June 2017 - Freeradius-Users - lists.freeradius.org

Counter attribute Daily-Session-Time MUST be integer64
by akash＠arrownet.com.np 21 Jun '17

21 Jun '17

I am getting following issue. rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_sqlcounter # Loading module "dailycounter" from file /etc/raddb/mods-enabled/sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" } /etc/raddb/mods-enabled/sqlcounter[41]: Counter attribute Daily-Session-Time MUST be integer64 /etc/raddb/mods-enabled/sqlcounter[41]: Instantiation failed for module "dailycounter"

2 1

Random crash after upgrading to 3.0.14 from 3.0.13
by Burn Zero 21 Jun '17

21 Jun '17

Hi, OS: CentOS Linux release 7.2.1511 (Core) 64 bit Openssl version: OpenSSL 1.0.2k I recently tried to upgrade to version 3.0.14 from 3.0.13. I uninstalled the 3.0.13 version rpm's and used 3.0.14 rpms. freeradius-3.0.14-2.1.x86_64.rpm freeradius-ldap-3.0.14-2.1.x86_64.rpm freeradius-utils-3.0.14-2.1.x86_64.rpm freeradius-config-3.0.14-2.1.x86_64.rpm I then copied the backed up raddb config files from 3.0.13 to new installation dir and restarted radius server. But then it got crashed randomly. Here's the debug log: *** Error in `radiusd': double free or corruption (!prev): 0x0000000000f33d60 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7c503)[0x7fe7937b0503] /lib64/libcrypto.so.10(CRYPTO_free+0x1d)[0x7fe794f0e7ad] /lib64/libssl.so.10(ssl_get_prev_session+0xd6)[0x7fe794c7fb66] /lib64/libssl.so.10(ssl3_get_client_hello+0x227)[0x7fe794c54bc7] /lib64/libssl.so.10(ssl3_accept+0x95d)[0x7fe794c5980d] /lib64/libssl.so.10(ssl23_accept+0x1c8)[0x7fe794c67478] /lib64/libssl.so.10(ssl23_read+0x32)[0x7fe794c68612] radiusd(tls_handshake_recv+0xa2)[0x4404d2] /usr/lib64/freeradius/libfreeradius-eap.so(eaptls_process+0x901)[0x7fe7952950a1] /usr/lib64/freeradius/rlm_eap_tls.so(+0xdee)[0x7fe78ab88dee] /usr/lib64/freeradius/rlm_eap.so(+0x3812)[0x7fe78e874812] /usr/lib64/freeradius/rlm_eap.so(eap_method_select+0x2d3)[0x7fe78e874d33] /usr/lib64/freeradius/rlm_eap.so(+0x2b26)[0x7fe78e873b26] radiusd[0x426d3e] radiusd[0x425e69] radiusd[0x42604e] radiusd(modcall+0x56)[0x427266] radiusd(indexed_modcall+0xad)[0x421e7d] radiusd(rad_authenticate+0x7ce)[0x4112ce] radiusd[0x4353c2] radiusd[0x431344] radiusd(request_receive+0x2a1)[0x432ad1] radiusd[0x41ca5e] radiusd[0x42f94e] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_loop+0x345)[0x7fe7954c57c5] radiusd(main+0x756)[0x40fdc6] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7fe793755b35] radiusd[0x41012a] ======= Memory map: ======== 00400000-00464000 r-xp 00000000 fd:00 531162 /usr/sbin/radiusd 00663000-00666000 r--p 00063000 fd:00 531162 /usr/sbin/radiusd 00666000-0066a000 rw-p 00066000 fd:00 531162 /usr/sbin/radiusd 0066a000-0066c000 rw-p 00000000 00:00 0 008d6000-01050000 rw-p 00000000 00:00 0 [heap] 7fe784000000-7fe784021000 rw-p 00000000 00:00 0 7fe784021000-7fe788000000 ---p 00000000 00:00 0 7fe78a577000-7fe78a579000 r-xp 00000000 fd:00 920239 /usr/lib64/freeradius/rlm_cache_rbtree.so 7fe78a579000-7fe78a779000 ---p 00002000 fd:00 920239 /usr/lib64/freeradius/rlm_cache_rbtree.so 7fe78a779000-7fe78a77a000 r--p 00002000 fd:00 920239 /usr/lib64/freeradius/rlm_cache_rbtree.so 7fe78a77a000-7fe78a77b000 rw-p 00003000 fd:00 920239 /usr/lib64/freeradius/rlm_cache_rbtree.so 7fe78a77b000-7fe78a77f000 r-xp 00000000 fd:00 920253 /usr/lib64/freeradius/rlm_eap_mschapv2.so 7fe78a77f000-7fe78a97e000 ---p 00004000 fd:00 920253 /usr/lib64/freeradius/rlm_eap_mschapv2.soAborted Does any one know what this mean? Thank you.

2 1

understanding NAS and accounting packets
by Saurabh Shandilya 20 Jun '17

20 Jun '17

Hi all, I am using freeradius server on my AWS. Freeradius version : 2.2.8 on 64bit system installed it via package manager. I have tried to go through a few times over the online present materials for freeradius but still I am not able to wrap my head around NAS. Here is my picture & current understanding: *Wireless AP* : D link 850l ; WPA-enterprise is only on 5 GHz band. The router firmware gives me this flexibility to put different security provisions on 2.4 and 5.0 GHz spectrum. AWS instance : *freeradius* server running. radtest output is correct as I can see by username and password being authenticated by access-accept response. 1. One of my node i.e laptop/mobile phone tries to connect to my wireless access point at 5.0 GHz. 2. I recieve packets at my freeradius server as I see it by running with -X swtich. 3. Successfull authentication is done and my device is connected. The problem arises for me when there occurs no accounting packets, the radacct table is empty all along. As what I think I understand by reading materails over internet, it seems like NAS sends this which I probably was considering my router to be. Is my d-link 850l is NAS? or I am getting it all wrong? There are no accounting packets, I checked it with radsniff. I am attaching a very big output response from my free-radius output. Initial few attempts are done while I tried connecting from my android phone to wireless AP with wrong credentials. Line number 1890 is when I sent request with correct credentials. Also, attaching my default file under sites-enabled/. I understand that I am here asking two things but I guess thats how I come to know about the problem. Let me know if any other outputs or logs are required. -- Regards, saurabh shandilya www.embedded4fun.com https://in.linkedin.com/in/shandilyasaurabh

3 6

Do-Over: Post-Auth-Type Accept vs Post-Auth-Type Reject 3.0.14
by Wussler, Doug 20 Jun '17

20 Jun '17

First, allow me to preface my inquiry by saying that we have been using FreeRADIUS for at least 5 years now. It does a fantastic job for us and we very much appreciate having access to this excellent application and to this extremely responsive listserv. We are grateful and send our thanks to all contributors. Now, to my inquiry: In “radiusd.conf” the “log {}” section defines radius log processing. In particular, “msg_goodpass” and “msg_badpass” allow you to add arbitrary info to your log records through the expansion of custom variables. Our config looks like this: log { destination = files file = ${logdir}/radius.log auth = yes msg_goodpass = "%{SSID} %{Aruba-Location-Id} %{Aruba-AP-Group} %{Aruba-Device-Type} %{reply:VLAN}" msg_badpass = "%{SSID} %{Aruba-Location-Id} %{Aruba-AP-Group} %{Aruba-Device-Type}" } Here is the relevant debug from a successful PEAP-MSChapV2 authentication. Note that the “Post-Auth” processing takes place BEFORE the log record is expanded and written. (9) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/fsu-1812 (9) post-auth { (9) if ( session-state:Cached-Session-Policy ) { (9) if ( session-state:Cached-Session-Policy ) -> FALSE (9) policy fsu-policy { (9) if ( &Client-Shortname =~ /City/ ) { (9) EXPAND &Client-Shortname (9) --> CL (9) if ( &Client-Shortname =~ /City/ ) -> FALSE (9) else { (9) update { (9) &reply:Aruba-User-Vlan := &reply:VLAN -> 8 (9) } # update = noop (9) } # else = noop (9) if ( !&SSID ) { (9) if ( !&SSID ) -> TRUE (9) if ( !&SSID ) { (9) if ( &Aruba-Essid-Name ) { (9) if ( &Aruba-Essid-Name ) -> TRUE (9) if ( &Aruba-Essid-Name ) { (9) update { (9) &SSID := &Aruba-Essid-Name -> 'FSU' (9) } # update = noop (9) } # if ( &Aruba-Essid-Name ) = noop (9) ... skipping elsif: Preceding "if" was taken (9) ... skipping elsif: Preceding "if" was taken (9) ... skipping elsif: Preceding "if" was taken (9) ... skipping else: Preceding "if" was taken (9) } # if ( !&SSID ) = noop (9) } # policy fsu-policy = noop (9) } # post-auth = noop (9) EXPAND %{SSID} %{Aruba-Location-Id} %{Aruba-AP-Group} %{Aruba-Device-Type} %{reply:VLAN} (9) --> FSU wg-wireless.fsu.edu Sha iPhone 8 (9) Login OK: [dw] (from client CL port 0 cli Bbbbbbbbbbb FSU wg-wireless.fsu.edu Sha iPhone 8 (9) Sent Access-Accept Id 85 from 128.186.10.10:1812 to 128.186.11.11:34005 length 0 Here is the relevant debug from an unsuccessful auth. Note that the Post-Auth-Type Reject processing takes place AFTER the log record is expanded and written: (8) Failed to authenticate the user (8) EXPAND %{SSID} %{Aruba-Location-Id} %{Aruba-AP-Group} %{Aruba-Device-Type} (8) --> wg-wireless.fsu.edu Sha iPhone (8) Login incorrect (eap_peap: The users session was previously rejected: returning reject (again.)): [dw] (from client CL port 0 cli Bbbbbbbbbbbb) wg-wireless.fsu.edu Sha iPhone (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-1812 (8) Post-Auth-Type REJECT { (8) policy fsu-policy { (8) if ( !&SSID ) { (8) if ( !&SSID ) -> TRUE (8) if ( !&SSID ) { (8) if ( &Aruba-Essid-Name ) { (8) if ( &Aruba-Essid-Name ) -> TRUE (8) if ( &Aruba-Essid-Name ) { (8) update { (8) &SSID := &Aruba-Essid-Name -> 'FSU' (8) } # update = noop (8) } # if ( &Aruba-Essid-Name ) = noop (8) ... skipping elsif: Preceding "if" was taken (8) ... skipping elsif: Preceding "if" was taken (8) ... skipping elsif: Preceding "if" was taken (8) ... skipping else: Preceding "if" was taken (8) } # if ( !&SSID ) = noop (8) } # policy fsu-policy = noop (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> dw (8) attr_filter.access_reject: Matched entry DEFAULT at line 17 (8) [attr_filter.access_reject] = updated (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 95 from 128.186.10.10:1812 to 128.186.11.11:34005 length 44 Is there some reason why we would want Post-Auth Accept to run BEFORE log processing but Post-Auth-Type Reject to run AFTER log processing? It seems like we would want our Post-Auth processing to occur in the same sequence relative to expanding and writing the log record no matter whether we get an Accept or a Reject. Doug Wussler Florida State University

4 3

Freeradius acct_unique module unavailable in OpenWrt
by Boudraa Cheikh 20 Jun '17

20 Jun '17

Hi, I'm running Openwrt CHAOS CALMER (15.05.1, r48532) on my linksys WRT1900AC V1 (mamba - mvebu platform). I have installed freeradius server version 2.2.8, i'm facing troubles with the acct unique session id which is all the time empty: rlm_sql_mysql: MYSQL check_error: 1062 received [sql] Couldn't insert SQL accounting STOP record - Duplicate entry '' for key 'acctuniqueid' rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Duplicate entry '' for key 'acctuniqueid'' rlm_sql (sql): Released sql socket id: 9 ++[sql] = fail +} # group accounting = fail Finished request 21. Cleaning up request 21 ID 5 with timestamp +1271 Going to the next request Ready to process requests. Reading the freeradius mailing list it seems that the only solution is to use the "acct_unique" module which is not available for download using the opkg install tool from OpenWrt console. I beg any one who have this package (ipk already compiled for the mvebu platform) or he have the OpenWrt build system and he can cross compile this module to help me sort my issue by helping me to get this module for my platform. Any other alternative solutions to sort out this problem using shell scripting call from the freeradius daemon are welcome Kind regards

4 3

Framed-IP-Address into Access-Request is not processed
by José María López Otero 20 Jun '17

20 Jun '17

Hello Freeradius community, I'm trying configure FreeRadius (v2.2.6) + sql module for users + sqlippool module to provide an IP address which the NAS client has suggested. The suggested IP address only should be provided if it matches in the pool allocated for this user, in any other case, the server could answer other allowed IP from the selected pool. The client is sending the "Framed-IP-Address" field in the Access-Request message but FreeRadius ignores it. I'm basing this philosophy in the RFC2865, section 5.8, Framed-IP-Address: "It MAY be used in Access-Request packet as a hint by the NAS to the server that would prefer that address, but the server is not required to the hint." Probably this feature is not supported but I want to be sure before develop my own workaround. I wonder if I could get it using unlang code. A FreeRadius upgrade is not allowed by now but I would be interesting to know if this feature could be achieve in other version. Thank you in advance. PD: The radius -X log trace is as follows: radiusd -X radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Sep 10 2015 at 07:12:21 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sqlippool.conf including configuration file /etc/raddb/sql/mysql/ippool.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 5 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "mysecret" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "se3-PGW" port = "3306" login = "radius" password = "mypass" radius_db = "MY_DB" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCD EFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@se3-PGW:3306/DB_BICS rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql): Connected new DB handle, #31 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_sqlippool Module: Instantiating module "sqlippool" from file /etc/raddb/sqlippool.conf sqlippool { sql-instance-name = "sql" lease-duration = 3601 pool-name = "" allocate-begin = "START TRANSACTION" allocate-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', calledstationid = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND pool_name = '%{control:Pool-Name}'" allocate-find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) LIMIT 1 FOR UPDATE" allocate-update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{3GPP-IMSI}-%{3GPP-NSAPI}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', calledstationid = '%{Called-Station-Id}', expiry_time = NOW() + INTERVAL 3601 SECOND WHERE framedipaddress = '%I' AND (expiry_time < NOW() OR expiry_time IS NULL)" allocate-commit = "COMMIT" allocate-rollback = "ROLLBACK" pool-check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start-begin = "START TRANSACTION" start-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3601 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{3GPP-IMSI}-%{3GPP-NSAPI}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start-commit = "COMMIT" start-rollback = "ROLLBACK" alive-begin = "START TRANSACTION" alive-update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3601 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{3GPP-IMSI}-%{3GPP-NSAPI}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive-commit = "COMMIT" alive-rollback = "ROLLBACK" stop-begin = "START TRANSACTION" stop-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', calledstationid = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{3GPP-IMSI}-%{3GPP-NSAPI}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop-commit = "COMMIT" stop-rollback = "ROLLBACK" on-begin = "START TRANSACTION" on-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on-commit = "COMMIT" on-rollback = "ROLLBACK" off-begin = "START TRANSACTION" off-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off-commit = "COMMIT" off-rollback = "ROLLBACK" sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" sqlippool_log_failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" sqlippool_log_nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" defaultpool = "main_pool" } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "noop" from file /etc/raddb/modules/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 0 } listen { type = "acct" ipaddr = 127.0.0.1 port = 0 } ... adding new socket proxy address * port 40388 Listening on authentication address 127.0.0.1 port 1812 Listening on accounting address 127.0.0.1 port 1813 Listening on proxy address * port 1297 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 54156, id=187, length=103 User-Name = "123123000@internet" Framed-IP-Address = 5.17.0.15 Called-Station-Id = "internet" Calling-Station-Id = "0034687947939" 3GPP-IMSI = "123123000000000" 3GPP-NSAPI = "5" # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok [files] users: Matched entry DEFAULT at line 50 ++[files] = ok [sql] expand: %{User-Name} -> 123123000@internet [sql] sql_set_user escaped user --> '123123000@internet' rlm_sql (sql): Reserving sql socket id: 30 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '123123000@internet' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '123123000@internet' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '123123000@internet' ORDER BY priority rlm_sql (sql): Released sql socket id: 30 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/raddb/sites-enabled/default +group post-auth { ++? if ("%{User-Name}" == "XTaskRadiusServerPing") expand: %{User-Name} -> 123123000@internet ? Evaluating ("%{User-Name}" == "XTaskRadiusServerPing") -> FALSE ++? if ("%{User-Name}" == "XTaskRadiusServerPing") -> FALSE ++else else { rlm_sql (sql): Reserving sql socket id: 29 [sqlippool] expand: %{User-Name} -> 123123000@internet [sqlippool] sql_set_user escaped user --> '123123000@internet' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', calledstationid = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND pool_name = '%{control:Pool-Name}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', calledstationid = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND pool_name = 'tochada' [sqlippool] expand: COMMIT -> COMMIT [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = 'tochada' AND (expiry_time < NOW() OR expiry_time IS NULL) LIMIT 1 FOR UPDATE [sqlippool] expand: UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{3GPP-IMSI}-%{3GPP-NSAPI}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', calledstationid = '%{Called-Station-Id}', expiry_time = NOW() + INTERVAL 3601 SECOND WHERE framedipaddress = '5.0.0.5' AND (expiry_time < NOW() OR expiry_time IS NULL) -> UPDATE radippool SET nasipaddress = '127.0.0.1', pool_key = '123123000000000-5', callingstationid = '0034687947939', username = '123123000@internet', calledstationid = 'internet', expiry_time = NOW() + INTERVAL 3601 SECOND WHERE framedipaddress = '5.0.0.5' AND (expiry_time < NOW() OR expiry_time IS NULL) [sqlippool] Allocated IP 5.0.0.5 [05000005] [sqlippool] expand: COMMIT -> COMMIT rlm_sql (sql): Released sql socket id: 29 [sqlippool] expand: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> Allocated IP: 5.0.0.5 from tochada (did internet cli 0034687947939 port user 123123000@internet) Allocated IP: 5.0.0.5 from tochada (did internet cli 0034687947939 port user 123123000@internet) +++[sqlippool] = ok +++update reply { expand: modules.sqlippool.lease-duration -> modules.sqlippool.lease- duration expand: %{config:modules.sqlippool.lease-duration} -> 3601 +++} # update reply = noop ++} # else else = ok ++[exec] = noop +} # group post-auth = ok Sending Access-Accept of id 187 to 127.0.0.1 port 54156 MS-Primary-DNS-Server = 8.8.8.8 Framed-IP-Address = 5.0.0.5 Session-Timeout = 3601 Finished request 1. Going to the next request Waking up in 4.7 seconds.

1 0

Post-Auth-Type Accept vs Post-Auth-Type Reject 3.0.14
by Wussler, Doug 19 Jun '17

19 Jun '17

I’m using 3.0.14. For a successful authentication, the log shows the Post-Auth routine executing BEFORE the log record expansion and output. This is handy because the Post-Auth routine sets some variables used by the log message (as set in radius.conf). For an unsuccessful authentication, the log shows the Post-Auth-Type “Reject” executing AFTER the log record expansion and output, which seems inconsistent and prevents the setting of the variables used in the log. Is this a bug or correct behavior? If it is correct behavior, what is the reason that we want Post-Auth to run BEFORE the log expansion but Post-Auth-Type Reject to run AFTER the log expansion? Doug Wussler Florida State University

2 1

Using NAS identifier instead of IP address
by Yusuf 19 Jun '17

19 Jun '17

The default method of freeradius identifying the source Access-Request packets requests is using IP addresses. But as many of you know, A lot of people don't have IP static addresses. IMHO, A workaround this problem could be to modify freeradius source code to use the NAS identifier + radius secret to authenticate (instead of source ip address+ radius secret) However, As per 1) https://www.dialogic.com/webhelp/BorderNet2020/1.1.0/WebHelp/radatt_nasiden… 2) https://community.arubanetworks.com/t5/Controller-Based-WLANs/What-is-NAS-i… They say : Code: [Select] NAS-Identifier MUST NOT be used to select the shared secret used to authenticate the request. The source IP address of the Access-Request packet MUST be used to select the shared secret. Can anyone tell me why not? what are the security implications (if any). Quick search on google mentions why NOT to do it, but does not explain the "WHY" of it. Thanks!

2 1

getting compilation error for freeradius 3.0.14
by Arvind Gupta 18 Jun '17

18 Jun '17

Hi All while compiling freeradius 3.0.14 server in linux I am getting following error during sudo make install command. Log file is attached for full compilation info INSTALL raddb/mods-available/yubikey INSTALL raddb/clients.conf make: *** No rule to make target `/scratch/arvindg/build/server/radius-agent/etc/raddb/dictionary', needed by `install.raddb'. Stop. Notifying upstream projects of job completion [DEBUG] Skipping watched dependency update for build: radius_agent-master #54 due to result: FAILURE Any help in this regard is highly appreciated. Thanks Arvind Kumar Gupta

2 1

SQL insert in rlm_expr
by Marius Booysen 16 Jun '17

16 Jun '17

I am fairly new to Radius, so please forgive me if this question is very basic. I am using version 3.0.14 and I know you can use the sql module in rlm_expr e.g %{sql:SELECT.....WHERE...} Now I am wondering if this is limited to select statements only or can I insert a row into a custom table like this: %{sql:INSERT INTO mytab (id) values (100)} I tried this in a policy and the policy executes fine (debugging shows that it is executing the insert) and returns ok, but the mytab table stays empty. Am I doing something wrong or is it just not supported? Thanks! Koos

3 6