- Freeradius-Users - lists.freeradius.org

Re: libpam-radius-auth password problem
by deepaksharma 17 Mar '11

17 Mar '11

Hi, I am facing exactly the same issue. Can anyone help me out if he has solution for this problem. -- Deepak Sharma -- View this message in context: http://freeradius.1045715.n5.nabble.com/libpam-radius-auth-password-problem… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Disconnect Request
by Etienne Pretorius 17 Mar '11

17 Mar '11

Hello List, Should I be worried about the following line in the Debug Output? WARNING: Unknown destination 127.0.0.1:1700 for CoA request. Kind Regards, Etienne Pretorius

1 2

Help required in Free Radius Debug Output
by Raheel Itrat 17 Mar '11

17 Mar '11

Hi, I am using Free readius version 1.1.7 on Ubuntu9.1, After installation I tried to check by editing the users file(etc/freeradius/users) by typing the following on the top and saved it testing Cleartext-Password := "password" Next i did radtest testing password 127.0.0.1 0 testing123 and follwing is my debug output Packet 0 rad_recv: Access-Request packet from host 127.0.0.1:45704, id=54, length=59 User-Name = "testing" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testing", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 54 to 127.0.0.1 port 45704 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 54 with timestamp 4d80c9e9 Nothing to do. Sleeping until we see a request.

2 4

The story of PAP, CHAP and the blank password
by Wynand Meijer 17 Mar '11

17 Mar '11

Greetings all, Instead of auth'ing a user on the 'User-Name' / 'Cleartext-Password' method we are using the 'Caller-Station-Id' with a blank password. ... # /etc/freeradius/sql/mysql/dialup.conf sql_user_name = "%{Calling-Station-Id}" ... We are using a mysql backend Here are a few challenges that came up: Using PAP: * The blank password transmitted is picked up by the RADIUS as "void" (an actual string value of 4 charaters) * To authenticate the 'blank password' the radcheck is set to [ user123 | Cleartext-Password | := | void] * Here are snippets of a successful connection ... rad_recv: Access-Request packet from host x.x.x.x port 57772, id=75, length=156 User-Name = "void" User-Password = "void" NAS-IP-Address = x.x.x.x NAS-Identifier = "rbggs2" Called-Station-Id = "apn.xxx.net" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 230647144 Calling-Station-Id = "00121231234" 3GPP-PDP-Type = 0 3GPP-SGSN-Address = x.x.x.x 3GPP-GGSN-Address = x.x.x.x +- entering group authorize {...} ... ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "void" [pap] Using clear text password "void" [pap] User authenticated successfully ++[pap] returns ok expand: The elders of the internet have granted you access -> The elders of the internet have granted you access Login OK: [void/void] (from client XXX_APN port 230647144 cli 00121231234) The elders of the internet have granted you access +- entering group post-auth {...} ... Using CHAP: * The blank password transmitted is picked up by the RADIUS as a challenge * To authenticate the 'blank password' the radcheck is set to [ user123 | Cleartext-Password | := | "" ] * Here are snippets of a successful connection rad_recv: Access-Request packet from host x.x.x.x port 50312, id=67, length=175 User-Name = "void" CHAP-Challenge = 0x48e2fc18c8f16b825cc4ce7c06b4bdea CHAP-Password = 0x012a6931a816773e44873124ecd7701e57 NAS-IP-Address = x.x.x.x NAS-Identifier = "rbggs2" Called-Station-Id = "apn.xxx.net" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 123703984 Calling-Station-Id = "00121231234" 3GPP-PDP-Type = 0 3GPP-SGSN-Address = x.x.x.x 3GPP-GGSN-Address = x.x.x.x +- entering group authorize {...} ... ++[logintime] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. CHAP-Password is correct. expand: The elders of the internet have granted you access -> The elders of the internet have granted you access Login OK: [void/<CHAP-Password>] (from client XXX_APN port 100795256 cli 00121231234) The elders of the internet have granted you access +- entering group post-auth {...} ... Is the transmission of the 'blank password' the responsibility of the NAS or can the password be manipulated in the FR settings / configs? Thanks Wynand

5 6

Seg Fault - 3.0 - More Info needed
by Breuer Nicolas 16 Mar '11

16 Mar '11

Hello Alan, Could you precise wich infos you need to go further ? Thanks ------- End of forwarded message ------- Hello I discovered a Seg Fault on the release 3.0 on the GIT server. Seems happening on the first auth. (30) Login OK: [XXX] (from client XXX) (30) # Executing section post-auth from file /etc/XXX.conf (30) +- entering group post-auth {...} (30) ++? if (reply:Framed-IP-Address) (30) ? Evaluating (reply:Framed-IP-Address) -> FALSE (30) ++? if (reply:Framed-IP-Address) -> FALSE (30) ++- entering else else {...} rlm_sql (ACCOUNTING-01): Reserving sql socket id: 14 (30) [IP-POOLING-01] expand: %{User-Name} -> XXX (30) [IP-POOLING-01] sql_set_user escaped user --> 'XXX' (30) [IP-POOLING-01] expand: BEGIN -> BEGIN (30) [IP-POOLING-01] expand: COMMIT -> COMMIT (30) [IP-POOLING-01] expand: SELECT ip_address FROM radippool WHERE pool_name = '%{reply:Pool-Suffix}*%{Huntgroup-Name}' AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE -> SELECT ip_address FROM radippool WHERE pool_name = 'BC*' AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE Segmentation fault I see the expand of variable HuntGroup-Name didn't get any values... Maybe the reason of Seg fault ? ------- End of forwarded message -------

2 1

problems with mac auth and huntgroups
by Eric Doutreleau 16 Mar '11

16 Mar '11

Hi i m using freeradius 2.1.10 i have setup mac auth based authentication like it s written here http://wiki.freeradius.org/Mac-Auth it works quite well my problems is now i want to combine that with huntgroups i have put in my /etc/raddb/huntgroups the following line radfiltuxmacs NAS-IP-Address == 157.159.7.108, NAS-Port-Id == 19-21 and i have modified the authorized_macs this way 00188bd041e4 Huntgroup-Name == "radfiltuxmacs" Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802, Tunnel-Private-Group-Id := 15, Fall-Through = no with the Huntgroup-Name it doesn't works here is the log Wed Mar 16 16:19:55 2011 : Debug: [<thread>] Received Access-Request packet from host 157.159.7.108 port 1025, id=38, leng th=197 Wed Mar 16 16:19:55 2011 : Debug: [<thread>] Framed-MTU = 1466 Wed Mar 16 16:19:55 2011 : Debug: [<thread>] NAS-IP-Address = 157.159.7.108 Wed Mar 16 16:19:55 2011 : Debug: [<thread>] NAS-Identifier = "radfilsw" Wed Mar 16 16:19:55 2011 : Debug: [<thread>] User-Name = "00188bd041e4" Wed Mar 16 16:19:55 2011 : Debug: [<thread>] Service-Type = Framed-User Wed Mar 16 16:19:55 2011 : Debug: [<thread>] Framed-Protocol = PPP Wed Mar 16 16:19:55 2011 : Debug: [<thread>] NAS-Port = 20 Wed Mar 16 16:19:55 2011 : Debug: [<thread>] NAS-Port-Type = Ethernet Wed Mar 16 16:19:55 2011 : Debug: [<thread>] NAS-Port-Id = "20" Wed Mar 16 16:19:55 2011 : Debug: [<thread>] Called-Station-Id = "00-23-47-33-7e-ec" Wed Mar 16 16:19:55 2011 : Debug: [<thread>] Calling-Station-Id = "00-18-8b-d0-41-e4" Wed Mar 16 16:19:55 2011 : Debug: [<thread>] Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Wed Mar 16 16:19:55 2011 : Debug: [<thread>] CHAP-Password = 0x14d8e8e4d846868af6005c652fa9294207 Wed Mar 16 16:19:55 2011 : Debug: [<thread>] Message-Authenticator = 0x3f7d3084a4e8c0e1507b1b196132d645 Wed Mar 16 16:19:55 2011 : Debug: [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Mar 16 16:19:55 2011 : Debug: [<thread>] +- entering group authorize {...} Wed Mar 16 16:19:55 2011 : Debug: ++[preprocess] returns ok Wed Mar 16 16:19:55 2011 : Debug: ++- entering policy rewrite_calling_station_id {...} Wed Mar 16 16:19:55 2011 : Debug: +++? if (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2} )[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) Wed Mar 16 16:19:55 2011 : Debug: ? Evaluating (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a- f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE Wed Mar 16 16:19:55 2011 : Debug: +++? if (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2} )[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE Wed Mar 16 16:19:55 2011 : Debug: +++- entering if (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0 -9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) {...} Wed Mar 16 16:19:55 2011 : Debug: expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 00188bd041e4 Wed Mar 16 16:19:55 2011 : Debug: ++++[request] returns ok Wed Mar 16 16:19:55 2011 : Debug: +++- if (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2} )[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns ok Wed Mar 16 16:19:55 2011 : Debug: +++ ... skipping else for request 0: Preceding "if" was taken Wed Mar 16 16:19:55 2011 : Debug: ++- policy rewrite_calling_station_id returns ok Wed Mar 16 16:19:55 2011 : Debug: ++? if (User-Name =~ /^%{Calling-Station-ID}$/i) Wed Mar 16 16:19:55 2011 : Debug: expand: ^%{Calling-Station-ID}$ -> ^00188bd041e4$ Wed Mar 16 16:19:55 2011 : Debug: ? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> TRUE Wed Mar 16 16:19:55 2011 : Debug: ++? if (User-Name =~ /^%{Calling-Station-ID}$/i) -> TRUE Wed Mar 16 16:19:55 2011 : Debug: ++- entering if (User-Name =~ /^%{Calling-Station-ID}$/i) {...} Wed Mar 16 16:19:55 2011 : Debug: +++[control] returns ok Wed Mar 16 16:19:55 2011 : Debug: ++- if (User-Name =~ /^%{Calling-Station-ID}$/i) returns ok Wed Mar 16 16:19:55 2011 : Debug: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/157.159.7.108/auth-detail-20110316 Wed Mar 16 16:19:55 2011 : Debug: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /v ar/log/radius/radacct/157.159.7.108/auth-detail-20110316 Wed Mar 16 16:19:55 2011 : Debug: [auth_log] expand: %t -> Wed Mar 16 16:19:55 2011 Wed Mar 16 16:19:55 2011 : Debug: ++[auth_log] returns ok Wed Mar 16 16:19:55 2011 : Debug: [chap] WARNING: Auth-Type already set. Not setting to CHAP Wed Mar 16 16:19:55 2011 : Debug: ++[chap] returns noop Wed Mar 16 16:19:55 2011 : Debug: ++[mschap] returns noop Wed Mar 16 16:19:55 2011 : Debug: [suffix] No '@' in User-Name = "00188bd041e4", looking up realm NULL Wed Mar 16 16:19:55 2011 : Debug: [suffix] Found realm "NULL" Wed Mar 16 16:19:55 2011 : Debug: [suffix] Adding Stripped-User-Name = "00188bd041e4" Wed Mar 16 16:19:55 2011 : Debug: [suffix] Adding Realm = "NULL" Wed Mar 16 16:19:55 2011 : Debug: [suffix] Authentication realm is LOCAL. Wed Mar 16 16:19:55 2011 : Debug: ++[suffix] returns ok Wed Mar 16 16:19:55 2011 : Debug: [eap] No EAP-Message, not doing EAP Wed Mar 16 16:19:55 2011 : Debug: ++[eap] returns noop Wed Mar 16 16:19:55 2011 : Debug: [files] users: Matched entry DEFAULT at line 31 Wed Mar 16 16:19:55 2011 : Debug: ++[files] returns ok Wed Mar 16 16:19:55 2011 : Debug: ++[expiration] returns noop Wed Mar 16 16:19:55 2011 : Debug: ++[logintime] returns noop Wed Mar 16 16:19:55 2011 : Debug: [pap] WARNING! No "known good" password found for the user. Authentication may fail bec ause of this. Wed Mar 16 16:19:55 2011 : Debug: ++[pap] returns noop Wed Mar 16 16:19:55 2011 : Debug: Found Auth-Type = CSID Wed Mar 16 16:19:55 2011 : Debug: # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 16 16:19:55 2011 : Debug: +- entering group CSID {...} Wed Mar 16 16:19:55 2011 : Debug: ++? if (Chap-Password) Wed Mar 16 16:19:55 2011 : Debug: ? Evaluating (Chap-Password) -> TRUE Wed Mar 16 16:19:55 2011 : Debug: ++? if (Chap-Password) -> TRUE Wed Mar 16 16:19:55 2011 : Debug: ++- entering if (Chap-Password) {...} Wed Mar 16 16:19:55 2011 : Debug: expand: %{User-Name} -> 00188bd041e4 Wed Mar 16 16:19:55 2011 : Debug: +++[control] returns reject Wed Mar 16 16:19:55 2011 : Debug: [chap] login attempt by "00188bd041e4" with CHAP password Wed Mar 16 16:19:55 2011 : Debug: [chap] Using clear text password "00188bd041e4" for user 00188bd041e4 authentication. Wed Mar 16 16:19:55 2011 : Debug: [chap] chap user 00188bd041e4 authenticated succesfully Wed Mar 16 16:19:55 2011 : Debug: +++[chap] returns ok Wed Mar 16 16:19:55 2011 : Debug: ++- if (Chap-Password) returns ok Wed Mar 16 16:19:55 2011 : Debug: ++ ... skipping else for request 0: Preceding "if" was taken Wed Mar 16 16:19:55 2011 : Debug: # Executing section post-auth from file /etc/raddb/sites-enabled/default Wed Mar 16 16:19:55 2011 : Debug: +- entering group post-auth {...} Wed Mar 16 16:19:55 2011 : Debug: [sql] expand: %{User-Name} -> 00188bd041e4 Wed Mar 16 16:19:55 2011 : Debug: [sql] sql_set_user escaped user --> '00188bd041e4' Wed Mar 16 16:19:55 2011 : Debug: [sql] expand: %{User-Password} -> Wed Mar 16 16:19:55 2011 : Debug: [sql] ... expanding second conditional Wed Mar 16 16:19:55 2011 : Debug: [sql] expand: %{Chap-Password} -> 0x14d8e8e4d846868af6005c652fa9294207 Wed Mar 16 16:19:55 2011 : Debug: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', ' %{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '00188bd041e4', '0x14d8e8e4d846868af6005c652fa9294207', 'Access-Accept ', '2011-03-16 16:19:55') Wed Mar 16 16:19:55 2011 : Debug: ++[sql] returns ok Wed Mar 16 16:19:55 2011 : Debug: ++[exec] returns noop Wed Mar 16 16:19:55 2011 : Debug: ++? if (control:Auth-Type == 'CSID') Wed Mar 16 16:19:55 2011 : Debug: ? Evaluating (control:Auth-Type == 'CSID') -> TRUE Wed Mar 16 16:19:55 2011 : Debug: ++? if (control:Auth-Type == 'CSID') -> TRUE Wed Mar 16 16:19:55 2011 : Debug: ++- entering if (control:Auth-Type == 'CSID') {...} Wed Mar 16 16:19:55 2011 : Debug: [authorized_macs] expand: %{Calling-Station-ID} -> 00188bd041e4 Wed Mar 16 16:19:55 2011 : Debug: +++[authorized_macs.authorize] returns noop Wed Mar 16 16:19:55 2011 : Debug: +++? if (!ok) Wed Mar 16 16:19:55 2011 : Debug: ? Evaluating !(ok) -> TRUE Wed Mar 16 16:19:55 2011 : Debug: +++? if (!ok) -> TRUE Wed Mar 16 16:19:55 2011 : Debug: +++- entering if (!ok) {...} Wed Mar 16 16:19:55 2011 : Debug: ++++[reject] returns reject Wed Mar 16 16:19:55 2011 : Debug: +++- if (!ok) returns reject Wed Mar 16 16:19:55 2011 : Debug: ++- if (control:Auth-Type == 'CSID') returns reject Wed Mar 16 16:19:55 2011 : Debug: Using Post-Auth-Type Reject Wed Mar 16 16:19:55 2011 : Debug: # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 16 16:19:55 2011 : Debug: +- entering group REJECT {...} Wed Mar 16 16:19:55 2011 : Debug: [attr_filter.access_reject] expand: %{User-Name} -> 00188bd041e4 Wed Mar 16 16:19:55 2011 : Debug: ++[attr_filter.access_reject] returns updated Wed Mar 16 16:19:55 2011 : Debug: Delaying reject of request 0 for 1 seconds Wed Mar 16 16:19:56 2011 : Debug: Sending delayed reject for request 0 Wed Mar 16 16:19:56 2011 : Debug: Sending Access-Reject packet to host 157.159.7.108 port 1025, id=38, length=0 Wed Mar 16 16:20:01 2011 : Debug: Cleaning up request 0 ID 38 with timestamp +42 without the huntgroup-name it does work here is the log Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Received Access-Request packet from host 157.159.7.108 port 1025, id=34, leng th=197 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Framed-MTU = 1466 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] NAS-IP-Address = 157.159.7.108 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] NAS-Identifier = "radfilsw" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] User-Name = "00188bd041e4" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Service-Type = Framed-User Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Framed-Protocol = PPP Wed Mar 16 16:14:13 2011 : Debug: [<thread>] NAS-Port = 20 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] NAS-Port-Type = Ethernet Wed Mar 16 16:14:13 2011 : Debug: [<thread>] NAS-Port-Id = "20" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Called-Station-Id = "00-23-47-33-7e-ec" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Calling-Station-Id = "00-18-8b-d0-41-e4" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] CHAP-Password = 0x12c06b04fb50151e8b4f43a769d3a04351 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Message-Authenticator = 0x6241a99d53380476bba649bedb8ee760 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Mar 16 16:14:13 2011 : Debug: [<thread>] +- entering group authorize {...} Wed Mar 16 16:14:13 2011 : Debug: ++[preprocess] returns ok Wed Mar 16 16:14:13 2011 : Debug: ++- entering policy rewrite_calling_station_id {...} Wed Mar 16 16:14:13 2011 : Debug: +++? if (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2} )[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) Wed Mar 16 16:14:13 2011 : Debug: ? Evaluating (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a- f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE Wed Mar 16 16:14:13 2011 : Debug: +++? if (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2} )[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE Wed Mar 16 16:14:13 2011 : Debug: +++- entering if (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0 -9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) {...} Wed Mar 16 16:14:13 2011 : Debug: expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 00188bd041e4 Wed Mar 16 16:14:13 2011 : Debug: ++++[request] returns ok Wed Mar 16 16:14:13 2011 : Debug: +++- if (request:Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2} )[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns ok Wed Mar 16 16:14:13 2011 : Debug: +++ ... skipping else for request 0: Preceding "if" was taken Wed Mar 16 16:14:13 2011 : Debug: ++- policy rewrite_calling_station_id returns ok Wed Mar 16 16:14:13 2011 : Debug: ++? if (User-Name =~ /^%{Calling-Station-ID}$/i) Wed Mar 16 16:14:13 2011 : Debug: expand: ^%{Calling-Station-ID}$ -> ^00188bd041e4$ Wed Mar 16 16:14:13 2011 : Debug: ? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> TRUE Wed Mar 16 16:14:13 2011 : Debug: ++? if (User-Name =~ /^%{Calling-Station-ID}$/i) -> TRUE Wed Mar 16 16:14:13 2011 : Debug: ++- entering if (User-Name =~ /^%{Calling-Station-ID}$/i) {...} Wed Mar 16 16:14:13 2011 : Debug: +++[control] returns ok Wed Mar 16 16:14:13 2011 : Debug: ++- if (User-Name =~ /^%{Calling-Station-ID}$/i) returns ok Wed Mar 16 16:14:13 2011 : Debug: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/157.159.7.108/auth-detail-20110316 Wed Mar 16 16:14:13 2011 : Debug: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /v ar/log/radius/radacct/157.159.7.108/auth-detail-20110316 Wed Mar 16 16:14:13 2011 : Debug: [auth_log] expand: %t -> Wed Mar 16 16:14:13 2011 Wed Mar 16 16:14:13 2011 : Debug: ++[auth_log] returns ok Wed Mar 16 16:14:13 2011 : Debug: [chap] WARNING: Auth-Type already set. Not setting to CHAP Wed Mar 16 16:14:13 2011 : Debug: ++[chap] returns noop Wed Mar 16 16:14:13 2011 : Debug: ++[mschap] returns noop Wed Mar 16 16:14:13 2011 : Debug: [suffix] No '@' in User-Name = "00188bd041e4", looking up realm NULL Wed Mar 16 16:14:13 2011 : Debug: [suffix] Found realm "NULL" Wed Mar 16 16:14:13 2011 : Debug: [suffix] Adding Stripped-User-Name = "00188bd041e4" Wed Mar 16 16:14:13 2011 : Debug: [suffix] Adding Realm = "NULL" Wed Mar 16 16:14:13 2011 : Debug: [suffix] Authentication realm is LOCAL. Wed Mar 16 16:14:13 2011 : Debug: ++[suffix] returns ok Wed Mar 16 16:14:13 2011 : Debug: [eap] No EAP-Message, not doing EAP Wed Mar 16 16:14:13 2011 : Debug: ++[eap] returns noop Wed Mar 16 16:14:13 2011 : Debug: [files] users: Matched entry DEFAULT at line 31 Wed Mar 16 16:14:13 2011 : Debug: ++[files] returns ok Wed Mar 16 16:14:13 2011 : Debug: ++[expiration] returns noop Wed Mar 16 16:14:13 2011 : Debug: ++[logintime] returns noop Wed Mar 16 16:14:13 2011 : Debug: [pap] WARNING! No "known good" password found for the user. Authentication may fail bec ause of this. Wed Mar 16 16:14:13 2011 : Debug: ++[pap] returns noop Wed Mar 16 16:14:13 2011 : Debug: Found Auth-Type = CSID Wed Mar 16 16:14:13 2011 : Debug: # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 16 16:14:13 2011 : Debug: +- entering group CSID {...} Wed Mar 16 16:14:13 2011 : Debug: ++? if (Chap-Password) Wed Mar 16 16:14:13 2011 : Debug: ? Evaluating (Chap-Password) -> TRUE Wed Mar 16 16:14:13 2011 : Debug: ++? if (Chap-Password) -> TRUE Wed Mar 16 16:14:13 2011 : Debug: ++- entering if (Chap-Password) {...} Wed Mar 16 16:14:13 2011 : Debug: expand: %{User-Name} -> 00188bd041e4 Wed Mar 16 16:14:13 2011 : Debug: +++[control] returns reject Wed Mar 16 16:14:13 2011 : Debug: [chap] login attempt by "00188bd041e4" with CHAP password Wed Mar 16 16:14:13 2011 : Debug: [chap] Using clear text password "00188bd041e4" for user 00188bd041e4 authentication. Wed Mar 16 16:14:13 2011 : Debug: [chap] chap user 00188bd041e4 authenticated succesfully Wed Mar 16 16:14:13 2011 : Debug: +++[chap] returns ok Wed Mar 16 16:14:13 2011 : Debug: ++- if (Chap-Password) returns ok Wed Mar 16 16:14:13 2011 : Debug: ++ ... skipping else for request 0: Preceding "if" was taken Wed Mar 16 16:14:13 2011 : Debug: # Executing section post-auth from file /etc/raddb/sites-enabled/default Wed Mar 16 16:14:13 2011 : Debug: +- entering group post-auth {...} Wed Mar 16 16:14:13 2011 : Debug: [sql] expand: %{User-Name} -> 00188bd041e4 Wed Mar 16 16:14:13 2011 : Debug: [sql] sql_set_user escaped user --> '00188bd041e4' Wed Mar 16 16:14:13 2011 : Debug: [sql] expand: %{User-Password} -> Wed Mar 16 16:14:13 2011 : Debug: [sql] ... expanding second conditional Wed Mar 16 16:14:13 2011 : Debug: [sql] expand: %{Chap-Password} -> 0x12c06b04fb50151e8b4f43a769d3a04351 Wed Mar 16 16:14:13 2011 : Debug: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', ' %{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '00188bd041e4', '0x12c06b04fb50151e8b4f43a769d3a04351', 'Access-Accept ', '2011-03-16 16:14:13') Wed Mar 16 16:14:13 2011 : Debug: ++[sql] returns ok Wed Mar 16 16:14:13 2011 : Debug: ++[exec] returns noop Wed Mar 16 16:14:13 2011 : Debug: ++? if (control:Auth-Type == 'CSID') Wed Mar 16 16:14:13 2011 : Debug: ? Evaluating (control:Auth-Type == 'CSID') -> TRUE Wed Mar 16 16:14:13 2011 : Debug: ++? if (control:Auth-Type == 'CSID') -> TRUE Wed Mar 16 16:14:13 2011 : Debug: ++- entering if (control:Auth-Type == 'CSID') {...} Wed Mar 16 16:14:13 2011 : Debug: [authorized_macs] expand: %{Calling-Station-ID} -> 00188bd041e4 Wed Mar 16 16:14:13 2011 : Debug: [authorized_macs] users: Matched entry 00188bd041e4 at line 1 Wed Mar 16 16:14:13 2011 : Debug: +++[authorized_macs.authorize] returns ok Wed Mar 16 16:14:13 2011 : Debug: +++? if (!ok) Wed Mar 16 16:14:13 2011 : Debug: ? Evaluating !(ok) -> FALSE Wed Mar 16 16:14:13 2011 : Debug: +++? if (!ok) -> FALSE Wed Mar 16 16:14:13 2011 : Debug: ++- if (control:Auth-Type == 'CSID') returns ok Wed Mar 16 16:14:13 2011 : Debug: Sending Access-Accept packet to host 157.159.7.108 port 1025, id=34, length=0 Wed Mar 16 16:14:13 2011 : Debug: Tunnel-Type:0 := VLAN Wed Mar 16 16:14:13 2011 : Debug: Tunnel-Medium-Type:0 := IEEE-802 Wed Mar 16 16:14:13 2011 : Debug: Tunnel-Private-Group-Id:0 := "15" Wed Mar 16 16:14:13 2011 : Debug: Finished request 0. Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Received Accounting-Request packet from host 157.159.7.108 port 1033, id=35, length=113 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Acct-Session-Id = "008C00000008" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Acct-Status-Type = Start Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Acct-Authentic = RADIUS Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Acct-Delay-Time = 0 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] NAS-Port = 20 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Calling-Station-Id = "00-18-8B-D0-41-E4" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] Service-Type = Framed-User Wed Mar 16 16:14:13 2011 : Debug: [<thread>] NAS-IP-Address = 157.159.7.108 Wed Mar 16 16:14:13 2011 : Debug: [<thread>] NAS-Identifier = "radfilsw" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] User-Name = "00188bd041e4" Wed Mar 16 16:14:13 2011 : Debug: [<thread>] # Executing section preacct from file /etc/raddb/sites-enabled/default Wed Mar 16 16:14:13 2011 : Debug: [<thread>] +- entering group preacct {...} Wed Mar 16 16:14:13 2011 : Debug: ++[preprocess] returns ok Wed Mar 16 16:14:13 2011 : Debug: [acct_unique] Hashing 'NAS-Port = 20,Client-IP-Address = 157.159.7.108,NAS-IP-Address = 157.159.7.108,Acct-Session-Id = "008C00000008",User-Name = "00188bd041e4"' Wed Mar 16 16:14:13 2011 : Debug: [acct_unique] Acct-Unique-Session-ID = "dc3de5f2391ff6ae". Wed Mar 16 16:14:13 2011 : Debug: ++[acct_unique] returns ok Wed Mar 16 16:14:13 2011 : Debug: [suffix] No '@' in User-Name = "00188bd041e4", looking up realm NULL Wed Mar 16 16:14:13 2011 : Debug: [suffix] Found realm "NULL" Wed Mar 16 16:14:13 2011 : Debug: [suffix] Adding Stripped-User-Name = "00188bd041e4" Wed Mar 16 16:14:13 2011 : Debug: [suffix] Adding Realm = "NULL" Wed Mar 16 16:14:13 2011 : Debug: [suffix] Accounting realm is LOCAL. Wed Mar 16 16:14:13 2011 : Debug: ++[suffix] returns ok Wed Mar 16 16:14:13 2011 : Debug: ++[files] returns noop Wed Mar 16 16:14:13 2011 : Debug: # Executing section accounting from file /etc/raddb/sites-enabled/default Wed Mar 16 16:14:13 2011 : Debug: +- entering group accounting {...} Wed Mar 16 16:14:13 2011 : Debug: [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var /log/radius/radacct/157.159.7.108/detail-20110316 Wed Mar 16 16:14:13 2011 : Debug: [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/ radius/radacct/157.159.7.108/detail-20110316 Wed Mar 16 16:14:13 2011 : Debug: [detail] expand: %t -> Wed Mar 16 16:14:13 2011 Wed Mar 16 16:14:13 2011 : Debug: ++[detail] returns ok Wed Mar 16 16:14:13 2011 : Debug: ++[unix] returns ok Wed Mar 16 16:14:13 2011 : Debug: [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp Wed Mar 16 16:14:13 2011 : Debug: [radutmp] expand: %{User-Name} -> 00188bd041e4 Wed Mar 16 16:14:13 2011 : Debug: ++[radutmp] returns ok Wed Mar 16 16:14:13 2011 : Debug: [sql] expand: %{User-Name} -> 00188bd041e4 Wed Mar 16 16:14:13 2011 : Debug: [sql] sql_set_user escaped user --> '00188bd041e4' Wed Mar 16 16:14:13 2011 : Debug: [sql] expand: %{Acct-Delay-Time} -> 0 Wed Mar 16 16:14:13 2011 : Debug: [sql] expand: INSERT INTO radacct (acctsessionid, acct uniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctsta rttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop , acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, se rvicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acc t-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protoco Wed Mar 16 16:14:13 2011 : Debug: ++[sql] returns ok Wed Mar 16 16:14:13 2011 : Debug: [sql_log] Processing sql_log_accounting Wed Mar 16 16:14:13 2011 : Debug: [sql_log] expand: %{User-Name} -> 00188bd041e4 Wed Mar 16 16:14:13 2011 : Debug: [sql_log] expand: %{%{User-Name}:-DEFAULT} -> 00188bd041e4 Wed Mar 16 16:14:13 2011 : Debug: [sql_log] sql_set_user escaped user --> '00188bd041e4' Wed Mar 16 16:14:13 2011 : Debug: [sql_log] expand: INSERT INTO radacct (AcctSessionId, UserName, NASIPAddress, Fra medIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctTerminateCause) VALUES ('%{Acct- Session-Id}', '%{User-Name}', '%{NAS-IP-Address}', '%{Framed-IP-Address}', '%S', '0', '0', ''); -> INSERT INTO radac ct (AcctSessionId, UserName, NASIPAddress, FramedIPAddress, AcctStartTime, AcctStopTime, AcctSessionTime, AcctTerm inateCause) VALUES ('008C00000008', '00188bd041e4', '157.159.7.108', '', '2011-03-16 16:14:13' , '0', '0', ''); Wed Mar 16 16:14:13 2011 : Debug: [sql_log] expand: /var/log/radius/radacct/sql-relay -> /var/log/radius/radacct/sql-r elay Wed Mar 16 16:14:13 2011 : Debug: ++[sql_log] returns ok Wed Mar 16 16:14:13 2011 : Debug: [attr_filter.accounting_response] expand: %{User-Name} -> 00188bd041e4 Wed Mar 16 16:14:13 2011 : Debug: ++[attr_filter.accounting_response] returns updated Wed Mar 16 16:14:13 2011 : Debug: Sending Accounting-Response packet to host 157.159.7.108 port 1033, id=35, length=0 Wed Mar 16 16:14:13 2011 : Debug: Finished request 1. Wed Mar 16 16:14:14 2011 : Debug: Cleaning up request 1 ID 35 with timestamp +44 Wed Mar 16 16:14:18 2011 : Debug: Cleaning up request 0 ID 34 with timestamp +44 does someone know if it s possible to use hungroups this way?

1 0

(Fwd) Seg Fault - 3.0
by Breuer Nicolas 16 Mar '11

16 Mar '11

------- Forwarded message follows ------- From: Breuer Nicolas <Nicolas.Breuer(a)Belcenter.biz> To: freeradius-devel(a)lists.freeradius.org Subject: Seg Fault - 3.0 Date sent: Wed, 16 Mar 2011 15:23:22 +0100 Hello I discovered a Seg Fault on the release 3.0 on the GIT server. Seems happening on the first auth. (30) Login OK: [XXX] (from client XXX) (30) # Executing section post-auth from file /etc/XXX.conf (30) +- entering group post-auth {...} (30) ++? if (reply:Framed-IP-Address) (30) ? Evaluating (reply:Framed-IP-Address) -> FALSE (30) ++? if (reply:Framed-IP-Address) -> FALSE (30) ++- entering else else {...} rlm_sql (ACCOUNTING-01): Reserving sql socket id: 14 (30) [IP-POOLING-01] expand: %{User-Name} -> XXX (30) [IP-POOLING-01] sql_set_user escaped user --> 'XXX' (30) [IP-POOLING-01] expand: BEGIN -> BEGIN (30) [IP-POOLING-01] expand: COMMIT -> COMMIT (30) [IP-POOLING-01] expand: SELECT ip_address FROM radippool WHERE pool_name = '%{reply:Pool-Suffix}*%{Huntgroup-Name}' AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE -> SELECT ip_address FROM radippool WHERE pool_name = 'BC*' AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE Segmentation fault I see the expand of variable HuntGroup-Name didn't get any values... Maybe the reason of Seg fault ? ------- End of forwarded message -------

2 1

Re: SQL Counter Escape String !
by Suman Dash 16 Mar '11

16 Mar '11

sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(acctsessiontime) FROM tbl_acct where \ username = '%{%k}' AND acctstarttime BETWEEN \ (SELECT STR_TO_DATE((SELECT value FROM tbl_check \ WHERE username = '%{%k}' AND attribute = 'Activation'), '%%%%d %%%%M %%%%Y %%%%H:%%%%i:%%%%s')) \ AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = '%{%k}' \ AND attribute = 'Expiration'), '%%%%d %%%%M %%%%Y %%%%H:%%%%i:%%%%s'))" DEBUG rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM tbl_check WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM tbl_check WHERE username = 'suman' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM tbl_reply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM tbl_reply WHERE username = 'suman' ORDER BY id [sql] expand: SELECT groupname FROM tbl_usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM tbl_usergroup WHERE username = 'suman' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM tbl_groupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM tbl_groupcheck WHERE groupname = 'Biz1Mbps-UL' ORDER BY id [sql] User found in group Biz1Mbps-UL [sql] expand: SELECT id, groupname, attribute, value, op FROM tbl_groupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM tbl_groupreply WHERE groupname = 'Biz1Mbps-UL' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(acctsessiontime) FROM tbl_acct where username = '%{User-Name}' AND acctstarttime BETWEEN (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = '%{User-Name}' AND attribute = 'Activation'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = '%{User-Name}' AND attribute = 'Expiration'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s'))' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] expand: SELECT SUM(acctsessiontime) FROM tbl_acct where username = '%{User-Name}' AND acctstarttime BETWEEN (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = '%{User-Name}' AND attribute = 'Activation'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = '%{User-Name}' AND attribute = 'Expiration'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) -> SELECT SUM(acctsessiontime) FROM tbl_acct where username = 'suman' AND acctstarttime BETWEEN (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Activation'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Expiration'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime) FROM tbl_acct where username = 'suman' AND acctstarttime BETWEEN (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Activation'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Expiration'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s'))}' [monthlycounter] sql_xlat [monthlycounter] expand: %{User-Name} -> suman [monthlycounter] sql_set_user escaped user --> 'suman' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' [monthlycounter] expand: SELECT SUM(acctsessiontime) FROM tbl_acct where username = 'suman' AND acctstarttime BETWEEN (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Activation'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Expiration'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) -> SELECT SUM(acctsessiontime) FROM tbl_acct where username = 'suman' AND acctstarttime BETWEEN (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Activation'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Expiration'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) rlm_sql (sql): Reserving sql socket id: 2 [monthlycounter] row[0] returned NULL rlm_sql (sql): Released sql socket id: 2 [monthlycounter] expand: %{sql:SELECT SUM(acctsessiontime) FROM tbl_acct where username = 'suman' AND acctstarttime BETWEEN (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Activation'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s')) AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = 'suman' AND attribute = 'Expiration'), '%0%0d %0%0M %0%0Y %0%0H:%0%0i:%0%0s'))} -> rlm_sqlcounter: No integer found in string "" ++[monthlycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop rlm_checkval: Item Name: Calling-Station-Id, Value: 001122334455 rlm_checkval: Value Name: Calling-Station-Id, Value: 001122334455 ++[checkval] returns ok [expiration] Checking Expiration time: '13 Mar 2012 21:37:23' ++[expiration] returns ok ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "duman12" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did cli 001122334455 port user suman) No Pool-Name defined (did cli 001122334455 port user suman) ++[sqlippool] returns noop [sql] expand: %{User-Name} -> suman [sql] sql_set_user escaped user --> 'suman' [sql] expand: %{User-Password} -> duman12 [sql] expand: INSERT INTO tbl_postauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO tbl_postauth (username, pass, reply, authdate) VALUES ( 'suman', 'duman12', 'Access-Accept', '2011-03-15 15:06:37') rlm_sql (sql) in sql_postauth: query is INSERT INTO tbl_postauth (username, pass, reply, authdate) VALUES ( 'suman', 'duman12', 'Access-Accept', '2011-03-15 15:06:37') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 9 to 122.175.85.117 port 19549 Session-Timeout = 31473046 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 9 with timestamp +2 Ready to process requests. I don't know... try using 3 or 4 '%' in the string, instead of just 2. > Suman Dash wrote: >> mysql> select * from tbl_check; >> +----+----------+---------------------+----+----------------------+ >> | id | username | attribute | op | value | >> +----+----------+---------------------+----+----------------------+ >> | 17 | suman | Crypt-Password | := | TeatgXaDQelbQ | >> | 18 | suman | Calling-Station-Id | := | 001122334455 | >> | 25 | suman | Expiration | := | 13 Mar 2012 21:37:23 | >> | 22 | suman | Activation | := | 13 Mar 2011 21:37:23 | >> | 24 | suman | Max-Monthly-Session | := | 30 | >> +----+----------+---------------------+----+----------------------+ >> 5 rows in set (0.00 sec) >> >> mysql> SELECT SUM(acctsessiontime) FROM tbl_acct where username = >> 'suman' AND acctstarttime BETWEEN \ >> -> (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE username = >> 'suman' AND attribute = 'Activation'), '%d %M %Y %H:%i:%s')) \ >> -> AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check WHERE >> username = 'suman' AND attribute = 'Expiration'), '%d %M %Y %H:%i:%s')); >> +----------------------+ >> | SUM(acctsessiontime) | >> +----------------------+ >> | 200 | >> +----------------------+ >> 1 row in set (0.00 sec) >> >> mysql> >> >> Counter.SQL >> >> sqlcounter monthlycounter { >> counter-name = Monthly-Session-Time >> check-name = Max-Monthly-Session >> reply-name = Session-Timeout >> sqlmod-inst = sql >> key = User-Name >> reset = never >> >> query = "SELECT SUM(acctsessiontime) FROM tbl_acct where \ >> username = '%{%k}' AND acctstarttime BETWEEN \ >> (SELECT STR_TO_DATE((SELECT value FROM tbl_check \ >> WHERE username = '%{%k}' AND attribute = 'Activation'), >> '%%d %%M %%Y %%H:%%i:%%s')) \ >> AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = '%{%k}' \ >> AND attribute = 'Expiration'), '%%d %%M %%Y %%H:%%i:%%s'))" >> >> >> DEBUG >> >> Listening on authentication address * port 1812 >> Listening on accounting address * port 1813 >> Listening on proxy address * port 1814 >> Ready to process requests. >> rad_recv: Access-Request packet from host 122.175.85.117 port 19169, >> id=6, length=59 >> User-Name = "suman" >> User-Password = "duman12" >> Calling-Station-Id = "001122334455" >> +- entering group authorize {...} >> ++[preprocess] returns ok >> ++[chap] returns noop >> ++[mschap] returns noop >> [suffix] No '@' in User-Name = "suman", looking up realm NULL >> [suffix] No such realm "NULL" >> ++[suffix] returns noop >> [eap] No EAP-Message, not doing EAP >> ++[eap] returns noop >> ++[unix] returns notfound >> ++[files] returns noop >> [sql] expand: %{User-Name} -> suman >> [sql] sql_set_user escaped user --> 'suman' >> rlm_sql (sql): Reserving sql socket id: 3 >> [sql] expand: SELECT id, username, attribute, value, op FROM >> tbl_check WHERE username = '%{SQL-User-Name}' >> ORDER BY id -> SELECT id, username, attribute, value, >> op FROM tbl_check WHERE username = 'suman' >> ORDER BY id >> [sql] User found in radcheck table >> [sql] expand: SELECT id, username, attribute, value, op FROM >> tbl_reply WHERE username = '%{SQL-User-Name}' >> ORDER BY id -> SELECT id, username, attribute, value, >> op FROM tbl_reply WHERE username = 'suman' >> ORDER BY id >> [sql] expand: SELECT groupname FROM tbl_usergroup >> WHERE username = '%{SQL-User-Name}' >> ORDER BY priority -> SELECT groupname FROM >> tbl_usergroup WHERE username = 'suman' >> ORDER BY priority >> [sql] expand: SELECT id, groupname, attribute, Value, >> op FROM tbl_groupcheck >> WHERE groupname = '%{Sql-Group}' ORDER BY id -> >> SELECT id, groupname, attribute, >> Value, op FROM tbl_groupcheck WHERE >> groupname = 'Biz1Mbps-UL' ORDER BY id >> [sql] User found in group Biz1Mbps-UL >> [sql] expand: SELECT id, groupname, attribute, value, >> op FROM tbl_groupreply >> WHERE groupname = '%{Sql-Group}' ORDER BY id -> >> SELECT id, groupname, attribute, >> value, op FROM tbl_groupreply WHERE >> groupname = 'Biz1Mbps-UL' ORDER BY id >> rlm_sql (sql): Released sql socket id: 3 >> ++[sql] returns ok >> rlm_sqlcounter: Entering module authorize code >> rlm_sqlcounter: Could not find Check item value pair >> ++[dailycounter] returns noop >> rlm_sqlcounter: Entering module authorize code >> sqlcounter_expand: 'SELECT SUM(acctsessiontime) FROM tbl_acct >> where username = '%{User-Name}' AND acctstarttime BETWEEN >> (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = '%{User-Name}' AND attribute = >> 'Activation'), '%0d %0M %0Y %0H:%0i:%0s')) >> AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = '%{User-Name}' >> AND attribute = 'Expiration'), '%0d %0M %0Y >> %0H:%0i:%0s'))' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] expand: SELECT SUM(acctsessiontime) FROM >> tbl_acct where username = '%{User-Name}' AND >> acctstarttime BETWEEN >> (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = '%{User-Name}' AND attribute = >> 'Activation'), '%0d %0M %0Y %0H:%0i:%0s')) >> AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = '%{User-Name}' >> AND attribute = 'Expiration'), '%0d %0M %0Y >> %0H:%0i:%0s')) -> SELECT SUM(acctsessiontime) FROM tbl_acct where >> username = 'suman' AND acctstarttime >> BETWEEN (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' AND attribute = 'Activation'), >> '%0d %0M %0Y %0H:%0i:%0s')) >> AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' >> AND attribute = 'Expiration'), '%0d %0M %0Y %0H:%0i:%0s')) >> sqlcounter_expand: '%{sql:SELECT SUM(acctsessiontime) FROM tbl_acct >> where username = 'suman' AND acctstarttime BETWEEN >> (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' AND attribute = 'Activation'), >> '%0d %0M %0Y %0H:%0i:%0s')) >> AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' >> AND attribute = 'Expiration'), '%0d %0M %0Y >> %0H:%0i:%0s'))}' >> [monthlycounter] sql_xlat >> [monthlycounter] expand: %{User-Name} -> suman >> [monthlycounter] sql_set_user escaped user --> 'suman' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] WARNING: Unknown variable '%0': See 'doc/variables.txt' >> [monthlycounter] expand: SELECT SUM(acctsessiontime) FROM >> tbl_acct where username = 'suman' AND acctstarttime BETWEEN >> (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' AND attribute = 'Activation'), >> '%0d %0M %0Y %0H:%0i:%0s')) >> AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' >> AND attribute = 'Expiration'), '%0d %0M %0Y >> %0H:%0i:%0s')) -> SELECT SUM(acctsessiontime) FROM tbl_acct where >> username = 'suman' AND acctstarttime >> BETWEEN (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' AND attribute = 'Activation'), >> '%0d %0M %0Y %0H:%0i:%0s')) >> AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' >> AND attribute = 'Expiration'), '%0d %0M %0Y %0H:%0i:%0s')) >> rlm_sql (sql): Reserving sql socket id: 2 >> [monthlycounter] row[0] returned NULL >> rlm_sql (sql): Released sql socket id: 2 >> [monthlycounter] expand: %{sql:SELECT SUM(acctsessiontime) FROM >> tbl_acct where username = 'suman' AND acctstarttime BETWEEN >> (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' AND attribute = 'Activation'), >> '%0d %0M %0Y %0H:%0i:%0s')) >> AND (SELECT STR_TO_DATE((SELECT value FROM tbl_check >> WHERE username = 'suman' >> AND attribute = 'Expiration'), '%0d %0M %0Y >> %0H:%0i:%0s'))} -> >> rlm_sqlcounter: No integer found in string "" >> ++[monthlycounter] returns noop >> rlm_sqlcounter: Entering module authorize code >> rlm_sqlcounter: Could not find Check item value pair >> ++[noresetcounter] returns noop >> rlm_checkval: Item Name: Calling-Station-Id, Value: 001122334455 >> rlm_checkval: Value Name: Calling-Station-Id, Value: 001122334455 >> ++[checkval] returns ok >> [expiration] Checking Expiration time: '13 Mar 2012 21:37:23' >> ++[expiration] returns ok >> ++[logintime] returns noop >> ++[pap] returns updated >> Found Auth-Type = PAP >> +- entering group PAP {...} >> [pap] login attempt with password "duman12" >> [pap] Using CRYPT encryption. >> [pap] User authenticated successfully >> ++[pap] returns ok >> +- entering group post-auth {...} >> [sqlippool] No Pool-Name defined. >> [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} >> cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No >> Pool-Name defined (did cli 001122334455 port user suman) >> No Pool-Name defined (did cli 001122334455 port user suman) >> ++[sqlippool] returns noop >> [sql] expand: %{User-Name} -> suman >> [sql] sql_set_user escaped user --> 'suman' >> [sql] expand: %{User-Password} -> duman12 >> [sql] expand: INSERT INTO tbl_postauth >> (username, pass, reply, authdate) VALUES >> ( '%{User-Name}', >> '%{%{User-Password}:-%{Chap-Password}}', >> '%{reply:Packet-Type}', '%S') -> INSERT INTO >> tbl_postauth (username, pass, reply, >> authdate) VALUES ( >> 'suman', 'duman12', >> 'Access-Accept', '2011-03-15 14:36:34') >> rlm_sql (sql) in sql_postauth: query is INSERT INTO >> tbl_postauth (username, pass, reply, >> authdate) VALUES ( >> 'suman', 'duman12', >> 'Access-Accept', '2011-03-15 14:36:34') >> rlm_sql (sql): Reserving sql socket id: 1 >> rlm_sql (sql): Released sql socket id: 1 >> ++[sql] returns ok >> ++[exec] returns noop >> Sending Access-Accept of id 6 to 122.175.85.117 port 19169 >> Session-Timeout = 31474849 >> Finished request 0. >> Going to the next request >> Waking up in 4.9 seconds. >> Cleaning up request 0 ID 6 with timestamp +3 >> Ready to process requests. >> >> >> >> ********************************************************** >> >> When the Counter Reset Period is monthly , %%' becomes '%1298917800 >> >> When the Counter Reset Period is Never , New Problem Arises i.e %0d %0M >> %0Y %0H:%0i:%0s >> >> Please let me know if you need any more debugs . >> >> Best Regards >> Suman >> >> >> On 3/15/2011 2:06 PM, Alan DeKok wrote: >>> Suman Dash wrote: >>>> I have tried almost all sql escape but looks like none are working or >>>> maybe i am missing something. I am stuck in this issue for more than 3 >>>> days and now i don't have any clue due to which i am trying to reach for >>>> help on the mailing list. >>> Hmm... the issue seems to be that the sqlcounter module does it's own >>> string expansion, and gets it *horribly* wrong. >>> >>> As for why '%%' becomes '%1298917800', I have no idea. Posting *more* >>> debug output might help. What you did post was the final result of the >>> expansion, and didn't include *how* that expansion came about. >>> >>> Alan DeKok. >>> >>> >>> __________ Information from ESET NOD32 Antivirus, version of virus >>> signature database 5924 (20110303) __________ >>> >>> The message was checked by ESET NOD32 Antivirus. >>> >>> http://www.eset.com >>> >>> >>> >>> >> > > > __________ Information from ESET NOD32 Antivirus, version of virus signature database 5924 (20110303) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > > >

4 10

Accounting - Acct-Interim-Interval
by Wynand Meijer 16 Mar '11

16 Mar '11

Greetings, * We have added the attribute "Acct-Interim-Interval = 150" to the radgroupreply * However we are not getting accounting packets back on a 150sec frequency * We are getting the accounting packets on the start and stop of the connection * The reporting back (accounting packets), is that the responsibility og the NAS / RADIUS / Client ? Thanks Wynand

3 2

freeradius failover-through proxy or other way?
by Martin Lambev 16 Mar '11

16 Mar '11

I'm really beginner in freeradius realm, and in advance sorry if the question is immature... After rading all wiki - freeradius, still is not clear to me, is it possible to do failover-through proxy, and how to organize the things that I want to accomplish. Explanation fallow: Now I have the fallowing setup: node 1 - NAS (pptp, openvpn) -> server 2 (freeradius + mysql as backed) I red in documentation about 2 or 3 mysql db and how to do fail-over, load-balancing and redundancy, but If I do it like that when freeradius server fail, the whole setup is down. I want to add another node as second NAS so the things will become like this: node 1 - NAS (pptp, openvpn) -> server 2 AAA (freeradius+mysql) node 3 - NAS ( l2tp) -------------^ I want to have redundancy in case server 2 AAA (freeradius + mysql as backend) fail, second server 4 AAA to take over with exactly the same setup (freeradius + mysql backend).. Should I use freeradius proxy on every node??? other solution? So the thigs needs to become like this: node 1 - NAS (+freeradius proxy?)--| Internet |---server 2 master (freeradius+mysql, location ex.US ) node 3 - NAS (+freeradius proxy?)--| Internet |---server 4 slave (freeradius+mysql, location ex.EU ) I want to have mysql db to be updated (to have mirror copy) on booth server 2,4 in real time. The purpose of this set up is redundancy if one of the AAA server is down the other one to take over without impact over node 1,3 ( temporary user disconnect is acceptable ) Or may be there is other way to do so? Any advices are welcomed, correction or hints.... anything that can help me "see" better :) Best Regards, Martin

2 1