Change between 2.2.1 and 2.2.2
Hi, There seems to be a change that’s happened between vsn 2.2.1 and 2.2.2 We’re in the process of implementing a phased take-over of the management of our CSE dept radius services. What I’m doing is 1). Point CSE switches at our radius server 2) Check mac address of client ( calling station id) 3). If I know about it, perform mac-auth and send access accept with appropriate parameters 4). If I don’t know about it proxy it off to another server which in turn proxies it off to the CSE radius service and act upon the result that comes back. This all worked just fine for 2.2.0 and 2.2.1.In the log file I’d also see entries of the form Fri Nov 1 16:17:10 2013 : Auth: Login incorrect (Home Server says so): [<blah!>/<CHAP-Password>] (from client nasaaa5 port 48 cli <mac-address of client>) Which is fine, it just means that I don't know that mac address and neither does the remote (CSE) server. It’s usually a client that is trying to do a macauth 1st and then an EAP auth with user credentials. An upgrade to 2.2.2 caused these messages to disappear. I saw another freeradius message to day that implied theres been a change that silently drops access-rejects instead of passing them back up the food chain to the client … or something like that…. managed to delete the message :-(( If that’s the case, how do I get the 2.2.1/2.2.0 functionality back please. Rgds Alex
Hi,
An upgrade to 2.2.2 caused these messages to disappear. I saw another freeradius message to day that implied theres been a change that silently drops access-rejects instead of passing them back up the food chain to the client ... or something like that.... managed to delete the message :-((
apply the patch Phil emailed.... just use the web interface to read todays emails (!) :-) alan
Hi, Well, applied the patch to my dev server and tried to run 2.2.2 ..... It's died with a segmentation fault about 3 times today.... moved back to 2.2.1 for the time being. Only traffic through this box are a handful of switches doing macauth and dot1x and the switch my work macbook is connected to. Really not a lot of traffic How do you track generate logging to track down segmentation faults? A On 1 Nov 2013, at 17:05, Phil Mayers wrote:
On 01/11/13 16:27, Alex Sharaz wrote:
An upgrade to 2.2.2 caused these messages to disappear. I saw another freeradius message to day that implied theres been a change that
I'll post a follow-up to the thread; don't delete this one! ;o) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 03/11/2013 16:44, Alex Sharaz wrote:
Hi, Well, applied the patch to my dev server and tried to run 2.2.2 ..... It's died with a segmentation fault about 3 times today.... moved back to 2.2.1 for the time being. Only traffic through this box are a handful of switches doing macauth and dot1x and the switch my work macbook is connected to. Really not a lot of traffic
How do you track generate logging to track down segmentation faults?
See "doc/bugs"
Thx A On 3 Nov 2013, at 17:19, Phil Mayers <p.mayers@IMPERIAL.AC.UK> wrote:
On 03/11/2013 16:44, Alex Sharaz wrote:
Hi, Well, applied the patch to my dev server and tried to run 2.2.2 ..... It's died with a segmentation fault about 3 times today.... moved back to 2.2.1 for the time being. Only traffic through this box are a handful of switches doing macauth and dot1x and the switch my work macbook is connected to. Really not a lot of traffic
How do you track generate logging to track down segmentation faults?
See "doc/bugs" - List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
On 03/11/13 19:55, Alex Sharaz wrote:
On 03/11/2013 16:44, Alex Sharaz wrote:
Hi, Well, applied the patch to my dev server and tried to run 2.2.2 ..... It's died with a segmentation fault about 3 times today.... moved back to 2.2.1 for the time being. Only traffic through this box are a handful of switches doing macauth and dot1x and the switch my work macbook is connected to. Really not a lot of traffic
Have you been able to reproduce this? I'm running a copy of v2.x.x on our test server and can't crash it - checkout of e7c7350ed19d.
Hi, When it crashed there were 9 switches worth of dot1x and mac auth going through it. At the moment there's just me as I had to move the other switches onto our prodn box. It took till this afternoon but yup it still crashed. It might be due to the fact that I'm using the control-socket feature to reread various config files every 15 mins. This had caused a lot of grief from the time I moved up to 2.1.10. Just doing a general reload of the server would cause a crash at least once a day. Moving over to just specific channels has changed that to every week or so. I'm also running 2.2.2 on our eduroam facing server that auth inbound requests from york users against AD and proxy outgoing requests from visitors ( with your patch). It's been running for 6.5 hours without a hiccup. The only difference is that the config files are static on the eduroam box. Nothing changes as all auths are against AD. Had a read of the docs/bugs section early this morning. Tomorrow I'll run a debug version and see what happens. Rgds Alex On 4 Nov 2013, at 13:17, Phil Mayers <p.mayers@IMPERIAL.AC.UK> wrote:
On 03/11/13 19:55, Alex Sharaz wrote:
On 03/11/2013 16:44, Alex Sharaz wrote:
Hi, Well, applied the patch to my dev server and tried to run 2.2.2 ..... It's died with a segmentation fault about 3 times today.... moved back to 2.2.1 for the time being. Only traffic through this box are a handful of switches doing macauth and dot1x and the switch my work macbook is connected to. Really not a lot of traffic
Have you been able to reproduce this? I'm running a copy of v2.x.x on our test server and can't crash it - checkout of e7c7350ed19d. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alex Sharaz wrote:
It took till this afternoon but yup it still crashed. It might be due to the fact that I'm using the control-socket feature to reread various config files every 15 mins.
You might want to avoid that for the time being. Or, check that the files have *changed* before telling the server to re-read them. Alan DeKok.
On 4 Nov 2013, at 16:50, Alan DeKok <aland@deployingradius.com> wrote:
Alex Sharaz wrote:
It took till this afternoon but yup it still crashed. It might be due to the fact that I'm using the control-socket feature to reread various config files every 15 mins.
You might want to avoid that for the time being. Or, check that the files have *changed* before telling the server to re-read them.
At least its my developement server so I can have a play. At the moment I really don’t have an option but to reread config files. While I’m mpoving to a db driven back end, at the moment all our mac auth is done via flat text files . It was worse, my predecdessor was rereading things every 5 mins!! I’ll have a look at checking if files have been updated A
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Alex Sharaz -
Phil Mayers