- Freeradius-Users - lists.freeradius.org

mod_auth_radius add_cookie segfault
by Brandon Ewing 26 Nov '07

26 Nov '07

Greetings, I am having some issues with mod_auth_radius causing httpd to segfault when "set_cookie" is called. The server in question is CentOS 4.5, with httpd-2.0.52-32.3 and apr-0.9.4-24.5.c4.2 RPMs installed. I downloaded mod_auth_radius from http://www.freeradius.org/mod_auth_radius/mod_auth_radius-2.0.c It compiled correctly via apxs after I added #include "apr_compat.h" I compiled with the following line: apxs -i -a -c mod_auth_radius-2.0.c I have the following in the .htaccess for the directory I wish to protect: <IfModule mod_auth_radius-2.0.c> AddRadiusAuth 10.10.17.15:1812 secret 5:3 AuthName "RADIUS Access" AuthType Basic Require valid-user AuthRadiusActive On </IfModule> If I access the page, I am presented with a basic authtype prompt -- however, after I enter a valid username and password, the httpd child segfaults: [Mon Nov 26 15:00:01 2007] [notice] child pid 21136 exit signal Segmentation fault (11) I know that the issue is in the set_cookie routine, because if I comment out the "set_cookie" call after a successful authentication and recompile, the segfault does not happen. However, this results in a RADIUS call for every single GET request, which is not desired. I am not proficient in C, so if anyone has any suggestions as to further troubleshooting/resolution for this issue, I would appreciate the input, off or on-list. -- Brandon Ewing (nicotine(a)warningg.com)

2 1

syaoran.sakura@gmail.com
by Syaoran Li 26 Nov '07

26 Nov '07

syaoran.sakura(a)gmail.com

1 0

Problem with CHAP
by Javier Fernando 26 Nov '07

26 Nov '07

I configure Freeradius , when the client try to connect with CHAP i have this error, and only connect with linux system users. When I connect locally with radtest i connect ok but when i connect remotely whit Windows Xp using CHAP don't connect. I run radius in debug mode with -X option. Part of clients.conf usuario1 Auth-Type := Local, Cleartext-Password := "testusuario1" usuario2 Auth-Type := Local, Password := "testusuario2" usuario3 Cleartext-Password := "testusuario3" Error of freeradius running with -X option: rad_recv: Access-Request packet from host 192.168.1.100:1645, id=106, length=126 Framed-Protocol = PPP User-Name = "chap" CHAP-Password = 0x019c1a0fb685942ed07fdb1e2d100e93f0 NAS-Port-Type = Virtual NAS-Port = 1586 Calling-Station-Id = "1141323200" Called-Station-Id = "8003450410" Connect-Info = "TLS-MISERVER-DIALUP" Service-Type = Framed-User NAS-IP-Address = 192.168.1.100 Processing the authorize section of radiusd.confmodcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "chap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 2rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 2modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type CHAPauth: type "CHAP" Processing the authenticate section of radiusd.confmodcall: entering group CHAP for request 2 rlm_chap: login attempt by "chap" with CHAP password rlm_chap: Could not find clear text password for user chap modcall[authenticate]: module "chap" returns invalid for request 2modcall: leaving group CHAP (returns invalid) for request 2auth: Failed to validate the user.Login incorrect (rlm_chap: Clear text password not available): [chap/<CHAP-Password>] (from client rasiplan2 port 1586 cli 1141323200)Delaying request 2 for 1 secondsFinished request 2Going to the next request--- Walking the entire request list ---Waking up in 1 seconds...--- Walking the entire request list ---Waking up in 1 seconds...--- Walking the entire request list ---Sending Access-Reject of id 106 to 192.168.1.1 port 1645Waking up in 4 seconds...--- Walking the entire request list ---Cleaning up request 2 ID 106 with timestamp 47472e23Nothing to do. Sleeping until we see a request. _________________________________________________________________ Tecnología, moda, motor, viajes,…suscríbete a nuestros boletines para estar a la última http://newsletters.msn.com/hm/maintenanceeses.asp?L=ES&C=ES&P=WCMaintenance…

2 10

Unresponsive child and accounting
by Christophe Saillard 26 Nov '07

26 Nov '07

Hi, I use freeradius (1.1.7) to authenticate wireless users (EAP-TTLS/PAP) with an OpenLDAP backend. Our first experience with Freeradius on a FreeBSD server was a nightmare (it seemed to be a thread related problem, the server stopped working with a lot of "unresponsive child" error logs). So, we tried on a Linux server (kernel 2.6.22-14-server ubuntu feisty fawn) and it worked fine since last week : Wed Nov 21 15:33:21 2007 : Auth: Login OK: [xxxx] (from client localhost port 576353 cli 001c.bf09.480c) Wed Nov 21 15:33:21 2007 : Auth: Login OK: [xxxx(a)u-strasbg.fr] (from client wds3 port 576353 cli 001c.bf09.480c) Wed Nov 21 15:33:22 2007 : Error: WARNING: Unresponsive child (id 3046112160) for request 2419782 (in component accounting module rlm_radutmp) Wed Nov 21 15:33:22 2007 : Error: WARNING: Unresponsive child (id 2841623456) for request 2419798 (in component accounting module rlm_radutmp) The CPU went up to 100%. There was about 300 802.1X clients connected (with a 2 minutes reauth period). At this time we had no other choice than upgrading the hardware, it runs now on a 8 processor server but even with more CPU power we noticed a 20% system load. Here's the threading part of the radiusd.conf : max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1000 thread pool { start_servers = 10 max_servers = 1000 min_spare_servers = 15 max_spare_servers = 30 max_requests_per_server = 300 } I don't know if it's relevant but there were about 80 Eduroam users connected when the problem happens. Thanks. -- --------------------------- Christophe Saillard Centre Réseau Communication Université Louis Pasteur --------------------------- Tél : 03 90 24 03 17 Fax : 03 90 24 03 12 ---------------------------

2 1

Cisco NAS enable password
by J M 25 Nov '07

25 Nov '07

Hello, I have the NAS login and enable passwords (for cisco equipment) working fine with freeradius using mysql, but I am considering splitting my NAS equipment into 6 huntgroups and would like to have a different enable password for each of the 6 different huntgroups. If I were using the users file, I would try entries like: $enab15$ Huntgroup-Name == "alpha", Cleartext-Password := "alphpasswd" Service-Type = NAS-Prompt-User $enab15$ Huntgroup-Name == "beta", Cleartext-Password := "btapasswd" Service-Type = NAS-Prompt-User etc. for 6 huntgroups I'm just not sure I understand how I can translate that into the sql information necessary to equal the above. Is there a trick I am missing here or do I need to re-read the docs a couple more times? Thanks for any help John ____________________________________________________________________________________ Be a better pen pal. Text or chat with friends inside Yahoo! Mail. See how. http://overview.mail.yahoo.com/

1 0

a few questions
by Paul Bartell 25 Nov '07

25 Nov '07

Im working on a project at my school district to implement RADIUS authentication. I have two Mac powerpc servers for use, which could run either OSX or some linux variant. We are planning on using a mysql backend. Our network has around 6k machines throughout the district, a few hundred on the wifi at any given time. so my questions are: 1. since mysql in OSX isn't kernel based from what i understand, would it make a big difference to use a linux based os (debian/unofficial powerpc port of ubuntu is my initial thought)? 2. Are both servers needed, and if so would it make sense to use mysql replication and just have two of the same? 3. Would it make sense to just point some Ap's at one RADIUS server and some at the other, or is there a better/easier way to load balance? thanks, Paul -- "If you are savvy and smart about the choices you make in life, The sky is not the limit!" Mark Shuttleworth Random quote of the week/month/whenever i get to updating it: " hate compasses i like can't use them. they don't stay straight, and i end up looking like an emo by the time i'm done, it stabs me so much" - Jasmine Lee

3 4

Is it something wrong in EAP-TLS ?
by OLIVER Patrice 23 Nov '07

23 Nov '07

Hello, I try to use EAP-TLS authentication. Here is a part to the debugging messages : rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A TLS_accept: SSLv3 write certificate A TLS_accept: SSLv3 write key exchange A TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode What's about this error ? Regards. Cordialement, ---------------------------------------- Patrice OLIVER Chef du Projet Ville Hôpital Responsable Réseaux & Sécurité ---------------------------------------- HOSPICES CIVILS DE BEAUNE Service Informatique BP 104 21203 BEAUNE CEDEX Tél. 33 3 80 24 44 09 Fax 33 3 80 24 45 90 ----------------------------------------

2 1

radwho does not show me any user
by OLIVER Patrice 23 Nov '07

23 Nov '07

Hello, When I use the radwho utility to know actually connected radius users. It returns me an empty list since I'm actually connected and authenticated. Yesterday, I saw that the radutmp file did not exist. So I created it with 600 permissions. The radiusd.conf has been setup like this : radutmp { filename = ${logdir}/radutmp Can you help me ? Cordialement, ---------------------------------------- Patrice OLIVER Chef du Projet Ville Hôpital Responsable Réseaux & Sécurité ---------------------------------------- HOSPICES CIVILS DE BEAUNE Service Informatique BP 104 21203 BEAUNE CEDEX Tél. 33 3 80 24 44 09 Fax 33 3 80 24 45 90 ----------------------------------------

2 2

Re: Expiration attribute
by Marinko Tarlac 23 Nov '07

23 Nov '07

Thanks Ivan Best regards Message: 3 Date: Thu, 22 Nov 2007 07:51:41 +0100 From: <tnt(a)kalik.co.yu> Subject: Re: Expire attribute To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <sRvpveEi.1195714301.7796390.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 Attribute name is Expiration. It is a check item so it does go into radcheck. I use is == as operator, but := should work as well. Format that works for me is: November 28 2007 20:26:43 Ivan Kalik Kalik Informatika ISP

1 0

Exec-Program-Wait
by Felipe Ceglia - PY1NB 23 Nov '07

23 Nov '07

Hello, I am trying to setup a "prepaid" style system on my freeradius. All I want is to check user name against a perl script that will let user get in or not. I put this on users file, but the script is not being run: DEFAULT Called-Station-Id == "hotspot_shop_tere" #THIS IS LINE 155 Exec-Program-Wait = "/etc/raddb/scripts/hotspot_shop_tere.pl %U", DEFAULT Called-Station-Id == "hotspot_shop_tere", Acct-Status-Type == Stop Exec-Program-Wait = "/etc/raddb/scripts/hotspot_shop_tere.pl %U %{AcctSessionTime}", Thanks in advance, Felipe radiusd -X says: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 10 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "after" main: lower_pass = "after" main: nospace_user = "after" main: nospace_pass = "after" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 2 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/raddb/temp/passwd" unix: shadow = "(null)" unix: group = "/etc/raddb/temp/group" unix: radwtmp = "NULL" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "rootpasswd" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Access-Request packet from host 192.168.254.2:32777, id=40, length=181 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:0B:CD:EC:63:50" Called-Station-Id = "hotspot_shop_tere" NAS-Port-Id = "hotspot" User-Name = "joe" NAS-Port = 2150629415 Acct-Session-Id = "80300027" Framed-IP-Address = 10.5.50.254 Mikrotik-Attr-10 = 0x0a0532fe User-Password = "whatever" Service-Type = Login-User WISPr-Logoff-URL = "http://0.0.0.0/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.254.2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "joe" rlm_realm: Proxying request from user joe to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'joe' rlm_sql (sql): sql_set_user escaped user --> 'joe' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'joe' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User joe not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'joe' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'joe' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User joe not found in radgroupcheck rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [joe/whatever] (from client hotspot_shop_tere port 2150629415 cli 00:0B:CD:EC:63:50) rad_lowerpair: Stripped-User-Name now 'joe' rad_lowerpair: User-Password now 'whatever' rad_rmspace_pair: Stripped-User-Name now 'joe' rad_rmspace_pair: User-Password now 'whatever' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'joe' rlm_sql (sql): sql_set_user escaped user --> 'joe' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'joe' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User joe not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'joe' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'joe' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User joe not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [joe/whatever] (from client hotspot_shop_tere port 2150629415 cli 00:0B:CD:EC:63:50) Delaying request 0 for 2 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Access-Request packet from host 192.168.254.2:32777, id=40, length=181 Sending Access-Reject of id 40 to 192.168.254.2 port 32777 --- Walking the entire request list --- Waking up in 10 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 40 with timestamp 4745d2ae Nothing to do. Sleeping until we see a request.

2 1