December 2016 - Freeradius-Users - lists.freeradius.org

rlm_perl returning attributes
by Ryan De Kock 30 Mar '17

30 Mar '17

Hi. I'm trying to return an attribute using the rlm_rest module. Authentication works fine but when a response is sent, an Access-Reject is generated. I'm hoping someone can point me in the right direction. *Working auth *(with no attributes in the response) (8) Cleaning up request packet ID 178 with timestamp +606 Ready to process requests (9) Received Access-Request Id 17 from 127.0.0.1:45433 to 127.0.0.1:1812 length 77 (9) User-Name = "585c208457bf8c3820c9e431(a)test.com" (9) User-Password = "password" (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) authorize { rlm_rest (rest): Reserved connection (16) (9) rest: Expanding URI components (9) rest: EXPAND http://127.0.0.1:1337 (9) rest: --> http://127.0.0.1:1337 (9) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (9) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (9) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (9) rest: Processing response header (9) rest: Status : 201 (Created) (9) rest: Type : json (application/json) rlm_rest (rest): Released connection (16) rlm_rest (rest): Need 1 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (17), 1 of 30 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" (9) [rest] = ok (9) if (ok || updated) { (9) if (ok || updated) -> TRUE (9) if (ok || updated) { (9) update control { (9) Auth-Type := Rest (9) } # update control = noop (9) } # if (ok || updated) = noop (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = ok (9) } # policy filter_username = ok (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: Looking up realm "test.com" for User-Name = " 585c208457bf8c3820c9e431(a)test.com" (9) suffix: No such realm "test.com" (9) [suffix] = noop (9) eap: No EAP-Message, not doing EAP (9) [eap] = noop (9) [files] = noop (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (9) pap: WARNING: Authentication will fail unless a "known good" password is available (9) [pap] = noop (9) } # authorize = ok (9) Found Auth-Type = Rest (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) Auth-Type Rest { rlm_rest (rest): Reserved connection (15) (9) rest: Expanding URI components (9) rest: EXPAND http://127.0.0.1:1337 (9) rest: --> http://127.0.0.1:1337 (9) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (9) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (9) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (9) rest: Processing response header (9) rest: Status : 201 (Created) (9) rest: Type : json (application/json) rlm_rest (rest): Released connection (15) (9) [rest] = ok (9) } # Auth-Type Rest = ok (9) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # post-auth = noop (9) Sent Access-Accept Id 17 from 127.0.0.1:1812 to 127.0.0.1:45433 length 0 (9) Finished request Waking up in 4.9 seconds. *exactly the same auth*, except I try return some values (8) Received Access-Request Id 178 from 127.0.0.1:41930 to 127.0.0.1:1812 length 77 (8) User-Name = "585c208457bf8c3820c9e431(a)test.com" (8) User-Password = "password" (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) authorize { rlm_rest (rest): Closing connection (13): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (14): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (12): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): 0 of 0 connections in use. You may need to increase "spare" rlm_rest (rest): Opening additional connection (15), 1 of 32 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" rlm_rest (rest): Reserved connection (15) (8) rest: Expanding URI components (8) rest: EXPAND http://127.0.0.1:1337 (8) rest: --> http://127.0.0.1:1337 (8) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (8) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (8) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (8) rest: Processing response header (8) rest: Status : 201 (Created) (8) rest: Type : json (application/json) (8) rest: Parsing attribute "Mikrotik-Address-List" (8) rest: EXPAND myList (8) rest: --> myList (8) rest: Mikrotik-Address-List := "myList" rlm_rest (rest): Released connection (15) rlm_rest (rest): Need 2 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (16), 1 of 31 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" (8) [rest] = updated (8) if (ok || updated) { (8) if (ok || updated) -> TRUE (8) if (ok || updated) { (8) update control { (8) Auth-Type := Rest (8) } # update control = noop (8) } # if (ok || updated) = noop (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = updated (8) } # policy filter_username = updated (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "test.com" for User-Name = " 585c208457bf8c3820c9e431(a)test.com" (8) suffix: No such realm "test.com" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = Rest (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Auth-Type Rest { rlm_rest (rest): Reserved connection (15) (8) rest: Expanding URI components (8) rest: EXPAND http://127.0.0.1:1337 (8) rest: --> http://127.0.0.1:1337 (8) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (8) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (8) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (8) rest: Processing response header (8) rest: Status : 201 (Created) (8) rest: Type : json (application/json) (8) rest: Parsing attribute "Mikrotik-Address-List" (8) rest: EXPAND myList (8) rest: --> myList (8) rest: Mikrotik-Address-List := "myList" rlm_rest (rest): Released connection (15) (8) [rest] = updated (8) } # Auth-Type Rest = updated (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> 585c208457bf8c3820c9e431(a)test.com (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.7 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 178 from 127.0.0.1:1812 to 127.0.0.1:41930 length 20 Waking up in 3.9 seconds. It seems that because rest updated the user that it now fails for some reason (8) [rest] = updated (8) } # Auth-Type Rest = updated (8) Failed to authenticate the user What do I need to change to allow this process to go through? I would appreciate any light shedding.

2 3

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Update on 3.0, 3.1, and 3.2.
by Alan DeKok 16 Feb '17

16 Feb '17

We plan on releasing 3.0.12 on Monday. it's stable, and there no new issues being reported for it. This will ideally be the last release of the 3.0 series. Version 3.0 was released almost three years ago, and it's time for a new major version of the server. 3.1 supports a "map" keyword, redis cluster, and many other useful features. Many people have been using the 3.1 branch in production, so we're confident that it is stable and functional. To keep things simple, we don't release an official 3.1 version. Instead, we will call 3.1 a "development / experimental" branch. Once we're ready (later this summer), we'll release an official 3.2 release. The v3.1.x branch will then be frozen, and no further development will occur on it. All new development will then start with a 3.3 branch, which will likely turn into version 4.0. There are enough architecture changes needed that it warrants a 4.0. In summary: 2.1 and earlier: dead. Don't use them. 2.2: Only critical security fixes. We expect this won't happen. 3.0: stable. New installations can use 3.0. 3.1: development. Use it only if you know what you're doing. 3.2: (future stable). Mid 2016 on, new installations should use this. 3.3. (future development), more changes, with a goal of increasing performance substantially.

4 6

configuration for retrieving LDAP security group membership
by Adam Thompson 18 Jan '17

18 Jan '17

I need to configure FreeRADIUS Version 2.2.6 to retrieve LDAP security group membership, and am hoping someone here can help. In this case I have a web application that queries FreeRADIUS. FreeRADIUS then goes to the LDAP server and authenticates the user. User authentication works, but I've tried a couple of things to get the LDAP server to return security group membership with no luck. I have added and included a dictionary file with a definition of my vendor-defined attribute as follows: VENDOR Uplogix 10243 BEGIN-VENDOR Uplogix ATTRIBUTE Uplogix-User-Groups 3 string After reading through available documentation, I tried to return the groups with the following in the /erc/raddb/users file, but it doesn't work: DEFAULT Uplogix-User-Groups = Ldap-Group Should I instead be requesting the LDAP group in the post-auth section of the LDAP module? If so can I get an example of how the syntax should work for that? Thanks in advance, Adam Thompson

4 11

rlm_eap module
by Peter Balsianok 02 Jan '17

02 Jan '17

Hi, How can i prevent to compile rlm-eap module ? Thx.

2 3

HUNTGROUP WITH SQL
by Jose Quezada 31 Dec '16

31 Dec '16

Hi Everyone, I'd like your help. I'm working to link certain user to a NAS I made the radhuntgroup table (groupname, nasipaddress...) and the internal AVP sql-hubtgroup-name but I need the Unlang Code that work... Thank in advance

1 0

WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
by Narender Yadav 30 Dec '16

30 Dec '16

Hello Everyone, I am new to FreeRADIUS world and got stuck at one point. My setup: - FreeRADIUS server o Users mentioned in ‘/usr/local/etc/raddb/mods-config/files/authorize’ § test Cleartext-Password := "welcome" o clients mentioned in ‘/usr/local/etc/raddb/clients.conf’ § client x.x.x.x{ § secret=test § } § Where, x.x.x.x is the IP address of RADIUS client machine - RADIUS client o RADIUS server is defined in ‘/etc/raddb/server’ § y.y.y.y test 2 § where, y.y.y.y is the IP address of RADIUS server *we have one application server where RADIUS client is already built and its working fine with newly configured RADIUS server. The issue is with RADIUS client that I have setup.* when trying to login to RADIUS client machine using user ‘test’, I am getting below error in debug logs: I have checked again and shared secret is same on NAS and RADIUS server. -------------------------------------------------------------------------------------------------------------------------------------- (1) Received Access-Request Id 33 from x.x.x.x:44896 to 10.222.34.65:1812 length 90 (1) User-Name = "test" (1) User-Password = "\010\n\r\177INCORRECT" (1) NAS-IP-Address = 10.222.34.227 (1) NAS-Identifier = "sshd" (1) NAS-Port = 3874 (1) NAS-Port-Type = Virtual (1) Service-Type = Authenticate-Only (1) Calling-Station-Id = "115.113.149.70" (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: users: Matched entry test at line 1 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Auth-Type PAP { (1) pap: Login attempt with password (1) pap: Comparing with "known good" Cleartext-Password (1) pap: ERROR: Cleartext password "? ?INCORRECT" does not match "known good" password (1) pap: Passwords don't match (1) [pap] = reject (1) } # Auth-Type PAP = reject (1) Failed to authenticate the user (1) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> test (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 33 from 10.222.34.65:1812 to x.x.x.x:44896 length 20 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 33 with timestamp +132 Ready to process requests *Regards,* *Narender Yadav*

3 3

EAP-AKA , EAP-SIM configuartion
by Avichal Agarwal 30 Dec '16

30 Dec '16

hi I want to configure EAP-AKA and EAP-SIM configuration on my Ubuntu-16 machine, MY free radius server version is 2.2.8 $ sudo freeradius -v freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. I am following the link [1]http://freeradius.1045715.n5.nabble.com/radiusd-startup-failure-for- EAP-AKA-configuration-td5717980.html But I am getting error: main{ user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary Errors reading dictionary: dict_init: /etc/freeradius/dictionary[34]: d ict_addattr: Duplicate attribute name EAP-Type-AKA [cid:XOK0LK7CT9SZ@namo.co.kr] [update?userid=avichal.a&do=bWFpbElEPTIwMTYxMjI5MTQzODE1ZXBjbXM1cDdkMDU 2ZTBkNDk4Y2M2ZTA0NjE2ZWY2MzNmMjIxYzg2ZSZyZWNpcGllbnRBZGRyZXNzPWZyZWVyYW RpdXMtdXNlcnNAbGlzdHMuZnJlZXJhZGl1cy5vcmc_] References 1. http://freeradius.1045715.n5.nabble.com/radiusd-startup-failure-for-EAP-AKA…

2 1

Unknown or invalid value "Crypt-Local" for attribute Auth-Type"
by Christoph Schwabl 30 Dec '16

30 Dec '16

Hello, I am currently trying to upgrade from freeradius 1.x (which is running for about 10 years) to freeradius 3.0.12. The freeradius is used for shell access to Cisco routers. I am using MySQL and the tables looks like: mysql> select * from radgroupreply; +----+-----------+--------------+----+-------------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------------+ | 3 | lanmgmt | Cisco-AVPair | = | shell:priv-lvl=15 | | 4 | lanmgmt | Service-Type | = | NAS-Prompt-User | | 5 | readonly | Cisco-AVPair | = | shell:priv-lvl=2 | | 6 | readonly | Service-Type | = | NAS-Prompt-User | +----+-----------+--------------+----+-------------------+ mysql> select * from radcheck; +----+------------------+----------------+----+------------------------ ----------+ | id | username | attribute | op | value | +----+------------------+----------------+----+------------------------ ----------+ | 2 | testusersql | Crypt-Password | := | cc03e747a6afbbcbf8be7668acfebee5 | | 3 | testuserdisabled | Crypt-Password | := | cc03e747a6afbbcbf8be7668acfebee5 | +----+------------------+----------------+----+------------------------ ----------+ mysql> select * from radgroupcheck; +----+-----------+-----------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+-----------+----+-------------+ | 24 | lanmgmt | Auth-Type | := | Crypt-Local | | 25 | disabled | Auth-Type | := | Reject | +----+-----------+-----------+----+-------------+ mysql> select * from radusergroup; +------------------+-----------+----------+ | username | groupname | priority | +------------------+-----------+----------+ | testusersql | lanmgmt | 1 | | testuserdisabled | disabled | 1 | +------------------+-----------+----------+ In the debug it is possible to see the reason. Rejects because of: "(0) sql: ERROR: Error parsing value: Unknown or invalid value "Crypt-Local" for attribute Auth-Type" The corespondig debug (freeradius -X) part: ... (0) sql: SQL-User-Name set to 'testusersql' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testusersql' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testusersql' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Crypt-Password := "cc03e747a6afbbcbf8be7668acfebee5" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testusersql' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testusersql' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'testusersql' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'testusersql' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'lanmgmt' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'lanmgmt' ORDER BY id (0) sql: ERROR: Error parsing value: Unknown or invalid value "Crypt-Local" for attribute Auth-Type (0) sql: ERROR: Error parsing user data from database result (0) sql: ERROR: Error retrieving check pairs for group lanmgmt rlm_sql (sql): Released connection (1) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.53-0+deb8u1, protocol version 10 (0) [sql] = fail (0) } # authorize = fail (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> testusersql (0) sql: SQL-User-Name set to 'testusersql' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testusersql', 'test123', 'Access-Reject', '2016-12-30 09:43:02') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testusersql', 'test123', 'Access-Reject', '2016-12-30 09:43:02') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) ... I know there is something wrong with the Auth-Type, but I am not aware how to solve it, even it is working under v1.x fine and also check already the documentation (e.g. http://wiki.freeradius.org/config/Auth%20Type) Is there some file where I need to specify Crypt-Local as Auth-Type? Thx br Christoph

2 1