- Freeradius-Users - lists.freeradius.org

Problem with VENDOR in dictionary
by Normand Christophe 16 Sep '19

16 Sep '19

Hello, I am trying to add a Vendor definition to my freeradius configuration (into the /etc/freeradius/3.0/dictionary file). The vendor is : International Electrotechnical Commission 41912 >From IANA : 41912 International Electrotechnical Commission Herbert Falk herb&sisconet.com Here is the configuration I tried and the results from the journalctl : First one, given by the vendor : VENDOR International Electrotechnical Commission 41912 BEGIN-VENDOR International Electrotechnical Commission ATTRIBUTE IEC62351-8-RoleID-0 1 integer ATTRIBUTE IEC62351-8-roleDefinition-0 2 string OPTIONAL ATTRIBUTE IEC62351-8-aor-0 3 string ATTRIBUTE IEC62351-8-revision-0 4 integer ATTRIBUTE IEC62351-8-ValidFrom-0 5 string OPTIONAL ATTRIBUTE IEC62351-8-ValidTo-0 6 string ATTRIBUTE IEC62351-8-RoleID-1 11 integer ATTRIBUTE IEC62351-8-roleDefinition-1 12 string OPTIONAL ATTRIBUTE IEC62351-8-aor-1 13 string ATTRIBUTE IEC62351-8-revision-1 14 integer ATTRIBUTE IEC62351-8-ValidFrom-1 15 string OPTIONAL ATTRIBUTE IEC62351-8-ValidTo-1 16 string ATTRIBUTE IEC62351-8-RoleID-2 21 integer ATTRIBUTE IEC62351-8-roleDefinition-2 22 string OPTIONAL ATTRIBUTE IEC62351-8-aor-2 23 string ATTRIBUTE IEC62351-8-revision-2 24 integer ATTRIBUTE IEC62351-8-ValidFrom-2 25 string OPTIONAL ATTRIBUTE IEC62351-8-ValidTo-2 26 string END-VENDOR International Electrotechnical Commission Error : Sep 16 14:05:41 raspberrypi freeradius[12273]: FreeRADIUS Version 3.0.12 Sep 16 14:05:41 raspberrypi freeradius[12273]: Copyright (C) 1999-2016 The FreeRADIUS server project and contributors Sep 16 14:05:41 raspberrypi freeradius[12273]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Sep 16 14:05:41 raspberrypi freeradius[12273]: PARTICULAR PURPOSE Sep 16 14:05:41 raspberrypi freeradius[12273]: You may redistribute copies of FreeRADIUS under the terms of the Sep 16 14:05:41 raspberrypi freeradius[12273]: GNU General Public License Sep 16 14:05:41 raspberrypi freeradius[12273]: For more information about these matters, see the file named COPYRIGHT Sep 16 14:05:41 raspberrypi freeradius[12273]: Starting - reading configuration files ... Sep 16 14:05:42 raspberrypi freeradius[12273]: Errors reading /etc/freeradius/3.0/dictionary: dict_init: /etc/freeradius/3.0/dictionary[51] invalid VENDOR entry Sep 16 14:05:42 raspberrypi systemd[1]: freeradius.service: Control process exited, code=exited status=1 -- Subject: Unit freeradius.service has failed -- Unit freeradius.service has failed. Sep 16 14:05:42 raspberrypi systemd[1]: freeradius.service: Unit entered failed state. Sep 16 14:05:42 raspberrypi systemd[1]: freeradius.service: Failed with result 'exit-code'. Second one (deleting spaces for the vendor name as in the manual) : VENDOR InternationalElectrotechnicalCommission 41912 BEGIN-VENDOR InternationalElectrotechnicalCommission ATTRIBUTE IEC62351-8-RoleID-0 1 integer ATTRIBUTE IEC62351-8-roleDefinition-0 2 string OPTIONAL ATTRIBUTE IEC62351-8-aor-0 3 string ATTRIBUTE IEC62351-8-revision-0 4 integer ATTRIBUTE IEC62351-8-ValidFrom-0 5 string OPTIONAL ATTRIBUTE IEC62351-8-ValidTo-0 6 string ATTRIBUTE IEC62351-8-RoleID-1 11 integer ATTRIBUTE IEC62351-8-roleDefinition-1 12 string OPTIONAL ATTRIBUTE IEC62351-8-aor-1 13 string ATTRIBUTE IEC62351-8-revision-1 14 integer ATTRIBUTE IEC62351-8-ValidFrom-1 15 string OPTIONAL ATTRIBUTE IEC62351-8-ValidTo-1 16 string ATTRIBUTE IEC62351-8-RoleID-2 21 integer ATTRIBUTE IEC62351-8-roleDefinition-2 22 string OPTIONAL ATTRIBUTE IEC62351-8-aor-2 23 string ATTRIBUTE IEC62351-8-revision-2 24 integer ATTRIBUTE IEC62351-8-ValidFrom-2 25 string OPTIONAL ATTRIBUTE IEC62351-8-ValidTo-2 26 string END-VENDOR InternationalElectrotechnicalCommission Error : Sep 16 14:07:53 raspberrypi freeradius[12410]: FreeRADIUS Version 3.0.12 Sep 16 14:07:53 raspberrypi freeradius[12410]: Copyright (C) 1999-2016 The FreeRADIUS server project and contributors Sep 16 14:07:53 raspberrypi freeradius[12410]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Sep 16 14:07:53 raspberrypi freeradius[12410]: PARTICULAR PURPOSE Sep 16 14:07:53 raspberrypi freeradius[12410]: You may redistribute copies of FreeRADIUS under the terms of the Sep 16 14:07:53 raspberrypi freeradius[12410]: GNU General Public License Sep 16 14:07:53 raspberrypi freeradius[12410]: For more information about these matters, see the file named COPYRIGHT Sep 16 14:07:53 raspberrypi freeradius[12410]: Starting - reading configuration files ... Sep 16 14:07:53 raspberrypi freeradius[12410]: Errors reading /etc/freeradius/3.0/dictionary: dict_init: /etc/freeradius/3.0/dictionary[54] Vendor flag inside of "BEGIN-VENDOR" is not allowed Sep 16 14:07:53 raspberrypi systemd[1]: freeradius.service: Control process exited, code=exited status=1 -- Subject: Unit freeradius.service has failed -- Unit freeradius.service has failed. Sep 16 14:07:53 raspberrypi systemd[1]: freeradius.service: Unit entered failed state. Sep 16 14:07:53 raspberrypi systemd[1]: freeradius.service: Failed with result 'exit-code'. Third one, trying something mixed with and without spaces VENDOR InternationalElectrotechnicalCommission 41912 BEGIN-VENDOR International Electrotechnical Commission ATTRIBUTE IEC62351-8-RoleID-0 1 integer ATTRIBUTE IEC62351-8-roleDefinition-0 2 string OPTIONAL ATTRIBUTE IEC62351-8-aor-0 3 string ATTRIBUTE IEC62351-8-revision-0 4 integer ATTRIBUTE IEC62351-8-ValidFrom-0 5 string OPTIONAL ATTRIBUTE IEC62351-8-ValidTo-0 6 string ATTRIBUTE IEC62351-8-RoleID-1 11 integer ATTRIBUTE IEC62351-8-roleDefinition-1 12 string OPTIONAL ATTRIBUTE IEC62351-8-aor-1 13 string ATTRIBUTE IEC62351-8-revision-1 14 integer ATTRIBUTE IEC62351-8-ValidFrom-1 15 string OPTIONAL ATTRIBUTE IEC62351-8-ValidTo-1 16 string ATTRIBUTE IEC62351-8-RoleID-2 21 integer ATTRIBUTE IEC62351-8-roleDefinition-2 22 string OPTIONAL ATTRIBUTE IEC62351-8-aor-2 23 string ATTRIBUTE IEC62351-8-revision-2 24 integer ATTRIBUTE IEC62351-8-ValidFrom-2 25 string OPTIONAL ATTRIBUTE IEC62351-8-ValidTo-2 26 string END-VENDOR International Electrotechnical Commission Error : Sep 16 14:11:12 raspberrypi freeradius[12644]: FreeRADIUS Version 3.0.12 Sep 16 14:11:12 raspberrypi freeradius[12644]: Copyright (C) 1999-2016 The FreeRADIUS server project and contributors Sep 16 14:11:12 raspberrypi freeradius[12644]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Sep 16 14:11:12 raspberrypi freeradius[12644]: PARTICULAR PURPOSE Sep 16 14:11:12 raspberrypi freeradius[12644]: You may redistribute copies of FreeRADIUS under the terms of the Sep 16 14:11:12 raspberrypi freeradius[12644]: GNU General Public License Sep 16 14:11:12 raspberrypi freeradius[12644]: For more information about these matters, see the file named COPYRIGHT Sep 16 14:11:12 raspberrypi freeradius[12644]: Starting - reading configuration files ... Sep 16 14:11:12 raspberrypi freeradius[12644]: Errors reading /etc/freeradius/3.0/dictionary: dict_init: /etc/freeradius/3.0/dictionary[52]: unknown vendor International Sep 16 14:11:12 raspberrypi systemd[1]: freeradius.service: Control process exited, code=exited status=1 -- Subject: Unit freeradius.service has failed -- Unit freeradius.service has failed. Sep 16 14:11:12 raspberrypi systemd[1]: freeradius.service: Unit entered failed state. Sep 16 14:11:12 raspberrypi systemd[1]: freeradius.service: Failed with result 'exit-code'. Regards, Christophe Normand

2 1

SQL session start
by Marcin Marszałkowski 13 Sep '19

13 Sep '19

Hi, As per config files it’s enough to enable sql_session_start in default server and toggle set of queries - start section in queries.conf (freeradius 3.0.20): # When using "sql_session_start", you should comment out # the previous query, and enable this one. Mainly changing sql query INSERT to UPDATE in queries.conf. Is this all or I’m missing something? Description in policy.d/accounting doesn’t say anything more. The reason I’m asking is accounting became useless as lots of data is missing (like acctupdatetime, acctstoptime and acctinterval and so on) when this feature is enabled… Accounting request debug with sql_session_start on: Ready to process requests (8) Received Accounting-Request Id 217 from 172.16.0.4:60220 to 172.16.0.12:1813 length 264 (8) Acct-Status-Type = Interim-Update (8) Acct-Authentic = RADIUS (8) User-Name = "Mark" (8) Framed-IP-Address = 172.16.4.6 (8) NAS-Identifier = "fdecea88ef4d" (8) Called-Station-Id = "FD-EC-EA-88-EF-4D:Site" (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) Calling-Station-Id = „A8-63-C7-20-A6-BC" (8) Connect-Info = "CONNECT 0Mbps 802.11b" (8) Acct-Session-Id = "4989DEE1E63DA03B" (8) WLAN-Pairwise-Cipher = 1027076 (8) WLAN-Group-Cipher = 1027076 (8) WLAN-AKM-Suite = 1027073 (8) Class = 0x61693a6135626131326534323930313730623036636231383032303437383138313738 (8) Event-Timestamp = "Sep 12 2019 22:45:48 CEST" (8) Acct-Delay-Time = 0 (8) Acct-Session-Time = 3985 (8) Acct-Input-Packets = 982894 (8) Acct-Output-Packets = 988539 (8) Acct-Input-Octets = 86555066 (8) Acct-Input-Gigawords = 0 (8) Acct-Output-Octets = 1008668910 (8) Acct-Output-Gigawords = 0 (8) # Executing section preacct from file /etc/freeradius/sites-enabled/default (8) preacct { (8) [preprocess] = ok (8) policy acct_counters64.preacct { (8) update request { (8) EXPAND %{expr:(&Acct-Input-Gigawords << 32) | &Acct-Input-Octets} (8) --> 86555066 (8) &Acct-Input-Octets64 = 86555066 (8) EXPAND %{expr:(&Acct-Output-Gigawords << 32) | &Acct-Output-Octets} (8) --> 1008668910 (8) &Acct-Output-Octets64 = 1008668910 (8) } # update request = noop (8) } # policy acct_counters64.preacct = noop (8) update request { (8) EXPAND %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} (8) --> 1568317163 (8) &FreeRADIUS-Acct-Session-Start-Time = Sep 12 2019 21:39:23 CEST (8) } # update request = noop (8) policy acct_unique { (8) update request { (8) &Tmp-String-9 := "ai:" (8) } # update request = noop (8) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (8) EXPAND %{hex:&Class} (8) --> 61693a6135626131326534323930313730623036636231383032303437383138313738 (8) EXPAND ^%{hex:&Tmp-String-9} (8) --> ^61693a (8) EXPAND %{string:&Class} (8) --> ai:a5ba12e4290170b06cb1802047818178 (8) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> TRUE (8) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (8) update request { (8) EXPAND %{md5:%{1},%{Acct-Session-ID}} (8) --> 6d2b000d2e24857d10699c46ad662bff (8) &Acct-Unique-Session-Id := 6d2b000d2e24857d10699c46ad662bff (8) } # update request = noop (8) } # if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) = noop (8) ... skipping else: Preceding "if" was taken (8) } # policy acct_unique = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "Mark", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) } # preacct = ok (8) # Executing section accounting from file /etc/freeradius/sites-enabled/default (8) accounting { (8) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (8) detail: --> /var/log/freeradius/radacct/172.16.0.4/detail-20190912 (8) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.16.0.4/detail-20190912 (8) detail: EXPAND %t (8) detail: --> Thu Sep 12 22:45:48 2019 (8) [detail] = ok (8) sql: EXPAND %{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query} (8) sql: --> type.interim-update.query (8) sql: Using query template 'query' rlm_sql (sql): Closing connection (14): Hit idle_timeout, was idle for 224 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (15): Hit idle_timeout, was idle for 224 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (16), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 172.16.0.13 via TCP/IP, server version 5.7.27-0ubuntu0.18.04.1, protocol version 10 rlm_sql (sql): Reserved connection (16) (8) sql: EXPAND %{User-Name} (8) sql: --> Mark (8) sql: SQL-User-Name set to 'Mark' (8) sql: EXPAND UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' (8) sql: --> UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1568321148), acctinterval = 1568321148 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '172.16.4.6', framedipv6address = '', framedipv6prefix = '', framedinterfaceid = '', delegatedipv6prefix = '', acctsessiontime = 3985, acctinputoctets = '0' << 32 | '86555066', acctoutputoctets = '0' << 32 | '1008668910' WHERE AcctUniqueId = '6d2b000d2e24857d10699c46ad662bff' (8) sql: Executing query: UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1568321148), acctinterval = 1568321148 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '172.16.4.6', framedipv6address = '', framedipv6prefix = '', framedinterfaceid = '', delegatedipv6prefix = '', acctsessiontime = 3985, acctinputoctets = '0' << 32 | '86555066', acctoutputoctets = '0' << 32 | '1008668910' WHERE AcctUniqueId = '6d2b000d2e24857d10699c46ad662bff' rlm_sql_mysql: Rows matched: 0 Changed: 0 Warnings: 0 (8) sql: SQL query returned: success (8) sql: 0 record(s) updated (8) sql: Trying next query... (8) sql: EXPAND UPDATE radacct SET AcctSessionId = '%{Acct-Session-Id}', AcctUniqueId = '%{Acct-Unique-Session-Id}', AcctAuthentic = '%{Acct-Authentic}', ConnectInfo_start = '%{Connect-Info}', ServiceType = '%{Service-Type}', FramedProtocol = '%{Framed-Protocol}', framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', AcctUpdateTime = FROM_UNIXTIME(%{integer:Event-Timestamp}), AcctSessionTime = %{%{Acct-Session-Time}:-NULL}, AcctInputOctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', AcctOutputOctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' AND NASPortType = '%{NAS-Port-Type}' AND AcctStopTime IS NULL (8) sql: --> UPDATE radacct SET AcctSessionId = '4989DEE1E63DA03B', AcctUniqueId = '6d2b000d2e24857d10699c46ad662bff', AcctAuthentic = 'RADIUS', ConnectInfo_start = 'CONNECT 0Mbps 802.11b', ServiceType = 'Framed-User', FramedProtocol = '', framedipaddress = '172.16.4.6', framedipv6address = '', framedipv6prefix = '', framedinterfaceid = '', delegatedipv6prefix = '', AcctUpdateTime = FROM_UNIXTIME(1568321148), AcctSessionTime = 3985, AcctInputOctets = '0' << 32 | '86555066', AcctOutputOctets = '0' << 32 | '1008668910' WHERE UserName = 'Mark' AND NASIPAddress = '172.16.0.4' AND NASPortId = '' AND NASPortType = 'Wireless-802.11' AND AcctStopTime IS NULL (8) sql: Executing query: UPDATE radacct SET AcctSessionId = '4989DEE1E63DA03B', AcctUniqueId = '6d2b000d2e24857d10699c46ad662bff', AcctAuthentic = 'RADIUS', ConnectInfo_start = 'CONNECT 0Mbps 802.11b', ServiceType = 'Framed-User', FramedProtocol = '', framedipaddress = '172.16.4.6', framedipv6address = '', framedipv6prefix = '', framedinterfaceid = '', delegatedipv6prefix = '', AcctUpdateTime = FROM_UNIXTIME(1568321148), AcctSessionTime = 3985, AcctInputOctets = '0' << 32 | '86555066', AcctOutputOctets = '0' << 32 | '1008668910' WHERE UserName = 'Mark' AND NASIPAddress = '172.16.0.4' AND NASPortId = '' AND NASPortType = 'Wireless-802.11' AND AcctStopTime IS NULL rlm_sql_mysql: Rows matched: 0 Changed: 0 Warnings: 0 (8) sql: SQL query returned: success (8) sql: 0 record(s) updated (8) sql: No additional queries configured rlm_sql (sql): Released connection (16) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (17), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 172.16.0.13 via TCP/IP, server version 5.7.27-0ubuntu0.18.04.1, protocol version 10 (8) [sql] = noop (8) [exec] = noop (8) attr_filter.accounting_response: EXPAND %{User-Name} (8) attr_filter.accounting_response: --> Mark (8) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (8) [attr_filter.accounting_response] = updated (8) } # accounting = updated (8) Sent Accounting-Response Id 217 from 172.16.0.12:1813 to 172.16.0.4:60220 length 0 (8) Finished request (8) Cleaning up request packet ID 217 with timestamp +613 Regards Martin

3 5

how to transfer from "users file to sql"
by Bornemann, Hans 13 Sep '19

13 Sep '19

Hi, we are testing a wlan with "private preshared keys". In the cisco wlancontroller world it works with the AAA override feature and some entries in the radius database. my first with the users file works fine: If I transfer this entries to the mysql database, the aut-type was not set. What is missing? I tested it with the default configuration, the sql module was enabled. ------------------------------------ configuration with users file ------------------------------------ users file: 3c15c2e840fe Auth-Type := Accept cisco-AVPair = "psk-mode=ascii", cisco-AVPair = "psk=abcdefgh" debug output: Thu Sep 12 10:27:31 2019 : Debug: (0) Received Access-Request Id 26 from 129.217.228.186:32776 to 129.217.228.164:1812 length 255 Thu Sep 12 10:27:31 2019 : Debug: (0) User-Name = "3c15c2e840fe" Thu Sep 12 10:27:31 2019 : Debug: (0) Called-Station-Id = "70-ea-1a-84-18-c0:itmc-ipsk" Thu Sep 12 10:27:31 2019 : Debug: (0) Calling-Station-Id = "3c-15-c2-e8-40-fe" Thu Sep 12 10:27:31 2019 : Debug: (0) NAS-Port = 1 Thu Sep 12 10:27:31 2019 : Debug: (0) NAS-IP-Address = 129.217.251.242 Thu Sep 12 10:27:31 2019 : Debug: (0) NAS-Identifier = "wlc-staging" Thu Sep 12 10:27:31 2019 : Debug: (0) Airespace-Wlan-Id = 10 Thu Sep 12 10:27:31 2019 : Debug: (0) User-Password = "3c15c2e840fe" Thu Sep 12 10:27:31 2019 : Debug: (0) Service-Type = Call-Check Thu Sep 12 10:27:31 2019 : Debug: (0) Framed-MTU = 1300 Thu Sep 12 10:27:31 2019 : Debug: (0) NAS-Port-Type = Wireless-802.11 Thu Sep 12 10:27:31 2019 : Debug: (0) Tunnel-Type:0 = VLAN Thu Sep 12 10:27:31 2019 : Debug: (0) Tunnel-Medium-Type:0 = IEEE-802 Thu Sep 12 10:27:31 2019 : Debug: (0) Tunnel-Private-Group-Id:0 = "3503" Thu Sep 12 10:27:31 2019 : Debug: (0) Cisco-AVPair = "audit-session-id=81d9fbf2000001465d79fc47" Thu Sep 12 10:27:31 2019 : Debug: (0) Acct-Session-Id = "5d79fc47/3c:15:c2:e8:40:fe/1259" Thu Sep 12 10:27:31 2019 : Debug: (0) session-state: No State attribute Thu Sep 12 10:27:31 2019 : Debug: (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu Sep 12 10:27:31 2019 : Debug: (0) authorize { Thu Sep 12 10:27:31 2019 : Debug: (0) policy filter_username { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name) { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name) -> TRUE Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name) { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ / /) { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ / /) -> FALSE Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ /@[^@]*@/ ) { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ /\.\./ ) { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ /\.\./ ) -> FALSE Thu Sep 12 10:27:31 2019 : Debug: (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Thu Sep 12 10:27:31 2019 : Debug: (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ /\.$/) { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ /\.$/) -> FALSE Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ /(a)\./) { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&User-Name =~ /(a)\./) -> FALSE Thu Sep 12 10:27:31 2019 : Debug: (0) } # if (&User-Name) = notfound Thu Sep 12 10:27:31 2019 : Debug: (0) } # policy filter_username = notfound Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) Thu Sep 12 10:27:31 2019 : Debug: (0) [preprocess] = ok Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling chap (rlm_chap) Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from chap (rlm_chap) Thu Sep 12 10:27:31 2019 : Debug: (0) [chap] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling mschap (rlm_mschap) Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from mschap (rlm_mschap) Thu Sep 12 10:27:31 2019 : Debug: (0) [mschap] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling digest (rlm_digest) Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from digest (rlm_digest) Thu Sep 12 10:27:31 2019 : Debug: (0) [digest] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling suffix (rlm_realm) Thu Sep 12 10:27:31 2019 : Debug: (0) suffix: Checking for suffix after "@" Thu Sep 12 10:27:31 2019 : Debug: (0) suffix: No '@' in User-Name = "3c15c2e840fe", looking up realm NULL Thu Sep 12 10:27:31 2019 : Debug: (0) suffix: No such realm "NULL" Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from suffix (rlm_realm) Thu Sep 12 10:27:31 2019 : Debug: (0) [suffix] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling eap (rlm_eap) Thu Sep 12 10:27:31 2019 : Debug: (0) eap: No EAP-Message, not doing EAP Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from eap (rlm_eap) Thu Sep 12 10:27:31 2019 : Debug: (0) [eap] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling files (rlm_files) Thu Sep 12 10:27:31 2019 : Debug: (0) files: users: Matched entry 3c15c2e840fe at line 2 Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) Thu Sep 12 10:27:31 2019 : Debug: (0) [files] = ok Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) Thu Sep 12 10:27:31 2019 : Debug: (0) [expiration] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) Thu Sep 12 10:27:31 2019 : Debug: (0) [logintime] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) Thu Sep 12 10:27:31 2019 : WARNING: (0) pap: Auth-Type already set. Not setting to PAP Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) Thu Sep 12 10:27:31 2019 : Debug: (0) [pap] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) } # authorize = ok Thu Sep 12 10:27:31 2019 : Debug: (0) Found Auth-Type = Accept Thu Sep 12 10:27:31 2019 : Debug: (0) Auth-Type = Accept, accepting the user Thu Sep 12 10:27:31 2019 : Debug: (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default Thu Sep 12 10:27:31 2019 : Debug: (0) post-auth { Thu Sep 12 10:27:31 2019 : Debug: (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { Thu Sep 12 10:27:31 2019 : Debug: (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE Thu Sep 12 10:27:31 2019 : Debug: (0) update { Thu Sep 12 10:27:31 2019 : Debug: (0) No attributes updated for RHS &session-state: Thu Sep 12 10:27:31 2019 : Debug: (0) } # update = noop Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[post-auth]: calling sql (rlm_sql) Thu Sep 12 10:27:31 2019 : Debug: .query Thu Sep 12 10:27:31 2019 : Debug: Parsed xlat tree: Thu Sep 12 10:27:31 2019 : Debug: literal --> .query Thu Sep 12 10:27:31 2019 : Debug: (0) sql: EXPAND .query Thu Sep 12 10:27:31 2019 : Debug: (0) sql: --> .query Thu Sep 12 10:27:31 2019 : Debug: (0) sql: Using query template 'query' Thu Sep 12 10:27:31 2019 : Debug: rlm_sql (sql): Reserved connection (0) Thu Sep 12 10:27:31 2019 : Debug: %{User-Name} Thu Sep 12 10:27:31 2019 : Debug: Parsed xlat tree: Thu Sep 12 10:27:31 2019 : Debug: attribute --> User-Name Thu Sep 12 10:27:31 2019 : Debug: (0) sql: EXPAND %{User-Name} Thu Sep 12 10:27:31 2019 : Debug: (0) sql: --> 3c15c2e840fe Thu Sep 12 10:27:31 2019 : Debug: (0) sql: SQL-User-Name set to '3c15c2e840fe' Thu Sep 12 10:27:31 2019 : Debug: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') Thu Sep 12 10:27:31 2019 : Debug: Parsed xlat tree: Thu Sep 12 10:27:31 2019 : Debug: literal --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( ' Thu Sep 12 10:27:31 2019 : Debug: attribute --> SQL-User-Name Thu Sep 12 10:27:31 2019 : Debug: literal --> ', ' Thu Sep 12 10:27:31 2019 : Debug: XLAT-IF { Thu Sep 12 10:27:31 2019 : Debug: attribute --> User-Password Thu Sep 12 10:27:31 2019 : Debug: } Thu Sep 12 10:27:31 2019 : Debug: XLAT-ELSE { Thu Sep 12 10:27:31 2019 : Debug: attribute --> CHAP-Password Thu Sep 12 10:27:31 2019 : Debug: } Thu Sep 12 10:27:31 2019 : Debug: literal --> ', ' Thu Sep 12 10:27:31 2019 : Debug: attribute --> Packet-Type Thu Sep 12 10:27:31 2019 : Debug: literal --> ', ' Thu Sep 12 10:27:31 2019 : Debug: percent --> S Thu Sep 12 10:27:31 2019 : Debug: literal --> ') Thu Sep 12 10:27:31 2019 : Debug: (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') Thu Sep 12 10:27:31 2019 : Debug: (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '3c15c2e840fe', '3c15c2e840fe', 'Access-Accept', '2019-09-12 10:27:31') Thu Sep 12 10:27:31 2019 : Debug: (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '3c15c2e840fe', '3c15c2e840fe', 'Access-Accept', '2019-09-12 10:27:31') Thu Sep 12 10:27:31 2019 : Debug: (0) sql: SQL query returned: success Thu Sep 12 10:27:31 2019 : Debug: (0) sql: 1 record(s) updated Thu Sep 12 10:27:31 2019 : Debug: rlm_sql (sql): Released connection (0) Thu Sep 12 10:27:31 2019 : Info: Need 5 more connections to reach 10 spares Thu Sep 12 10:27:31 2019 : Info: rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[post-auth]: returned from sql (rlm_sql) Thu Sep 12 10:27:31 2019 : Debug: (0) [sql] = ok Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec) Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec) Thu Sep 12 10:27:31 2019 : Debug: (0) [exec] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) policy remove_reply_message_if_eap { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) { Thu Sep 12 10:27:31 2019 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Thu Sep 12 10:27:31 2019 : Debug: (0) else { Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) Thu Sep 12 10:27:31 2019 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) Thu Sep 12 10:27:31 2019 : Debug: (0) [noop] = noop Thu Sep 12 10:27:31 2019 : Debug: (0) } # else = noop Thu Sep 12 10:27:31 2019 : Debug: (0) } # policy remove_reply_message_if_eap = noop Thu Sep 12 10:27:31 2019 : Debug: (0) } # post-auth = ok Thu Sep 12 10:27:31 2019 : Debug: (0) Sent Access-Accept Id 26 from 129.217.228.164:1812 to 129.217.228.186:32776 length 0 Thu Sep 12 10:27:31 2019 : Debug: (0) Cisco-AVPair = "psk-mode=ascii" Thu Sep 12 10:27:31 2019 : Debug: (0) Cisco-AVPair = "psk=abcdefgh" Thu Sep 12 10:27:31 2019 : Debug: (0) Finished request -------------------------------- configuration with mysql -------------------------------- +----+--------------+--------------+----+----------------+ | id | username | attribute | op | value | +----+--------------+--------------+----+----------------+ | 1 | 3c15c2e840fe | Auth-Type | := | Accept | | 2 | 3c15c2e840fe | cisco-AVPair | == | psk-mode=ascii | | 3 | 3c15c2e840fe | cisco-AVPair | == | psk=abcdefgh | +----+--------------+--------------+----+----------------+ debug output: --------------------------------- Thu Sep 12 10:21:00 2019 : Debug: (9) Received Access-Request Id 25 from 129.217.228.186:32776 to 129.217.228.164:1812 length 255 Thu Sep 12 10:21:00 2019 : Debug: (9) User-Name = "3c15c2e840fe" Thu Sep 12 10:21:00 2019 : Debug: (9) Called-Station-Id = "70-ea-1a-84-18-c0:itmc-ipsk" Thu Sep 12 10:21:00 2019 : Debug: (9) Calling-Station-Id = "3c-15-c2-e8-40-fe" Thu Sep 12 10:21:00 2019 : Debug: (9) NAS-Port = 1 Thu Sep 12 10:21:00 2019 : Debug: (9) NAS-IP-Address = 129.217.251.242 Thu Sep 12 10:21:00 2019 : Debug: (9) NAS-Identifier = "wlc-staging" Thu Sep 12 10:21:00 2019 : Debug: (9) Airespace-Wlan-Id = 10 Thu Sep 12 10:21:00 2019 : Debug: (9) User-Password = "3c15c2e840fe" Thu Sep 12 10:21:00 2019 : Debug: (9) Service-Type = Call-Check Thu Sep 12 10:21:00 2019 : Debug: (9) Framed-MTU = 1300 Thu Sep 12 10:21:00 2019 : Debug: (9) NAS-Port-Type = Wireless-802.11 Thu Sep 12 10:21:00 2019 : Debug: (9) Tunnel-Type:0 = VLAN Thu Sep 12 10:21:00 2019 : Debug: (9) Tunnel-Medium-Type:0 = IEEE-802 Thu Sep 12 10:21:00 2019 : Debug: (9) Tunnel-Private-Group-Id:0 = "3503" Thu Sep 12 10:21:00 2019 : Debug: (9) Cisco-AVPair = "audit-session-id=81d9fbf2000001445d79fab6" Thu Sep 12 10:21:00 2019 : Debug: (9) Acct-Session-Id = "5d79fab6/3c:15:c2:e8:40:fe/1256" Thu Sep 12 10:21:00 2019 : Debug: (9) session-state: No State attribute Thu Sep 12 10:21:00 2019 : Debug: (9) # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu Sep 12 10:21:00 2019 : Debug: (9) authorize { Thu Sep 12 10:21:00 2019 : Debug: (9) policy filter_username { Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name) { Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name) -> TRUE Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name) { Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ / /) { Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ / /) -> FALSE Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ /@[^@]*@/ ) { Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ /\.\./ ) { Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ /\.\./ ) -> FALSE Thu Sep 12 10:21:00 2019 : Debug: (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Thu Sep 12 10:21:00 2019 : Debug: (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ /\.$/) { Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ /\.$/) -> FALSE Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ /(a)\./) { Thu Sep 12 10:21:00 2019 : Debug: (9) if (&User-Name =~ /(a)\./) -> FALSE Thu Sep 12 10:21:00 2019 : Debug: (9) } # if (&User-Name) = notfound Thu Sep 12 10:21:00 2019 : Debug: (9) } # policy filter_username = notfound Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling preprocess (rlm_preprocess) Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from preprocess (rlm_preprocess) Thu Sep 12 10:21:00 2019 : Debug: (9) [preprocess] = ok Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling chap (rlm_chap) Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from chap (rlm_chap) Thu Sep 12 10:21:00 2019 : Debug: (9) [chap] = noop Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling mschap (rlm_mschap) Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from mschap (rlm_mschap) Thu Sep 12 10:21:00 2019 : Debug: (9) [mschap] = noop Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling digest (rlm_digest) Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from digest (rlm_digest) Thu Sep 12 10:21:00 2019 : Debug: (9) [digest] = noop Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling suffix (rlm_realm) Thu Sep 12 10:21:00 2019 : Debug: (9) suffix: Checking for suffix after "@" Thu Sep 12 10:21:00 2019 : Debug: (9) suffix: No '@' in User-Name = "3c15c2e840fe", looking up realm NULL Thu Sep 12 10:21:00 2019 : Debug: (9) suffix: No such realm "NULL" Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from suffix (rlm_realm) Thu Sep 12 10:21:00 2019 : Debug: (9) [suffix] = noop Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling eap (rlm_eap) Thu Sep 12 10:21:00 2019 : Debug: (9) eap: No EAP-Message, not doing EAP Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from eap (rlm_eap) Thu Sep 12 10:21:00 2019 : Debug: (9) [eap] = noop Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling files (rlm_files) Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from files (rlm_files) Thu Sep 12 10:21:00 2019 : Debug: (9) [files] = noop Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling sql (rlm_sql) Thu Sep 12 10:21:00 2019 : Debug: %{User-Name} Thu Sep 12 10:21:00 2019 : Debug: Parsed xlat tree: Thu Sep 12 10:21:00 2019 : Debug: attribute --> User-Name Thu Sep 12 10:21:00 2019 : Debug: (9) sql: EXPAND %{User-Name} Thu Sep 12 10:21:00 2019 : Debug: (9) sql: --> 3c15c2e840fe Thu Sep 12 10:21:00 2019 : Debug: (9) sql: SQL-User-Name set to '3c15c2e840fe' Thu Sep 12 10:21:00 2019 : Debug: rlm_sql (sql): Reserved connection (10) Thu Sep 12 10:21:00 2019 : Debug: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Sep 12 10:21:00 2019 : Debug: Parsed xlat tree: Thu Sep 12 10:21:00 2019 : Debug: literal --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = ' Thu Sep 12 10:21:00 2019 : Debug: attribute --> SQL-User-Name Thu Sep 12 10:21:00 2019 : Debug: literal --> ' ORDER BY id Thu Sep 12 10:21:00 2019 : Debug: (9) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Sep 12 10:21:00 2019 : Debug: (9) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '3c15c2e840fe' ORDER BY id Thu Sep 12 10:21:00 2019 : Debug: (9) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '3c15c2e840fe' ORDER BY id Thu Sep 12 10:21:00 2019 : The 'rlm_sql_null' driver CANNOT be used for SELECTS. Thu Sep 12 10:21:00 2019 : Please update the 'sql' module configuration to use a real database. Thu Sep 12 10:21:00 2019 : Set 'driver = ...' to the database you want to use. Thu Sep 12 10:21:00 2019 : Debug: (9) sql: ... falling-through to group processing Thu Sep 12 10:21:00 2019 : Debug: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority Thu Sep 12 10:21:00 2019 : Debug: Parsed xlat tree: Thu Sep 12 10:21:00 2019 : Debug: literal --> SELECT groupname FROM radusergroup WHERE username = ' Thu Sep 12 10:21:00 2019 : Debug: attribute --> SQL-User-Name Thu Sep 12 10:21:00 2019 : Debug: literal --> ' ORDER BY priority Thu Sep 12 10:21:00 2019 : Debug: rlm_sql (sql): Reserved connection (3) Thu Sep 12 10:21:00 2019 : Debug: rlm_sql (sql): Released connection (3) Thu Sep 12 10:21:00 2019 : Debug: (9) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority Thu Sep 12 10:21:00 2019 : Debug: (9) sql: --> SELECT groupname FROM radusergroup WHERE username = '3c15c2e840fe' ORDER BY priority Thu Sep 12 10:21:00 2019 : Debug: (9) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '3c15c2e840fe' ORDER BY priority Thu Sep 12 10:21:00 2019 : The 'rlm_sql_null' driver CANNOT be used for SELECTS. Thu Sep 12 10:21:00 2019 : Please update the 'sql' module configuration to use a real database. Thu Sep 12 10:21:00 2019 : Set 'driver = ...' to the database you want to use. Thu Sep 12 10:21:00 2019 : Debug: (9) sql: User not found in any groups Thu Sep 12 10:21:00 2019 : Debug: (9) sql: ... falling-through to profile processing Thu Sep 12 10:21:00 2019 : Debug: rlm_sql (sql): Released connection (10) Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from sql (rlm_sql) Thu Sep 12 10:21:00 2019 : Debug: (9) [sql] = notfound Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling expiration (rlm_expiration) Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from expiration (rlm_expiration) Thu Sep 12 10:21:00 2019 : Debug: (9) [expiration] = noop Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling logintime (rlm_logintime) Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from logintime (rlm_logintime) Thu Sep 12 10:21:00 2019 : Debug: (9) [logintime] = noop Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: calling pap (rlm_pap) Thu Sep 12 10:21:00 2019 : WARNING: (9) pap: No "known good" password found for the user. Not setting Auth-Type Thu Sep 12 10:21:00 2019 : WARNING: (9) pap: Authentication will fail unless a "known good" password is available Thu Sep 12 10:21:00 2019 : Debug: (9) modsingle[authorize]: returned from pap (rlm_pap) Thu Sep 12 10:21:00 2019 : Debug: (9) [pap] = noop Thu Sep 12 10:21:00 2019 : Debug: (9) } # authorize = ok Thu Sep 12 10:21:00 2019 : ERROR: (9) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject Thu Sep 12 10:21:00 2019 : Debug: (9) Failed to authenticate the user Mit freundlichen Grüßen Hans Bornemann TU Dortmund ITMC / Datanet Tel. 0231 7552132

2 5

Re: Is it possible to automate a Disconnect-Request based on exceeded Monthly-Usage?
by Houman 13 Sep '19

13 Sep '19

Hi Alan and Jorge, Sorry, I should have explained that I'm using StrongSwan as my NAS, which is supporting CoA : --- StrongSwan Release 4.6.3 <https://wiki.strongswan.org/projects/strongswan/wiki/463> introduces support for the RADIUS Session-Timeout attribute and the Dynamic Authorization extension, RFC 5176. A received Session-Timeout from the RADIUS backend is enforced using Repeated Authentication, RFC 4478. The Dynamic Authorization Extension allows a RADIUS backend to actively terminate a session using a Disconnect-Request, or change the timeout of a session using a Session-Timeout attribute in a CoA-Request. The extension is enabled using a *dae* section in the *eap-radius* configuration --- I can see when I send a Disconnect-Request manually like this: echo User-Name=houman | radclient -x 127.0.0.1:3799 disconnect ''secret123'' The NAS is able to see the CoA packet and disconnects the user already. I have found the home server example in sites-available/originate-coa. I think I have to set it up under /etc/freeradius/3.0/proxy.cnf. Alan, I'm a bit lost here when you said: > That's what "originate-com" is for. > The documentation isn't perfect, but it should be good. When you receive an accounting >request packet, check for over the limit, and if so, send a Disconnect-Request packet. I think you mean I have to do that in /etc/freeradius/3.0/sites-enabled/default under the section: update request { ... } In what programming language do I have to do that? I think it has to be in SQL right? I already do this to capture the monthly usage upon each request: update request { Monthly-Usage = "%{sql:SELECT COALESCE((SUM(`acctoutputoctets`)), 0) FROM radacct WHERE `username`='%{User-Name}' AND Month(acctupdatetime)=(Month(NOW())) AND Year(acctupdatetime)=Year(NOW())}" } Now I need to add another line underneath to compare the Monthly-Usage against a value and then send the Disconnect-Request if it's greater than the value. How Do I raise the Disconnect-Request? Many Thanks, Houman

2 5

Format date and time for linelog
by R3DNano 13 Sep '19

13 Sep '19

I have to output the current date and time via linelog on a specific way. *DD/MM/YYY,HH:MM:SS* I've figured out all of the fields but the seconds one. There's no seconds expansion on the documentation: https://wiki.freeradius.org/config/run_time_variables I was wondering if there's any alternative way, since I've seen there's a %S variable that outputs almost what I want: Except, it uses dash instead of forward slash for date separation and that it outputs both date and time separated by a space, while I have to use a comma between those two, since they are going on different fields. Is there a way to manipulate (substitute) characters? or a better way of achieving this? Regards.

2 2

Conditional modules and dynamically attributes
by Viktor Kolesnikov 13 Sep '19

13 Sep '19

Hi everyone! I have freeradius 3.0.20 and use rlm_ldap as a conditional module in the authorize section like this authorize { ... sql if (notfound) { -ldap if (&LDAP-Group == '% {Group-Name}') { update { &control:Auth-Type: = ldap } } else { ... } } ... } I enable and disable (if it is not configured) module by creating/deleting a link in the mods-enabled/ directory, but when the module is disabled, I cannot use the attribute LDAP-Group in the condition because it loads dynamically when the module loads. I found this issue https://github.com/FreeRADIUS/freeradius-server/issues/1642 but it says nothing if a conditional module is used. How can I use dynamically loads attributes such as LDAP-Group or SQL-Group and conditional modules? -- Viktor

2 5

eap type for Windows client authentication without certificate
by Tal Nur 13 Sep '19

13 Sep '19

Hi All, I think I'm asking simple question.I installed FR 3.0.19 for eduroam and I used configuration files from eduroam.org.I noticed that my Windows clients must install CA certificate to successfully log in.My question is what type our EAP I should to use to allow them be authenticated without certificate?Is it possible to use both types of authentication at the same time? Here is my eap file: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = QwerAsdf1992! private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } mschapv2 { } }

2 2

Freeradius, building from sources using unixodbc-dev not libiodbc2-dev package.
by CpServiceSPb . 12 Sep '19

12 Sep '19

I plan to install Asterisk and Freeradius at teh same Ubuntu server, that is to build from sources. But there is dependency conflict. Asterisk needs unixodbc-dev for correctly working with DBs, as Freeradius requires libiodbc2-dev. And it conflicts each other. Is it possible to make Freeradius with unixodbc-dev without functionality lacking ? Or it is not and is libiodbc2-dev only required ?

2 1

How to send a challenge request via PEAP-GTC
by ngoetz24＠gmail.com 11 Sep '19

11 Sep '19

Is it possible to send a challenge response to a user asking them to enter a OPT (One Time Password) token using PEAP with GTC? I have followed the documentation example and got this working with PAP, but our security team will not allow us to use PAP due to security concerns with the week encryption used by PAP. I also tried to do this via EAP-TTLS, but when I posted the issue I was having, I was informed that EAP-TTLS has a fixed packet flow, and that I should use EAP-GTS in the inner tunnel. I am trying to do this now, but I am obviously doing something wrong. I am trying to follow the documentation, but I could not find any examples of sending a challenge via PEAP with GTC. Is this even possible, or is PAP the only way to send a challenge request to the user? The problem I seem to be having is that when I use "challenge" in the authenticate section of the inner-tunnel configuration it seems to break the tunnel. When I do this I get the following error message in the debug: eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed. My guess is that I am trying to do the challenge from the wrong location in the configuration, but I am not sure where the proper place is. My inner-tunnel is configured as follows: server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { filter_username chap mschap suffix update control { &Proxy-To-Realm := LOCAL } eap { ok = return } files pap } authenticate { Auth-Type PAP { pap } Auth-Type MSCHAP { mschap } mschap Auth-Type ntlm_auth { ntlm_auth if (ok) { update reply { # Create a random State attribute: State := "%{randstr:aaaaaaaaaaaaaaaa}" Reply-Message := "Please enter OTP" } # Return Access-Challenge: challenge } } eap } session { radutmp } post-auth { if (0) { update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY } update { &outer.session-state: += &reply: } } Post-Auth-Type REJECT { -sql attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { eap } } Here is a copy of the section of the debug where it seems to break: (18) eap_peap: Continuing EAP-TLS (18) eap_peap: Peer indicated complete TLS record size will be 42 bytes (18) eap_peap: Got complete TLS record (42 bytes) (18) eap_peap: [eaptls verify] = length included (18) eap_peap: [eaptls process] = ok (18) eap_peap: Session established. Decoding tunneled attributes (18) eap_peap: PEAP state phase2 (18) eap_peap: EAP method GTC (6) (18) eap_peap: Got tunneled request (18) eap_peap: EAP-Message = 0x020800110643306b3343306b3331323334 (18) eap_peap: Setting User-Name to test-user (18) eap_peap: Sending tunneled request to inner-tunnel (18) eap_peap: EAP-Message = 0x020800110643306b3343306b3331323334 (18) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (18) eap_peap: User-Name = " test-user " (18) eap_peap: State = 0x48f270f749fa76fc54bf6bce0580ffa4 (18) eap_peap: Framed-MTU = 1200 (18) eap_peap: Service-Type = Framed-User (18) eap_peap: NAS-Identifier = "Test" (18) eap_peap: NAS-IP-Address = 151.143.16.5 (18) eap_peap: Event-Timestamp = "Sep 11 2019 10:09:42 PDT" (18) Virtual server inner-tunnel received request (18) EAP-Message = 0x020800110643306b3343306b3331323334 (18) FreeRADIUS-Proxied-To = 127.0.0.1 (18) User-Name = " test-user " (18) State = 0x48f270f749fa76fc54bf6bce0580ffa4 (18) Framed-MTU = 1200 (18) Service-Type = Framed-User (18) NAS-Identifier = "Test" (18) NAS-IP-Address = 151.143.16.5 (18) Event-Timestamp = "Sep 11 2019 10:09:42 PDT" (18) server inner-tunnel { (18) session-state: No cached attributes (18) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (18) authorize { (18) policy filter_username { (18) if (&User-Name) { (18) if (&User-Name) -> TRUE (18) if (&User-Name) { (18) if (&User-Name =~ / /) { (18) if (&User-Name =~ / /) -> FALSE (18) if (&User-Name =~ /@[^@]*@/ ) { (18) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (18) if (&User-Name =~ /\.\./ ) { (18) if (&User-Name =~ /\.\./ ) -> FALSE (18) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (18) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (18) if (&User-Name =~ /\.$/) { (18) if (&User-Name =~ /\.$/) -> FALSE (18) if (&User-Name =~ /(a)\./) { (18) if (&User-Name =~ /(a)\./) -> FALSE (18) } # if (&User-Name) = notfound (18) } # policy filter_username = notfound (18) [chap] = noop (18) [mschap] = noop (18) suffix: Checking for suffix after "@" (18) suffix: No '@' in User-Name = " test-user ", looking up realm NULL (18) suffix: No such realm "NULL" (18) [suffix] = noop (18) update control { (18) &Proxy-To-Realm := LOCAL (18) } # update control = noop (18) eap: Peer sent EAP Response (code 2) ID 8 length 17 (18) eap: No EAP Start, assuming it's an on-going EAP conversation (18) [eap] = updated (18) [files] = noop (18) [pap] = noop (18) } # authorize = updated (18) Found Auth-Type = eap (18) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (18) authenticate { (18) eap: Expiring EAP session with state 0x48f270f749fa76fc (18) eap: Finished EAP session with state 0x48f270f749fa76fc (18) eap: Previous EAP request found for state 0x48f270f749fa76fc, released from the list (18) eap: Peer sent packet with method EAP GTC (6) (18) eap: Calling submodule eap_gtc to process data (18) eap_gtc: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (18) eap_gtc: Auth-Type ntlm_auth { (18) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=EDD_LOCAL --username=%{mschap:User-Name} --password=%{User-Password}: (18) ntlm_auth: EXPAND --username=%{mschap:User-Name} (18) ntlm_auth: --> --username= test-user (18) ntlm_auth: EXPAND --password=%{User-Password} (18) ntlm_auth: --> --password=Test-Password (18) ntlm_auth: Program returned code (0) and output 'NT_STATUS_OK: The operation completed successfully. (0x0)' (18) ntlm_auth: Program executed successfully (18) [ntlm_auth] = ok (18) if (ok) { (18) if (ok) -> TRUE (18) if (ok) { (18) update reply { (18) EXPAND %{randstr:aaaaaaaaaaaaaaaa} (18) --> 96SQAtQhOkKcI9Gb (18) State := 0x39365351417451684f6b4b6349394762 (18) Reply-Message := "Please enter OTP" (18) } # update reply = noop (18) policy challenge { (18) update control { (18) &Response-Packet-Type = Access-Challenge (18) } # update control = noop (18) [handled] = handled (18) } # policy challenge = handled (18) } # if (ok) = handled (18) } # Auth-Type ntlm_auth = handled (18) eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed (18) eap: Sending EAP Failure (code 4) ID 8 length 4 (18) eap: Failed in EAP select (18) [eap] = invalid (18) } # authenticate = invalid (18) Failed to authenticate the user (18) Using Post-Auth-Type Reject (18) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (18) Post-Auth-Type REJECT { (18) attr_filter.access_reject: EXPAND %{User-Name} (18) attr_filter.access_reject: --> test-user (18) attr_filter.access_reject: Matched entry DEFAULT at line 11 (18) [attr_filter.access_reject] = updated (18) update outer.session-state { (18) &Module-Failure-Message := &request:Module-Failure-Message -> 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed' (18) } # update outer.session-state = noop (18) } # Post-Auth-Type REJECT = updated (18) } # server inner-tunnel (18) Virtual server sending reply (18) Reply-Message := "Please enter OTP" (18) EAP-Message = 0x04080004 (18) Message-Authenticator = 0x00000000000000000000000000000000 (18) eap_peap: Got tunneled reply code 3 (18) eap_peap: Reply-Message := "Please enter OTP" (18) eap_peap: EAP-Message = 0x04080004 (18) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (18) eap_peap: Got tunneled reply RADIUS code 3 (18) eap_peap: Reply-Message := "Please enter OTP" (18) eap_peap: EAP-Message = 0x04080004 (18) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (18) eap_peap: Tunneled authentication was rejected (18) eap_peap: FAILURE (18) eap: Sending EAP Request (code 1) ID 9 length 46 (18) eap: EAP session adding &reply:State = 0xaa5507c9a25c1ecd (18) [eap] = handled (18) } # authenticate = handled (18) Using Post-Auth-Type Challenge (18) Post-Auth-Type sub-section not found. Ignoring. (18) # Executing group from file /etc/raddb/sites-enabled/default (18) session-state: Saving cached attributes (18) Module-Failure-Message := "eap: Failed continuing EAP GTC (6) session. EAP sub-module failed" (18) Sent Access-Challenge Id 8 from 151.143.230.42:1812 to 151.143.16.5:48021 length 0 (18) EAP-Message = 0x0109002e19001703030023c75c4bff687aa6d3f1bdb96e186b084df07da99dd0cc0c16b678 094cb04ef7d6fee216 (18) Message-Authenticator = 0x00000000000000000000000000000000 (18) State = 0xaa5507c9a25c1ecdfce0263177f07a1c (18) Finished request

2 5

Log file format
by John Horne 11 Sep '19

11 Sep '19

Hello, I can see in our 'radius.log' file entries such as: ====== Wed Sep 11 17:33:27 2019 : Auth: (1746809) Login OK: [snipped] Wed Sep 11 17:33:28 2019 : Auth: (1746811) Login incorrect (Home Server says so): [snipped] ====== My question is what are the numbers 1746809 and 1746811? They are too small to be an epoch time, and as a number of seconds don't correspond to the server uptime. Thanks, John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

2 1