March 2013 - Freeradius-Users - lists.freeradius.org

Re : Re: Re : Re: Mode debug
by Billot 28 Mar '13

28 Mar '13

When using raddebug or -x option in startup, i can't see logs like User-Name = "nagios(a)ac-orleans-tours.fr" NAS-IP-Address = 172.21.175.132 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "2C-B0-5D-A4-52-00:WIFI-ACAD" Calling-Station-Id = "8C-77-12-53-62-0E" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11g" which can be found with -X I tried radiusd -xxxxl /var/log/debug.log, file exists but is as detailled as with debug_level = 2 in radiusd.conf I tried radmin, debug level 4, debug file debug.log and same way. Any idea ? Le 28/03/13, Olivier Beytrison <olivier(a)heliosnet.org> a écrit : > On 28.03.2013 10:31, Billot wrote: > > Ok thanks but is it possible to have it permanently with a config item like > > > > raddbdir = ${sysconfdir}/raddb > > radacctdir = ${logdir}/radacct > > debug_level = 4 > > > > edit your startup script and add -xl /path/to/my/debugfile > add more x for more debugging > Be aware that this file will grow quickly depending on the amount of > request your server handle. > > Olivier > -- > > Olivier Beytrison > Network & Security Engineer, HES-SO Fribourg > Mail: olivier(a)heliosnet.org > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 2

compile error
by Igor Smitran 28 Mar '13

28 Mar '13

I am not able to compile from git. It ends with error: version.c:71: warning: no previous prototype for 'ssl_version_check' version.c: In function 'ssl_version': version.c:78: error: expected ';' before '}' token gmake[4]: *** [version.lo] Error 1 gmake[4]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server/src/main' gmake[3]: *** [main] Error 2 gmake[3]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/usr/src/freeradius-git-2.x.x/freeradius-server' make: *** [all] Error 2

2 2

Mode debug
by Billot 28 Mar '13

28 Mar '13

Hi, When debugging freeradius config, we use radiusd -X which can offer a lot of useful datas like rad_recv: Access-Request packet from host 172.21.175.132 port 32769, id=166, length=332 User-Name = "nagios(a)ac-orleans-tours.fr" NAS-IP-Address = 172.21.175.132 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "2C-B0-5D-A4-52-00:WIFI-ACAD" Calling-Station-Id = "8C-77-12-53-62-0E" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11g" but in standard running mode (service radius start), even with debug = 2 set, there is no such detailed log. How can we have such detail logs in running mode ? -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 3

Auth-Type krb5 not recognized by v2.1.12
by Jaap Winius 27 Mar '13

27 Mar '13

Hi folks, Recently my server received an in-place upgrade from Debian squeeze to wheezy (still testing). Along with that, freeradius was upgraded from version 2.1.10 to 2.1.12, but as a result it no longer works. The problem is that I use "DEFAULT Auth-Type = krb5" in /etc/freeradius/ users, and this now leads to an error in the radius.log that prevents freeradius from starting up: Error: /etc/freeradius/users[207]: Parse error (check) for \ entry DEFAULT: Unknown value krb5 for attribute Auth-Type Interestingly, if I use "kerberos" instead of "krb5" for the default auth- type, there is no such error in the radius.log, but I still can't authenticate. Downgrading to 2.1.10 quickly fixes the problem. Is this new behavior intentional, or is it simply a bug? In either case, is there a workaround or a code fix for this, or should I continue to use 2.1.10? Thanks, Jaap

4 7

Update reply to DHCP-Ack
by Leo Combes 27 Mar '13

27 Mar '13

I have a small problem that I do not know how to solve. Freeradius works correctly as DHCP server delivering static IPs, but I need to write a log in the PostAuth database if the transaction finalizes with a DHCP-Ack. Currently when transaction ends with a DHCP-Ack, this configuration log a "DHCP-Request" instead of "DHCP-Ack". This is my setup: server dhcp { listen { type = dhcp ipaddr = 255.255.255.255 port = 67 interface = eth1.2 broadcast = yes } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = 0.0.0.0 DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.31.1.1 } deselabs_dhcp_cpes.authorize ok } dhcp DHCP-Request { update reply { # Is not the type supposed to be changed here? DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 0.0.0.0 DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.31.1.1 Reply-Message = "Framed protocol is" } deselabs_dhcp_cpes.authorize deselabs_dhcp_cpes.post-auth ok } dhcp { # send a DHCP NAK. reject } } This is the debug output: Received DHCP-Discover of id 7ca9d708 from 0.0.0.0:68 to 255.255.255.255:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 2091505416 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:50:c2:31:24:4f DHCP-Message-Type = DHCP-Discover DHCP-Client-Identifier = 0x010050c231244f00 DHCP-IP-Address-Lease-Time = 4294967040 DHCP-IP-Address-Lease-Time = 4294967295 DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Bootp-Extensions-Path DHCP-Parameter-Request-List = DHCP-TFTP-Server-Name DHCP-Parameter-Request-List = DHCP-SIP-Servers-DHCP-Option DHCP-Parameter-Request-List = DHCP-HTTP-Proxy DHCP-Parameter-Request-List = 213 DHCP-Parameter-Request-List = 214 DHCP-Parameter-Request-List = 215 server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} ++[reply] returns noop ++[reply] returns noop [deselabs_dhcp_cpes] expand: %{DHCP-Client-Hardware-Address} -> 00:50:c2:31:24:4f [deselabs_dhcp_cpes] sql_set_user escaped user --> '00:50:c2:31:24:4f' rlm_sql (deselabs_dhcp_cpes): Reserving sql socket id: 4 [deselabs_dhcp_cpes] expand: SELECT '1', mac_address, 'Cleartext-Password', REPLACE('%{SQL-User-Name}', ':', ''), ':=' FROM cpes WHERE mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '2', mac_address, 'Auth-Type', 'Accept', ':=' FROM cpes WHERE mac_address = REPLACE('%{SQL-User-Name}', ':', '') -> SELECT '1', mac_address, 'Cleartext-Password', REPLACE('00:50:c2:31:24:4f', ':', ''), ':=' FROM cpes WHERE mac_address = REPLACE('00:50:c2:31:24:4f', ':', '') UNION SELECT '2', mac_address, 'Auth-Type', 'Accept', ':=' FROM cpes WHERE mac_address = REPLACE('00:50:c2:31:24:4f', ':', '') [deselabs_dhcp_cpes] User found in radcheck table [deselabs_dhcp_cpes] expand: SELECT '1', mac_address as username, 'DHCP-Your-IP-Address' AS attribute, CONCAT_WS('.', nets.net_prefix, cpes.ip_host) AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '2' as id, mac_address, 'DHCP-Subnet-Mask' AS attribute, nets.netmask AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '3' as id, mac_address, 'DHCP-Router-Address' AS attribute, nets.gateway AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '4' as id, mac_address, 'DHCP-Bootp-Extensions-Path' AS attribute, cpes_profiles.acf_name AS value, '=' AS op FROM cpes LEFT OUTER JOIN cpes_profiles ON cpes.profile=cpes_profiles.profile_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', ' rlm_sql (deselabs_dhcp_cpes): Released sql socket id: 4 ++[deselabs_dhcp_cpes.authorize] returns ok ++[ok] returns ok } # server dhcp DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 172.31.1.1 DHCP-Domain-Name-Server = 0.0.0.0 DHCP-Bootp-Extensions-Path = "slave_clear.acf" DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.31.1.1 DHCP-TFTP-Server-Name = "172.31.1.1" Sending DHCP-Offer of id 7ca9d708 to 255.255.255.255:68 Finished request 0. Cleaning up request 0 ID 2091505416 with timestamp +6 Going to the next request Ready to process requests. Received DHCP-Request of id 7da9d708 from 0.0.0.0:68 to 255.255.255.255:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 2108282632 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:50:c2:31:24:4f DHCP-Message-Type = DHCP-Request DHCP-Client-Identifier = 0x010050c231244f00 DHCP-IP-Address-Lease-Time = 4294967040 DHCP-Requested-IP-Address = 172.31.1.12 DHCP-DHCP-Server-Identifier = 172.31.1.1 DHCP-IP-Address-Lease-Time = 4294967295 DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Bootp-Extensions-Path DHCP-Parameter-Request-List = DHCP-TFTP-Server-Name DHCP-Parameter-Request-List = DHCP-SIP-Servers-DHCP-Option DHCP-Parameter-Request-List = DHCP-HTTP-Proxy DHCP-Parameter-Request-List = 213 DHCP-Parameter-Request-List = 214 DHCP-Parameter-Request-List = 215 server dhcp { Trying sub-section dhcp DHCP-Request {...} +- entering group DHCP-Request {...} ++[reply] returns noop ++[reply] returns noop [deselabs_dhcp_cpes] expand: %{DHCP-Client-Hardware-Address} -> 00:50:c2:31:24:4f [deselabs_dhcp_cpes] sql_set_user escaped user --> '00:50:c2:31:24:4f' rlm_sql (deselabs_dhcp_cpes): Reserving sql socket id: 3 [deselabs_dhcp_cpes] expand: SELECT '1', mac_address, 'Cleartext-Password', REPLACE('%{SQL-User-Name}', ':', ''), ':=' FROM cpes WHERE mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '2', mac_address, 'Auth-Type', 'Accept', ':=' FROM cpes WHERE mac_address = REPLACE('%{SQL-User-Name}', ':', '') -> SELECT '1', mac_address, 'Cleartext-Password', REPLACE('00:50:c2:31:24:4f', ':', ''), ':=' FROM cpes WHERE mac_address = REPLACE('00:50:c2:31:24:4f', ':', '') UNION SELECT '2', mac_address, 'Auth-Type', 'Accept', ':=' FROM cpes WHERE mac_address = REPLACE('00:50:c2:31:24:4f', ':', '') [deselabs_dhcp_cpes] User found in radcheck table [deselabs_dhcp_cpes] expand: SELECT '1', mac_address as username, 'DHCP-Your-IP-Address' AS attribute, CONCAT_WS('.', nets.net_prefix, cpes.ip_host) AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '2' as id, mac_address, 'DHCP-Subnet-Mask' AS attribute, nets.netmask AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '3' as id, mac_address, 'DHCP-Router-Address' AS attribute, nets.gateway AS value, '=' AS op FROM cpes LEFT OUTER JOIN nets ON cpes.net=nets.net_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', '') UNION SELECT '4' as id, mac_address, 'DHCP-Bootp-Extensions-Path' AS attribute, cpes_profiles.acf_name AS value, '=' AS op FROM cpes LEFT OUTER JOIN cpes_profiles ON cpes.profile=cpes_profiles.profile_id WHERE cpes.mac_address = REPLACE('%{SQL-User-Name}', ':', ' rlm_sql (deselabs_dhcp_cpes): Released sql socket id: 3 ++[deselabs_dhcp_cpes.authorize] returns ok [deselabs_dhcp_cpes] expand: %{DHCP-Client-Hardware-Address} -> 00:50:c2:31:24:4f [deselabs_dhcp_cpes] sql_set_user escaped user --> '00:50:c2:31:24:4f' [deselabs_dhcp_cpes] expand: %{User-Password} -> [deselabs_dhcp_cpes] ... expanding second conditional [deselabs_dhcp_cpes] expand: %{Chap-Password} -> [deselabs_dhcp_cpes] expand: INSERT INTO radius_postauth (username, password, reply, authdate) VALUES (UPPER(REPLACE('%{SQL-User-Name}', ':', '')), '%{%{User-Password}:-%{Chap-Password}}', '%{DHCP-Message-Type}', '%S') -> INSERT INTO radius_postauth (username, password, reply, authdate) VALUES (UPPER(REPLACE('00:50:c2:31:24:4f', ':', '')), '', 'DHCP-Request', '2013-03-25 12:53:15') rlm_sql (deselabs_dhcp_cpes) in sql_postauth: query is INSERT INTO radius_postauth (username, password, reply, authdate) VALUES (UPPER(REPLACE('00:50:c2:31:24:4f', ':', '')), '', 'DHCP-Request', '2013-03-25 12:53:15') rlm_sql (deselabs_dhcp_cpes): Reserving sql socket id: 2 rlm_sql (deselabs_dhcp_cpes): Released sql socket id: 2 ++[deselabs_dhcp_cpes.post-auth] returns ok ++[ok] returns ok } # server dhcp DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 172.31.1.1 DHCP-Domain-Name-Server = 0.0.0.0 DHCP-Bootp-Extensions-Path = "slave_clear.acf" DHCP-IP-Address-Lease-Time = 7200 DHCP-DHCP-Server-Identifier = 172.31.1.1 DHCP-TFTP-Server-Name = "172.31.1.1" Sending DHCP-Ack of id 7da9d708 to 255.255.255.255:68 Finished request 1. Cleaning up request 1 ID 2108282632 with timestamp +7 Going to the next request Ready to process requests. What should I change in my config if I want to change the DHCP-Message-Type to "DHCP-Ack" in order to get the correct log information? I tried using the ":=" operator with no luck.

1 1

Re: Auth-Type krb5 not recognized by v2.1.12
by Alan Buxey 27 Mar '13

27 Mar '13

What you are doing is actually okay (its one of those exceptions where auth-type needs to be present as the server has no idea to use krb5). I wonder if your server has been built with kerberos support? alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2

Re: Question about interaction Between Vmware View 5.1 and smsotp
by Thomas Glanzmann 27 Mar '13

27 Mar '13

Hello Stéphane, > It works. Thank you. Yes, the radiusd process listen on some > multiples ports and i was wrong when i put the value 1812 on VMware > View. for the list. The problem was that View was configured to port 1812 which does not do SMSOTP with my configuration, so we reconfigured it to port 11812 and it worked. > A little question, this is normal workflow => Client view ask for > user/pass AD => ASk for OTP => ask again for user/passAD? If I remeber correctly you either should put the username as: domain\username or username(a)full.realm.de than it should ask only once. But the last time I configured it with View is one year ago. Cheers, Thomas

1 0

Re: Question about interaction Between Vmware View 5.1 and smsotp
by Thomas Glanzmann 27 Mar '13

27 Mar '13

Hello Stéphane, can you please send a screenshot of your View Radius Configuration, your full configuration and the full debugging output which includes an authentication request from pap_challenge_request.pl and from View. Cheers, Thomas

1 0

How can I change proxy based on username?
by John Horne 26 Mar '13

26 Mar '13

Hello, Using Freeradius 2.1.10 I have been trying to see if I can proxy a request to a remote server but using a different User-Name attribute based on the original request User-Name attribute. For example so that: Request 'j.bloggs(a)plymouth.ac.uk' gets proxied to remote server with User-Name="j.bloggs(a)plymouth.ac.uk" in the proxy request. Request 'jbloggs(a)plymouth.ac.uk' gets proxied to the same remote server but uses the User-Name="jbloggs" attribute (so no realm) in the proxy request. So basically if a username contains a dot, then proxy on the whole thing (username and realm). But if the username does not contain a dot, then only proxy on the username, no realm. I have been trying in the authorize section to use: ========================= if (Realm !~ /^(NULL|DEFAULT|LOCAL)$/) { if (User-Name =~ /^([^.]+)@/) { update control { Proxy-To-Realm := NULL } } } ========================= The NULL realm will 'strip' the username, and proxy the request to the remote server. However, testing shows that the User-Name being sent is the original one still with the realm: ========================= Tue Mar 26 12:31:07 2013 : Debug: ++? if (Realm !~ /^(NULL|DEFAULT| LOCAL)$/) Tue Mar 26 12:31:07 2013 : Debug: ? Evaluating (Realm !~ /^(NULL| DEFAULT|LOCAL)$/) -> TRUE Tue Mar 26 12:31:07 2013 : Debug: ++? if (Realm !~ /^(NULL|DEFAULT| LOCAL)$/) -> TRUE Tue Mar 26 12:31:07 2013 : Debug: ++- entering if (Realm !~ /^(NULL| DEFAULT|LOCAL)$/) {...} Tue Mar 26 12:31:07 2013 : Debug: +++? if (User-Name =~ /^([^.]+)@/) Tue Mar 26 12:31:07 2013 : Debug: ? Evaluating (User-Name =~ /^([^.]+)@/) -> TRUE Tue Mar 26 12:31:07 2013 : Debug: +++? if (User-Name =~ /^([^.]+)@/) -> TRUE Tue Mar 26 12:31:07 2013 : Debug: +++- entering if (User-Name =~ /^([^.]+)@/) {...} Tue Mar 26 12:31:07 2013 : Debug: ++++[control] returns updated Tue Mar 26 12:31:07 2013 : Debug: +++- if (User-Name =~ /^([^.]+)@/) returns updated Tue Mar 26 12:31:07 2013 : Debug: ++- if (Realm !~ /^(NULL|DEFAULT| LOCAL)$/) returns updated Tue Mar 26 12:31:07 2013 : Debug: ++[local_mschap] returns noop Tue Mar 26 12:31:07 2013 : Debug: [eap] Request is supposed to be proxied to Realm NULL. Not doing EAP. Tue Mar 26 12:31:07 2013 : Debug: ++[eap] returns noop Tue Mar 26 12:31:07 2013 : Debug: ++[files] returns noop Tue Mar 26 12:31:07 2013 : Debug: ++[expiration] returns noop Tue Mar 26 12:31:07 2013 : Debug: ++[logintime] returns noop Tue Mar 26 12:31:07 2013 : Debug: ++[pap] returns noop ... Tue Mar 26 12:31:07 2013 : Debug: Sending Access-Request packet to host 141.163.1.180 port 1812, id=140, length=191 Tue Mar 26 12:31:07 2013 : Debug: User-Name = "jbloggs(a)plymouth.ac.uk" Tue Mar 26 12:31:07 2013 : Debug: NAS-IP-Address = 127.0.0.1 Tue Mar 26 12:31:07 2013 : Debug: Calling-Station-Id = "02-00-00-00-00-01" Tue Mar 26 12:31:07 2013 : Debug: Framed-MTU = 1400 Tue Mar 26 12:31:07 2013 : Debug: NAS-Port-Type = Wireless-802.11 Tue Mar 26 12:31:07 2013 : Debug: Connect-Info = "CONNECT 11Mbps 802.11b" Tue Mar 26 12:31:07 2013 : Debug: EAP-Message = 0x020c00261900170301001b3fb7e62a2e47d33ede49271ebc0c70dc92c4a82ac889c9b1867ddc Tue Mar 26 12:31:07 2013 : Debug: State = 0x28af050f0000013700018da3c9b4000000035b2fcad100 Tue Mar 26 12:31:07 2013 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Tue Mar 26 12:31:07 2013 : Debug: Realm = "plymouth.ac.uk" Tue Mar 26 12:31:07 2013 : Debug: EAP-Type = PEAP Tue Mar 26 12:31:07 2013 : Debug: Proxy-State = 0x3132 ========================= As the output shows 'Request is supposed to be proxied to Realm NULL', so the authorize bit seems to be working, but the realm is not being stripped from the username. The proxy.conf file simply has: ========================= realm NULL { auth_pool = local_proxies } ========================= So the realm should be stripped from the username. Anyone any ideas about this? Thanks, John. -- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK Fax: +44 (0)1752 587001

4 7

(no subject)
by Mehdi Ravanbakhsh 26 Mar '13

26 Mar '13

Hi All I am create stored persedure in postgresql database named "findout_cuncurrent_session_for_a_user_result" that return "Deny" or "Permit" . I need to call this persidure in session section but it not working i check all policy that be explaned in unlang man page but this cod is not working : session { if ("{%sql:select findout_cuncurrent_session_for_a_user_result ('%{User-Name}','%{NAS-IP-Address}','%{Called-Station-Id}','%{Calling-Station-Id}')}" == "Deny") { update control { Pool-Name := "Exceeded-Concurrent-Session" } } } What is the problem? Do i write sql query write ? (this query is work fine in sql.conf )

3 5