- Freeradius-Users - lists.freeradius.org

3.0.0 'Null value in first column' in unixodbc xlat
by Michael Rigoni 23 Oct '13

23 Oct '13

Hi list, I am trying to update a FreeRADIUS deployment on RHEL5 to version 3.0.0. This configuration used to work with FreeRADIUS 3.0 dev branch from October 2012... It uses UnixODBC to connect to MSSQL db (tried it with posgresql odbc driver and does the same). To pin down the issue, I have set up a new deployment of FR with latest v3.0.x branch and did the following set up: * ./configure * make * make install * enabled sql module (see attachment) * added the following lines to sites enabled/default, just after 'preprocess' in 'authorize' section: update reply { Tmp-String-0 := "%{sql:SELECT username from mytest WHERE csid = '%{Calling-Station-Id}'}" } * Commented out the '-sql' in authorize section (was making FR segfault, certainly because the SQL tables mentionned in 'queries.conf' did not exist). On first request (see also full debug attached), it gets the value correctly: Tue Oct 22 05:39:55 2013 : Debug: rlm_sql (sql): Reserved connection (4) Tue Oct 22 05:39:55 2013 : Debug: rlm_sql (sql): Executing query: 'SELECT username from mytest WHERE csid = 'FFFFFFFFFFF0'' Tue Oct 22 05:39:55 2013 : Debug: (0) sql_xlat finished Tue Oct 22 05:39:55 2013 : Debug: rlm_sql (sql): Released connection (4) Tue Oct 22 05:39:55 2013 : Info: rlm_sql (sql): Closing connection (0): Too many free connections (5 > 3) Tue Oct 22 05:39:55 2013 : Debug: rlm_sql_unixodbc: Socket destructor called, closing socket Tue Oct 22 05:39:55 2013 : Debug: (0) *expand: "%{sql:SELECT username from mytest WHERE csid = '%{Calling-Station-Id}'}" -> 'test'* But one second request, it fails (returns empty string) saying '*Null value in first column*': Tue Oct 22 05:41:36 2013 : Debug: rlm_sql (sql): Executing query: 'SELECT username from mytest WHERE csid = 'FFFFFFFFFFF0'' Tue Oct 22 05:41:36 2013 : Debug: (1) *Null value in first column* Tue Oct 22 05:41:36 2013 : Debug: rlm_sql (sql): Released connection (4) Tue Oct 22 05:41:36 2013 : Info: rlm_sql (sql): Closing connection (1): Too many free connections (4 > 3) Tue Oct 22 05:41:36 2013 : Debug: rlm_sql_unixodbc: Socket destructor called, closing socket Tue Oct 22 05:41:36 2013 : Info: rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 123 seconds Tue Oct 22 05:41:36 2013 : rlm_sql (sql): You probably need to lower "min" Tue Oct 22 05:41:36 2013 : Debug: rlm_sql_unixodbc: Socket destructor called, closing socket Tue Oct 22 05:41:36 2013 : Info: rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 123 seconds Tue Oct 22 05:41:36 2013 : Debug: rlm_sql_unixodbc: Socket destructor called, closing socket Tue Oct 22 05:41:36 2013 : Debug: (1) expand:*"%{sql:SELECT username from mytest WHERE csid = '%{Calling-Station-Id}'}" -> ''** * Sometimes it works with further requests, sometimes not... It seems to work when a new connection to DB is made: Tue Oct 22 06:20:44 2013 : Debug: rlm_sql (sql): Released connection (5) Tue Oct 22 06:20:44 2013 : Info: rlm_sql (sql): *Opening additional connection* (6) Tue Oct 22 06:20:44 2013 : Debug: (8) expand: "%{sql:SELECT username from mytest WHERE csid = '%{Calling-Station-Id}'}" -> 'test' Tue Oct 22 06:20:44 2013 : Debug: (8) Tmp-String-0 := "test" I did mess around a bit with src/modules/rlm_sql/drivers/rlm_sql_unixodbc/rlm_sql_unixodbc.c to check the return value of 'SQLExecDirect' line 163. When it works, it returns 0 and when it fails -2 (invalid handle ?). The rest of the code is beyond my comprehension :) Any ideas how to fix this ? Michael

1 0

Trouble with group checking against Samba4
by Arthur Ramsey 23 Oct '13

23 Oct '13

I'm having trouble getting group membership to work against Samba4 (Active Directory). It doesn't appear to be running the search (&(objectClass=group)(member=%{control:Ldap-UserDn})). I've googled and found others with the same issue, but I don't see the same configuration mistakes that they had made. modules/ldap <http://pastebin.com/Bw5AUn89> users <http://pastebin.com/H44gW7uT> debug output <http://pastebin.com/YTFDTCy6> -- Arthur Ramsey Systems Administrator Mediture arthur_ramsey(a)mediture.com 952.400.0323 This e-mail and any attachments may contain CONFIDENTIAL information, including PROTECTED HEALTH INFORMATION. If you are not the intended recipient, any use or disclosure of this information is STRICTLY PROHIBITED; you are requested to delete this e-mail and any attachments, notify the sender immediately, and notify the Mediture Privacy Officer atprivacyofficer(a)mediture.com.

2 2

Sql mac authentication, module not instantiated
by Bertalan Voros 22 Oct '13

22 Oct '13

Hello All, I am trying to do this: if (Called-Station-ID =~ /:ssid$/) { rewrite_calling_station_id if(!"%{sql_mac:SELECT COUNT(*) FROM 'arguswifi.macaddress' WHERE mac = '%{Calling-Station-ID}' = 1}"){ reject } } But getting the following in -X: WARNING: Unknown module "sql_mac" in string expansion "%" Also if I look through the debug log there seems to be no mentioning of sql_mac. sql.conf is uncommented in radiusd.conf. My sql.conf: sql sql_mac { database = "mysql" driver = "rlm_sql_${database}" server = "mysql.server" login = "dbuser" password = "dpPwd" radius_db = "macdb" sqltrace = yes sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = 5 connect_failure_retry_delay = 60 lifetime = 0 max_queries = 0 } What am I doing wrong? Thanks again, Bertalan

2 3

Acct-Status-Type = Failed, mysql
by Miha 22 Oct '13

22 Oct '13

Hi, is there any mysql Insert for dialup.conf if Acct-Status-Type = Failed? thanks! miha

2 2

Incorrect NAS-IP-Address attribute
by Morris, Andi 22 Oct '13

22 Oct '13

Hi all, Can somebody tell me where the NAS-IP-Address attribute is pulled from? I have one particular switch that has a different IP address in this attribute to the actual switch's IP address, and therefore radius rejects the request as this IP address isn't a declared client. All my other switches are working fine so the radius server is fine in general. I'm just not sure whether this is set on the radius server, or the switch. I can't find it on either. Here's a debug log snippet: rad_recv: Access-Request packet from host 10.1.1.10 port 1812, id=9, length=159 NAS-IP-Address = 10.1.1.12 NAS-Port = 50024 Cisco-NAS-Port = "FastEthernet0/24" NAS-Port-Type = Ethernet User-Name = "st12345678" Called-Station-Id = "00-0D-28-1A-36-98" Calling-Station-Id = "F0-DE-F1-D4-FB-D7" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000f0173743230303235313330 Message-Authenticator = 0x07b499ef56d777d5284f72c3ad2cc15a Thanks in advance. ------------------------------------- Andi Morris IT Security Officer Cardiff Metropolitan University T: 02920 205720 E: amorris(a)cardiffmet.ac.uk<mailto:amorris@cardiffmet.ac.uk> --------------------------------------

4 3

Freeradius+Oracle11gR2 installation error
by jiejie_d 22 Oct '13

22 Oct '13

Hello, I'm install freeradius 2.2.1 + oracle 11gR2, when I execute radiusd+X, the prompt is: [root@sap raddb]# radiusd -X debug Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf Config: including file: /usr/local/etc/raddb/sql/oracle/dialup.conf config: No such entry nas_table for string SELECT id, nasname, shortname, type, secret, server FROM ${nas_table} Errors reading radiusd.conf

2 1

RE: Re: interaction between Virtual server & Authorize section
by Okis Chuang 22 Oct '13

22 Oct '13

Hi Fajar and Alan Yes, I noticed that it said discarding *duplicate* request from our NMS. About how fast our NMS request to FR, just like I mentioned before about it send a request w/ 2 retry & 1 sec timeout every minute. This request will proxy to external AAA for auth and I've confirmed the AAA is normal. We're guessing the problem is due to abnormal IO overloading of our new DB. Another, our NMS always send the same request w/ the same ID, if it didn't get response from FR with 2 retry & 1 sec TO, it will trigger trap to send SMS to us. I'm afraid that sometimes our NMS would get a chance to finish a request under the circumstance of bad DB situation which other virtual server is facing. At the same time, FR possibly be late to return a response to it so that our test client will consider as RADIUS is down. And I guess FR will queue the reply with the ID. After a minute, it might ignore the request from our NMS because previous request w/ same ID is still in the queue. Then this has been a cycle. In summary, I just want to confirm if I can assert it was caused by problematic DB when I got the error message like that. But since Alan has said that I can put more focus on what happened to DB. Thanks you guys' experiences a lot! Besides, I want to know how much extent that does perl script in FR would likely decrease performance of overall FR significantly? Because I also wrote some modules by rlm_perl in different sections. I know documentation says perl with FR is fast. But I have no idea if there is a limitation. Thanks again! Okis On Mon, Oct 21, 2013 at 3:48 PM, Okis Chuang < <http://freeradius.1045715.n5.nabble.com/user/SendEmail.jtp?type=node&node=5 723064&i=0> [hidden email]> wrote: "Discarding duplicate request from NMS - ID xx due to unfinished request xxxx", Did you read what it says? "Duplicate request"? then after about short period of time, it showed msg "WARNING: Unresponsive child for request xxxx, in component authorized module", can I still say that is due to problematic DB? Do you actually know how fast your NMS request is processed? It can be slow even if it doesn't use db if it depends on external components. For example, proxying auth to external radius servers. -- Fajar

3 2

Re: interaction between Virtual server & Authorize
by Okis Chuang 22 Oct '13

22 Oct '13

Dear Fajar In fact, I've use radmin before for just few simple task like hup, terminate, stats. Honestly, this is the first time I try 'debug' in radmin! I've took a try few minute ago, it's so convenient and useful! Thank you for let me know this suggestion! Now I think I will try to output some debug log by radmin on our production server to see what's wrong with it when this service is still in low traffic now. At the same time, I will try to copy the context in our test environment to see what's going on. Much appreciate! Btw, do you suggest using large number of perl script in FR? Does it drop performance dramatically? Such as writing some file logs, connect to external UDP server, or some attributes editing in Perl module. Okis

1 0

Re: interaction between Virtual server & Authorize section
by Okis Chuang 22 Oct '13

22 Oct '13

Dear Fajar Yes, I have confirmed the external AAA is ok by sending same test request using radclient. They responded immediately since they are production RADIUS server. Yes, sure. I've set to 5 on num_of_sock yesterday. But the problem still exist. So I really doubt that why does the virtual server for our NMS would be affected especially under that frequency of check. Okis

1 0

Re: interaction between Virtual server & Authorize section
by Okis Chuang 22 Oct '13

22 Oct '13

Yes, I have confirmed the external AAA is ok by sending same test request using radclient. They responded immediately since they are production RADIUS server. Yes, sure. I've set to 5 on num_of_sock yesterday. But the problem still exist. So I really doubt that why does the virtual server for our NMS would be affected especially under that frequency of check. Okis

2 1