Hi everybody, I had configured freeradius with mysql and writting in a second detail. This second file was readed by radrelay and accounting data was replicated between both servers. All worked fine. Now when I have tried to configure a second radrelay on the second server (that only recieved account data from the other server), first radrelay from the first server not works and all the system not works fine. The first server only writes in detail file if it is not launch with -n radrelay option. I think that it's very rare. Is it possible that radrelay works between two servers but only in one sense? What is happening? Regards, -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problems-with-radrelay-tp4918721p491... Sent from the FreeRadius - User mailing list archive at Nabble.com.
tonimanel wrote:
Now when I have tried to configure a second radrelay on the second server (that only recieved account data from the other server), first radrelay from the first server not works and all the system not works fine.
See the FAQ for "it doesn't work"
The first server only writes in detail file if it is not launch with -n radrelay option.
That's how it's supposed to work.
I think that it's very rare. Is it possible that radrelay works between two servers but only in one sense?
What is happening?
You misconfigured the system. Alan DeKok.
I did not write the output result.
The first server only writes in detail file if it is not launch with -n radrelay option.
That's how it's supposed to work.
Yes, but I want to say that only writes in detail_file (second detail file) when it's launch without -n radrelay option, when it should writes in detail_file (second detail file) with or without -n option, I think. I am going to write the steps that I have followed to check the result of the freeradius service. - I have tested both freeradius servers and both work fine when work individually. The first freeradius server writes in second_detail file, and second freeradius server doesn't writes in second_detail file because it is not configured (correct!). Both servers work fine with authentication and accounting processes. - When I launch first freeradius server with -X -n radrelay options, radrelay reads from second_detail file (that exists) and send records to second freeradius server. The second freeradius server writes records in radacct table (database). Then, first freeradius server delete the second_detail file. - When I try to authenticate to first freeradius server I get a timeout message. - The service is continuing trying to read from second_detail file (that not exists because was deleted by first freeradius service) and it's ignoring all authentication requests (in output result not appears nothing about authentication requests). Outputs: First freeradius server with -X option: http://freeradius.1045715.n5.nabble.com/file/n4920900/first_freeradius-X_aut... first_freeradius-X_authentication%26accounting.txt Second detail_file exists: root@debian:/var/log/freeradius/radacct# ls -l total 12 drwxr-xr-x 2 freerad freerad 4096 oct 19 10:34 192.168.1.163 drwxr-xr-x 2 freerad freerad 4096 oct 20 09:30 192.168.1.7 -rw------- 1 freerad freerad 368 oct 20 11:11 second_detail <-------------- This root@debian:/var/log/freeradius/radacct# First freeradius server with -X -n radrelay and second freeradius server with -X option and listening: http://freeradius.1045715.n5.nabble.com/file/n4920900/first_freerasius-X-n_s... first_freerasius-X-n_synchronize_nothningmore.txt http://freeradius.1045715.n5.nabble.com/file/n4920900/second_listentingradre... second_listentingradrelay.txt At the end, first freeradius server says: violation of the segment Would you need the configuration files? First freeradius server: http://freeradius.1045715.n5.nabble.com/file/n4920900/radiusd.conf radiusd.conf http://freeradius.1045715.n5.nabble.com/file/n4920900/radrelay.conf radrelay.conf Second freeradius server: http://freeradius.1045715.n5.nabble.com/file/n4920900/radiusd.conf radiusd.conf If yuo need any thing else, please tell me. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problems-with-radrelay-tp4918721p492... Sent from the FreeRadius - User mailing list archive at Nabble.com.
On Thu, Oct 20, 2011 at 4:31 PM, tonimanel <antoniofernandez@fabergames.com> wrote:
I did not write the output result.
The first server only writes in detail file if it is not launch with -n radrelay option.
That's how it's supposed to work.
Yes, but I want to say that only writes in detail_file (second detail file) when it's launch without -n radrelay option, when it should writes in detail_file (second detail file) with or without -n option, I think.
As usual, back to basics. Where did you get "-n radrelay"? Had you bother to run "man radrelay" (to look at the manpage) you'd immediately see " NAME radrelay -- Deprecated command. " You DO know what deprecated means, right? Note that in the last numbered list to check I wrote earlier, I didn't mention anything about radrelay. What I wrote is basically steps to check when you want to write accounting to a db AND file, then use a virtual server to read the file and proxy it to another radius server. Have you been following the list? What number are you on? -- Fajar
tonimanel wrote:
Yes, but I want to say that only writes in detail_file (second detail file) when it's launch without -n radrelay option, when it should writes in detail_file (second detail file) with or without -n option, I think.
No. You don't understand what "-n" means. It's documented. "-n" means load a COMPLETELY DIFFERENT configuration. You seem to think that there's one "radiusd" process, and it magically knows everything, even when you point it at a different configuration file.
- I have tested both freeradius servers and both work fine when work individually. The first freeradius server writes in second_detail file, and second freeradius server doesn't writes in second_detail file because it is not configured (correct!). Both servers work fine with authentication and accounting processes.
OK...
- When I launch first freeradius server with -X -n radrelay options, radrelay reads from second_detail file (that exists) and send records to second freeradius server. The second freeradius server writes records in radacct table (database). Then, first freeradius server delete the second_detail file.
OK...
- When I try to authenticate to first freeradius server I get a timeout message.
Nonsense. The debug log you posted shows it sending an Access-Accept.
- The service is continuing trying to read from second_detail file (that not exists because was deleted by first freeradius service) and it's ignoring all authentication requests (in output result not appears nothing about authentication requests).
Because you told it to ignore authentication packets. Again, the debug output shows this. Honestly, I don't see what the problem is. You've been doing enormous amounts of work to try to solve the problem. It should really be about 15 minutes to follow the documentations and the messages on this list.
At the end, first freeradius server says: violation of the segment
Not in any debug output you posted.
Would you need the configuration files?
No.
If yuo need any thing else, please tell me.
We need you to read the debug output, and the messages on this list. Alan DeKok.
Hi everybody. I guess that it's normal but I would like to know it. I have configured two servers with robust-proxy-accounting model. My doubt is, when radiusA server writes a record into database, writes Its current time and then sends accounting packet to radiusB server (proxying). RadiusB server receives the packet and writes the record into database but with different time (obviously Its current time) (a few seconds of difference). This is correct? I thnik that yes... So, if I want to have the same data between radiusA and radiusB, must I to use copy-acct-to-home configuration model to get it? Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problems-with-radrelay-tp4918721p492... Sent from the FreeRadius - User mailing list archive at Nabble.com.
tonimanel wrote:
I guess that it's normal but I would like to know it. I have configured two servers with robust-proxy-accounting model. My doubt is, when radiusA server writes a record into database, writes Its current time and then sends accounting packet to radiusB server (proxying). RadiusB server receives the packet and writes the record into database but with different time (obviously Its current time) (a few seconds of difference). This is correct?
Possibly. More recent versions of the server update the Event-Timestamp && Acct-Delay-Time attributes. They keep track of the time when it was written to the detail file, versus when it was sent to the other server. The other server then uses those attributes to track when the session really started.
So, if I want to have the same data between radiusA and radiusB, must I to use copy-acct-to-home configuration model to get it?
Yes. Alan DeKok.
participants (3)
-
Alan DeKok -
Fajar A. Nugraha -
tonimanel