September 2015 - Freeradius-Users - lists.freeradius.org

Re: Postgresql groupreply problem
by georg＠wojti.de 04 Sep '15

04 Sep '15

Alan DeKok schrieb am 31.08.2015 14:30: > On Aug 31, 2015, at 4:15 AM, georg(a)wojti.de wrote: >> I want to change the user MAC-authentication with an HP-Switch from the >> users-file to postgresql. The first thing is, that I have a some lines which >> check whether it is a Call-Check or not. If not then the radius has to reject >> this. But I think it's ok if I put this into the users-file. I have written >> the Cleartext-Password in this file, too, because I get an chap error (chap: >> ERROR: &control:Cleartext-Password is required for authentication), when I put >> this into the database. > > The server doesn't care where it gets the Cleartext-Password from. It doesn't > matter if it's in a database, or in the "users" file > >> In the Moment my configurations looks like this: >> >> -------------- users file -------------- >> DEFAULT Service-Type != Call-Check, Auth-Type := Reject >> Fall-Through = Yes > > You should delete that "Fall-Through". It does nothing useful. > >> DEFAULT Cleartext-Password := "xxxXXXxxx" >> Fall-Through = Yes >> >> DEFAULT >> Egress-VLANID := 0x3200005C #<-- check in server.conf; reject if it's >> the same > > Why is this entry here? It ALWAYS matches ALL incoming requests. So... > you'll always reject all requests. > > That doesn't make any sense. I have removed the files section. So the server has to test sql. looks like this: -------------- server.conf -------------- ... authorize { suffix if (Realm != "NULL") { reject } chap sql.sw-hp-mac-v3 } I have read the Rlm_sql wiki many times but there is no resolution to my problem. I tried many differen constellations for Example: Test #1: If "The user IS NOT found in radcheck" freeradius should start the group processing. In the usergroup table ist the username (in my case the MAC of the client) and the group, in groupcheck tabe is an entry with the Cleartext-Password and in the groupreply table is an entry for Egress-VLANID. Test #2: If "The user IS found in radcheck, the check items DO match AND Fall-Through is set in the radreply table" the group processing starts, too. In this case i have the Cleartext-Password in the check table and in the reply table is an entry with Fall-Through=Yes. In the usergroup table ist the MAC and the group,too, and in the groupreply table is an enty for Egress-VLANID. There is nothing to check for the groups so this table is empty. Result for both: The Group-Problem still exists! 1. Freeradius checks the usergroups and -> "rlm_sql_postgresql: query affected rows = 1 , fields = 5". I tested the sql-command manually and I get the Group "abc" -> this is OK 2. Next, freeradius calls the command "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" but freeradius does not insert any group name into the sql-command. Why?! Looks like this "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '' ORDER BY id" And so no attributes from the group tables were checked. >> -------------- Database -------------- >> (Hope that the format is ok. The tables radreply and radgroupcheck are empty) >> >> +----------------------------------------------------------------------+ >> | radcheck | >> +----+-------------------+--------------------+----+-------------------+ >> | id | username | attribute | op | value | >> +----+-------------------+--------------------+----+-------------------+ >> | 0 | 00:11:22:33:44:55 | Calling-Station-Id | == | 00-11-22-33-44-55 | >> +----+-------------------+--------------------+----+-------------------+ > > Which does nothing other than check the Calling-Station-Id. It does NOT add a > Cleartext-Password. > >> +-----------------------------------------------+ >> | radusergroup | >> +----+-------------------+-----------+----------+ >> | id | username | groupname | priority | >> +----+-------------------+-----------+----------+ >> | 0 | 00:11:22:33:44:55 | abc | 0 | >> +----+-------------------+-----------+----------+ >> >> +--------------------------------------------------+ >> | radgroupreply | >> +----+-----------+---------------+----+------------+ >> | id | groupname | attribute | op | value | >> +----+-----------+---------------+----+------------+ >> | 0 | abc | Egress-VLANID | := | 0x320000E0 | >> +----+-----------+---------------+----+------------+ >> >> >> >> The main problem is that the freeradius does not insert the GroupName in the >> sql-commands and so there is no correct reply. > > Because the radgroupcheck is empty. > > If you want to know how the SQL module works, go to the wiki, and search for > "rlm_sql". It has an entire page devoted to explaining exactly how the module > works, including processing of radcheck / radreply, and radgroupcheck / > radgroupreply. > > i.e. this is documented. Read the documentation, and you will fi the problem. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Auth-Type LDAP and "WARNING: Unknown value specified for Auth-Type. Cannot perform requested action"
by José Ignacio Siles Rueda 03 Sep '15

03 Sep '15

Hi, I'm well aware about not setting Auth-Type and let freeradius choose properly auth method, but I need LDAP authentication, and IT staff of LDAP server is very hostile to give freeradius userPassword info. So, my only choice is binding user to LDAP, and pray for the best... AFAIK, if I can't get proper userPassword (stored in SHA1 in LDAP), I'll never reach PAP module, and my only way out is using LDAP binding in authorize and authenticate sections of inner-tunnel. I'm using 2.1.12 version, and my inner-tunnel is as follows: server inner-tunnel { authorize { suffix eap { ok = return } switch "%{Realm}" { case "alumno.upo.es" { LDAP_estudiantes } case "upo.es" { LDAP_docentes } } } authenticate { eap Auth-Type LDAP_estudiantes { LDAP_estudiantes } Auth-Type LDAP_docentes { LDAP_docentes } Auth-Type PAP { pap } } session { radutmp } post-auth { reply_log Post-Auth-Type REJECT { attr_filter.access_reject } update outer.reply { User-Name = "%{request:User-Name}" } } And modules/ldap is as follows: ldap LDAP_estudiantes { server = "ldap.XXX.XX" basedn = "o=XXX, c=XX" filter = (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@alumno.XX.XX)(mailAlternateAddress=%{Stripped-User-Name}@alumno.XX.XX))<mailto:mail=%25%7bStripped-User-Name%7d@alumno.XX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@alumno.XX.XX))> (IrisUserEntitlement=urn:mace:XXX.XX:XX.XX:entitlement:ServiciosRed:wifi:estudiantes) base_filter = "(objectclass=irisperson)" groupname_attribute = "IrisUserEntitlement" groupmembership_attribute = "IrisUserEntitlement" ldap_connections_number = 100 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile=/etc/raddb/certs/SCSChain.XX.XX } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } ldap LDAP_docentes { server = "ldap.XXX.XX" basedn = "o=XXX, c=XX" filter = (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@XX.XX)(mailAlternateAddress=%{Stripped-User-Name}@XX.XX))<mailto:mail=%25%7bStripped-User-Name%7d@XX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@XX.XX))> (IrisUserEntitlement=urn:mace:XXX.XX:XX.XX:entitlement:ServiciosRed:wifi:Docentes) base_filter = "(objectclass=irisperson)" groupname_attribute = "IrisUserEntitlement" groupmembership_attribute = "IrisUserEntitlement" ldap_connections_number = 100 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile=/etc/raddb/certs/SCSChain.XX.XX } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } And, if I try one user with "alumno.XX.XX" realm, I'm getting: [ttls] Got tunneled request User-Name = "uwifialumno(a)alumno.XX.XX<mailto:uwifialumno@alumno.XX.XX>" User-Password = "XXXX" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "uwifialumno(a)alumno.XX.XX<mailto:uwifialumno@alumno.XX.XX>" User-Password = "XXXXX" FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} [suffix] Looking up realm "alumno.XXX.XX" for User-Name = "uwifialumno(a)alumno.XXX.XX<mailto:uwifialumno@alumno.XXX.XX>" [suffix] Found realm "alumno.XXX.XX" [suffix] Adding Stripped-User-Name = "uwifialumno" [suffix] Adding Realm = "alumno.XXX.XX" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop expand: %{Realm} -> alumno.XXX.XX ++- entering switch %{Realm} {...} +++- entering case alumno.XXX.XX {...} [LDAP_estudiantes] performing user authorization for uwifialumno [LDAP_estudiantes] expand: (&(|(uid=%{User-Name})(mail=%{Stripped-User-Name}@alumno.XXX.XX)(mailAlternateAddress=%{Stripped-User-Name}@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:mail=%25%7bStripped-User-Name%7d@alumno.XXX.XX)(mailAlternateAddress=%25%7bStripped-User-Name%7d@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> -> (&(|(uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> [LDAP_estudiantes] expand: o=XXXXXX, c=XX -> o=XXXXX, c=XX [LDAP_estudiantes] ldap_get_conn: Checking Id: 0 [LDAP_estudiantes] ldap_get_conn: Got Id: 0 [LDAP_estudiantes] performing search in o=XXXXX, c=XX, with filter (&(|(uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))<mailto:uid=uwifialumno@alumno.XXX.XX)(mail=uwifialumno@alumno.XXX.XX)(mailAlternateAddress=uwifialumno@alumno.XXXX.XX))(IrisUserEntitlement=urn:mace:XXX.XX:XXX.XX:entitlement:ServiciosRed:wifi:estudiantes))> [LDAP_estudiantes] looking for check items in directory... [LDAP_estudiantes] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [LDAP_estudiantes] Setting Auth-Type = LDAP_estudiantes [LDAP_estudiantes] user uwifialumno authorized to use remote access [LDAP_estudiantes] ldap_release_conn: Release Id: 0 ++++[LDAP_estudiantes] returns ok +++- case alumno.upo.es returns ok ++- switch %{Realm} returns ok Found Auth-Type = LDAP_estudiantes WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. Login incorrect: [uwifialumno] (from client RedAPs-oviwan port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Why am I getting "Unknown value specified for Auth-Type", if I define: Auth-Type LDAP_estudiantes { LDAP_estudiantes } In my inner-tunnel config file? Thanks in advance, Ignacio Siles Jefe de Proyecto- Infraestructuras / Sol. y Prod. Wireless Dirección de Servicios y Soluciones I.T. Teléfono: +34 672.283.836 Skype jisiles.ingenia C/Severo Ochoa, 43 Parque Tecnológico de Andalucía 29590. Málaga Tel: +34 952029300 | Fax: +34 952029309 www.ingenia.es<http://www.ingenia.es>

2 5

poptop dns query
by Edwardo Garcia 02 Sep '15

02 Sep '15

Howdy, The poptop mailing list seem defunct? So I ask here, since also relevant. Trying to get DNS assignments from radius, I have verified that freeradius is sending it along with all other goodies verify by running with -X, so satisfy not a freeradius server problem. I have the required follow guide from wiki and many google site, the dictionary.microsoft and .merit in radiusclient from freeradius-client 1.1.7 too, and pptpd v1.4 and ppp 2.4.7, if I use in pppd it assigns OK, but for our new network project we need radius to assign, which it sends but the poptop client ignore, so not sure how to get ppptd/pppd to accept this value and send it to connections, has anyone got this setup and got this work? Willy

2 3

stale session
by Sergio Diaz 02 Sep '15

02 Sep '15

Hello Guys, I am simulating the problem on what if the AP goes down (due to various reasons). I observed that user is not properly disconnected and result is stale session. When the AP is up and when the previous user tries to log in he/she gets login failed message because "Simultaneous-Use" is in effect while previous session is still ticking. How can prevent and fix this? Saludos Cordiales, Sergio Diaz Infraestructura TI 01(55) 5265.0145 (044) 55.28.99.95.71 sdiazf(a)logitel.com.mx www.logitel.com.mx

3 10

authorize file not being reread on HUP
by Jay Rouman 02 Sep '15

02 Sep '15

I am sure I am doing something wrong. We have all our user data in "authorize" and a HUP doesn't reread the file in 3.0.9. That version added the feature of ignoring a HUP unless a file had changed. It seems to recognize that a file has changed but it doesn't actually reload. After a HUP in 3.0.8: server inner-tunnel { # from file /usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel Ready to process requests 3.0.9: Listening on proxy address * port 53399 Ready to process requests Ready to process requests Received HUP signal HUP - No files changed. Ignoring <-- "authorize" changed here Ready to process requests Ready to process requests Received HUP signal HUP - Files loaded by a module have changed. Ready to process requests <-- no indication of an actual reload At this point radiusd doesn't answer queries with the new information in "authorize." -- Jay Rouman (jsr(a)dexter.mi.org jsr(a)edzone.net) Gratiot/Isabella RESD, Ithaca, Michigan

2 1

3rd-party certificates in FR3
by Иван Стрельников 02 Sep '15

02 Sep '15

Hello everyone! I'm using freeradius 3.0.9. And i want to realize next scheme: cisco wlc wi-fi -> freeradius -> mysql db. It's all ok with db, i just want to clear out the messages to end user about radius certificate. So, i want use a certificate, which root ca will be in apple\android's certificate stores. Maybe geotrust, maybe other. I didn't find how it should to install and i need help here. Thank you. tl;dr I need a cookbook how to setup chained certificate from other trusted root CA. -- BW, Ivan.

3 3

Basic problem about radius client secret
by Timmy 02 Sep '15

02 Sep '15

Dear all Users, I want to understand more about this. When we talk about freeradius client, it will include a string of characters called secret. Is this sting an encryption key string or a password for the connection? What should be the appropriate length of this sting? Thanks for your response. Yours Faithfully, Timmy

2 1

Accounting mysql
by nicolas.clo＠ricoh-industrie.fr 02 Sep '15

02 Sep '15

Hi List, I have a problem to log accounting informations to mysql, rlm_sql_mysql: ERROR 1582 (Incorrect parameter count in the call to native function 'FROM_UNIXTIME'): 42000 It seems to be that Freeradius can't retrieve "integer:Event-Timestamp" value. FreeRADIUS Version 3.0.10 (git #f7065a7), for host i486-pc-linux-gnu, built on Sep 1 2015 at 15:39:31 on Debian 7.8 Mysql 5.5.35 Wed Sep 2 08:38:21 2015 : Debug: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME (%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') Wed Sep 2 08:38:21 2015 : Debug: Parsed xlat tree: Wed Sep 2 08:38:21 2015 : Debug: literal --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES (' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Acct-Session-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Acct-Unique-Session-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> SQL-User-Name Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Realm Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-IP-Address Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: if { Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-Port-Id Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: else { Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-Port Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-Port-Type Wed Sep 2 08:38:21 2015 : Debug: literal --> ', FROM_UNIXTIME( Wed Sep 2 08:38:21 2015 : Debug: xlat --> integer Wed Sep 2 08:38:21 2015 : Debug: { Wed Sep 2 08:38:21 2015 : Debug: literal --> Event-Timestamp Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: literal --> ), FROM_UNIXTIME( Wed Sep 2 08:38:21 2015 : Debug: xlat --> integer Wed Sep 2 08:38:21 2015 : Debug: { Wed Sep 2 08:38:21 2015 : Debug: literal --> Event-Timestamp Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: literal --> ), NULL, '0', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Acct-Authentic Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Connect-Info Wed Sep 2 08:38:21 2015 : Debug: literal --> ', '', '0', '0', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Called-Station-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Calling-Station-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', '', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Service-Type Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Framed-Protocol Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Framed-IP-Address Wed Sep 2 08:38:21 2015 : Debug: literal --> ') Wed Sep 2 08:38:21 2015 : Debug: (10) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME (%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') Wed Sep 2 08:38:21 2015 : Debug: (10) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('00000028', '', 'Administrateur', '', '172.29.x.x', '284', 'Wireless-802.11', FROM_UNIXTIME(), FROM_UNIXTIME(), NULL, '0', 'RADIUS', '', '', '0', '0', '00xxxxxxxx', 'xxxxxxxxxxx', '', 'Framed-User', '', '') Wed Sep 2 08:38:21 2015 : Debug: (10) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('00000028', '', 'Administrateur', '', '172.29.x.x', '284', 'Wireless-802.11', FROM_UNIXTIME(), FROM_UNIXTIME(), NULL, '0', 'RADIUS', '', '', '0', '0', 'xxxxxxxxxxxxx', 'xxxxxxxxxxxxxx', '', 'Framed-User', '', '') Wed Sep 2 08:38:21 2015 : Debug: rlm_sql_mysql: No additional diagnostic info on server Wed Sep 2 08:38:21 2015 : ERROR: (10) sql: rlm_sql_mysql: ERROR 1582 (Incorrect parameter count in the call to native function 'FROM_UNIXTIME'): 42000 Wed Sep 2 08:38:21 2015 : Debug: (10) sql: SQL query returned: server error Wed Sep 2 08:38:21 2015 : Debug: rlm_sql (sql): Released connection (6) Wed Sep 2 08:38:21 2015 : Debug: (10) modsingle[accounting]: returned from sql (rlm_sql) for request 10 Wed Sep 2 08:38:21 2015 : Debug: (10) [sql] = fail Wed Sep 2 08:38:21 2015 : Debug: (10) } # accounting = fail Wed Sep 2 08:38:21 2015 : Debug: (10) Not sending reply to client. Wed Sep 2 08:38:21 2015 : Debug: (10) Finished request Any ideas ? Thanks. Nicolas.

3 3

Fwd: PAM Radius COA
by Emma Benny 01 Sep '15

01 Sep '15

Hi, I'm new to Radius so I apologize if this is a stupid question. I could not find it answered in the archive after searching quite a bit. Does the pam_radius client support RFC 5176 ? Does it have support to get pushed DM or CoA messages from a freeRadius server and disconnect or force re-authentication of the user ? Thanks in advance, Emma

2 2

Re: Rest API for authentication
by Murat BEŞER 01 Sep '15

01 Sep '15

You could write proxy which provides a restfull api. Murat BEŞER Black-Solutionshttp://www.black-solutions.com ------ Original message------From: Herwin WeststrateDate: Tue, Sep 1, 2015 13:26To: FreeRadius users mailing list;Subject:Re: Rest API for authentication On 31-08-15 09:15, Randeep wrote:> Hi Alan,> > We have two types of IPTV boxes. One has pppoe support and other one> doesn't have pppoe support.> > We are using FreeRadius 3.0.8 for authentication.> > I remember you mentioning that authentication can be done via a rest api> also. So we can use this api for authentication for the device which> doesn't have the pppoe support.I think you've got a few things mixed up here. The rest module is just amodule that can run in different sections by calling an externalprocess/server via a RESTful API to do something. The added demo.pl addsa Cleartext-Password := testing123 to the control map, this could beused in the authorize section of a server, where for example the papmodule could compare the passwords in authenticate section. A bitcomparable to a lookup in a database to find the plaintext password.I've really got no idea how this would be related to iptv boxes thatdon't use pppoe. To me this sounds a bit like you heard about a conceptand now try to retrofit that concept to some completely unrelated problem.-- Herwin Weststrate-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0