- Freeradius-Users - lists.freeradius.org

Performance issues
by Imdad Hasan 30 Sep '22

30 Sep '22

Hi Alan, Actually the problem is something different. i checked all queries and all indexes. even i enabled MySQL logs for slow queries + without indexed queries. and it's showing none.. Another main thing is MySQL is only taking 5-10% cpu max. i already increased the max_connection as well with 1024 from the first day of installation. So, I am monitoring how many connections are opened by WebUI and FreeRADIUS servers separately. So, everytime WebUI (NGINX + PHP-FPM) has so many connections like around 150. But on the other hand the FreeRADIUS has only 15 to 20 max connections. why it's not taking full advantage of MySQL resources/connections. I also increased max_server from 32 to 64 in radiusd.conf but still it's not creating more connections. And whenever i restart freeradius it shows *rlm_exec unblocked* (i think because of intruption in running php processes.). But the *rlm_sql unblocked* is sometimes in a day without any reason.. But I am sure that *rlm_sql* means pre-compiled queries Or action update queries. Right? Please correct me if I am wrong.. The *rlm_sql unblocked (with conflict packet)* problem is from the configuration of freeradius.. it's not from a php exec script. Please suggest to me what will be the bottleneck in this issue. Thanks Imdad 😊

2 1

Performance issues
by Imdad Hasan 29 Sep '22

29 Sep '22

Thank you so much alen for very quick response. I am checking indexes. let's see, if i find any misconfiguration in that. Thanks Again and very good morning. have a good day. Imdad 😊

1 0

Performance issues
by Imdad Hasan 29 Sep '22

29 Sep '22

Hi Alen, Right now in current version of my app, 1.) For accounting i am using pre-compiled FreeRADIUS queries with two tables approach one radacct for live and another for closed sessions. 2.) In update control i am updating in/out octets on another table for specific user total usage. (Also for Accounting) 3.) For Authentication/Authorization i am still using exec with php script, i am planning to move on perl, but still confuse because of some old posts about perl module. - MySQL server have 32GB RAM and 8-Core CPU with Mysql READ-COMMITED isolation mode. - MySQL server CPU usage is max to max 10% to 15% On high load. - FreeRADIUS server have 4GB RAM and 2-Core CPU. - FreeRADIUS server CPU usage is around 50 to 75%. but the half of total usage (around 30%) is by the system kernel itself. mostly these two function of the kernel. *5.29% [kernel] [k] copy_pte_range.isra.0 4.52% [kernel] [k] zap_pte_range.isra.0* - MySQL and FreeRADIUS is linked in the local network in one VPC of Amazon AWS. - The average load of internet subscriber is around 35k. and i set 5mins interim update time for every subscriber for accounting. - most of time is working fine, but some times it's gives below errors and hangs.. on client sides it's showing *radius time out.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client MARUTI-OFFICE port 41243 - ID: 74 due to unfinished request in module . Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client Sargasan port 43843 - ID: 39 due to unfinished request in module . Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client kathlal port 45688 - ID: 18 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : WARNING: (4098875) WARNING: Module rlm_sql became unblocked* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 54191 - ID: 82 due to unfinished request in module sql. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client Vadhvan-GIDC port 50558 - ID: 247 due to unfinished request in module . Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client GULIA port 60073 - ID: 21 due to unfinished request in module . Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client G_NET port 58334 - ID: 158 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 42216 - ID: 84 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client KUHA_1009 port 39064 - ID: 103 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client mansa port 35213 - ID: 73 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 48780 - ID: 83 due to unfinished request in module sql. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 60583 - ID: 87 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 55875 - ID: 86 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: Received conflicting packet from client omnet port 50524 - ID: 85 due to unfinished request in module <queue>. Giving up on old request.* *Thu Sep 29 07:40:54 2022 : Error: (4098887) Ignoring duplicate packet from client Skynet-Agra-BNG port 37257 - ID: 1 due to unfinished request in component <core> module <queue>* *Thu Sep 29 07:40:54 2022 : WARNING: (4098878) WARNING: Module rlm_sql became unblocked* Thanks Imdad 😊

2 1

Re: Freeradius-Users Digest, Vol 209, Issue 34
by Imdad Hasan 29 Sep '22

29 Sep '22

Hi Alen, Actually before some time you suggested the perl module for very huge traffic. so, i should have to use perl for accounting or just use perl for Authentication/Authorization and Redis for Accounting? Thanks Imdad On Thu, Sep 29, 2022 at 5:30 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius-Users Digest, Vol 209, Issue 33 (Imdad Hasan) > 2. Re: Freeradius-Users Digest, Vol 209, Issue 33 > (Michael Schwartzkopff) > 3. Received Conflict packets in RADIUS accounting (Imdad Hasan) > 4. Re: Received Conflict packets in RADIUS accounting (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 29 Sep 2022 11:42:34 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Freeradius-Users Digest, Vol 209, Issue 33 > Message-ID: > <CAPidyMVQCX2vLgZCGVUBCmtUZv53GguaDVg= > WK6ixxPD6tKS+Q(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi Matthew, > > Actually I am finding a less costly way to reload config from service > restart.. Right now i am using service restart command for that.. but is > there any way without restarting service? > > > On Wed, Sep 28, 2022 at 5:30 PM < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > https://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. How to reload freeradius service after new NAS added without > > restart (Imdad Hasan) > > 2. Re: How to reload freeradius service after new NAS added > > without restart (Matthew Newton) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Tue, 27 Sep 2022 17:35:19 +0530 > > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > > To: freeradius-users(a)lists.freeradius.org > > Subject: How to reload freeradius service after new NAS added without > > restart > > Message-ID: > > <CAPidyMVv6jsEvUthyd4S6hVzGFcyN16bcXdoOab= > > WGMKghcqWw(a)mail.gmail.com> > > Content-Type: text/plain; charset="UTF-8" > > > > Hi All, > > > > I am trying to reload freeradius config after adding NAS but it's not > > working, and it is only work with restart.. > > > > On "service freeradius reload" it's showing this error.. > > > > " > > * Checking FreeRADIUS daemon configuration... > > > > [ OK ] > > * FreeRADIUS daemon is not running > > " > > > > i also tried the with sig HUP but still it's not working. > > > > Please help if anyone have idea about this. > > > > Thanks > > Imdad > > > > > > ------------------------------ > > > > Message: 2 > > Date: Tue, 27 Sep 2022 13:13:31 +0100 > > From: Matthew Newton <mcn(a)freeradius.org> > > To: freeradius-users(a)lists.freeradius.org > > Subject: Re: How to reload freeradius service after new NAS added > > without restart > > Message-ID: <30fbf890-26b5-de85-6d96-766962b55d85(a)freeradius.org> > > Content-Type: text/plain; charset=UTF-8; format=flowed > > > > > > > > On 27/09/2022 13:05, Imdad Hasan wrote: > > > On "service freeradius reload" it's showing this error.. > > > > > > " > > > * Checking FreeRADIUS daemon configuration... > > > > > > [ OK ] > > > * FreeRADIUS daemon is not running > > > " > > > > > > i also tried the with sig HUP but still it's not working. > > > > > > Please help if anyone have idea about this. > > > > Use `service freeradius restart`. > > > > If there are errors and it won't restart, use `freeradius -X` to see why. > > > > -- > > Matthew > > > > > > ------------------------------ > > > > Subject: Digest Footer > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > ------------------------------ > > > > End of Freeradius-Users Digest, Vol 209, Issue 33 > > ************************************************* > > > > > ------------------------------ > > Message: 2 > Date: Thu, 29 Sep 2022 08:40:33 +0200 > From: Michael Schwartzkopff <ms(a)sys4.de> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Freeradius-Users Digest, Vol 209, Issue 33 > Message-ID: <c5424c74-e8d0-b38f-7b46-506f474929b5(a)sys4.de> > Content-Type: text/plain; charset=UTF-8; format=flowed > > On 29.09.22 08:12, Imdad Hasan wrote: > > Hi Matthew, > > > > Actually I am finding a less costly way to reload config from service > > restart.. Right now i am using service restart command for that.. but is > > there any way without restarting service? > > > Yes. See radmin. > > > > > > On Wed, Sep 28, 2022 at 5:30 PM < > > freeradius-users-request(a)lists.freeradius.org> wrote: > > > >> Send Freeradius-Users mailing list submissions to > >> freeradius-users(a)lists.freeradius.org > >> > >> To subscribe or unsubscribe via the World Wide Web, visit > >> https://lists.freeradius.org/mailman/listinfo/freeradius-users > >> or, via email, send a message with subject or body 'help' to > >> freeradius-users-request(a)lists.freeradius.org > >> > >> You can reach the person managing the list at > >> freeradius-users-owner(a)lists.freeradius.org > >> > >> When replying, please edit your Subject line so it is more specific > >> than "Re: Contents of Freeradius-Users digest..." > >> > >> > >> Today's Topics: > >> > >> 1. How to reload freeradius service after new NAS added without > >> restart (Imdad Hasan) > >> 2. Re: How to reload freeradius service after new NAS added > >> without restart (Matthew Newton) > >> > >> > >> ---------------------------------------------------------------------- > >> > >> Message: 1 > >> Date: Tue, 27 Sep 2022 17:35:19 +0530 > >> From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > >> To: freeradius-users(a)lists.freeradius.org > >> Subject: How to reload freeradius service after new NAS added without > >> restart > >> Message-ID: > >> <CAPidyMVv6jsEvUthyd4S6hVzGFcyN16bcXdoOab= > >> WGMKghcqWw(a)mail.gmail.com> > >> Content-Type: text/plain; charset="UTF-8" > >> > >> Hi All, > >> > >> I am trying to reload freeradius config after adding NAS but it's not > >> working, and it is only work with restart.. > >> > >> On "service freeradius reload" it's showing this error.. > >> > >> " > >> * Checking FreeRADIUS daemon configuration... > >> > >> [ OK ] > >> * FreeRADIUS daemon is not running > >> " > >> > >> i also tried the with sig HUP but still it's not working. > >> > >> Please help if anyone have idea about this. > >> > >> Thanks > >> Imdad > >> > >> > >> ------------------------------ > >> > >> Message: 2 > >> Date: Tue, 27 Sep 2022 13:13:31 +0100 > >> From: Matthew Newton <mcn(a)freeradius.org> > >> To: freeradius-users(a)lists.freeradius.org > >> Subject: Re: How to reload freeradius service after new NAS added > >> without restart > >> Message-ID: <30fbf890-26b5-de85-6d96-766962b55d85(a)freeradius.org> > >> Content-Type: text/plain; charset=UTF-8; format=flowed > >> > >> > >> > >> On 27/09/2022 13:05, Imdad Hasan wrote: > >>> On "service freeradius reload" it's showing this error.. > >>> > >>> " > >>> * Checking FreeRADIUS daemon configuration... > >>> > >>> [ OK ] > >>> * FreeRADIUS daemon is not running > >>> " > >>> > >>> i also tried the with sig HUP but still it's not working. > >>> > >>> Please help if anyone have idea about this. > >> Use `service freeradius restart`. > >> > >> If there are errors and it won't restart, use `freeradius -X` to see > why. > >> > >> -- > >> Matthew > >> > >> > >> ------------------------------ > >> > >> Subject: Digest Footer > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > >> > >> ------------------------------ > >> > >> End of Freeradius-Users Digest, Vol 209, Issue 33 > >> ************************************************* > >> > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > Mit freundlichen Gr??en, > > -- > > [*] sys4 AG > > https://sys4.de, +49 (89) 30 90 46 64 > Schlei?heimer Stra?e 26/MG,80333 M?nchen > > Sitz der Gesellschaft: M?nchen, Amtsgericht M?nchen: HRB 199263 > Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief > Aufsichtsratsvorsitzender: Florian Kirstein > > > > ------------------------------ > > Message: 3 > Date: Thu, 29 Sep 2022 16:47:58 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Received Conflict packets in RADIUS accounting > Message-ID: > < > CAPidyMU0RShHrDB0-Bdp0Y4CZ0PKxirhfZ0cQd1DAZRL_wrBxA(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi All, > > i am receiving an error about conflict packet like > > *Error: Received conflicting packet from client NAS1 port 53433 - ID: 194 > due to unfinished request in module <queue>. Giving up on old request.* > > 1.) At this time my radius server hangs and takes 100% CPU. > 2.) From some time the linux kernel is taking 30% CPU constantly. > > I am using ubuntu-server 20.04 with freeradius 3.0.20. > > > Note: I am using distributed systems like *DB, WebUI and FreeRADIUS in > different-different VPS*. > > Please help if any one has an idea about this error/issue. > > > Thanks > Imdad > > > ------------------------------ > > Message: 4 > Date: Thu, 29 Sep 2022 07:28:20 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Received Conflict packets in RADIUS accounting > Message-ID: <B018B37A-11ED-4219-9A08-D7E6CD9D6623(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Sep 29, 2022, at 7:17 AM, Imdad Hasan <imdadalikadiwala0(a)gmail.com> > wrote: > > i am receiving an error about conflict packet like > > > > *Error: Received conflicting packet from client NAS1 port 53433 - ID: 194 > > due to unfinished request in module <queue>. Giving up on old request.* > > > > 1.) At this time my radius server hangs and takes 100% CPU. > > 2.) From some time the linux kernel is taking 30% CPU constantly. > > > > I am using ubuntu-server 20.04 with freeradius 3.0.20. > > You should use 3.2.0, but that won't help. The problem is almost > definitely your database. > > Read the *rest* of the messages in the log files. You will likely see > messages about "module sql became unblocked" or "module sql is > unresponsive"/ > > Something else is blocking the server, and is preventing it from doing > work. It is almost always something like a database. Or maybe a slow Perl > module, or even you're exec'ing complicated scripts. > > If you put a name and password into the "users" file, FreeRADIUS can > handle 40K packets/s. So if your local site can't handle 100 packets/s, > then it's something broken in your local system. > > Alan DeKok. > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 209, Issue 34 > ************************************************* >

2 1

Received Conflict packets in RADIUS accounting
by Imdad Hasan 29 Sep '22

29 Sep '22

Hi All, i am receiving an error about conflict packet like *Error: Received conflicting packet from client NAS1 port 53433 - ID: 194 due to unfinished request in module <queue>. Giving up on old request.* 1.) At this time my radius server hangs and takes 100% CPU. 2.) From some time the linux kernel is taking 30% CPU constantly. I am using ubuntu-server 20.04 with freeradius 3.0.20. Note: I am using distributed systems like *DB, WebUI and FreeRADIUS in different-different VPS*. Please help if any one has an idea about this error/issue. Thanks Imdad

2 1

Re: Freeradius-Users Digest, Vol 209, Issue 33
by Imdad Hasan 29 Sep '22

29 Sep '22

Hi Matthew, Actually I am finding a less costly way to reload config from service restart.. Right now i am using service restart command for that.. but is there any way without restarting service? On Wed, Sep 28, 2022 at 5:30 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. How to reload freeradius service after new NAS added without > restart (Imdad Hasan) > 2. Re: How to reload freeradius service after new NAS added > without restart (Matthew Newton) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 27 Sep 2022 17:35:19 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: How to reload freeradius service after new NAS added without > restart > Message-ID: > <CAPidyMVv6jsEvUthyd4S6hVzGFcyN16bcXdoOab= > WGMKghcqWw(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi All, > > I am trying to reload freeradius config after adding NAS but it's not > working, and it is only work with restart.. > > On "service freeradius reload" it's showing this error.. > > " > * Checking FreeRADIUS daemon configuration... > > [ OK ] > * FreeRADIUS daemon is not running > " > > i also tried the with sig HUP but still it's not working. > > Please help if anyone have idea about this. > > Thanks > Imdad > > > ------------------------------ > > Message: 2 > Date: Tue, 27 Sep 2022 13:13:31 +0100 > From: Matthew Newton <mcn(a)freeradius.org> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: How to reload freeradius service after new NAS added > without restart > Message-ID: <30fbf890-26b5-de85-6d96-766962b55d85(a)freeradius.org> > Content-Type: text/plain; charset=UTF-8; format=flowed > > > > On 27/09/2022 13:05, Imdad Hasan wrote: > > On "service freeradius reload" it's showing this error.. > > > > " > > * Checking FreeRADIUS daemon configuration... > > > > [ OK ] > > * FreeRADIUS daemon is not running > > " > > > > i also tried the with sig HUP but still it's not working. > > > > Please help if anyone have idea about this. > > Use `service freeradius restart`. > > If there are errors and it won't restart, use `freeradius -X` to see why. > > -- > Matthew > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 209, Issue 33 > ************************************************* >

2 1

How to reload freeradius service after new NAS added without restart
by Imdad Hasan 27 Sep '22

27 Sep '22

Hi All, I am trying to reload freeradius config after adding NAS but it's not working, and it is only work with restart.. On "service freeradius reload" it's showing this error.. " * Checking FreeRADIUS daemon configuration... [ OK ] * FreeRADIUS daemon is not running " i also tried the with sig HUP but still it's not working. Please help if anyone have idea about this. Thanks Imdad

2 1

Re: Fwd: Error binding to port for 0.0.0.0 port 1812 | address already used
by Steven Walters 26 Sep '22

26 Sep '22

Hi Nick I upgraded to FreeRADIUS Version 3.2.0 and still have the same error message. Nothing bound to port 1812. ss -lunp | grep 1812 [root(a)radius-02.cnt sites-enabled]# ss -lunp State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.1:323 *:* users:(("chronyd",pid=771,fd=5)) UNCONN 0 0 [::1]:323 [::]:* users:(("chronyd",pid=771,fd=6)) Regards Steven On Sat, 24 Sept 2022 at 14:00, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: sqlippool, allocate_find and duplicate address if NAS > packets are received in the reverse order (Matteo Sgalaberni) > 2. Re: Fwd: Error binding to port for 0.0.0.0 port 1812 | > address already used (Steven Walters) > 3. Re: Fwd: Error binding to port for 0.0.0.0 port 1812 | > address already used (Nick Porter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 23 Sep 2022 13:41:18 +0000 (UTC) > From: Matteo Sgalaberni <sgala(a)sgala.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: sqlippool, allocate_find and duplicate address if NAS > packets are received in the reverse order > Message-ID: > <1510281924.290603.1663940478970.JavaMail.zimbra(a)ehiweb.it> > Content-Type: text/plain; charset=utf-8 > > ----- On 17 Sep, 2022, at 14:47, Alan DeKok aland(a)deployingradius.com > wrote: > > Whatever solution works for you is fine. That's why the queries are > editable, > > and documented. You can change them to work around issues in your > network. > > Hi Alan, > > I found that my thesis are very "obsolete" and related to an older > "queries.conf". > > On the branch release_3_0_26 I found a patch authored by Nick Porter > > > https://github.com/FreeRADIUS/freeradius-server/commit/1e9ab2a99674bb598af8… > > related to this pull request: > https://github.com/FreeRADIUS/freeradius-server/pull/3651 > > from the pull request description: > >Updates to schema - set default values for all columns, including > expiry_time. This allows pools to be populated with the new helper script > which only updates pool_name and framedipaddress. Having expiry_time as a > NOT NULL >removes the need for selection criteria such as (expiry_time < > NOW OR expiry_time IS NULL), enabling better use of indexes. > > >Updates to queries - > > >Take advantage of the new allocate_existing query to split re-issuing of > existing address from finding a free one > >Amend all "freeing" queries so that they just expire the entry rather > than clearing all client data. Essential to allow "sticky" IP behaviour > >Remove allocate_clear queries that achieve nothing useful (and also break > "sticky" IP behaviour) > > So the issue was resolved by Nick in 2020 ;) Thanks Nick! > > Case closed;) > > Thanks to all, > > Matteo > > > ------------------------------ > > Message: 2 > Date: Fri, 23 Sep 2022 19:05:24 +0200 > From: Steven Walters <steven.walters1(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Fwd: Error binding to port for 0.0.0.0 port 1812 | > address already used > Message-ID: > <CALF=EM+i= > fTu-fyL4pK+KbT8TGH22LSHajwy0O9mrn4fEMPFOA(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Thanks for the response Nick. I tried version first 3.0.26 but had an issue > with the openldap driver on RHEL7 when trying to start freeradius. As we > are running RHEL7 I decided on the highest version available from the RHEL7 > repo, which is 3.0.13. > > I confirmed no freeradius is not running in the background. If I remove > all the sites except default and inner-tunnel, freeradius starts fine. > > With the following sites enabled no start. > > [root(a)radius-02.cnt sites-enabled]# ls -ltr > total 0 > lrwxrwxrwx. 1 root radiusd 26 Sep 22 11:36 default -> > ../sites-available/default > lrwxrwxrwx. 1 root radiusd 31 Sep 22 11:36 inner-tunnel -> > ../sites-available/inner-tunnel > lrwxrwxrwx. 1 root root 25 Sep 23 18:38 mobile -> > ../sites-available/mobile > lrwxrwxrwx. 1 root root 34 Sep 23 18:38 staticipaddress -> > ../sites-available/staticipaddress > > With only the following sites-enabled, freeradius starts. The same configs > that worked under 3.0.1 with no issue. > > [root(a)radius-02.cnt sites-enabled]# ls -ltr > total 0 > lrwxrwxrwx. 1 root radiusd 26 Sep 22 11:36 default -> > ../sites-available/default > lrwxrwxrwx. 1 root radiusd 31 Sep 22 11:36 inner-tunnel -> > ../sites-available/inner-tunnel > > Default, mobile and staticipaddress using the same protocols (1812 auth and > 1813 acct) and "ipaddr=*" for all three. > > Kind Regards > Steven > > On Fri, 23 Sept 2022 at 14:00, < > freeradius-users-request(a)lists.freeradius.org> wrote: > > > Send Freeradius-Users mailing list submissions to > > freeradius-users(a)lists.freeradius.org > > > > To subscribe or unsubscribe via the World Wide Web, visit > > https://lists.freeradius.org/mailman/listinfo/freeradius-users > > or, via email, send a message with subject or body 'help' to > > freeradius-users-request(a)lists.freeradius.org > > > > You can reach the person managing the list at > > freeradius-users-owner(a)lists.freeradius.org > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of Freeradius-Users digest..." > > > > > > Today's Topics: > > > > 1. Re: looking for help on an unusual config (dan) > > 2. Re: looking for help on an unusual config (Alan DeKok) > > 3. Re: looking for help on an unusual config (dan) > > 4. Fwd: Error binding to port for 0.0.0.0 port 1812 | address > > already used (Steven Walters) > > 5. Re: Fwd: Error binding to port for 0.0.0.0 port 1812 | > > address already used (Nick Porter) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Thu, 22 Sep 2022 10:12:21 -0600 > > From: dan <dandenson(a)gmail.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: looking for help on an unusual config > > Message-ID: > > <CAA_JP8XYijQ+vp349N23TOtPtR+L8X_ofdCv541cagq= > > 3kF4Ug(a)mail.gmail.com> > > Content-Type: text/plain; charset="UTF-8" > > > > > > > > > > > You can use nested expansions / alternation... > > > > > > %{%{%{remote-id}:-%{circuit-id}}:-%{mac-address}} > > > > > > See the debug output for the actual names of the attributes. > > > > > > Use that for the key, and then whatever is there will just work. > > > > > > ok, I'll dig into that. > > > > > > It appears that all DHCP servers work under the assumption that if > you > > > want > > > > to do something like this you'll radius back it against a database w/ > > CRM > > > > etc. I don't really care about the database part of this initially. > > > > > > > > Thoughts? is this something freeradius can be configured to handle > > > without > > > > adding a database backend? > > > > > > It's difficult to do DHCP assignment without a database. You > generally > > > need some way to track the IP address assignments. > > > > > > Alan DeKok. > > > > > > > I don't really want to track IPs in a database, I want them in my routers > > so I'd prefer freeradius as just the radius backend, not using it's DHCP > > capabilities. > > > > Ideally, I want to use Mikrotik's DHCP server hitting freeradius because > I > > don't really want to track the IPs so much as just offer a very long > lease > > and I'd prefer the visibility of that right in the router itself. I > might > > be missing something here though. DHCP request comes in w/ option 82 > extra > > data, forwards to radius, freeradius replies with a client ID based on > what > > I've used to filter yes? ie, request comes in with remote id of > '00:11:22' > > so I want freeradius to reply with client id of 00:11:22' and 'dhcp pool > = > > users' and 'accept'. Then my router will hand out an address from pool > > 'users' and the lease will show that client id. If another dhcp request > > comes in with a different MAC but the same option 82 remote ID, radius > will > > do the same thing, reply back with the client id and the lease get's > > updated/replaced. > > > > Does this makes sense? > > > > > > ------------------------------ > > > > Message: 2 > > Date: Thu, 22 Sep 2022 12:24:14 -0400 > > From: Alan DeKok <aland(a)deployingradius.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: looking for help on an unusual config > > Message-ID: <B775FF3A-D488-4152-9BA1-14F36AFA4902(a)deployingradius.com> > > Content-Type: text/plain; charset=us-ascii > > > > On Sep 22, 2022, at 12:12 PM, dan <dandenson(a)gmail.com> wrote: > > > ie, request comes in with remote id of '00:11:22' > > > so I want freeradius to reply with client id of 00:11:22' and 'dhcp > pool > > = > > > users' and 'accept'. > > > > OK... I assume there are actual RADIUS attributes for this? > > > > They're certainly not standard attributes. Maybe Mikrotik has such > > attributes, but I don't use Mikrotik, so I'm not familiar with them. > > > > > Then my router will hand out an address from pool > > > 'users' and the lease will show that client id. If another dhcp > request > > > comes in with a different MAC but the same option 82 remote ID, radius > > will > > > do the same thing, reply back with the client id and the lease get's > > > updated/replaced. > > > > > > Does this makes sense? > > > > That explanation makes a lot more sense than the previous very vague > > question. Details matter. And giving details helps us give you the > > correct solution. > > > > Which here is (as always): run the server in debug mode. > > > > See which attributes come in the packet. Then, write if / then / else > > rules to match attributes. And to reply with more attributes. > > > > See the Mikrotik documentation and/or dictionaries for which attributes > > need to be in the reply. > > > > See the FreeRADIUS documentation for how to configure FreeRADIUS. > > > > There are 1000 vendors, each of which have 1000 different products. We > > can't document them all, unfortunately. > > > > Alan DeKok. > > > > > > > > ------------------------------ > > > > Message: 3 > > Date: Thu, 22 Sep 2022 13:31:43 -0600 > > From: dan <dandenson(a)gmail.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: looking for help on an unusual config > > Message-ID: > > < > > CAA_JP8WugNMinue45nZykEiXLsYBKroxXY-sGvuFXyK+OMO1SQ(a)mail.gmail.com> > > Content-Type: text/plain; charset="UTF-8" > > > > 'Alan, thanks for the help here, I appreciate it. Took me a minute to > > get freeradius installed and hack my way through the very basics but > > here's what I have. > > > > Test setup is ubuntu 22.04 freeradius from repos. Mikrotik routeros > > v7 'router' running DHCP with radius pointed to the ubuntu box. > > Another mikrotik v7 'bridge' to insert DHCP option 82. > > The data it inserts is: > > Agent Circuit ID = 'mAP-1 eth 0/2' > > Agent Remote ID = 'ether2' > > > > So I'm looking for the Circuit ID here. > > > > freeradius -X -x with the client for the mikrotik router. > > > > I'm using a yealink phone as the target device here because it's handy. > > > > Ready to process requests > > (8) Received Accounting-Request Id 76 from 192.168.1.208:50139 to > > 192.168.1.211:1813 length 216 > > (8) User-Name = "00:15:65:A4:E0:1F" > > (8) NAS-Port-Type = Ethernet > > (8) NAS-Port = 2208301057 > > (8) Service-Type = Framed-User > > (8) Calling-Station-Id = "1:0:15:65:a4:e0:1f" > > (8) Framed-IP-Address = 100.72.2.199 > > (8) Called-Station-Id = "APs" > > (8) Agent-Remote-Id = 0x657468657232 > > (8) ADSL-Agent-Remote-Id = 0x657468657232 > > (8) Agent-Circuit-Id = 0x6d41502d312065746820302f32 > > (8) ADSL-Agent-Circuit-Id = 0x6d41502d312065746820302f32 > > (8) Event-Timestamp = "Sep 22 2022 19:15:06 UTC" > > (8) Acct-Status-Type = Stop > > (8) Acct-Session-Id = "0100a083" > > (8) Acct-Authentic = Local > > (8) Acct-Session-Time = 2218 > > (8) NAS-Identifier = "RLB-Access" > > (8) Acct-Delay-Time = 0 > > (8) NAS-IP-Address = 192.168.1.208 > > > > Agent-Remote-Id's HEX converts to 'ether2' > > Agent-Circuit-Id's HEX converts to 'mAP-1 eth 0/2' > > The 'ADSL versions are identical data so either one I think is usable.. > > > > > > On some platforms I can manipulate these two values. On these > > Mikrotik's Remote ID is always set to the device id + serialized port > > id, 'mAP-1' is the 'bridge' device's identification (I can change > > this) and 'eth 0/2' is switch1, port 2 So basically I want to use the > > 'Agent-Circuit-Id'. Other platforms like cambiums cnwave I manually > > put this data into the customer prem radio, so that's likely the > > radio's MAC address. On Ubiquiti I can't remember but I think it's > > radio name + port number as well. I can verify this later. End of > > the day, the HEX value of agent id I think is what I want as the > > username *AND* what I want freeradius to reply for Client ID. > > > > > > On Thu, Sep 22, 2022 at 10:24 AM Alan DeKok <aland(a)deployingradius.com> > > wrote: > > > > > > On Sep 22, 2022, at 12:12 PM, dan <dandenson(a)gmail.com> wrote: > > > > ie, request comes in with remote id of '00:11:22' > > > > so I want freeradius to reply with client id of 00:11:22' and 'dhcp > > pool = > > > > users' and 'accept'. > > > > > > OK... I assume there are actual RADIUS attributes for this? > > > > > > They're certainly not standard attributes. Maybe Mikrotik has such > > attributes, but I don't use Mikrotik, so I'm not familiar with them. > > > > > > > Then my router will hand out an address from pool > > > > 'users' and the lease will show that client id. If another dhcp > > request > > > > comes in with a different MAC but the same option 82 remote ID, > radius > > will > > > > do the same thing, reply back with the client id and the lease get's > > > > updated/replaced. > > > > > > > > Does this makes sense? > > > > > > That explanation makes a lot more sense than the previous very vague > > question. Details matter. And giving details helps us give you the > > correct solution. > > > > > > Which here is (as always): run the server in debug mode. > > > > > > See which attributes come in the packet. Then, write if / then / > else > > rules to match attributes. And to reply with more attributes. > > > > > > See the Mikrotik documentation and/or dictionaries for which > > attributes need to be in the reply. > > > > > > See the FreeRADIUS documentation for how to configure FreeRADIUS. > > > > > > There are 1000 vendors, each of which have 1000 different products. > > We can't document them all, unfortunately. > > > > > > Alan DeKok. > > > > > > - > > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > ------------------------------ > > > > Message: 4 > > Date: Fri, 23 Sep 2022 07:03:47 +0200 > > From: Steven Walters <steven.walters1(a)gmail.com> > > To: freeradius-users(a)lists.freeradius.org > > Subject: Fwd: Error binding to port for 0.0.0.0 port 1812 | address > > already used > > Message-ID: > > <CALF= > > EMJbdhACzrEzv97bnFg_q+25VVP9POVx1tmj1U8wBd5-2g(a)mail.gmail.com> > > Content-Type: text/plain; charset="UTF-8" > > > > Hi > > > > We are planning to upgrade from freeradius version 3.0.1 to 3.0.13. I am > > busy testing in the lab. After upgrade, radius don't want to start with > the > > following error: > > > > "Failed binding to auth address * port 1812 bound to server > > staticipaddress: Address already in use > > /etc/raddb/sites-enabled/staticipaddress[59]: Error binding to port for > > 0.0.0.0 port 1812" > > > > We are running multiple virtual servers on the same port 1812 and 1813. > The > > "ipaddr = *" set in all site configurations. > > > > It seems something changed between versions so any advice will be > > appreciated? > > > > Regards > > Steven > > > > > > ------------------------------ > > > > Message: 5 > > Date: Fri, 23 Sep 2022 09:22:47 +0100 > > From: Nick Porter <nick(a)portercomputing.co.uk> > > To: freeradius-users(a)lists.freeradius.org > > Subject: Re: Fwd: Error binding to port for 0.0.0.0 port 1812 | > > address already used > > Message-ID: > > <618c16c9-3a16-d8dd-a282-b720e5bf5469(a)portercomputing.co.uk> > > Content-Type: text/plain; charset="utf-8"; Format="flowed" > > > > On 23/09/2022 06:03, Steven Walters wrote: > > > Hi > > > > > > We are planning to upgrade from freeradius version 3.0.1 to 3.0.13. > > > > Why upgrade to 3.0.13 - that's 5 years old.? 3.2.0 or 3.0.26 are what > > you should be using now.? https://packages.networkradius.com/ > > > > > I am > > > busy testing in the lab. After upgrade, radius don't want to start with > > the > > > following error: > > > > > > "Failed binding to auth address * port 1812 bound to server > > > staticipaddress: Address already in use > > > /etc/raddb/sites-enabled/staticipaddress[59]: Error binding to port for > > > 0.0.0.0 port 1812" > > > > That error means something else is already bound to port 1812 - likely > > FreeRADIUS running in the background. > > > > Kill the existing processes first > > > > > > > > We are running multiple virtual servers on the same port 1812 and 1813. > > The > > > "ipaddr = *" set in all site configurations. > > > > > > It seems something changed between versions so any advice will be > > > appreciated? > > > > > > Regards > > > Steven > > > - > > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > -- > > Nick Porter > > > >

2 1

Re: Fwd: Error binding to port for 0.0.0.0 port 1812 | address already used
by Steven Walters 23 Sep '22

23 Sep '22

Thanks for the response Nick. I tried version first 3.0.26 but had an issue with the openldap driver on RHEL7 when trying to start freeradius. As we are running RHEL7 I decided on the highest version available from the RHEL7 repo, which is 3.0.13. I confirmed no freeradius is not running in the background. If I remove all the sites except default and inner-tunnel, freeradius starts fine. With the following sites enabled no start. [root(a)radius-02.cnt sites-enabled]# ls -ltr total 0 lrwxrwxrwx. 1 root radiusd 26 Sep 22 11:36 default -> ../sites-available/default lrwxrwxrwx. 1 root radiusd 31 Sep 22 11:36 inner-tunnel -> ../sites-available/inner-tunnel lrwxrwxrwx. 1 root root 25 Sep 23 18:38 mobile -> ../sites-available/mobile lrwxrwxrwx. 1 root root 34 Sep 23 18:38 staticipaddress -> ../sites-available/staticipaddress With only the following sites-enabled, freeradius starts. The same configs that worked under 3.0.1 with no issue. [root(a)radius-02.cnt sites-enabled]# ls -ltr total 0 lrwxrwxrwx. 1 root radiusd 26 Sep 22 11:36 default -> ../sites-available/default lrwxrwxrwx. 1 root radiusd 31 Sep 22 11:36 inner-tunnel -> ../sites-available/inner-tunnel Default, mobile and staticipaddress using the same protocols (1812 auth and 1813 acct) and "ipaddr=*" for all three. Kind Regards Steven On Fri, 23 Sept 2022 at 14:00, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: looking for help on an unusual config (dan) > 2. Re: looking for help on an unusual config (Alan DeKok) > 3. Re: looking for help on an unusual config (dan) > 4. Fwd: Error binding to port for 0.0.0.0 port 1812 | address > already used (Steven Walters) > 5. Re: Fwd: Error binding to port for 0.0.0.0 port 1812 | > address already used (Nick Porter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 22 Sep 2022 10:12:21 -0600 > From: dan <dandenson(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: looking for help on an unusual config > Message-ID: > <CAA_JP8XYijQ+vp349N23TOtPtR+L8X_ofdCv541cagq= > 3kF4Ug(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > > > > > > You can use nested expansions / alternation... > > > > %{%{%{remote-id}:-%{circuit-id}}:-%{mac-address}} > > > > See the debug output for the actual names of the attributes. > > > > Use that for the key, and then whatever is there will just work. > > > > ok, I'll dig into that. > > > > It appears that all DHCP servers work under the assumption that if you > > want > > > to do something like this you'll radius back it against a database w/ > CRM > > > etc. I don't really care about the database part of this initially. > > > > > > Thoughts? is this something freeradius can be configured to handle > > without > > > adding a database backend? > > > > It's difficult to do DHCP assignment without a database. You generally > > need some way to track the IP address assignments. > > > > Alan DeKok. > > > > I don't really want to track IPs in a database, I want them in my routers > so I'd prefer freeradius as just the radius backend, not using it's DHCP > capabilities. > > Ideally, I want to use Mikrotik's DHCP server hitting freeradius because I > don't really want to track the IPs so much as just offer a very long lease > and I'd prefer the visibility of that right in the router itself. I might > be missing something here though. DHCP request comes in w/ option 82 extra > data, forwards to radius, freeradius replies with a client ID based on what > I've used to filter yes? ie, request comes in with remote id of '00:11:22' > so I want freeradius to reply with client id of 00:11:22' and 'dhcp pool = > users' and 'accept'. Then my router will hand out an address from pool > 'users' and the lease will show that client id. If another dhcp request > comes in with a different MAC but the same option 82 remote ID, radius will > do the same thing, reply back with the client id and the lease get's > updated/replaced. > > Does this makes sense? > > > ------------------------------ > > Message: 2 > Date: Thu, 22 Sep 2022 12:24:14 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: looking for help on an unusual config > Message-ID: <B775FF3A-D488-4152-9BA1-14F36AFA4902(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Sep 22, 2022, at 12:12 PM, dan <dandenson(a)gmail.com> wrote: > > ie, request comes in with remote id of '00:11:22' > > so I want freeradius to reply with client id of 00:11:22' and 'dhcp pool > = > > users' and 'accept'. > > OK... I assume there are actual RADIUS attributes for this? > > They're certainly not standard attributes. Maybe Mikrotik has such > attributes, but I don't use Mikrotik, so I'm not familiar with them. > > > Then my router will hand out an address from pool > > 'users' and the lease will show that client id. If another dhcp request > > comes in with a different MAC but the same option 82 remote ID, radius > will > > do the same thing, reply back with the client id and the lease get's > > updated/replaced. > > > > Does this makes sense? > > That explanation makes a lot more sense than the previous very vague > question. Details matter. And giving details helps us give you the > correct solution. > > Which here is (as always): run the server in debug mode. > > See which attributes come in the packet. Then, write if / then / else > rules to match attributes. And to reply with more attributes. > > See the Mikrotik documentation and/or dictionaries for which attributes > need to be in the reply. > > See the FreeRADIUS documentation for how to configure FreeRADIUS. > > There are 1000 vendors, each of which have 1000 different products. We > can't document them all, unfortunately. > > Alan DeKok. > > > > ------------------------------ > > Message: 3 > Date: Thu, 22 Sep 2022 13:31:43 -0600 > From: dan <dandenson(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: looking for help on an unusual config > Message-ID: > < > CAA_JP8WugNMinue45nZykEiXLsYBKroxXY-sGvuFXyK+OMO1SQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > 'Alan, thanks for the help here, I appreciate it. Took me a minute to > get freeradius installed and hack my way through the very basics but > here's what I have. > > Test setup is ubuntu 22.04 freeradius from repos. Mikrotik routeros > v7 'router' running DHCP with radius pointed to the ubuntu box. > Another mikrotik v7 'bridge' to insert DHCP option 82. > The data it inserts is: > Agent Circuit ID = 'mAP-1 eth 0/2' > Agent Remote ID = 'ether2' > > So I'm looking for the Circuit ID here. > > freeradius -X -x with the client for the mikrotik router. > > I'm using a yealink phone as the target device here because it's handy. > > Ready to process requests > (8) Received Accounting-Request Id 76 from 192.168.1.208:50139 to > 192.168.1.211:1813 length 216 > (8) User-Name = "00:15:65:A4:E0:1F" > (8) NAS-Port-Type = Ethernet > (8) NAS-Port = 2208301057 > (8) Service-Type = Framed-User > (8) Calling-Station-Id = "1:0:15:65:a4:e0:1f" > (8) Framed-IP-Address = 100.72.2.199 > (8) Called-Station-Id = "APs" > (8) Agent-Remote-Id = 0x657468657232 > (8) ADSL-Agent-Remote-Id = 0x657468657232 > (8) Agent-Circuit-Id = 0x6d41502d312065746820302f32 > (8) ADSL-Agent-Circuit-Id = 0x6d41502d312065746820302f32 > (8) Event-Timestamp = "Sep 22 2022 19:15:06 UTC" > (8) Acct-Status-Type = Stop > (8) Acct-Session-Id = "0100a083" > (8) Acct-Authentic = Local > (8) Acct-Session-Time = 2218 > (8) NAS-Identifier = "RLB-Access" > (8) Acct-Delay-Time = 0 > (8) NAS-IP-Address = 192.168.1.208 > > Agent-Remote-Id's HEX converts to 'ether2' > Agent-Circuit-Id's HEX converts to 'mAP-1 eth 0/2' > The 'ADSL versions are identical data so either one I think is usable.. > > > On some platforms I can manipulate these two values. On these > Mikrotik's Remote ID is always set to the device id + serialized port > id, 'mAP-1' is the 'bridge' device's identification (I can change > this) and 'eth 0/2' is switch1, port 2 So basically I want to use the > 'Agent-Circuit-Id'. Other platforms like cambiums cnwave I manually > put this data into the customer prem radio, so that's likely the > radio's MAC address. On Ubiquiti I can't remember but I think it's > radio name + port number as well. I can verify this later. End of > the day, the HEX value of agent id I think is what I want as the > username *AND* what I want freeradius to reply for Client ID. > > > On Thu, Sep 22, 2022 at 10:24 AM Alan DeKok <aland(a)deployingradius.com> > wrote: > > > > On Sep 22, 2022, at 12:12 PM, dan <dandenson(a)gmail.com> wrote: > > > ie, request comes in with remote id of '00:11:22' > > > so I want freeradius to reply with client id of 00:11:22' and 'dhcp > pool = > > > users' and 'accept'. > > > > OK... I assume there are actual RADIUS attributes for this? > > > > They're certainly not standard attributes. Maybe Mikrotik has such > attributes, but I don't use Mikrotik, so I'm not familiar with them. > > > > > Then my router will hand out an address from pool > > > 'users' and the lease will show that client id. If another dhcp > request > > > comes in with a different MAC but the same option 82 remote ID, radius > will > > > do the same thing, reply back with the client id and the lease get's > > > updated/replaced. > > > > > > Does this makes sense? > > > > That explanation makes a lot more sense than the previous very vague > question. Details matter. And giving details helps us give you the > correct solution. > > > > Which here is (as always): run the server in debug mode. > > > > See which attributes come in the packet. Then, write if / then / else > rules to match attributes. And to reply with more attributes. > > > > See the Mikrotik documentation and/or dictionaries for which > attributes need to be in the reply. > > > > See the FreeRADIUS documentation for how to configure FreeRADIUS. > > > > There are 1000 vendors, each of which have 1000 different products. > We can't document them all, unfortunately. > > > > Alan DeKok. > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 4 > Date: Fri, 23 Sep 2022 07:03:47 +0200 > From: Steven Walters <steven.walters1(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Fwd: Error binding to port for 0.0.0.0 port 1812 | address > already used > Message-ID: > <CALF= > EMJbdhACzrEzv97bnFg_q+25VVP9POVx1tmj1U8wBd5-2g(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi > > We are planning to upgrade from freeradius version 3.0.1 to 3.0.13. I am > busy testing in the lab. After upgrade, radius don't want to start with the > following error: > > "Failed binding to auth address * port 1812 bound to server > staticipaddress: Address already in use > /etc/raddb/sites-enabled/staticipaddress[59]: Error binding to port for > 0.0.0.0 port 1812" > > We are running multiple virtual servers on the same port 1812 and 1813. The > "ipaddr = *" set in all site configurations. > > It seems something changed between versions so any advice will be > appreciated? > > Regards > Steven > > > ------------------------------ > > Message: 5 > Date: Fri, 23 Sep 2022 09:22:47 +0100 > From: Nick Porter <nick(a)portercomputing.co.uk> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Fwd: Error binding to port for 0.0.0.0 port 1812 | > address already used > Message-ID: > <618c16c9-3a16-d8dd-a282-b720e5bf5469(a)portercomputing.co.uk> > Content-Type: text/plain; charset="utf-8"; Format="flowed" > > On 23/09/2022 06:03, Steven Walters wrote: > > Hi > > > > We are planning to upgrade from freeradius version 3.0.1 to 3.0.13. > > Why upgrade to 3.0.13 - that's 5 years old.? 3.2.0 or 3.0.26 are what > you should be using now.? https://packages.networkradius.com/ > > > I am > > busy testing in the lab. After upgrade, radius don't want to start with > the > > following error: > > > > "Failed binding to auth address * port 1812 bound to server > > staticipaddress: Address already in use > > /etc/raddb/sites-enabled/staticipaddress[59]: Error binding to port for > > 0.0.0.0 port 1812" > > That error means something else is already bound to port 1812 - likely > FreeRADIUS running in the background. > > Kill the existing processes first > > > > > We are running multiple virtual servers on the same port 1812 and 1813. > The > > "ipaddr = *" set in all site configurations. > > > > It seems something changed between versions so any advice will be > > appreciated? > > > > Regards > > Steven > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- > Nick Porter > >

2 1

sqlippool, allocate_find and duplicate address if NAS packets are received in the reverse order
by Matteo Sgalaberni 23 Sep '22

23 Sep '22

Hi, I found on this patch a huge change on the sqlippool: https://github.com/FreeRADIUS/freeradius-server/commit/38e475f424d4abb1b3ec… I see that it's well documented on wiki. I have a doubt about the "allocate_existing". I'm using the oldest query "allocate_find" that do in the same query "allocate_existing+allocate_find" and works well. I can probably understand why the developer who wrote this patch divided this, so it's simpler to disable the sticky ip. I'm running in a problem with "sticky ip" (old query allocate_existing): allocate_find = " \ SELECT framedipaddress \ FROM ${ ippool_table } \ WHERE pool_name = '%{control:${pool_name}}' \ AND ( \ expiry_time < 'now' :: timestamp ( 0 ) \ OR ( nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool_key}' ) \ ) \ ORDER BY \ ( username <> '%{SQL-User-Name}' ), \ ( callingstationid <> '%{Calling-Station-Id}' ), \ expiry_time \ LIMIT 1 \ FOR UPDATE " Sometimes, in rare case when the customer have a very quick disconnection/reconnection happen that the NAS send the Access-Request before the stop Accounting-Request. So in that case happen: 1) Access_Request -> allocate_find (find the same ip to the same user) + allocate_update (assign same ip, renew lease) 2) Accounting-Request Stop -> allocate_free (clear ip) Now, the IP is assigned, but on sqlippool is marked as free...and sometime in the future another user will obtain the same IP and I have a duplicate assignment. Is this behaviour normal and "known"? I can't find this "warn" on wiki/documentation. If this is normal and known I think that I need to kill the "stitky ip" capability to solve the issue in these way: Way A) remove " nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool_key}'" and ORDER BY \ (username <> '%{SQL-User-Name}') from allocate_find or Way B) using the new queries.conf of the last branch and commenting the "allocate_existing" The IP in that case is not assigned again to the same user and I'm sure that the NAS packets order are not creating issues. Thanks Matteo

3 4