October 2015 - Freeradius-Users - lists.freeradius.org

rlm_digest failing after upgrade from 2.1.12 to 2.2.5
by Daniel Pocock 29 Oct '15

29 Oct '15

Hi, We just updated a Debian server from wheezy to jessie The freeradius server package updated from 2.1.12+dfsg-1.2 to 2.2.5+dfsg-0.2 This particular server is used for SIP users (for debian.org itself) The users are in a text file and it is loaded like this in radiusd.conf: modules { $INCLUDE modules/attr_filter $INCLUDE modules/digest passwd rtc_users { filename = /var/local/rtc-passwords.freerad format = "*User-Name:Digest-HA1:" hashsize = 1000 ignorenislike = no allowmultiplekeys = no } } Since the upgrade, the server is complaining: Auth: [digest] Cleartext-Password or Digest-HA1 is required for authentication. When the server is started or given HUP, it doesn't give any hints that anything is wrong: Wed Oct 21 07:51:05 2015 : Info: Received HUP signal. Wed Oct 21 07:51:05 2015 : Info: HUP - Re-reading configuration files Wed Oct 21 07:51:05 2015 : Info: HUP - loading modules Wed Oct 21 07:51:05 2015 : Info: Module: Reloaded module "attr_filter.access_reject" Wed Oct 21 07:51:05 2015 : Info: Module: Reloaded module "rtc_users" Wed Oct 21 07:51:05 2015 : Info: Loaded virtual server <default> Wed Oct 21 07:51:05 2015 : Info: Loaded virtual server rtc.debian.org I looked at the changelog, it only mentions passwd in one place and digest is not mentioned anywhere: FreeRADIUS 2.2.0 Mon 10 Sep 2012 12:00:00 CEST, urgency=medium Feature improvements * 100% configuration file compatible with 2.1.x. The only fix needed is to disallow "hashsize=0" for rlm_passwd The freeradius-client library is being used, it is the same version before and after the upgrade, 1.1.6. Can anybody give any feedback on this or suggest the best way to troubleshoot the issue? Regards, Daniel

3 8

Setting up a Proxy Server as a load balancer to bypass winbind/samba bottleneck
by Walter Reynolds 29 Oct '15

29 Oct '15

We are running to the same problems with winbind/samba bottlenecks as many other universities. While one of our servers does quite well we are starting to get hung modules at peak hitting as many as 150 authentications per second while averaging over 70/sec for several minutes. Since wireless controllers are getting bigger and with Cisco we are limited to sending radius auth request to one server at a time we need another way to balance things out. I thought setting up a freeradius proxy that pointed to two separate servers might be a way to go about this. Problem is I thought I read somewhere in the freeradius lists that that would create other problems, but now I can not find that. I also am not sure I followed this right, but in looking at proxy home_server_pool it looks like my options for load balancing will still send all auth request from my one large controller to a single server as the source IP will all be the same under client-balance. Thanks. ------------------------ Walter Reynolds Principal Systems Security Development Engineer Information and Technology Services University of Michigan (734) 615-9438

7 6

Return codes in policies
by Jonathan Gazeley 29 Oct '15

29 Oct '15

Hi folks, I am porting my FreeRADIUS config from 2.x to 3.x and I've run into an issue I don't understand. I have this policy "wism-checks" which allows the server to respond to probes sent by the WLAN controllers. It is invoked in the authorize section of my virtual servers. wism-checks { if (Service-Type == "NAS-Prompt-User") { if (NAS-IP-Address =~ /^172\.17\.107\./) { if (User-Name =~ /^wism\-probe/) { update control { Auth-Type := Accept } updated } else { reject } } updated = return } } This works quite happily on FR2 but chokes on FR3 with the following: /etc/raddb/policy.d/policies[178] Invalid return code assigment inside of a if section /etc/raddb/policy.d/policies[166]: Failed to parse "if" subsection. Line 178 is the "updated = return" line. I've read the Fail-over docs[1] but that seems to deal with overriding return codes from modules rather than setting them explicitly in a policy. What's the best way to tweak this? Thanks, Jonathan [1] http://wiki.freeradius.org/config/Fail-over

3 4

3.0.10 fails to start (OpenSuse 13.2)
by Thomas Stather 29 Oct '15

29 Oct '15

Hello I installed freeradius-server 3.0.10 from the OpenSuse "network" repo (OpenSuse OBS) -------------------------------------- radius1:~ # zypper info freeradius-server Loading repository data... Reading installed packages... Information for package freeradius-server: ------------------------------------------ Repository: Networking services and related tools (openSUSE_Tumbleweed) Name: freeradius-server Version: 3.0.10-91.3 Arch: x86_64 Vendor: obs://build.opensuse.org/network Installed: Yes Status: up-to-date Installed Size: 3.0 MiB Summary: Very Highly Configurable Radius Server Description: The FreeRADIUS server has a number of features found in other servers and additional features not found in any other server. -------------------------------------- but when i try to start it, i get: -------------------------------------- radius1:~ # radiusd -X libssl version mismatch. built: 1000204f linked: 100010bf -------------------------------------- How can i fix this? I assume this is because of a mismatched OpenSSL version. The info of the installed package is: -------------------------------------- radius1:~ # zypper info openssl Loading repository data... Reading installed packages... Information for package openssl: -------------------------------- Repository: openSUSE-13.2-Update Name: openssl Version: 1.0.1k-2.24.1 Arch: x86_64 Vendor: openSUSE Installed: Yes Status: up-to-date Installed Size: 1.4 MiB Summary: Secure Sockets and Transport Layer Security Description: The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and open source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL toolkit and its related documentation. Derivation and License OpenSSL is based on the excellent SSLeay library developed by Eric A. Young and Tim J. Hudson. The OpenSSL toolkit is licensed under an Apache-style license, which basically means that you are free to get it and to use it for commercial and noncommercial purposes. -------------------------------------- Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

8 28

Define coa_server for clients in nas table
by Bryan Mesich 28 Oct '15

28 Oct '15

Hello, I have a functioning FreeRadius 3.0.10 installation that currently uses the rlm_sql module for accounting and authorization. The setup is composed of 2 FreeRadius servers with a MariaDB/Galara cluster. I'm interested in using the nas table in the database rather than clients.conf when configuring my clients. Each NAS "client" has a corresponding home_server defined in sites-enabled/originate-coa, which the client gets tied to with the coa_server parameter in clients.conf: [clients.conf] client hk-wlc1 { ipaddr = 10.129.3.13 secret = secret nas_type = cisco coa_server = hk-wlc1-coa } [originate-coa] home_server hk-wlc1-coa { type = coa ipaddr = 10.129.3.13 port = 1700 secret = secret coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } The provided radius schema does not include a coa_server field in the nas table. One would think that would be needed in order for clients that are defined in the db to use the appropriate CoA server. Looking at the source code, I located the function generate_sql_clients(), which appears to parse the records returned from the query defined for the particular DB platform (mods-config/sql/main/mysql/queries.conf in this case). It doesn't appear to be possible to define a coa_server for a client that is defined in the nas table. Is it possible for FreeRadius to identify the appropriate CoA home_server based on the IP address that originated the request (thus not requiring the coa_server parameter)? Bryan

3 2

Re: Welcome to the "Freeradius-Users" mailing list
by Orion Timbale 28 Oct '15

28 Oct '15

Thanks to all freeradius users!!!! I'm using freeradius v3.0.4 under Fedora 22. I try to proxy some Access-Request and add some check item/attribute before proxying. The radiusd -X output regarding this problem looks like this: "Wed Oct 21 18:31:19 2015 : Debug: (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default Wed Oct 21 18:31:19 2015 : Debug: (0) pre-proxy { Wed Oct 21 18:31:19 2015 : Debug: (0) node.pre-proxy node.pre-proxy { Wed Oct 21 18:31:19 2015 : Debug: (0) if ("%{request:Packet-Type}" == 'Access-Request') Wed Oct 21 18:31:19 2015 : Debug: (0) EXPAND %{request:Packet-Type} Wed Oct 21 18:31:19 2015 : Debug: (0) --> Access-Request Wed Oct 21 18:31:19 2015 : Debug: (0) if ("%{request:Packet-Type}" == 'Access-Request') -> TRUE Wed Oct 21 18:31:19 2015 : Debug: (0) if ("%{request:Packet-Type}" == 'Access-Request') { Wed Oct 21 18:31:19 2015 : Debug: (0) update proxy-request { Wed Oct 21 18:31:19 2015 : Debug: (0) &NodeID == '0000000002' Wed Oct 21 18:31:19 2015 : Debug: (0) No existing attribute to filter, adding instead Wed Oct 21 18:31:19 2015 : Debug: (0) } # update proxy-request = noop Wed Oct 21 18:31:19 2015 : Debug: (0) } # if ("%{request:Packet-Type}" == 'Access-Request') = noop Wed Oct 21 18:31:19 2015 : Debug: (0) } # byon-node.pre-proxy byon-node.pre-proxy = noop Wed Oct 21 18:31:19 2015 : Debug: (0) } # pre-proxy = noop Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Trying to allocate ID (0/2) Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Failed allocating ID: Failed finding socket, caller must allocate a new one Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Trying to open a new listener to the home server Wed Oct 21 18:31:19 2015 : Debug: Opening new proxy socket 'proxy address * port 0' Wed Oct 21 18:31:19 2015 : Debug: Listening on proxy address * port 45141 Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Trying to allocate ID (1/2) Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: request is now in proxy hash Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: allocating destination 192.168.42.193 port 1812 - Id 16 Wed Oct 21 18:31:19 2015 : Debug: (0) Proxying request to home server 192.168.42.193 port 1812 timeout 14.000000 Wed Oct 21 18:31:19 2015 : Debug: (0) Sending Access-Request packet to host 192.168.42.193 port 1812, id=16, length=0 Wed Oct 21 18:31:19 2015 : Debug: (0) User-Name = 'fname.lname(a)my-network.com' Wed Oct 21 18:31:19 2015 : Debug: (0) User-Password = 'passme' Wed Oct 21 18:31:19 2015 : Debug: (0) NAS-IP-Address = 127.0.0.1 Wed Oct 21 18:31:19 2015 : Debug: (0) NAS-Port = 100 Wed Oct 21 18:31:19 2015 : Debug: (0) Message-Authenticator = 0x29fc545638a7a1c6ec10b5f7e2c860c9 Wed Oct 21 18:31:19 2015 : Debug: (0) Event-Timestamp = 'Oct 21 2015 18:31:19 CEST' Wed Oct 21 18:31:19 2015 : Debug: (0) Realm = 'DEFAULT' Wed Oct 21 18:31:19 2015 : Debug: (0) Proxy-State = 0x3337 Wed Oct 21 18:31:19 2015 : Debug: (0) NodeID == '0000000002' Sending Access-Request Id 16 from 0.0.0.0:45141 to 192.168.42.193:1812 User-Name = 'fname.lname(a)my-network.com' User-Password = 'passme' NAS-IP-Address = 127.0.0.1 NAS-Port = 100 Message-Authenticator = 0x29fc545638a7a1c6ec10b5f7e2c860c9 Event-Timestamp = 'Oct 21 2015 18:31:19 CEST' Proxy-State = 0x3337" As you can see Realm and NodeID are not passed to the radius proxy in the access request. Can anyone suggest me something ? Sincerely yours. Tim

2 3

problem compiling eapol_test under OpenSuse 13.2
by Thomas Stather 28 Oct '15

28 Oct '15

Hello I wanted to compile the eapol_test binary to test my eap setup (Eduroam service, EAP-PEAP/MSCHAPv2 and EAP-TTLS/MSCHAPv2). The manual is here: http://deployingradius.com/scripts/eapol_test/ I downloaded the 2.5 source, additionally the OpenSuse Pattern "devel_basis" and the package "libopenss-devel" However when i do a "make eapol_test" i get: ... CC ../src/utils/ip_addr.c /usr/lib64/gcc/x86_64-suse-linux/4.8/../../../../x86_64-suse-linux/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status Makefile:1677: recipe for target 'eapol_test' failed make: *** [eapol_test] Error 1 Does sombody have a clue? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

2 2

RV: FreeRadius 3.0.6 failed
by Oscar Jofre 27 Oct '15

27 Oct '15

Hi, I have configuring a new FreeRadius 3.0.6 on Centos7 and MariaDB. Is has been working ok (had to increase max connextion and other values) but now I'm getting the radius down every time. MariaDB has radacct with over 10.000.000 rows. I'm connecting 10.000 PPTP users authentication with this Radius, Interim every 30seconds and client-pptp-session 10minutes, but after start mariadb and freeradius exits with this message: [root@rad ~]# systemctl status radiusd radiusd.service - FreeRADIUS high performance RADIUS server. Loaded: loaded (/usr/lib/systemd/system/radiusd.service; disabled) Active: failed (Result: signal) since mar 2015-10-27 22:41:14 CET; 17min ago Process: 12086 ExecStart=/usr/sbin/radiusd -d /etc/raddb (code=exited, status=0/SUCCESS) Process: 12083 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=0/SUCCESS) Process: 12080 ExecStartPre=/bin/chown -R radiusd.radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Main PID: 12090 (code=killed, signal=ABRT) CGroup: /system.slice/radiusd.service oct 27 22:36:16 rad.aaa.com systemd[1]: Starting FreeRADIUS high performance RADIUS server.... oct 27 22:36:17 rad.aaa.com systemd[1]: Started FreeRADIUS high performance RADIUS server.. oct 27 22:41:14 rad.aaa.com systemd[1]: radiusd.service: main process exited, code=killed, status=6/ABRT oct 27 22:41:14 rad.aaa.com systemd[1]: Unit radiusd.service entered failed state. Last Lines from radius.log Tue Oct 27 23:14:20 2015 : ERROR: (73758) ERROR: <queue> : Received conflicting packet from client 0.0.0.0/0 port 53359 - ID: 220 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73736) ERROR: detail : Received conflicting packet from client 0.0.0.0/0 port 48163 - ID: 146 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73737) ERROR: detail : Received conflicting packet from client 0.0.0.0/0 port 59445 - ID: 144 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : Warning: No such configuration item .type..query Tue Oct 27 23:14:20 2015 : Warning: No such configuration item .type..query Tue Oct 27 23:14:20 2015 : ERROR: (73751) ERROR: <queue> : Received conflicting packet from client 0.0.0.0/0 port 33445 - ID: 148 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73757) ERROR: <queue> : Received conflicting packet from client 0.0.0.0/0 port 53686 - ID: 147 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : Warning: No such configuration item .type..query Tue Oct 27 23:14:20 2015 : ERROR: (73752) ERROR: detail : Received conflicting packet from client 0.0.0.0/0 port 43723 - ID: 144 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73753) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 44422 - ID: 145 due to unfinished request. Giving up on old request. Also I have all this warnings/errors on log. What is really important to fix and how ??? 1) START RADIUS Tue Oct 27 22:36:17 2015 : Warning: No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 0.0.0.0/0. Please fix your configuration Tue Oct 27 22:36:17 2015 : Warning: Support for old-style clients will be removed in a future release Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Attempting to connect to database "radius" Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server <default> Tue Oct 27 22:36:17 2015 : Warning: Ignoring "ldap" (see raddb/mods-available/README.rst) Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server default Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server inner-tunnel Tue Oct 27 22:36:17 2015 : Warning: No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 0.0.0.0/0. Please fix your configuration Tue Oct 27 22:36:17 2015 : Warning: Support for old-style clients will be removed in a future release Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Attempting to connect to database "radius" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (0) Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server <default> Tue Oct 27 22:36:17 2015 : Warning: Ignoring "ldap" (see raddb/mods-available/README.rst) Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server default Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server inner-tunnel Tue Oct 27 22:36:17 2015 : Info: Ready to process requests 2) Tue Oct 27 22:36:17 2015 : Warning: rlm_sql (sql): 1 of 1 connections in use. You probably need to increase "spare" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (1) Tue Oct 27 22:36:17 2015 : Warning: rlm_sql (sql): 2 of 2 connections in use. You probably need to increase "spare" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (2) Tue Oct 27 22:36:17 2015 : Warning: rlm_sql (sql): 3 of 3 connections in use. You probably need to increase "spare" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (3) Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): 3 of 4 connections in use. Need more spares Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (4) Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): 2 of 4 connections in use. Need more spares 3) Tue Oct 27 22:36:51 2015 : ERROR: (4217) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 39418 - ID: 59 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4220) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 50628 - ID: 62 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4221) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 55753 - ID: 63 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4224) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 41959 - ID: 66 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4229) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 57022 - ID: 71 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4260) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 45267 - ID: 104 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4287) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 47887 - ID: 120 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4292) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 40463 - ID: 128 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4294) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 44484 - ID: 129 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4303) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 47015 - ID: 137 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4304) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 48617 - ID: 138 due to unfinished request. Giving up on old request. 4) Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query 5) Tue Oct 27 22:37:04 2015 : Error: (7162) Ignoring duplicate packet from client 0.0.0.0/0 port 47432 - ID: 116 due to unfinished request in component <core> module <queue> 6) Tue Oct 27 22:37:09 2015 : Error: rlm_sql (sql): Duplicate entry '30a1ada7fbf7328ec740200d6042f02b' for key 'acctuniqueid' Tue Oct 27 22:37:09 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:37:09 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '30a1ada7fbf7328ec740200d6042f02b' for key 'acctuniqueid'' Tue Oct 27 22:40:14 2015 : Error: rlm_sql (sql): Duplicate entry '51208897d76ba70d93d0a5d4486b3622' for key 'acctuniqueid' Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '51208897d76ba70d93d0a5d4486b3622' for key 'acctuniqueid'' Tue Oct 27 22:40:14 2015 : Error: rlm_sql (sql): Duplicate entry 'a2ccf69a14f3eb13105c3a5df8dcb81f' for key 'acctuniqueid' Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'a2ccf69a14f3eb13105c3a5df8dcb81f' for key 'acctuniqueid'' Tue Oct 27 22:40:14 2015 : Error: rlm_sql (sql): Duplicate entry 'b92b5f282a678d6edfec278fc07a057a' for key 'acctuniqueid' Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'b92b5f282a678d6edfec278fc07a057a' for key 'acctuniqueid'' Tue Oct 27 22:40:16 2015 : Error: rlm_sql (sql): Duplicate entry '4b8983776731b1f5da36b35a1a53d9fa' for key 'acctuniqueid' Tue Oct 27 22:40:16 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:16 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '4b8983776731b1f5da36b35a1a53d9fa' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '61cb092a85b6a15acf5d79cfb60855d6' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '61cb092a85b6a15acf5d79cfb60855d6' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '39df97f43a022814b698ebfa18065f02' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '39df97f43a022814b698ebfa18065f02' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '370a69125a04214aae019cecdccac86d' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '370a69125a04214aae019cecdccac86d' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '78108b526c3d18d0fbb5c330fae5b770' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '78108b526c3d18d0fbb5c330fae5b770' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '337e085c9a8d7cde42499a130cb2d6fb' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result 7) Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11202, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11201, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11199, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11206, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11205, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11212, in component <core> module Thanks.

2 1

update control
by Alan Buxey 27 Oct '15

27 Oct '15

Hi Is there a fixed list of attribute pairs that can be used when doing update control (eg Proxy-To-Realm) or can any attribute defined locally in a dictionary be used? alan

2 1

[sqlippool]IP address could not be allocated as no pool exists with that name
by Rod Elias 27 Oct '15

27 Oct '15

Hello list! Could someone please help me with a problem regarding freeradius sqlippool module? I'm migrating to FreeRADIUS Version 2.1.10 with MySQL 5.1.73-1 running on a Debian GNU/Linux 6 The content of my radcheck table is something like: mysql> select * from radcheck where UserName = 'lucasmenezes'; +-------+-------------------------+--------------------+----------------+----+ | id | UserName | Attribute | Value | op | +-------+-------------------------+--------------------+----------------+----+ | 15643 | lucasmenezes | Cleartext-Password | 12110 | := | | 22342 | lucasmenezes | Pool-Name | PONTALNORTE_02 | := | +-------+-------------------------+--------------------+----------------+----+ 2 rows in set (0.00 sec) When the mentioned user tries to authenticate, I get the error message "IP address could not be allocated as no pool exists with that name". The user receives Login OK, but radius releases IP 0.0.0.0 to her/him. Here is an **example** of my radippool table: mysql> select * from radcheck where UserName = 'lucasmenezes'; +-------+----------------+-----------------+--------------+-----------------+-------------------+---------------------+-------------------------+-------------------+ | id | pool_name | FramedIPAddress | NASIPAddress | CalledStationId | CallingStationID | expiry_time | username | pool_key | +-------+----------------+-----------------+--------------+-----------------+-------------------+---------------------+-------------------------+-------------------+ | 64171 | PONTALNORTE_02 | 187.44.69.244 | 187.44.64.58 | | 00:0C:43:B4:1B:81 | 2015-10-27 16:00:10 | lucasmenezes | 00:0C:43:B4:1B:81 | +-------+----------------+-----------------+--------------+-----------------+-------------------+---------------------+-------------------------+-------------------+ 1 row in set (0.00 sec) For some reason, I noticed the %{control:Pool-Name} section in the SQL query isn't being resolved and, because that, SQL query doesn't return any results. Please let me post bellow the output of freeradius -X regarding that situation: Login OK: [lucasmenezes] (from client MK_Pontal port 15728946 cli 00:0C:43:B4:1B:81) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} rlm_sql (sql): Reserving sql socket id: 110 [sqlippool] expand: %{User-Name} -> lucasmenezes [sqlippool] sql_set_user escaped user --> 'lucasmenezes' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '187.44.64.58' [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = '' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'lucasmenezes'), (callingstationid <> '00:0C:43:B4:1B:81'), expiry_time LIMIT 1 FOR UPDATE [sqlippool] SQL query did not return any results [sqlippool] expand: COMMIT -> COMMIT [sqlippool] expand: SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1 -> SELECT id FROM radippool WHERE pool_name='' LIMIT 1 [sqlippool] SQL query did not return any results rlm_sql (sql): Released sql socket id: 110 [sqlippool] IP address could not be allocated as no pool exists with that name. ++[sqlippool] returns noop ++[exec] returns noop Any help please? What am I missing? Thanks a lot in advanced. Best regards, []'s --

3 3