- Freeradius-Users - lists.freeradius.org

Filter-ID reply with Raritan KVMs
by Jonathan Davis 30 Aug '21

30 Aug '21

I'm trying to setup Radius with Raritan KVMs. Authentication works, Access-Accept is sent, but I'm having trouble with the Filter-Id. The Raritan documentaion states: When a RADIUS authentication attempt succeeds, the Dominion KX II device determines the permissions for a given user based on the permissions of the user's group. Your remote RADIUS server can provide these user group names by returning an attribute, implemented as a RADIUS FILTER-ID. The FILTER-ID should be formatted as follows: Raritan:G{GROUP_NAME} where GROUP_NAME is a string, denoting the name of the group to which the user belongs. Before starting to implement the groups in SQL, I wanted to test Radius with them, so I updated my virtual server as follows: server raritan { authorize { filter_username update control { Pam-Auth := "radiusd_%{Client-Shortname}" } preprocess auth_log chap files -sql pap } authenticate { Auth-Type PAP { pam if (&User-Password =~ /^(.*)(.{44})$/) { update request { &User-Password := "%{1}" } } pap } } post-auth { exec update reply { &Filter-Id = "Raritan:G{Admin}" } } } Admin user exists on the Raritan, and is part of the Admin group (defaults on the device). I feel like I'm missing something obvious, but I've been looking at https://freeradius.org/rfc/rfc2865.html#Filter-Id and it doesn't seem like there is really all that much to mess with? Debug Log: FreeRADIUS Version 3.0.20 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/clients.conf including configuration file /etc/freeradius/3.0/mods-enabled/sql including configuration file /etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/pam including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/expr including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/control including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/raritans including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel main { security { user = "root" group = "root" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.10 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client raritan_b11_tor1 { ipaddr = 67.223.108.2 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" virtual_server = "raritan" proto = "*" limit { max_connections = 32 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = PAP # Creating Auth-Type = CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/3.0/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" logfile = "/var/log/freeradius/sqllog.sql" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_pam # Loading module "pam" from file /etc/freeradius/3.0/mods-enabled/pam pam { pam_auth = "radiusd" } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } instantiate { } # Instantiating module "sql" from file /etc/freeradius/3.0/mods-enabled/sql rlm_sql_mysql: libmysql version: 8.0.26 mysql { tls { tls_required = no check_cert = no check_cert_cn = no } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default server raritan { # from file /etc/freeradius/3.0/sites-enabled/raritans # Loading authenticate {...} # Loading authorize {...} # Loading post-auth {...} } # server raritan server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Ready to process requests (0) Received Access-Request Id 160 from 67.223.108.2:32779 to 173.237.216.130:1812 length 127 (0) NAS-Port-Type = Virtual (0) NAS-IP-Address = 67.223.108.2 (0) User-Name = "admin" (0) Acct-Session-Id = "1462612d3441729d9bc2" (0) User-Password = "passencryptedccccccvknngtngebtgvkffdclfcdfekfcfthtehgrbev" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/raritans (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) update control { (0) EXPAND radiusd_%{Client-Shortname} (0) --> radiusd_raritan_b11_tor1 (0) Pam-Auth := radiusd_raritan_b11_tor1 (0) } # update control = noop (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/67.223.108.2/auth-detail-20210830 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/67.223.108.2/auth-detail-20210830 (0) auth_log: EXPAND %t (0) auth_log: --> Mon Aug 30 19:40:49 2021 (0) [auth_log] = ok (0) [chap] = noop (0) files: users: Matched entry admin at line 91 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> admin (0) sql: SQL-User-Name set to 'admin' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'admin' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'admin' ORDER BY id (0) sql: WARNING: User not found in radcheck table. rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'admin' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'admin' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (0) (0) [sql] = notfound (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/raritans (0) Auth-Type PAP { (0) pam: Using pamauth string "radiusd_raritan_b11_tor1" for pam.conf lookup debug: pam_yubico.c:933 (parse_cfg): called. debug: pam_yubico.c:934 (parse_cfg): flags 0 argc 3 debug: pam_yubico.c:936 (parse_cfg): argv[0]=id=66772 debug: pam_yubico.c:936 (parse_cfg): argv[1]=debug debug: pam_yubico.c:936 (parse_cfg): argv[2]=authfile=/etc/yubikey_mappings/raritan_b11_tor1 debug: pam_yubico.c:937 (parse_cfg): id=66772 debug: pam_yubico.c:938 (parse_cfg): key=(null) debug: pam_yubico.c:939 (parse_cfg): debug=1 debug: pam_yubico.c:940 (parse_cfg): debug_file=1 debug: pam_yubico.c:941 (parse_cfg): alwaysok=0 debug: pam_yubico.c:942 (parse_cfg): verbose_otp=0 debug: pam_yubico.c:943 (parse_cfg): try_first_pass=0 debug: pam_yubico.c:944 (parse_cfg): use_first_pass=0 debug: pam_yubico.c:945 (parse_cfg): always_prompt=0 debug: pam_yubico.c:946 (parse_cfg): nullok=0 debug: pam_yubico.c:947 (parse_cfg): ldap_starttls=0 debug: pam_yubico.c:948 (parse_cfg): ldap_bind_as_user=0 debug: pam_yubico.c:949 (parse_cfg): authfile=/etc/yubikey_mappings/raritan_b11_tor1 debug: pam_yubico.c:950 (parse_cfg): ldapserver=(null) debug: pam_yubico.c:951 (parse_cfg): ldap_uri=(null) debug: pam_yubico.c:952 (parse_cfg): ldap_bind_user=(null) debug: pam_yubico.c:953 (parse_cfg): ldap_bind_password=(null) debug: pam_yubico.c:954 (parse_cfg): ldap_filter=(null) debug: pam_yubico.c:955 (parse_cfg): ldap_cacertfile=(null) debug: pam_yubico.c:956 (parse_cfg): ldapdn=(null) debug: pam_yubico.c:957 (parse_cfg): ldap_clientcertfile=(null) debug: pam_yubico.c:958 (parse_cfg): ldap_clientkeyfile=(null) debug: pam_yubico.c:959 (parse_cfg): user_attr=(null) debug: pam_yubico.c:960 (parse_cfg): yubi_attr=(null) debug: pam_yubico.c:961 (parse_cfg): yubi_attr_prefix=(null) debug: pam_yubico.c:962 (parse_cfg): url=(null) debug: pam_yubico.c:963 (parse_cfg): urllist=(null) debug: pam_yubico.c:964 (parse_cfg): capath=(null) debug: pam_yubico.c:965 (parse_cfg): cainfo=(null) debug: pam_yubico.c:966 (parse_cfg): proxy=(null) debug: pam_yubico.c:967 (parse_cfg): token_id_length=12 debug: pam_yubico.c:968 (parse_cfg): mode=client debug: pam_yubico.c:969 (parse_cfg): chalresp_path=(null) debug: pam_yubico.c:970 (parse_cfg): mysql_server=(null) debug: pam_yubico.c:971 (parse_cfg): mysql_port=0 debug: pam_yubico.c:972 (parse_cfg): mysql_user=(null) debug: pam_yubico.c:973 (parse_cfg): mysql_database=(null) debug: pam_yubico.c:1009 (pam_sm_authenticate): pam_yubico version: 2.27 debug: pam_yubico.c:1024 (pam_sm_authenticate): get user returned: admin debug: pam_yubico.c:190 (authorize_user_token): Using system-wide auth_file /etc/yubikey_mappings/raritan_b11_tor1 debug: util.c:351 (check_user_token): Authorization line: admin:ccccccudtfrl:ccccccudtfrn:ccccccvknngt:ccccccudtfre:cccccctrufvg debug: util.c:356 (check_user_token): Matched user: admin debug: util.c:362 (check_user_token): Authorization token: ccccccudtfrl debug: util.c:362 (check_user_token): Authorization token: ccccccudtfrn debug: util.c:362 (check_user_token): Authorization token: ccccccvknngt debug: util.c:362 (check_user_token): Authorization token: ccccccudtfre debug: util.c:362 (check_user_token): Authorization token: cccccctrufvg debug: util.c:362 (check_user_token): Authorization token: (null) debug: util.c:351 (check_user_token): Authorization line: port1:ccccccudtfrl:ccccccudtfrn:ccccccvknngt:ccccccudtfre:cccccctrufvg debug: pam_yubico.c:1146 (pam_sm_authenticate): Tokens found for user debug: pam_yubico.c:1209 (pam_sm_authenticate): conv returned 57 bytes debug: pam_yubico.c:1223 (pam_sm_authenticate): Skipping first 13 bytes. Length is 57, token_id set to 12 and token OTP always 32. debug: pam_yubico.c:1243 (pam_sm_authenticate): Extracted a probable system password entered before the OTP - setting item PAM_AUTHTOK debug: pam_yubico.c:190 (authorize_user_token): Using system-wide auth_file /etc/yubikey_mappings/raritan_b11_tor1 debug: util.c:351 (check_user_token): Authorization line: admin:ccccccudtfrl:ccccccudtfrn:ccccccvknngt:ccccccudtfre:cccccctrufvg debug: util.c:356 (check_user_token): Matched user: admin debug: util.c:362 (check_user_token): Authorization token: ccccccudtfrl debug: util.c:362 (check_user_token): Authorization token: ccccccudtfrn debug: util.c:362 (check_user_token): Authorization token: ccccccvknngt debug: util.c:366 (check_user_token): Match user/token as admin/ccccccvknngt debug: pam_yubico.c:1265 (pam_sm_authenticate): OTP: ccccccvknngtngebtgvkffdclfcdfekfcfthtehgrbev ID: ccccccvknngt debug: pam_yubico.c:1266 (pam_sm_authenticate): Token is associated to the user. Validating the OTP... debug: pam_yubico.c:1268 (pam_sm_authenticate): ykclient return value (0): Success debug: pam_yubico.c:1269 (pam_sm_authenticate): ykclient URL used: https://api4.yubico.com/wsapi/2.0/verify?id=66772&nonce=aybpqjdscaktuvauvev… debug: pam_yubico.c:1337 (pam_sm_authenticate): done. [Success] (0) pam: Authentication succeeded (0) [pam] = ok (0) if (&User-Password =~ /^(.*)(.{44})$/) { (0) if (&User-Password =~ /^(.*)(.{44})$/) -> TRUE (0) if (&User-Password =~ /^(.*)(.{44})$/) { (0) update request { (0) EXPAND %{1} (0) --> passencrypted (0) &User-Password := passencrypted (0) } # update request = noop (0) } # if (&User-Password =~ /^(.*)(.{44})$/) = noop (0) pap: Login attempt with password (0) pap: Comparing with "known-good" Crypt-password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/raritans (0) post-auth { (0) [exec] = noop (0) update reply { (0) &Filter-Id = "Raritan:G{Admin}" (0) } # update reply = noop (0) } # post-auth = noop (0) Login OK: [admin] (from client raritan_b11_tor1 port 0) (0) Sent Access-Accept Id 160 from 173.237.216.130:1812 to 67.223.108.2:32779 length 0 (0) Filter-Id = "Raritan:G{Admin}" (0) Finished request Waking up in 4.9 seconds. (0) Sending duplicate reply to client raritan_b11_tor1 port 32779 - ID: 160 Waking up in 9.7 seconds. (0) Sending duplicate reply to client raritan_b11_tor1 port 32779 - ID: 160 Waking up in 18.7 seconds.

2 3

post-auth help to simplify
by Pizu 30 Aug '21

30 Aug '21

Hello, Currently we have the below in the post-auth and I would like to simplify this. if (&LDAP-Group == "RSSO - Group - 01") { update reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Group-01" } } elsif (&LDAP-Group == " RSSO - Test - Group - 01 ") { update Reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "RSSO-Test-Group-01" } } etc... We have over 70 groups like this, the above is working but I'd like to minimize the changes on the freeradius configuration and was thinking of using regex but not sure if it's possible in my case. As you can see from the above the LDAP-Group and Class differences are the spaces. I was thinking of doing something like the below: if (&LDAP-Group =~ /^RSSO/) { << Match if group starts with RSSO update reply { &Tunnel-Type := "VLAN" &Tunnel-Medium-Type := "IEEE-802" &Tunnel-Private-Group-Id := "943" &Class := "${0}" << is it possible to remove whitespaces? before the update reply? } } Regards, Pizu

3 4

Problem with multiple clients.conf
by Klemen forneci 30 Aug '21

30 Aug '21

Hello. In my environment (migrated from v2 to v3) I have multiple clients defined: client net { ipaddr = 192.168.0.0 netmask = 16 secret = removed shortname = mass nastype = other } client hivemanager { ipaddr = 192.168.1.1 netmask = 24 secret = removed_2 shortname = HM nastype = other } This configuration works on the v2. On the v3, the problem is that i'm getting a incorrect secret error: Dropping packet without response because of error: Received packet from 192.168.1.15 with invalid Message-Authenticator! (Shared secret is incorrect.) Like the package is managed by client NET and not hivemanager (the secrets are not the same). Is there a order in which the clients must be listed inside the configuration file (finds the first and ignores the others)? Best regards, Klemen

3 3

User Class
by Pizu 30 Aug '21

30 Aug '21

Hi, Currently on the MySQL database the class is remaining NULL and in the log files the class is being written mixed numbers/letters. log file: Class = 0x5253534f2d49542d4e6574776f726b696e67 in db: [image: image.png] Is it possible to write the actual value in the database and in the log file? Thanks.

4 13

Passing data to custom xlat function
by g4-lisz＠tonarchiv.ch 29 Aug '21

29 Aug '21

Hi there, I wonder if there is a way to "transport" data to an xlat function on another way than attaching it to a Radius request... I'm asking this because we have quite a lot of parameters that we want to be expanded in the module config file. These parameters depend on the user realm. So when a request comes in, our module does a look up in a realm to connection data table. This connection data again is used to make a REST authentication. In the module config we have something like this: uri = "https://%{control:Cust-Gateway}/api/%{control:Cust-App-Id}/etc/..." data = 'grant_type=password&username=%{urlquote:%{control:Cust-Client-Id}}&password=%{urlquote:%{control:Cust-Client-Secret}}' In the authorize function we do the DB call and when the realm is valid we add these custom attributes to the request. This works, but maybe there's a more elegant way than adding attributes to the request only for xla expansion. The xlat callback function has only a handle to the instance configuration. I don't see a way to store the data-by-realm there. Of course we could do a data lookup in the xlat callback, but I don't like this approach because this would result in two DB calls per request. Cheers, Till

3 6

trying to override the pam_auth attribute
by Jonathan Davis 27 Aug '21

27 Aug '21

I'm trying to override the pam_auth attribute which is set in: mods-enabled/pam In that file I read the following note: # Note that any Pam-Auth attribute set in the 'authorize' # section will over-ride this one. I've tried adding it to the authorize section of a virtual-server but get the following error when starting freeradius -X server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} /etc/freeradius/3.0/sites-enabled/default[329]: Entry is not a reference to a module /etc/freeradius/3.0/sites-enabled/default[283]: Errors parsing authorize section. The only other authorize I could think of which might be the authorize section referenced is: mods-config/files/authorize But not sure how to add it, as it's not a check item for a user, and I don't want to set it as a default? End goal is based on clients, change the pam_auth to load different /etc/pam.d/ files that specify different yubikey_mappings files. Thank you, JOnathan

3 11

radippool and expiry time
by Mirko Alberio 27 Aug '21

27 Aug '21

Hi! We have this "issue": - Our NAS are correctly configured with 10 minutes Interim-Update - Radius has 1h lease time for radippool module all is working fine but when simulating a NAS outage, for example it becomes disconnected from our network, IPs allocated from PPPOE users on that nas remain allocated even if expiry time is expired. Then when NAS comes back the expiry time is updated and all works fine, but our doubt is if this behaviour is intended or there is some other configuration our side: I expect that if an allocation expires because no interim update is received (and no accounting-stop is received because the NAS is not communicating) allocation should be freed, right? Thanks! -- Mirko Alberio - Assistenza tecnica e-mail: mirko.alberio(a)telemar.it Telemar SpA Internet Quality Provider Via Enrico Fermi, 235 - 36100 Vicenza - Italia Tel 0444 291302 - Fax 0444 566310 - www.telemar.it Assistenza tecnica 0444 1420000 Reg. Imp. Di Vicenza /C.F./P.I. 02508710247 Cap. Soc. € 120.000,00 I.V. R.E.A. VI-236292

2 3

Freeradius forum
by Jahans Solutions 27 Aug '21

27 Aug '21

Hi I am just wondering what happen to the forum? Its being down for a while. It was a great resources for the users. Any idea when it will be back! Thanks

3 4

Configurations for proxying radius requests to home-server using TCP
by Abhilash Y G 26 Aug '21

26 Aug '21

Proxying to homeserver using a TCP connection is causing issue. I am seeing the response from the homeserver, it seems like freeradius running on proxy server is not honoring the response. I have attached the debug logs collected on the proxying server (debug_proxy_server.txt), homeservers (debug_homeserver.txt). I had to trim the logs to focus on issue logs due to limitation in sending attachments more than 500KB. Please advise if any configuration changes are needed on the proxying server to handle the requests without timeouts. Please note, all the homeservers are running freeradius. Regards, Abhilash

2 1

Override/set Current-Time for rlm_logintime testing
by Jason Healy 26 Aug '21

26 Aug '21

I'm working on using rlm_logintime to enforce time of day logins for certain users. I'm also building some radclient packets that I can use to test different time boundaries to make sure my policies are correct. However, logintime looks like it's always using the packet arrival time to do its calculations (understandably; there's no other reliable source). Is there any way to override the packet arrival time, through an attribute or function? I tried setting Packet-Original-Timestamp with no luck. I also tried setting Current-Time, but that looks like a kind of virtual attribute that can be checked (against simple time strings), but not printed or assigned directly. Thanks for any clarification, Jason

2 1