June 2014 - Freeradius-Users - lists.freeradius.org

HEX Stripping using attr_rewrite
by Simon Allard 17 Jun '14

17 Jun '14

Hi Freeradius list :-) I am have a bit of an issue with the stripping hex values from my ADSL-Agent-Remote-ID field in my Auth packet. I am using an Alcatel-Lucent 7750SR platform and for some reason they decided when converting a DHCPv6 packet into a radius packet it appends the Enterprise ID (which is a hex number) into the ADSL-Agent-Remote-ID. I end up with a packet looking like this: User-Name = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" User-Password = "" NAS-IP-Address = 60.xxx.xxx.xxx ADSL-Agent-Circuit-Id = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" ADSL-Agent-Remote-Id = "\000\000\000\001CHORUS1234567894" NAS-Port-Type = Ethernet NAS-Port-Id = "pw-2:1101.104" Calling-Station-Id = "\000\000\000\001CHORUS1234567894" NAS-Identifier = "bng" Acct-Session-Id = "E1F15900F37E74538D434C" The issue I seem to be running into, since \000 is a termination value, that freeradius sees the value of attribute ADSL-Agent-Remote-Id as blank. Example below. [sql] expand: %{Orcon-User-Name} -> : User-Name = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" User-Password = "" NAS-IP-Address = 60.xx.xx.xx ADSL-Agent-Circuit-Id = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" ADSL-Agent-Remote-Id = "\000\000\000\001CHORUS1234567894" NAS-Port-Type = Ethernet NAS-Port-Id = "pw-2:1101.104" Calling-Station-Id = "\000\000\000\001CHORUS1234567894" NAS-Identifier = "bng1" Acct-Session-Id = "E1F15900F40272538D8D8E" +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "MDR-POLT01 eth 1/1/01/01/4/1/1:10", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] expand: %{ADSL-Agent-Circuit-Id} -> MDR-POLT01 eth 1/1/01/01/4/1/1:10 ++[files] returns noop [sane_dhcpv6_chorus] expand: \000\000\000\001 -> \000\000\000\001 sane_dhcpv6_chorus: Does not match: ADSL-Agent-Remote-Id = sane_dhcpv6_chorus: Could not find value pair for attribute ADSL-Agent-Remote-Id ++[sane_dhcpv6_chorus] returns ok My attr_rewrite code is: attr_rewrite sane_dhcpv6_chorus { attribute = ADSL-Agent-Remote-Id searchin = packet searchfor = "\\000\\000\\000\\001" replacewith = "" ignore_case = no new_attribute = no max_matches = 10 ## If set to yes then the replace string will be ## appended to the original string append = no } I have raised the issue with the vendor, but I am not holding my breath for a fix anytime soon. Are there any other options in freeradius to get around this?

5 8

LDAP Groups to Freeradius and then Ruckus Wireless?
by Enrique Sainz Baixauli 17 Jun '14

17 Jun '14

Hello there, I'm trying to deploy a FreeRadius server with OpenLDAP. To this end, both are working properly and communicate with each other successfully. I have LDAP groups set up so users belong to a group and I can check from freeradius' users file if a user belongs to a group (and, for example, deny access to all users belonging to a certain group). I must say that, if I enable group checking in users file, I can see rlm_ldap debug info about it searching for group information; but if it's not enabled it doesn't search for groups. The issue here is that the server will be used to authenticate wifi users from a Ruckus ZoneDirector device, which defines roles and assigns roles to the users depending on the groups that the users belong to. This works flawlessly when authenticating against LDAP itself, but if freeradius stands in the middle the group info gets lost somewhere. I know that freeradius can access Ldap-Group variable and know which group the user belongs to, but I'd like it to forward that info to the ZoneDirector (who is actually performing the authentication request against freeradius), so that it can assign the role properly. The LDAP database is set up with two OUs, users and groups, and users being of objectClass inetOrgPerson and groups being groupOfNames. In freeradius, ldap config is mostly default except for server, identity, etc, but with these group-related parameters: groupname_attribute = cn groupmembership_filter = (&(objectClass=groupOfNames)(member=%{control:Ldap-UserDn})) groupmembership_attribute = member # (also tried with memberOf, radiusGroup, radiusGroupName and several others) And, about the server, it is running Debian 7.5, OpenLDAP 2.4.31 and freeradius 2.1.12 (default packages from debian). I can provide any other info that you need :) Thanks everyone in advance!

8 76

Dumb all returned attributes
by Brandon Jozsa 17 Jun '14

17 Jun '14

Want to approach this differently than trying to use cache, as I don't think rlm_cache will fit what I need. At least not how I can logically wrap my head around it anyway... I'm running FR in proxy mode and can collect send user auth to an upstream radius server. Is there any way to collect, and dump, all returned attributes to a text file? If so, how can I do this...I can't find any good articles that show how to really do this. It's for a quick and dirty forklift solution to replace an old, ready to fail RSA server. I want to try dumping the output first, then possibly figure out how to use a rlm_perl to maybe put back into a mysql database for later use. I could really use some help trying to figure this out. -- Brandon

2 2

Freeradius with Active Directory
by Prashant A 16 Jun '14

16 Jun '14

Hi All, I have followed the guide for integrating freeradius with active directory which is mentioned here, http://deployingradius.com/documents/configuration/active_directory.html So finally, radtest -t mschap prashant Active@123 localhost 0 testing123 Gives me following output Sending Access-Request Id 40 from 0.0.0.0:54825 to 127.0.0.1:1812 User-Name = 'prashant' NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x42b125cb7f6408b4 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000c82b9abb20333db96efcb1f93beb602b39ebbd007a8c0392 Received Access-Accept Id 40 from 127.0.0.1:1812 to 127.0.0.1:54825 length 84 MS-CHAP-MPPE-Keys = 0x MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed But when I try to login from webpage I am getting following response (0) mschap : Client is using MS-CHAPv2 (0) mschap : Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-mycompany.local} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} (0) mschap : EXPAND --username=%{mschap:User-Name:-None} (0) mschap : --> --username=prashant (0)*ERROR: mschap : No NT-Domain was found in the User-Name* (0) mschap : EXPAND --domain=%{%{mschap:NT-Domain}:-mycompany.local} (0) mschap : --> --domain=mycompany.local (0) mschap : Creating challenge hash with username: prashant (0) mschap : EXPAND --challenge=%{mschap:Challenge:-00} (0) mschap : --> --challenge=e5d49180d36eb904 (0) mschap : EXPAND --nt-response=%{mschap:NT-Response:-00} *(0) mschap : --> --nt-response=0000000e0000000000000000000000000000000000000000** **(0) ERROR: mschap : Program returned code (1) and output 'Logon failure (0xc000006d)'* (0) mschap : External script failed. (0) ERROR: mschap : External script says: Logon failure (0xc000006d) (0) ERROR: mschap : MS-CHAP2-Response is incorrect (0) [mschap] = reject (0) } # Auth-Type MS-CHAP = reject Can somebody help me to understand what exactly the issue. I am using FreeRADIUS Version 3.0.3 and Samba version 3.6.3. Thanks & Regards, Prashant

3 6

Re: Issues with building Freeradius on CentOS 6.5: need rlm_cache
by Brandon Jozsa 16 Jun '14

16 Jun '14

Ok, so now that I have this working...rlm_cache is loading just fine, but I think I may be making an error (based on what I want to achieve anyway). I've taken information from the article http://wiki.freeradius.org/modules/Rlm_cache#Two-call-caching, and i see the cache working, but is it in the wrong place? My hope was that if the user doesn't exist in sql (which "tester" doesn't) then forward. When you get a response, cache these attributes (user account, authZ privileges, etc) back into the sql database. I don't see any updates to the radcheck table, but I'm not 100% sure if that's where it should go. Sorry for being slow here...can anyone help, or do I have this wrong? I'm probably missing something easy here or just getting the formatting wrong. output (i can give more if necessary): [sql] User tester not found +++[sql] = notfound ++} # if (notfound) = notfound ++update control { ++} # update control = noop [cache] expand: %{User-Name} -> tester [cache] expand: reply:Reply-Message -> reply:Reply-Message [cache] expand: Cache last updated at %t -> Cache last updated at Fri Jun 13 16:41:10 2014 [cache] expand: ssssssssssssssssssssssssssssssss -> ssssssssssssssssssssssssssssssss [cache] expand: %{randstr:ssssssssssssssssssssssssssssssss} -> gcEKJNqJQcCe4J4qSRlEciZ7DYDhJW7e rlm_cache: Adding entry for "tester", with TTL of 10 ++[cache] = updated +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Proxying request 0 to home server 192.168.1.35 port 1812 Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Going to the next request Waking up in 0.9 seconds. Waking up in 19.0 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 42674, id=113, length=76 Sending duplicate proxied request to home server 192.168.1.35 port 1812 - ID: 182 Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Waking up in 14.9 seconds. rad_recv: Access-Accept packet from host 192.168.1.35 port 1812, id=182, length=25 Proxy-State = 0x313133 The config under authorize section: ############ CUSTOM AUTHORIZE STATEMENTS ############ if (!notfound) { update control { Proxy-To-Realm := "DARTH_RSA" } } ############ CUSTOM CACHING REQUIREMENTS ############ update control { Cache-Status-Only = 'yes' } cache if (notfound) { sql } update control { Cache-Status-Only := 'no' } cache ############ CUSTOM AUTHORIZE STATEMENTS ############ On Thu, Jun 12, 2014 at 11:50 PM, Brandon Jozsa <bjozsa(a)gmail.com> wrote: > Hello, > > I've been trying to work through the issues and by searching high and low > for solutions before turning to this users list. I'm sorry if this is a > stupid question (I've seen worse though, so maybe I shouldn't feel bad). > > I have a very high need to use the rlm_cache module with Freeradius on > CentOS 6.5. I'm trying to first us the statement: > > ----- snipped ----- > > authorize { > if (!notfound) { > update control { > Proxy-To-Realm := "SOME_REALM" > } > } > ----- snipped ----- > > which works GREAT alone...but I also want to use the cache function like > so: > > ----- snipped ----- > update control { > Cache-Status-Only = 'yes' > } > cache > if (notfound) { > sql > } > update control { > Cache-Status-Only := 'no' > } > cache > > ----- snipped ----- > > which doesn't work (obviously) because rlm_cache isn't included with > 2.1.12, or so it seems anyway. > > My hope is (it is a hope anyway) that I can collect authN/authZ replies > from an upstream radius server and cache them locally; thus building a > mysql database of users access/privileges and let this run on an > environment before cutting completely over to our new Freeradius setup. > Again, I'm hoping it can work like this...getting rid of RSA and using > LinOTP or MOTP would be so nice; it would be more flexible and user > friendly, but I really need to collect authN and authZ in order to rebuild > our massive user-base. > > My issue...CentOS, which is our "approved platform" (I'm rolling my eyes > and giving air quotes), doesn't have a newer version of Freeradius other > than 2.1.12. I think the rlm_cache modules are only included in 3.0.0 and > higher, is that right? > > So, I started looking on how to build from source...and I found one; great > news I thought!! Enter: > http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources…. > I thought this would save the day, but there are broken links for 3.0.0 and > I am running into major issues; it just doesn't seem to work at all. I also > tried to build it out, take the rlm_cache.so lib over to my 2.1.12 > installation, but Freeradius barfed all over that little trick. > > What are my options here? I could really use some help. Any ideas? > > -- > Brandon > -- Brandon

3 16

freeradius installation question
by Bryan Totten 16 Jun '14

16 Jun '14

Installed freeradius on ubuntu 12.04. I was able to start in debug mode the first time however now i am getting error message stating: /var/run/freeradius/freeradius.pid not found... any help would be greatly appreciated! tottenavl

2 1

Winbind issues in Ubuntu 14.04
by Arran Cudbard-Bell 15 Jun '14

15 Jun '14

So no one else wastes a couple of hours of their lives wondering why ntlm_auth is failing due to what appear to be permissions issue. In the version of samba4 installed with Ubuntu 14.04 (4.1.6) the default location of the winbinddd_privileged directory appears to be /var/lib/samba. The upstart script however, still has it in /var/run/samba/ (it may have changed), and does a lovely job of masking the problem by creating the winbindd_privileged directory there on start: pre-start script test -x /usr/sbin/winbindd || exit 0 mkdir -p /var/run/samba/winbindd_privileged chgrp winbindd_priv /var/run/samba/winbindd_privileged chmod 0750 /var/run/samba/winbindd_privileged end script Special shout outs go to the samba project for writing a utility with the most useless debugging output ever: Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)' (57) mschap : External script failed (57) ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001) (57) ERROR: mschap : MS-CHAP2-Response is incorrect and whoever decided to disable the init.d script on upstart enabled systems by adding: case "$1" in start) if init_is_upstart; then exit 1 fi Lovely. Bug reported here for winbindd_privileged: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1330220 Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2

Client is using MSCHAPv2 for %s, we need NT-Password
by Matthew Berry 14 Jun '14

14 Jun '14

Is this message merely informative, or does it indicate a problem? I'm attempting to debug my issue with something else and this is the only line I see that sounds like a warning/error prior to the rejection happening. From what I see in rlm_mschap.c, I would have seen a different message if the code could not either find a valid NT-Password attribute[1] or could not create one from a Cleartext-Password attribute[2]. Based on the comment left above the message > The old "mschapv2" function has been moved to > here It leads me to believe this line is informative only. (i.e., we need this attribute to be present, and unless you've seen otherwise it is). -Matt [1] https://github.com/FreeRADIUS/freeradius-server/blob/ec8c055b4c8e9358a08d51… [2] https://github.com/FreeRADIUS/freeradius-server/blob/ec8c055b4c8e9358a08d51…

2 4

Issues with building Freeradius on CentOS 6.5: need rlm_cache
by Brandon Jozsa 14 Jun '14

14 Jun '14

Hello, I've been trying to work through the issues and by searching high and low for solutions before turning to this users list. I'm sorry if this is a stupid question (I've seen worse though, so maybe I shouldn't feel bad). I have a very high need to use the rlm_cache module with Freeradius on CentOS 6.5. I'm trying to first us the statement: ----- snipped ----- authorize { if (!notfound) { update control { Proxy-To-Realm := "SOME_REALM" } } ----- snipped ----- which works GREAT alone...but I also want to use the cache function like so: ----- snipped ----- update control { Cache-Status-Only = 'yes' } cache if (notfound) { sql } update control { Cache-Status-Only := 'no' } cache ----- snipped ----- which doesn't work (obviously) because rlm_cache isn't included with 2.1.12, or so it seems anyway. My hope is (it is a hope anyway) that I can collect authN/authZ replies from an upstream radius server and cache them locally; thus building a mysql database of users access/privileges and let this run on an environment before cutting completely over to our new Freeradius setup. Again, I'm hoping it can work like this...getting rid of RSA and using LinOTP or MOTP would be so nice; it would be more flexible and user friendly, but I really need to collect authN and authZ in order to rebuild our massive user-base. My issue...CentOS, which is our "approved platform" (I'm rolling my eyes and giving air quotes), doesn't have a newer version of Freeradius other than 2.1.12. I think the rlm_cache modules are only included in 3.0.0 and higher, is that right? So, I started looking on how to build from source...and I found one; great news I thought!! Enter: http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources…. I thought this would save the day, but there are broken links for 3.0.0 and I am running into major issues; it just doesn't seem to work at all. I also tried to build it out, take the rlm_cache.so lib over to my 2.1.12 installation, but Freeradius barfed all over that little trick. What are my options here? I could really use some help. Any ideas?

7 15

Subject: Radcheck gives Accept but still moves onto Radgroupcheck
by Mike Poole 13 Jun '14

13 Jun '14

file /var/log/freeradius/radacct/sql-relay: No such file or directory Brent - The reject isn't coming from group check, it fails out when it tries to write to the sql-relay file that doesn't exist. You should turn off sql-relay or configure it. If part of the sql process fails (as I've been painfully doing here with my MT the last two days) the whole process will result in an Access Reject. Notice the reject comes directly after the statement above. Also, any time a "user found in radcheck" is sent, the next query will be processed. Mike Message: 4 Date: Wed, 11 Jun 2014 17:04:30 -0600 From: "Brent Wilkinson" <brent(a)air2data.com> To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Subject: Radcheck gives Accept but still moves onto Radgroupcheck Message-ID: <000601cf85c9$8104cd50$830e67f0$@com> Content-Type: text/plain; charset="us-ascii" I am setting up a new Radius server or a mikrotik hotspot system. I am getting a wierd issue that I have not been able to solve or find hints to what to do to fix it. I have setup the system with mysql. I see the radcheck happen and show it retrieved a record. ( I have verified the sql statments do actually pull something). I am not sending any reply so nothing is found in that table. At this point from what I understand in reading how the sql module works at this point it should send back a Access-Accept. Unfortunatly it does not and continues to do group checks and I end up with a reject. Hoping someone can give me a idea of what I need to look at or what I can read up more on to track the issue I am having down. Here is the debug: rad_recv: Access-Request packet from host 76.8.212.170 port 36910, id=78, length=189 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C:4B:D6:A5:CD:BF" Called-Station-Id = "10631" NAS-Port-Id = "ether2" User-Name = "1" NAS-Port = 2152726611 Acct-Session-Id = "80500053" Framed-IP-Address = 10.69.103.254 Mikrotik-Host-IP = 10.69.103.254 CHAP-Challenge = 0x95b4afa9e0e37e62da70a83197931d11 CHAP-Password = 0x21b4c5ed3e3175b1b7672103936286b74e Service-Type = Login-User WISPr-Logoff-URL = "http://10.69.100.1/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.99.163 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "1" with CHAP password [chap] Using clear text password "1" for user 1 authentication. [chap] chap user 1 authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> 1 [sql_log] expand: %{%{User-Name}:-DEFAULT} -> 1 [sql_log] sql_set_user escaped user --> '1' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('1', 'Chap-Password', 'Access-Accept', '2014-06-11 18:42:31'); [sql_log] expand: /var/log/freeradius/radacct/sql-relay -> /var/log/freeradius/radacct/sql-relay [sql_log] Couldn't open file /var/log/freeradius/radacct/sql-relay: No such file or directory ++[sql_log] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> 1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 78 to 76.8.212.170 port 36910 Waking up in 4.9 seconds. Cleaning up request 0 ID 78 with timestamp +6 Ready to process requests. Thanks Brent

1 0