problem with rlm_dbm_parser and DEFAULT Realms
Using freeradius2.1.3 and rlm_dbm module Having a problem with rlm_dbm_parser to create dbm file. Testing with 3 DEFAULT Realm records and two username/password. Seems to be overwriting DEFAULT Realm as only last one exists. rlm_dbm_parser reports all records read and no errors but rlm_dbm_cat shows only last Default. radclient tests naturally only succeed with DEFAULT domain_three Is there a know issue here on creating dbm files or have I missed some setting to allow multiple DEFAULT Realm=xxx records in dbm file. Desired approach is - dbm file with large numbers of DEFAULT Realm and all with no fallthru. - we have no other (catch-all) DEFAULTs with explicit accept or reject - ideally usernames matching these realms (proxy.conf) and DEFAULT Realm should respond with Accept straight away - no searching full subscriber base dbm file and then DEFAULT match. (e.g treat DEFAULT Realm =xxx as distinct from generic DEFAULT) - ideally have DEFAULT Realm=xxx be read in to hash/memory from separate file and DBM users just have subscriber base (user/pass). This way every time users.db updated/re-created/re-read - does not impact DEFAULT Realm=xxx records. The later Realms more static - subscriber base changes more dynamic. - Also using dbm as faster/ less memory resources and no need to restart radiusd as dbm files change - and do change constantly.. This possible? Logs below: Test users file -------------------- DEFAULT Realm == "domain_one", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IP, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "realm1", Tunnel-Password:1 = "xxx", Tunnel-Assignment-Id:1 = "xxx", Tunnel_Algorithm = 2, Tunnel_Domain = 1 DEFAULT Realm == "domain_two", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IP, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "realm2", Tunnel-Password:1 = "xxx", Tunnel-Assignment-Id:1 = "xxx", Tunnel_Algorithm = 2, Tunnel_Domain = 1 DEFAULT Realm == "domain_three", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IP, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "realm3", Tunnel-Password:1 = "xxx", Tunnel-Assignment-Id:1 = "xxx", Tunnel_Algorithm = 2, Tunnel_Domain = 1 userone@one Cleartext-Password := "pass" Class = "xxxclass1xxx", Service-Type = Framed-User, Framed-Protocol = PPP usertwo@norealm Cleartext-Password := "pass", Calling-Station-Id == "123456" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 10.10.10.0, Framed-IP-Netmask = 255.255.255.240, ------------------------------------------------------------------ rlm_dbm_parser logs: %% # /usr/local/freeradius/bin/rlm_dbm_parser -c -xxx -i /usr/local/freeradius/etc/raddb/users_generic -o /usr/local/freeradius/etc/raddb/users Use dictionary in: /usr/local/freeradius/etc/raddb Found user: DEFAULT Found user: DEFAULT Found user: DEFAULT Found user: userone@one Found user: usertwo@norealm Record loaded: 5 Lines parsed: 41 Record skiped: 0 Warnings: 0 Errors: 0 %%# rlm_dbm_cat logs - only shows last DEFAULT Realm ------------------------------ %% # /usr/local/freeradius/bin/rlm_dbm_cat -f /usr/local/freeradius/etc/raddb/users DEFAULT Realm == "domain_three", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IPv4, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "realm3", Tunnel-Password:1 = "xxx", Tunnel-Assignment-Id:1 = "xxx", Tunnel_Algorithm = 2, Tunnel_Domain = 1 userone@one Cleartext-Password := "pass" Class = "xxxclass1xxx", Service-Type = Framed-User, Framed-Protocol = PPP usertwo@norealm Cleartext-Password := "pass", Calling-Station-Id == "123456" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 10.10.10.0, Framed-IP-Netmask = 255.255.255.240 %%# ----------------------- Havent included radiusd -X logs as issue seems to be creating dbm file and hence before using Radius. radclient tests are successful when matching 3 records that do exit in dbm file. Problem is two missing records
Seamus Bridgeman wrote:
Using freeradius2.1.3 and rlm_dbm module
Why? There's no need to use the DBM module. See recent messages on this list.
Having a problem with rlm_dbm_parser to create dbm file. Testing with 3 DEFAULT Realm records and two username/password. Seems to be overwriting DEFAULT Realm as only last one exists. rlm_dbm_parser reports all records read and no errors but rlm_dbm_cat shows only last Default.
<shrug> Don't bother debugging it. Just use the "users" file.
Desired approach is - dbm file with large numbers of DEFAULT Realm and all with no fallthru.
Why is DBM a *requirement*? The server can load 10's of 1000's of "users" file entries in less than a second.
- Also using dbm as faster/ less memory resources and no need to restart radiusd as dbm files change - and do change constantly..
No. In 2.x. you can reload the server dynamically. In 2.1.x, you can even use "radmin" to reload *just* the "files" module. Alan DeKok.
Id really appreciate anyone could clarify if they are indeed using DBM files with multiple DEFAULT user profiles and/or user profiles with duplicate usernames. From my tests and cursory look at code (especially rlm_dbm_parser), it seems the key is based solely on username which wont work for multiple 'DEFAULT' usernames or duplicate usernames. As the key-value pair will be overwritten and this is what I see. Only the last DEFAULT Realm=xxx record exists in the DBM file. Other/Earlier Radius implementations used a combination of username and incremental counter to support ordered duplicate usernames.So multiple DEFAULTS would be read in as DEFAULT, DEFAULT\n00, DEFAULT\n01 ...when creating the DBM file and equally duplicate username matches would be returned by adding the same incremental counter when fetching . This is causing an issue for us as we cant migrate from this earlier Radius to Freeradius2.1.3 Could I also ask if anyone is explicltiy using DEFAULT Realm = xxx records in the DBM file and also if they are using regexp matches successfully (e.g DEFAULT Realm =~ "*.domain) as the rlm_dbm_parser is not matching this and records Realm as "" (bombs out on *). I know there is a regexp fix in 2.1.4 but not sure if this also applies to rlm_dbm_parser. thanks in anticipation/desperation ! Seamus
Seamus Bridgeman wrote:
Id really appreciate anyone could clarify if they are indeed using DBM files with multiple DEFAULT user profiles and/or user profiles with duplicate usernames.
Very few people are using the DBM module. The "users" file is better for small numbers of entries, and SQL DB's are better for large numbers of entries.
From my tests and cursory look at code (especially rlm_dbm_parser), it seems the key is based solely on username which wont work for multiple 'DEFAULT' usernames or duplicate usernames. As the key-value pair will be overwritten and this is what I see. Only the last DEFAULT Realm=xxx record exists in the DBM file.
It does look like that's what the code does. In fact, looking at the git log, the last *substantive* change to the code was in 2002. The only other changes since then have been things like re-generating the "configure" script, or internal server maintenance (fixing includes, renaming functions, etc.) i.e. No one has touched the code in a *long* time.
Other/Earlier Radius implementations used a combination of username and incremental counter to support ordered duplicate usernames.So multiple DEFAULTS would be read in as DEFAULT, DEFAULT\n00, DEFAULT\n01 ...when creating the DBM file and equally duplicate username matches would be returned by adding the same incremental counter when fetching .
See the "files" module. It does something similar, but uses instead an entry number (called "order"), and tracks the "next" DEFAULT entry. This is more robust than simply naming the entries "DEFAULT0", "DEFAULT1", etc.
This is causing an issue for us as we cant migrate from this earlier Radius to Freeradius2.1.3
You have access to the source code. The fixes shouldn't be too hard.
Could I also ask if anyone is explicltiy using DEFAULT Realm = xxx records in the DBM file and also if they are using regexp matches successfully (e.g DEFAULT Realm =~ "*.domain) as the rlm_dbm_parser is not matching this and records Realm as "" (bombs out on *). I know there is a regexp fix in 2.1.4 but not sure if this also applies to rlm_dbm_parser.
It doesn't. No one has changed the rlm_dbm source code in almost 7 years. Alan DeKok.
participants (2)
-
Alan DeKok -
Seamus Bridgeman