- Freeradius-Users - lists.freeradius.org

Getting more info on radpostauth
by Andrés Gómez 29 Sep '20

29 Sep '20

Hi Alan and dear list. Currently I use freeradius 3 to authenticate wifi users using SQL module. After each authentication request I can see a new entry on radpostauth table in my database.... Everything OK. Radpostauth table has the information about username, pass, reply message and authdate. I need a record about the callingstationid parameter that is arriving in each request. So, If I create a new row in that table, how can I modify the SQL query in order to insert the callingstationid in that table? Thanks a lot -- *C. Andrés Gómez R.*

3 3

Perl script error when testing locally
by HORMAZABAL PI�ONES BARBARA FRANCISCA 28 Sep '20

28 Sep '20

Hello again, I'm trying to follow the tutorial from this site <https://kerker.website/freeradiusgmail802-1x%E8%A8%AD%E5%AE%9Apop3s/> (it's in chinese but it's pretty understandable if you translate it) basically using a perl script for authentication against gmail accounts using POP3. So far I have reached to the part where it tests the script locally and the error occurs, I haven't yet reached to the part where it configures the eap file to EAP-GTC for the 802.1X. Even though it's not in the tutorial I still added the user in the users file anyway and the error is still there. This is the output I get when doing radtest locally: (0) Received Access-Request Id 63 from 127.0.0.1:41319 to 127.0.0.1:1812 length 93 (0) User-Name = "pruebaucnperl(a)gmail.com" (0) User-Password = "password" (0) NAS-IP-Address = 146.83.124.26 (0) NAS-Port = 0 (0) Message-Authenticator = 0xf081ea4e44b9ed006a1316a93828157f (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "gmail.com" for User-Name = " pruebaucnperl(a)gmail.com" (0) suffix: Found realm "gmail.com" (0) suffix: Adding Realm = "gmail.com" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) if (!control:Auth-Type && User-Password){ (0) if (!control:Auth-Type && User-Password) -> TRUE (0) if (!control:Auth-Type && User-Password) { (0) update control { (0) Auth-Type := Perl (0) } # update control = noop (0) } # if (!control:Auth-Type && User-Password) = noop (0) } # authorize = ok (0) Found Auth-Type = Perl (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type Perl { (0) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> ' pruebaucnperl(a)gmail.com' (0) perl: $RAD_REQUEST{'User-Password'} = &request:User-Password -> 'password' (0) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '146.83.124.26' (0) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '0' (0) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'sep 22 2020 18:33:00 -03' (0) perl: $RAD_REQUEST{'Message-Authenticator'} = &request:Message-Authenticator -> '0xf081ea4e44b9ed006a1316a93828157f' (0) perl: $RAD_REQUEST{'Realm'} = &request:Realm -> 'gmail.com' (0) perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'Perl' (0) perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'Perl' POP3 <- +OK Gpop ready for requests from 146.83.124.26 d17mb25011424qvc at /etc/freeradius/3.0/mods-config/perl/pop3.pl line 149. POP3 -> QUIT at /etc/freeradius/3.0/mods-config/perl/pop3.pl line 149. POP3 <- +OK Bye d17mb25011424qvc at /etc/freeradius/3.0/mods-config/perl/pop3.pl line 149. (0) perl: &request:Realm = $RAD_REQUEST{'Realm'} -> 'gmail.com' (0) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> ' pruebaucnperl(a)gmail.com' (0) perl: &request:Message-Authenticator = $RAD_REQUEST{'Message-Authenticator'} -> '0xf081ea4e44b9ed006a1316a93828157f' (0) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '0' (0) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '146.83.124.26' (0) perl: &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'password' (0) perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'sep 22 2020 18:33:00 -03' (0) perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'Perl' (0) [perl] = reject (0) } # Auth-Type Perl = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Delaying response for 1.000000 seconds Waking up in 0.9 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 63 from 127.0.0.1:1812 to 127.0.0.1:41319 length 20 Thank you in advance.

2 5

Re: External trigger for CoA
by vcargats＠cisco.com 27 Sep '20

27 Sep '20

Hi I have been able to implement this approach with coa-relay and it mostly working, but there are a couple of issues with that. Here are my observations (note I am talking about FR 3.0.x branch): 1) We may specify Packet-DST-IP-Address/Packet-Dst-IPv6-Address or Home-Server-Pool to be able to forward CoA request to the particular NAS. 2) If Packet-DST-IP-Address is specified then FR searches the home_server by port type UDP and this is hardcoded. Of course, if I have configured the home_server with RADSEC/TCP FR cannot find it. But at this step that would not be such a big issue if I would be able to specify the NAS via Home-Server-Pool. 3) If Home-Server-Pool is used, FR still cannot find the home_server. Moreover, it is crashed with SIGSEGV. The reason for this is: a) listener is set to null in request_coa_originate in process.c coa->listener = NULL; /* copied here by request_alloc_fake(), but not needed */ here is the git ref: https://github.com/FreeRADIUS/freeradius-server/commit/d9dd706503897a4c271b… b) listener type is checked in home_server_ldb in realms.c if ((request->listener->type == RAD_LISTEN_DETAIL) && (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) && (fr_ipaddr_cmp(&home->ipaddr, &request->packet->src_ipaddr) == 0)) { continue; } Here the listener is NULL and hence the SIGSEGV. Once I deleted the "coa->listener = NULL;" The flow started to be working as expected. Also, if I check if the listener is NULL before checking its type in home_server_ldb - that also worked. The questions are: 1) May you recall the reason for "coa->listener = NULL;" in request_coa_originate? 2) Is it safe to remove that line, essentially to revert the commit referenced above? 3) Alternatively, will that be better to check for the listener is NULL just to avoid the crash in home_server_ldb? Thanks, Vadim _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com

2 1

-simeltenious-1
by MEjaz 27 Sep '20

27 Sep '20

Thanks for your usual instant support. And sorry for annoying you with the config files. Rest assure that I will not repeat it what you told not to, however I revert back original queries.config for mssql. When I tested to connect user multiple times through NTRadPing utility, Yes they can connect which I don’t want. It should allow only once. I noticed following warning in the debug level. " sql: WARNING: Simultaneous-Use checking requires 'simul_count_query' to be configured. Attached is full debug file your information " I have searched few forums for where/how to configure this statement "'simul_count_query'" in which file? But no luck. Would you please help. almost all done. Except this default simultaneous-use to 1, database side is already done. Once again thanks in advance… Ejaz -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+mejaz=cyberia.net.sa@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Sunday, September 20, 2020 7:09 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: auth-type-error On Sep 20, 2020, at 11:33 AM, MEjaz < <mailto:mejaz@cyberia.net.sa> mejaz(a)cyberia.net.sa> wrote: > So far I have successfully achieved the below request type through radpingutility > > * Authentication > * Accounting start > * Accounting stop That's good. > Now only remaining is to set default simultaneous-use to 1. As i want to limit user's behavior, such as a username can login only once at the same time... > > But got error as “rlm_sql_unixodbc: 22002 [Microsoft][ODBC Driver 17 for SQL Server]Indicator variable required but not supplied (2) sql: ERROR: Error fetching row” debug is attached fyi. Ok... > 1、modifiy default and inner-tunnel in For pretty much the last time... we do NOT need to see config files. If I haven't gotten that point across before, please pay attention now. If you keep posting config files when told not to, I will just start ignoring your messages. > 2、modify queris.coonf in /usr/local/etc/raddb/mods-config/sql/main/mssql, > > below statment i have copeied from /usr/local/etc/raddb/mods-config/sql/main/mysql/quries.conf, as it was not exists by default under the msssql/queries.coonf Don't do that. The databases have different syntaxes. You *cannot* just copy queries from one config file to another one. There's a *reason* that the configuration files are different. Go fix the queries to be correct for MSSQL. How? I don't know. I don't run MSSQL. Alan DeKok. - List info/subscribe/unsubscribe? See <http://www.freeradius.org/list/users.html> http://www.freeradius.org/list/users.html

2 1

PEAP mschapv2 E= 691 R=0 code is correct?
by 엔트로링크(주) 25 Sep '20

25 Sep '20

atteched full log. Thanks

2 3

Re: PEAP mschapv2 E= 691 R=0 code is correct?
by 엔트로링크(주) 25 Sep '20

25 Sep '20

again atteched.

2 2

PEAP mschapv2 E= 691 R=0 code is correct?
by 엔트로링크(주) 25 Sep '20

25 Sep '20

Hi. At Cisco ISE case, Change at ISE user password then, Windows 10 Input Password input page popuped, but, FR3.x is not popup. below is debug -- Released connection (2) Fri Sep 25 19:55:58 2020 : Debug: (6) modsingle[post-auth]: returned from sql (rlm_sql) Fri Sep 25 19:55:58 2020 : Debug: (6) [sql] = ok Fri Sep 25 19:55:58 2020 : Debug: (6) if (reply:MS-CHAP-Error =~ /E=691 R=0/) { Fri Sep 25 19:55:58 2020 : Debug: No matches Fri Sep 25 19:55:58 2020 : Debug: (6) if (reply:MS-CHAP-Error =~ /E=691 R=0/) -> FALSE Fri Sep 25 19:55:58 2020 : Debug: (6) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Fri Sep 25 19:55:58 2020 : Debug: %{User-Name} Fri Sep 25 19:55:58 2020 : Debug: Parsed xlat tree: Fri Sep 25 19:55:58 2020 : Debug: attribute --> User-Name Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: EXPAND %{User-Name} Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: --> user01 Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Matched entry DEFAULT at line 1 Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "Cleartext-Password" allowed by 0 rules, disallowed by 0 rules Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: MS-CHAP-Error = "\006E=691 R=1 C=02fa5a91d12763de0ebb5702753e7402 V=3 M=Authentication rejected" allowed by MS-CHAP-Error =* "" Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "MS-CHAP-Error" allowed by 1 rules, disallowed by 0 rules Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: MS-CHAP-Error = "\006E=691 R=1 C=3ffb7931c560572bb7e802f970f89497 V=3 M=Authentication failed" allowed by MS-CHAP-Error =* "" Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "MS-CHAP-Error" allowed by 1 rules, disallowed by 0 rules Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: EAP-Message = 0x04060004 allowed by EAP-Message =* 0x Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "EAP-Message" allowed by 1 rules, disallowed by 0 rules Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Message-Authenticator = 0x00000000000000000000000000000000 allowed by Message-Authenticator =* 0x Fri Sep 25 19:55:58 2020 : Debug: (6) attr_filter.access_reject: Attribute "Message-Authenticator" allowed by 1 rules, disallowed by 0 rules -- Thanks

2 3

Trying to get 3GPP-User-Location-Info
by Wessel de Schrijver 24 Sep '20

24 Sep '20

Dear All, We are a M2M IOT service provider and all of our SIM Cards are authenticated through a FreeRadius server. With accounting information we're able to see usages and all other sorts of info, one of our providers is also sending location information through the 3GPP-User-Location-Info. What you are trying to do: We're trying to get the location of celltowers where A specific SIM card is connected to, using 3GPP-User-Location-Info. Why you are trying to do it: So we can have more diagnostic information for our customers. What you expect the server to do: We expected the server to log the Attribute: 3GPP-User-Location-Info. What the server does instead (i.e. debug output): We can only see: 3GPP-Location-Information. We've included a packetcapture as well, because we can see the attributes we're looking for in the packet capture. Could you please assist in how to enable the 3GPP-User-Location-Info? Many thanks in advance! Wessel de Schrijver Sim Services. debug log: FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/moonshot-targeted-ids including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/canonicalization including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/dhcp main { security { allow_core_dumps = no } name = "radiusd" prefix = "@prefix@" localstatedir = "@localstatedir@" logdir = "@logdir@" run_dir = "@localstatedir@/run/radiusd" } main { name = "radiusd" prefix = "@prefix@" localstatedir = "@localstatedir@" sbindir = "@sbindir@" logdir = "@logdir@" run_dir = "@localstatedir@/run/radiusd" libdir = "@libdir@" radacctdir = "@radacctdir@" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 160000 pidfile = "@localstatedir@/run/radiusd/radiusd.pid" checkrad = "@sbindir@/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 172.17.0.0/16 { ipaddr = 172.17.0.0/16 require_message_authenticator = no secret = <<< secret >>> shortname = "private-docker-network" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 172.18.0.0/16 { ipaddr = 172.18.0.0/16 require_message_authenticator = no secret = <<< secret >>> shortname = "private-docker-network-on-circleci" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_1 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_2 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_3 { ipaddr = XXX.XXX.XXX.XXX require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_4 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_5 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tele2_6 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client telenor_t1 { ipaddr = XXX.XXX.XXX.XXX netmask = 28 require_message_authenticator = no secret = <<< secret >>> shortname = "TelenorGGSN_t1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client telenor_t2 { ipaddr = XXX.XXX.XXX.XXX netmask = 28 require_message_authenticator = no secret = <<< secret >>> shortname = "TelenorGGSN_t2" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client telenor_3 { ipaddr = XXX.XXX.XXX.XXX netmask = 28 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client tmobile_1 { ipaddr = XXX.XXX.XXX.XXX netmask = 32 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "@logdir@/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "@logdir@/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "@logdir@/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "@logdir@/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "@logdir@/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "@radacctdir@/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "XXX.XXX.XXX.XXX" port = 3306 login = "root" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{%{DHCP-Client-Hardware-Address}:-%{%{User-Name}:-DEFAULT}}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, locationinfo) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{3GPP-Location-Info}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', locationinfo = '%{3GPP-Location-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}', locationinfo = '%{3GPP-Location-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.3.6 mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 100 min = 50 max = 300 spare = 150 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 300 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 299 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 298 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 297 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 296 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (5), 1 of 295 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (6), 1 of 294 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (7), 1 of 293 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (8), 1 of 292 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (9), 1 of 291 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (10), 1 of 290 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (11), 1 of 289 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (12), 1 of 288 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (13), 1 of 287 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (14), 1 of 286 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (15), 1 of 285 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (16), 1 of 284 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (17), 1 of 283 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (18), 1 of 282 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (19), 1 of 281 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (20), 1 of 280 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (21), 1 of 279 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (22), 1 of 278 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (23), 1 of 277 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (24), 1 of 276 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (25), 1 of 275 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (26), 1 of 274 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (27), 1 of 273 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (28), 1 of 272 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (29), 1 of 271 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (30), 1 of 270 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (31), 1 of 269 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (32), 1 of 268 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (33), 1 of 267 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (34), 1 of 266 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (35), 1 of 265 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (36), 1 of 264 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (37), 1 of 263 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (38), 1 of 262 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (39), 1 of 261 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (40), 1 of 260 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (41), 1 of 259 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (42), 1 of 258 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (43), 1 of 257 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (44), 1 of 256 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (45), 1 of 255 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (46), 1 of 254 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (47), 1 of 253 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (48), 1 of 252 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (49), 1 of 251 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (50), 1 of 250 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (51), 1 of 249 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (52), 1 of 248 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (53), 1 of 247 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (54), 1 of 246 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (55), 1 of 245 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (56), 1 of 244 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (57), 1 of 243 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (58), 1 of 242 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (59), 1 of 241 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (60), 1 of 240 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (61), 1 of 239 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (62), 1 of 238 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (63), 1 of 237 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (64), 1 of 236 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (65), 1 of 235 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (66), 1 of 234 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (67), 1 of 233 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (68), 1 of 232 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (69), 1 of 231 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (70), 1 of 230 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (71), 1 of 229 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (72), 1 of 228 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (73), 1 of 227 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (74), 1 of 226 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (75), 1 of 225 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (76), 1 of 224 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (77), 1 of 223 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (78), 1 of 222 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (79), 1 of 221 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (80), 1 of 220 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (81), 1 of 219 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (82), 1 of 218 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (83), 1 of 217 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (84), 1 of 216 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (85), 1 of 215 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (86), 1 of 214 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (87), 1 of 213 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (88), 1 of 212 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (89), 1 of 211 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (90), 1 of 210 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (91), 1 of 209 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (92), 1 of 208 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (93), 1 of 207 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (94), 1 of 206 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (95), 1 of 205 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (96), 1 of 204 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (97), 1 of 203 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (98), 1 of 202 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 rlm_sql (sql): Opening additional connection (99), 1 of 201 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default server dhcp { # from file /etc/raddb/sites-enabled/dhcp # Loading dhcp DHCP-Discover {...} # Loading dhcp DHCP-Request {...} # Loading dhcp DHCP-Decline {...} # Loading dhcp DHCP-Inform {...} # Loading dhcp DHCP-Release {...} # Loading dhcp DHCP-Lease-Query {...} } # server dhcp radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_pps = 0 max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "dhcp" ipaddr = * port = 67 src_ipaddr = * } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on dhcp interface ens192 address * port 67 bound to server dhcp Listening on proxy address * port 43620 Listening on proxy address :: port 55432 Ready to process requests (0) Received Accounting-Request Id 19 from XXX.XXX.XXX.XXX:26644 to XXX.XXX.XXX.XXX:1813 length 349 (0) Acct-Status-Type = Interim-Update (0) User-Name = "467191003331463" (0) Event-Timestamp = "Sep 24 2020 13:14:06 UTC" (0) Acct-Input-Octets = 40255 (0) Acct-Input-Gigawords = 0 (0) Acct-Output-Octets = 18332 (0) Acct-Output-Gigawords = 0 (0) Acct-Session-Time = 992822 (0) Framed-IP-Address = 10.162.12.6 (0) Called-Station-Id = "wocozon.tele2.m2m" (0) Calling-Station-Id = "467191003331463" (0) NAS-IP-Address = XXX.XXX.XXX.XXX (0) Acct-Session-Id = "82F4D11A08f1dea7" (0) 3GPP-IMSI = "240075830143983" (0) 3GPP-SGSN-Address = XXX.XXX.XXX.XXX (0) 3GPP-NSAPI = "5" (0) 3GPP-GGSN-Address = XXX.XXX.XXX.XXX (0) 3GPP-GGSN-MCC-MNC = "24007" (0) 3GPP-Charging-Characteristics = "0800" (0) 3GPP-IMEISV = "3521080747680008" (0) 3GPP-RAT-Type = GERAN (0) 3GPP-Location-Info = 0x0002f4800c8ad624 (0) 3GPP-Charging-ID = 150068903 (0) 3GPP-PDP-Type = 0 (0) 3GPP-Selection-Mode = "0" (0) 3GPP-MS-Time-Zone = 0x4001 (0) 3GPP-GPRS-Negotiated-QoS-profile = "08-0109000021C0000021C0" (0) # Executing section preacct from file /etc/raddb/sites-enabled/default (0) preacct { (0) [preprocess] = ok (0) policy acct_unique { (0) update request { (0) &Tmp-String-9 := "ai:" (0) } # update request = noop (0) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (0) EXPAND %{hex:&Class} (0) --> (0) EXPAND ^%{hex:&Tmp-String-9} (0) --> ^61693a (0) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (0) else { (0) update request { (0) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (0) --> d032aea6d7e9d9f5900873ef8870a711 (0) &Acct-Unique-Session-Id := d032aea6d7e9d9f5900873ef8870a711 (0) } # update request = noop (0) } # else = noop (0) } # policy acct_unique = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "467191003331463", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) [files] = noop (0) } # preacct = ok (0) # Executing section accounting from file /etc/raddb/sites-enabled/default (0) accounting { (0) sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (0) sql: --> type.interim-update.query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND %{%{DHCP-Client-Hardware-Address}:-%{%{User-Name}:-DEFAULT}} (0) sql: --> 467191003331463 (0) sql: SQL-User-Name set to '467191003331463' (0) sql: EXPAND UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', locationinfo = '%{3GPP-Location-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' (0) sql: --> UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1600953246), acctinterval = 1600953246 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '10.162.12.6', acctsessiontime = 992822, acctinputoctets = '0' << 32 | '40255', acctoutputoctets = '0' << 32 | '18332', locationinfo = '0x0002f4800c8ad624' WHERE AcctUniqueId = 'd032aea6d7e9d9f5900873ef8870a711' (0) sql: Executing query: UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1600953246), acctinterval = 1600953246 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '10.162.12.6', acctsessiontime = 992822, acctinputoctets = '0' << 32 | '40255', acctoutputoctets = '0' << 32 | '18332', locationinfo = '0x0002f4800c8ad624' WHERE AcctUniqueId = 'd032aea6d7e9d9f5900873ef8870a711' rlm_sql_mysql: Rows matched: 1 Changed: 1 Warnings: 0 (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (0) Need 50 more connections to reach 150 spares rlm_sql (sql): Opening additional connection (100), 1 of 200 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on XXX.XXX.XXX.XXX via TCP/IP, server version 5.7.31, protocol version 10 (0) [sql] = ok (0) if (noop) { (0) if (noop) -> FALSE (0) [exec] = noop (0) attr_filter.accounting_response: EXPAND %{User-Name} (0) attr_filter.accounting_response: --> 467191003331463 (0) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (0) [attr_filter.accounting_response] = updated (0) } # accounting = updated (0) Sent Accounting-Response Id 19 from XXX.XXX.XXX.XXX:1813 to XXX.XXX.XXX.XXX:26644 length 0 (0) Finished request (0) Cleaning up request packet ID 19 with timestamp +0 Ready to process requests Packet Capture log: Frame 43: 390 bytes on wire (3120 bits), 390 bytes captured (3120 bits) Ethernet II, Src: VMware_9f:23:41 (00:50:56:9f:23:41), Dst: VMware_01:03:b7 (00:50:56:01:03:b7) Internet Protocol Version 4, Src: XXX.XXX.XXX.XXX, Dst: XXX.XXX.XXX.XXX User Datagram Protocol, Src Port: 1915, Dst Port: 1813 Source Port: 1915 Destination Port: 1813 Length: 356 Checksum: 0xa762 [unverified] [Checksum Status: Unverified] [Stream index: 22] [Timestamps] RADIUS Protocol Code: Accounting-Request (4) Packet identifier: 0xb4 (180) Length: 348 Authenticator: 88a610f05bfaf86ff506fd4efc5517a3 [The response to this request is in frame 46] Attribute Value Pairs AVP: t=Acct-Status-Type(40) l=6 val=Interim-Update(3) AVP: t=User-Name(1) l=17 val=467191202305517 AVP: t=Event-Timestamp(55) l=6 val=Sep 24, 2020 09:58:22.000000000 W. Europe Daylight Time AVP: t=Acct-Input-Octets(42) l=6 val=202917 AVP: t=Acct-Input-Gigawords(52) l=6 val=0 AVP: t=Acct-Output-Octets(43) l=6 val=125607 AVP: t=Acct-Output-Gigawords(53) l=6 val=0 AVP: t=Acct-Session-Time(46) l=6 val=2638210 AVP: t=Framed-IP-Address(8) l=6 val=10.161.120.191 AVP: t=Called-Station-Id(30) l=18 val=m2mc.simservices AVP: t=Calling-Station-Id(31) l=17 val=467191202305517 AVP: t=NAS-IP-Address(4) l=6 val=XXX.XXX.XXX.XXX AVP: t=Acct-Session-Id(44) l=18 val=82F4D11Aaad25991 AVP: t=Vendor-Specific(26) l=23 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=9 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=13 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=24 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=9 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=16 vnd=3GPP(10415) Type: 26 Length: 16 Vendor ID: 3GPP (10415) VSA: t=3GPP-User-Location-Info(22) l=10 val=0002f4800d0cc2f2 Type: 22 Length: 10 Geographic Location Type: Cell Global Identification (CGI) (0) Mobile Country Code (MCC): Netherlands (204) Mobile Network Code (MNC): KPN Mobile The Netherlands B.V. (08) Location Area Code (LAC): 3340 Cell ID (CI): 49906 AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=12 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=9 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=10 vnd=3GPP(10415) AVP: t=Vendor-Specific(26) l=31 vnd=3GPP(10415)

2 1

Help in allowing particular AD group to be authorised
by shivangi jaiswal 24 Sep '20

24 Sep '20

Hi, I am looking for possible ways to perform radius Authorization for a particular group. I was able to successfully integrate rhel 7.3 with Ad using ntlm_auth and mschap.. Could someone please assist Thanks

3 2

Client certificate authentication using Apache and mod_auth_radius
by Marki 24 Sep '20

24 Sep '20

Hello, I've tried authenticating a client certificate using Apache and aforementioned module. All I'm getting to work is for Apache to transmit the entire DN to Radius as username, which contains whitespace and thus doesn't work. For the sake of testing I've tried sending only the country code contained within the DN: Virtualhost configuration is this: <VirtualHost *:443> ... SSLVerifyClient require SSLCACertificateFile /CA.pem SSLVerifyDepth 2 SSLOptions +FakeBasicAuth +StdEnvVars SSLUserName SSL_CLIENT_S_DN_C <Location /> AuthType basic AuthName "Cert" AuthBasicProvider radius # AuthBasicFake "%{SSL_CLIENT_S_DN_C}" <RequireAny> Require valid-user </RequireAny> </Location> </VirtualHost> Without "SSLOptions +FakeBasicAuth", Radius isn't queried at all. Using "AuthBasicFake" does not change things (specifying it alone does not query Radius, and specifying it additionally to SSLUsername does not change anything). Has anyone ever made extracting a part of the DN in order to provide it to Radius work with Apache? (Apache version in this case is 2.4.23) I've found some bug reports for Apache, the state of which is not clear however: https://bz.apache.org/bugzilla/show_bug.cgi?id=52616 https://bz.apache.org/bugzilla/show_bug.cgi?id=31418 Thanks, Marki

2 1