Forum Debian Users Gang

Nicram · 2010-05-06 18:11:10

witam

od dluzszego czasu freeradius chodzil mi bez problemu.
freradiusa mam podlaczonego do bazy mysql ktora jest na osobnym hoscie.
dzisiaj zauwazylem ze nie dziala limit polaczen, moge nawiazac wiecej niz 1sesje pppoe dla jednego konta.

freeradius -X
pokazuje, ze nie jest wysylany do klienta portlimit.
moze cos z loga:

podczas startu ...

Kod:

...
authorize_group_check_query = "SELECT '1' as id,'users' as GroupName,'Simultaneous-Use' as Attribute,'1' as Value,':=' as op"
...

no i podczas polaczenia klienta:

Kod:

Ready to process requests.
rad_recv: Access-Request packet from host 127.0.0.1 port 36334, id=167, length=112
    Service-Type = Framed-User
    Framed-Protocol = PPP
    User-Name = "blachjerzy"
    CHAP-Challenge = 0xbf0150606cbc0984eae0cbb367ed9d02
    CHAP-Password = 0x97eff0899bd8ab482427f89d5450644cfd
    Calling-Station-Id = "00:24:1D:16:6A:43"
    NAS-IP-Address = 192.168.36.6
    NAS-Port = 255
+- entering group authorize
++[preprocess] returns ok
  rlm_chap: Setting 'Auth-Type := CHAP'
++[chap] returns ok
++[mschap] returns noop
  rlm_eap: No EAP-Message, not doing EAP
++[eap] returns noop
    expand: %{User-Name} -> blachjerzy
rlm_sql (sql): sql_set_user escaped user --> 'blachjerzy'
rlm_sql (sql): Reserving sql socket id: 3
    expand: SELECT id,name as username,'User-Password' as attribute,passwd as value,':=' as op FROM nodes WHERE name = '%{SQL-User-Name}' ORDER BY id -> SELECT id,name as username,'User-Password' as attribute,passwd as value,':=' as op FROM nodes WHERE name = 'blachjerzy' ORDER BY id
rlm_sql (sql): User found in radcheck table
    expand: SELECT id,name as UserName,'Framed-IP-Address' as Attribute,inet_ntoa(ipaddr) as Value,'=' as op FROM nodes WHERE name = '%{SQL-User-Name}' ORDER BY id -> SELECT id,name as UserName,'Framed-IP-Address' as Attribute,inet_ntoa(ipaddr) as Value,'=' as op FROM nodes WHERE name = 'blachjerzy' ORDER BY id
    expand: SELECT groupname           FROM usergroup           WHERE username = '%{SQL-User-Name}'           ORDER BY id -> SELECT groupname           FROM usergroup           WHERE username = 'blachjerzy'           ORDER BY id
rlm_sql (sql): Released sql socket id: 3
++[sql] returns ok
  rad_check_password:  Found Auth-Type CHAP
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!    Replacing User-Password in config items with Cleartext-Password.     !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!! Please update your configuration so that the "known good"               !!!
!!! clear text password is in Cleartext-Password, and not in User-Password. !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
auth: type "CHAP"
+- entering group CHAP
  rlm_chap: login attempt by "blachjerzy" with CHAP password
  rlm_chap: Using clear text password "yKLy7OjSXghz52rc" for user blachjerzy authentication.
  rlm_chap: chap user blachjerzy authenticated succesfully
++[chap] returns ok
Login OK: [blachjerzy/<CHAP-Password>] (from client localhost port 255 cli 00:24:1D:16:6A:43)
+- entering group post-auth
rlm_sql (sql): Processing sql_postauth
    expand: %{User-Name} -> blachjerzy
rlm_sql (sql): sql_set_user escaped user --> 'blachjerzy'
    expand: %{User-Password} -> 
    expand: %{Chap-Password} -> 0x97eff0899bd8ab482427f89d5450644cfd
    expand: INSERT INTO radpostauth                           (user, pass, reply, date)                           VALUES (                           '%{User-Name}',                           '%{%{User-Password}:-%{Chap-Password}}',                           '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth                           (user, pass, reply, date)                           VALUES (                           'blachjerzy',                           '0x97eff0899bd8ab482427f89d5450644cfd',                           'Access-Accept', '2010-05-06 17:44:34')
rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth                           (user, pass, reply, date)                           VALUES (                           'blachjerzy',                           '0x97eff0899bd8ab482427f89d5450644cfd',                           'Access-Accept', '2010-05-06 17:44:34')
rlm_sql (sql): Reserving sql socket id: 2
rlm_sql (sql): Released sql socket id: 2
++[sql] returns ok
Sending Access-Accept of id 167 to 127.0.0.1 port 36334
    Framed-IP-Address = 192.168.32.250
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Accounting-Request packet from host 127.0.0.1 port 55315, id=168, length=121
    Acct-Session-Id = "4BE2E3E2546E00"
    User-Name = "blachjerzy"
    Acct-Status-Type = Start
    Service-Type = Framed-User
    Framed-Protocol = PPP
    Calling-Station-Id = "00:24:1D:16:6A:43"
    Acct-Authentic = RADIUS
    NAS-Port-Type = Async
    Framed-IP-Address = 192.168.32.250
    NAS-IP-Address = 192.168.36.6
    NAS-Port = 255
    Acct-Delay-Time = 0
+- entering group preacct
++[preprocess] returns ok
rlm_acct_unique: Hashing 'NAS-Port = 255,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 192.168.36.6,Acct-Session-Id = "4BE2E3E2546E00",User-Name = "blachjerzy"'
rlm_acct_unique: Acct-Unique-Session-ID = "a645d60890796569".
++[acct_unique] returns ok
    rlm_realm: No '@' in User-Name = "blachjerzy", looking up realm NULL
    rlm_realm: No such realm "NULL"
++[suffix] returns noop
++[files] returns noop
+- entering group accounting
    expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/detail-20100506
rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20100506
    expand: %t -> Thu May  6 17:44:34 2010
++[detail] returns ok
    expand: %{User-Name} -> blachjerzy
rlm_sql (sql): sql_set_user escaped user --> 'blachjerzy'
    expand: %{Acct-Delay-Time} -> 0
    expand:            INSERT INTO radacct             (acctsessionid,    acctuniqueid,     username,              realm,            nasipaddress,     nasportid,              nasporttype,      acctstarttime,    acctstoptime,              acctsessiontime,  acctauthentic,    connectinfo_start,              connectinfo_stop, acctinputoctets,  acctoutputoctets,              calledstationid,  callingstationid, acctterminatecause,              servicetype,      framedprotocol,   framedipaddress,              acctstartdelay,   acctstopdelay)           VALUES             ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}',              '%{NAS-Port-Type}', '%S', '',              '0', '%{Acct-Authentic}', '%{Connect-Info}',              '', '0', '0',              '%{Called-Station-Id}', '%{Calling-Station-Id}', '',              '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}',              '%{%{Acct-Delay-Time}:-0}', '0') ->            INSERT INTO radacct             (acctsessionid,    acctuniqueid,     username,              realm,            nasipaddress,     nasportid,              nasporttype,      acctstarttime,    acctstoptime,              acctsessiontime,  acctauthentic,    connectinfo_start,              connectinfo_stop, acctinputoctets,  acctoutputoctets,              calledstationid,  callingstationid, acctterminatecause,              servicetype,      framedprotocol,   framedipaddress,              acctstartdelay,   acctstopdelay)           VALUES             ('4BE2E3E2546E00', 'a645d60890796569',              'blachjerzy',              '', '192.168.36.6', '255',              'Async', '2010-05-06 17:44:34', '',              '0', 'RADIUS', '',              '', '0', '0',              '', '00:24:1D:16:6A:43', '',              'Framed-User', 'PPP', '192.168.32.250',              '0', '0')
rlm_sql (sql): Reserving sql socket id: 1
rlm_sql (sql): Released sql socket id: 1
++[sql] returns ok
Sending Accounting-Response of id 168 to 127.0.0.1 port 55315
Finished request 2.
Cleaning up request 2 ID 168 with timestamp +49
Going to the next request
Waking up in 4.8 seconds.
Cleaning up request 1 ID 167 with timestamp +49
Ready to process requests.

dlaczego nagle freeradius przestal odpowiadac klientowi z portlimit?
bardzo prosze o podpowiedzi. z gory dzieki.

jak juz wspomnialem baza sql stoi na osobnym hoscie. ostatnio kombinowalem z hostname /etc/hosts. czy zmiany w tych nazwach mogly by sie przyczynic do tego problemu?

Ostatnio edytowany przez Nicram (2010-05-06 18:15:21)

BiExi · 2010-05-06 20:26:09

port limita ustaw tak
Port-Limit == 1

Z logów wynika że komunikacja z bazą jest wiec modyfikacje o których pisałeś nie mają wpływu (przeniesienie na innego hosta)
przjzyj tabele radacct jak wyglada sprawa sesji klijenta
i logi klienta z /var/log/freeradius/radacct/127.0.0.1/

Nicram · 2010-05-07 09:37:57

moze nie bede kombinowal narazie zmieniac. dzialalo to dlugo i chcialbym znalezc przyczyne.
mam dwa "blizniacze" serwery z koncentratorami pppoe, na obu stoi ten sam freeradius i dostep maja do tej samej bazy.
wlasnie na tym drugin nic nie kombinowalem.

w logu /var/log/freeradius/radacct/127.0.0.1/detail... w zadnych z odpowiedzi do klienta nie widze Port-Limit=1, ale
odpalam freeradius -X
i do niektorych klietow jest to wysylane:

Kod:

rlm_sql (sql): Reserving sql socket id: 2
rlm_sql (sql): Released sql socket id: 2
++[sql] returns ok
Sending Access-Accept of id 228 to 127.0.0.1 port 37546
    Framed-IP-Address = 192.168.36.221
    Framed-Protocol = PPP
    Framed-IP-Netmask = 255.255.255.255
    Framed-MTU = 1492
    Port-Limit = 1

a do innych nie. tak jak w wyzszym logu, nie do wszystkich sprawdza grupe.

ukasz · 2012-06-14 23:16:25

nie widac w logu zeby pytal sie o grupe.

moze nie masz jej przypisanej ?

ja zawsze odlapam sobie sqltrace. wtedy widac eleganco czego sie pyta dokladnie radius bazy.
uzywam najnowszej z squeeze.

Jacekalex · 2012-07-04 13:04:14

A nie chodzi przypadkiem o taki problem:
http://zibik.jogger.pl/2008/03/12/one-session-per-host-w-pppoe-pod-linuksem/
lub sytuację, gdy po zerwaniu sesji ppp, odnowienie otwiera nową, a stara sobie wisi jakiś czas?

Time (s)	Query
0.00012	SET CHARSET latin2
0.00004	SET NAMES latin2
0.00132	SELECT u., g., o.logged FROM punbb_users AS u INNER JOIN punbb_groups AS g ON u.group_id=g.g_id LEFT JOIN punbb_online AS o ON o.ident='18.220.64.128' WHERE u.id=1
0.00088	REPLACE INTO punbb_online (user_id, ident, logged) VALUES(1, '18.220.64.128', 1714867439)
0.00070	SELECT * FROM punbb_online WHERE logged<1714867139
0.00057	SELECT topic_id FROM punbb_posts WHERE id=205413
0.00123	SELECT id FROM punbb_posts WHERE topic_id=16771 ORDER BY posted
0.00067	SELECT t.subject, t.closed, t.num_replies, t.sticky, f.id AS forum_id, f.forum_name, f.moderators, fp.post_replies, 0 FROM punbb_topics AS t INNER JOIN punbb_forums AS f ON f.id=t.forum_id LEFT JOIN punbb_forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id=3) WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id=16771 AND t.moved_to IS NULL
0.00009	SELECT search_for, replace_with FROM punbb_censoring
0.00120	SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM punbb_posts AS p INNER JOIN punbb_users AS u ON u.id=p.poster_id INNER JOIN punbb_groups AS g ON g.g_id=u.group_id LEFT JOIN punbb_online AS o ON (o.user_id=u.id AND o.user_id!=1 AND o.idle=0) WHERE p.topic_id=16771 ORDER BY p.id LIMIT 0,25
0.00107	UPDATE punbb_topics SET num_views=num_views+1 WHERE id=16771
Total query time: 0.00789 s

Forum Debian Users Gang

Ogłoszenie

#1 2010-05-06 18:11:10

Nicram - Użytkownik

freeradius - limit polaczen - pomocy

Kod:

Kod:

#2 2010-05-06 20:26:09

BiExi - matka przelozona

Re: freeradius - limit polaczen - pomocy

#3 2010-05-07 09:37:57

Nicram - Użytkownik

Re: freeradius - limit polaczen - pomocy

Kod:

#4 2012-06-14 23:16:25

ukasz - Użytkownik

Re: freeradius - limit polaczen - pomocy

#5 2012-07-04 13:04:14

Jacekalex - Podobno człowiek...;)

Re: freeradius - limit polaczen - pomocy

Stopka forum

Informacje debugowania