- Freeradius-Users - lists.freeradius.org

Radacct table is growing and growing
by Rui Ribeiro 17 Jan '14

17 Jan '14

You have to offload old historical data out of your DB, for sure. Of particular importance is using innodb_file_per_table=1. If you arent using that, better configure it, and do a dump and restore of your DB. Alternatives for offloading in MySQL are SHARDING and PARTITIONING. In the meantime, you can add the DELAYED keyword in INSERT queries. There is no point in waiting for INSERT queries and delaying the authentication. Regards -- Rui Fernando Ferreira Ribeiro senior sysadmin ISCTE-IUL > Message: 5 > Date: Fri, 17 Jan 2014 09:18:47 +0100 > From: Antonio Fern?ndez P?rez <antoniofernandez(a)fabergames.com> > To: freeradius-users <freeradius-users(a)lists.freeradius.org> > Subject: Radacct table is growing and growing > Message-ID: > <CANz54joeyD8rXnDwEgUY7+k-wLmN820tz= > 6F+wx9wi1BS8-sxA(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi everybody, > > I have a radacct table with more than 12300000 rows. I have increased RAM > memory recently because the data base is working with InnoDB engine and was > necessary to load data into the buffer. But, anybody knows some technique > that allows freeradius makes authentications with radacct historical > tables? > > I have thought in grouping rows using the UserName, keeping only one row > for each user. Also I thought in make quarterly tables but this is a proble > to authenticate users. > > Any ideas? > > Thanks in advance. > > Regards, > > Antonio. >

1 0

Directing request to virtual server
by David Aldwinckle 16 Jan '14

16 Jan '14

Hi All, I have a NAS that sends two types of Access-Requests. They are VPN login (AnyConnect or IPSec), and CLI access for the NAS. I’m trying to direct the VPN requests into the virtual server “vpn”. I would like CLI requests to be handled by realm DEFAULT, so I’m trying to catch everything that doesn’t fit that category and direct it elsewhere. Here is an example of a request: --------------------------------- Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Received Access-Request packet from host <redacted> port 1025, id=24, length=185 Tue Oct 22 07:50:46 2013 : Debug: [<thread>] User-Name = "" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] User-Password = Tue Oct 22 07:50:46 2013 : Debug: [<thread>] NAS-Port = 229748736 Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Called-Station-Id = “<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Calling-Station-Id = "<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] NAS-Port-Type = Virtual Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Tunnel-Client-Endpoint:0 = "<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] NAS-IP-Address = <redacted> Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Cisco-AVPair = "ip:source-ip=<redacted>" Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Vendor-3076-Attr-146 = 0xxxxx Tue Oct 22 07:50:46 2013 : Debug: [<thread>] Vendor-3076-Attr-150 = 0xxxxx ---------------------------------- What I am interested to know is if my way of accomplishing this task is efficient, or if there is a better way. I’m working on porting my configs to 3.0 and am striving for efficiency and simplicity. I’ve added the two nameless attributes to /etc/raddb/dictionary ATTRIBUTE CPVN3000-Tunnel-Group-Name 146 string ATTRIBUTE CPVN3000-Client-Type 150 string I created hints for each possible value of "CPVN3000-Tunnel-Group-Name” /etc/raddb/hints DEFAULT CPVN3000-Tunnel-Group-Name == “staff”, Strip-User-Name = Yes Hint = “VPN” DEFAULT CPVN3000-Tunnel-Group-Name == “guest”, Strip-User-Name = Yes Hint = “VPN” In /etc/raddb/users… DEFAULT Hint == “VPN”, Proxy-To-Realm := “VPN_REALM” And finally, in /etc/raddb/proxy.conf Realm VPN_REALM { virtual_server = “vpn” } How does that look? Regards, Dave

3 5

Version 3.0.1 has been released
by Alan DeKok 16 Jan '14

16 Jan '14

See http://freeradius.org/press/ for details. It fixes all known bugs in the 3.x series. Everyone using 3.0 should upgrade as soon as practical. Alan DeKok.

1 0

Radius and Ldap Authentication problem
by 亚坤李 16 Jan '14

16 Jan '14

Hello all, I set a radius server for wifi authentication, I can log in wifi by username and password in radius server user file using mobile phone. Then, I need to use ldap server as the backend database for user authentication, I can use radtest on radius to connect with ldap server successfully. However I can not log in to wifi by the username and password stored in ldap server. As mschapv2 is not supported by ldap, so I use ttls as the default peap method. The ldap server will only give me the information about accept or reject, but it would not reply me with a password. If possible, can anyone tell me the authentication process between ldap server and radius server. All of the above are the problem what I encountered by now, can anyone help with this, this problem really drive crazy, Thanks. Best Regards Li

4 3

Write 3GPP attributes accounting into mysql problem
by bit1 16 Jan '14

16 Jan '14

Hi Freeradius-Users May be some of you facing with this problem, but I haven't a proper solution yet. I have a freeradius 2.2.0 and mysql 5.5.28. I would like to write (and of course aggregate) accounting records into mysql db. I 'v tried to modify the dialup.conf to extract the 3GPP radius attributes as well as the standard attributes (appended extra fields, db schema modified as well). accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey, test,fullpacket) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '0','%{request:3GPP-IMSI}','%Z')" But the '%{request:3GPP-IMSI}' does not work, it is empty, however the '%Z' countains the full accounting packet. It seems the 3GPP-* runtime variable does not get value or may be the format is wrong. I'v made a not so elegant solution with mysql-udf-preg and regexped the necessary attribs from full packet , but i think it could be too slow with more attribs/inserts. Do you have any idea how to solve this issue? Dohány Tibor mailto:bit1@freemail.hu

5 21

SQL schema for radcheck table
by Matt Zagrabelny 15 Jan '14

15 Jan '14

Greetings, Looking at the file raddb/mods-config/sql/main/postgresql/schema.sql in the git repo, I see: CREATE TABLE radcheck ( id serial PRIMARY KEY, UserName text NOT NULL DEFAULT '', Attribute text NOT NULL DEFAULT '', op VARCHAR(2) NOT NULL DEFAULT '==', Value text NOT NULL DEFAULT '' ); Is the "id" field used by FR? Or does it exist for administration of the table in case someone enters two records with identical (UserName, Attribute, op, Values) values? Thanks, -mz

2 2

Gradual increase in memory usage
by Бен Томпсон 15 Jan '14

15 Jan '14

Hello everyone I have an instance of FreeRADIUS which is gradually consuming memory. The version is as follows: radiusd: FreeRADIUS Version 2.2.4 (git #b15a660), for host x86_64-unknown-linux-gnu, built on Dec 27 2013 at 12:46:27 I ran it in valgrind but I am not sure how to interprete the output: ==00:00:00:55.539 15239== 4 bytes in 1 blocks are definitely lost in loss record 1 of 547 ==00:00:00:55.539 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.540 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.540 15239== by 0x746050C: ??? ==00:00:00:55.540 15239== by 0x41A832: find_module_instance (modules.c:620) ==00:00:00:55.540 15239== by 0x41C6B2: do_compile_modsingle (modcall.c:1963) ==00:00:00:55.540 15239== by 0x41C298: do_compile_modgroup (modcall.c:2184) ==00:00:00:55.540 15239== by 0x41AB1C: T.125 (modules.c:785) ==00:00:00:55.540 15239== by 0x41AEE9: load_component_section (modules.c:887) ==00:00:00:55.540 15239== by 0x41B1DB: load_byserver (modules.c:1109) ==00:00:00:55.540 15239== by 0x41B6F4: virtual_servers_load (modules.c:1244) ==00:00:00:55.540 15239== by 0x41B93F: setup_modules (modules.c:1568) ==00:00:00:55.540 15239== by 0x419405: read_mainconfig (mainconfig.c:973) ==00:00:00:55.540 15239== ==00:00:00:55.541 15239== 32 bytes in 1 blocks are definitely lost in loss record 426 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.541 15239== by 0x746049C: ??? ==00:00:00:55.541 15239== by 0x41A832: find_module_instance (modules.c:620) ==00:00:00:55.541 15239== by 0x41C6B2: do_compile_modsingle (modcall.c:1963) ==00:00:00:55.541 15239== by 0x41C298: do_compile_modgroup (modcall.c:2184) ==00:00:00:55.541 15239== by 0x41AB1C: T.125 (modules.c:785) ==00:00:00:55.541 15239== by 0x41AEE9: load_component_section (modules.c:887) ==00:00:00:55.541 15239== by 0x41B1DB: load_byserver (modules.c:1109) ==00:00:00:55.541 15239== by 0x41B6F4: virtual_servers_load (modules.c:1244) ==00:00:00:55.541 15239== by 0x41B93F: setup_modules (modules.c:1568) ==00:00:00:55.541 15239== by 0x419405: read_mainconfig (mainconfig.c:973) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 128 bytes in 1 blocks are definitely lost in loss record 454 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76FB783: Perl_my_cxt_init (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77988CE: boot_DynaLoader (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x770E704: Perl_pp_entersub (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x770CC45: Perl_runops_standard (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76B0D0E: Perl_call_sv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76B124C: Perl_call_list (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x769D348: ??? (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76AAE91: Perl_newATTRSUB (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76A9E12: Perl_utilize (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76D8D85: Perl_yyparse (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 144 bytes in 18 blocks are definitely lost in loss record 458 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717E00: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7718A30: Perl_gp_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717F89: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7709E79: Perl_he_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7709E3A: Perl_he_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 144 bytes in 18 blocks are definitely lost in loss record 459 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76DC3F9: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77187F6: Perl_mg_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717C72: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771852F: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77176C9: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7718960: Perl_gp_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717F89: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 184 (136 direct, 48 indirect) bytes in 1 blocks are definitely lost in loss record 469 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.541 15239== by 0x410F71: listen_alloc (listen.c:1735) ==00:00:00:55.541 15239== by 0x415A8B: proxy_new_listener (listen.c:1838) ==00:00:00:55.541 15239== by 0x42C988: home_server_create_callback (realms.c:2256) ==00:00:00:55.541 15239== by 0x4E3C3D1: WalkNodeInOrder (rbtree.c:551) ==00:00:00:55.541 15239== by 0x42C952: home_server_create_listeners (realms.c:2282) ==00:00:00:55.541 15239== by 0x415FEB: listen_init (listen.c:2323) ==00:00:00:55.541 15239== by 0x428C81: radius_event_init (event.c:3701) ==00:00:00:55.541 15239== by 0x41E941: main (radiusd.c:346) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 384 bytes in 3 blocks are definitely lost in loss record 486 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77287C2: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x745E959: ??? ==00:00:00:55.541 15239== by 0x745EF78: ??? ==00:00:00:55.541 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.541 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.541 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.541 15239== by 0x41E36B: modcall (modcall.c:877) ==00:00:00:55.541 15239== by 0x41A342: indexed_modcall (modules.c:750) ==00:00:00:55.541 15239== by 0x409927: rad_authenticate (auth.c:580) ==00:00:00:55.541 15239== by 0x42B27D: radius_handle_request (event.c:3838) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 528 bytes in 2 blocks are possibly lost in loss record 497 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76DC3A5: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x745E959: ??? ==00:00:00:55.541 15239== by 0x745EF78: ??? ==00:00:00:55.541 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.541 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.541 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 1,056 bytes in 4 blocks are possibly lost in loss record 520 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76DC3F9: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x745E959: ??? ==00:00:00:55.541 15239== by 0x745EF78: ??? ==00:00:00:55.541 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.541 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.541 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 1,440 bytes in 180 blocks are definitely lost in loss record 524 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717E00: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7718A30: Perl_gp_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717F89: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7709E79: Perl_he_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== by 0x7717AE3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.541 15239== ==00:00:00:55.541 15239== 1,764 (656 direct, 1,108 indirect) bytes in 2 blocks are definitely lost in loss record 528 of 547 ==00:00:00:55.541 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.541 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.541 15239== by 0x422CEA: request_alloc (util.c:377) ==00:00:00:55.541 15239== by 0x42BD76: received_request (event.c:2980) ==00:00:00:55.541 15239== by 0x417394: auth_socket_recv (listen.c:859) ==00:00:00:55.542 15239== by 0x42C8AD: event_socket_handler (event.c:3483) ==00:00:00:55.542 15239== by 0x4E4293A: fr_event_loop (event.c:415) ==00:00:00:55.542 15239== by 0x41EA09: main (radiusd.c:422) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 1,920 bytes in 15 blocks are definitely lost in loss record 529 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77287C2: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745E959: ??? ==00:00:00:55.542 15239== by 0x745EF78: ??? ==00:00:00:55.542 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.542 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.542 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.542 15239== by 0x41E36B: modcall (modcall.c:877) ==00:00:00:55.542 15239== by 0x41A342: indexed_modcall (modules.c:750) ==00:00:00:55.542 15239== by 0x4091D7: rad_accounting (acct.c:94) ==00:00:00:55.542 15239== by 0x42B27D: radius_handle_request (event.c:3838) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 1,998 bytes in 54 blocks are definitely lost in loss record 530 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D79: Perl_savepv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B872C: Perl_gv_init (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B9543: Perl_gv_fetchpvn_flags (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76D5F10: Perl_yylex (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76D6DC5: Perl_yyparse (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77417D9: ??? (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7743284: Perl_pp_require (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x770CC45: Perl_runops_standard (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B0D0E: Perl_call_sv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745F240: ??? ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 4,752 bytes in 18 blocks are definitely lost in loss record 538 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76DC3CF: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745E959: ??? ==00:00:00:55.542 15239== by 0x745EF78: ??? ==00:00:00:55.542 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.542 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.542 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 6,402 (2,296 direct, 4,106 indirect) bytes in 7 blocks are definitely lost in loss record 540 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x422CB8: rad_malloc (util.c:347) ==00:00:00:55.542 15239== by 0x422CEA: request_alloc (util.c:377) ==00:00:00:55.542 15239== by 0x42BD76: received_request (event.c:2980) ==00:00:00:55.542 15239== by 0x416F91: acct_socket_recv (listen.c:947) ==00:00:00:55.542 15239== by 0x42C8AD: event_socket_handler (event.c:3483) ==00:00:00:55.542 15239== by 0x4E4293A: fr_event_loop (event.c:415) ==00:00:00:55.542 15239== by 0x41EA09: main (radiusd.c:422) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 15,360 bytes in 15 blocks are definitely lost in loss record 543 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x4E34B69: fr_strerror_printf (log.c:93) ==00:00:00:55.542 15239== by 0x4E3ABF2: rad_verify (radius.c:2185) ==00:00:00:55.542 15239== by 0x414896: client_socket_decode (listen.c:1336) ==00:00:00:55.542 15239== by 0x426EA3: request_pre_handler (event.c:1859) ==00:00:00:55.542 15239== by 0x42B23A: radius_handle_request (event.c:3831) ==00:00:00:55.542 15239== by 0x4221AB: request_handler_thread (threads.c:556) ==00:00:00:55.542 15239== by 0x5A7F8C9: start_thread (pthread_create.c:300) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 51,084 bytes in 1,548 blocks are definitely lost in loss record 544 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D79: Perl_savepv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B872C: Perl_gv_init (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B9543: Perl_gv_fetchpvn_flags (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76BAA87: Perl_gv_fetchsv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7716349: Perl_pp_sassign (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x770CC45: Perl_runops_standard (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B0D0E: Perl_call_sv (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76B124C: Perl_call_list (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x769D348: ??? (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76AAE91: Perl_newATTRSUB (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 131,904 bytes in 180 blocks are definitely lost in loss record 545 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717E00: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7718A30: Perl_gp_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717F89: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x77179F3: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 146,544 bytes in 2,246 blocks are definitely lost in loss record 546 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76DC3F9: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745E959: ??? ==00:00:00:55.542 15239== by 0x745EF78: ??? ==00:00:00:55.542 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.542 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.542 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== 277,664 bytes in 3,218 blocks are definitely lost in loss record 547 of 547 ==00:00:00:55.542 15239== at 0x4C244E8: malloc (vg_replace_malloc.c:236) ==00:00:00:55.542 15239== by 0x76F6C45: Perl_safesysmalloc (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76F6D06: Perl_savepvn (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x771857C: Perl_rvpv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7717627: Perl_sv_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x76DC3A5: Perl_re_dup (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x7727047: perl_clone (in /usr/lib/libperl.so.5.10.1) ==00:00:00:55.542 15239== by 0x745E959: ??? ==00:00:00:55.542 15239== by 0x745EF78: ??? ==00:00:00:55.542 15239== by 0x41D9B5: modcall_recurse (modcall.c:305) ==00:00:00:55.542 15239== by 0x41D499: modcall_child (modcall.c:423) ==00:00:00:55.542 15239== by 0x41D65F: modcall_recurse (modcall.c:628) ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== LEAK SUMMARY: ==00:00:00:55.542 15239== definitely lost: 636,590 bytes in 7,526 blocks ==00:00:00:55.542 15239== indirectly lost: 5,262 bytes in 35 blocks ==00:00:00:55.542 15239== possibly lost: 1,584 bytes in 6 blocks ==00:00:00:55.542 15239== still reachable: 85,822 bytes in 2,529 blocks ==00:00:00:55.542 15239== suppressed: 0 bytes in 0 blocks ==00:00:00:55.542 15239== Reachable blocks (those to which a pointer was found) are not shown. ==00:00:00:55.542 15239== To see them, rerun with: --leak-check=full --show-reachable=yes ==00:00:00:55.542 15239== ==00:00:00:55.542 15239== For counts of detected and suppressed errors, rerun with: -v ==00:00:00:55.542 15239== Use --track-origins=yes to see where uninitialised values come from ==00:00:00:55.542 15239== ERROR SUMMARY: 804 errors from 25 contexts (suppressed: 4 from 4) I would be grateful if anyone could take a quick glance at this output and let me know if it shows anything untoward. Ben Thompson

2 2

Accounting in MySQL - Password
by P K 15 Jan '14

15 Jan '14

Hi, This may be a simple question but I was not able to find a setting for this. Basically, I'm using freeradius with LDAP for my user base and MySQL for accounting. I've loaded schema on MySQL, configured freeradius and my two tables get populated properly (radacct and radpostauth). My Clients are using TTLS/PAP and PEAP/MSCHAP protocols. When I look in radpostauth, the "pass" field is populated in clear text when TTLS/PAP protocol is used. Is there a way to disable this or at least encrypt the password? Password logging is only a problem when we use MySQL. Freeradius Log files do not contain passwords. Thanks.

4 10

feature request: ldap enhancements
by Hachmer, Tobias 15 Jan '14

15 Jan '14

Hello Arran, you asked if I have any feature requests. So, here are two points I want to discuss: 1. reload all RADIUS clients stored in ldap on SIGHUP (bulk load) - 'radmin -e "hup ldap"' would be sufficient here 2. enhanced ldap support for storing and managing huntgroups Our goal is to restrict several users to one or more "NAS groups". It should be possible that the same NAS can be member of multiple huntgroups as well as to assign multiple huntgroups to a user. Example: huntgroup-1 NAS-IP-Address == 192.0.2.5 huntgroup-1 NAS-IP-Address == 192.0.2.6 huntgroup-1 NAS-IP-Address == 192.0.2.7 huntgroup-2 NAS-IP-Address == 192.0.2.7 huntgroup-2 NAS-IP-Address == 192.0.2.8 huntgroup-2 NAS-IP-Address == 192.0.2.9 user1 Cleartext-Password := "password1", Huntgroup-Name == "huntgroup-1" Service-Type = Administrative-User user2 Cleartext-Password := "password2", Huntgroup-Name == "huntgroup-2" Service-Type = Administrative-User user3 Cleartext-Password := "password3", Huntgroup-Name == "huntgroup-1", Huntgroup-Name == "huntgroup-2" Service-Type = Administrative-User Please pardon if the huntgroup assignment here is incorrect, I did not use huntgroups at all for now. To do this in ldap there have to be something like: a) new object class for huntgroups to distinct these from other RADIUS related objects like RADIUS clients and RADIUS profiles. I think this approach is better than adding a multi-valued attribute to the RADIUS clients object class for better clarity. b) The existing RADIUS profile object class should be extended for a multi-valued attribute to assign multiple huntgroups to a user profile. With this assumption radiusd could read all defined huntgroups on startup (reread on SIGHUP;-) ) and do the matching in authorize section after the user profile is read from ldap. Would be glad if you can give your thoughts on this or maybe some hints if this could be achieved already different. Hope this two points are not very far-fetched ;-) Regard, Tobias

3 9

"No DB handles" workaround
by Pete Ashdown 14 Jan '14

14 Jan '14

I ran into the "rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0" error shortly after switching our authentication to newly configured freeradius servers and putting load on them. In searching for a resolution to this error, I found this thread: http://freeradius.1045715.n5.nabble.com/errors-There-are-no-DB-handles-to-u… Where Alan DeKok responds with: "Your database is broken. Fix it." "The answer is always the same: Fix the database." " What part of "fix your database" is hard to understand?" "Fix your database so that it isn't too slow." Our SQL server is a 24 core, 32GB, SSD backed server with very light loads. A slowquery log showed nothing of interest, so we started looking in other directions. What we found is that if the thread pool max_servers > sql num_sql_socks this error will occur. I haven't looked at the code, but I am guessing that it is locking one SQL socket per thread, and if you have more threads than sockets, then you will start seeing this error. We set max_servers and num_sql_socks both to 15 and we haven't seen the error since. This was with freeradius v2.2.2. I hope this helps someone.

4 3