Nabble - FreeRadius - User

Re: Changing the format of a date attribute

2009-12-09T06:57:29Z

Alan DeKok wrote:

> On 09-12-09 11:37 AM, Patric wrote:
>
>> The problem with the above is that some of those formatting options ('%M
>> %d %Y %H:%i:%s') are also defined as one-character variables, so instead
>> of formatting the date with those options, its replacing each with the
>> variable value, and when Im trying to end up with:
>>
>
> Use %% to escape the %. That should work. e.g.
>
> ' ... %%M %%d %%Y %%H:%%i:%%s'

Thanks Ill give that a go :)
Patric
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Changing the format of a date attribute

2009-12-09T06:54:30Z

On 09-12-09 11:37 AM, Patric wrote:
> The problem with the above is that some of those formatting options ('%M
> %d %Y %H:%i:%s') are also defined as one-character variables, so instead
> of formatting the date with those options, its replacing each with the
> variable value, and when Im trying to end up with:

Use %% to escape the %. That should work. e.g.

' ... %%M %%d %%Y %%H:%%i:%%s'

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: I cant Connect to GSM Operator by using APN

2009-12-09T05:59:51Z

On 09-12-09 2:27 PM, Tevfik Ceydeliler wrote:
> Hi,
> I have freeradius and I have a Secovid OTP server.
> I use free radius as proxy.
> When I try to connect via APN, altough OTP server accept-access , I get
> access-reject as final result.
> Can anybody say what is wrong???

This packet receives an accept:

> rad_recv: Access-Accept packet from host W.X.Y.Z port 1812, id=111,
> length=25

And this one receives a reject:

> rad_recv: Access-Reject packet from host W.X.Y.Z port 1812, id=105,
> length=25
...
> Wed Dec 9 15:04:58 2009 : Auth: Login incorrect (Home Server says so):

Fix the home server to send access accepts for this other user.

I don't understand why you're looking at FreeRADIUS in order to debug
a problem where the home server returns reject.

Alan DEKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I cant Connect to GSM Operator by using APN

2009-12-09T05:27:23Z

Hi,
I have freeradius and I have a Secovid OTP server.
I use free radius as proxy.
When I try to connect via APN, altough OTP server accept-access , I get access-reject as final result.
Can anybody say what is wrong???
Here is my debug:
##########################################################
rad_recv: Access-Request packet from host A.B.C.D port 2460, id=104, length=139
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 14457480
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Wed Dec 9 15:04:57 2009 : Info: +- entering group authorize {...}
Wed Dec 9 15:04:57 2009 : Info: ++[preprocess] returns ok
Wed Dec 9 15:04:57 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/auth-detail-20091209
Wed Dec 9 15:04:57 2009 : Info: [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/auth-detail-20091209
Wed Dec 9 15:04:57 2009 : Debug: expand: %t -> Wed Dec 9 15:04:57 2009
Wed Dec 9 15:04:57 2009 : Info: ++[auth_log] returns ok
Wed Dec 9 15:04:57 2009 : Info: [chap] Setting 'Auth-Type := CHAP'
Wed Dec 9 15:04:57 2009 : Info: ++[chap] returns ok
Wed Dec 9 15:04:57 2009 : Info: ++[mschap] returns noop
Wed Dec 9 15:04:57 2009 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL
Wed Dec 9 15:04:57 2009 : Info: [suffix] No such realm "NULL"
Wed Dec 9 15:04:57 2009 : Info: ++[suffix] returns noop
Wed Dec 9 15:04:57 2009 : Info: [eap] No EAP-Message, not doing EAP
Wed Dec 9 15:04:57 2009 : Info: ++[eap] returns noop
Wed Dec 9 15:04:57 2009 : Info: ++[unix] returns notfound
Wed Dec 9 15:04:57 2009 : Info: [files] users: Matched entry tevfikceydeliler at line 100
Wed Dec 9 15:04:57 2009 : Debug: expand: Hello, %{User-Name} -> Hello, tevfikceydeliler
Wed Dec 9 15:04:57 2009 : Info: ++[files] returns ok
Wed Dec 9 15:04:57 2009 : Info: ++[expiration] returns noop
Wed Dec 9 15:04:57 2009 : Info: ++[logintime] returns noop
Wed Dec 9 15:04:57 2009 : Info: ++[pap] returns noop
Wed Dec 9 15:04:57 2009 : Info: +- entering group pre-proxy {...}
Wed Dec 9 15:04:57 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/pre-proxy-detail-20091209
Wed Dec 9 15:04:57 2009 : Info: [pre_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/pre-proxy-detail-20091209
Wed Dec 9 15:04:57 2009 : Debug: expand: %t -> Wed Dec 9 15:04:57 2009
Wed Dec 9 15:04:57 2009 : Info: ++[pre_proxy_log] returns ok
Sending Access-Request of id 111 to W.X.Y.Z port 1812
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 14457480
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Proxy-State = 0x313034
Wed Dec 9 15:04:57 2009 : Info: Proxying request 0 to home server W.X.Y.Z port 1812
Sending Access-Request of id 111 to W.X.Y.Z port 1812
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 14457480
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Proxy-State = 0x313034
Wed Dec 9 15:04:57 2009 : Debug: Going to the next request
Wed Dec 9 15:04:57 2009 : Debug: Waking up in 0.9 seconds.
rad_recv: Access-Accept packet from host W.X.Y.Z port 1812, id=111, length=25
Proxy-State = 0x313034
Wed Dec 9 15:04:57 2009 : Info: +- entering group post-proxy {...}
Wed Dec 9 15:04:57 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/post-proxy-detail-20091209
Wed Dec 9 15:04:57 2009 : Info: [post_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/post-proxy-detail-20091209
Wed Dec 9 15:04:57 2009 : Debug: expand: %t -> Wed Dec 9 15:04:57 2009
Wed Dec 9 15:04:57 2009 : Info: ++[post_proxy_log] returns ok
Wed Dec 9 15:04:57 2009 : Info: [eap] No pre-existing handler found
Wed Dec 9 15:04:57 2009 : Info: ++[eap] returns noop
Wed Dec 9 15:04:57 2009 : Info: Found Auth-Type = CHAP
Wed Dec 9 15:04:57 2009 : Info: Found Auth-Type = Accept
Wed Dec 9 15:04:57 2009 : Error: Warning: Found 2 auth-types on request for user 'tevfikceydeliler'
Wed Dec 9 15:04:57 2009 : Info: Auth-Type = Accept, accepting the user
Wed Dec 9 15:04:57 2009 : Auth: Login OK: [tevfikceydeliler/<CHAP-Password>] (from client turkcellAPN port 14457480 cli 905308507313)
Wed Dec 9 15:04:57 2009 : Info: +- entering group post-auth {...}
Wed Dec 9 15:04:57 2009 : Info: ++[TCELL_pool] returns noop
Wed Dec 9 15:04:57 2009 : Debug: expand: %{NAS-IP-Address} %{NAS-Port} -> A.B.C.D 14457480
Wed Dec 9 15:04:57 2009 : Info: [BirmasGPRS_pool] MD5 on 'key' directive maps to: 156b20174482d4044a5602154300512b
Wed Dec 9 15:04:57 2009 : Info: [BirmasGPRS_pool] Searching for an entry for key: '156b20174482d4044a5602154300512b'
Wed Dec 9 15:04:57 2009 : Debug: rlm_ippool: Allocating ip to key: '156b20174482d4044a5602154300512b'
Wed Dec 9 15:04:57 2009 : Info: [BirmasGPRS_pool] num: 1
Wed Dec 9 15:04:57 2009 : Info: [BirmasGPRS_pool] Allocated ip 192.168.2.120 to client key: 156b20174482d4044a5602154300512b
Wed Dec 9 15:04:57 2009 : Info: ++[BirmasGPRS_pool] returns ok
Wed Dec 9 15:04:57 2009 : Info: ++[PSUOtonom_pool] returns noop
Wed Dec 9 15:04:57 2009 : Info: ++[YBPOtonom1_pool] returns noop
Wed Dec 9 15:04:57 2009 : Info: ++[YBPOtonom2_pool] returns noop
Wed Dec 9 15:04:57 2009 : Info: ++[YBPOtonom3_pool] returns noop
Wed Dec 9 15:04:57 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/reply-detail-20091209
Wed Dec 9 15:04:57 2009 : Info: [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/reply-detail-20091209
Wed Dec 9 15:04:57 2009 : Debug: expand: %t -> Wed Dec 9 15:04:57 2009
Wed Dec 9 15:04:57 2009 : Info: ++[reply_log] returns ok
Wed Dec 9 15:04:57 2009 : Info: ++[exec] returns noop
Sending Access-Accept of id 104 to A.B.C.D port 2460
Framed-IP-Address = 192.168.2.120
Framed-IP-Netmask = 255.255.240.0
Wed Dec 9 15:04:57 2009 : Info: Finished request 0.
Wed Dec 9 15:04:57 2009 : Debug: Going to the next request
Wed Dec 9 15:04:57 2009 : Debug: Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host A.B.C.D port 2005, id=250, length=139
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 79921368
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Wed Dec 9 15:04:57 2009 : Info: +- entering group authorize {...}
Wed Dec 9 15:04:57 2009 : Info: ++[preprocess] returns ok
Wed Dec 9 15:04:57 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/auth-detail-20091209
Wed Dec 9 15:04:57 2009 : Info: [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/auth-detail-20091209
Wed Dec 9 15:04:57 2009 : Debug: expand: %t -> Wed Dec 9 15:04:57 2009
Wed Dec 9 15:04:57 2009 : Info: ++[auth_log] returns ok
Wed Dec 9 15:04:57 2009 : Info: [chap] Setting 'Auth-Type := CHAP'
Wed Dec 9 15:04:57 2009 : Info: ++[chap] returns ok
Wed Dec 9 15:04:57 2009 : Info: ++[mschap] returns noop
Wed Dec 9 15:04:57 2009 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL
Wed Dec 9 15:04:57 2009 : Info: [suffix] No such realm "NULL"
Wed Dec 9 15:04:57 2009 : Info: ++[suffix] returns noop
Wed Dec 9 15:04:57 2009 : Info: [eap] No EAP-Message, not doing EAP
Wed Dec 9 15:04:57 2009 : Info: ++[eap] returns noop
Wed Dec 9 15:04:57 2009 : Info: ++[unix] returns notfound
Wed Dec 9 15:04:57 2009 : Info: [files] users: Matched entry tevfikceydeliler at line 100
Wed Dec 9 15:04:57 2009 : Debug: expand: Hello, %{User-Name} -> Hello, tevfikceydeliler
Wed Dec 9 15:04:57 2009 : Info: ++[files] returns ok
Wed Dec 9 15:04:57 2009 : Info: ++[expiration] returns noop
Wed Dec 9 15:04:57 2009 : Info: ++[logintime] returns noop
Wed Dec 9 15:04:57 2009 : Info: ++[pap] returns noop
Wed Dec 9 15:04:57 2009 : Info: +- entering group pre-proxy {...}
Wed Dec 9 15:04:57 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/pre-proxy-detail-20091209
Wed Dec 9 15:04:57 2009 : Info: [pre_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/pre-proxy-detail-20091209
Wed Dec 9 15:04:57 2009 : Debug: expand: %t -> Wed Dec 9 15:04:57 2009
Wed Dec 9 15:04:57 2009 : Info: ++[pre_proxy_log] returns ok
Sending Access-Request of id 105 to W.X.Y.Z port 1812
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 79921368
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Proxy-State = 0x323530
Wed Dec 9 15:04:58 2009 : Info: Proxying request 1 to home server W.X.Y.Z port 1812
Sending Access-Request of id 105 to W.X.Y.Z port 1812
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 79921368
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Proxy-State = 0x323530
Wed Dec 9 15:04:58 2009 : Debug: Going to the next request
Wed Dec 9 15:04:58 2009 : Debug: Waking up in 0.9 seconds.
rad_recv: Access-Reject packet from host W.X.Y.Z port 1812, id=105, length=25
Proxy-State = 0x323530
Wed Dec 9 15:04:58 2009 : Info: +- entering group post-proxy {...}
Wed Dec 9 15:04:58 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/post-proxy-detail-20091209
Wed Dec 9 15:04:58 2009 : Info: [post_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/post-proxy-detail-20091209
Wed Dec 9 15:04:58 2009 : Debug: expand: %t -> Wed Dec 9 15:04:57 2009
Wed Dec 9 15:04:58 2009 : Info: ++[post_proxy_log] returns ok
Wed Dec 9 15:04:58 2009 : Info: [eap] No pre-existing handler found
Wed Dec 9 15:04:58 2009 : Info: ++[eap] returns noop
Wed Dec 9 15:04:58 2009 : Auth: Login incorrect (Home Server says so): [tevfikceydeliler/<CHAP-Password>] (from client turkcellAPN port 79921368 cli 905308507313)
Wed Dec 9 15:04:58 2009 : Info: Using Post-Auth-Type Reject
Wed Dec 9 15:04:58 2009 : Info: +- entering group REJECT {...}
Wed Dec 9 15:04:58 2009 : Debug: expand: %{User-Name} -> tevfikceydeliler
Wed Dec 9 15:04:58 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11
Wed Dec 9 15:04:58 2009 : Info: ++[attr_filter.access_reject] returns updated
Wed Dec 9 15:04:58 2009 : Info: Delaying reject of request 1 for 3 seconds
Wed Dec 9 15:04:58 2009 : Debug: Going to the next request
Wed Dec 9 15:04:58 2009 : Debug: Waking up in 0.9 seconds.
Wed Dec 9 15:04:59 2009 : Debug: Waking up in 1.9 seconds.
Wed Dec 9 15:05:01 2009 : Info: Sending delayed reject for request 1
Sending Access-Reject of id 250 to A.B.C.D port 2005
Wed Dec 9 15:05:01 2009 : Debug: Waking up in 1.9 seconds.
rad_recv: Access-Request packet from host A.B.C.D port 4817, id=133, length=139
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 152187272
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Wed Dec 9 15:05:01 2009 : Info: +- entering group authorize {...}
Wed Dec 9 15:05:01 2009 : Info: ++[preprocess] returns ok
Wed Dec 9 15:05:01 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/auth-detail-20091209
Wed Dec 9 15:05:01 2009 : Info: [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/auth-detail-20091209
Wed Dec 9 15:05:01 2009 : Debug: expand: %t -> Wed Dec 9 15:05:01 2009
Wed Dec 9 15:05:01 2009 : Info: ++[auth_log] returns ok
Wed Dec 9 15:05:01 2009 : Info: [chap] Setting 'Auth-Type := CHAP'
Wed Dec 9 15:05:01 2009 : Info: ++[chap] returns ok
Wed Dec 9 15:05:01 2009 : Info: ++[mschap] returns noop
Wed Dec 9 15:05:01 2009 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL
Wed Dec 9 15:05:01 2009 : Info: [suffix] No such realm "NULL"
Wed Dec 9 15:05:01 2009 : Info: ++[suffix] returns noop
Wed Dec 9 15:05:01 2009 : Info: [eap] No EAP-Message, not doing EAP
Wed Dec 9 15:05:01 2009 : Info: ++[eap] returns noop
Wed Dec 9 15:05:01 2009 : Info: ++[unix] returns notfound
Wed Dec 9 15:05:01 2009 : Info: [files] users: Matched entry tevfikceydeliler at line 100
Wed Dec 9 15:05:01 2009 : Debug: expand: Hello, %{User-Name} -> Hello, tevfikceydeliler
Wed Dec 9 15:05:01 2009 : Info: ++[files] returns ok
Wed Dec 9 15:05:01 2009 : Info: ++[expiration] returns noop
Wed Dec 9 15:05:01 2009 : Info: ++[logintime] returns noop
Wed Dec 9 15:05:01 2009 : Info: ++[pap] returns noop
Wed Dec 9 15:05:01 2009 : Info: +- entering group pre-proxy {...}
Wed Dec 9 15:05:01 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/pre-proxy-detail-20091209
Wed Dec 9 15:05:01 2009 : Info: [pre_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/pre-proxy-detail-20091209
Wed Dec 9 15:05:01 2009 : Debug: expand: %t -> Wed Dec 9 15:05:01 2009
Wed Dec 9 15:05:01 2009 : Info: ++[pre_proxy_log] returns ok
Sending Access-Request of id 220 to W.X.Y.Z port 1812
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 152187272
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Proxy-State = 0x313333
Wed Dec 9 15:05:01 2009 : Info: Proxying request 2 to home server W.X.Y.Z port 1812
Sending Access-Request of id 220 to W.X.Y.Z port 1812
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 152187272
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Proxy-State = 0x313333
Wed Dec 9 15:05:01 2009 : Debug: Going to the next request
Wed Dec 9 15:05:01 2009 : Debug: Waking up in 0.9 seconds.
rad_recv: Access-Reject packet from host W.X.Y.Z port 1812, id=220, length=25
Proxy-State = 0x313333
Wed Dec 9 15:05:01 2009 : Info: +- entering group post-proxy {...}
Wed Dec 9 15:05:01 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/post-proxy-detail-20091209
Wed Dec 9 15:05:01 2009 : Info: [post_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/post-proxy-detail-20091209
Wed Dec 9 15:05:01 2009 : Debug: expand: %t -> Wed Dec 9 15:05:01 2009
Wed Dec 9 15:05:01 2009 : Info: ++[post_proxy_log] returns ok
Wed Dec 9 15:05:01 2009 : Info: [eap] No pre-existing handler found
Wed Dec 9 15:05:01 2009 : Info: ++[eap] returns noop
Wed Dec 9 15:05:01 2009 : Auth: Login incorrect (Home Server says so): [tevfikceydeliler/<CHAP-Password>] (from client turkcellAPN port 152187272 cli 905308507313)
Wed Dec 9 15:05:01 2009 : Info: Using Post-Auth-Type Reject
Wed Dec 9 15:05:01 2009 : Info: +- entering group REJECT {...}
Wed Dec 9 15:05:01 2009 : Debug: expand: %{User-Name} -> tevfikceydeliler
Wed Dec 9 15:05:01 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11
Wed Dec 9 15:05:01 2009 : Info: ++[attr_filter.access_reject] returns updated
Wed Dec 9 15:05:01 2009 : Info: Delaying reject of request 2 for 3 seconds
Wed Dec 9 15:05:01 2009 : Debug: Going to the next request
Wed Dec 9 15:05:01 2009 : Debug: Waking up in 0.9 seconds.
Wed Dec 9 15:05:02 2009 : Debug: Waking up in 0.8 seconds.
Wed Dec 9 15:05:02 2009 : Info: Cleaning up request 0 ID 104 with timestamp +185
Wed Dec 9 15:05:02 2009 : Debug: Waking up in 1.0 seconds.
Wed Dec 9 15:05:04 2009 : Info: Sending delayed reject for request 2
Sending Access-Reject of id 133 to A.B.C.D port 4817
Wed Dec 9 15:05:04 2009 : Debug: Waking up in 1.9 seconds.
rad_recv: Access-Request packet from host A.B.C.D port 3820, id=182, length=139
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 163401920
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Wed Dec 9 15:05:04 2009 : Info: +- entering group authorize {...}
Wed Dec 9 15:05:04 2009 : Info: ++[preprocess] returns ok
Wed Dec 9 15:05:04 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/auth-detail-20091209
Wed Dec 9 15:05:04 2009 : Info: [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/auth-detail-20091209
Wed Dec 9 15:05:04 2009 : Debug: expand: %t -> Wed Dec 9 15:05:04 2009
Wed Dec 9 15:05:04 2009 : Info: ++[auth_log] returns ok
Wed Dec 9 15:05:04 2009 : Info: [chap] Setting 'Auth-Type := CHAP'
Wed Dec 9 15:05:04 2009 : Info: ++[chap] returns ok
Wed Dec 9 15:05:04 2009 : Info: ++[mschap] returns noop
Wed Dec 9 15:05:04 2009 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL
Wed Dec 9 15:05:04 2009 : Info: [suffix] No such realm "NULL"
Wed Dec 9 15:05:04 2009 : Info: ++[suffix] returns noop
Wed Dec 9 15:05:04 2009 : Info: [eap] No EAP-Message, not doing EAP
Wed Dec 9 15:05:04 2009 : Info: ++[eap] returns noop
Wed Dec 9 15:05:04 2009 : Info: ++[unix] returns notfound
Wed Dec 9 15:05:04 2009 : Info: [files] users: Matched entry tevfikceydeliler at line 100
Wed Dec 9 15:05:04 2009 : Debug: expand: Hello, %{User-Name} -> Hello, tevfikceydeliler
Wed Dec 9 15:05:04 2009 : Info: ++[files] returns ok
Wed Dec 9 15:05:04 2009 : Info: ++[expiration] returns noop
Wed Dec 9 15:05:04 2009 : Info: ++[logintime] returns noop
Wed Dec 9 15:05:04 2009 : Info: ++[pap] returns noop
Wed Dec 9 15:05:04 2009 : Info: +- entering group pre-proxy {...}
Wed Dec 9 15:05:04 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/pre-proxy-detail-20091209
Wed Dec 9 15:05:04 2009 : Info: [pre_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/pre-proxy-detail-20091209
Wed Dec 9 15:05:04 2009 : Debug: expand: %t -> Wed Dec 9 15:05:04 2009
Wed Dec 9 15:05:04 2009 : Info: ++[pre_proxy_log] returns ok
Sending Access-Request of id 216 to W.X.Y.Z port 1812
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 163401920
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Proxy-State = 0x313832
Wed Dec 9 15:05:04 2009 : Info: Proxying request 3 to home server W.X.Y.Z port 1812
Sending Access-Request of id 216 to W.X.Y.Z port 1812
NAS-IP-Address = A.B.C.D
NAS-Identifier = "GGFILE02"
Called-Station-Id = "yasarapn"
Framed-Protocol = GPRS-PDP-Context
Service-Type = Framed-User
NAS-Port-Type = Virtual
NAS-Port = 163401920
CHAP-Challenge = 0xd0ceda5e56ea3f6f28ed31cd5646c988
User-Name = "tevfikceydeliler"
CHAP-Password = 0x0126f5f525a93d37c4caf7e55d586ce5cd
Calling-Station-Id = "905308507313"
Proxy-State = 0x313832
Wed Dec 9 15:05:04 2009 : Debug: Going to the next request
Wed Dec 9 15:05:04 2009 : Debug: Waking up in 0.9 seconds.
rad_recv: Access-Reject packet from host W.X.Y.Z port 1812, id=216, length=25
Proxy-State = 0x313832
Wed Dec 9 15:05:04 2009 : Info: +- entering group post-proxy {...}
Wed Dec 9 15:05:04 2009 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/A.B.C.D/post-proxy-detail-20091209
Wed Dec 9 15:05:04 2009 : Info: [post_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/A.B.C.D/post-proxy-detail-20091209
Wed Dec 9 15:05:04 2009 : Debug: expand: %t -> Wed Dec 9 15:05:04 2009
Wed Dec 9 15:05:04 2009 : Info: ++[post_proxy_log] returns ok
Wed Dec 9 15:05:04 2009 : Info: [eap] No pre-existing handler found
Wed Dec 9 15:05:04 2009 : Info: ++[eap] returns noop
Wed Dec 9 15:05:04 2009 : Auth: Login incorrect (Home Server says so): [tevfikceydeliler/<CHAP-Password>] (from client turkcellAPN port 163401920 cli 905308507313)
Wed Dec 9 15:05:04 2009 : Info: Using Post-Auth-Type Reject
Wed Dec 9 15:05:04 2009 : Info: +- entering group REJECT {...}
Wed Dec 9 15:05:04 2009 : Debug: expand: %{User-Name} -> tevfikceydeliler
Wed Dec 9 15:05:04 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11
Wed Dec 9 15:05:04 2009 : Info: ++[attr_filter.access_reject] returns updated
Wed Dec 9 15:05:04 2009 : Info: Delaying reject of request 3 for 3 seconds
Wed Dec 9 15:05:04 2009 : Debug: Going to the next request
Wed Dec 9 15:05:04 2009 : Debug: Waking up in 0.9 seconds.
Wed Dec 9 15:05:05 2009 : Debug: Waking up in 0.8 seconds.
Wed Dec 9 15:05:05 2009 : Info: Cleaning up request 1 ID 250 with timestamp +185
Wed Dec 9 15:05:05 2009 : Debug: Waking up in 1.0 seconds.
Wed Dec 9 15:05:07 2009 : Info: Sending delayed reject for request 3
Sending Access-Reject of id 182 to A.B.C.D port 3820
Wed Dec 9 15:05:07 2009 : Debug: Waking up in 1.9 seconds.
Wed Dec 9 15:05:09 2009 : Info: Cleaning up request 2 ID 133 with timestamp +189
Wed Dec 9 15:05:09 2009 : Debug: Waking up in 3.0 seconds.
Wed Dec 9 15:05:12 2009 : Info: Cleaning up request 3 ID 182 with timestamp +192
Wed Dec 9 15:05:12 2009 : Debug: Ready to process requests.
##########################################################

Tevfik Ceydeliler
Ağ &Web Teknolojileri Uzmanı
Astron Proje Ofisi

'  (232) 435 82 88 dahili 131
*  tevfik.ceydeliler@ astron.yasar.com.tr
ü  www.astron.ws
7/24 Acil Müdahele: 0 533 658 85 57

Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Possible to add a NAS in any MySQL table?

2009-12-09T05:25:50Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

W dniu 2009-12-09 08:42, Patric pisze:

> Peter Carlstedt wrote:
>> Hello everyone,
>>
>> I´ve been searching the net for answers but havent´been able to find
>> any information about how to add a NAS in the MySQL tables instead of
>> using the clients.conf file. It is possible to use one of the tables
>> that comes with Freeradius?
>> If it is possible, is there any "HOW to" guide for it somewhere?
>
> sql.conf:
> ---------
>
> # Set to 'yes' to read radius clients from the database ('nas'
> table)
> # Clients will ONLY be read on server startup. For performance
> # and security reasons, finding clients via SQL queries CANNOT
> # be done "live" while the server is running.
> #
> readclients = yes
>
> # Table to keep radius client info
> nas_table = "nas"
>
>
>
> sql/${database}/dialup.conf:
> ----------------------------
>
> nas_query = "SELECT id, nasname, shortname, type, secret FROM
> ${nas_table}"
>
>

Hi,

so, maybe You know, Patric, how I can insert into radacct table username
from inner session, not outer session?

- --
pozdrawiam
Maciej Łukasz Wojszkun
tel. +48698611234
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJLH6VdAAoJELZ0XRdrHMhc3oUH/23EWlCo/XJrHLdPMaM0CF1V
kTATI2qqdBM/+XILt6ppvRhwiGGsqNHkIK+YW3nZqKgk9tcSmWClu/ECWajXAcBT
rqGy1AhJLF2gpuyRHLMGJNRSd8EXjD0iHdyKpn3o6KVuQ2SvEBP0MaxAqvbXfca4
MoJ67sw3iZ9rYBEaKTWQsL4aePvPBfAIRqmyKfBn/PQpy2VRxhCX6ttDukoScRQz
Qc85men6lRfBBSRlt3H00wI0yP4uhJZf/A3dHL/xDtGGIlnoAEez6kJ6fVojKZtb
f2DB+lXthFV+rFw25+YvZaV46wYk4MWuJw3b9M6nWRhvImp0Fsh95jhoS9KI298=
=AhoQ
-----END PGP SIGNATURE-----
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I cant Connect to GSM Operator by using APN

2009-12-09T05:22:32Z

Re: Changing the format of a date attribute

2009-12-09T02:37:18Z

Hi again all :)

Patric wrote:

> Alan DeKok wrote:
>> Patric wrote:
>>> Is there any way for me to get my FreeRADIUS-Acct-Session-Start-Time
>>> attribute value into that date format?
>>
>> http://dev.mysql.com/doc/refman/5.0/en/date-and-time-functions.html#function_from-unixtime
>>
> So now I have the following:
>
> STR_TO_DATE('%{FreeRADIUS-Acct-Session-Start-Time}', '%M %d %Y %H:%i:%s'))
>
> And that converts "Dec 8 2009 09:14:14 GMT" into "2009-12-08 09:14:14"

I have a curious problem trying to format the date field in my MySQL
statement as shown above.

In my sql/mysql/dialup.conf I have the following:

accounting_start_query_alt = "UPDATE ${acct_table_new} \
SET \
acct_start_time = STR_TO_DATE('%{FreeRADIUS-Acct-Session-Start-Time}',
'%M %d %Y %H:%i:%s'), \
...

The problem with the above is that some of those formatting options ('%M
%d %Y %H:%i:%s') are also defined as one-character variables, so instead
of formatting the date with those options, its replacing each with the
variable value, and when Im trying to end up with:

2009-12-08 09:14:14

instead Im ending up with:

2009-12-09 11:0126538264:AutoShapedVC

As you can see the minutes were replaced with the Calling Station ID and
the seconds were replaced with the Connect-Info...

Is there any way for me to perhaps escape my format string, or some
other work-around?

Many thanks
Patric
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Pre-release of Version 2.1.8

2009-12-09T01:09:15Z

On Wed, Dec 09, 2009 at 07:50:05AM +0100, Alan DeKok wrote:
> Then the home servers are *extremely* slow. Sending 300 packets over
> the course of a second or two wouldn't overload a 486.

AFAIK they are not 486s :) but we're still investigating what made them so.

> > Can any conclusions be drawn from this? I send over the detailed logs if
> > necessary.
>
> The home servers are pathetic.
>
> Also, the proxy && fail-over algorithms in 2.1.x are much better than
> 2.0.4.

Yes, I plan to upgrade. 2.1.x did need some ironing out first, as you know :)

--
2. That which causes joy or happiness.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: default linelog Accounting-Request handling broken?

2009-12-09T00:10:23Z

Josip Rodin wrote:
> Yes, I understood that originally. The gist of the rationale for the current
> behaviour is quite clear, but even so, many users would nevertheless be best
> served by many per-packet errors being more clearly visible, because even
> when they enable debug level 2+, they get a huge amount of output that is
> hard for them to handle. Errors don't particularly stand out in the crowd,
> and that isn't practical.

Good point.

> Perhaps the best compromise for some of these issues would be what the
> Linux kernel folks did with WARN_ONCE() or printk_once().

I'll look into that.

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Possible to add a NAS in any MySQL table?

2009-12-08T23:42:40Z

Peter Carlstedt wrote:
> Hello everyone,
>
> I´ve been searching the net for answers but havent´been able to find
> any information about how to add a NAS in the MySQL tables instead of
> using the clients.conf file. It is possible to use one of the tables
> that comes with Freeradius?
> If it is possible, is there any "HOW to" guide for it somewhere?

sql.conf:
---------

# Set to 'yes' to read radius clients from the database ('nas'
table)
# Clients will ONLY be read on server startup. For performance
# and security reasons, finding clients via SQL queries CANNOT
# be done "live" while the server is running.
#
readclients = yes

# Table to keep radius client info
nas_table = "nas"

sql/${database}/dialup.conf:
----------------------------

nas_query = "SELECT id, nasname, shortname, type, secret FROM
${nas_table}"

HTH
Patric
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Possible to add a NAS in any MySQL table?

2009-12-08T23:30:37Z

Hello everyone,

I´ve been searching the net for answers but havent´been able to find any information about how to add a NAS in the MySQL tables instead of using the clients.conf file. It is possible to use one of the tables that comes with Freeradius?
If it is possible, is there any "HOW to" guide for it somewhere?

Best regards/ Peter Carlstedt

Keep your friends updated— even when you’re not signed in.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Pre-release of Version 2.1.8

2009-12-08T22:50:05Z

Josip Rodin wrote:
> Which reminds me - the other day I had a situation where a NAS was rebooted
> and ~300 users immediately tried to reconnect and authenticated over a
> FreeRADIUS 2.0.4 server, which in turn tried to authenticate them over its
> two home_servers set up as fail-over, but neither of them with status_check.
>
> Sadly, this started failing horribly - it seemed to overload the primary
> home_server, entering a peculiar pattern - condensed for readability and
> some private info obfuscation:

Then the home servers are *extremely* slow. Sending 300 packets over
the course of a second or two wouldn't overload a 486.

> 1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 87

Look at the messages *before* that one. The proxy:

a) proxies packet 1
b) gives up on it after a time
c) proxies a new packet 2
d) receives a reply for packet 1
e) logs this message as "Huh?"

> So I tried the poor man's solution - I shuffled them manually, restarted
> FreeRADIUS, and then it started authenticating them, before it seemingly
> DoSed that one and entered a very similar pattern of brokenness.

300 packets is a DoS for a RADIUS server? Wow... that's a *bad* server.

> Can any conclusions be drawn from this? I send over the detailed logs if
> necessary.

The home servers are pathetic.

Also, the proxy && fail-over algorithms in 2.1.x are much better than
2.0.4.

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: default linelog Accounting-Request handling broken?

2009-12-08T22:41:06Z

Alan Buxey wrote:
> it'd be nice if SNMPTRAPs
> could be generated too natively but thats a different issue.

On the roadmap.

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: default linelog Accounting-Request handling broken?

2009-12-08T15:18:37Z

On Tue, Dec 08, 2009 at 11:02:30PM +0100, Alan DeKok wrote:
> Logging *state changes* is OK. e.g. "this packet caused the proxy to
> decide that the home server is down". That happens for *one* packet,
> when the home server changes state.
>
> The messages you've asked to make "log file" would result in
> per-packet errors, not general state change errors. That's why I'm
> reluctant to make those changes.

Yes, I understood that originally. The gist of the rationale for the current
behaviour is quite clear, but even so, many users would nevertheless be best
served by many per-packet errors being more clearly visible, because even
when they enable debug level 2+, they get a huge amount of output that is
hard for them to handle. Errors don't particularly stand out in the crowd,
and that isn't practical.

Perhaps the best compromise for some of these issues would be what the
Linux kernel folks did with WARN_ONCE() or printk_once().

--
2. That which causes joy or happiness.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: default linelog Accounting-Request handling broken?

2009-12-08T14:27:32Z

Hi,

> The messages you've asked to make "log file" would result in
> per-packet errors, not general state change errors. That's why I'm
> reluctant to make those changes.

exactly.

chuck me EVERYTHING in debug mode. i'll take the hit..i NEED the info...
but in general use - status change only... it'd be nice if SNMPTRAPs
could be generated too natively but thats a different issue.

alan
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Pre-release of Version 2.1.8

2009-12-08T14:25:59Z

Hi,

> 1 Error: Received Access-Accept packet from client home_server_ip_5 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.

well, theres a problem with shared secret there that needs to be ironed out

> Can any conclusions be drawn from this? I send over the detailed logs if
> necessary.

in the main it looks like the remote RADIUS server was sloooooow to respond to
authentications...and the other one likewise after you flipped them across.

but just 300 users caused this?

alan
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: default linelog Accounting-Request handling broken?

2009-12-08T14:02:30Z

Josip Rodin wrote:
> But the proxy state logging is not a priori per-packet, it's based on status
> check events. Only if each packet changes the proxy status (?!), then you'll
> get as many status check logs as there are packets.

Ah... that's the misunderstanding.

The messages which should be debug-only, and not log file are
*exactly* those messages which will be logged on every packet. This
includes:

- configuration typos (e.g. improper expansions)

- "failed to do X with this packet"

- anything else "per packet".

Logging *state changes* is OK. e.g. "this packet caused the proxy to
decide that the home server is down". That happens for *one* packet,
when the home server changes state.

The messages you've asked to make "log file" would result in
per-packet errors, not general state change errors. That's why I'm
reluctant to make those changes.

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Pre-release of Version 2.1.8

2009-12-08T13:19:12Z

On Tue, Dec 08, 2009 at 03:43:14PM +0100, Alan DeKok wrote:

> Garber, Neal wrote:
> >> This limit is around 8K packets in 2.1.x, and will be 64K packets in
> >> 2.2.x. So if you're getting 500 packets/s for a home server, 16s after
> >> it goes down, all 8k "slots" will be used.
>
> In 2.1.x, there are a limited number of UDP sockets that can be used
> for proxied traffic. This number is limited to 32, in src/lib/packet.c,
> macro MAX_SOCKETS.
>
> Due to RADIUS limitations, it can only have 256 packets outstanding
> for any combination of (src/ds IP/port). So each socket can send 256
> packets to every home server.
>
> Packets are added to the "outstanding" list when proxied, and removed
> a short time after a response is received from the home server. If no
> response is received from the home server, the packets are removed 30s
> after they were received.
>
> Once a packet has been removed from the "outstanding" list, its place
> can be used by a new packet that is proxied using the same socket/id to
> the same home server.

Which reminds me - the other day I had a situation where a NAS was rebooted
and ~300 users immediately tried to reconnect and authenticated over a
FreeRADIUS 2.0.4 server, which in turn tried to authenticate them over its
two home_servers set up as fail-over, but neither of them with status_check.

Sadly, this started failing horribly - it seemed to overload the primary
home_server, entering a peculiar pattern - condensed for readability and
some private info obfuscation:

1 Auth: Login OK:
10 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Auth: Login OK:
2 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Auth: Login incorrect (Home Server says so):
4 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Auth: Login OK:
4 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Auth: Login OK:
2 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
2 Auth: Login OK:
2 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Auth: Login OK:
11 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Auth: Login OK:
86 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 87
19 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 252
7 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Error: Received Access-Accept packet from client home_server_ip_5 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.
5 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Error: Received Access-Accept packet from client home_server_ip_5 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.
33 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 61
7 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 120
4 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 112
6 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Error: Received Access-Accept packet from client home_server_ip_5 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.
2 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Error: Received Access-Accept packet from client home_server_ip_5 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.
20 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 161
12 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Error: Received Access-Accept packet from client home_server_ip_5 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.
4 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 243
11 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 203
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 176
1 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 6
10 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Error: Received Access-Accept packet from client home_server_ip_5 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.
3 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 248
2 Error: Rejecting request <number> due to lack of any response from home server home_server_ip_5 port 1812
1 Proxy: No outstanding request was found for proxy reply from home server home_server_ip_5 port 1812 - ID 69
[...]

This went on for a while, before I was alerted about the outage, came in and
started checking what is going on - using radtest showed that the primary
home_server was indeed ignoring my requests, but the secondary one was
replying as if there was nothing going on.

So I tried the poor man's solution - I shuffled them manually, restarted
FreeRADIUS, and then it started authenticating them, before it seemingly
DoSed that one and entered a very similar pattern of brokenness. I did the
manual shuffle a few more times, by which time most users were connected,
and the problem worked itself out.

Can any conclusions be drawn from this? I send over the detailed logs if
necessary.

--
2. That which causes joy or happiness.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: default linelog Accounting-Request handling broken?

2009-12-08T12:53:12Z

On Tue, Dec 08, 2009 at 11:32:36AM +0000, Alan Buxey wrote:

> Hi,
>
> > Again, my point was that people who are prepared to immediately intervene in
> > a dead radiusd are most commonly are prepared to immediately intervene in a
> > faulty configuration file.
>
> revisiting the early messages in this thread clearly indicate a
> desire for much more verbose logging of proxy issues....almost, if
> not exactly, a per-packer log when errors arise. that is a 'bad thing'
> IMHO. much better to have the current situation. you could
> argue - and I'll agree with it - that a tool like raddebug could be used
> to attach to the process and view the debug of proxy issues live
> and inline - just as it can be used for verbose client logging on
> a chosen station when not running the daemon in full debug.

But the proxy state logging is not a priori per-packet, it's based on status
check events. Only if each packet changes the proxy status (?!), then you'll
get as many status check logs as there are packets.

(This discussion is getting annoyingly circular.)

--
2. That which causes joy or happiness.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08T11:30:16Z

> Actually I copied the file from /usr/share/doc/freeradius/examples/certs
> folder
> But I didnt change any in MAKE file

>From which version? 2.1.7 or 2.1.8? 2.1.8 has the new Makefile which signs
client certificates with ca certificate.

> Is there anyother way to debug it???

That's openSSL stuff. Ask them.

Ivan Kalik

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08T11:14:38Z

> Where I could get the "makefile" v.2.1.8-pre....
> Probably it also solves the problem that I have.

PS. I would take the whole certs directory.

Ivan Kalik

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08T11:13:30Z

> Where I could get the "makefile" v.2.1.8-pre....
> Probably it also solves the problem that I have.

Get the whole thing and take what you want:

http://git.freeradius.org/pre/

Ivan Kalik

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Cisco-AVPair Accounting

2009-12-08T10:59:50Z

Coutesy of Michael Bowe . . .

Since Calling-Station-Id does not exist in the accounting spill from the
Cisco, concatenating the client-mac-address works just great.

In the instance that we are not using a Cisco then the
Calling-Station-Id is populated and client-mac-address does not exist.
So, callingstationid is correct no matter what.

No rewrites necessary!

Thanks!

Bryan -

Bryan Campbell wrote:

> O.K.
>
> What is the best way to accomplish the following . . .
>
> For a specific NAS-IP-Address=10.10.10.10
>
> Accounting packet includes the following . . .
> %{Calling-Station-Id}(does not exist)
> %{client-mac-address}=0000.0000.0000
>
> Need to write the value for . . .
> %{client-mac-address} into %{Calling-Station-Id}
> . . . so that the Calling-Station-Id will be written
> to the MySQL database radacct table.
>
> Bryan -
>
>
>
>
>
> Michael Bowe wrote:
>>> One of the attributes we are after is the client-mac-address from
>>> Cisco-AVPair = "client-mac-address=0012.3fb2.15d2".
>>>
>>> So far it is now converted to an attribute of its own
>>> client-mac-address=0012.3fb2.15d2. (by setting cisco-av-hack to yes
>>> and
>>> adding some attributes to the dictionary)
>>>
>>> Now to get it to be the callingstationid. Looks like that will require
>>> that attr_rewrite be used to redefine callingstationid to be the mac
>>> address defined as client-mac-address.
>>>
>>> Still reading a bit on how to get that done. Anyone have any
>>> suggestions? If so, please send them along.
>>
>> Hi,
>>
>> Tweak the freeradius conf
>> with_cisco_vsa_hack = yes
>>
>> Add dictionary entry something like this :
>> ATTRIBUTE client-mac-address 3004 string
>>
>> Give the dialup.conf a bit of a tweak, so if calling-station-id isn't
>> available, try putting the client-mac-address instead :
>> Change '%{Calling-Station-Id}'
>> To
>> '%{Calling-Station-Id:-%{client-mac-address}}'
>>
>> Michael.
>>
>> -
>> List info/subscribe/unsubscribe? See
>> http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Cisco-AVPair Accounting

2009-12-08T09:02:51Z

O.K.

What is the best way to accomplish the following . . .

For a specific NAS-IP-Address=10.10.10.10

Accounting packet includes the following . . .
%{Calling-Station-Id}(does not exist)
%{client-mac-address}=0000.0000.0000

Need to write the value for . . .
%{client-mac-address} into %{Calling-Station-Id}
. . . so that the Calling-Station-Id will be written
to the MySQL database radacct table.

Bryan -

Michael Bowe wrote:

>> One of the attributes we are after is the client-mac-address from
>> Cisco-AVPair = "client-mac-address=0012.3fb2.15d2".
>>
>> So far it is now converted to an attribute of its own
>> client-mac-address=0012.3fb2.15d2. (by setting cisco-av-hack to yes
>> and
>> adding some attributes to the dictionary)
>>
>> Now to get it to be the callingstationid. Looks like that will require
>> that attr_rewrite be used to redefine callingstationid to be the mac
>> address defined as client-mac-address.
>>
>> Still reading a bit on how to get that done. Anyone have any
>> suggestions? If so, please send them along.
>
> Hi,
>
> Tweak the freeradius conf
> with_cisco_vsa_hack = yes
>
> Add dictionary entry something like this :
> ATTRIBUTE client-mac-address 3004 string
>
> Give the dialup.conf a bit of a tweak, so if calling-station-id isn't
> available, try putting the client-mac-address instead :
> Change
> '%{Calling-Station-Id}'
> To
> '%{Calling-Station-Id:-%{client-mac-address}}'
>
> Michael.
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: [GENERAL] freeradius postgresql sql query glitch

2009-12-08T08:46:56Z

Josip Rodin wrote:
> Alan, please apply the patch:

Applied, thanks.

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

jradius performance

2009-12-08T08:19:10Z

Hello,

The question of performance of jradius has been raised a couple times. I
thought I'd share some recent findings and improvements. Attached are
some radperf results of various setups and a brief discussion is below.

The tests are after changes we have made, which we will be integrating
into jradius/rlm_jradius soon. What we have done amounts to:

- buffers read/write to jradius socket in rlm_jradius and jradius-server

- object reuse of heavily used Java objects (radius packets, attributes,
etc - using Apache commons "pool" for this)

- using ByteBuffer instead of wrapped Streams throughout jradius
(resulting in less objects and method calls)

- and some more things...

It should also be noted that jradius per-default will maintain a RADIUS
"session" keyed on the combination of some attributes - analogous to the
"Acct-Unique-Session-Id" - and a thread-safe RadiusSession cached
object. For the testing, we disabled the session manager (and therefor
the session locking) since all the packets from radperf appear to be of
the same session, and requests are serialized around the session lock.

The tests are with the setup:

Thread pool: 128

thread pool {
start_servers = 128
max_servers = 128
min_spare_servers = 3
max_spare_servers = 128
max_requests_per_server = 0
}

JRadius config:

jradius {
name = "test"
primary = "localhost"
timeout = 2
keepalive = yes
connections = 128
onfail = NOOP
allow_codechange = yes
}

RadPerf performed using: radperf -x -s -f test.csv -T nas.rad -a pap -p
200 -c 20000 localhost auth <sec> -q

Summary of test:

FreeRADIUS 'users' file: ~ 17500 p/s
FreeRADIUS rlm_perl (example.pl): ~ 7600 p/s
FreeRADIUS rlm_jradius (LocalUsers): ~ 2500 p/s
Native Java jradius (CoovaRADIUS): ~ 12000 p/s

Still some room for improvement... but, we are getting there.

Valgrind reveals that FreeRADIUS is spending a lot of time in
rlm_jradius as it parses and creates/add attributes. This part could be
streamlined a lot as the attributes (in request and response) don't
always change yet rlm_jradius is freeing/creating new attributes
constantly. I suspect fixing that would greatly improve the rlm_jradius
performance.

Cheers,
David

======================================================================================

FreeRADIUS / users file (native)
(Only the 'files' modules in authorize, no 'perl', no 'jradius')

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 1.151
Packets/s : 17372
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 6260
< 0.1s : 13740
< s : 0
< 10s : 0
< 100s : 0

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 1.111
Packets/s : 17986
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 7339
< 0.1s : 12661
< s : 0
< 10s : 0
< 100s : 0

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 1.140
Packets/s : 17536
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 5631
< 0.1s : 14369
< s : 0
< 10s : 0
< 100s : 0

======================================================================================

FreeRADIUS / Simple rlm_perl handler
(Only 'files' and 'perl' in authorize, no 'jradius')

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 2.578
Packets/s : 7758
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 903
< 0.1s : 19075
< s : 22
< 10s : 0
< 100s : 0

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 2.622
Packets/s : 7625
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 693
< 0.1s : 19302
< s : 5
< 10s : 0
< 100s : 0

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 2.672
Packets/s : 7484
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 791
< 0.1s : 19157
< s : 52
< 10s : 0
< 100s : 0

======================================================================================

FreeRADIUS / rlm_jradius / LocalUsers
(Only 'files' and 'jradius' in authorize, no 'perl')

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 8.135
Packets/s : 2458
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 37
< 0.1s : 16283
< s : 3680
< 10s : 0
< 100s : 0

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 8.025
Packets/s : 2492
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 45
< 0.1s : 16022
< s : 3933
< 10s : 0
< 100s : 0

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 7.874
Packets/s : 2540
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 35
< 0.1s : 16995
< s : 2970
< 10s : 0
< 100s : 0

======================================================================================

Native Java / LocalUsers

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 1.636
Packets/s : 12221
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 2329
< 0.1s : 17671
< s : 0
< 10s : 0
< 100s : 0

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 1.635
Packets/s : 12229
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 2730
< 0.1s : 17270
< s : 0
< 10s : 0
< 100s : 0

Total succeeded : 20000
Total failed : 0
Total no reply : 0
Total time (s) : 1.644
Packets/s : 12160
Response times:
< 10 usec : 0
< 100 usec : 0
< msec : 0
< 10 msec : 2418
< 0.1s : 17582
< s : 0
< 10s : 0
< 100s : 0

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: EAP-TTLS auth

2009-12-08T07:57:08Z

1.- Sorry for the HTML mail mess.
2.- Now I have signed the client certificate by using the "Makefile"
v.2.1.8-pre (just to be sure that I generate correctly the certificates).

So, client certificate:
-
subject=/C=FR/ST=Isere/O=ESRF/CN=swatzy01.esrf.fr/emailAddress=user@...
-
issuer=/C=FR/ST=Isere/L=Grenoble/O=ESRF/emailAddress=admin@.../CN=radiusserv.esrf.fr

Server certificate:
-
subject=/C=FR/ST=Isere/O=ESRF/CN=radiusserv.esrf.fr/emailAddress=admin@...
-
issuer=/C=FR/ST=Isere/L=Grenoble/O=ESRF/emailAddress=admin@.../CN=radiusserv.esrf.fr

I have load ca.der under "Trusted Root CA"
Also I have load client.p12 under "Personal Cerificates"
And default configuration is at eap.conf
- private_key_file = ${certdir}/server.pem
- certificate_file = ${certdir}/server.pem
- CA_file = ${cadir}/ca.pem

Still work with "Microsoft: Smart Card or other Certificate"
authentication method
But not with "Intel: EAP-TTLS" with "PAP user/password", "Server
Certificate Validation" + "Specify Server or Certificate Name" (if I
remove last part... also works fine!!)
Also I not be able to test EAP-TLS auth (not present on windows
supplicant software)

I have tried both CN as parameter for "Server or Certificate Name" (on
the "Step 2 of 2" at the EAP-TTLS auth method of windows supplicant
software)

- Server or Certificate Name == swatzy01.esrf.fr
- Server or Certificate Name == radiusserv.esrf.fr

With same result:

[ttls] Authenticate
[ttls] processing EAP-TLS
[ttls] eaptls_verify returned 7
[ttls] Done initial handshake
[ttls] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca
TLS Alert read:fatal:unknown CA
TLS_accept:failed in SSLv3 read client certificate A
rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1
alert unknown ca
SSL: SSL_read failed inside of TLS (-1), TLS session fails.
TLS receive handshake failed during operation
[ttls] eaptls_process returned 4

Should I load server certificate at the "Intermediate Certification
Authorities" on Windows side?
Any other idea why it work fine with "Microsoft: Smart Card or other
Certificate" authentication method and it is not consider a valid
certificate when I employ EAP-TTLS?

Thanks in advance for your help.
Regards,

Fernando.

tnt@... wrote:

>> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
>> <html>
>> <head>
>> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
>> </head>
>> <body bgcolor="#ffffff" text="#000000">
>> Hi again: 
>> 
>> I have just tried with both CN that I could found at my 'client
>> certificate' 
>> 
>> <big><tt><a class="moz-txt-link-abbreviated"
>> href="mailto:subject=/C=FR/ST=Isere/O=ESRF/CN=swatzy01.esrf.fr/emailAddress=user@...">subject=/C=FR/ST=Isere/O=ESRF/CN=swatzy01.esrf.fr/emailAddress=user@...</a> 
>> <a class="moz-txt-link-abbreviated"
>> href="mailto:issuer=/C=FR/ST=Isere/L=Grenoble/O=ESRF/emailAddress=admin@.../CN=radiusserv.esrf.fr">issuer=/C=FR/ST=Isere/L=Grenoble/O=ESRF/emailAddress=admin@.../CN=radiusserv.esrf.fr</a> 
>> </tt></big> 
>> So I have tested with: 
>> - Server or Certificate Name == <big><tt>swatzy01.esrf.fr 
>> </tt></big>- Server or Certificate Name ==
>> <big><tt>radiusserv.esrf.fr 
>> </tt></big> 
>> But with the same result: 
>> 
>> <tt>Found Auth-Type = EAP 
>> +- entering group authenticate {...} 
>> [eap] Request found, released from the list 
>> [eap] EAP/ttls 
>> [eap] processing type ttls 
>> [ttls] Authenticate 
>> [ttls] processing EAP-TLS 
>> [ttls] eaptls_verify returned 7 
>> [ttls] Done initial handshake 
>> [ttls] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca 
>> TLS Alert read:fatal:unknown CA 
>> TLS_accept:failed in SSLv3 read client certificate
>> A 
>> rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1
>> alert unknown ca 
>> SSL: SSL_read failed inside of TLS (-1), TLS session fails. 
>> TLS receive handshake failed during operation 
>> [ttls] eaptls_process returned 4 
>> [eap] Handler failed in EAP/ttls 
>> [eap] Failed in EAP select 
>> ++[eap] returns invalid 
>> Failed to authenticate the user.</tt> 
>> 
>> I have already done also what "Ivan Kalik" said (altering
>> certs/Makefile to sign client certificates with ca certificate instead
>> of server certificate.) 
>> Because of that, "Microsoft: Smart Card or other Certificate" works
>> fine right now (not before) 
>> But I'm still not able to perform "Intel: EAP-TTLS" with "PAP
>> user/password", "Server Certificate Validation" + "Specify Server or
>> Certificate Name" (if I remove last part... also works fine!!) 
>> 
>> thanks in advance for all your kindly help. 
>> regards, 
>> 
>> Fernando. 
>> 
>> Alan Buxey wrote:
>> <blockquote cite="mid:20091203135939.GA5878@..." type="cite">
>> <pre wrap="">Hi,
>>
>> </pre>
>> <blockquote type="cite">
>> <pre wrap="">...and I guest it is not due to the "Client Certificate"
>> because it was succeed authenticated in the previous tests
>> Probably is due to I am not sure what I should write in the box reserved
>> for "Server or Certificate Name" (on the "Step 2 of 2" at the supplicant
>> windows software)
>> Anyone knows what I should write at this box? I could not find a "server
>> name" or "domain name" at the certificate (as it is explained on the
>> "windows in-line help")
>> </pre>
>> </blockquote>
>> <pre wrap="">
>>
>> this will be the CN of your server certificate.
>>
>> so, if , when your RADIUS server got signed by the CA it became known
>> as eg radius.happyorg.org then the name you put into the client is
>> radius.happyorg.org
>>
>> dotn forget, this is NOT a DNS name - it is purely a 'label' - just the CN
>> of the server.... and you must have the CA present to check that server
>> cert
>> has been signed by your trusted CA (for otherwise anyone can make a
>> server
>> have a dumb cert with radius.happyorg.org as its CN
>>
>> alan
>> </pre>
>> </blockquote>
>> 
>> </body>
>> </html>
>>
>
> 1. Learn how to use e-mail.
>
> 2. That issuer looks like server certificate. You say you made client
> certificates signed by ca certificate. This doesn't seem to be one of
> them. If you can do EAP-TLS with the client certificate, you should be
> able to do EAP-TTLS with them too.
>
> Ivan Kalik
>
>

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Pre-release of Version 2.1.8

2009-12-08T06:52:34Z

Bjørn Mork wrote:
> Yes, I got one of those:
>
> Tue Dec 8 08:49:22 2009 : Proxy: Marking home server 192.168.8.216 port 1812 as dead.
> Tue Dec 8 08:49:22 2009 : Error: Failed creating new proxy socket: server is too busy and home servers appear to be down

OK. That indicates that all 32 sockets have been allocated. All this
means is that no *new* sockets will be allocated from now on.

> So it's possible that a few failing home servers end up tying up all
> sockets available for proxying?

No. See my other post for a detailed explanation.

> Or am I misunderstanding this? For how
> long? The server was not responding to requests going to a proxy at all
> between 08:43:27 and 09:35:46. That's a very long time to sit waiting
> for available resources...

I agree. You should use radmin to look at the server stats, to see
what it's doing.

> But I still believe sharing these resources in a way which let a few bad
> servers steal them all, is wrong. It should be possible to isolate two
> independent realms from each other, even if they use the same proxy
> radius.

See my other post. They are isolated, unless they both proxy to the
same home server. When that happens, they share the home server state.

>> If that works, we could do a "git bisect" to find the issue. There
>> are only 26 commits since them, and many of those don't have code
>> changes. It shouldn't be too hard to track down the offending commit.
>
> Given that I can actually trigger the problem in a test enviroment. I
> don't think I can.

? You can reproduce it, but can't find the offending commit?

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Pre-release of Version 2.1.8

2009-12-08T06:43:14Z

Garber, Neal wrote:
>> This limit is around 8K packets in 2.1.x, and will be 64K packets in
>> 2.2.x. So if you're getting 500 packets/s for a home server, 16s after
>> it goes down, all 8k "slots" will be used.
>
> I'm not sure if this is feasible and/or easy to implement, but I thought I'd ask.. As a suggestion, can there be a separate pool for each home server? It seems like increasing the limit of a shared pool just lengthens the time before the same problem can occur. If each home server had a separate pool, then one home server could not affect the others, regardless of the size of the pool.

Yes and no. Let me explain in more detail.

In 2.1.x, there are a limited number of UDP sockets that can be used
for proxied traffic. This number is limited to 32, in src/lib/packet.c,
macro MAX_SOCKETS.

Due to the "unconnected" nature of UDP, each socket can be used to
send packets to *multiple* home servers at the same time. So this means
that the limitation isn't really 32 sockets *total*, but (semantically)
32 sockets for every home server.

Due to RADIUS limitations, it can only have 256 packets outstanding
for any combination of (src/ds IP/port). So each socket can send 256
packets to every home server.

Since there are 32 sockets and 256 packets/s, a proxy can handle 8192
packets sent to *each* home server. If you have 13 home servers, then
the proxy can send 13*8192 = ~100K packets.

Packets are added to the "outstanding" list when proxied, and removed
a short time after a response is received from the home server. If no
response is received from the home server, the packets are removed 30s
after they were received.

Once a packet has been removed from the "outstanding" list, its place
can be used by a new packet that is proxied using the same socket/id to
the same home server.

To answer your question: Yes, there is a separate pool for each home
server. However, they share a global set of sockets.

The *intent* is for the pools to not affect each other. i.e. "filling
up" all 8K slots for one home server should have no affect on other home
servers.

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08T06:35:22Z

Actually I copied the file from /usr/share/doc/freeradius/examples/certs folder

But I didnt change any in MAKE file

Is there anyother way to debug it???

On Tue, Dec 8, 2009 at 3:40 AM, <tnt@...> wrote:

> Below is the complete Log..
> Please let me know how to solve/debug it..
>
>

> [tls] Done initial handshake
>
> [tls] <<< TLS 1.0 Alert [length 0002], warning bad_certificate
>
> TLS Alert read:warning:bad certificate
>

It's adifferent error. Quite clear what is wrong. Did you try to alter
Makefile yourself? If you don't know how to do it, try the Makefile from
2.1.8-pre or wait a few days for 2.1.8 release which will have client
certificates signed by ca.

Ivan Kalik

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

--
"Adversity always presents opportunity for Introspection"

Regards
Senthil

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Pre-release of Version 2.1.8

2009-12-08T06:14:54Z

> This limit is around 8K packets in 2.1.x, and will be 64K packets in
> 2.2.x. So if you're getting 500 packets/s for a home server, 16s after
> it goes down, all 8k "slots" will be used.

I'm not sure if this is feasible and/or easy to implement, but I thought I'd ask.. As a suggestion, can there be a separate pool for each home server? It seems like increasing the limit of a shared pool just lengthens the time before the same problem can occur. If each home server had a separate pool, then one home server could not affect the others, regardless of the size of the pool.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Pre-release of Version 2.1.8

2009-12-08T05:50:14Z

Alan DeKok <aland@...> writes:

> Bjørn Mork wrote:
>> Yes, now it continues to answer both authentication and accounting
>> requests, but it still stops proxying after a while (where "a while"
>> might be something like 20+ hours and 1+ million auth requests - I have
>> no indication that these values are fixed).
>
> Look for the message:
>
> Failed creating new proxy socket: server is too busy and home servers
> appear to be down

Yes, I got one of those:

Tue Dec 8 08:49:22 2009 : Proxy: Marking home server 192.168.8.216 port 1812 as dead.
Tue Dec 8 08:49:22 2009 : Error: Failed creating new proxy socket: server is too busy and home servers appear to be down

> It *should* continue to proxy after that, but it *won't* create new
> outgoing sockets. And it *won't* proxy any more requests until the
> current requests have timed out.

So it's possible that a few failing home servers end up tying up all
sockets available for proxying? Or am I misunderstanding this? For how
long? The server was not responding to requests going to a proxy at all
between 08:43:27 and 09:35:46. That's a very long time to sit waiting
for available resources...

What's the actual limit here? The number of open files left after the
sql module and others have taken their share? Then increasing it, and
trying to tune the timeouts might help I geuss.

But I still believe sharing these resources in a way which let a few bad
servers steal them all, is wrong. It should be possible to isolate two
independent realms from each other, even if they use the same proxy
radius.

> If the upstream servers really are that bad, I suggest configuring
> local detail files, as in raddb/sites-available/robust-proxy-accounting.
> This should make the server log packets locally, and *not* track them
> in memory (which appears to be the problem).

Thanks, I'll look into that. I do have to live with failing proxy
authentication as well, but I guess removing the accounting might take
some load off this.

>> There are a number of servers marked "alive", but these are all servers
>> which have been revived after the fixed period. When used, they will be
>> marked dead/zombie again.
>
> Configure "status_check". Really. Get the upstream servers to permit
> status-checks for a "test" user. It will make your network *much* more
> robust.

On my TODO list. Thanks.

> And why are the upstream servers dying so consistently? You're really
> in a corner case where you're testing FreeRADIUS in situations where the
> network Just Doesn't Work. The suggestions above should help work
> around most of those issues.

Some of the upstream servers are just not very well mangaged, if managed
at all. I wish I could ignore them, but I can't.

>> But I will test that now, starting with the stable branch from
>> git.freeradius.org, commit d7b4f003477644978f3fefa694305dce9b5dc8bf,
>> which was the last point where things seemed to work
>
> If that works, we could do a "git bisect" to find the issue. There
> are only 26 commits since them, and many of those don't have code
> changes. It shouldn't be too hard to track down the offending commit.

Given that I can actually trigger the problem in a test enviroment. I
don't think I can.

Bjørn

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08T05:46:32Z

Fernando Calvelo Vazquez wrote:
> Where I could get the "makefile" v.2.1.8-pre....
> Probably it also solves the problem that I have.

http://git.freeradius.org/pre/

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Pre-release of Version 2.1.8

2009-12-08T05:44:31Z

Bjørn Mork wrote:
> My problem is that this affects *all* proxied realms, including those
> with perfect radius servers. I know, because one of those realms is our
> own, running FreeRADIUS on another set of servers.
>
> You'll notice that all the "No outstanding request was found " messages
> were caused by only 2 slow servers in 2 different realms. That shouldn't
> bring down proxying for the other 20 realms.

Quite possibly, yes. The issue is that FreeRADIUS has a limited
amount of packets it can proxy without receiving a response. Once that
limit is reached, proxying starts having issues.

This limit is around 8K packets in 2.1.x, and will be 64K packets in
2.2.x. So if you're getting 500 packets/s for a home server, 16s after
it goes down, all 8k "slots" will be used.

> In real life, I need FreeRADIUS to survive anything a home server does
> without any effect on other realms than the one served by the bad home
> server.

If you can verify that commit d7b4f003477 works, then that should help
track down the issue.

Until then, configuring status-checks && local detail files will
definitely help. I would recommend doing that *anyways* for network
stability.

Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Changing the format of a date attribute

2009-12-08T05:43:51Z

Alan DeKok wrote:
> Patric wrote:
>> Is there any way for me to get my FreeRADIUS-Acct-Session-Start-Time
>> attribute value into that date format?
>
> http://dev.mysql.com/doc/refman/5.0/en/date-and-time-functions.html#function_from-unixtime
You sir are a genius :) It didnt even occur to me to do it in the SQL
statement...

So now I have the following:

STR_TO_DATE('%{FreeRADIUS-Acct-Session-Start-Time}', '%M %d %Y %H:%i:%s'))

And that converts "Dec 8 2009 09:14:14 GMT" into "2009-12-08 09:14:14"

Thanks so much!
Patric
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html