Re: POD not work with radclient
Am Mittwoch, den 28.03.2007, 14:30 +0100 schrieb satish patel: why user not disconnect from NAS but user still login on NAS ? Maybe you've been hit by this bug? http://www.cisco.com/en/US/products/hw/routers/ps133/prod_release_note09186a0080346996.html CSCee16150 Previously, the router did not respond to valid packet of disconnect (PoD) packets by disconnecting the user. Instead, the router returned a RADIUS-format packet with a Code of Disconnect-Request-NAKed (42 in decimal) and a Reply-Message attribute with a value set to the string No Matching Session. This problem occurred when you used PoD to disconnect users, and have aaa pod server ... auth-type all ... configured, and used a PoD server that included an exact copy of RADIUS attribute 151 from an earlier accounting request in the PoD packet. In RADIUS accounting packets, Cisco IOS generates attribute 151 values as a string of hexadecimal digits, corresponding to a 32-bit integer. When running an IOS version affected by this bug, the router IOS expects a copy of that 32-bit unsigned integer as a 32-bit unsigned integer, rather than as a string of ASCII characters representing a hexadecimal number. In Cisco IOS versions where the fix for this bug has been integrated, Cisco IOS will accept either the string which IOS sent out, or the 32-bit unsigned integer which unfixed versions accept. Regards Stephan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
rlm_sql: group table changes
Hi, whats the background behind the radgroupreply table now only being read if there are entries in the radgroupcheck table for this group? I just want to add reply attributes for some groups which is not possible any more like it was done before. Whats the intended way now? Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: checkrad/waitpid problem
Am Dienstag, den 26.04.2005, 09:51 -0400 schrieb Alan DeKok: Stephan Jaeger [EMAIL PROTECTED] wrote: For testing purposes i replaced the call to rad_waitpid with waitpid. As soon as the checkradius script is exiting the call returns with -1 and errno set to No child processes. It's a bug in 1.0.x. The CVS head has fixes. I just compiled HEAD but somehow the proxy radius server does not recognize the replies from the home radius server: Wed Apr 27 10:22:39 2005 : Error: Ignoring request from unknown home server 127.0.0.1 port 1815 Wed Apr 27 10:22:41 2005 : Proxy: marking authentication server localhost:1815 for realm test dead The (imho) interesting parts in the debug output of the proxy server: Waking up in 3 seconds... rad_recv: Access-Accept packet from host 127.0.0.1 port 1815, id=0, length=60 Ignoring request from unknown home server 127.0.0.1 port 1815 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Re-sending Access-Request of id 0 to 0.0.0.0 port 1815 The at least in the output the home server ip is 0.0.0.0, while it still reaches the home server he seems to have problems matching the reply later on. In my 20050103 snapshot it looks better: Sending Access-Request of id 0 to 127.0.0.1:1815 Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: checkrad/waitpid problem
Am Mittwoch, den 27.04.2005, 05:39 -0400 schrieb Alan DeKok: Ignoring request from unknown home server 127.0.0.1 port 1815 Is that the correct IP? Yes, thats the right one. Oh well, at least this narrows the scope where the bug can be. That sounds good ;) Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
checkrad/waitpid problem
Hi, i have a problem with freeradius executing the checkrad script. I get Check-TS: unknown error in waitpid() child_pid = -1; for (n = 0; n 10; n++) { sleep(1); radlog(L_ERR, pid: %d, pid); child_pid = waitpid(pid, status, WNOHANG); radlog(L_ERR, child_pid: %d, %s, child_pid, strerror(errno)); /*if ((child_pid 0) || (child_pid == pid)) { found = 1; break; }*/ } For testing purposes i replaced the call to rad_waitpid with waitpid. As soon as the checkradius script is exiting the call returns with -1 and errno set to No child processes. here is the output from the above loop (checkrad has a sleep(5) in it): pid: 3831 child_pid: 0, Success pid: 3831 child_pid: 0, Success pid: 3831 child_pid: 0, Success pid: 3831 child_pid: 0, Success pid: 3831 child_pid: 0, Success pid: 3831 child_pid: -1, No child processes pid: 3831 child_pid: -1, No child processes pid: 3831 child_pid: -1, No child processes pid: 3831 child_pid: -1, No child processes pid: 3831 child_pid: -1, No child processes System is Linux 2.6.9. Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: radius-1.0.1 die randomly
Am Donnerstag, den 13.01.2005, 11:08 +0100 schrieb Stefan Winter: Now that's a complicated script. How about #!/bin/bash pstree | grep radiusd || /etc/rc.d/init.d/radiusd restart As i already wrote in another thread i have nearly the same problem (and also almost the same setup: two radius servers logging to one mysql db, and both dying at the same time). The problem with your one liner is that the radiusd is not always dying with assertion failed, but sometimes just hangs, so this restart script won't work, but something doing real auth req. works perfect. These problems are just occouring from time to time and i don't know exactly when. Too much simultaneous radius requests? Too much load on the db? Or maybe the network is just slow from time to time... The only thing to note is that the crashes are happening more recurrent lately, i guess this happens because the db gets slower as the amount of acct data in the radacct table grows. Regards Stephan Jaeger -- Stephan Jaeger [EMAIL PROTECTED] EWETEL GmbH - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Server crashes at high load situations
Am Donnerstag, den 23.12.2004, 14:37 -0500 schrieb Alan DeKok: The solution is to re-write some of the code for handling requests timeouts. I've been looking at it recently, and have decided that it could use some updates for other issues, and now this, too. Sounds good! I'll wait then until the new code is in cvs to give it a try. Merry Christmas to you all. Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Server crashes at high load situations
Hi, I'm still experiencing server crashes under some high load situations. Error: Assertion failed in threads.c, line 285 bt: Program received signal SIGABRT, Aborted. [Switching to Thread 1077318912 (LWP 29184)] 0x40254ed9 in raise () from /lib/tls/libc.so.6 (gdb) bt #0 0x40254ed9 in raise () from /lib/tls/libc.so.6 #1 0x40362fcc in ?? () from /lib/tls/libc.so.6 #2 0x40065520 in PADDING () from /radius/daemon/freeradius-snapshot-20041223/lib/libradius-1.1.0-pre0.so #3 0x40256771 in abort () from /lib/tls/libc.so.6 #4 0x in ?? () #5 0x0020 in ?? () #6 0x in ?? () #7 0x in ?? () #8 0x in ?? () #9 0x in ?? () #10 0x in ?? () #11 0x in ?? () #12 0x in ?? () #13 0x in ?? () #14 0x in ?? () #15 0x in ?? () #16 0x in ?? () #17 0x in ?? () #18 0x in ?? () #19 0x in ?? () #20 0x in ?? () #21 0x in ?? () #22 0x in ?? () #23 0x in ?? () #24 0x in ?? () #25 0x in ?? () #26 0x in ?? () #27 0x in ?? () #28 0x in ?? () #29 0x in ?? () #30 0x in ?? () #31 0x in ?? () #32 0x in ?? () #33 0x in ?? () #34 0x in ?? () #35 0x in ?? () #36 0x in ?? () #37 0x in ?? () #38 0x0001 in ?? () #39 0x0010 in ?? () #40 0xbfffe1b4 in ?? () #41 0x40016c00 in ?? () from /lib/ld-linux.so.2 #42 0x40016fd4 in ?? () #43 0xbfffe240 in ?? () #44 0xbfffe208 in ?? () #45 0x in ?? () #46 0x45e0 in ?? () from /lib/ld-linux.so.2 #47 0x40016c00 in ?? () from /lib/ld-linux.so.2 #48 0x0626 in ?? () #49 0x40016e38 in _r_debug () #50 0xbfffe1f0 in ?? () #51 0x4000ba16 in _dl_map_object_deps () from /lib/ld-linux.so.2 #52 0x0805c2dc in proxy_cmp (one=0xd6, two=0xbfffe2c0) at request_list.c:214 #53 0x400628b3 in rbtree_find (tree=0x816b838, Data=0xbfffe2c0) at rbtree.c:448 #54 0x0805ce40 in rl_find_proxy (packet=0x6) at request_list.c:885 #55 0x0804ca54 in proxy_ok (packet=0x4e3e58a0) at radiusd.c:478 #56 0x0804cd08 in request_ok (packet=0x4e3e58a0, secret=0x0, listener=0x0) at radiusd.c:600 #57 0x0804d552 in main (argc=4, argv=0x0) at radiusd.c:1294 Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Proxy accounting problem
Hi, i'm having a proxy problem with newer freeradius versions. While 0.9.2 as a proxy send an accounting response for a request which wasn't to be proxied and with an empty accounting section (in radiusd.conf), newer versions at least everything = snapshot 2004/21/06 and = 1.0.1 just ignore the request. As i'd like to just drop these (administrative) tickets or better write them to a detail file it would be good just beeing able to send an accounting response, but if i let the detail module on the proxy handle this it logs every request, not just the ones that don't get proxied. Any suggestions? Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Proxy accounting problem
Hi, thanks, for your fast answer. On Fri, 2004-09-24 at 10:29 -0400, Alan DeKok wrote: Stephan Jaeger [EMAIL PROTECTED] wrote: i'm having a proxy problem with newer freeradius versions. While 0.9.2 as a proxy send an accounting response for a request which wasn't to be proxied and with an empty accounting section (in radiusd.conf), newer versions at least everything = snapshot 2004/21/06 and = 1.0.1 just ignore the request. Yes. That's because the accounting section returns noop, which means nothing was done with the packet, which means it wasn't accounted for, and the server shouldn't respond. That makes sense :) As i'd like to just drop these (administrative) tickets or better write them to a detail file it would be good just beeing able to send an accounting response, but if i let the detail module on the proxy handle this it logs every request, not just the ones that don't get proxied. The simplest way to fix this would be to configure rlm_detail to use the realm name for the detail file: detailfile = /detail-%{Realm:-LOCAL} You will get a detail file per realm, and another detail file containing only local requests. But it's not possible to get only one detail file with the local tickets? Currently the detail files are written on the home servers not on the proxy server. Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Proxy accounting problem
On Fri, 2004-09-24 at 11:10 -0400, Alan DeKok wrote: Stephan Jaeger [EMAIL PROTECTED] wrote: But it's not possible to get only one detail file with the local tickets? Yes. You can set Acct-Type for the non-proxied requests, and have a sub-section of accounting{}, with that Acct-Type, and put detail inside of it. Great, works like a charme, thanks a lot. Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
SNMP and multiple radius instances per host
Hi, i couln't find anything on how to use snmp with mutliple radius instances on one host. Seems to me not even the mibs are designed for this. Did i overlook something? Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
zombies and crashes
Hi, while my proxy radiusd is now behaving very nicely with the new code i have a problem with the home server. Every thread that exits goes zombie and with really high load the radiusd is crashing after some minutes. Here are some backtraces: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 18450)] 0x402e847b in memset () from /lib/libc.so.6 (gdb) bt #0 0x402e847b in memset () from /lib/libc.so.6 #1 0x080594fa in request_enqueue (request=0x40507ab8, fun=0) at threads.c:225 #2 0x08059ed8 in thread_pool_addrequest (request=0x40507ab8, fun=0) at threads.c:760 #3 0x0804d99e in main (argc=135115592, argv=0x80535b0) at radiusd.c:1446 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1196106 (LWP 22119)] 0x402e32ab in mallopt () from /lib/libc.so.6 (gdb) bt #0 0x402e32ab in mallopt () from /lib/libc.so.6 #1 0x402e207f in free () from /lib/libc.so.6 #2 0x400504b9 in pairbasicfree (pair=0x1f8) at valuepair.c:111 #3 0x4005050e in pairfree (pair_ptr=0x41a12b78) at valuepair.c:127 #4 0x0804e21b in rad_respond (request=0x41603528, fun=0x80535b0 rad_authenticate) at radiusd.c:1877 #5 0x08059924 in request_handler_thread (arg=0x40a08120) at threads.c:458 #6 0x400f6e51 in pthread_start_thread () from /lib/libpthread.so.0 #7 0x400f6ecf in pthread_start_thread_event () from /lib/libpthread.so.0 #8 0x4034866a in clone () from /lib/libc.so.6 Program received signal SIGABRT, Aborted. [Switching to Thread 16384 (LWP 22840)] 0x4029a721 in kill () from /lib/libc.so.6 (gdb) bt #0 0x4029a721 in kill () from /lib/libc.so.6 #1 0x400f9771 in pthread_kill () from /lib/libpthread.so.0 #2 0x400f9a7b in raise () from /lib/libpthread.so.0 #3 0x4029a4d4 in raise () from /lib/libc.so.6 #4 0x4029b9e8 in abort () from /lib/libc.so.6 #5 0x0805004e in rad_assert_fail (file=0x0, line=0) at util.c:331 #6 0x0805de40 in rl_next (request=0x4151b9e0) at request_list.c:918 #7 0x0805e528 in rl_clean_list (now=0) at request_list.c:1397 #8 0x0804d89a in main (argc=0, argv=0x0) at radiusd.c:1491 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 24258)] pairmove2 (to=0xbfffe5e8, from=0x4121e620, attr=79) at valuepair.c:474 474 next = i-next; (gdb) (gdb) bt #0 pairmove2 (to=0xbfffe5e8, from=0x4121e620, attr=79) at valuepair.c:474 #1 0x0805026b in rfc_clean (packet=0x4121e5e8) at util.c:456 #2 0x0805036a in request_reject (request=0x4121e528) at util.c:510 #3 0x0805e0aa in refresh_request (request=0x4121e528, data=0x9cc2) at request_list.c:1124 #4 0x0805ddf0 in rl_walk (walker=0x805df10 refresh_request, data=0xbfffe680) at request_list.c:895 #5 0x0805e42b in rl_clean_list (now=5328) at request_list.c:1425 #6 0x0804d89a in main (argc=0, argv=0x80535b0) at radiusd.c:1491 Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Re-writes required for proxied connections - HOWTO
Hi, Am Di, den 01.06.2004 um 23:10 Uhr +0100 schrieb paul hanson: Hi, I have the latest 0.93 available on SuSE Professional 9.1 and need to proxy in-bound requests based upon the called phone number. The most obvious way would be to add a realm name to the 'user name' and proxy based upon the full account name matched to a called phone number. i.e. fred. [EMAIL PROTECTED]. I will need to further strip the realm name once re-directed to the correct radius server. I do that on our proxy radius with entries like this in the users file: DEFAULT Called-Station-Id == 123, Proxy-To-Realm := foobar Fall-Through = no You just have to define the realm in the proxy.conf like you would do normally, and if you don't specify it, the suffix is stripped off before sending the request to the home server. Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: server crashes with new proxy code
On Mon, 2004-05-24 at 09:51 -0400, Alan DeKok wrote: Stephan Jaeger [EMAIL PROTECTED] wrote: Testing the newest freerad version i ran into some problems with the server crashing under very-high-load situations (cvs snapshot from yesterday). Hmm... on second look, ignore my previous message. If you need the complete output or anything else let me know. gdb 'bt', as per doc/bugs would help. Took me some time to figure out that linux doesnt like to coredump on multithread procs and i had to run it in gdb. Maybe that could be added to doc/bugs. Here you go, this time another it happend in another line of request_list.c: Assertion failed in request_list.c, line 580 Program received signal SIGABRT, Aborted. [Switching to Thread 16384 (LWP 2567)] 0x4029b721 in kill () from /lib/libc.so.6 (gdb) bt #0 0x4029b721 in kill () from /lib/libc.so.6 #1 0x400fa771 in pthread_kill () from /lib/libpthread.so.0 #2 0x400faa7b in raise () from /lib/libpthread.so.0 #3 0x4029b4d4 in raise () from /lib/libc.so.6 #4 0x4029c9e8 in abort () from /lib/libc.so.6 #5 0x0805004e in rad_assert_fail (file=0x0, line=0) at util.c:331 #6 0x0805d9ef in rl_add_proxy (request=0x40102140) at request_list.c:580 #7 0x0805236d in proxy_send (request=0x82c8890) at proxy.c:472 #8 0x0804e2ee in rad_respond (request=0x82c8890, fun=0x8053600 rad_authenticate) at radiusd.c:1723 #9 0x0804d9ba in main (argc=135116904, argv=0x8053600) at radiusd.c:1452 Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Freeradius Segmentation Fault on LDAP Bind
On Mon, 2004-05-24 at 08:50 -0700, Paul Bender wrote: I would love to hear your results. I have compiled it with both gcc 3.3.3 (gcc version 3.3.3 20040412 (Red Hat Linux 3.3.3-7)) and gcc 3.4.0 (gcc version 3.4.0 20040519 (Red Hat Linux 3.4.0-2)). In both cases, I get a segmentation fault. I spent a little time trying to get it to core dump, but I have not been successful. I did 'ulimit -c unlimited', enabled core dumps in radiusd.conf and compiled freeradius with --enable-developer. Yet, it still does not core dump on a segmentation fault. I had the same problem, i think it is that multithread procs won't coredump on linux, run it directly in gdb and do the bt there. Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: problem with rlm_mysql and passwords with comma
Hi, On Tue, 2004-05-18 at 12:28 -0400, Alan DeKok wrote: Stephan Jaeger [EMAIL PROTECTED] wrote: since cvs version 1.76 for file /radiusd/src/modules/rlm_sql/sql.c i have a problem authenticating users with rlm_mysql which have a , in their password, the problem seems to be the call to gettoken() in line 367, which returns in the argument value only the attribute value from the mysql db up to the first comma. Hmm... that is an issue. My suggestion would be to either put double quotes around the password, or to update sql.c, so that it calls gettoken ONLY if it sees the string starting off with , `, or ' --- sql.c.orig 2004-05-21 16:09:03.0 +0200 +++ sql.c 2004-05-21 16:12:45.0 +0200 @@ -364,7 +364,15 @@ return 0; ptr = row[3]; - xlat = gettoken(ptr, value, sizeof(value)); + xlat = T_INVALID; + + if ((*ptr == '\'') || + (*ptr == '') || + (*ptr == '`')) + xlat = gettoken(ptr, value, sizeof(value)); + else + strNcpy(value, ptr, sizeof(value)); + switch (xlat) { /* * Make the full pair now. Would something like this be ok here? Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
problem with rlm_mysql and passwords with comma
Hi, since cvs version 1.76 for file /radiusd/src/modules/rlm_sql/sql.c i have a problem authenticating users with rlm_mysql which have a , in their password, the problem seems to be the call to gettoken() in line 367, which returns in the argument value only the attribute value from the mysql db up to the first comma. In the previous version row[3] was used in the call to pairmake which holds the complete value. Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: crash under high load
Am Fr, den 14.05.2004 um 2:37 Uhr -0400 schrieb Alan DeKok: Stephan Jaeger [EMAIL PROTECTED] wrote: i'm having a problem with high load situations, i get Error: Assertion failed in request_list.c, line 532 and the server crashes, it's acting as a radius proxy. Since you didn't say what version you're running, I'm going to suggest upgrading to the latest CVS snapshot. Uhh! Sorry, it's the snapshot from 10th of may. Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: crash under high load
Hi, Am Fr, den 14.05.2004 um 3:05 Uhr -0400 schrieb Alan DeKok: Stephan Jaeger [EMAIL PROTECTED] wrote: Uhh! Sorry, it's the snapshot from 10th of may. Ok... try defining PROXY_ID in request_list.c, to get experimental code which better handles allocation of ID's. That is, at the top of request_list.c, add: #define PROXY_ID 1 and re-build the server. The code is not well tested, so it may require some additional debugging. But the underlying idea should solve the problem. That seems to make things worse The home server says: Fri May 14 09:23:49 2004 : Info: Ready to process requests. Fri May 14 09:24:05 2004 : Auth: Login OK: [test/xxx] (from client proxy_loc port 0 dnis 00) Fri May 14 09:24:05 2004 : Auth: Login OK: [test/xxx] (from client proxy_loc port 0 dnis 00) and the proxy says: Fri May 14 09:23:53 2004 : Info: Ready to process requests. Fri May 14 09:24:05 2004 : Proxy: No outstanding request was found for proxy reply from home server 127.0.0.1: - ID 1 Fri May 14 09:24:05 2004 : Error: Assertion failed in request_list.c, line 533 So now, it crashes nearly instantly. (Both are running the same binary with different configs) Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: crash under high load
Hi, Am Fr, den 14.05.2004 um 3:46 Uhr -0400 schrieb Alan DeKok: Stephan Jaeger [EMAIL PROTECTED] wrote: and the proxy says: Fri May 14 09:23:53 2004 : Info: Ready to process requests. Fri May 14 09:24:05 2004 : Proxy: No outstanding request was found for proxy reply from home server 127.0.0.1: - ID 1 Fri May 14 09:24:05 2004 : Error: Assertion failed in request_list.c, line 533 Please run the server in debugging mode. As I said, the *idea* of the code should solve the problem, but it hasn't been heavily tested. I can't reliably reproduce this problem in my setup, so it's difficult for me to stress test the code. There isn't much more to see, at least not for me. Here is the output only for the second incoming request after that he bails out: [...] Waking up in 3 seconds... rad_recv: Access-Request packet from host 127.0.0.1:34249, id=164, length=64 User-Name = test User-Password = xxx NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Called-Station-Id = 00 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 users: Matched DEFAULT at 3 modcall[authorize]: module files returns ok for request 1 rlm_realm: No '@' in User-Name = test, looking up realm NULL rlm_realm: No such realm NULL modcall[authorize]: module suffix returns noop for request 1 modcall: group authorize returns ok for request 1 Sending Access-Request of id 2 to 127.0.0.1: User-Name = test User-Password = xxx NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Called-Station-Id = 00 Proxy-State = 0x313634 Assertion failed in request_list.c, line 533 Aborted Let me know if you need the whole debug output. Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
nas clients only in the database
Hi, it seems inpossible right now to start freeradius without clients in the radiusd.conf or included files and a client file, as i'd like to with having them only in the mysql database. As a workaround i commented out the if (!c) { return -1 } in file mainconfig.c around line 1154 and added an if (c) {} around the next three lines, seems to work fine. Server also starts without clients in the nas table and doesn't crash on incoming request, its just that it might be not to sensible without any clients ;) Regards Stephan Jaeger - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html