- Freeradius-Users - lists.freeradius.org

If statement for two different sql queries
by Giedrius Baronas 12 Oct '21

12 Oct '21

Hi, I need help to split it radreply to two different queries. I have a two different queries:DHCP message and ARP message For examples ARP query (1) Received Access-Request Id 93 from 10.10.10.2:64387 to 10.10.10.3:1812 (1) User-Name = "d4:ca:6d:0a:94:5b" (1) User-Password = "password" (1) NAS-IP-Address = 10.10.10.10 (1) ADSL-Agent-Circuit-Id = "192.168.0.100" (1) NAS-Port-Type = Ethernet (1) NAS-Port-Id = "lag-1:1000" DHCP query (2) Received Access-Request Id 94 from 10.10.10.2:54337 to 10.10.10.3:1812 (2) User-Name = "d4:ca:6d:0a:94:5b" (2) User-Password = "password" (2) NAS-IP-Address = 10.10.10.10 (2) ADSL-Agent-Remote-Id = "5888" (2) NAS-Port-Type = Ethernet (2) NAS-Port-Id = "lag-1:1000" I wrote IF statement in default file authorize section authorize { (...) if(ADSL-Agent-Circuit-Id) { if(ADSL-Agent-Circuit-Id =~ /.+\..+\..+\..+/) { update request { (???) } }else{ update request { (???) } } } sql I think I will use multiple instances for different rad_replay queries. Is this a bad idea? Is it possible to create just two queries.conf files with different queries? -- Pagarbiai, Giedrius

2 5

Manage client in LDAP...
by Marco Gaiarin 12 Oct '21

12 Oct '21

I'm not an expert on freeradius, but at work i manage successfully a setup with freeradius binded to an AD domain, successfully autheticate wireless clients with MSCHAPv2. At home i need to extend my wireless coverage (for now, i use an hostapd and a wireless interface in my server), and so i've thinked about using LDAP as a source for auth data, using as AP some OpenWRT/LEDE routers. Yes, i can use WPA/WPA2 personal, but i want to experiment and continue to assign different credential for different MAC addess. ;) I've found the basic setup info on: https://wiki.freeradius.org/modules/Rlm_ldap and some other info on how add clients to the LDAP on: https://www.ldap-account-manager.org/static/doc/manual-onePage/index.html#i… Also i've found some forum/blog pages around, but all seems to be about freeradius 2, and does not provide clues on why (at least to me). For example, i suppose i have to use WPA2-Enterprise with EAP-TTLS, but i've not found a place that clarify if the password in LDAP have to be 'in clear', or hashed, and how hashed. Someone have some info, or a good link? Thanks. -- There are only 10 kinds of people in the world -- Those who understand binary, and those who don't. (Roberto Maglica)

2 2

What is the purpose of the default accounting-on/off queries?
by Antônio Modesto 11 Oct '21

11 Oct '21

Hello everyone, I have two questions: 1) What is the purpose of the default accounting-on and accounting-off queries bundled with freeradius? I am asking this because one of my customer's NAS is sending accounting-on packets for no reason, and Freeradius is closing the sessions with the 'NAS-Reboot' Acct-Terminate-Cause. I was thinking about disabling the accounting-on query altogether, and leaving only the accounting-off. Are there any side effects by doing this? 2) Does Freeradius use accounting-off packets to release IPs allocated in the sqlippool? Regards -- Att, *Antônio Modesto*

4 12

We need excellent and well-written documentation for setting up open source RADIUS Server
by Turritopsis Dohrnii Teo En Ming 09 Oct '21

09 Oct '21

Subject: We need excellent and well-written documentation for setting up open source RADIUS Server Good day from Singapore, Our company, which is a Systems Integrator (SI) in Singapore, is evaluating various open source RADIUS servers. We need excellent and well-written documentation for your open source RADIUS server. Please provide us with links on how to setup your open source RADIUS server. We are looking forward to your replies. Thank you very much for your kind assistance. Mr. Turritopsis Dohrnii Teo En Ming, 43 years old as of 9 October 2021, is a TARGETED INDIVIDUAL living in Singapore. He is an IT Consultant with a System Integrator (SI)/computer firm in Singapore. He is an IT enthusiast. -----BEGIN EMAIL SIGNATURE----- The Gospel for all Targeted Individuals (TIs): [The New York Times] Microwave Weapons Are Prime Suspect in Ills of U.S. Embassy Workers Link: https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba-microwave.html ******************************************************************************************** Singaporean Targeted Individual Mr. Turritopsis Dohrnii Teo En Ming's Academic Qualifications as at 14 Feb 2019 and refugee seeking attempts at the United Nations Refugee Agency Bangkok (21 Mar 2017), in Taiwan (5 Aug 2019) and Australia (25 Dec 2019 to 9 Jan 2020): [1] https://tdtemcerts.wordpress.com/ [2] https://tdtemcerts.blogspot.sg/ [3] https://www.scribd.com/user/270125049/Teo-En-Ming -----END EMAIL SIGNATURE-----

1 0

detail logs with filebeat, elasticsearch and Kibana
by Lineconnect 08 Oct '21

08 Oct '21

Hi there, i found a nice way to get the detailed logs of FreeRADIUS into elasticsearch and want to share it with you: After reading some of the old threads/presentations(e.g. http://lists.freeradius.org/pipermail/freeradius-users/2018-April/091415.htm or https://www.slideshare.net/MatthewNewton28/freeradius-eduroam-logging-and-e…) i pretty much copied this approach, to get the detail log into a json format because there is currenlty no module for the default FreeRADIUS logs. It works in general very good but has the disadvantage to get empyt fields in elasticsearch because not all the fields filled at each time, when the linelog module was called(may just my problem) and you properly will not see any vendor specific RADIUS attribute as long you're not updating your linelog module. The default FreeRADIUS detail log does only contain key-value pairs which are filled(obviously). To let FreeRADIUS write the detail log with the linemodule you can do something like this(found in the eduroam documentation(https://wiki.freeradius.org/guide/eduroam#configuration_the-o…: ```` linelog log_reply { filename = ${logfile} permissions = 0644 reference = "messages.%{%{reply:Packet-Type}:-format}" messages { Access-Accept = "%{pairs:request:}" Access-Reject = "%{pairs:request:}" } } ```` Now the log which is written by linelog looks like this: ```` User-Name = "anonymous", NAS-IP-Address = 127.0.0.1, Calling-Station-Id = "02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11, Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b", EAP-Message = 0x0200000e01616e6f6e796d6f7573, Message-Authenticator = 0x77ad754adf2d2dee13cfc20cb5f02c74, EAP-Type = Identity ```` To get all of the attributes parsed in elasticsearch as field and value you can use a ingest pipeline and the key-value module - https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest.html - https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html The api request to elastic could be look like this: ```` PUT _ingest/pipeline/radius-log-parsing { "description" : "Parse radius log", "processors" : [ { "kv": { "field": "message", "field_split": ", ", "value_split": " = " } } ] } ```` And if you're using filebeat as logshipper, you can reference that pipeline in your input configuration, so it could look like this: ```` - type: log paths: - /var/log/freeradius/radius-detail.log ignore_older: 5m pipeline: "radius-log-parsing" tags: ['detail'] ```` Hope this helps someone how's trying to get dynamic field in elastic for the FreeRADIUS detail log. Best regards, Lineconnect

1 0

eap-tls certificates
by Munroe Sollog 08 Oct '21

08 Oct '21

I'm reading: http://deployingradius.com/documents/configuration/certificates.html It mentions, "You need to edit client.cnf only if you are using EAP-TLS. If not, then that file can be left as-is." Though it doesn't say, I'm assuming i need to edit the [req] and [client] sections? For the [client] section, do I need an entry for every unique client I plan on deploying a certificate to? I'm asking because I don't understand the emailAddress and commonName fields in this context. Finally, is there any documentation on how to scale this solution up to support 15k-20k users? I'm hoping something like LDAP or RDBMS is an option? -- Munroe Sollog (He/Him/His) Network Architect munroe(a)lehigh.edu

2 2

Version 3.0 and 3.2
by Alan DeKok 08 Oct '21

08 Oct '21

Matthew has tagged version 3.2 here: https://github.com/FreeRADIUS/freeradius-server/tree/v3.2.x We will use 3.2 as the new "minor features" branch. Matthew has already pulled in a few PRs. Version 3.2 (and any later 3.x) will also be 99.99% compatible with 3.0. So the upgrade process will be painless. We have now marked 3.0 as "security and bug fixes only". There will be no new features in 3.0. We will continue to maintain both the 3.0 and 3.2 branches for the foreseeable future. Alan DeKok.

1 0

"0x" in front of Clear-text password
by Eric Aguilar 08 Oct '21

08 Oct '21

Hello, We have Freeradius 3 running successfully - we updated from Freeradius 2 a couple months ago. We encountered a problem with NAS running Coovachilli for captive portal authentication which was working before. Even if the uamsecret is not set SQL logs the radcheck attempt with the correct password but with a leading "0x" - it seems it is rejecting the access request due to that 0x being in front. Is there a way to modify freeradius to strip that "0x" so that we can get successful authentication or maybe force taking CHAP-Password parameter as User-Password? Please let me know if I should ask differently or include some more information. Here is the debug file: Ready to process requests (0) Received Access-Request Id 60 from 187.168.34.159:48641 to 172.31.36.39:1812 length 162 (0) User-Name = "06-CC-C6-1E-6B-09" (0) CHAP-Password = 0x7c2e341f7fa12820b2605223bac6c307 (0) CHAP-Challenge = 0x047808cb6d147b8d77d3116a0cfa6498 (0) Calling-Station-Id = "06-CC-C6-1E-6B-09" (0) Called-Station-Id = "00-1A-DD-7A-E1-80" (0) Service-Type = Login-User (0) NAS-Port-Type = Wireless-802.11 (0) NAS-Identifier = "myNas" (0) Acct-Session-Id = "615f44bb00000000" (0) NAS-Port = 0 (0) NAS-IP-Address = 192.168.101.166 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "06-CC-C6-1E-6B-09", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> 06-CC-C6-1E-6B-09 (0) sql: SQL-User-Name set to '06-CC-C6-1E-6B-09' rlm_sql (sql): Closing connection (0): Hit idle_timeout, was idle for 78 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 78 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 78 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 78 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 78 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 78 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (6): Hit idle_timeout, was idle for 78 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 78 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (8): Hit idle_timeout, was idle for 78 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (9): Hit idle_timeout, was idle for 78 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (10), 1 of 128 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on radiuscg.us-east-2.rds.amazonaws.com via TCP/IP, server version 5.7.33-log, protocol version 10 rlm_sql (sql): Reserved connection (10) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '06-CC-C6-1E-6B-09' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '06-CC-C6-1E-6B-09' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "7c2e341f7fa12820b2605223bac6c307" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '06-CC-C6-1E-6B-09' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '06-CC-C6-1E-6B-09' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = '06-CC-C6-1E-6B-09' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '06-CC-C6-1E-6B-09' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (10) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (11), 1 of 127 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on radiuscg.us-east-2.rds.amazonaws.com via TCP/IP, server version 5.7.33-log, protocol version 10 (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: No User-Password attribute in the request. Cannot do PAP (0) [pap] = noop (0) } # authorize = ok (0) WARNING: Please update your configuration, and remove 'Auth-Type = Local' (0) WARNING: Use the PAP or CHAP modules instead (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (10) (0) sql: EXPAND %{User-Name} (0) sql: --> 06-CC-C6-1E-6B-09 (0) sql: SQL-User-Name set to '06-CC-C6-1E-6B-09' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '06-CC-C6-1E-6B-09', '0x7c2e341f7fa12820b2605223bac6c307', 'Access-Reject', '2021-10-07 19:04:27.702763') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '06-CC-C6-1E-6B-09', '0x7c2e341f7fa12820b2605223bac6c307', 'Access-Reject', '2021-10-07 19:04:27.702763') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (10) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> 06-CC-C6-1E-6B-09 (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.7 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 60 from 172.31.36.39:1812 to 187.168.34.159:48641 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 60 with timestamp +78 Ready to process requests (1) Received Accounting-Request Id 60 from 201.113.6.173:5630 to 172.31.36.39:1813 length 169 (1) Acct-Status-Type = Start (1) NAS-Port-Type = Wireless-802.11 (1) Calling-Station-Id = "D4:62:EA:42:E1:E2" (1) Called-Station-Id = "6C:3B:6B:FA:1A:8F" (1) NAS-Port-Id = "hotspot" (1) User-Name = "D4-62-EA-42-E1-E2" (1) NAS-Port = 2153812177 (1) Acct-Session-Id = "806090d1" (1) Framed-IP-Address = 10.5.50.164 (1) Mikrotik-Host-IP = 10.5.50.164 (1) Event-Timestamp = "Oct 7 2021 19:11:03 UTC" (1) NAS-Identifier = "6C:3B:6B:FA:1A:8F" (1) Acct-Delay-Time = 0 (1) NAS-IP-Address = 192.168.1.67 (1) # Executing section preacct from file /etc/raddb/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) policy acct_unique { (1) update request { (1) &Tmp-String-9 := "ai:" (1) } # update request = noop (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (1) EXPAND %{hex:&Class} (1) --> (1) EXPAND ^%{hex:&Tmp-String-9} (1) --> ^61693a (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> 7f054881202d112c62658b7b3b7c059e (1) &Acct-Unique-Session-Id := 7f054881202d112c62658b7b3b7c059e (1) } # update request = noop (1) } # else = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "D4-62-EA-42-E1-E2", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /etc/raddb/sites-enabled/default (1) accounting { (1) detail: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (1) detail: --> /var/log/radius/radacct/201.113.6.173/detail-20211007 (1) detail: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/201.113.6.173/detail-20211007 (1) detail: EXPAND %t (1) detail: --> Thu Oct 7 19:12:44 2021 (1) [detail] = ok (1) [unix] = ok (1) sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (1) sql: --> type.start.query (1) sql: Using query template 'query' rlm_sql (sql): Closing connection (11): Hit idle_timeout, was idle for 497 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (10): Hit idle_timeout, was idle for 497 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (12), 1 of 128 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on radiuscg.us-east-2.rds.amazonaws.com via TCP/IP, server version 5.7.33-log, protocol version 10 rlm_sql (sql): Reserved connection (12) (1) sql: EXPAND %{User-Name} (1) sql: --> D4-62-EA-42-E1-E2 (1) sql: SQL-User-Name set to 'D4-62-EA-42-E1-E2' (1) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (1) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('806090d1', '7f054881202d112c62658b7b3b7c059e', 'D4-62-EA-42-E1-E2', '', '192.168.1.67', 'hotspot', 'Wireless-802.11', FROM_UNIXTIME(1633633863), FROM_UNIXTIME(1633633863), NULL, '0', '', '', '', '0', '0', '6C:3B:6B:FA:1A:8F', 'D4:62:EA:42:E1:E2', '', '', '', '10.5.50.164') (1) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('806090d1', '7f054881202d112c62658b7b3b7c059e', 'D4-62-EA-42-E1-E2', '', '192.168.1.67', 'hotspot', 'Wireless-802.11', FROM_UNIXTIME(1633633863), FROM_UNIXTIME(1633633863), NULL, '0', '', '', '', '0', '0', '6C:3B:6B:FA:1A:8F', 'D4:62:EA:42:E1:E2', '', '', '', '10.5.50.164') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (12) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (13), 1 of 127 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on radiuscg.us-east-2.rds.amazonaws.com via TCP/IP, server version 5.7.33-log, protocol version 10 (1) [sql] = ok (1) [exec] = noop (1) attr_filter.accounting_response: EXPAND %{User-Name} (1) attr_filter.accounting_response: --> D4-62-EA-42-E1-E2 (1) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated (1) Sent Accounting-Response Id 60 from 172.31.36.39:1813 to 201.113.6.173:5630 length 0 (1) Finished request (1) Cleaning up request packet ID 60 with timestamp +575 Ready to process requests

2 1

Version 3.0.25 has been released
by Matthew Newton 07 Oct '21

07 Oct '21

We have released version 3.0.25 today. Thanks everyone for your patience after the issues with 3.0.24 - hopefully not repeated this time... This is a bugfix release. - `correct_escapes` has been added back into the default configuration. - A segfault when trying to proxy to zombie home servers has been fixed. - A number of other small bugs and compiler warnings were fixed. - Added support for building with PostgreSQL 14. Many thanks to those who helped track down the segfault, which was particularly tricky and took a number of days to trigger. It had been added as part of another bug fix. :( Packages, Docker images and source tarballs are all available in the usual places. https://packages.networkradius.com/ https://freeradius.org/releases/ ftp://ftp.freeradius.org/pub/freeradius/ -- Matthew

2 1

Commercial support needed
by David Baird 07 Oct '21

07 Oct '21

Hello, I work for a K12 school district. We have a functional freeradius setup providing authentication to our Aruba wireless network. Unfortunately, the technician who set up and managed both the wireless network and radius left suddenly a few weeks ago with no notice and no knowledge transfer. I am looking for an expert to help us overcome an immediate need to enable 2 additional wireless controllers to communicate with our radius servers. Any advice or assistance would be greatly appreciated! Sincerely, Dave Baird Network Admin Olympia School District

2 1