- Freeradius-Users - lists.freeradius.org

RE: dailycounter isnt started
by Sanity Computers 08 Mar '14

08 Mar '14

Guys, I found the right code from the Daloradius /sql/counter.conf. In all my googling I have not seen it like this. I found it a little tough when the wiki and Github show code that does not work for a daily-max-session. I guess there is a reason but loads of the examples out there simply don't work unless the radacct table is already populated, cheers. sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT IFNULL(SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)),0) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" Regards Jim

2 1

rlm_unix and logging of bad passwords
by Mischa Diehm 07 Mar '14

07 Mar '14

Hi, I run: freeradius-2.2.0p2 on OpenBSD 5.4 and I'm wondering how I can stop freeradius to log bad passwords to /var/log/radius/radius.log. The users are in the system password-db. I checked in rlm_unix.c where the log is happening but from there didn't figure what could be done to prevent the line from being logged: //line371ff if (fr_crypt_check((char *) request->password->vp_strvalue, (char *) vp->vp_strvalue) != 0) { radlog_request(L_AUTH, 0, request, "invalid password \"%s\"", request->password->vp_strvalue); return RLM_MODULE_REJECT; } Any hints? Thanks in advance. Mischa -- Mischa Diehm | Network Operations Center (NOC) UniBasel | UniRechenZentrum (URZ) Klingebergstr. 70 | CH-4056 Basel Tel. +41 61 267 1574 | http://urz.unibas.ch

3 2

mod_xml_radius concurrency limit
by Ričardas Stoma 07 Mar '14

07 Mar '14

I'm using mod_xml_radius module to do radius authentication and accounting. When doing stress test (using sipp), i noticed that EVERY time when the number of concurrent calls reached exactly 245, authentications started to fail. >From the logs, i see these errors appearing after 245 calls: freeswitch: rc_send_server: no reply from RADIUS server localhost.localdomain:1812, 127.0.0.1 FreeSwitch and FreeRadius are communicating over localhost. I'm using 3 servers to do this stress test. First server generates calls, seconds server does freeswitch + freeradius stuff and third servers is used for terminating calls. Calls are generated with RTP stream. Wireshark shows that freeradius is sending correct responses to every mod_xml_radius request, but after 245 calls, responses do not reach destination (i see error messages "destination port is unreachable"). When the number of concurrent calls drops below 245, new calls are authenticated correctly (until it reaches that weird 245 limit). I'm using CentOS 6 (64 bit) Does anyone know why i'm getting this weird limitation? Is this related to freeswitch? freeradius server? mod_xml_radius? freeradius-client? linux?

2 1

Failover with two different versions of FR
by Erwann Thoraval 07 Mar '14

07 Mar '14

Hi list, I have a working config with one FR 2.2.0 server. I also setup a FR 3.0.1 server for failover purpose. Accouting is done with one pgsql server. Is it safe for the acounting database to be written by two different versions of FR? (ie 2.x and 3.x) Thanks, -- Erwann

2 1

Re: dailycounter isnt started
by Sanity Computers 07 Mar '14

07 Mar '14

Sorry I thought I was clear, the debug looked absolutely normal except no sign of the counter doing its job. I have used all default settings from the wiki but I'm a bit lost to how the counter works and what I should be seeing. I found a few other users with the same problem - this chap found a solution and added to githup so I will attempt to find it. http://freeradius.1045715.n5.nabble.com/Probmels-with-sqlcounter-module-in-F reeRADIUS-2-1-12-td5713958.html The issue is when the counter first runs on the first login there is no data in radacct ... so the query has no result. Someone also said this is the query to use: query = "SELECT COALESCE( SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) ) FROM radacct WHERE username = '%{${key}}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" but that didn't work for me, I'll check github, thanks.

1 0

X11 Authentication
by Jon Spriggs 06 Mar '14

06 Mar '14

Hi, I've deployed FreeRadius and am using it without issue on web applications and SSH sessions, however, I'm trying to expand this usage into GUI logins on an Ubuntu Linux based system (using one of the LightDM, GDM or KDM login managers - any will suffice, but ideally LightDM for Unity). I realise that this is outside the normal remit of this mailing list, and I'm happy to be told to look elsewhere, but as the project shepherds the pam_radius plugin, I was wondering whether there was just some settings I needed to tweak or configure in that plugin, or even whether I'm just looking in the wrong place to support my desired outcome. Many thanks in advance, -- Jon "The Nice Guy" Spriggs

2 3

radius server presenting itself as 127.0.0.1
by Morris, Andi 06 Mar '14

06 Mar '14

Hi all, I'm working on developing a high-availability setup PacketFence, which uses freeradius to authenticate users against our internal active directory server. I've just come to implement the production self-signed certificates as laid out in http://deployingradius.com/documents/configuration/ca_import.html and when I enable the "validate server certificate" box on my windows client I am asked to accept the certificate, which is expected as I haven't deployed the CA certificate yet, however I'm seeing "127.0.0.1" presented as the radius server name in the pop up box, rather than the actual hostname. I can't seem to find why this is happening, and I'd rather that have the server hostnames in the trusted radius server list than something generic like 127.0.0.1. Can anyone please point me in the right direction? Debug log attached. Cheers, Andi

4 8

pam module / freeradius permissions
by msheiny＠seas.upenn.edu 06 Mar '14

06 Mar '14

Hello, I'm running FreeRadius 2.2.0 and am looking for advice on resolving a permissions issue I am running into with a third-party pam module. As far as freeradius goes, I have it configured how I would like - radius authentication is being checked against PAM as I intended. The problem is that this pam module I am running currently requires root permissions but I would prefer to keep radiusd running as a restricted user. I've confirmed I can get around the issue by specifying radiusd to run as root but this is not desired. So my question - what would be the best way to run the freeradius pam sub-routine as root but keep the rest of the freeradius system runnning as my restricted user? I'm trying to avoid editing source code if I can help it. I realize this is not strictly related to freeradius but figured there may be a freeradius setting I'm not familiar here. Thanks in advance for any assistance. -- --Mike

5 5

FreeRADIUS 3.0: Segfault in rlm_detail
by Julius Plenz 06 Mar '14

06 Mar '14

Hi, I'm trying to upgrade my config to FreeRADIUS 3.0, but I get reproducable segfaults in the `rlm_detail' module. I send a simple packet (User-Name, User-Password) via `radclient', and the server immediately crashes: $ bin/radiusd -xx -f -l /dev/stderr -t ... (0) auth_log : expand: "/server/devel/server/log/client/%{Client-IP-Address}/auth-%Y%m%d" -> '/server/devel/server/log/client/XXX.XXX.XX.XX/auth-20140304' (0) auth_log : /server/devel/server/log/client/%{Client-IP-Address}/auth-%Y%m%d expands to /server/devel/server/log/client/XXX.XXX.XX.XX/auth-20140304 (0) auth_log : Acquired filelock, tried 1 time(s) (0) auth_log : expand: "%S" -> '2014-03-04 14:41:14' Bad talloc magic value - unknown value [Backtrace follows] The auth_log is defined in the detail module config: $ cat etc/mods-enabled/detail ... detail auth_log { filename = ${radacctdir}/%{Client-IP-Address}/auth-%Y%m%d permissions = 0600 dir_permissions = 0700 locking = yes header = "%S" log_packet_header = yes suppress { User-Password } } ... Interesting part of GDB backtrace: #0 0x00007ffff5d891b5 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 #1 0x00007ffff5d8bfc0 in *__GI_abort () at abort.c:92 #2 0x00007ffff71380bc in ?? () from /usr/lib/libtalloc.so.2 #3 0x00007ffff7138221 in talloc_get_name () from /usr/lib/libtalloc.so.2 #4 0x00007ffff713b56b in _talloc_get_type_abort () from /usr/lib/libtalloc.so.2 #5 0x00007ffff79913b8 in vp_prints (out=0x7fffffffa751 "", outlen=1023, vp=0x7fffffffac20) at src/lib/print.c:868 #6 0x00007ffff799154a in vp_print (fp=0xd31870, vp=0x7fffffffac20) at src/lib/print.c:908 #7 0x00007ffff3523e7e in detail_write (out=0xd31870, inst=0xd16a50, request=0xd31060, packet=0xd30ee0, compat=false) at src/modules/rlm_detail/rlm_detail.c:249 #8 0x00007ffff35248c3 in detail_do (instance=0xd16a50, request=0xd31060, packet=0xd30ee0, compat=false) at src/modules/rlm_detail/rlm_detail.c:484 #9 0x00007ffff3524a5a in mod_authorize (instance=0xd16a50, request=0xd31060) at src/modules/rlm_detail/rlm_detail.c:533 #10 0x0000000000423915 in call_modsingle (component=RLM_COMPONENT_AUTZ, sp=0xd18bb0, request=0xd31060) at src/main/modcall.c:311 ... The file /server/devel/server/log/client/XXX.XXX.XX.XX/auth-20140304 is actually being created, but contains only this: 2014-03-04 14:41:14 Packet-Type = Access-Request So presumably FreeRADIUS crashes while trying to print out the Packet-Src-IP-Address...? Thanks in advance, Julius P.S.: I'm using the v3.0.x branch from a few days ago, namely 80eee20b9. Compiling against the tip of v3.0.x, eb3bfda, is not possible any more: $ make CC src/lib/cbuff.c In file included from <command-line>:0: /server/devel/src/freeradius/src/freeradius-devel/build.h:84:6: error: #error Failed determining endianness of system make: *** [build/objs/src/lib/cbuff.lo] Error 1

3 17

Anyone using Debian?
by Alan DeKok 06 Mar '14

06 Mar '14

FreeRADIUS has been removed from Debian "testing", for reasons that aren't clear. http://packages.qa.debian.org/f/freeradius.html Anyone willing to help? Alan DeKok.

4 4