutmp and sradutmp in your sites-enabled and inner-tunnel files. Sure, fell free to email. Regards > > Date: Fri, 1 Aug 2014 17:37:04 +0200 > From: "Arnaud ." <arn0(a)live.fr> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: CPU utilization (Stefano PASCALI) > Message-ID: <DUB118-W5B4FE78DF8C0275C4EFBA9BE70(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > Hello Rui, > > I can contact you about radwtmp (as you mention below). Because I use > mysql but there is also radutmp / radwtmp archive and that I would either > disable it or empty it. Is this possible? how > > thank you > >

1 0

Freeradius authentification against Kerberos
by Benjamin Stahl 02 Aug '14

02 Aug '14

Hi, I’m a newbie with Freeserver. It is my first time with it. I try to make a configuration against Kerberos with your freeradius-server on centOS 6.5. I use FreeRadius 2.1.12 But now I got everytime the error: „no authenticate method (Auth-Type) found for the request“. So every user got a reject. I setup the server like explained at this tutorial from eduroam.us: https://www.eduroam.us/node/45 My problem is also that a PEAP - MSCHAPv2 auth from a Windows 7 - PC does not work. Can anyone help me, please? I attached the logs. Thanks, and best Benjamin.

8 15

Re: Freeradius-Users Digest, Vol 112, Issue 2
by Rui Ribeiro 01 Aug '14

01 Aug '14

Hi Mathew, I am dealing with 3.1.0, however I could swear I have this particular problem since 2.2.5. What kind of paches are you using? That seems interesting. I will answer with more details in a couple of hours. Thanks for the reply. Regards, Rui > > Message: 2 > Date: Fri, 1 Aug 2014 10:38:19 +0100 > From: Matthew Newton <mcn4(a)leicester.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: problems with reinstallation of deb packages from > repositories > Message-ID: <20140801093819.GC20472(a)rootmail.cc.le.ac.uk> > Content-Type: text/plain; charset=us-ascii > > On Fri, Aug 01, 2014 at 01:15:05AM +0100, Rui Ribeiro wrote: > > It is just me, or have people noticed problems while creating debs from > > freeradius.org and upgrading them from (local) repositories? > > Do this here with a local repository, and don't have a problem. > Currently running a fairly recent 2.x with some cherry-picked > patches. > > Giving version numbers you're dealing with (upgrade from, to) and > any appropriate debugging/console output might give people here > more to go on than guess what the problem is. > > Cheers, > > Matthew > >

2 1

Transcribe RADIUS pcap while replacing secret?
by Brian Julin 01 Aug '14

01 Aug '14

I have the need to take a PCAP file and, without any other rewriting than is necessary, transcribe all the packets with a new secret so I don't have to expose a production secret to a third-party TAC working to debug an issue. Anyone ever done that and care to share how? -- Brian S. Julin Network Administrator Clark University

1 0

CPU utilization
by Stefano PASCALI 01 Aug '14

01 Aug '14

Hi FR folks, I got a strange cpu load on my FR installation. Sometimes CPU utilization rises to 100% and FR service doesn't respond anymore to the clients. I got two virtual servers enabled: default and inner-tunnel and their configurations are the provided ones by the FR installation. Configuration details in the following: OS: Ubuntu server 14.04 Deamon: freeradius 2.1.12+dfsg-1.2ubuntu8 amd64 2 vcpu RAM 4GB Users on freeradius MySQL (5.x) DB installed on a different virtual host on the same hosting server. Hosting server (Ubuntu server 14.04 + Xen 4.3) HP PL G5 CPU: 2 x Intel(R) Xeon(R) CPU E7330 @ 2.40GHz - cpu cores 4; [total cores 2x4 = 8] RAM 16GiB Do you have any ideas to solve my issue? Hope someone help me. Regards Stefano

3 2

Policy to Respond to Accounting Packets
by Anthony McGarry 01 Aug '14

01 Aug '14

Hi, I receive CDRs from a gateway. There are two types SS7 and SIP I want to insert the SS7 and discard the SIP. However I need to respond to the gateway with an Accounting-Response for these SIP records or it will failover. I have tried this below deny_img_sip_acct { if (Dialogic-call-type =~ /SIP/) { update control { Response-Packet-Type := Accounting-Response } handled } } based on the do_not_respond template. It stops the SIP from being wrote to the DB but it is not sending the response. Is there a way to force a response? Anthony See below SS7 and SIP request \\\\\SIP Ready to process requests. rad_recv: Accounting-Request packet from host 10.101.20.201 port 1813, id=5, length=630 NAS-IP-Address = 10.101.20.201 NAS-Port = 1813 Calling-Station-Id = "499529638" Called-Station-Id = "ad061203407" Acct-Session-Id = "00201c1428fa008e00e213db832d4d0c1297" Acct-Status-Type = Start NAS-Port-Type = Ethernet Service-Type = Login-User Dialogic-call-origin = "answer" Dialogic-call-type = "SIP" Acct-Delay-Time = 6 Login-IP-Host = 10.101.20.96 Tunnel-Client-Endpoint:0 = "10.101.20.201" Dialogic-setup-time = "FRI AUG 01 13:08:14:285 2014" Dialogic-connect-time = "FRI AUG 01 13:08:14:295 2014" Dialogic-dnis-post-translate = "ad061203407" Dialogic-ani-post-translate = "499529638" Dialogic-call-direction = "OUTGOING LEG" Dialogic-trunk-grp-out = "cs03" Dialogic-next-hop-ip = "10.101.23.112" Dialogic-outgoing-req-uri = "sip:ad061203407@10.101.23.112" Dialogic-next-hop-dn = "10.101.23.112" Dialogic-call-id = "732a-408-71201412813-IMG1_DEG-1-10.101.23.201" Dialogic-voip-dst-sig-ip-out = "10.101.23.112" Dialogic-voip-dst-rtp-ip-out = "10.101.24.112" Dialogic-voip-src-rtp-ip-out = "10.101.24.201" Dialogic-voip-src-sig-ip-out = "10.101.23.201" Dialogic-voip-local-vocoders = "PCMA,PCMU,CLEARMODE,G729,telephone-event" Dialogic-voip-remote-vocoders = "PCMA,telephone-event" Dialogic-voip-codec-priority = "Local" Dialogic-span-id = "4160" Dialogic-channel-id = "8" server img1010 { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/raddb/radiusd.conf +- entering group accounting {...} ++- entering policy deny_img_sip_acct {...} +++? if (Dialogic-call-type =~ /SIP/) ? Evaluating (Dialogic-call-type =~ /SIP/) -> TRUE +++? if (Dialogic-call-type =~ /SIP/) -> TRUE +++- entering if (Dialogic-call-type =~ /SIP/) {...} ++++[control] returns noop ++++[handled] returns handled +++- if (Dialogic-call-type =~ /SIP/) returns handled ++- policy deny_img_sip_acct returns handled } # server img1010 Finished request 4. Cleaning up request 4 ID 5 with timestamp +24 Going to the next request \\\\SS7 Ready to process requests. rad_recv: Accounting-Request packet from host 10.101.20.201 port 1813, id=7, length=433 NAS-IP-Address = 10.101.20.201 NAS-Port = 1813 Calling-Station-Id = "871515967" Called-Station-Id = "17533010214548704f" Acct-Session-Id = "00201c1428fa009d000413db826a53181331" Acct-Session-Time = 206 Acct-Status-Type = Stop Acct-Terminate-Cause = NAS-Request NAS-Port-Type = Ethernet Service-Type = Login-User Dialogic-call-origin = "originate" Dialogic-call-type = "SS7" Dialogic-Q931-disconnect-cause = "10" Acct-Delay-Time = 0 Login-IP-Host = 10.101.20.96 Tunnel-Client-Endpoint:0 = "10.101.20.201" Dialogic-setup-time = "FRI AUG 01 13:04:58:108 2014" Dialogic-connect-time = "FRI AUG 01 13:05:02:258 2014" Dialogic-disconnect-time = "FRI AUG 01 13:08:27:948 2014" Dialogic-release-source = "CALLED PARTY RELEASE,Remote" Dialogic-dnis-pre-translate = "ad0214548704" Dialogic-ani-pre-translate = "871515967" Dialogic-call-direction = "INCOMING LEG" Dialogic-trunk-grp-in = “Trunk" Dialogic-span-id = "2" Dialogic-channel-id = "11" server img1010 { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/raddb/radiusd.conf +- entering group accounting {...} ++- entering policy deny_img_sip_acct {...} +++? if (Dialogic-call-type =~ /SIP/) ? Evaluating (Dialogic-call-type =~ /SIP/) -> FALSE +++? if (Dialogic-call-type =~ /SIP/) -> FALSE ++- policy deny_img_sip_acct returns noop [sql_virtual_1] expand: UPDATE radacct SET acctsessiontime = '%{Acct-Session-Time}', disconnecttime = '%{Dialogic-disconnect-time}' WHERE acctsessionid = '%{Acct-Session-Id}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctsessiontime = '206', disconnecttime = 'FRI AUG 01 13:08:27:948 2014' WHERE acctsessionid = '00201c1428fa009d000413db826a53181331' AND nasipaddress = '10.101.20.201' [sql_virtual_1] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql_virtual_1): Reserving sql socket id: 3 rlm_sql_mysql: query: UPDATE radacct SET acctsessiontime = '206', disconnecttime = 'FRI AUG 01 13:08:27:948 2014' WHERE acctsessionid = '00201c1428fa009d000413db826a53181331' AND nasipaddress = '10.101.20.201' [sql_virtual_1] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, nasipaddress, setuptime, connecttime, disconnecttime, callingstationid, calledstationid, trunkgroupin, trunkgroupout, spanid, channelid, calldirection) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{NAS-IP-Address}', '%{Dialogic-setup-time}', '%{Dialogic-connect-time}', '%{Dialogic-disconnect-time}', '%{Calling-Station-Id}', '%{Called-Station-Id}', '%{Dialogic-trunk-grp-in}', '%{Dialogic-trunk-grp-out}', '%{Dialogic-span-id}', '%{Dialogic-channel-id}', '%{Dialogic-call-direction}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, nasipaddress, setuptime, connecttime, disconnecttime, callingst [sql_virtual_1] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, nasipaddress, setuptime, connecttime, disconnecttime, callingstationid, calledstationid, trunkgroupin, trunkgroupout, spanid, channelid, calldirection) VALUES ('00201c1428fa009d000413db826a53181331', '', '10.101.20.201', 'FRI AUG 01 13:04:58:108 2014', 'FRI AUG 01 13:05:02:258 2014', 'FRI AUG 01 13:08:27:948 2014', '871515967', '17533010214548704f', ’Trunk', '', '2', '11', 'INCOMING LEG') rlm_sql (sql_virtual_1): Released sql socket id: 3 ++[sql_virtual_1] returns ok } # server img1010 Sending Accounting-Response of id 7 to 10.101.20.201 port 1813 Finished request 6. Cleaning up request 6 ID 7 with timestamp +33 Going to the next request

1 0

Re: Freeradius-Users Digest, Vol 112, Issue 1
by Rui Ribeiro 01 Aug '14

01 Aug '14

Hello Stefano, 2.12 is quite old, and is has several bugs. Why not update it to at least 2.2.5? As for problems, there is a know bug when using mschap in 2.1.12, that often freeradius stops answering requests after a reload when rotating logs. You have to edit /etc/logrotate.d/freeradius and change the reload for a restart if that is your case. Another probable source of cpu/ I/O load is radwtmp and similar files, as they grow and are not rotated per the default configuration. I dont use them, I rely on the (My)SQL data. Hope these tips help you in some way. You are welcome to ask me any questions. Regards, Rui > Message: 7 > Date: Fri, 1 Aug 2014 10:57:48 +0200 > From: Stefano PASCALI <stefano.pascali(a)unisalento.it> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: CPU utilization > Message-ID: <488B69B7-9992-4940-B9D0-04A1DD6CD698(a)unisalento.it> > Content-Type: text/plain; charset=us-ascii > > Hi FR folks, > > I got a strange cpu load on my FR installation. Sometimes CPU utilization > rises to 100% and FR service doesn't respond anymore to the clients. I got > two virtual servers enabled: default and inner-tunnel and their > configurations are the provided ones by the FR installation. > Configuration details in the following: > > OS: Ubuntu server 14.04 > Deamon: freeradius 2.1.12+dfsg-1.2ubuntu8 amd64 > 2 vcpu > RAM 4GB > > Users on freeradius MySQL (5.x) DB installed on a different virtual host > on the same hosting server. > > Hosting server (Ubuntu server 14.04 + Xen 4.3) HP PL G5 > CPU: 2 x Intel(R) Xeon(R) CPU E7330 @ 2.40GHz - cpu cores 4; [total cores > 2x4 = 8] > RAM 16GiB > > Do you have any ideas to solve my issue? > Hope someone help me. > > Regards > Stefano > >

1 0

migration to rlm_perl with two user domains setup
by Saša Babić 01 Aug '14

01 Aug '14

Hi. My situation: - freeradius 2.1.12 on debian, - eap/ttls setup (eduroam) by someone who doesn't work here any more, - pretty vague understanding of freeradius, I'm affraid, - two separate groups of users (employees and students); user accounts in AD and in Postgresql, - two virtual servers: eduroam & eduroam-inner-tunnel, - each group uses its own domain for authentication (e.g. user(a)example.edu & user(a)sub.example.edu) Right now I have a Ruby script which I planted instead of ntlm_auth (called by eduroam-inner-tunnel) that does the actual work. At the moment, the script accepts non-stripped User-Name, matches the domain and calls the appropriate method. Obviously not the most elegant solution, but it works. Now I want to migrate the script to Perl and use rlm_perl, since it looks like rlm_ruby is not that mature. If I understood correctly the way freeradius/rlm_perl works, the database connection should be set inside a CLONE() subroutine. Since my script connects to two different types of databases (LDAP & Postgresql), I'm thinking that it would be more elegant to use different virtual servers (per domain) with two different scripts. That way each virtual server would call a separate script (or rlm_perl module in the future), and each script could have its own CLONE() subroutine. The confusing part is that eduroam-inner-tunnel virtual server is set in eap.conf in the ttls {} section. Can I do some sort of workflow controll there so that the actual virtual server is determined by the user's domain? Or is there a better way to do it? BTW, I'm planning to migrate to freeradius 3.0.x at the same time, so any hints and/or examples for that version are more then welcome. Thanks. Regards, -- Saša

1 0

problems with reinstallation of deb packages from repositories
by Rui Ribeiro 01 Aug '14

01 Aug '14

Hi, It is just me, or have people noticed problems while creating debs from freeradius.org and upgrading them from (local) repositories? Whilst upgrading with debs from command line (dpkg -i), normally works ok, installing them with apt/aptitude install normally breaks the configuration to a point I have to recover /etc/freeradius from backups to be back on track. I have noticed this since setting up a local apt/deb repository. Has anyone noticed this? Regards, Rui

2 1

Reduce the sleep time?
by khali singh 01 Aug '14

01 Aug '14

Hi I am running a freeradius server that is proxying my requests to another radius server. The other radius server supports a special proble message to indicate to a connecting supplicant that it supports a particular EAP method. IT simply results in a FAILURE to the authentication request indicating that it does support this EAP method and it can try with correct credentials. However, the proxying freeradius server shows : Debug: Waking up in 4.9 seconds. . . . . Debug: Waking up in 103.9 seconds. My question is, how can I reduce these times? I use UDP and not TCP? IS there some configuration that I can change or can I compile my own custom version! Khali

2 1