April 2014 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

unlang vs suffix
by Rui Ribeiro 07 Nov '14

07 Nov '14

Hi, I have a simple doubt; I have seen many times a couple of people saying they prefer to use unlang than the suffix directive; what´s the advantage of - supposing proxy.conf is adequately configured, instead of doing suffix do instead (ignore the if part, I know it is missing in the example above, it is here just for the sake of clarity): if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "iscte.pt") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := EDUROAM } } } Regards, Rui Regards, Rui Ribeiro

7 8

radutmp file not created
by Khapare Joshi 03 Jul '14

03 Jul '14

hi I am not able to do radwho since radutmp is not created, In Radius -X it tells me radutmp module is loaded and file should be /var/log/radius/radutmp Freeradius version is : freeradius-2.2.3-6.el6.x86_64 Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } And, In /var/log/radius/radacct/192.168.1.1/auth-detail-20140430, NAS seem to sending request packet to the server Wed Apr 30 10:58:41 2014 Packet-Type = Access-Request EAP-Message = 0x020900061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser(a)ba.com" State = 0x882dba688924a0df1b204ef3b696b63f Calling-Station-Id = "00215c5b8ef3" Called-Station-Id = "dca5f44de9c0:eduroam-tmp" NAS-Port = 1 Cisco-AVPair = "audit-session-id=82d0a5f700000e5a535fb9e9" NAS-IP-Address = 192.168.1.1 NAS-Identifier = "mywireless1" Airespace-Wlan-Id = 310 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 In /etc/raddb/sites-enabled/default accounting section radutmp is uncommented And, still radutmp file is not created in /var/log/radius directory. When I run the freeradius in debug mode (radiusd -X) and test authenticate user I get following: Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 54636, id=127, length=139 User-Name = "testuser(a)ba.com" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Message-Authenticator = 0xee4209c0650849c1f6d60a5f94bf5a9b MS-CHAP-Challenge = 0x3feecd0086804485 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000077ac654ce5135ab5f8690098e68c7e403bfcc24bb714d293 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] = ok ++[digest] = noop [suffix] Looking up realm "ba.com" for User-Name = "testuser(a)ba.com" [suffix] Found realm "ba.com" [suffix] Adding Stripped-User-Name = "testuser" [suffix] Adding Realm = "ba.com" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] No EAP-Message, not doing EAP ++[eap] = noop [files] users: Matched entry DEFAULT at line 3 ++[files] = ok [ldap] performing user authorization for testuser [ldap] expand: %{Stripped-User-Name} -> testuser [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser) [ldap] expand: ou=People,dc=BA,dc=com -> ou=People,dc=BA,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.ba.com:389, authentication 0 [ldap] bind as / to ldap.ba.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=People,dc=BA,dc=com, with filter (uid=testuser) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +group MS-CHAP { [mschap] Client is using MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> testuser [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=testuser [mschap] mschap1: 3f [mschap] expand: %{mschap:Challenge} -> 3feecd0086804485 [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=3feecd0086804485 [mschap] expand: %{mschap:NT-Response} -> 77ac654ce5135ab5f8690098e68c7e403bfcc24bb714d293 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=77ac654ce5135ab5f8690098e68c7e403bfcc24bb714d293 Exec output: NT_KEY: 04066C8C6B0E8CFCABBB0AB6760971F7 Exec plaintext: NT_KEY: 04066C8C6B0E8CFCABBB0AB6760971F7 [mschap] Exec: program returned: 0 [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] = ok +} # group MS-CHAP = ok # Executing section session from file /etc/raddb/sites-enabled/default +group session { [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp ++[radutmp] = ok So, even though it says radutmp = ok the file /var/log/radius/radutmp is not created. I must be doing something wrong or my configuration is not correct for radutmp. I appericiate some inputs. Thanks K

3 7

AVP EAP-KEY name support in FR
by Srinu Bandari 12 May '14

12 May '14

Hi, We are trying to bring up MACsec with Cisco and FR, and we are stuck because of Radius unable to send EAP-Key-Name AVP. Below is what is expected as per RFC4072 RFC4072 says "A home Diameter server receiving a Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST silently discard the AVP. In addition, the home Diameter server SHOULD include this AVP in Diameter-EAP-Response only if an empty EAP-Key-Name AVP was present in Diameter-EAP-Request." But radius server is not sending EAP-Key-Name AVP (Radius Attribute Type 102) even invalid AVP present in the Diameter-EAP-Request". Below is the debug print of radius Sending Access-Accept of id 647 to 10.20.64.9 port 1645 MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Does anyone have clue on this. Thanks, Srinivas CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 19

How to define Pool-Name with radcheck table
by yata 01 May '14

01 May '14

Hi all! I'm using freeradius2 as a radius-server and dhcp-server. When I connect to freeradius by defined user in /etc/raddb/users , it is successful. But I wanna define users in mysql's radcheck table. I inserted userID and password in radcheck table then following messages were displaied and connection failed. it seems to be failed to find pool-name How should I define pool-name in radcheck table or somewhere? Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.0.5.200 port 50000, id=10, length=207 User-Password = "test123" User-Name = "test123(a)test.or.jp" Acct-Session-Id = "erx FastEthernet 1/6:0014680074" Service-Type = Framed-User Framed-Protocol = PPP ERX-Pppoe-Description = "pppoe 00:1d:72:c6:7b:d5" Calling-Station-Id = "#ERX-40-b0-7a#E16#0" NAS-Port-Type = Ethernet NAS-Port = 369098752 NAS-Port-Id = "FastEthernet 1/6" NAS-IP-Address = 10.0.5.200 NAS-Identifier = "ERX-40-b0-7a" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "test.or.jp" for User-Name = "test123(a)test.or.jp" [suffix] No such realm "test.or.jp" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> test123(a)test.or.jp [sql] sql_set_user escaped user --> 'test123(a)test.or.jp' rlm_sql (sql): Reserving sql socket id: 13 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test123(a)test.or.jp' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test123(a)test.or.jp' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test123(a)test.or.jp' ORDER BY priority rlm_sql (sql): Released sql socket id: 13 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "test123" [pap] Using clear text password "test123" [pap] User authenticated successfully ++[pap] returns ok Login OK: [test123(a)test.or.jp] (from client GGSN1 port 369098752 cli #ERX-40-b0-7a#E16#0) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did cli #ERX-40-b0-7a#E16#0 port 369098752 user test123(a)test.or.jp) No Pool-Name defined (did cli #ERX-40-b0-7a#E16#0 port 369098752 user test123(a)test.or.jp) ++[sqlippool] returns noop ++[exec] returns noop Sending Access-Accept of id 10 to 10.0.5.200 port 50000 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 10.0.5.200 port 50016, id=108, length=248 Acct-Status-Type = Stop User-Name = "test123(a)test.or.jp" Event-Timestamp = "Apr 29 2014 14:20:16 PDT" Acct-Delay-Time = 0 NAS-Identifier = "ERX-40-b0-7a" Acct-Session-Id = "erx FastEthernet 1/6:0014680074" NAS-IP-Address = 10.0.5.200 Service-Type = Framed-User Calling-Station-Id = "#ERX-40-b0-7a#E16#0" Acct-Input-Gigawords = 0 Acct-Input-Octets = 0 Acct-Output-Gigawords = 0 Acct-Output-Octets = 0 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 369098752 NAS-Port-Id = "FastEthernet 1/6" Acct-Authentic = RADIUS Acct-Session-Time = 0 Acct-Terminate-Cause = NAS-Request # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 369098752,Client-IP-Address = 10.0.5.200,NAS-IP-Address = 10.0.5.200,Acct-Session-Id = "erx FastEthernet 1/6:0014680074",User-Name = "test123(a)test.or.jp"' [acct_unique] Acct-Unique-Session-ID = "4abb92629c9787a0". ++[acct_unique] returns ok [suffix] Looking up realm "test.or.jp" for User-Name = "test123(a)test.or.jp" [suffix] No such realm "test.or.jp" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} rlm_sql (sql): Reserving sql socket id: 12 [sqlippool] expand: %{User-Name} -> test123(a)test.or.jp [sqlippool] sql_set_user escaped user --> 'test123(a)test.or.jp' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '10.0.5.200' AND pool_key = '369098752' AND username = 'test123(a)test.or.jp' AND callingstationid = '=23ERX-40-b0-7a=23E16=230' AND framedipaddress = '' [sqlippool] expand: COMMIT -> COMMIT [sqlippool] expand: Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name}) -> Released IP (did cli #ERX-40-b0-7a#E16#0 user test123(a)test.or.jp) Released IP (did cli #ERX-40-b0-7a#E16#0 user test123(a)test.or.jp) rlm_sql (sql): Released sql socket id: 12 ++[sqlippool] returns ok [sql] expand: %{User-Name} -> test123(a)test.or.jp [sql] sql_set_user escaped user --> 'test123(a)test.or.jp' [sql] expand: %{Acct-Input-Gigawords} -> 0 [sql] expand: %{Acct-Input-Octets} -> 0 [sql] expand: %{Acct-Output-Gigawords} -> 0 [sql] expand: %{Acct-Output-Octets} -> 0 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2014-04-29 22:49:42', acctsessiontime = '0', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | rlm_sql (sql): Reserving sql socket id: 11 [sql] expand: stop packet with zero session length. [user '%{User-Name}', nas '%{NAS-IP-Address}'] -> stop packet with zero session length. [user 'test123(a)test.or.jp', nas '10.0.5.200'] [sql] stop packet with zero session length. [user 'test123(a)test.or.jp', nas '10.0.5.200'] rlm_sql (sql): Released sql socket id: 11 ++[sql] returns noop ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> test123(a)test.or.jp attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 108 to 10.0.5.200 port 50016 Finished request 1. Cleaning up request 1 ID 108 with timestamp +7 Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 10 with timestamp +7 Ready to process requests. If you need more information, please let me know. Thanks.

3 3

freeradius 1.1.8 help
by Stacy Trippe 30 Apr '14

30 Apr '14

I've been trying (unsuccessfully) to upgrade an old 0.8.1 server running on FreeBSD 4.7 to something in the current decade... any help appreciated... Getting a segmentation fault running 1.1.8 on CentOS 6.5 (32-bit - i686) Ran check-radius-config -- and get through to modules loading -- and it crashes: Ignoring deprecated command-line option -pStarting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib:/usr/lib/freeradius" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 2 main: max_requests = 2560 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = no proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 0 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup I followed doc/bugs and created a gdb-radiusd.log which is below: * 1 Thread 0xb77f4730 (LWP 5815) 0x00b637d7 in __strcmp_sse4_2 () from /lib/i686/nosegneg/libc.so.6 Thread 1 (Thread 0xb77f4730 (LWP 5815)): #0 0x00b637d7 in __strcmp_sse4_2 () from /lib/i686/nosegneg/libc.so.6 No symbol table info available. #1 0x006fbb95 in lt_dlpreload_open () from /usr/lib/libltdl.so.7 No symbol table info available. #2 0x006ffb2b in lt_dlinit () from /usr/lib/libltdl.so.7 No symbol table info available. #3 0x002d1b54 in setup_modules () at modules.c:710 comp = <value optimized out> cs = <value optimized out> filename = 0x2dd7d1 "radiusd.conf" #4 0x002d4e58 in main (argc=2, argv=0xbfddc874) at radiusd.c:965 request = 0x2e3ea0 packet = <value optimized out> secret = <value optimized out> buffer = '\000' <repeats 16 times>"\340, \267<U+077F>", '\000' <repeats 12 times>, "\004<\027\000\001\000\000\000\000\320G\000\220|\177\267\000@\027\000<\266<U+077F>\000\000\000\000=\331F\000\274&\241\000\340\237\177\267\304\317G\000x\235\177\267\274&\241\000(\271<U+077F>\204eF\000\274&\241\000i\212J\000\003\000\000\000\260|\177\267\004<\027\000\004\354\001\000\000\375\000\000i\212J\000\000\000\000\000\203\001\020\000\355\201\000\000\001", '\000' <repeats 23 times>, "\001\000\000\000\000\320G\000\340x\177\267\360\000\000\000\000\000\000\000*\035CS<Ù¶#=\331F\000\254\243\024\000\340\237\177\267\304\317G\000x\235\177\267\254\243\024\000\250\271<U+077F>\204eF\000\254\243\024\000i\212J\000\304\317G\000\021\306\177\267\221\243\024\000Ä¹<U+077F>\261fF\000i\212J\000x|\177\267(v\177\267\001\000\000\000\000\000\000\000\254\271<U+077F>\000\000\000\000\003\000\000\000\307yG\000\260\271<U+077F>\001\000\000\000\000\320G\000(v\177\267"... readfds = {fds_bits = {-1075984572, 21, 4708600, 0, 0, 1, 2200, -1216388896, -1216373384, 2908937, 10743672, 2902908, 1, 4706244, -1075984352, 4709040, -1075984396, 4620570, -1075984412, 2902908, -1075984424, 4708948, 0, -1216388896, 1, 0, 1, 4708600, 3870384, -1075984488, 4664624, 2}} argval = <value optimized out> pid = <value optimized out> max_fd = <value optimized out> status = <value optimized out> tv = 0x0 act = {__sigaction_handler = {sa_handler = 0, sa_sigaction = 0}, sa_mask = {__val = {0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0} listener = <value optimized out> Thanks, Stacy

5 4

FreeRADIUS & MAC authentication
by Russell Mike 30 Apr '14

30 Apr '14

Greetings FreeRADIUS List i have a special requirement, i need your help to understand FreeRADIUS virtual server(s) a little bit. i want to use FreeRADIUS for MAC authentication and i need the following results. if not found then accept the access if found look for accept & reject value in the database table to send reply. My question is not that how to do it, but to know if do able. i shall read more documentation if possible to achieve. i would VERY grateful also, if someone can kindly send me the documentation link, which explain this kind of topic. Thanks / Regards RM --

2 5

accounting_onoff_query with empty acctterminatecause
by Lorenzo Milesi 30 Apr '14

30 Apr '14

Hi. I was investigating my DB for some session being marked as terminated while still active and I believe I found the culprit in the accounting_onoff_query query. While this issue is probably related to NAS (Coova) configuration being incompatible with the query itself (NAS-IP-Address is almost always the same), the sessions terminated by this query all have a blank terminate cause. Is this expected? Thanks P.S. The query is the default one: accounting_onoff_query = "\ UPDATE ${acct_table1} \ SET \ acctstoptime = '%S', \ acctsessiontime = unix_timestamp('%S') - \ unix_timestamp(acctstarttime), \ acctterminatecause = '%{Acct-Terminate-Cause}', \ acctstopdelay = %{%{Acct-Delay-Time}:-0} \ WHERE acctstoptime IS NULL \ AND nasipaddress = '%{NAS-IP-Address}' \ AND acctstarttime <= '%S'" -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

2 1