- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 112, Issue 2
by Rui Ribeiro 01 Aug '14

01 Aug '14

Hi Mathew, I am dealing with 3.1.0, however I could swear I have this particular problem since 2.2.5. What kind of paches are you using? That seems interesting. I will answer with more details in a couple of hours. Thanks for the reply. Regards, Rui > > Message: 2 > Date: Fri, 1 Aug 2014 10:38:19 +0100 > From: Matthew Newton <mcn4(a)leicester.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: problems with reinstallation of deb packages from > repositories > Message-ID: <20140801093819.GC20472(a)rootmail.cc.le.ac.uk> > Content-Type: text/plain; charset=us-ascii > > On Fri, Aug 01, 2014 at 01:15:05AM +0100, Rui Ribeiro wrote: > > It is just me, or have people noticed problems while creating debs from > > freeradius.org and upgrading them from (local) repositories? > > Do this here with a local repository, and don't have a problem. > Currently running a fairly recent 2.x with some cherry-picked > patches. > > Giving version numbers you're dealing with (upgrade from, to) and > any appropriate debugging/console output might give people here > more to go on than guess what the problem is. > > Cheers, > > Matthew > >

2 1

Transcribe RADIUS pcap while replacing secret?
by Brian Julin 01 Aug '14

01 Aug '14

I have the need to take a PCAP file and, without any other rewriting than is necessary, transcribe all the packets with a new secret so I don't have to expose a production secret to a third-party TAC working to debug an issue. Anyone ever done that and care to share how? -- Brian S. Julin Network Administrator Clark University

1 0

CPU utilization
by Stefano PASCALI 01 Aug '14

01 Aug '14

Hi FR folks, I got a strange cpu load on my FR installation. Sometimes CPU utilization rises to 100% and FR service doesn't respond anymore to the clients. I got two virtual servers enabled: default and inner-tunnel and their configurations are the provided ones by the FR installation. Configuration details in the following: OS: Ubuntu server 14.04 Deamon: freeradius 2.1.12+dfsg-1.2ubuntu8 amd64 2 vcpu RAM 4GB Users on freeradius MySQL (5.x) DB installed on a different virtual host on the same hosting server. Hosting server (Ubuntu server 14.04 + Xen 4.3) HP PL G5 CPU: 2 x Intel(R) Xeon(R) CPU E7330 @ 2.40GHz - cpu cores 4; [total cores 2x4 = 8] RAM 16GiB Do you have any ideas to solve my issue? Hope someone help me. Regards Stefano

3 2

Policy to Respond to Accounting Packets
by Anthony McGarry 01 Aug '14

01 Aug '14

Hi, I receive CDRs from a gateway. There are two types SS7 and SIP I want to insert the SS7 and discard the SIP. However I need to respond to the gateway with an Accounting-Response for these SIP records or it will failover. I have tried this below deny_img_sip_acct { if (Dialogic-call-type =~ /SIP/) { update control { Response-Packet-Type := Accounting-Response } handled } } based on the do_not_respond template. It stops the SIP from being wrote to the DB but it is not sending the response. Is there a way to force a response? Anthony See below SS7 and SIP request \\\\\SIP Ready to process requests. rad_recv: Accounting-Request packet from host 10.101.20.201 port 1813, id=5, length=630 NAS-IP-Address = 10.101.20.201 NAS-Port = 1813 Calling-Station-Id = "499529638" Called-Station-Id = "ad061203407" Acct-Session-Id = "00201c1428fa008e00e213db832d4d0c1297" Acct-Status-Type = Start NAS-Port-Type = Ethernet Service-Type = Login-User Dialogic-call-origin = "answer" Dialogic-call-type = "SIP" Acct-Delay-Time = 6 Login-IP-Host = 10.101.20.96 Tunnel-Client-Endpoint:0 = "10.101.20.201" Dialogic-setup-time = "FRI AUG 01 13:08:14:285 2014" Dialogic-connect-time = "FRI AUG 01 13:08:14:295 2014" Dialogic-dnis-post-translate = "ad061203407" Dialogic-ani-post-translate = "499529638" Dialogic-call-direction = "OUTGOING LEG" Dialogic-trunk-grp-out = "cs03" Dialogic-next-hop-ip = "10.101.23.112" Dialogic-outgoing-req-uri = "sip:ad061203407@10.101.23.112" Dialogic-next-hop-dn = "10.101.23.112" Dialogic-call-id = "732a-408-71201412813-IMG1_DEG-1-10.101.23.201" Dialogic-voip-dst-sig-ip-out = "10.101.23.112" Dialogic-voip-dst-rtp-ip-out = "10.101.24.112" Dialogic-voip-src-rtp-ip-out = "10.101.24.201" Dialogic-voip-src-sig-ip-out = "10.101.23.201" Dialogic-voip-local-vocoders = "PCMA,PCMU,CLEARMODE,G729,telephone-event" Dialogic-voip-remote-vocoders = "PCMA,telephone-event" Dialogic-voip-codec-priority = "Local" Dialogic-span-id = "4160" Dialogic-channel-id = "8" server img1010 { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/raddb/radiusd.conf +- entering group accounting {...} ++- entering policy deny_img_sip_acct {...} +++? if (Dialogic-call-type =~ /SIP/) ? Evaluating (Dialogic-call-type =~ /SIP/) -> TRUE +++? if (Dialogic-call-type =~ /SIP/) -> TRUE +++- entering if (Dialogic-call-type =~ /SIP/) {...} ++++[control] returns noop ++++[handled] returns handled +++- if (Dialogic-call-type =~ /SIP/) returns handled ++- policy deny_img_sip_acct returns handled } # server img1010 Finished request 4. Cleaning up request 4 ID 5 with timestamp +24 Going to the next request \\\\SS7 Ready to process requests. rad_recv: Accounting-Request packet from host 10.101.20.201 port 1813, id=7, length=433 NAS-IP-Address = 10.101.20.201 NAS-Port = 1813 Calling-Station-Id = "871515967" Called-Station-Id = "17533010214548704f" Acct-Session-Id = "00201c1428fa009d000413db826a53181331" Acct-Session-Time = 206 Acct-Status-Type = Stop Acct-Terminate-Cause = NAS-Request NAS-Port-Type = Ethernet Service-Type = Login-User Dialogic-call-origin = "originate" Dialogic-call-type = "SS7" Dialogic-Q931-disconnect-cause = "10" Acct-Delay-Time = 0 Login-IP-Host = 10.101.20.96 Tunnel-Client-Endpoint:0 = "10.101.20.201" Dialogic-setup-time = "FRI AUG 01 13:04:58:108 2014" Dialogic-connect-time = "FRI AUG 01 13:05:02:258 2014" Dialogic-disconnect-time = "FRI AUG 01 13:08:27:948 2014" Dialogic-release-source = "CALLED PARTY RELEASE,Remote" Dialogic-dnis-pre-translate = "ad0214548704" Dialogic-ani-pre-translate = "871515967" Dialogic-call-direction = "INCOMING LEG" Dialogic-trunk-grp-in = “Trunk" Dialogic-span-id = "2" Dialogic-channel-id = "11" server img1010 { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/raddb/radiusd.conf +- entering group accounting {...} ++- entering policy deny_img_sip_acct {...} +++? if (Dialogic-call-type =~ /SIP/) ? Evaluating (Dialogic-call-type =~ /SIP/) -> FALSE +++? if (Dialogic-call-type =~ /SIP/) -> FALSE ++- policy deny_img_sip_acct returns noop [sql_virtual_1] expand: UPDATE radacct SET acctsessiontime = '%{Acct-Session-Time}', disconnecttime = '%{Dialogic-disconnect-time}' WHERE acctsessionid = '%{Acct-Session-Id}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctsessiontime = '206', disconnecttime = 'FRI AUG 01 13:08:27:948 2014' WHERE acctsessionid = '00201c1428fa009d000413db826a53181331' AND nasipaddress = '10.101.20.201' [sql_virtual_1] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql_virtual_1): Reserving sql socket id: 3 rlm_sql_mysql: query: UPDATE radacct SET acctsessiontime = '206', disconnecttime = 'FRI AUG 01 13:08:27:948 2014' WHERE acctsessionid = '00201c1428fa009d000413db826a53181331' AND nasipaddress = '10.101.20.201' [sql_virtual_1] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, nasipaddress, setuptime, connecttime, disconnecttime, callingstationid, calledstationid, trunkgroupin, trunkgroupout, spanid, channelid, calldirection) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{NAS-IP-Address}', '%{Dialogic-setup-time}', '%{Dialogic-connect-time}', '%{Dialogic-disconnect-time}', '%{Calling-Station-Id}', '%{Called-Station-Id}', '%{Dialogic-trunk-grp-in}', '%{Dialogic-trunk-grp-out}', '%{Dialogic-span-id}', '%{Dialogic-channel-id}', '%{Dialogic-call-direction}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, nasipaddress, setuptime, connecttime, disconnecttime, callingst [sql_virtual_1] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, nasipaddress, setuptime, connecttime, disconnecttime, callingstationid, calledstationid, trunkgroupin, trunkgroupout, spanid, channelid, calldirection) VALUES ('00201c1428fa009d000413db826a53181331', '', '10.101.20.201', 'FRI AUG 01 13:04:58:108 2014', 'FRI AUG 01 13:05:02:258 2014', 'FRI AUG 01 13:08:27:948 2014', '871515967', '17533010214548704f', ’Trunk', '', '2', '11', 'INCOMING LEG') rlm_sql (sql_virtual_1): Released sql socket id: 3 ++[sql_virtual_1] returns ok } # server img1010 Sending Accounting-Response of id 7 to 10.101.20.201 port 1813 Finished request 6. Cleaning up request 6 ID 7 with timestamp +33 Going to the next request

1 0

Re: Freeradius-Users Digest, Vol 112, Issue 1
by Rui Ribeiro 01 Aug '14

01 Aug '14

Hello Stefano, 2.12 is quite old, and is has several bugs. Why not update it to at least 2.2.5? As for problems, there is a know bug when using mschap in 2.1.12, that often freeradius stops answering requests after a reload when rotating logs. You have to edit /etc/logrotate.d/freeradius and change the reload for a restart if that is your case. Another probable source of cpu/ I/O load is radwtmp and similar files, as they grow and are not rotated per the default configuration. I dont use them, I rely on the (My)SQL data. Hope these tips help you in some way. You are welcome to ask me any questions. Regards, Rui > Message: 7 > Date: Fri, 1 Aug 2014 10:57:48 +0200 > From: Stefano PASCALI <stefano.pascali(a)unisalento.it> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: CPU utilization > Message-ID: <488B69B7-9992-4940-B9D0-04A1DD6CD698(a)unisalento.it> > Content-Type: text/plain; charset=us-ascii > > Hi FR folks, > > I got a strange cpu load on my FR installation. Sometimes CPU utilization > rises to 100% and FR service doesn't respond anymore to the clients. I got > two virtual servers enabled: default and inner-tunnel and their > configurations are the provided ones by the FR installation. > Configuration details in the following: > > OS: Ubuntu server 14.04 > Deamon: freeradius 2.1.12+dfsg-1.2ubuntu8 amd64 > 2 vcpu > RAM 4GB > > Users on freeradius MySQL (5.x) DB installed on a different virtual host > on the same hosting server. > > Hosting server (Ubuntu server 14.04 + Xen 4.3) HP PL G5 > CPU: 2 x Intel(R) Xeon(R) CPU E7330 @ 2.40GHz - cpu cores 4; [total cores > 2x4 = 8] > RAM 16GiB > > Do you have any ideas to solve my issue? > Hope someone help me. > > Regards > Stefano > >

1 0

migration to rlm_perl with two user domains setup
by Saša Babić 01 Aug '14

01 Aug '14

Hi. My situation: - freeradius 2.1.12 on debian, - eap/ttls setup (eduroam) by someone who doesn't work here any more, - pretty vague understanding of freeradius, I'm affraid, - two separate groups of users (employees and students); user accounts in AD and in Postgresql, - two virtual servers: eduroam & eduroam-inner-tunnel, - each group uses its own domain for authentication (e.g. user(a)example.edu & user(a)sub.example.edu) Right now I have a Ruby script which I planted instead of ntlm_auth (called by eduroam-inner-tunnel) that does the actual work. At the moment, the script accepts non-stripped User-Name, matches the domain and calls the appropriate method. Obviously not the most elegant solution, but it works. Now I want to migrate the script to Perl and use rlm_perl, since it looks like rlm_ruby is not that mature. If I understood correctly the way freeradius/rlm_perl works, the database connection should be set inside a CLONE() subroutine. Since my script connects to two different types of databases (LDAP & Postgresql), I'm thinking that it would be more elegant to use different virtual servers (per domain) with two different scripts. That way each virtual server would call a separate script (or rlm_perl module in the future), and each script could have its own CLONE() subroutine. The confusing part is that eduroam-inner-tunnel virtual server is set in eap.conf in the ttls {} section. Can I do some sort of workflow controll there so that the actual virtual server is determined by the user's domain? Or is there a better way to do it? BTW, I'm planning to migrate to freeradius 3.0.x at the same time, so any hints and/or examples for that version are more then welcome. Thanks. Regards, -- Saša

1 0

problems with reinstallation of deb packages from repositories
by Rui Ribeiro 01 Aug '14

01 Aug '14

Hi, It is just me, or have people noticed problems while creating debs from freeradius.org and upgrading them from (local) repositories? Whilst upgrading with debs from command line (dpkg -i), normally works ok, installing them with apt/aptitude install normally breaks the configuration to a point I have to recover /etc/freeradius from backups to be back on track. I have noticed this since setting up a local apt/deb repository. Has anyone noticed this? Regards, Rui

2 1

Reduce the sleep time?
by khali singh 01 Aug '14

01 Aug '14

Hi I am running a freeradius server that is proxying my requests to another radius server. The other radius server supports a special proble message to indicate to a connecting supplicant that it supports a particular EAP method. IT simply results in a FAILURE to the authentication request indicating that it does support this EAP method and it can try with correct credentials. However, the proxying freeradius server shows : Debug: Waking up in 4.9 seconds. . . . . Debug: Waking up in 103.9 seconds. My question is, how can I reduce these times? I use UDP and not TCP? IS there some configuration that I can change or can I compile my own custom version! Khali

2 1

Multivalued attributes
by Franks Andy (RLZ) IT Systems Engineer 31 Jul '14

31 Jul '14

Hi, I just read in a post where Phil Mayers commented on some much needed (imho) functionality of FR. Maybe it's in there and I don't know, but he added in multivalue attribute comparisons : >> * |== At least one attribute should equal the value >> * &== All attributes should equal the value >> * |=~ At least one attribute should match the regular expression >> * &=~ All attributes should match the regular expression This would help me in my random thrashing of the ldap servers to check against lots of groups - I already populate a multivalue attributes "Ldap-MemberOf" and this would let me test against it nicely without foreach. Problem is that it doesn't work now: .. |== .. ^ Invalid text. Expected comparison operator Has it been removed from recent releases, and if so, how can I get it back ? Thanks Andy

5 13

Unlang access to use_tunneled_reply?
by Stefan Paetow 31 Jul '14

31 Jul '14

Just out of interest... is there any way I can access the use_tunneled_reply option (in eap) from unlang? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 2