- Freeradius-Users - lists.freeradius.org

Performance issues
by Imdad Hasan 05 Oct '22

05 Oct '22

Hi Alen, I am checking the slow query logs from the last 3 days and still it's not any slow query logs more than 2 secs from FreeRADIUS queries. Please suggest what I should do. I checked all the things. Thanks Imdad

3 3

Version 3.2.1 has been released
by Matthew Newton 03 Oct '22

03 Oct '22

We have released version 3.2.1. This is the latest version 3 "feature" release. There are a number of improvements and bug fixes, see the changelog for full details. As usual, see the web site for release notes and downloads: https://freeradius.org/releases/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_1 Packages are available on the Network RADIUS site: https://packages.networkradius.com/ Rocky Linux 9 packages have been added with this release. Note that since Ubuntu 16 is now EOL, packages will be dropped at some point in the future; you are encouraged to upgrade. Docker images have been pushed to Dockerhub. With this release the Docker "latest" tag now points at version 3.2.1, along with the "latest-3.2" tag. For anyone wishing to stay with version 3.0, please use the "latest-3.0" tag. -- Matthew

1 0

Performance issues
by Imdad Hasan 01 Oct '22

01 Oct '22

Hi Alen, I enabled slow query logs and another mysql logs for further inspection for last 24 hours, i set the time is 2 secs long for slow query logs, But whenever the freeradius gives me a warning like *WARNING: Module rlm_sql became unblocked *at that time mysql hasn't any slow query logs. Meaning mysql hasn't any query that takes more than 2 seconds. Thanks Imdad 😊

1 0

msg_goodpass and msg_badpass conditional
by Munroe Sollog 30 Sep '22

30 Sep '22

I had a desire to log additional information about authentications to help enrich our logging analysis. The best idea I came up with at the time was to customize msg_goodpass and msg_badpass in the log{} section of the radius.conf. This worked as expected, however, now I find myself wanting to customize these messages based on unlang attributes. Specifically, I log something like: msg_goodpass = "AP-location: %{Aruba-Location-Id}, Device: %{Aruba-Device-Type}, SSID: %{Aruba-Essid-Name}, Group: %{Aruba-AP-Group}” This makes perfect sense and really helps the support staff to troubleshoot user issues. However, this log line will also log when a VPN user successfully authenticates, and as such, makes no sense. Any ideas or suggestions for a more flexible way of customizing logging data would be appreciated. Munroe Sollog (He/Him/His) Network Architect munroe(a)lehigh.edu

2 1

Freeradiusd 3 and Realm help
by Olivier CALVANO 30 Sep '22

30 Sep '22

Hello, I have to set up a radius server which must make a specific response to a realm and I can't find how to do it. So I configured a realm in proxy.conf: realm "~(my.realm)" { nostrip } Then I tried in the users file (./mods-config/files/authorize) to put: bob(a)my.realm Cleartext-Password := "hello" Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IPv4, Tunnel-Server-Endpoint:1="192.168.1.100", Tunnel-Preference:1=1, Tunnel-Assignment-Id:1 = "\"Rt1\"", Tunnel-Type:2 = L2TP, Tunnel-Medium-Type:2 = IPv4, Tunnel-Server-Endpoint:2="192.168.2.100", Tunnel-Preference:2=1, Tunnel-Assignment-Id:2 = "\"Rt2\"", Service-Type = Framed-User, Framed-Protocol = PPP in radtest, it's good. but now i want same with all username and without check password sample: *(a)my.realm Cleartext-Password := "*" Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IPv4, Tunnel-Server-Endpoint:1="192.168.1.100", Tunnel-Preference:1=1, Tunnel-Assignment-Id:1 = "\"Rt1\"", Tunnel-Type:2 = L2TP, Tunnel-Medium-Type:2 = IPv4, Tunnel-Server-Endpoint:2="192.168.2.100", Tunnel-Preference:2=1, Tunnel-Assignment-Id:2 = "\"Rt2\"", Service-Type = Framed-User, Framed-Protocol = PPP I don't know how to do this, does anyone have a tip? thank you in advance for your help

2 1

Performance issues
by Imdad Hasan 30 Sep '22

30 Sep '22

Hi Alan, Actually the problem is something different. i checked all queries and all indexes. even i enabled MySQL logs for slow queries + without indexed queries. and it's showing none.. Another main thing is MySQL is only taking 5-10% cpu max. i already increased the max_connection as well with 1024 from the first day of installation. So, I am monitoring how many connections are opened by WebUI and FreeRADIUS servers separately. So, everytime WebUI (NGINX + PHP-FPM) has so many connections like around 150. But on the other hand the FreeRADIUS has only 15 to 20 max connections. why it's not taking full advantage of MySQL resources/connections. I also increased max_server from 32 to 64 in radiusd.conf but still it's not creating more connections. And whenever i restart freeradius it shows *rlm_exec unblocked* (i think because of intruption in running php processes.). But the *rlm_sql unblocked* is sometimes in a day without any reason.. But I am sure that *rlm_sql* means pre-compiled queries Or action update queries. Right? Please correct me if I am wrong.. The *rlm_sql unblocked (with conflict packet)* problem is from the configuration of freeradius.. it's not from a php exec script. Please suggest to me what will be the bottleneck in this issue. Thanks Imdad 😊

2 1

Performance issues
by Imdad Hasan 29 Sep '22

29 Sep '22

Thank you so much alen for very quick response. I am checking indexes. let's see, if i find any misconfiguration in that. Thanks Again and very good morning. have a good day. Imdad 😊

1 0

Performance issues
by Imdad Hasan 29 Sep '22

29 Sep '22

Hi Alen, Right now in current version of my app, 1.) For accounting i am using pre-compiled FreeRADIUS queries with two tables approach one radacct for live and another for closed sessions. 2.) In update control i am updating in/out octets on another table for specific user total usage. (Also for Accounting) 3.) For Authentication/Authorization i am still using exec with php script, i am planning to move on perl, but still confuse because of some old posts about perl module. - MySQL server have 32GB RAM and 8-Core CPU with Mysql READ-COMMITED isolation mode. - MySQL server CPU usage is max to max 10% to 15% On high load. - FreeRADIUS server have 4GB RAM and 2-Core CPU. - FreeRADIUS server CPU usage is around 50 to 75%. but the half of total usage (around 30%) is by the system kernel itself. mostly these two function of the kernel. *5.29% [kernel] [k] copy_pte_range.isra.0 4.52% [kernel] [k] zap_pte_range.isra.0* - MySQL and FreeRADIUS is linked in the local network in one VPC of Amazon AWS. - The average load of internet subscriber is around 35k. and i set 5mins interim update time for every subscriber for accounting. - most of time is working fine, but some times it's gives below errors and hangs.. on client sides it's showing *radius time out.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client MARUTI-OFFICE port 41243 - ID: 74 due to unfinished request in module . Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client Sargasan port 43843 - ID: 39 due to unfinished request in module . Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client kathlal port 45688 - ID: 18 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : WARNING: (4098875) WARNING: Module rlm_sql became unblocked* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 54191 - ID: 82 due to unfinished request in module sql. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client Vadhvan-GIDC port 50558 - ID: 247 due to unfinished request in module . Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client GULIA port 60073 - ID: 21 due to unfinished request in module . Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client G_NET port 58334 - ID: 158 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 42216 - ID: 84 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client KUHA_1009 port 39064 - ID: 103 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client mansa port 35213 - ID: 73 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 48780 - ID: 83 due to unfinished request in module sql. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 60583 - ID: 87 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 55875 - ID: 86 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 50524 - ID: 85 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: (4098887) Ignoring duplicate packet from client Skynet-Agra-BNG port 37257 - ID: 1 due to unfinished request in component <core> module <queue>* *Thu Sep 29 07:40:54 2022 : WARNING: (4098878) WARNING: Module rlm_sql became unblocked* Thanks Imdad 😊

2 1

Re: Freeradius-Users Digest, Vol 209, Issue 34
by Imdad Hasan 29 Sep '22

29 Sep '22

Hi Alen, Actually before some time you suggested the perl module for very huge traffic. so, i should have to use perl for accounting or just use perl for Authentication/Authorization and Redis for Accounting? Thanks Imdad On Thu, Sep 29, 2022 at 5:30 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius-Users Digest, Vol 209, Issue 33 (Imdad Hasan) > 2. Re: Freeradius-Users Digest, Vol 209, Issue 33 > (Michael Schwartzkopff) > 3. Received Conflict packets in RADIUS accounting (Imdad Hasan) > 4. Re: Received Conflict packets in RADIUS accounting (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 29 Sep 2022 11:42:34 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Freeradius-Users Digest, Vol 209, Issue 33 > Message-ID: > <CAPidyMVQCX2vLgZCGVUBCmtUZv53GguaDVg= > WK6ixxPD6tKS+Q(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi Matthew, > > Actually I am finding a less costly way to reload config from service > restart.. Right now i am using service restart command for that.. but is > there any way without restarting service? > > > On Wed, Sep 28, 2022 at 5:30 PM < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > https://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. How to reload freeradius service after new NAS added without > > restart (Imdad Hasan) > > 2. Re: How to reload freeradius service after new NAS added > > without restart (Matthew Newton) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Tue, 27 Sep 2022 17:35:19 +0530 > > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > > To: freeradius-users(a)lists.freeradius.org > > Subject: How to reload freeradius service after new NAS added without > > restart > > Message-ID: > > <CAPidyMVv6jsEvUthyd4S6hVzGFcyN16bcXdoOab= > > WGMKghcqWw(a)mail.gmail.com> > > Content-Type: text/plain; charset="UTF-8" > > > > Hi All, > > > > I am trying to reload freeradius config after adding NAS but it's not > > working, and it is only work with restart.. > > > > On "service freeradius reload" it's showing this error.. > > > > " > > * Checking FreeRADIUS daemon configuration... > > > > [ OK ] > > * FreeRADIUS daemon is not running > > " > > > > i also tried the with sig HUP but still it's not working. > > > > Please help if anyone have idea about this. > > > > Thanks > > Imdad > > > > > > ------------------------------ > > > > Message: 2 > > Date: Tue, 27 Sep 2022 13:13:31 +0100 > > From: Matthew Newton <mcn(a)freeradius.org> > > To: freeradius-users(a)lists.freeradius.org > > Subject: Re: How to reload freeradius service after new NAS added > > without restart > > Message-ID: <30fbf890-26b5-de85-6d96-766962b55d85(a)freeradius.org> > > Content-Type: text/plain; charset=UTF-8; format=flowed > > > > > > > > On 27/09/2022 13:05, Imdad Hasan wrote: > > > On "service freeradius reload" it's showing this error.. > > > > > > " > > > * Checking FreeRADIUS daemon configuration... > > > > > > [ OK ] > > > * FreeRADIUS daemon is not running > > > " > > > > > > i also tried the with sig HUP but still it's not working. > > > > > > Please help if anyone have idea about this. > > > > Use `service freeradius restart`. > > > > If there are errors and it won't restart, use `freeradius -X` to see why. > > > > -- > > Matthew > > > > > > ------------------------------ > > > > Subject: Digest Footer > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > ------------------------------ > > > > End of Freeradius-Users Digest, Vol 209, Issue 33 > > ************************************************* > > > > > ------------------------------ > > Message: 2 > Date: Thu, 29 Sep 2022 08:40:33 +0200 > From: Michael Schwartzkopff <ms(a)sys4.de> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Freeradius-Users Digest, Vol 209, Issue 33 > Message-ID: <c5424c74-e8d0-b38f-7b46-506f474929b5(a)sys4.de> > Content-Type: text/plain; charset=UTF-8; format=flowed > > On 29.09.22 08:12, Imdad Hasan wrote: > > Hi Matthew, > > > > Actually I am finding a less costly way to reload config from service > > restart.. Right now i am using service restart command for that.. but is > > there any way without restarting service? > > > Yes. See radmin. > > > > > > On Wed, Sep 28, 2022 at 5:30 PM < > > freeradius-users-request(a)lists.freeradius.org> wrote: > > > >> Send Freeradius-Users mailing list submissions to > >> freeradius-users(a)lists.freeradius.org > >> > >> To subscribe or unsubscribe via the World Wide Web, visit > >> https://lists.freeradius.org/mailman/listinfo/freeradius-users > >> or, via email, send a message with subject or body 'help' to > >> freeradius-users-request(a)lists.freeradius.org > >> > >> You can reach the person managing the list at > >> freeradius-users-owner(a)lists.freeradius.org > >> > >> When replying, please edit your Subject line so it is more specific > >> than "Re: Contents of Freeradius-Users digest..." > >> > >> > >> Today's Topics: > >> > >> 1. How to reload freeradius service after new NAS added without > >> restart (Imdad Hasan) > >> 2. Re: How to reload freeradius service after new NAS added > >> without restart (Matthew Newton) > >> > >> > >> ---------------------------------------------------------------------- > >> > >> Message: 1 > >> Date: Tue, 27 Sep 2022 17:35:19 +0530 > >> From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > >> To: freeradius-users(a)lists.freeradius.org > >> Subject: How to reload freeradius service after new NAS added without > >> restart > >> Message-ID: > >> <CAPidyMVv6jsEvUthyd4S6hVzGFcyN16bcXdoOab= > >> WGMKghcqWw(a)mail.gmail.com> > >> Content-Type: text/plain; charset="UTF-8" > >> > >> Hi All, > >> > >> I am trying to reload freeradius config after adding NAS but it's not > >> working, and it is only work with restart.. > >> > >> On "service freeradius reload" it's showing this error.. > >> > >> " > >> * Checking FreeRADIUS daemon configuration... > >> > >> [ OK ] > >> * FreeRADIUS daemon is not running > >> " > >> > >> i also tried the with sig HUP but still it's not working. > >> > >> Please help if anyone have idea about this. > >> > >> Thanks > >> Imdad > >> > >> > >> ------------------------------ > >> > >> Message: 2 > >> Date: Tue, 27 Sep 2022 13:13:31 +0100 > >> From: Matthew Newton <mcn(a)freeradius.org> > >> To: freeradius-users(a)lists.freeradius.org > >> Subject: Re: How to reload freeradius service after new NAS added > >> without restart > >> Message-ID: <30fbf890-26b5-de85-6d96-766962b55d85(a)freeradius.org> > >> Content-Type: text/plain; charset=UTF-8; format=flowed > >> > >> > >> > >> On 27/09/2022 13:05, Imdad Hasan wrote: > >>> On "service freeradius reload" it's showing this error.. > >>> > >>> " > >>> * Checking FreeRADIUS daemon configuration... > >>> > >>> [ OK ] > >>> * FreeRADIUS daemon is not running > >>> " > >>> > >>> i also tried the with sig HUP but still it's not working. > >>> > >>> Please help if anyone have idea about this. > >> Use `service freeradius restart`. > >> > >> If there are errors and it won't restart, use `freeradius -X` to see > why. > >> > >> -- > >> Matthew > >> > >> > >> ------------------------------ > >> > >> Subject: Digest Footer > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > >> > >> ------------------------------ > >> > >> End of Freeradius-Users Digest, Vol 209, Issue 33 > >> ************************************************* > >> > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > Mit freundlichen Gr??en, > > -- > > [*] sys4 AG > > https://sys4.de, +49 (89) 30 90 46 64 > Schlei?heimer Stra?e 26/MG,80333 M?nchen > > Sitz der Gesellschaft: M?nchen, Amtsgericht M?nchen: HRB 199263 > Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief > Aufsichtsratsvorsitzender: Florian Kirstein > > > > ------------------------------ > > Message: 3 > Date: Thu, 29 Sep 2022 16:47:58 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Received Conflict packets in RADIUS accounting > Message-ID: > < > CAPidyMU0RShHrDB0-Bdp0Y4CZ0PKxirhfZ0cQd1DAZRL_wrBxA(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi All, > > i am receiving an error about conflict packet like > > *Error: Received conflicting packet from client NAS1 port 53433 - ID: 194 > due to unfinished request in module <queue>. Giving up on old request.* > > 1.) At this time my radius server hangs and takes 100% CPU. > 2.) From some time the linux kernel is taking 30% CPU constantly. > > I am using ubuntu-server 20.04 with freeradius 3.0.20. > > > Note: I am using distributed systems like *DB, WebUI and FreeRADIUS in > different-different VPS*. > > Please help if any one has an idea about this error/issue. > > > Thanks > Imdad > > > ------------------------------ > > Message: 4 > Date: Thu, 29 Sep 2022 07:28:20 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Received Conflict packets in RADIUS accounting > Message-ID: <B018B37A-11ED-4219-9A08-D7E6CD9D6623(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Sep 29, 2022, at 7:17 AM, Imdad Hasan <imdadalikadiwala0(a)gmail.com> > wrote: > > i am receiving an error about conflict packet like > > > > *Error: Received conflicting packet from client NAS1 port 53433 - ID: 194 > > due to unfinished request in module <queue>. Giving up on old request.* > > > > 1.) At this time my radius server hangs and takes 100% CPU. > > 2.) From some time the linux kernel is taking 30% CPU constantly. > > > > I am using ubuntu-server 20.04 with freeradius 3.0.20. > > You should use 3.2.0, but that won't help. The problem is almost > definitely your database. > > Read the *rest* of the messages in the log files. You will likely see > messages about "module sql became unblocked" or "module sql is > unresponsive"/ > > Something else is blocking the server, and is preventing it from doing > work. It is almost always something like a database. Or maybe a slow Perl > module, or even you're exec'ing complicated scripts. > > If you put a name and password into the "users" file, FreeRADIUS can > handle 40K packets/s. So if your local site can't handle 100 packets/s, > then it's something broken in your local system. > > Alan DeKok. > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 209, Issue 34 > ************************************************* >

2 1

Received Conflict packets in RADIUS accounting
by Imdad Hasan 29 Sep '22

29 Sep '22

Hi All, i am receiving an error about conflict packet like *Error: Received conflicting packet from client NAS1 port 53433 - ID: 194 due to unfinished request in module <queue>. Giving up on old request.* 1.) At this time my radius server hangs and takes 100% CPU. 2.) From some time the linux kernel is taking 30% CPU constantly. I am using ubuntu-server 20.04 with freeradius 3.0.20. Note: I am using distributed systems like *DB, WebUI and FreeRADIUS in different-different VPS*. Please help if any one has an idea about this error/issue. Thanks Imdad

2 1