March 2016 - Freeradius-Users - lists.freeradius.org

rlm_redis_ippool_tool
by O'Connell, Ryan 10 Mar '16

10 Mar '16

Looking for an example/guidance of using the rim_redis_ippool_tool to add a subnet to a fresh installation (Redis running localhost)? I have the (3.1.0) server up and connected to Redis and can submit a simulated request but there are no IP’s to assign. I have tried following the help (-h) and man pages for the tool without success. Debug output below. Thanks, Ryan --- [root@dhcp02 ~]# rlm_redis_ippool_tool -x -f bootstrap.conf 127.0.0.1:6379 Nothing to do! [root@dhcp02 ~]# cat bootstrap.conf ippool local { range-start = 192.0.2.0 range-stop = 192.0.2.255 session-db = /etc/raddb/ip-pool.db ip-index = /etc/raddb/ip-index.db } [root@dhcp02 ~]# rlm_redis_ippool_tool -xS 127.0.0.1:6379 rlm_redis_ippool_tool [1] - Opening additional connection (0), 1 of 10 pending slots used ------ FreeRADIUS Version 3.1.0 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog /etc/raddb/mods-enabled/linelog[114]: Reference "${..pool}" not found /etc/raddb/mods-enabled/linelog[127]: Reference "${..pool}" not found including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/redis including configuration file /etc/raddb/mods-enabled/redis_ippool including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/vendor including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/dhcp main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 continuation_timeout = 15 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 2 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dynamic = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 queue_priority = "default" auto_limit_acct = no } WARNING: Ignoring "max_spare_servers = 10", forcing to "max_spare_servers = 3" # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest # Creating Auth-Type = eap listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 recv_buff = 0 } listen { type = "dhcp" ipaddr = 127.0.0.1 port = 6700 recv_buff = 0 No "interface" setting is defined. Only unicast DHCP will work src_ipaddr = 127.0.0.1 } radiusd: #### Loading modules #### modules { # Loaded module "rlm_always" # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module "rlm_attr_filter" # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" relaxed = no } # Loaded module "rlm_cache" # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module "rlm_chap" # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module "rlm_detail" # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module "rlm_dhcp" # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module "rlm_digest" # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module "rlm_dynamic_clients" # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module "rlm_eap" # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" ignore_unknown_eap_types = no cisco_accounting_username_bug = no } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" require_client_cert = yes } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls - Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls - Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module "rlm_exec" # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module "rlm_expiration" # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module "rlm_expr" # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module "rlm_files" # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module "rlm_linelog" # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { destination = "file" delimiter = " " file { filename = "/var/log/radius/linelog" permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { port = 514 timeout = 2.000000 } udp { port = 514 timeout = 2.000000 } } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { destination = "file" delimiter = " " file { filename = "/var/log/radius/linelog-accounting" permissions = 384 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000.000000 } udp { timeout = 1000.000000 } } # Loaded module "rlm_logintime" # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module "rlm_mschap" # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module "rlm_pap" # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module "rlm_passwd" # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module "rlm_preprocess" # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module "rlm_radutmp" # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module "rlm_realm" # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module "rlm_replicate" # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module "rlm_soh" # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module "rlm_unix" # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module "rlm_unpack" # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module "rlm_utf8" # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module "rlm_redis" # Loading module "redis" from file /etc/raddb/mods-enabled/redis redis { server = "127.0.0.1" port = 6379 database = 0 max_nodes = 20 max_alt = 3 max_redirects = 2 } libfreeradius-redis: libhiredis version: 0.12.1 # Loaded module "rlm_redis_ippool" # Loading module "redis_ippool" from file /etc/raddb/mods-enabled/redis_ippool redis_ippool { copy_on_update = yes redis { server = "localhost" port = 6379 database = 0 max_nodes = 20 max_alt = 3 max_redirects = 2 } } instantiate { } } # modules # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache_eap - Driver rlm_cache_rbtree loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log) - 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading file /etc/raddb/mods-config/files/authorize reading file /etc/raddb/mods-config/files/accounting reading file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap: using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading file /etc/raddb/mods-config/preprocess/huntgroups reading file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "redis" from file /etc/raddb/mods-enabled/redis rlm_redis (redis) [1] - Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } rlm_redis (redis) [1] - Opening additional connection (0), 1 of 32 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Opening additional connection (1), 1 of 31 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Opening additional connection (2), 1 of 30 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Opening additional connection (3), 1 of 29 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Opening additional connection (4), 1 of 28 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Reserved connection (0) rlm_redis (redis): Bootstrap server "127.0.0.1" returned: rlm_redis (redis) [1] - Released connection (0) rlm_redis (redis) [1] - Need 5 more connections to reach 10 spares rlm_redis (redis) [1] - Opening additional connection (5), 1 of 27 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 # Instantiating module "redis_ippool" from file /etc/raddb/mods-enabled/redis_ippool rlm_redis (redis) [1] - Initialising connection pool pool { start = 0 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 held_trigger_min = 0.000000 held_trigger_max = 0.500000 retry_delay = 30 spread = no } rlm_redis (redis) [1] - 0 of 0 connections in use. You may need to increase "spare" rlm_redis (redis) [1] - Opening additional connection (0), 1 of 32 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Reserved connection (0) rlm_redis (redis): Bootstrap server "localhost" returned: rlm_redis (redis) [1] - Released connection (0) rlm_redis (redis) [1] - Need 2 more connections to reach 10 spares rlm_redis (redis) [1] - Opening additional connection (1), 1 of 31 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 rlm_redis (redis) [1] - Reserved connection (0) rlm_redis (redis) [1] - Released connection (0) radiusd: #### Loading Virtual Servers #### server default { # from file /etc/raddb/sites-enabled/default Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel } # server inner-tunnel server dhcp { # from file /etc/raddb/sites-enabled/dhcp # Loading dhcp DHCP-Discover {...} # Loading dhcp DHCP-Request {...} # Loading dhcp DHCP-Decline {...} # Loading dhcp DHCP-Inform {...} # Loading dhcp DHCP-Release {...} # Loading dhcp DHCP-Lease-Query {...} } # server dhcp radiusd: #### Opening IP addresses and Ports #### Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on dhcp address 127.0.0.1 port 6700 bound to server dhcp Listening on proxy address * port 43002 Ready to process requests (0) Received DHCP-Discover Id 3b426982 from 127.0.0.1:6701 to 127.0.0.1:6700 via lo length 300 (0) &request:DHCP-Opcode = Client-Message (0) &request:DHCP-Hardware-Type = Ethernet (0) &request:DHCP-Hardware-Address-Length = 6 (0) &request:DHCP-Hop-Count = 0 (0) &request:DHCP-Transaction-Id = 994208130 (0) &request:DHCP-Number-of-Seconds = 0 (0) &request:DHCP-Flags = 0 (0) &request:DHCP-Client-IP-Address = 0.0.0.0 (0) &request:DHCP-Your-IP-Address = 0.0.0.0 (0) &request:DHCP-Server-IP-Address = 0.0.0.0 (0) &request:DHCP-Gateway-IP-Address = 0.0.0.0 (0) &request:DHCP-Client-Hardware-Address = 00:a0:bc:00:00:00 (0) &request:DHCP-Message-Type = DHCP-Discover (0) Trying sub-section dhcp DHCP-Discover {...} (0) dhcp DHCP-Discover { (0) update reply { (0) &reply:DHCP-Message-Type = DHCP-Offer (0) } # update reply (noop) (0) update reply { (0) &reply:DHCP-Domain-Name-Server = 127.0.0.1 (0) &reply:DHCP-Domain-Name-Server = 127.0.0.2 (0) &reply:DHCP-Subnet-Mask = 255.255.255.0 (0) &reply:DHCP-Router-Address = 192.0.2.1 (0) &reply:DHCP-IP-Address-Lease-Time = 86400 (0) &reply:DHCP-DHCP-Server-Identifier = 192.0.2.1 (0) } # update reply (noop) (0) update control { (0) &control:Pool-Name := local (0) } # update control (noop) (0) redis_ippool - Allocating lease from pool "local", to "00:a0:bc:00:00:00", expires in 30s (0) redis_ippool - Reserved connection (1) (0) redis_ippool - [1] >>> Sending command(s) to 127.0.0.1:6379 (0) redis_ippool - [1] <<< Returned: success (0) redis_ippool - Released connection (1) (0) redis_ippool - Need 1 more connections to reach 10 spares (0) redis_ippool - Opening additional connection (2), 1 of 30 pending slots used rlm_redis (redis) [1]: Connecting node to 127.0.0.1:6379 (0) redis_ippool - WARNING: Pool contains no free addresses (0) redis_ippool (notfound) (0) ok (ok) (0) } # dhcp DHCP-Discover (ok) (0) ERROR: Can't assign address to client: Neither &reply:DHCP-Client-IP-Address nor &reply:DHCP-Your-IP-Address set (0) ERROR: State callback returned error (-1): Server error: NOSCRIPT No matching script. Please use EVAL. (0) Not sending reply to client. (0) Finished request (0) Cleaning up request packet ID 994208130 with timestamp +17 Ready to process requests

3 7

Can't work out HP/Huawei reply attributes
by Joel Bergmark 10 Mar '16

10 Mar '16

Hello all, I've got quite stuck regarding reply-attributes to get privileged when logging on to a HP/Comware firmware switch (HP, Huawei, 3com etc). I run Daloradius as frontend. Basically what I want is to have something similar to the "Cisco AVPair shell:priv-lvl=15". So the radius server is working and I can login to the HP in question, I have googled this for hours and tried much but to no resolution, examples is like: http://certifiedgeek.weebly.com/blog/ssh-radius-authentication-with-hp-comw… Also tried a number of variants including Cisco AVPair, most of time tried variants of this: NAS-Prompt-User Huawei-Exec-Privilege = "3" rlm_sql: Failed to create the pair: Unknown attribute "NAS-Prompt-User" requires a hex string, not "Huawei-Exec-Privilege = "3"" 3Com-User-Access-Level HP-Privelege-Level = 3 rlm_sql: Failed to create the pair: Unknown value HP-Privelege-Level = 3 for attribute 3Com-User-Access-Level 3Com-User-Access-Level HP-Privelege-Level = 3 rlm_sql: Failed to create the pair: Unknown value 3Com-User-Access-Level = 3 for attribute 3Com-User-Access-Level Basically debug gives me same issue, "failed to create the pair: Unknown value <reply attribute> for <attribute> like this: (...) [sql] expand: %{User-Name} -> hua [sql] sql_set_user escaped user --> 'hua' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'hua' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'hua' ORDER BY id rlm_sql: Failed to create the pair: Unknown value Huawei-Exec-Privilege = "3" for attribute Huawei-Exec-Privilege rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 0 ++[sql] returns fail Invalid user: [user/password] (from client dr1.xyz port 0 cli 00-00-00-00-00-00) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> hua attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 39 to X8.X3.3X.65 port 2888 This leads me to believe that there is something with the dictionary not working correct, I have tried to figure out the dictionary stuff but not sure on how to troubleshoot it. And I also have started a thread at the HP-forums to see if anyone not running windows have got it to work. Thanks for any assistance, and if solved I will as before update the wiki :-) Kind regards, Joel

3 4

Possible to have 2 authentications in sequence?
by Andy P. 10 Mar '16

10 Mar '16

Hello, Can someone tell if it is possible to have FreeRADIUS perform (as a proxy) 2 authentications in sequence on a user, such as the 1st - against an AD and if that succeeds - against another RADIUS server? Is it simply a matter of the the Authorization/Authentication sections definition, or requires some development? Thank you! BR

3 7

FR3.0.11 with ldap + 802.1x + dynamic Vlan assignment.
by Vlad Kratsberg 09 Mar '16

09 Mar '16

Hi Freeradius Users, We are using FR3.0.11 and are trying to set up 802.1x authentication. We are using eap-gtc inside peap. Here is what was configured: 1. mods-available/ldap + symlink to mods-enabled/ldap 2. mods-enabled/eap a. EAP section: changed default_eap_type to peap b. PEAP section: changed default_eap_type to gtc 3. mods-config/files/authorize Added the following: DEFAULT Ldap-Group == "juniper-admins" Service-Type = "Login-User", Idle-Timeout = 600, Juniper-Local-User-Name = "admin", Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 505, Filter-Id = "USERS-FILTER" Here is the full debug: http://pastebin.com/Lugmz3yc The result: Ldap works, user gets authenticated, and Access-Accept message is received however Vlan attributes and Filter-id are not present in Access-Accept. Freeradius-2.1.12 version returns attributes just fine. P.S: The reason why i m not using available RPM FR_3.0.4 is because when I perform change number 2.a. (eap section) as described above, freeradius doesn't recognize it and displays default config: ================================================ # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 ================================================= I would appreciate any help or point in the right direction. Thanks Vlad

2 4

3.1.x systemd startup
by Jonathan Gazeley 09 Mar '16

09 Mar '16

I've just built 3.1.x from git head this morning (commit 307c8a9) and while it works properly when executed as radiusd -X, it will not startup when started via systemctl on CentOS 7. [jg4461@radius-el7 ~]$ sudo service radiusd start Redirecting to /bin/systemctl start radiusd.service Job for radiusd.service failed because the control process exited with error code. See "systemctl status radiusd.service" and "journalctl -xe" for details. [jg4461@radius-el7 ~]$ sudo journalctl -xe Mar 09 11:55:58 radius-el7 systemd[1]: Starting FreeRADIUS multi-protocol policy server... -- Subject: Unit radiusd.service has begun start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit radiusd.service has begun starting up. Mar 09 11:55:58 radius-el7 radiusd[1195]: Usage: radiusd [options] Mar 09 11:55:58 radius-el7 radiusd[1195]: Options: Mar 09 11:55:58 radius-el7 radiusd[1195]: -C Check configuration and exit. Mar 09 11:55:58 radius-el7 radiusd[1195]: -d <raddb> Set configuration directory (defaults to /etc/raddb). Mar 09 11:55:58 radius-el7 systemd[1]: radiusd.service: control process exited, code=exited status=1 Mar 09 11:55:58 radius-el7 radiusd[1195]: -D <dictdir> Set main dictionary directory (defaults to /usr/share/freeradius). Mar 09 11:55:58 radius-el7 radiusd[1195]: -f Run as a foreground process, not a daemon. Mar 09 11:55:58 radius-el7 radiusd[1195]: -h Print this help message. Mar 09 11:55:58 radius-el7 radiusd[1195]: -l <log_file> Logging output will be written to this file. Mar 09 11:55:58 radius-el7 radiusd[1195]: -m On SIGINT or SIGQUIT clean up all used memory instead of just exiting. Mar 09 11:55:58 radius-el7 radiusd[1195]: -n <name> Read raddb/name.conf instead of raddb/radiusd.conf. Mar 09 11:55:58 radius-el7 radiusd[1195]: -P Always write out PID, even with -f. Mar 09 11:55:58 radius-el7 radiusd[1195]: -s Do not spawn child processes to handle requests (same as -ft). Mar 09 11:55:58 radius-el7 radiusd[1195]: -t Disable threads. Mar 09 11:55:58 radius-el7 radiusd[1195]: -v Print server version information. Mar 09 11:55:58 radius-el7 radiusd[1195]: -X Turn on full debugging (similar to -tfxxl stdout). Mar 09 11:55:58 radius-el7 radiusd[1195]: -x Turn on additional debugging (-xx gives more debugging). Mar 09 11:55:58 radius-el7 systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. -- Subject: Unit radiusd.service has failed The radiusd.service unit specifies to start with -m, but when I run this by hand... [jg4461@radius-el7 ~]$ sudo radiusd -m Usage: radiusd [options] Options: -C Check configuration and exit. -d <raddb> Set configuration directory (defaults to /etc/raddb). -D <dictdir> Set main dictionary directory (defaults to /usr/share/freeradius). -f Run as a foreground process, not a daemon. -h Print this help message. -l <log_file> Logging output will be written to this file. -m On SIGINT or SIGQUIT clean up all used memory instead of just exiting. -n <name> Read raddb/name.conf instead of raddb/radiusd.conf. -P Always write out PID, even with -f. -s Do not spawn child processes to handle requests (same as -ft). -t Disable threads. -v Print server version information. -X Turn on full debugging (similar to -tfxxl stdout). -x Turn on additional debugging (-xx gives more debugging). Has the -m option been changed or taken away? It still appears in the usage message and the systemd unit. I guess either -m needs to be fixed, or removed from the docs etc. Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

2 2

mschap direct-to-Winbind different behaviour
by Jonathan Gazeley 09 Mar '16

09 Mar '16

Hi folks, I've been investigating switching my mschap authentications from ntlm_auth to use direct Winbind connections with libwbclient. It works fine for user authentications against AD but does not work for machine authentications against the same. The direct Winbind method returns an error from AD. Can anyone explain this? FreeRADIUS 3.1.x built from git Samba 4.2.3 from CentOS 7 Here's my mschap config: mschap eduroammschap { # Either: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} --challenge=%{eduroammschap:Challenge} --nt-response=%{eduroammschap:NT-Response} " # Or: winbind_username = "%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}}" winbind_domain = "%{eduroammschap:NT-Domain}" pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } allow_retry = no retry_msg = "Verify username and re-enter your password" } Debug using ntlm_auth: (7) Auth-Type eduroamlioneap { (7) eduroamlioneap - Peer sent packet with EAP method MSCHAPv2 (26) (7) eduroamlioneap - Calling submodule eap_mschapv2 to process data (7) eap_mschapv2 - Running Auth-Type MS-CHAP from file /etc/raddb/sites-enabled/eduroamlion-inner (7) eap_mschapv2 - Auth-Type MS-CHAP { (7) eduroammschap - Creating challenge hash with username: MONITOR899307$ (7) eduroammschap - Client is using MS-CHAPv2 (7) eduroammschap - Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} --challenge=%{eduroammschap:Challenge} --nt-response=%{eduroammschap:NT-Response} : (7) eduroammschap - EXPAND --username=%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} (7) eduroammschap - --> --username=MONITOR899307$ (7) eduroammschap - EXPAND --challenge=%{eduroammschap:Challenge} (7) eduroammschap - Creating challenge hash with username: MONITOR899307$ (7) eduroammschap - --> --challenge=d6341cfb2d2e480e (7) eduroammschap - EXPAND --nt-response=%{eduroammschap:NT-Response} (7) eduroammschap - --> --nt-response=843e30991be16db3f688bff168572cb202bf0582b0713189 (7) eduroammschap - Program returned code (0) and output 'NT_KEY: 4B6BB21FE18F7D003EFD4D39CFC5939A' (7) eduroammschap - Adding MS-CHAPv2 MPPE keys (7) eduroammschap (ok) Debug using direct Winbind: (27) Auth-Type eduroamlioneap { (27) eduroamlioneap - Peer sent packet with EAP method MSCHAPv2 (26) (27) eduroamlioneap - Calling submodule eap_mschapv2 to process data (27) eap_mschapv2 - Running Auth-Type MS-CHAP from file /etc/raddb/sites-enabled/eduroamlion-inner (27) eap_mschapv2 - Auth-Type MS-CHAP { (27) eduroammschap - Creating challenge hash with username: MONITOR899307$ (27) eduroammschap - Client is using MS-CHAPv2 (27) eduroammschap - EXPAND %{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} (27) eduroammschap - --> MONITOR899307$ (27) eduroammschap - EXPAND %{eduroammschap:NT-Domain} (27) eduroammschap - --> UOB (27) eduroammschap - Reserved connection (1) (27) eduroammschap - sending authentication request user='MONITOR899307$' domain='UOB' (27) eduroammschap - Released connection (1) (27) eduroammschap - ERROR: No logon workstation trust account [0xC0000199] (27) eduroammschap - ERROR: Password has expired. User should retry authentication (27) eduroammschap (reject) Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

4 11

Proxy realms and home_server_pool fallback not working
by Peter Lambrechtsen 08 Mar '16

08 Mar '16

Hi I'm looking to add more robustness into my proxy architecture and noticed in the home_server_pool there is the option for "fallback = virtualrealm" so if all home servers fail then a last resort home_server is used with some config locally to always accept / reject customers based on the realm they are coming from. I'm not using the status_check as some of the downstream clients don't support status-server, but I will look into that to see if it makes a difference. However for this situation I would expect if you are using or not using Status server checks shouldn't have any impact on how the fallback server works. In the proxy.conf I have configured: home_server ProxyDest { type = auth+acct ipaddr = 192.168.1.113 port = 1812 secret = password response_window = 1 require_message_authenticator = no zombie_period = 5 revive_interval = 10 status_check = none #status_check = status-server # username = "test_user_please_reject_me" # password = "this is really secret" check_interval = 10 num_answers_to_alive = 3 max_outstanding = 65536 } home_server cacheuser { virtual_server = cacheuser } # Main server pool # home_server_pool ProxyDestPool { type = fail-over home_server = ProxyDest # home_server = cacheuser fallback = cacheuser } Then in my virtual server I have configured: server cacheuser { authorize { accept } So when the Destination server is up life is good. (0) Proxying request to home server 192.168.1.113 port 1812 timeout 1.000000 (0) Sent Access-Request Id 26 from 0.0.0.0:58512 to 192.168.1.113:1812 length 337 ... Waking up in 0.3 seconds. (0) Marking home server 192.168.1.113 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Accept Id 26 from 192.168.1.113:1812 to 192.168.1.116:58512 length 55 But if the server is down the first request I get a reject as expected due to the home server being down. (2) Proxying request to home server 192.168.1.113 port 1812 timeout 1.000000 (2) Sent Access-Request Id 17 from 0.0.0.0:47755 to 192.168.1.113:1812 length 337 ... Waking up in 0.3 seconds. (2) Expecting proxy response no later than 0.669753 seconds from now Waking up in 0.4 seconds. (2) No proxy response, giving up on request and marking it done Marking home server 192.168.1.113 port 1812 as zombie (it has not responded in 1.000000 seconds). (2) ERROR: Failing proxied request for user "peter", due to lack of any response from home server 192.168.1.113 port 1812 (2) Clearing existing &reply: attributes But the second and subsequent request I would expect to get proxied to the local fallback virtual server as the home_server has been marked as zombie. But that never seems to happen. It keeps on rejecting the requests and fallback never seems to be used. If I configure a second home server in the pool. home_server_pool ProxyDestPool { type = fail-over home_server = ProxyDest home_server = cacheuser fallback = cacheuser } Then the second server is failed over to when the first fails. Which is all good if I wanted to use the type fail-over, but if I wanted to use load-balance then I can't have my fallback server as a home server otherwise a percentage of requests will always be local which isn't ideal. The other interesting thing with the failover is I set the check_interval to 10 seconds, or 30 seconds. But it only seems that the first client is re-checked after 60 seconds and assumed to be back up. Waking up in 0.2 seconds. Marking home server 192.168.1.113 port 1812 alive again... we have no idea if it really is alive or not. Waking up in 1.0 seconds. I would have thought that zombie_period = 5 revive_interval = 10 check_interval = 10 Would mean that the client would be re-checked in 10 seconds. Am I mis-understanding how fallback is supposed to work? Cheers Peter

2 7

Acct-Interim-Interval - Help is needed
by Bacsó Márton Károly 08 Mar '16

08 Mar '16

Dear Freeradius users, We have been using Freeradius with Daloradius on a Raspberry Pi for almost a year now. Until now everything worked perfectly, but because of a faulty SD card I had to reinstall the system at the weeekend. Now acct-interim-interval doesn’t work. I do get usage data, but only on stops. I checked my config files from the original installation and it seems that I managed to replicate all of my settings. Radtest gives back the reply attributes and I didn’t change anything on my APs.. Old system: Raspbian Wheezy, Freeradius 2.x (1.8??, I don’t remember). SQL New system: Raspbian Jessie, Freeradius 2.2.5, SQL Most of our APs are TPLINK901NDs, running OpenWRT. I have attached the the result of freeradius -X. Any help would be greatly appriciated!!! Radtest:Sending Access-Request of id 186 to 127.0.0.1 port 1812 User-Name = "bacsom" User-Password = "MB1237" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=186, length=32 Acct-Interim-Interval = 60 Idle-Timeout = 600 Marton Bacsó Márton Károly bacsom(a)hotmail.com bacsom(a)thankaroly.hu M.: +36 20 3315753 http://digilecke.com http://www.bacsomarton.com

2 2

how to authorize ldap users
by MichaelLeung 08 Mar '16

08 Mar '16

hi list who can i define policys on freeradius to authorize those users belong to speacific group which exsist on openldap server i google lot , but fine nothing , most of them are talking how to initial freeradius with internal user database

2 1

can linelog log passwords?
by Stefano Zanmarchi 08 Mar '16

08 Mar '16

Hello, I know that the log section of radiusd.conf allows to log passwords, by setting auth_badpass and auth_goodpass to "yes" or"no". But what I need is to log passwords only using the linelog module. More precisely, I'd like to keep auth_badpass = no auth_goodpass =yes destination = syslog in the log section of radiusd.conf and occasionally activate password logging on a local file via linelog for debugging purposes (and not have password be sent to syslog). Is this possible? If not with linelog, is there another way to keep on logging via syslog, while logging only password to a file? Thanks in advance, Stefano

3 2