- Freeradius-Users - lists.freeradius.org

Separate pam modules for multiple clients
by Jeff McCarty 09 Feb '18

09 Feb '18

I’m running FreeRadius 3.0.13 on RedHat EL 7 with IdM. IdM provides host-based access control by accepting or rejecting authentication via PAM. I’d like to set up two FreeRadius clients that authenticate users using two different PAM modules. It looks like the person in this thread was doing the same thing, but I can’t tell from the discussion how to set everything up: http://freeradius.1045715.n5.nabble.com/multiple-instances-of-pam-module-td… <http://freeradius.1045715.n5.nabble.com/multiple-instances-of-pam-module-td…> I have changed the user and group to root in radiusd.conf because I’ve read that PAM won’t work with the radiusd user. I’ve added the following line to mods-config/files/authorize: DEFAULT Auth-Type := pam I have multiple modules set up in my pam config file as below and have symlinked it to the mods-enabled folder: pam { pam_auth = radiusd } pam pam-one { pam_auth = radiusd-one } pam pam-two { pam_auth = radiusd-two } I have created a file in sites-available and symlinked it to sites-enabled with the following contents: server server-one { authenticate { pam-one } } server server-two { authenticate { pam-two } } And in my clients.conf file, I have: client client-one { ipaddr = 192.168.0.1 secret = secret-one virtual_server = server-one } client client-two { ipaddr = 192.168.0.2 secret = secret-two virtual_server = server-two } With this configuration, no matter which client I use, it authenticates against the default radiusd PAM module. What am I missing?

2 4

cafe wifi with freeradius
by Muhammed Buvaydani 09 Feb '18

09 Feb '18

Hello I working on freeradius management system and I wish to install it into cafe . my system contain self registiration so user can register for new account and password will send through sms . my question is how can I prevent another users from using my system ie . I want only cafe clients to use my system . so if user is inside my cafe and has table he can Access internet by register new account . how can I do this ? how can I prevent non client user from Access login page . I have idea like putting QR code onto every table inside my cafe and if user want to acccess internet he must read this code by his phone and he will redirect to register page to has new account , but I don't know how to implement this idea Are thgere any idea or way to make this

2 1

Failed to find "ldap" in the "modules" section.
by Muhammed Buvaydani 09 Feb '18

09 Feb '18

My freeradius server give me this error : /etc/freeradius/sites-enabled/default[234]: Failed to find "ldap" in the "modules" section. /etc/freeradius/sites-enabled/default[69]: Errors parsing authorize section. Even if I have ldap file in modules folder This is the content of ldap file ldap 127.0.0.1 { server =127.0.0.1 identity = 'cn=root,cn=dc=netcom,dc=com' password = roots # basedn = 'o=novell' filter = '(cn=%{Stripped-User-Name:-%{User-Name}})' port = 636 tls_mode = yes dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # for EAP/802.1x password_attribute = nspmPassword edir_account_policy_check=yes timeout = 8 timelimit = 3 net_timeout = 1 # so I don't have to enable the users to allow access access_attr_used_for_allow = no }

1 0

Freeradius with hotels
by Muhammed Buvaydani 09 Feb '18

09 Feb '18

Hello I working on freeradius management system and I wish to implement freeradius with hotels database but I have problems with this . Hotels have different databases and different database integration I want to make authentication using room number and guest name . I don't know alote about this idea so How can I do this integration with freeradius

3 2

Different bandwidth for Day & Night in FR
by JAHANZAIB SYED 08 Feb '18

08 Feb '18

OS: Using Ubuntu / Freeradius for user authentication. NAS is mikrotik ver 6.x Scenario: I am trying to implement 'different bandwidth for day & night' from 8am-till-8pm > 1mb from 8pm-till-8am > 2mb I dont know much about freeradius inside core, therefore so far I have think of following, I have created separate table in which i have a dded username / bandwidth for night, start/end time / COA sent flag. mysql> select * from users_bwsch; +----+----------+-----------+----------+----------+------------------+----------------+ | id | username | bwpkg | start | end | start_alert_sent | end_alert_sent | +----+----------+-----------+----------+----------+------------------+----------------+ | 1 | zaib | 2048k/2048k | 11:00:00 | 20:00:00 | 0 | 0 | +----+----------+-----------+----------+----------+------------------+----------------+ I know howto use COA, but confused on howto do multiple IF statement in ACCOUNTING section 1) Using UNLAG query in FR , check the start and end time and match with NOW, if time matches, & start_alert_coa flag is 0 then send COA and update start_alert_sent to 1, when time ends, send COA to change pkg to original one and set FLAG end_alert_sent to 1, and something more ... OR 2) Using external script to do the checking and send COA using radclient? I believe there might be more suitable methods to achieve this , that is why I am seeking help from list members. Regards, Jz <http:///>

2 3

Different databases with single freeradius
by Emrah Yıldırım 08 Feb '18

08 Feb '18

Hi, http://freeradius.1045715.n5.nabble.com/Reg-Different-databases-with-single… I'm asking for your help with the subject. Would you please provide more open and more concrete information? I've separated the databases. I present the same problem... The Radacct table is visible to everyone. Please help. Regards

5 14

Re: Different databases with single freeradius
by Alan Buxey 07 Feb '18

07 Feb '18

You don't need to send all that junk. Just send the output of free radius daemon run with -X , including an example of when an with is dealt with. Anyway, I've already given you the required lead in my previous response alan On 7 Feb 2018 9:06 pm, "Emrah Yıldırım" <emrah.yldrm81(a)gmail.com> wrote: First of all, I'm sorry. I sent out the changes I made and the Freeradius-X output. If I need to share other information, please tell me to share. >Of course, that won't work as-is. Because you have given *zero* information about the usernames, SQL instance names, etc >If you give more information, you get better answers. > > *freeradius -X* # Instantiating module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Loaded module rlm_always # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_unix # Instantiating module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_digest # Instantiating module "digest" from file /etc/freeradius/mods-enabled/digest } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server default { # from file /etc/freeradius/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 56236 Ready to process requests. Received Access-Request Id 44 from 192.168.6.1:15001 to 192.168.6.237:1812 length 133 NAS-IP-Address = 192.168.5.53 NAS-Identifier = 'pfSense.localdomain' User-Name = 'alandekok' User-Password = '123' Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 2000 Framed-IP-Address = 192.168.6.17 Called-Station-Id = '192.168.5.53' Calling-Station-Id = '68-5d-43-1d-c6-da' (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") (0) EXPAND %{tolower:%{User-Name}} (0) --> alandekok (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (User-Name =~ /\\.$/) (0) if (User-Name =~ /\\.$/) -> FALSE (0) if (User-Name =~ /(a)\\./) (0) if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "alandekok", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) db1 : EXPAND %{User-Name} (0) db1 : --> alandekok (0) db1 : SQL-User-Name set to 'alandekok' rlm_sql (db1): Reserved connection (4) (0) db1 : EXPAND SELECT id, username, attribu, value, op FROM rad_checks WHERE username = '%{SQL-User-Name}' ORDER BY id (0) db1 : --> SELECT id, username, attribu, value, op FROM rad_checks WHERE username = 'alandekok' ORDER BY id rlm_sql (db1): Executing query: 'SELECT id, username, attribu, value, op FROM rad_checks WHERE username = 'alandekok' ORDER BY id' (0) db1 : EXPAND SELECT groupname FROM rad_user_groups WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) db1 : --> SELECT groupname FROM rad_user_groups WHERE username = 'alandekok' ORDER BY priority rlm_sql (db1): Executing query: 'SELECT groupname FROM rad_user_groups WHERE username = 'alandekok' ORDER BY priority' (0) db1 : User not found in any groups rlm_sql (db1): Released connection (4) (0) [db1] = notfound (0) db2 : EXPAND %{User-Name} (0) db2 : --> alandekok (0) db2 : SQL-User-Name set to 'alandekok' rlm_sql (db2): Reserved connection (4) (0) db2 : EXPAND SELECT id, username, attribu, value, op FROM rad_checks WHERE username = '%{SQL-User-Name}' ORDER BY id (0) db2 : --> SELECT id, username, attribu, value, op FROM rad_checks WHERE username = 'alandekok' ORDER BY id rlm_sql (db2): Executing query: 'SELECT id, username, attribu, value, op FROM rad_checks WHERE username = 'alandekok' ORDER BY id' (0) db2 : User found in radcheck table (0) db2 : Check items matched (0) db2 : EXPAND SELECT id, username, attribu, value, op FROM rad_replies WHERE username = '%{SQL-User-Name}' ORDER BY id (0) db2 : --> SELECT id, username, attribu, value, op FROM rad_replies WHERE username = 'alandekok' ORDER BY id rlm_sql (db2): Executing query: 'SELECT id, username, attribu, value, op FROM rad_replies WHERE username = 'alandekok' ORDER BY id' (0) db2 : EXPAND SELECT groupname FROM rad_user_groups WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) db2 : --> SELECT groupname FROM rad_user_groups WHERE username = 'alandekok' ORDER BY priority rlm_sql (db2): Executing query: 'SELECT groupname FROM rad_user_groups WHERE username = 'alandekok' ORDER BY priority' (0) db2 : User found in the group table (0) db2 : EXPAND SELECT id, groupname, attribu, Value, op FROM rad_group_checks WHERE groupname = '%{Sql-Group}' ORDER BY id (0) db2 : --> SELECT id, groupname, attribu, Value, op FROM rad_group_checks WHERE groupname = 'group6mbit' ORDER BY id rlm_sql (db2): Executing query: 'SELECT id, groupname, attribu, Value, op FROM rad_group_checks WHERE groupname = 'group6mbit' ORDER BY id' (0) db2 : Group "group6mbit" check items matched (0) db2 : EXPAND SELECT id, groupname, attribu, value, op FROM rad_group_replies WHERE groupname = '%{Sql-Group}' ORDER BY id (0) db2 : --> SELECT id, groupname, attribu, value, op FROM rad_group_replies WHERE groupname = 'group6mbit' ORDER BY id rlm_sql (db2): Executing query: 'SELECT id, groupname, attribu, value, op FROM rad_group_replies WHERE groupname = 'group6mbit' ORDER BY id' (0) db2 : Group "group6mbit" reply items processed rlm_sql (db2): Released connection (4) (0) [db2] = ok (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: dailycounter : Couldn't find control attribute 'control:Max-Daily-Session' (0) [dailycounter] = noop (0) WARNING: noresetcounter : Couldn't find control attribute 'control:Max-All-Session' (0) [noresetcounter] = noop (0) WARNING: monthlycounter : Couldn't find control attribute 'control:Max-Monthly-Session' (0) [monthlycounter] = noop (0) WARNING: expire_on_login : Couldn't find control attribute 'control:Expire-After' (0) [expire_on_login] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type PAP { (0) pap : Login attempt with password (0) pap : User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) db1 : EXPAND .query (0) db1 : --> .query (0) db1 : Using query template 'query' rlm_sql (db1): Reserved connection (4) (0) db1 : EXPAND %{User-Name} (0) db1 : --> alandekok (0) db1 : SQL-User-Name set to 'alandekok' (0) db1 : EXPAND INSERT INTO rad_post_auths (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) db1 : --> INSERT INTO rad_post_auths (username, pass, reply, authdate) VALUES ( 'alandekok', '123', 'Access-Accept', '2018-02-07 22:46:21') rlm_sql (db1): Executing query: 'INSERT INTO rad_post_auths (username, pass, reply, authdate) VALUES ( 'alandekok', '123', 'Access-Accept', '2018-02-07 22:46:21')' rlm_sql (db1): Released connection (4) (0) [db1] = ok (0) db2 : EXPAND .query (0) db2 : --> .query (0) db2 : Using query template 'query' rlm_sql (db2): Reserved connection (4) (0) db2 : EXPAND %{User-Name} (0) db2 : --> alandekok (0) db2 : SQL-User-Name set to 'alandekok' (0) db2 : EXPAND INSERT INTO rad_post_auths (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) db2 : --> INSERT INTO rad_post_auths (username, pass, reply, authdate) VALUES ( 'alandekok', '123', 'Access-Accept', '2018-02-07 22:46:21') rlm_sql (db2): Executing query: 'INSERT INTO rad_post_auths (username, pass, reply, authdate) VALUES ( 'alandekok', '123', 'Access-Accept', '2018-02-07 22:46:21')' rlm_sql (db2): Released connection (4) (0) [db2] = ok (0) [exec] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (reply:EAP-Message && reply:Reply-Message) (0) if (reply:EAP-Message && reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # post-auth = ok Sending Access-Accept Id 44 from 192.168.6.237:1812 to 192.168.6.1:15001 WISPr-Bandwidth-Max-Down = 6291456 (0) Finished request Waking up in 0.3 seconds. Received Accounting-Request Id 70 from 192.168.6.1:18746 to 192.168.6.237:1813 length 166 NAS-IP-Address = 192.168.5.53 NAS-Identifier = 'pfSense.localdomain' User-Name = 'alandekok' Acct-Status-Type = Start Acct-Authentic = RADIUS NAS-IP-Address = 192.168.5.53 NAS-Identifier = 'pfSense.localdomain' NAS-Port-Type = Ethernet NAS-Port = 2000 Acct-Session-Id = '51ddb7ae87a6974e' Framed-IP-Address = 192.168.6.17 Called-Station-Id = '192.168.5.53' Calling-Station-Id = '68-5d-43-1d-c6-da' (1) # Executing section preacct from file /etc/freeradius/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) acct_unique acct_unique { (1) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (1) EXPAND %{string:Class} (1) --> (1) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (1) else else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6- Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> 5f7d981301d43b05adad3019deb5500a (1) Acct-Unique-Session-Id := '"5f7d981301d43b05adad3019deb5500a"' (1) } # update request = noop (1) } # else else = noop (1) } # acct_unique acct_unique = noop (1) suffix : No '@' in User-Name = "alandekok", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /etc/freeradius/sites-enabled/default (1) accounting { (1) detail : EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/detail-%Y%m%d (1) detail : --> /var/log/freeradius/radacct/192.168.6.1/detail-20180207 (1) detail : /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.6.1/detail-20180207 (1) detail : EXPAND %t (1) detail : --> Wed Feb 7 22:46:21 2018 (1) [detail] = ok (1) [unix] = ok (1) db1 : EXPAND %{tolower:type.%{Acct-Status-Type}.query} (1) db1 : --> type.start.query (1) db1 : Using query template 'query' rlm_sql (db1): Reserved connection (4) (1) db1 : EXPAND %{User-Name} (1) db1 : --> alandekok (1) db1 : SQL-User-Name set to 'alandekok' (1) db1 : EXPAND INSERT INTO rad_accts (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (1) db1 : --> INSERT INTO rad_accts (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('51ddb7ae87a6974e', '5f7d981301d43b05adad3019deb5500a', 'alandekok', '', '192.168.5.53', '2000', 'Ethernet', FROM_UNIXTIME(1518036381), FROM_UNIXTIME(1518036381), NULL, '0', 'RADIUS', '', '', '0', '0', '192.168.5.53', '68-5d-43-1d-c6-da', '', '', '', '192.168.6.17') rlm_sql (db1): Executing query: 'INSERT INTO rad_accts (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('51ddb7ae87a6974e', '5f7d981301d43b05adad3019deb5500a', 'alandekok', '', '192.168.5.53', '2000', 'Ethernet', FROM_UNIXTIME(1518036381), FROM_UNIXTIME(1518036381), NULL, '0', 'RADIUS', '', '', '0', '0', '192.168.5.53', '68-5d-43-1d-c6-da', '', '', '', '192.168.6.17')' rlm_sql (db1): Released connection (4) (1) [db1] = ok (1) db2 : EXPAND %{tolower:type.%{Acct-Status-Type}.query} (1) db2 : --> type.start.query (1) db2 : Using query template 'query' rlm_sql (db2): Reserved connection (4) (1) db2 : EXPAND %{User-Name} (1) db2 : --> alandekok (1) db2 : SQL-User-Name set to 'alandekok' (1) db2 : EXPAND INSERT INTO rad_accts (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (1) db2 : --> INSERT INTO rad_accts (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('51ddb7ae87a6974e', '5f7d981301d43b05adad3019deb5500a', 'alandekok', '', '192.168.5.53', '2000', 'Ethernet', FROM_UNIXTIME(1518036381), FROM_UNIXTIME(1518036381), NULL, '0', 'RADIUS', '', '', '0', '0', '192.168.5.53', '68-5d-43-1d-c6-da', '', '', '', '192.168.6.17') rlm_sql (db2): Executing query: 'INSERT INTO rad_accts (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('51ddb7ae87a6974e', '5f7d981301d43b05adad3019deb5500a', 'alandekok', '', '192.168.5.53', '2000', 'Ethernet', FROM_UNIXTIME(1518036381), FROM_UNIXTIME(1518036381), NULL, '0', 'RADIUS', '', '', '0', '0', '192.168.5.53', '68-5d-43-1d-c6-da', '', '', '', '192.168.6.17')' rlm_sql (db2): Released connection (4) (1) [db2] = ok (1) [exec] = noop (1) attr_filter.accounting_response : EXPAND %{User-Name} (1) attr_filter.accounting_response : --> alandekok (1) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated Sending Accounting-Response Id 70 from 192.168.6.237:1813 to 192.168.6.1:18746 (1) Finished request Waking up in 0.3 seconds. (1) Cleaning up request packet ID 70 with timestamp +16 Waking up in 4.6 seconds. (0) Cleaning up request packet ID 44 with timestamp +16 Ready to process requests. */etc/freeradius/mods-available/sql* sql db1 { driver = "rlm_sql_mysql" dialect = "mysql" server = "localhost" port = 3306 login = "root" password = "123456" radius_db = "db1" acct_table1 = "rad_accts" acct_table2 = "rad_accts" postauth_table = "rad_post_auths" authcheck_table = "rad_checks" groupcheck_table = "rad_group_checks" authreply_table = "rad_replies" groupreply_table = "rad_group_replies" usergroup_table = "rad_user_groups" read_groups = no delete_stale_sessions = yes pool { start = 5 min = 4 max = ${thread[pool].max_servers} spare = 3 uses = 0 lifetime = 0 idle_timeout = 60 } read_clients = yes client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } sql db2 { driver = "rlm_sql_mysql" dialect = "mysql" server = "localhost" port = 3306 login = "root" password = "123456" radius_db = "db2" acct_table1 = "rad_accts" acct_table2 = "rad_accts" postauth_table = "rad_post_auths" authcheck_table = "rad_checks" groupcheck_table = "rad_group_checks" authreply_table = "rad_replies" groupreply_table = "rad_group_replies" usergroup_table = "rad_user_groups" read_groups = no delete_stale_sessions = yes pool { start = 5 min = 4 max = ${thread[pool].max_servers} spare = 3 uses = 0 lifetime = 0 idle_timeout = 60 } read_clients = yes client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } *etc/freeradius/sites-enabled/inner-tunnel* # -*- text -*- ###################################################################### # # This is a virtual server that handles *only* inner tunnel # requests for EAP-TTLS and PEAP types. # # $Id: 11b6c12d845a1e8287888b3f0a0748d810b2c184 $ # ###################################################################### server inner-tunnel { # # This next section is here to allow testing of the "inner-tunnel" # authentication methods, independently from the "default" server. # It is listening on "localhost", so that it can only be used from # the same machine. # # $ radtest USER PASSWORD 127.0.0.1:18120 0 testing123 # # If it works, you have configured the inner tunnel correctly. To check # if PEAP will work, use: # # $ radtest -t mschap USER PASSWORD 127.0.0.1:18120 0 testing123 # # If that works, PEAP should work. If that command doesn't work, then # # FIX THE INNER TUNNEL CONFIGURATION SO THAT IT WORKS. # # Do NOT do any PEAP tests. It won't help. Instead, concentrate # on fixing the inner tunnel configuration. DO NOTHING ELSE. # listen { ipaddr = 127.0.0.1 port = 18120 type = auth } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set chap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap # # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want # to read /etc/passwd or /etc/shadow directly, see the # passwd module, above. # # unix # # Look for IPASS style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # IPASS # # If you are using multiple kinds of realms, you probably # want to set "ignore_null = yes" for all of them. # Otherwise, when the first style of realm doesn't match, # the other styles won't be checked. # # Note that proxying the inner tunnel authentication means # that the user MAY use one identity in the outer session # (e.g. "anonymous", and a different one here # (e.g. "user(a)example.com"). The inner session will then be # proxied elsewhere for authentication. If you are not # careful, this means that the user can cause you to forward # the authentication to another RADIUS server, and have the # accounting logs *not* sent to the other server. This makes # it difficult to bill people for their network activity. # suffix # ntdomain # # The "suffix" module takes care of stripping the domain # (e.g. "@example.com") from the User-Name attribute, and the # next few lines ensure that the request is not proxied. # # If you want the inner tunnel request to be proxied, delete # the next few lines. # update control { Proxy-To-Realm := LOCAL } # # This module takes care of EAP-MSCHAPv2 authentication. # # It also sets the EAP-Type attribute in the request # attribute list to the EAP type from the packet. # # The example below uses module failover to avoid querying all # of the following modules if the EAP module returns "ok". # Therefore, your LDAP and/or SQL servers will not be queried # for the many packets that go back and forth to set up TTLS # or PEAP. The load on those servers will therefore be reduced. # eap { ok = return } # # Read the 'users' file files # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf -sql # # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. # etc_smbpasswd # # The ldap module reads passwords from the LDAP database. -ldap # # Enforce daily limits on time spent logged in. # daily expiration logintime dailycounter noresetcounter monthlycounter expire_on_login # # If no other module has claimed responsibility for # authentication, then try to use PAP. This allows the # other modules listed above to add a "known good" password # to the request, and to do nothing else. The PAP module # will then see that password, and use it to do PAP # authentication. # # This module should be listed last, so that the other modules # get a chance to set Auth-Type for themselves. # pap } # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the appropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user, or forcibly accept him. # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # Pluggable Authentication Modules. # pam # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # # We do NOT recommend using this. LDAP servers are databases. # They are NOT authentication servers. FreeRADIUS is an # authentication server, and knows what to do with authentication. # LDAP servers do not. # # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. eap } ###################################################################### # # There are no accounting requests inside of EAP-TTLS or PEAP # tunnels. # ###################################################################### # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { radutmp # # See "Simultaneous Use Checking Queries" in sql.conf #sql db1 db2 } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { # If you want privacy to remain, see the # Chargeable-User-Identity attribute from RFC 4372. # If you want to use it just uncomment the line below. # cui-inner # # If you want to have a log of authentication replies, # un-comment the following line, and enable the # 'detail reply_log' module. # reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf -sql # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. # # ldap # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject } # # The example policy below updates the outer tunnel reply # (usually Access-Accept) with the User-Name from the inner # tunnel User-Name. Since this section is processed in the # context of the inner tunnel, "request" here means "inner # tunnel request", and "outer.reply" means "outer tunnel # reply attributes". # # This example is most useful when the outer session contains # a User-Name of "anonymous@....", or a MAC address. If it # is enabled, the NAS SHOULD use the inner tunnel User-Name # in subsequent accounting packets. This makes it easier to # track user sessions, as they will all be based on the real # name, and not on "anonymous". # # The problem with doing this is that it ALSO exposes the # real user name to any intermediate proxies. People use # "anonymous" identifiers outside of the tunnel for a very # good reason: it gives them more privacy. Setting the reply # to contain the real user name removes ALL privacy from # their session. # # If you still want to use the inner tunnel User-Name then # uncomment the section below, otherwise you may want # to use Chargeable-User-Identity attribute from RFC 4372. # See further on. #update outer.reply { # User-Name = "%{request:User-Name}" #} # } # # When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy. # # Only a few modules currently have this method. # pre-proxy { # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file. # files # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file. # attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. # pre_proxy_log } # # When the server receives a reply to a request it proxied # to a home server, the request may be massaged here, in the # post-proxy stage. # post-proxy { # If you want to have a log of replies from a home server, # un-comment the following line, and the 'detail post_proxy_log' # section, above. # post_proxy_log # Uncomment the following line if you want to filter replies from # remote proxies based on the rules defined in the 'attrs' file. # attr_filter.post-proxy # # If you are proxying LEAP, you MUST configure the EAP # module, and you MUST list it here, in the post-proxy # stage. # # You MUST also use the 'nostrip' option in the 'realm' # configuration. Otherwise, the User-Name attribute # in the proxied request will not match the user name # hidden inside of the EAP packet, and the end server will # reject the EAP request. # eap # # If the server tries to proxy a request and fails, then the # request is processed through the modules in this section. # # The main use of this section is to permit robust proxying # of accounting packets. The server can be configured to # proxy accounting packets as part of normal processing. # Then, if the home server goes down, accounting packets can # be logged to a local "detail" file, for processing with # radrelay. When the home server comes back up, radrelay # will read the detail file, and send the packets to the # home server. # # With this configuration, the server always responds to # Accounting-Requests from the NAS, but only writes # accounting packets to disk if the home server is down. # # Post-Proxy-Type Fail { # detail # } } } # inner-tunnel server block *etc/freeradius/sites-enabled/default* ###################################################################### # # As of 2.0.0, FreeRADIUS supports virtual hosts using the # "server" section, and configuration directives. # # Virtual hosts should be put into the "sites-available" # directory. Soft links should be created in the "sites-enabled" # directory to these files. This is done in a normal installation. # # If you are using 802.1X (EAP) authentication, please see also # the "inner-tunnel" virtual server. You will likely have to edit # that, too, for authentication to work. # # $Id: 3278975e054fab504afda5ba8fc999239cb2fb9d $ # ###################################################################### # # Read "man radiusd" before editing this file. See the section # titled DEBUGGING. It outlines a method where you can quickly # obtain the configuration you want, without running into # trouble. See also "man unlang", which documents the format # of this file. # # This configuration is designed to work in the widest possible # set of circumstances, with the widest possible number of # authentication methods. This means that in general, you should # need to make very few changes to this file. # # The best way to configure the server for your local system # is to CAREFULLY edit this file. Most attempts to make large # edits to this file will BREAK THE SERVER. Any edits should # be small, and tested by running the server with "radiusd -X". # Once the edits have been verified to work, save a copy of these # configuration files somewhere. (e.g. as a "tar" file). Then, # make more edits, and test, as above. # # There are many "commented out" references to modules such # as ldap, sql, etc. These references serve as place-holders. # If you need the functionality of that module, then configure # it in radiusd.conf, and un-comment the references to it in # this file. In most cases, those small changes will result # in the server being able to connect to the DB, and to # authenticate users. # ###################################################################### server default { # # If you want the server to listen on additional addresses, or on # additional ports, you can use multiple "listen" sections. # # Each section make the server listen for only one type of packet, # therefore authentication and accounting have to be configured in # different sections. # # The server ignore all "listen" section if you are using '-i' and '-p' # on the command line. # listen { # Type of packets to listen for. # Allowed values are: # auth listen for authentication packets # acct listen for accounting packets # proxy IP to use for sending proxied packets # detail Read from the detail file. For examples, see # raddb/sites-available/copy-acct-to-home-server # status listen for Status-Server packets. For examples, # see raddb/sites-available/status # coa listen for CoA-Request and Disconnect-Request # packets. For examples, see the file # raddb/sites-available/coa-server # type = auth # Note: "type = proxy" lets you control the source IP used for # proxying packets, with some limitations: # # * A proxy listener CANNOT be used in a virtual server section. # * You should probably set "port = 0". # * Any "clients" configuration will be ignored. # # See also proxy.conf, and the "src_ipaddr" configuration entry # in the sample "home_server" section. When you specify the # source IP address for packets sent to a home server, the # proxy listeners are automatically created. # IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) ipaddr = * # OR, you can use an IPv6 address, but not both # at the same time. # ipv6addr = :: # any. ::1 == localhost # Port on which to listen. # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" port = 0 # Some systems support binding to an interface, in addition # to the IP address. This feature isn't strictly necessary, # but for sites with many IP addresses on one interface, # it's useful to say "listen on all addresses for eth0". # # If your system does not support this feature, you will # get an error if you try to use it. # # interface = eth0 # Per-socket lists of clients. This is a very useful feature. # # The name here is a reference to a section elsewhere in # radiusd.conf, or clients.conf. Having the name as # a reference allows multiple sockets to use the same # set of clients. # # If this configuration is used, then the global list of clients # is IGNORED for this "listen" section. Take care configuring # this feature, to ensure you don't accidentally disable a # client you need. # # See clients.conf for the configuration of "per_socket_clients". # # clients = per_socket_clients # # Connection limiting for sockets with "proto = tcp". # # This section is ignored for other kinds of sockets. # limit { # # Limit the number of simultaneous TCP connections to the socket # # The default is 16. # Setting this to 0 means "no limit" max_connections = 16 # The per-socket "max_requests" option does not exist. # # The lifetime, in seconds, of a TCP connection. After # this lifetime, the connection will be closed. # # Setting this to 0 means "forever". lifetime = 0 # # The idle timeout, in seconds, of a TCP connection. # If no packets have been received over the connection for # this time, the connection will be closed. # # Setting this to 0 means "no timeout". # # We STRONGLY RECOMMEND that you set an idle timeout. # idle_timeout = 30 } } # # This second "listen" section is for listening on the accounting # port, too. # listen { ipaddr = * # ipv6addr = :: port = 0 type = acct # interface = eth0 # clients = per_socket_clients limit { # The number of packets received can be rate limited via the # "max_pps" configuration item. When it is set, the server # tracks the total number of packets received in the previous # second. If the count is greater than "max_pps", then the # new packet is silently discarded. This helps the server # deal with overload situations. # # The packets/s counter is tracked in a sliding window. This # means that the pps calculation is done for the second # before the current packet was received. NOT for the current # wall-clock second, and NOT for the previous wall-clock second. # # Useful values are 0 (no limit), or 100 to 10000. # Values lower than 100 will likely cause the server to ignore # normal traffic. Few systems are capable of handling more than # 10K packets/s. # # It is most useful for accounting systems. Set it to 50% # more than the normal accounting load, and you can be sure that # the server will never get overloaded # # max_pps = 0 # Only for "proto = tcp". These are ignored for "udp" sockets. # # idle_timeout = 0 # lifetime = 0 # max_connections = 0 } } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # Any changes made here should also be made to the "inner-tunnel" # virtual server. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { # # Take a User-Name, and perform some checks on it, for spaces and other # invalid characters. If the User-Name appears invalid, reject the # request. # # See policy.d/filter for the definition of the filter_username policy. # filter_username # # The preprocess module takes care of sanitizing some bizarre # attributes in the request, and turning them into attributes # which are more standard. # # It takes care of processing the 'raddb/hints' and the # 'raddb/huntgroups' files. preprocess # If you intend to use CUI and you require that the Operator-Name # be set for CUI generation and you want to generate CUI also # for your local clients then uncomment the operator-name # below and set the operator-name for your clients in clients.conf # operator-name # # If you want to generate CUI for some clients that do not # send proper CUI requests, then uncomment the # cui below and set "add_cui = yes" for these clients in clients.conf # cui # # If you want to have a log of authentication requests, # un-comment the following line, and the 'detail auth_log' # section, above. # auth_log # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set chap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authenticate' section. digest # # The WiMAX specification says that the Calling-Station-Id # is 6 octets of the MAC. This definition conflicts with # RFC 3580, and all common RADIUS practices. Un-commenting # the "wimax" module here means that it will fix the # Calling-Station-Id attribute to the normal format as # specified in RFC 3580 Section 3.21 # wimax # # Look for IPASS style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # IPASS # # If you are using multiple kinds of realms, you probably # want to set "ignore_null = yes" for all of them. # Otherwise, when the first style of realm doesn't match, # the other styles won't be checked. # suffix # ntdomain # # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP # authentication. # # It also sets the EAP-Type attribute in the request # attribute list to the EAP type from the packet. # # As of 2.0, the EAP module returns "ok" in the authorize stage # for TTLS and PEAP. In 1.x, it never returned "ok" here, so # this change is compatible with older configurations. # # The example below uses module failover to avoid querying all # of the following modules if the EAP module returns "ok". # Therefore, your LDAP and/or SQL servers will not be queried # for the many packets that go back and forth to set up TTLS # or PEAP. The load on those servers will therefore be reduced. # eap { ok = return } # # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want # to read /etc/passwd or /etc/shadow directly, see the # passwd module in radiusd.conf. # # unix # # Read the 'users' file #files # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf #sql db1 db2 # # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'smbpasswd' module. # smbpasswd # # The ldap module reads passwords from the LDAP database. -ldap # # Enforce daily limits on time spent logged in. # daily # expiration logintime dailycounter noresetcounter monthlycounter expire_on_login # # If no other module has claimed responsibility for # authentication, then try to use PAP. This allows the # other modules listed above to add a "known good" password # to the request, and to do nothing else. The PAP module # will then see that password, and use it to do PAP # authentication. # # This module should be listed last, so that the other modules # get a chance to set Auth-Type for themselves. # pap # # If "status_server = yes", then Status-Server messages are passed # through the following section, and ONLY the following section. # This permits you to do DB queries, for example. If the modules # listed here return "fail", then NO response is sent. # # Autz-Type Status-Server { # # } } # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the appropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user (Auth-Type := Reject), # or to or forcibly accept the user (Auth-Type := Accept). # # Note that Auth-Type := Accept will NOT work with EAP. # # Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for. # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. digest # # Pluggable Authentication Modules. # pam # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # # We do NOT recommend using this. LDAP servers are databases. # They are NOT authentication servers. FreeRADIUS is an # authentication server, and knows what to do with authentication. # LDAP servers do not. # # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. eap # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Merge Acct-[Input|Output]-Gigawords and Acct-[Input-Output]-Octets # into a single 64bit counter Acct-[Input|Output]-Octets64. # # acct_counters64 # # Session start times are *implied* in RADIUS. # The NAS never sends a "start time". Instead, it sends # a start packet, *possibly* with an Acct-Delay-Time. # The server is supposed to conclude that the start time # was "Acct-Delay-Time" seconds in the past. # # The code below creates an explicit start time, which can # then be used in other modules. It will be *mostly* correct. # Any errors are due to the 1-second resolution of RADIUS, # and the possibility that the time on the NAS may be off. # # The start time is: NOW - delay - session_length # # update request { # FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}" # } # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique # # Look for IPASS-style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # # Accounting requests are generally proxied to the same # home server as authentication requests. # IPASS suffix # ntdomain # # Read the 'acct_users' file files } # # Accounting. Log the accounting data. # accounting { # Update accounting packet by adding the CUI attribute # recorded from the corresponding Access-Accept # use it only if your NAS boxes do not support CUI themselves # cui # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # dailycounter # noresetcounter # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. # radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf #sql db1 db2 # # If you receive stop packets with zero session length, # they will NOT be logged in the database. The SQL module # will print a message (only in debugging mode), and will # return "noop". # # You can ignore these packets by uncommenting the following # three lines. Otherwise, the server will not respond to the # accounting request, and the NAS will retransmit. # # if (noop) { # ok # } # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # Cisco VoIP specific bulk accounting # pgsql-voip # For Exec-Program and Exec-Program-Wait exec # Filter attributes from the accounting response. attr_filter.accounting_response # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { # radutmp # # See "Simultaneous Use Checking Queries" in sql.conf #sql db1 db2 } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { # Get an address from the IP Pool. # main_pool # Create the CUI value and add the attribute to Access-Accept. # Uncomment the line below if *returning* the CUI. # cui # # If you want to have a log of authentication replies, # un-comment the following line, and enable the # 'detail reply_log' module. # reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf #sql db1 db2 # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # # Un-comment the following if you want to modify the user's object # in LDAP after a successful login. # # ldap # For Exec-Program and Exec-Program-Wait exec # # Calculate the various WiMAX keys. In order for this to work, # you will need to define the WiMAX NAI, usually via # # update request { # WiMAX-MN-NAI = "%{User-Name}" # } # # If you want various keys to be calculated, you will need to # update the reply with "template" values. The module will see # this, and replace the template values with the correct ones # taken from the cryptographic calculations. e.g. # # update reply { # WiMAX-FA-RK-Key = 0x00 # WiMAX-MSK = "%{EAP-MSK}" # } # # You may want to delete the MS-MPPE-*-Keys from the reply, # as some WiMAX clients behave badly when those attributes # are included. See "raddb/modules/wimax", configuration # entry "delete_mppe_keys" for more information. # # wimax # If there is a client certificate (EAP-TLS, sometimes PEAP # and TTLS), then some attributes are filled out after the # certificate verification has been performed. These fields # MAY be available during the authentication, or they may be # available only in the "post-auth" section. # # The first set of attributes contains information about the # issuing certificate which is being used. The second # contains information about the client certificate (if # available). # # update reply { # Reply-Message += "%{TLS-Cert-Serial}" # Reply-Message += "%{TLS-Cert-Expiration}" # Reply-Message += "%{TLS-Cert-Subject}" # Reply-Message += "%{TLS-Cert-Issuer}" # Reply-Message += "%{TLS-Cert-Common-Name}" # Reply-Message += "%{TLS-Cert-Subject-Alt-Name-Email}" # # Reply-Message += "%{TLS-Client-Cert-Serial}" # Reply-Message += "%{TLS-Client-Cert-Expiration}" # Reply-Message += "%{TLS-Client-Cert-Subject}" # Reply-Message += "%{TLS-Client-Cert-Issuer}" # Reply-Message += "%{TLS-Client-Cert-Common-Name}" # Reply-Message += "%{TLS-Client-Cert-Subject-Alt-Name-Email}" # } # Insert class attribute (with unique value) into response, # aids matching auth and acct records, and protects against duplicate # Acct-Session-Id. Note: Only works if the NAS has implemented # RFC 2865 behaviour for the class attribute, AND if the NAS # supports long Class attributes. Many older or cheap NASes # only support 16-octet Class attributes. # insert_acct_class # MacSEC requires the use of EAP-Key-Name. However, we don't # want to send it for all EAP sessions. Therefore, the EAP # modules put required data into the EAP-Session-Id attribute. # This attribute is never put into a request or reply packet. # # Uncomment the next few lines to copy the required data into # the EAP-Key-Name attribute # if (reply:EAP-Session-Id) { # update reply { # EAP-Key-Name := "%{reply:EAP-Session-Id}" # } # } # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { # log failed authentications in SQL, too. #sql db1 db2 attr_filter.access_reject # Insert EAP-Failure message if the request was # rejected by policy instead of because of an # authentication failure eap # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap } } # # When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy. # # Only a few modules currently have this method. # pre-proxy { # Before proxing the request add an Operator-Name attribute identifying # if the operator-name is found for this client. # No need to uncomment this if you have already enabled this in # the authorize section. # operator-name # The client requests the CUI by sending a CUI attribute # containing one zero byte. # Uncomment the line below if *requesting* the CUI. # cui # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file. # files # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file. # attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. # pre_proxy_log } # # When the server receives a reply to a request it proxied # to a home server, the request may be massaged here, in the # post-proxy stage. # post-proxy { # If you want to have a log of replies from a home server, # un-comment the following line, and the 'detail post_proxy_log' # section, above. # post_proxy_log # Uncomment the following line if you want to filter replies from # remote proxies based on the rules defined in the 'attrs' file. # attr_filter.post-proxy # # If you are proxying LEAP, you MUST configure the EAP # module, and you MUST list it here, in the post-proxy # stage. # # You MUST also use the 'nostrip' option in the 'realm' # configuration. Otherwise, the User-Name attribute # in the proxied request will not match the user name # hidden inside of the EAP packet, and the end server will # reject the EAP request. # eap # # If the server tries to proxy a request and fails, then the # request is processed through the modules in this section. # # The main use of this section is to permit robust proxying # of accounting packets. The server can be configured to # proxy accounting packets as part of normal processing. # Then, if the home server goes down, accounting packets can # be logged to a local "detail" file, for processing with # radrelay. When the home server comes back up, radrelay # will read the detail file, and send the packets to the # home server. # # With this configuration, the server always responds to # Accounting-Requests from the NAS, but only writes # accounting packets to disk if the home server is down. # # Post-Proxy-Type Fail { # detail # } } } 2018-02-07 17:20 GMT+03:00 Alan DeKok <aland(a)deployingradius.com>: > On Feb 6, 2018, at 11:56 PM, Emrah Yıldırım <emrah.yldrm81(a)gmail.com> > wrote: > > > > Are you sure > > you're looking at Link? > > You need to learn how to ask good questions. Your first question, and > the link, are vague and content-free. > > If you ask a bad question, you will get a bad answer. > > > > This topic is related to Freeradius... I have > > separated databases with SQL instance. > > Does this mean you have two SQL instances configured in FreeRADIUS? > > > However, separate hosts in both NAS > > tables > > Although I do, I see the same data in the RADACCT table of both > databases. > > You've configured the server to use both SQL instances for all users. > This is wrong. > > You need to call the right instance for the right user: > > if (user is from system A) { > sql1 > } > else { > sql2 > } > > Of course, that won't work as-is. Because you have given *zero* > information about the usernames, SQL instance names, etc > > If you give more information, you get better answers. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list > /users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

1 0

strangeness with 3rd sql pool and unlang in policy.d/<filename>
by Vikash Badal (IS) 07 Feb '18

07 Feb '18

Hi, can someone advise what i am doing wrong here: <background> i have 3 different sql servers, hence 3 sql pools sql_auth -> db for auth and accounting sql_ippool -> db for ip pools sql_policyLookup -> db for the sql_auth and sql_ippool work without any issues in the policy.d/filename the sql_policyLoopup behave strangely, </background> effectively this is what i want to do apply-sv-policy { update control { &Tmp-String-0 := "%{sql_policyLookup:SELECT AttrValue \ FROM SVRadiusPackageMap \ LEFT JOIN UserConfiguredPackages \ ON UserConfiguredPackages.PackageID = PackageName \ WHERE UserName = '%{SQL-User-Name}' AND ServiceID = 'lte' AND \ AttrName = 'IS-SV-Policy-Profile'}" } } this is what i have to do apply-sv-policy { if ( "{sql_policyLookup:select concat('%{SQL-User-Name}', '1')" ) { update control { &Tmp-String-0 := "%{sql_policyLookup:SELECT AttrValue \ FROM SVRadiusPackageMap \ LEFT JOIN UserConfiguredPackages \ ON UserConfiguredPackages.PackageID = PackageName \ WHERE UserName = '%{SQL-User-Name}' AND ServiceID = 'lte' AND \ AttrName = 'IS-SV-Policy-Profile'}" } } update control { &Tmp-String-0 := "%{sql_policyLookup:SELECT AttrValue \ FROM SVRadiusPackageMap \ LEFT JOIN UserConfiguredPackages \ ON UserConfiguredPackages.PackageID = PackageName \ WHERE UserName = '%{SQL-User-Name}' AND ServiceID = 'lte' AND \ AttrName = 'IS-SV-Policy-Profile'}" } } i have had to duplicate the sql query as it only produces a result the 3rd time. (5) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/copy-to-sde (5) preacct { (5) [preprocess] = ok (5) policy apply-sv-policy { (5) if ( "{sql_policyLookup:select concat('%{SQL-User-Name}', '1')" ) { (5) EXPAND {sql_policyLookup:select concat('%{SQL-User-Name}', '1') (5) --> {sql_policyLookup:select concat('', '1') <me> as you can see, the SQL-User-Name is not expanded. </me> (5) if ( "{sql_policyLookup:select concat('%{SQL-User-Name}', '1')" ) -> TRUE (5) if ( "{sql_policyLookup:select concat('%{SQL-User-Name}', '1')" ) { (5) update control { (5) EXPAND %{User-Name} (5) --> 27747638935(a)lte.broadband.is (5) SQL-User-Name set to '27747638935(a)lte.broadband.is' rlm_sql (sql_policyLookup): Reserved connection (2) (5) Executing select query: SELECT AttrValue FROM SVRadiusPackageMap LEFT JOIN UserConfiguredPackages ON UserConfiguredPackages.PackageID = PackageName WHERE UserName = '' AND ServiceID = 'lte' AND AttrName = 'IS-SV-Policy-Profile' <me> as you can see, the SQL-User-Name is not expanded here either. </me> (5) SQL query returned no results rlm_sql (sql_policyLookup): Released connection (2) Need 4 more connections to reach 10 spares rlm_sql (sql_policyLookup): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'isdsl' on greatrepublic.dial-up.net via TCP/IP, server version 5.1.56-log, protocol version 10 (5) EXPAND %{sql_policyLookup:SELECT AttrValue FROM SVRadiusPackageMap LEFT JOIN UserConfiguredPackages ON UserConfiguredPackages.PackageID = PackageName WHERE UserNam e = '%{SQL-User-Name}' AND ServiceID = 'lte' AND AttrName = 'IS-SV-Policy-Profile'} (5) --> (5) &Tmp-String-0 := (5) } # update control = noop (5) } # if ( "{sql_policyLookup:select concat('%{SQL-User-Name}', '1')" ) = noop <me> duplicated block </me> (5) update control { (5) EXPAND %{User-Name} (5) --> 27747638935(a)lte.broadband.is (5) SQL-User-Name set to '27747638935(a)lte.broadband.is' rlm_sql (sql_policyLookup): Reserved connection (3) (5) Executing select query: SELECT AttrValue FROM SVRadiusPackageMap LEFT JOIN UserConfiguredPackages ON UserConfiguredPackages.PackageID = PackageName WHERE UserName = '277 47638935(a)lte.broadband.is' AND ServiceID = 'lte' AND AttrName = 'IS-SV-Policy-Profile' <me> as you can see, the SQL-User-Name is expanded here </me> (5) SQL query returned no results rlm_sql (sql_policyLookup): Released connection (3) (5) EXPAND %{sql_policyLookup:SELECT AttrValue FROM SVRadiusPackageMap LEFT JOIN UserConfiguredPackages ON UserConfiguredPackages.PackageID = PackageName WHERE UserName = '%{S QL-User-Name}' AND ServiceID = 'lte' AND AttrName = 'IS-SV-Policy-Profile'} (5) --> (5) &Tmp-String-0 := <me> this use is not configure, so blank expected. </me> (5) } # update control = noop (5) if ( &Tmp-String-0 ) { (5) if ( &Tmp-String-0 ) -> FALSE (5) } # policy apply-sv-policy = noop (5) update control { (5) Proxy-To-Realm := sandvinesde (5) } # update control = noop Regards Vikash Badal Senior Technical Systems Engineer T +27 11 5750825 C +27 83 6774915 www.is.co.za Internet Solutions is a division of Dimension Data Disclaimer: https://www.is.co.za/legal/#e-mail-confidentiality-notice-and-disclaimer

2 1

unlang/python "scripting" for gateway and dns servers
by Michael Duckett 07 Feb '18

07 Feb '18

I'd like to derive the gateway based on unlang rules from the assigned ip address/mask I store in ldap. In what configuration file would I put the unlang or python code to implement the rule? For DNS servers, i want to use a subset of the username in something like a case/switch statement. Can I use the username in the accept request during the authorization phase? Where would i put this code (preferrably python but could use unlang)? Would I put in the authorize part of the default config file? Thanks

2 2

Custom php module error in v3
by Javed Akhtar 06 Feb '18

06 Feb '18

this is what i am getting in radius debug (0) Received Access-Request Id 14 from xxx.xxx.xxx.xxx:62252 to yyy.yyy.yyy.yyy:1815 length 50 (0) User-Name = "93381062" (0) User-Password = "12345" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enab led/default (0) authorize { (0) update control { (0) Executing: /usr/bin/php -f /var/lib/radius/rad_check.php '%{Called-Station-Id}' '%{User-Name}' '%{User-Password}' '%{Calling-Station-Id}': (0) EXPAND %{Called-Station-Id} (0) --> (0) EXPAND %{User-Name} (0) --> 93381062 (0) EXPAND %{User-Password} (0) --> 12345 (0) EXPAND %{Calling-Station-Id} (0) --> (0) Program returned code (0) and output 'Accept' (0) } # update control = invalid (0) } # authorize = invalid (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. this is what i have in default sites authorize { #php_check update control { Auth-Type := `/usr/bin/php -f /var/lib/radius/rad_check.php '%{Called-Station-Id}' '%{User-Name}' '%{User-Password}' '%{Calling-Station-Id}'` } } and this is the php script <?php echo "Accept"; exit; ?> why its rejecting the user i am trying to upgrade form v2 to v3 of freeradius and lots of problem i got

5 12