- Freeradius-Users - lists.freeradius.org

Re: PEAP mschapv2 E= 691 R=0 code is correct?
by 엔트로링크(주) 25 Sep '20

25 Sep '20

again atteched.

2 2

PEAP mschapv2 E= 691 R=0 code is correct?
by 엔트로링크(주) 25 Sep '20

25 Sep '20

Hi. At Cisco ISE case, Change at ISE user password then, Windows 10 Input Password input page popuped, but, FR3.x is not popup. below is debug -- Released connection (2) Fri Sep 25 19:55:58 2020 : Debug: (6) modsingle[post-auth]: returned from sql (rlm_sql) Fri Sep 25 19:55:58 2020 : Debug: (6) [sql] = ok Fri Sep 25 19:55:58 2020 : Debug: (6) if (reply:MS-CHAP-Error =~ /E=691 R=0/) { Fri Sep 25 19:55:58 2020 : Debug: No matches Fri Sep 25 19:55:58 2020 : Debug: (6) if (reply:MS-CHAP-Error =~ /E=691 R=0/) -> FALSE Fri Sep 25 19:55:58 2020 : Debug: (6) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Fri Sep 25 19:55:58 2020 : Debug: %{User-Name} Fri Sep 25 19:55:58 2020 : Debug: Parsed xlat tree: Fri Sep 25 19:55:58 2020 : Debug: attribute --> User-Name Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: EXPAND %{User-Name} Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: --> user01 Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Matched entry DEFAULT at line 1 Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "Cleartext-Password" allowed by 0 rules, disallowed by 0 rules Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: MS-CHAP-Error = "\006E=691 R=1 C=02fa5a91d12763de0ebb5702753e7402 V=3 M=Authentication rejected" allowed by MS-CHAP-Error =* "" Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "MS-CHAP-Error" allowed by 1 rules, disallowed by 0 rules Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: MS-CHAP-Error = "\006E=691 R=1 C=3ffb7931c560572bb7e802f970f89497 V=3 M=Authentication failed" allowed by MS-CHAP-Error =* "" Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "MS-CHAP-Error" allowed by 1 rules, disallowed by 0 rules Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: EAP-Message = 0x04060004 allowed by EAP-Message =* 0x Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "EAP-Message" allowed by 1 rules, disallowed by 0 rules Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Message-Authenticator = 0x00000000000000000000000000000000 allowed by Message-Authenticator =* 0x Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "Message-Authenticator" allowed by 1 rules, disallowed by 0 rules -- Thanks

2 3

Trying to get 3GPP-User-Location-Info
by Wessel de Schrijver 24 Sep '20

24 Sep '20

Dear All, We are a M2M IOT service provider and all of our SIM Cards are authenticated through a FreeRadius server. With accounting information we're able to see usages and all other sorts of info, one of our providers is also sending location information through the 3GPP-User-Location-Info. What you are trying to do: We're trying to get the location of celltowers where A specific SIM card is connected to, using 3GPP-User-Location-Info. Why you are trying to do it: So we can have more diagnostic information for our customers. What you expect the server to do: We expected the server to log the Attribute: 3GPP-User-Location-Info. What the server does instead (i.e. debug output): We can only see: 3GPP-Location-Information. We've included a packetcapture as well, because we can see the attributes we're looking for in the packet capture. Could you please assist in how to enable the 3GPP-User-Location-Info? Many thanks in advance! Wessel de Schrijver Sim Services. debug log: FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/moonshot-targeted-ids including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/canonicalization including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/dhcp main { security { allow_core_dumps = no } name = "radiusd" prefix = "@prefix@" localstatedir = "@localstatedir@" logdir = "@logdir@" run_dir = "@localstatedir@/run/radiusd" } main { name = "radiusd" prefix = "@prefix@" localstatedir = "@localstatedir@" sbindir = "@sbindir@" logdir = "@logdir@" run_dir = "@localstatedir@/run/radiusd" libdir = "@libdir@" radacctdir = "@radacctdir@" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 160000 pidfile = "@localstatedir@/run/radiusd/radiusd.pid" checkrad = "@sbindir@/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 172.17.0.0/16 { ipaddr = 172.17.0.0/16 require_message_authenticator = no secret = <<< secret >>> shortname = "private-docker-network" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 172.18.0.0/16 { ipaddr = 172.18.0.0/16 require_message_authenticator = no secret = <<< secret >>> shortname = "private-docker-network-on-circleci" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_1 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_2 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_3 { ipaddr = XXX.XXX.XXX.XXX require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_4 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_5 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_6 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client telenor_t1 { ipaddr = XXX.XXX.XXX.XXX netmask = 28 require_message_authenticator = no secret = <<< secret >>> shortname = "TelenorGGSN_t1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client telenor_t2 { ipaddr = XXX.XXX.XXX.XXX netmask = 28 require_message_authenticator = no secret = <<< secret >>> shortname = "TelenorGGSN_t2" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client telenor_3 { ipaddr = XXX.XXX.XXX.XXX netmask = 28 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tmobile_1 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "@logdir@/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "@logdir@/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "@logdir@/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "@logdir@/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "@logdir@/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "XXX.XXX.XXX.XXX" port = 3306 login = "root" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{%{DHCP-Client-Hardware-Address}:-%{%{User-Name}:-DEFAULT}}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, locationinfo) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{3GPP-Location-Info}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', locationinfo = '%{3GPP-Location-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}', locationinfo = '%{3GPP-Location-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.3.6 mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 100 min = 50 max = 300 spare = 150 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 300 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 299 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 298 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 297 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 296 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (5), 1 of 295 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (6), 1 of 294 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (7), 1 of 293 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (8), 1 of 292 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (9), 1 of 291 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (10), 1 of 290 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (11), 1 of 289 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (12), 1 of 288 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (13), 1 of 287 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (14), 1 of 286 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (15), 1 of 285 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (16), 1 of 284 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (17), 1 of 283 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (18), 1 of 282 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (19), 1 of 281 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (20), 1 of 280 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (21), 1 of 279 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (22), 1 of 278 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (23), 1 of 277 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (24), 1 of 276 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (25), 1 of 275 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (26), 1 of 274 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (27), 1 of 273 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (28), 1 of 272 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (29), 1 of 271 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (30), 1 of 270 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (31), 1 of 269 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (32), 1 of 268 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (33), 1 of 267 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (34), 1 of 266 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (35), 1 of 265 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (36), 1 of 264 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (37), 1 of 263 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (38), 1 of 262 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (39), 1 of 261 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (40), 1 of 260 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (41), 1 of 259 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (42), 1 of 258 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (43), 1 of 257 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (44), 1 of 256 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (45), 1 of 255 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (46), 1 of 254 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (47), 1 of 253 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (48), 1 of 252 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (49), 1 of 251 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (50), 1 of 250 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (51), 1 of 249 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (52), 1 of 248 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (53), 1 of 247 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (54), 1 of 246 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (55), 1 of 245 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (56), 1 of 244 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (57), 1 of 243 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (58), 1 of 242 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (59), 1 of 241 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (60), 1 of 240 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (61), 1 of 239 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (62), 1 of 238 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (63), 1 of 237 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (64), 1 of 236 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (65), 1 of 235 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (66), 1 of 234 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (67), 1 of 233 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (68), 1 of 232 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (69), 1 of 231 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (70), 1 of 230 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (71), 1 of 229 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (72), 1 of 228 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (73), 1 of 227 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (74), 1 of 226 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (75), 1 of 225 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (76), 1 of 224 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (77), 1 of 223 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (78), 1 of 222 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (79), 1 of 221 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (80), 1 of 220 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (81), 1 of 219 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (82), 1 of 218 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (83), 1 of 217 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (84), 1 of 216 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (85), 1 of 215 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (86), 1 of 214 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (87), 1 of 213 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (88), 1 of 212 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (89), 1 of 211 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (90), 1 of 210 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (91), 1 of 209 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (92), 1 of 208 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (93), 1 of 207 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (94), 1 of 206 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (95), 1 of 205 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (96), 1 of 204 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (97), 1 of 203 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (98), 1 of 202 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (99), 1 of 201 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default server dhcp { # from file /etc/raddb/sites-enabled/dhcp # Loading dhcp DHCP-Discover {...} # Loading dhcp DHCP-Request {...} # Loading dhcp DHCP-Decline {...} # Loading dhcp DHCP-Inform {...} # Loading dhcp DHCP-Release {...} # Loading dhcp DHCP-Lease-Query {...} } # server dhcp radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_pps = 0 max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "dhcp" ipaddr = * port = 67 src_ipaddr = * } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on dhcp interface ens192 address * port 67 bound to server dhcp Listening on proxy address * port 43620 Listening on proxy address :: port 55432 Ready to process requests (0) Received Accounting-Request Id 19 from XXX.XXX.XXX.XXX:26644 to XXX.XXX.XXX.XXX:1813 length 349 (0) Acct-Status-Type = Interim-Update (0) User-Name = "467191003331463" (0) Event-Timestamp = "Sep 24 2020 13:14:06 UTC" (0) Acct-Input-Octets = 40255 (0) Acct-Input-Gigawords = 0 (0) Acct-Output-Octets = 18332 (0) Acct-Output-Gigawords = 0 (0) Acct-Session-Time = 992822 (0) Framed-IP-Address = 10.162.12.6 (0) Called-Station-Id = "wocozon.tele2.m2m" (0) Calling-Station-Id = "467191003331463" (0) NAS-IP-Address = XXX.XXX.XXX.XXX (0) Acct-Session-Id = "82F4D11A08f1dea7" (0) 3GPP-IMSI = "240075830143983" (0) 3GPP-SGSN-Address = XXX.XXX.XXX.XXX (0) 3GPP-NSAPI = "5" (0) 3GPP-GGSN-Address = XXX.XXX.XXX.XXX (0) 3GPP-GGSN-MCC-MNC = "24007" (0) 3GPP-Charging-Characteristics = "0800" (0) 3GPP-IMEISV = "3521080747680008" (0) 3GPP-RAT-Type = GERAN (0) 3GPP-Location-Info = 0x0002f4800c8ad624 (0) 3GPP-Charging-ID = 150068903 (0) 3GPP-PDP-Type = 0 (0) 3GPP-Selection-Mode = "0" (0) 3GPP-MS-Time-Zone = 0x4001 (0) 3GPP-GPRS-Negotiated-QoS-profile = "08-0109000021C0000021C0" (0) # Executing section preacct from file /etc/raddb/sites-enabled/default (0) preacct { (0) [preprocess] = ok (0) policy acct_unique { (0) update request { (0) &Tmp-String-9 := "ai:" (0) } # update request = noop (0) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (0) EXPAND %{hex:&Class} (0) --> (0) EXPAND ^%{hex:&Tmp-String-9} (0) --> ^61693a (0) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (0) else { (0) update request { (0) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) --> d032aea6d7e9d9f5900873ef8870a711 (0) &Acct-Unique-Session-Id := d032aea6d7e9d9f5900873ef8870a711 (0) } # update request = noop (0) } # else = noop (0) } # policy acct_unique = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "467191003331463", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) [files] = noop (0) } # preacct = ok (0) # Executing section accounting from file /etc/raddb/sites-enabled/default (0) accounting { (0) sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (0) sql: --> type.interim-update.query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND %{%{DHCP-Client-Hardware-Address}:-%{%{User-Name}:-DEFAULT}} (0) sql: --> 467191003331463 (0) sql: SQL-User-Name set to '467191003331463' (0) sql: EXPAND UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', locationinfo = '%{3GPP-Location-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' (0) sql: --> UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1600953246), acctinterval = 1600953246 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '10.162.12.6', acctsessiontime = 992822, acctinputoctets = '0' << 32 | '40255', acctoutputoctets = '0' << 32 | '18332', locationinfo = '0x0002f4800c8ad624' WHERE AcctUniqueId = 'd032aea6d7e9d9f5900873ef8870a711' (0) sql: Executing query: UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1600953246), acctinterval = 1600953246 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '10.162.12.6', acctsessiontime = 992822, acctinputoctets = '0' << 32 | '40255', acctoutputoctets = '0' << 32 | '18332', locationinfo = '0x0002f4800c8ad624' WHERE AcctUniqueId = 'd032aea6d7e9d9f5900873ef8870a711' rlm_sql_mysql: Rows matched: 1 Changed: 1 Warnings: 0 (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (0) Need 50 more connections to reach 150 spares rlm_sql (sql): Opening additional connection (100), 1 of 200 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 (0) [sql] = ok (0) if (noop) { (0) if (noop) -> FALSE (0) [exec] = noop (0) attr_filter.accounting_response: EXPAND %{User-Name} (0) attr_filter.accounting_response: --> 467191003331463 (0) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (0) [attr_filter.accounting_response] = updated (0) } # accounting = updated (0) Sent Accounting-Response Id 19 from XXX.XXX.XXX.XXX:1813 to XXX.XXX.XXX.XXX:26644 length 0 (0) Finished request (0) Cleaning up request packet ID 19 with timestamp +0 Ready to process requests Packet Capture log: Frame 43: 390 bytes on wire (3120 bits), 390 bytes captured (3120 bits) Ethernet II, Src: VMware_9f:23:41 (00:50:56:9f:23:41), Dst: VMware_01:03:b7 (00:50:56:01:03:b7) Internet Protocol Version 4, Src: XXX.XXX.XXX.XXX, Dst: XXX.XXX.XXX.XXX User Datagram Protocol, Src Port: 1915, Dst Port: 1813 Source Port: 1915 Destination Port: 1813 Length: 356 Checksum: 0xa762 [unverified] [Checksum Status: Unverified] [Stream index: 22] [Timestamps] RADIUS Protocol Code: Accounting-Request (4) Packet identifier: 0xb4 (180) Length: 348 Authenticator: 88a610f05bfaf86ff506fd4efc5517a3 [The response to this request is in frame 46] Attribute Value Pairs AVP: t=Acct-Status-Type(40) l=6 val=Interim-Update(3) AVP: t=User-Name(1) l=17 val=467191202305517 AVP: t=Event-Timestamp(55) l=6 val=Sep 24, 2020 09:58:22.000000000 W. Europe Daylight Time AVP: t=Acct-Input-Octets(42) l=6 val=202917 AVP: t=Acct-Input-Gigawords(52) l=6 val=0 AVP: t=Acct-Output-Octets(43) l=6 val=125607 AVP: t=Acct-Output-Gigawords(53) l=6 val=0 AVP: t=Acct-Session-Time(46) l=6 val=2638210 AVP: t=Framed-IP-Address(8) l=6 val=10.161.120.191 AVP: t=Called-Station-Id(30) l=18 val=m2mc.simservices AVP: t=Calling-Station-Id(31) l=17 val=467191202305517 AVP: t=NAS-IP-Address(4) l=6 val=XXX.XXX.XXX.XXX AVP: t=Acct-Session-Id(44) l=18 val=82F4D11Aaad25991 AVP: t=Vendor-Specific(26) l=23 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=9 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=13 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=24 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=9 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=16 vnd=3GPP(10415) Type: 26 Length: 16 Vendor ID: 3GPP (10415) VSA: t=3GPP-User-Location-Info(22) l=10 val=0002f4800d0cc2f2 Type: 22 Length: 10 Geographic Location Type: Cell Global Identification (CGI) (0) Mobile Country Code (MCC): Netherlands (204) Mobile Network Code (MNC): KPN Mobile The Netherlands B.V. (08) Location Area Code (LAC): 3340 Cell ID (CI): 49906 AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=9 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=10 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=31 vnd=3GPP(10415)

2 1

Help in allowing particular AD group to be authorised
by shivangi jaiswal 24 Sep '20

24 Sep '20

Hi, I am looking for possible ways to perform radius Authorization for a particular group. I was able to successfully integrate rhel 7.3 with Ad using ntlm_auth and mschap.. Could someone please assist Thanks

3 2

Client certificate authentication using Apache and mod_auth_radius
by Marki 24 Sep '20

24 Sep '20

Hello, I've tried authenticating a client certificate using Apache and aforementioned module. All I'm getting to work is for Apache to transmit the entire DN to Radius as username, which contains whitespace and thus doesn't work. For the sake of testing I've tried sending only the country code contained within the DN: Virtualhost configuration is this: <VirtualHost *:443> ... SSLVerifyClient require SSLCACertificateFile /CA.pem SSLVerifyDepth 2 SSLOptions +FakeBasicAuth +StdEnvVars SSLUserName SSL_CLIENT_S_DN_C <Location /> AuthType basic AuthName "Cert" AuthBasicProvider radius # AuthBasicFake "%{SSL_CLIENT_S_DN_C}" <RequireAny> Require valid-user </RequireAny> </Location> </VirtualHost> Without "SSLOptions +FakeBasicAuth", Radius isn't queried at all. Using "AuthBasicFake" does not change things (specifying it alone does not query Radius, and specifying it additionally to SSLUsername does not change anything). Has anyone ever made extracting a part of the DN in order to provide it to Radius work with Apache? (Apache version in this case is 2.4.23) I've found some bug reports for Apache, the state of which is not clear however: https://bz.apache.org/bugzilla/show_bug.cgi?id=52616 https://bz.apache.org/bugzilla/show_bug.cgi?id=31418 Thanks, Marki

2 1

EAP issue
by lingctam 24 Sep '20

24 Sep '20

Hello, There seems to be an issue with the EAP module but I cannot spot it: (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_peap to process data (0) eap_peap: Initiating new EAP-TLS session (0) eap_peap: Flushing SSL sessions (of #0) (0) eap_peap: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 106 length 6 (0) eap: EAP session adding &reply:State = 0xf7942626f7fe3f0a (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/raddb/sites-enabled/******** (0) Sent Access-Challenge Id 245 from ************:1812 to ************:62704 length 0 (0) EAP-Message = 0x016a00061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xf7942626f7fe3f0a42c923255cc967ab (0) Finished request Waking up in 4.9 seconds. (1) authenticate { (1) eap: Expiring EAP session with state 0xf7942626f7fe3f0a (1) eap: Finished EAP session with state 0xf7942626f7fe3f0a (1) eap: Previous EAP request found for state 0xf7942626f7fe3f0a, released from the list (1) eap: Peer sent packet with method EAP PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Continuing EAP-TLS (1) eap_peap: Peer indicated complete TLS record size will be 131 bytes (1) eap_peap: Got complete TLS record (131 bytes) (1) eap_peap: [eaptls verify] = length included (1) eap_peap: (other): before SSL initialization (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 007e] (1) eap_peap: TLS_accept: SSLv3/TLS read client hello (1) eap_peap: >>> send TLS 1.2 [length 005d] (1) eap_peap: TLS_accept: SSLv3/TLS write server hello (1) eap_peap: >>> send TLS 1.2 [length 0e78] (1) eap_peap: TLS_accept: SSLv3/TLS write certificate (1) eap_peap: >>> send TLS 1.2 [length 014d] (1) eap_peap: TLS_accept: SSLv3/TLS write key exchange (1) eap_peap: >>> send TLS 1.2 [length 0004] (1) eap_peap: TLS_accept: SSLv3/TLS write server done (1) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_peap: In SSL Handshake Phase (1) eap_peap: In SSL Accept mode (1) eap_peap: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 107 length 1004 (1) eap: EAP session adding &reply:State = 0xf7942626f6ff3f0a (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/raddb/sites-enabled/********** (1) Sent Access-Challenge Id 246 from **********:1812 to **********:62704 length 0 (1) EAP-Message = **************************************************************************** (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xf7942626f6ff3f0a42c923255cc967ab (1) Finished request Waking up in 4.9 seconds. This happens until the EAP session expires. Could anyone please offer some insight? Thanks.

2 1

LDAP Simultaneous-use
by Alex 24 Sep '20

24 Sep '20

Hi everyone! I'm trying to configure freeradius to get users from ldap directory. Currently my configuration works perfectly except for one little detail: i'm not able to impose the Simultaneous-use limitation. the ldap entry already has the attribute, but i was not able to make freeradius to get it. Has someone one example of configuration of rlm_ldap module?? thank you and best regards Alex

3 6

How Can send Response-Packet-Type "Password-Request" at auth fail time
by 엔트로링크(주) 23 Sep '20

23 Sep '20

How Can send Response-Packet-Type "Password-Request" at auth fail time (not Reply message) default Response-Packet-Type is Access-Reject at auth fail time Thanks.

2 1

Debugging while service is running
by lingctam 23 Sep '20

23 Sep '20

Dear Colleagues, Please forgive this question, but can the debugging service be ran while the radius service is running (given that the sites-enabled/default ports will be testing outside of 1812 and 1813)? Thanks.

5 5

Access Request Configuraton Attributes in Module-Configuration
by g4-lisz＠tonarchiv.ch 22 Sep '20

22 Sep '20

Hi everyone I wonder if I can access the configuration attributes of a request in the module configuration. I.e. in the code a configuration attribute is set like this: pair_make_config("Custom-My-Attrib", "Some value, T_OP_ADD); It would be nice if i could access this in a configuration file, so it can be expanded in a string: my_module { some_param = "foobar-%{???:Custom-My-Attrib}" } Is something like this possible? Cheers T

2 3