- Freeradius-Users - lists.freeradius.org

Re: Problem with limiting users to group in Active Directory
by Erik Frangež 01 Dec '21

01 Dec '21

Hi guys, I am still having problems to check if user is member of group... here is cut from logs where is comparison: (31) ldap1-vpn-student: EXPAND (sAMAccountName=%{User-Name}) (31) ldap1-vpn-student: --> (sAMAccountName=erik.frangez1) (31) ldap1-vpn-student: Performing search in "ou=um,dc=loki,dc=um,dc=si" with filter "(sAMAccountName=erik.frangez1)", scope "sub" (31) ldap1-vpn-student: Waiting for search result... (31) ldap1-vpn-student: User object found at DN "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" rlm_ldap (ldap1-vpn-student): Released connection (0) (31) [ldap1-vpn-student] = ok (31) } # redundant = ok (31) policy check_ldap_group_vpn { (31) if (&ldap1-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") { (31) Searching for user in group "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" rlm_ldap (ldap1-student-um): Reserved connection (0) (31) Using user DN from request "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" rlm_ldap (ldap1-student-um): Released connection (0) (31) User is not a member of "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" (31) if (&ldap1-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") -> FALSE (31) elsif (&ldap2-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") { (31) Searching for user in group "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" rlm_ldap (ldap2-student-um): Reserved connection (0) (31) Using user DN from request "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" rlm_ldap (ldap2-student-um): Released connection (0) (31) User is not a member of "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si" (31) elsif (&ldap2-student-um-LDAP-Group[*] == "cn=idm_vpn,ou=groups,ou=quest,ou=um,dc=loki,dc=um,dc=si") -> FALSE (31) else { (31) [reject] = reject (31) } # else = reject (31) } # policy check_ldap_group_vpn = reject (31) } # Autz-Type LDAPS-VPN-STUDENT = reject If I run ldapsearch we could see that user is member of group, here: # IDM_VPN, Groups, QUEST, UM, loki.um.si dn: CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si objectClass: top objectClass: group cn: IDM_VPN description:: U2t1cGluYSBqZSBuYW1lbmplbmEgZG9zdG9wdSDFoXR1ZGVudG92IGRvIHN0b3Jp dGV2IFZQTi4gWiBuam8gdXByYXZsamEgSURNLg== member: CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si distinguishedName: CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si instanceType: 4 whenCreated: 20211118102555.0Z Please help me! Best, Erik On 11/29/21 9:38 PM, Alan DeKok wrote: > And I didn't notice in my last reply... > > don't email me off-list. The purpose of the list is to let everyone ELSE see what problems are being solved. Email the list. > > Any further emails sent directly to me will be ignored. > >> On Nov 29, 2021, at 3:07 PM, Erik Frangež <erik(a)frangez.net> wrote: >> >> Can you please help me? Thank you! >> >> >> >> -------- Posredovano sporočilo -------- >> Zadeva: Re: Problem with limiting users to group in Active Directory >> Datum: Sun, 28 Nov 2021 21:45:47 +0100 >> Od: Erik Frangež <erik(a)frangez.net> >> Za: Alan DeKok <aland(a)deployingradius.com> >> >> >> Hi Alan, >> >> here is whole log for one attempt: >> >> (74) Received Access-Request Id 42 from 164.8.15.42:54972 to 164.8.100.71:21812 length 71 >> (74) User-Name = "erik.frangez1" >> (74) User-Password = "*******" >> (74) Service-Type = Authenticate-Only >> (74) NAS-Port = 0 >> (74) NAS-IP-Address = 164.8.15.40 >> (74) # Executing section authorize from file /etc/raddb/sites-enabled/guard_vpn_student >> (74) authorize { >> (74) suffix: Checking for suffix after "@" >> (74) suffix: No '@' in User-Name = "erik.frangez1", looking up realm NULL >> (74) suffix: Found realm "NULL" >> (74) suffix: Adding Stripped-User-Name = "erik.frangez1" >> (74) suffix: Adding Realm = "NULL" >> (74) suffix: Authentication realm is LOCAL >> (74) [suffix] = ok >> (74) guard_vpn_student_file: users: Matched entry DEFAULT at line 1 >> (74) [guard_vpn_student_file] = ok >> (74) } # authorize = ok >> (74) Using Autz-Type LDAPS-VPN-STUDENT >> (74) # Executing group from file /etc/raddb/sites-enabled/guard_vpn_student >> (74) Autz-Type LDAPS-VPN-STUDENT { >> (74) redundant { >> (74) ldap1-vpn-student: EXPAND (sAMAccountName=%{User-Name}) >> (74) ldap1-vpn-student: --> (sAMAccountName=erik.frangez1) >> (74) ldap1-vpn-student: Performing search in "ou=um,dc=loki,dc=um,dc=si" with filter "(sAMAccountName=erik.frangez1)", scope "sub" >> (74) ldap1-vpn-student: Waiting for search result... >> (74) ldap1-vpn-student: User object found at DN "CN=Erik Frangez,OU=Users,OU=FERI,OU=UM,DC=loki,DC=um,DC=si" >> (74) [ldap1-vpn-student] = ok >> (74) } # redundant = ok >> (74) policy check_ldap_group_vpn_test { >> (74) if (ldap1-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") { >> (74) if (ldap1-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") -> FALSE >> (74) elsif (ldap2-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") { >> (74) elsif (ldap2-student-um-LDAP-Group == "CN=IDM_VPN,OU=Groups,OU=QUEST,OU=UM,DC=loki,DC=um,DC=si") -> FALSE >> (74) else { >> (74) [reject] = reject >> (74) } # else = reject >> (74) } # policy check_ldap_group_vpn_test = reject >> (74) } # Autz-Type LDAPS-VPN-STUDENT = reject >> (74) Invalid user: [erik.frangez1] (from client guard port 0) >> (74) Using Post-Auth-Type Reject >> (74) Post-Auth-Type sub-section not found. Ignoring. >> (74) Delaying response for 1.000000 seconds >> (74) Sending delayed response >> (74) Sent Access-Reject Id 42 from 164.8.100.71:21812 to 164.8.15.42:54972 length 20 >> (74) Cleaning up request packet ID 42 with timestamp +19 >> >> >> >> User is part of group IDM_VPN on domain LOKI... >> >> Thank you for help! >> >> Best, Erik >> >> On 11/28/21 7:33 PM, Alan DeKok wrote: >>> On Nov 28, 2021, at 12:32 PM, Erik Frangež via Freeradius-Users <freeradius-users(a)lists.freeradius.org> >>> wrote: >>> >>>> I am having problems with configuring Radius authentication limiting users to group in Active directory. >>>> >>>> Here is configuration of LDAP: >>>> >>> We don't need to see that. >>> >>> Read >>> http://wiki.freeradius.org/list-help >>> >>> >>> >>> >>>> In sites-enabled for radius, I have specify this: >>>> >>> We don't need to see that, either. >>> >>> >>>> Authentication is not working. Here are logs: >>>> >>> Part of the logs. But whatever... >>> >>> >>>> rlm_ldap (ldap1): Reserved connection (0) >>>> (392) ldap1: EXPAND (sAMAccountName=%{User-Name}) >>>> (392) ldap1: --> (sAMAccountName=user) >>>> (392) ldap1: Performing search in "ou=ou,dc=domain,dc=dc,dc=dc" with filter "(sAMAccountName=user)", scope "sub" >>>> (392) ldap1: Waiting for search result... >>>> (392) ldap1: User object found at DN "..." >>>> rlm_ldap (ldap1): Released connection (0) >>>> (392) [ldap1] = ok >>>> (392) } # redundant = ok >>>> (392) policy check_ldap_group_vpn { >>>> (392) if (&ldap1-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") { >>>> (392) Searching for user in group "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" >>>> >>> That seems wrong. "ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" ? Why the repetition? >>> >>> The default configuration works. The file mods-available/ldap has detailed instructions for getting it working with Active Directory. >>> >>> Follow the instructions, and it should work. >>> >>> >>>> User is member of group. Same configuration we are having for other domain and its working. >>>> >>> Is it *exactly* the same? i.e. with the same "ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" repetition? >>> >>> Alan DeKok. >>> >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html

2 1

FREERADIUS WITH MULTIPLE LDAP AUTHENTICATION SOURCES
by Diego Forcella 30 Nov '21

30 Nov '21

Hi all, I am trying to set up a single freeradius with multiple ldap servers to query. The goal is to have a single freeradius server authenticating users from different tenants. Ex: user(a)domain1.com must use only the ldap domain1 {} configuration user(a)domain2.com must use only the ldap domain2 {} configuration I configured the file /etc/freeradius/3.0/mods-available/ldap in order to have the 2 configurations ldap domain1 {} and ldap domain2 {} and the bind is correct The problem is that when I run a radtest the user is searched for both on domain1 and on domain2 and then the result is returned only for domain2 because it is the last one that is queried. I would like that if I make a query, domain1 or domain2 is used based on the suffix of the user I am querying I hope I was clear Thanks for your help Diego INFORMATIVA PRIVACY (Reg.UE 2016/679 e D.Lgs.196/2003) Questa email ed i suoi eventuali allegati sono da considerarsi materiale riservato e di proprietà della scrivente società. Nel caso venisse ricevuta per errore non deve essere divulgata, copiata o distribuita per alcuna ragione. Le comunicazioni che transitano attraverso il presente indirizzo di posta elettronica hanno carattere e finalità prettamente lavorative, pertanto potranno essere conosciute all’interno dell’organizzazione aziendale. Qualsiasi dato personale sarà comunque trattato in conformità alle vigenti normative in materia di privacy e protezione dei dati personali. A tale riguardo potete esercitare tutti i diritti previsti dalla legge semplicemente rispondendo alla presente ed esplicitando la vostra richiesta. Maggiori info in materia di privacy: https://www.c2group.it/policy-privacy

2 1

Seemingly obvious question
by Gregory Sloop 29 Nov '21

29 Nov '21

I'm running Ubuntu 20.04's packaged FR - and been happy with Enterprise-WPA using EAP-TLS on a single server - authenticating wireless clients. But we're putting more and more machines on E-WPA, and so the FR server becomes a critical resource. The obvious answer is to have two/multiple servers and that's a option in Unifi. (And most/all other Wifi AP's.) The question is: Since I'm just using certificates is there anything different that I really need to do, other than setting up the new server, essentially, identically to the first one? If I revoke certificates I understand I'll need to complete that process on both machines - essentially manually keeping them in sync. Do I have that right? (In this setup, both servers will use the same key and certificate - which means I can't revoke one and leave the other running, but that (revoking a server) really doesn't work anyway, since the clients don't look up a CRL somewhere reliable anyway. So, if I lose control of one of the servers, I'm screwed and will have to rebuild the entire PKI framework again, but that's going to happen even if I use different certs/keys for both servers. ...provided I conceptually understand things correctly.)

2 1

Problem with limiting users to group in Active Directory
by Erik Frangež 28 Nov '21

28 Nov '21

Hi guys, I am having problems with configuring Radius authentication limiting users to group in Active directory. Here is configuration of LDAP: ldap ldap1 { server = "Server" port = 389 identity = DOMAIN\user password = "password" basedn = "ou=OU,dc=domain,dc=dc,dc=dc" filter = "(sAMAccountName=%{User-Name})" groupmembership_filter = "(member=%{control:Ldap-UserDn})" groupmembership_attribute = "memberOf" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 user { filter = "(sAMAccountName=%{User-Name})" scope = "sub" base_dn = "ou=OU,dc=domain,dc=dc,dc=dc" access_positive = yes rebind = yes chase_referrals=yes } group { base_dn = "ou=OU,dc=domain,dc=dc,dc=dc" filter = "(sAMAccountName=%{User-Name})" scope = 'sub' membership_filter = "(member=%{control:Ldap-UserDn})" membership_attribute = 'memberOf' } tls { start_tls = no ca_file = "/etc/openldap/certs/ldap_certs.pem" require_cert = "demand" } dictionary_mapping = ${confdir}/ldap.attrmap keepalive { idle = 60 probes = 3 interval = 3 } } Policy: check_ldap_group_vpn { if (&ldap1-LDAP-Group[*] == "CN=group,OU=Groups,OU=OU,OU=OU,DC=DOMAIN,DC=DC,DC=DC") { ok } else { reject } } In sites-enabled for radius, I have specify this: authorize { suffix guard_vpn_file Autz-Type LDAPS-VPN { redundant { ldap1 ldap2 } check_ldap_group_vpn expiration } } Authentication is not working. Here are logs: rlm_ldap (ldap1): Reserved connection (0) (392) ldap1: EXPAND (sAMAccountName=%{User-Name}) (392) ldap1: --> (sAMAccountName=user) (392) ldap1: Performing search in "ou=ou,dc=domain,dc=dc,dc=dc" with filter "(sAMAccountName=user)", scope "sub" (392) ldap1: Waiting for search result... (392) ldap1: User object found at DN "..." rlm_ldap (ldap1): Released connection (0) (392) [ldap1] = ok (392) } # redundant = ok (392) policy check_ldap_group_vpn { (392) if (&ldap1-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") { (392) Searching for user in group "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" rlm_ldap (ldap1): Reserved connection (0) (392) Using user DN from request "CN=user" rlm_ldap (ldap1): Released connection (0) (392) User is not a member of "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" (392) if (&ldap1-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") -> FALSE (392) elsif (&ldap2-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") { (392) Searching for user in group "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" rlm_ldap (ldap2): Reserved connection (0) (392) Using user DN from request "CN=user" rlm_ldap (ldap2): Released connection (0) (392) User is not a member of "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc" (392) elsif (&ldap2-LDAP-Group[*] == "cn=group,ou=groups,ou=ou,ou=ou,dc=dc,dc=dc,dc=dc") -> FALSE (392) else { (392) [reject] = reject (392) } # else = reject (392) } # policy check_ldap_group_vpn = reject (392) } # Autz-Type LDAPS-VPN = reject User is member of group. Same configuration we are having for other domain and its working. Thank you for any advise! Best, Erik

2 1

Freeradius 3.0.22 - mssql - Schema
by Clive Allen 28 Nov '21

28 Nov '21

Hi, I noticed that the mssql schema does not include a "nas" section that the "mysql" contains as follows: CREATE TABLE IF NOT EXISTS nas ( id int(10) NOT NULL auto_increment, nasname varchar(128) NOT NULL, shortname varchar(32), type varchar(30) DEFAULT 'other', ports int(5), secret varchar(60) DEFAULT 'secret' NOT NULL, server varchar(64), community varchar(50), description varchar(200) DEFAULT 'RADIUS Client', PRIMARY KEY (id), KEY nasname (nasname) ); I have converted this to "mssql" staments and created the nas table. However, the radtest that has proved successful does not seem to take any of the nas table entries but does take the username. For example, if I use the following inputs into the "nas" table: Server = <freeradius box> Shortname = <ServerName> Secret = secret User details: clive test123 := Cleartext-Password And then I utilise radtest as follows: radtest clive test123 localhost 1812 secret ---- I can try any combination here of localhost, IP address or name and get the same result. It does not even pass to mssql (no response at all). However, if I use the following: radtest clive test123 localhost 1 testing123 I get an access-accept. So, my question is - Does mssql with freeradius accept a "nas" table please?

1 1

rlm_sql_unixodbc: Errors
by Clive Allen 27 Nov '21

27 Nov '21

Hi Alan, Many apologies for not responding to your response to my issue. It was excellent that you responded so quickly. I have resolved the issue and mailing here so it will be available if anyone else has the same problem. For some reason, and unsure why, after following Microsofts installation process for the unix and ms - odbc drivers and then following the freeradius instructions for odbc installation it looked like the drivers were not present when running radius -X (even though unixodbc and msodbc were there afetr confirming). The way the issue was resolved was by completing the following: yum list freeradius-* We get the following appearing in the list: freeradius-unixODBC.x86_64 yum install freeradius-unixODBC.x86_64 I restarted mssql-server as a precaution and then ran radiusd -X and everything worked. I completed a radtest and got successful accept packet returned. Thank you for you help Alan. Very much appreciated. I do have another question but will ask that in a separate mail. Thank you again.

1 0

Proxy
by Nicolas Breuer 25 Nov '21

25 Nov '21

Hello, According to the doc https://wiki.freeradius.org/config/Proxy ......... * he remote server replies with ACK or REJECT * On ACK: The initial Auth-Type is set to Accept * On REJECT: The initial Auth-Type is set to Reject * Then the users file is processed as usual. The username used at this point is the one after hints file processing (regardless of the "hints" option). It also includes the realm (regardless of the setting of the "nostrip" option) unless the realm is LOCAL. ........... Waking up in 0.3 seconds. (0) Marking home server 217. port 1649 alive (0) Clearing existing &reply: attributes (0) Received Access-Accept Id 112 from NAS (0) Service-Type = Framed-User (0) Cisco-AVPair = "ip:vrf-id=BEXX" (0) Cisco-AVPair = "ip:ip-unnumbered=Loopback22" (0) Framed-IP-Netmask = 255.255.255.255 (0) Proxy-State = 0x3936 (0) Framed-IP-Address = ZZZ (0) Session-Timeout = 172800 (0) server dsl { (0) # Executing section post-proxy from file /etc/raddb/config/... (0) post-proxy { (0) post_proxy_log: --> Thu Nov 25 14:48:24 2021 (0) [post_proxy_log] = ok (0) attr_filter.post-proxy: EXPAND %{Realm} (0) attr_filter.post-proxy: --> BE (0) attr_filter.post-proxy: Matched entry DEFAULT at line 106 (0) [attr_filter.post-proxy] = updated (0) } # post-proxy = updated (0) } (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/raddb/config/ (0) post-auth { (0) if (&reply:Subscription-Name=="PRO"){ (0) ERROR: Failed retrieving values required to evaluate condition (0) if (&reply:Subscription-Name=="NOSERVICE"){ (0) ERROR: Failed retrieving values required to evaluate condition (0) elsif (&reply:Subscription-Name != '') { (0) ERROR: Failed retrieving values required to evaluate condition (0) update reply { (0) Service-Type := Framed-User (0) Framed-IP-Netmask := 255.255.255.255 (0) } # update reply = noop (0) if (reply:Framed-IP-Address) { (0) if (reply:Framed-IP-Address) -> FALSE (0) else { (0) update reply { (0) Session-Timeout = 172800 (0) } # update reply = noop (0) } # else = noop (0) } # post-auth = noop (0) Login OK: [BCtest@BXXX] (from client test port 0) (0) Sent Access-Accept Id 96 from (0) Framed-IP-Netmask := 255.255.255.255 (0) Service-Type := Framed-User (0) Session-Timeout = 172800 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 96 with timestamp +8 Ready to process requests In users I have a match before the proxy (0) [suffix] = updated (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 54 (0) auth_dsl: users: Matched entry DEFAULT at line 79 (0) [auth_dsl] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop But this is not applied at all after the accept.... Any ideas ?

2 8

rlm_sql_unixodbc: Driver Link failure when running radiusd -X
by Clive Allen 25 Nov '21

25 Nov '21

Hello all, Firstly, my apologies if this is not freeradius related but am hoping someone may have seen this before or could point me in the right direction please: I am trying to connect to an mssql database with freeradius on redhat. When running radiusd -X I am getting the following readout (error): Nov 25 13:40:27 rhmssql1 radiusd[7698]: Creating attribute Unix-Group Nov 25 13:40:27 rhmssql1 radiusd[7698]: Could not link driver rlm_sql_unixodbc: /usr/lib64/freeradius/rlm_sql_unixodbc.so: cannot open shared object file: No such file or directory Nov 25 13:40:27 rhmssql1 radiusd[7698]: Make sure it (and all its dependent libraries!) are in the search path of your system's Nov 25 13:40:27 rhmssql1 radiusd[7698]: /etc/raddb/mods-enabled/sql[27]: Instantiation failed for module "sql" Nov 25 13:40:27 rhmssql1 systemd[1]: radiusd.service: control process exited, code=exited status=1 Nov 25 13:40:27 rhmssql1 systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. -- Subject: Unit radiusd.service has failed I have checked the directory /usr/lib64/freeradius/ and sure enough the file rlm_sql_unixodbc.so does not exist there. I have tested with isql -v rhmssql1 radius radPass_123 and that works fine. I can also access the DB with either radius or SA. I have configured /etc/odbc.ini with the following: [rhmssql1] Driver = ODBC Driver 17 for SQL Server Description=My DSN for the FreeRADIUS Database Database = radius Server = tcp:192.168.56.167,1433 The Driver section in here should then point to the relevant part in odbcinst.ini which is configured as follows: [ODBC Driver 13 for SQL Server] Description=Microsoft ODBC Driver 13 for SQL Server Driver=/opt/microsoft/msodbcsql/lib64/libmsodbcsql-13.1.so.9.2 UsageCount=1 [ODBC Driver 17 for SQL Server] Description=Microsoft ODBC Driver 17 for SQL Server Driver=/opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.8.so.1.2 UsageCount=1 I have checked the locations as follows: [root@rhmssql1 lib64]# ldd /opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.8.so.1.2 linux-vdso.so.1 => (0x00007ffd793f3000) libdl.so.2 => /lib64/libdl.so.2 (0x00007fc7c12fa000) librt.so.1 => /lib64/librt.so.1 (0x00007fc7c10f2000) libodbcinst.so.2 => /lib64/libodbcinst.so.2 (0x00007fc7c0ed8000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007fc7c0bef000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007fc7c09a2000) libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fc7c069a000) libm.so.6 => /lib64/libm.so.6 (0x00007fc7c0398000) libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fc7c0182000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fc7bff66000) libc.so.6 => /lib64/libc.so.6 (0x00007fc7bfb98000) /lib64/ld-linux-x86-64.so.2 (0x00007fc7c190a000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007fc7bf965000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007fc7bf761000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007fc7bf551000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007fc7bf34d000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fc7bf133000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fc7bef0c000) libpcre.so.1 => /lib64/libpcre.so.1 (0x00007fc7becaa000) I have ensured that the link is correct with: [root@rhmssql1 lib64]# odbcinst -q -d -n "ODBC Driver 17 for SQL Server" [ODBC Driver 17 for SQL Server] Description=Microsoft ODBC Driver 17 for SQL Server Driver=/opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.8.so.1.2 UsageCount=1 I have also followed the excellent process doument at https://wiki.freeradius.org/modules/Rlm_sql_unixodbc and everything works as should except the very last stage (start up of freeradius). Excuse my picking up on this as it is a typo I expect - but in there you have labelled port "1443" under the DSN (Section 4:Server = tcp:192.0.2.1, 1443 and suspect you meant 1433). In the /etc/raddb/mods-available - I completed the following changes: sql { dialect = "mssql" driver = "rlm_sql_unixodbc" # driver = "rlm_sql_${dialect}" # Connection info: # server = "rhmssql1" port = 1433 login = "radius" password = "radPass_123" Again, many apologies if the answer to this is obvious (which I know it is from the error) but this e-mail has been a last resort. There are articles on the wiki but they are from 2007 and 2008. I have completed a "find" for the named file and cannot find it "find / -name "*rlm_sql*" Thank you for any pointers.

2 1

detail file locking
by Thor Spruyt 25 Nov '21

25 Nov '21

Hi, Using freeradius 3.0.25 on centos 7 I have a configuration with a "detail" module writing to a file with locking = yes I have a type = detail listener on that same file. Under some load, apparantly, very sporadically a packet seems to gets lost. Am I correct to say that with locking = yes , there should never be any packet lost due to the reader renaming the file while the writer is writing to it ? How would be a good approach to further troubleshoot this ? -- Regards, Thor

2 12

(no subject)
by Giedrius Baronas 24 Nov '21

24 Nov '21

Hi, I read a manual about comparisons. If I write IP without network mask then it works but if IP with mask I get error Maybe who sees where I make a mistake? >From https://freeradius.org/radiusd/man/unlang.txt Comparisons (foo == bar) Compares 'foo' to 'bar', and evaluates to true if the comparison holds true. Valid comparison operators are "==", "!=", "<", "<=", ">", ">=", "=~", and "!~", all with their usual meanings. The operators ":=" and "=" are assignment oper- ators, and are not allowed for comparisons. The operators "<", "<=", ">", and ">=" are also allowed for checking that an IP address is contained within a network. For example: if (<ipaddr>192.0.2.1 < 192.0.2.0/24) { This com- parison succeeds, because the address 192.0.2.1 is contained within the network 192.0.2.0/24. My debug: Wed Nov 24 21:35:27 2021 : Debug: (1) if ( <ipaddr>NAS-IP-Address == 192.0.2.0/24 ){Wed Nov 24 21:35:27 2021 : ERROR: (1) Failed casting rhs operand: Invalid IPv4 mask length "/24". Only "/32" permitted for non-prefix typesWed Nov 24 21:35:27 2021 : ERROR: (1) Failed retrieving values required to evaluate condition -- Pagarbiai, Giedrius 861569551

2 2