- Freeradius-Users - lists.freeradius.org

Re: FreeRADIUS 3.0.12 VMPS and logging twice?
by Václav Ovsík 28 Jun '17

28 Jun '17

On Wed, Jun 28, 2017 at 03:49:52PM -0400, Alan DeKok wrote: > On Jun 28, 2017, at 3:27 PM, Václav Ovsík <vaclav.ovsik(a)i.cz> wrote: > > > > Forgot you to attach the patch? > > Hmm.. the mailing list strips it. I've attached it here. ...including the patch hier for completeness -----<snip>----- diff --git a/src/modules/proto_vmps/vmps.c b/src/modules/proto_vmps/vmps.c index f1df128..1fc0a19 100644 --- a/src/modules/proto_vmps/vmps.c +++ b/src/modules/proto_vmps/vmps.c @@ -37,6 +37,7 @@ static int vmps_process(REQUEST *request) process_post_auth(0, request); DEBUG2("Done VMPS"); + request->packet->code = 0; /* hack for VMPS */ request->reply->code = PW_CODE_ACCESS_ACCEPT; return 0; -----<snip>----- I rebuilt Debian package including your patch and it looks ok now! FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/mac2vlan including configuration file /etc/freeradius/3.0/mods-enabled/linelog_vmps including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/operator-name including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/vmps main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan passwd mac2vlan { filename = "/etc/freeradius/3.0/mods-config/passwd/mac2vlan" format = "*VMPS-Mac:=VMPS-VLAN-Name" delimiter = "," ignore_nislike = yes ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps linelog linelog_vmps { filename = "/var/log/freeradius/vmps.log" escape_filenames = no syslog_severity = "info" permissions = 384 format = "%S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name}" } instantiate { } # Instantiating module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan rlm_passwd: nfields: 2 keyfield 0(VMPS-Mac) listable: no # Instantiating module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server vmps { # from file /etc/freeradius/3.0/sites-enabled/vmps # Loading vmps {...} } # server vmps radiusd: #### Opening IP addresses and Ports #### listen { type = "vmps" ipaddr = 10.2.28.97 port = 1589 client cisco-switches { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client cisco-switches2 { ipaddr = 10.0.0.0 netmask = 11 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit { ipaddr = 192.168.30.80 netmask = 28 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit2 { ipaddr = 10.0.156.80 netmask = 29 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on vmps address 10.2.28.97 port 1589 bound to server vmps Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = d4:be:d9:68:15:58 (0) Received Access-Request Id 4660 from 192.168.30.82:49212 to 10.2.28.97:1589 length 60 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 127.0.0.1 (0) VMPS-Port-Name = "Fa0/1" (0) VMPS-VLAN-Name = "" (0) VMPS-Domain-Name = "" (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = d4:be:d9:68:15:58 Doing VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) mac2vlan: Added VMPS-VLAN-Name: 'TPS' to reply_items (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> d4:be:d9:68:15:58 (0) &VMPS-VLAN-Name = "Guest" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) linelog_vmps: EXPAND %S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name} (0) linelog_vmps: --> 2017-06-28 23:39:04 127.0.0.1 Fa0/1 VMPS-Join-Request d4:be:d9:68:15:58 -> TPS (0) linelog_vmps: EXPAND /var/log/freeradius/vmps.log (0) linelog_vmps: --> /var/log/freeradius/vmps.log (0) [linelog_vmps] = ok (0) } # vmps = ok Done VMPS (0) Sent Access-Accept Id 4660 from 10.2.28.97:1589 to 192.168.30.82:49212 length 0 VMPS-VLAN-Name = "TPS" VMPS-Cookie = d4:be:d9:68:15:58 (0) Finished request (0) Cleaning up request packet ID 4660 with timestamp +2 Ready to process requests Great! Many thanks for solving the problem! Regards -- Zito

1 0

Execute external script triggered by accounting request
by Leandro 28 Jun '17

28 Jun '17

Hi guys , I need to take device ip from accounting request packet, use this ip to run external script to grab some device parameters via ping and snmp. Im working on two methods , both have cons and advantages. 1st Method: "perl module." So far I have the module working with a testing script but when I want to exec net::ping module it yelds that root privileges are needed. I tried "usermod -G root radiusd" to provide radiusd root privileges but have not success. Other consequence of this method could be to get a very large delay considering that every devices takes 5~7 secs to process and send the response back, so I think that it would be good also to run this external script in background. 2nd Method " Tail the raddacct file" I can use a perl tail process to grab the "Framed_ip_address" from the accounting log file and execute the snmp and ping queries from outside the radius process Principal advantage could be that Im not adding extra delay to the radius accounting process. I wanted to know if is possible to change the accounting logging behaviour in the following way: Write always to /var/log/messages file (currently it writes to detail-YYYYMMDD file). Select the fields and write them horizontally instead of writting them in column format. Any idea would be wellcome. Regards Leandro.

2 1

shared secret
by Andrew Meyer 28 Jun '17

28 Jun '17

I have my clients setup with the same shared secret for testing. I have this setup w/ FreeIPA. However I am testing FreeRADIUS in debug mode and i'm running radtest against and not getting anything. I'm not sure why. I have verified that I am typing in the secret correctly. (10) Cleaning up request packet ID 88 with timestamp +475Ready to process requestsReceived Access-Request Id 88 from 127.0.0.1:60005 to 127.0.0.1:1812 length 76(11) Received Access-Request packet from host 127.0.0.1 port 60005, id=88, length=76(11) Dropping packet without response because of error: Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.)

2 2

Migration how to
by Olivier 28 Jun '17

28 Jun '17

Hello, I am migrating my configuration from FreeRadius 2 to 3 and I am struggling to go ahead. I am not really sure what is in the working configuration, nor why it is there. Does it exist some how to to help doing the migration? Best regards, Olivier --

3 2

FreeRADIUS 3.0.12 VMPS and logging twice?
by Václav Ovsík 28 Jun '17

28 Jun '17

Hi, we are using FreeRADIUS VMPS server for a long time on Debian GNU/Linux. It works perfectly and my tiny modification to dist vmps site definition is line log. With FreeRADIUS 2.2.5 it worked fine. I did upgrade of first VMPS yesterday (Debian Stretch) and did a small mods to vmps for FreeRADIUS version 3.0.12. What I didn't know to do with is that vmps processing doubled or two-phase or something (every request is logged twice). Request sent from monitoring site using check_vmps nagios plugin with success: VMPS OK - Vlan: TPS, MAC Address: d4bed9681558, Status: ALLOW response is correct one packet (checked using tcpdump). The output of freeradius -X: FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/mac2vlan including configuration file /etc/freeradius/3.0/mods-enabled/linelog_vmps including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/operator-name including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/vmps main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan passwd mac2vlan { filename = "/etc/freeradius/3.0/mods-config/passwd/mac2vlan" format = "*VMPS-Mac:=VMPS-VLAN-Name" delimiter = "," ignore_nislike = yes ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps linelog linelog_vmps { filename = "/var/log/freeradius/vmps.log" escape_filenames = no syslog_severity = "info" permissions = 384 format = "%S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name}" } instantiate { } # Instantiating module "mac2vlan" from file /etc/freeradius/3.0/mods-enabled/mac2vlan rlm_passwd: nfields: 2 keyfield 0(VMPS-Mac) listable: no # Instantiating module "linelog_vmps" from file /etc/freeradius/3.0/mods-enabled/linelog_vmps } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server vmps { # from file /etc/freeradius/3.0/sites-enabled/vmps # Loading vmps {...} } # server vmps radiusd: #### Opening IP addresses and Ports #### listen { type = "vmps" ipaddr = 10.2.28.97 port = 1589 client cisco-switches { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client cisco-switches2 { ipaddr = 10.0.0.0 netmask = 11 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit { ipaddr = 192.168.30.80 netmask = 28 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client monit2 { ipaddr = 10.0.156.80 netmask = 29 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on vmps address 10.2.28.97 port 1589 bound to server vmps Ready to process requests VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 4660 VMPS-Client-IP-Address = 127.0.0.1 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "" VMPS-Domain-Name = "" VMPS-Unknown = 0x00 VMPS-MAC = d4:be:d9:68:15:58 (0) Received Access-Request Id 4660 from 192.168.30.82:41160 to 10.2.28.97:1589 length 60 (0) VMPS-Packet-Type = VMPS-Join-Request (0) VMPS-Error-Code = VMPS-No-Error (0) VMPS-Sequence-Number = 4660 (0) VMPS-Client-IP-Address = 127.0.0.1 (0) VMPS-Port-Name = "Fa0/1" (0) VMPS-VLAN-Name = "" (0) VMPS-Domain-Name = "" (0) VMPS-Unknown = 0x00 (0) VMPS-MAC = d4:be:d9:68:15:58 Doing VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) mac2vlan: Added VMPS-VLAN-Name: 'TPS' to reply_items (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> d4:be:d9:68:15:58 (0) &VMPS-VLAN-Name = "Guest" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) linelog_vmps: EXPAND %S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name} (0) linelog_vmps: --> 2017-06-28 17:21:53 127.0.0.1 Fa0/1 VMPS-Join-Request d4:be:d9:68:15:58 -> TPS (0) linelog_vmps: EXPAND /var/log/freeradius/vmps.log (0) linelog_vmps: --> /var/log/freeradius/vmps.log (0) [linelog_vmps] = ok (0) } # vmps = ok Done VMPS (0) vmps { (0) if (!&VMPS-Mac) { (0) if (!&VMPS-Mac) -> FALSE (0) mac2vlan: Added VMPS-VLAN-Name: 'TPS' to reply_items (0) [mac2vlan] = ok (0) update reply { (0) &VMPS-Packet-Type = VMPS-Join-Response (0) &VMPS-Cookie = &VMPS-Mac -> d4:be:d9:68:15:58 (0) &VMPS-VLAN-Name = "Guest" (0) } # update reply = noop (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request){ (0) if (&VMPS-Packet-Type == VMPS-Reconfirm-Request) -> FALSE (0) linelog_vmps: EXPAND %S %{VMPS-Client-IP-Address} %{VMPS-Port-Name} %{VMPS-Packet-Type} %{VMPS-Mac} -> %{reply:VMPS-VLAN-Name} (0) linelog_vmps: --> 2017-06-28 17:21:53 127.0.0.1 Fa0/1 VMPS-Join-Request d4:be:d9:68:15:58 -> TPS (0) linelog_vmps: EXPAND /var/log/freeradius/vmps.log (0) linelog_vmps: --> /var/log/freeradius/vmps.log (0) [linelog_vmps] = ok (0) } # vmps = ok (0) Sent Access-Accept Id 4660 from 10.2.28.97:1589 to 192.168.30.82:41160 length 0 VMPS-VLAN-Name = "TPS" VMPS-Cookie = d4:be:d9:68:15:58 (0) Finished request (0) Cleaning up request packet ID 4660 with timestamp +3 Ready to process requests To distributed Debian configuration I did only * disabled proxy_requests in radiusd.conf * added to site-enabled vmps, removed default and inner-tunnel * removed all mods from mods-enabled and enable linelog-vmps and mac2vlan Any idea why there is second pass after 'Done VMPS'? Regards -- Zito

2 1

LDAP group authentication
by Jake L. 28 Jun '17

28 Jun '17

Hello - I successfully got our Freeradius server to authenticate against our FreeIPA LDAP environment, allowing user access. Currently, all users in here will be granted successful access. However, I'm having trouble trying to identify what to setup to get only a single group in our FreeIPA environment allowed to authenticate while all other groups are denied. In a nutshell, I want to only allow the "network-team" group authenticated access via the Freeradius server, and any/all other groups to be denied. In my wiki and google searches, I've found reference to "group_authorization", but I can't find that module in the policy.d or mods-available folder. Also, I've seen the reference to huntgroups, but only when queried against SQL, which shouldn't be needed in my case. Can anyone point me in the right direction to get this working? TL;DR = Need info on setting up Freeradius authentication to LDAP only for a specific group, denying all other groups. Thank you!Jake

3 4

Freeradius with ldap authentication
by Fatih Naufal 27 Jun '17

27 Jun '17

Hello before i ask this question, i already read and try the freeradius + ldap authentication from https://wiki.freeradius.org/protocol/LDAP and http://confluence.diamond.ac.uk/display/PAAUTH/Using+LDAP+as+authentication…. But now i'm kinda stuck with that both documentation, because everytime i test the user in ldap (using radtest) i get "no DN found". I already check that the dn has properly set up (i'm using phpldapadmin to create user in ldap to make it easier). Here is the debug log : Tue Jun 27 05:54:40 2017 : Debug: (1) Received Access-Request Id 251 from 127.0.0.1:53093 to 127.0.0.1:1812 length 74 Tue Jun 27 05:54:41 2017 : Debug: (1) User-Name = "teke" Tue Jun 27 05:54:41 2017 : Debug: (1) User-Password = "xxx" Tue Jun 27 05:54:41 2017 : Debug: (1) NAS-IP-Address = 127.0.1.1 Tue Jun 27 05:54:41 2017 : Debug: (1) NAS-Port = 1812 Tue Jun 27 05:54:41 2017 : Debug: (1) Message-Authenticator = 0xef22ab207657169978bd2b65ef0f42c6 Tue Jun 27 05:54:41 2017 : Debug: (1) session-state: No State attribute Tue Jun 27 05:54:41 2017 : Debug: (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default Tue Jun 27 05:54:41 2017 : Debug: (1) authorize { Tue Jun 27 05:54:41 2017 : Debug: (1) policy filter_username { Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name) { Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name) -> TRUE Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name) { Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /@[^@]*@/ ) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /\.\./ ) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /\.\./ ) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /\.$/) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /\.$/) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /(a)\./) { Tue Jun 27 05:54:41 2017 : Debug: No matches Tue Jun 27 05:54:41 2017 : Debug: (1) if (&User-Name =~ /(a)\./) -> FALSE Tue Jun 27 05:54:41 2017 : Debug: (1) } # if (&User-Name) = notfound Tue Jun 27 05:54:41 2017 : Debug: (1) } # policy filter_username = notfound Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling preprocess (rlm_preprocess) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from preprocess (rlm_preprocess) Tue Jun 27 05:54:41 2017 : Debug: (1) [preprocess] = ok Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling chap (rlm_chap) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from chap (rlm_chap) Tue Jun 27 05:54:41 2017 : Debug: (1) [chap] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling mschap (rlm_mschap) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from mschap (rlm_mschap) Tue Jun 27 05:54:41 2017 : Debug: (1) [mschap] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling digest (rlm_digest) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from digest (rlm_digest) Tue Jun 27 05:54:41 2017 : Debug: (1) [digest] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling suffix (rlm_realm) Tue Jun 27 05:54:41 2017 : Debug: (1) suffix: Checking for suffix after "@" Tue Jun 27 05:54:41 2017 : Debug: (1) suffix: No '@' in User-Name = "teke", looking up realm NULL Tue Jun 27 05:54:41 2017 : Debug: (1) suffix: No such realm "NULL" Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from suffix (rlm_realm) Tue Jun 27 05:54:41 2017 : Debug: (1) [suffix] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling eap (rlm_eap) Tue Jun 27 05:54:41 2017 : Debug: (1) eap: No EAP-Message, not doing EAP Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from eap (rlm_eap) Tue Jun 27 05:54:41 2017 : Debug: (1) [eap] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling files (rlm_files) Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: returned from files (rlm_files) Tue Jun 27 05:54:41 2017 : Debug: (1) [files] = noop Tue Jun 27 05:54:41 2017 : Debug: (1) modsingle[authorize]: calling ldap (rlm_ldap) Tue Jun 27 05:54:41 2017 : Info: rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 118721 seconds Tue Jun 27 05:54:41 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba43988d0 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 118721 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba439cf90 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 118721 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba438f2e0 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 118721 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): You probably need to lower "min" Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba4392d70 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle for 118711 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): You probably need to lower "min" Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba44fefb0 Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Closing connection (5): Hit idle_timeout, was idle for 118711 seconds Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): You probably need to lower "min" Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap: Closing libldap handle 0x558ba439f860 Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" Tue Jun 27 05:54:42 2017 : Info: rlm_ldap (ldap): Opening additional connection (6), 1 of 32 pending slots used Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): New libldap handle 0x558ba438e620 Tue Jun 27 05:54:42 2017 : Debug: rlm_ldap (ldap): Waiting for bind result... Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Bind successful Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Reserved connection (6) Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: EXPAND TMPL XLAT Tue Jun 27 05:54:43 2017 : Debug: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Tue Jun 27 05:54:43 2017 : Debug: Parsed xlat tree: Tue Jun 27 05:54:43 2017 : Debug: literal --> (uid= Tue Jun 27 05:54:43 2017 : Debug: if { Tue Jun 27 05:54:43 2017 : Debug: attribute --> Stripped-User-Name Tue Jun 27 05:54:43 2017 : Debug: } Tue Jun 27 05:54:43 2017 : Debug: else { Tue Jun 27 05:54:43 2017 : Debug: attribute --> User-Name Tue Jun 27 05:54:43 2017 : Debug: } Tue Jun 27 05:54:43 2017 : Debug: literal --> ) Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: --> (uid=teke) Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: EXPAND TMPL LITERAL Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: Performing search in "" with filter "(uid=teke)", scope "sub" Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: Waiting for search result... Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: The specified DN wasn't found Tue Jun 27 05:54:43 2017 : Debug: (1) ldap: Search returned no results Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Released connection (6) Tue Jun 27 05:54:43 2017 : Info: rlm_ldap (ldap): Need 2 more connections to reach 10 spares Tue Jun 27 05:54:43 2017 : Info: rlm_ldap (ldap): Opening additional connection (7), 1 of 31 pending slots used Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): New libldap handle 0x558ba439b660 Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Waiting for bind result... Tue Jun 27 05:54:43 2017 : Debug: rlm_ldap (ldap): Bind successful Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[authorize]: returned from ldap (rlm_ldap) Tue Jun 27 05:54:43 2017 : Debug: (1) [ldap] = notfound Tue Jun 27 05:54:43 2017 : Debug: (1) } # authorize = notfound Tue Jun 27 05:54:43 2017 : ERROR: (1) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject Tue Jun 27 05:54:43 2017 : Debug: (1) Failed to authenticate the user Tue Jun 27 05:54:43 2017 : Debug: (1) Using Post-Auth-Type Reject Tue Jun 27 05:54:43 2017 : Debug: (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default Tue Jun 27 05:54:43 2017 : Debug: (1) Post-Auth-Type REJECT { Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Tue Jun 27 05:54:43 2017 : Debug: %{User-Name} Tue Jun 27 05:54:43 2017 : Debug: Parsed xlat tree: Tue Jun 27 05:54:43 2017 : Debug: attribute --> User-Name Tue Jun 27 05:54:43 2017 : Debug: (1) attr_filter.access_reject: EXPAND %{User-Name} Tue Jun 27 05:54:43 2017 : Debug: (1) attr_filter.access_reject: --> teke Tue Jun 27 05:54:43 2017 : Debug: (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) Tue Jun 27 05:54:43 2017 : Debug: (1) [attr_filter.access_reject] = updated Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: calling eap (rlm_eap) Tue Jun 27 05:54:43 2017 : Debug: (1) eap: Request didn't contain an EAP-Message, not inserting EAP-Failure Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: returned from eap (rlm_eap) Tue Jun 27 05:54:43 2017 : Debug: (1) [eap] = noop Tue Jun 27 05:54:43 2017 : Debug: (1) policy remove_reply_message_if_eap { Tue Jun 27 05:54:43 2017 : Debug: (1) if (&reply:EAP-Message && &reply:Reply-Message) { Tue Jun 27 05:54:43 2017 : Debug: (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Tue Jun 27 05:54:43 2017 : Debug: (1) else { Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: calling noop (rlm_always) Tue Jun 27 05:54:43 2017 : Debug: (1) modsingle[post-auth]: returned from noop (rlm_always) Tue Jun 27 05:54:43 2017 : Debug: (1) [noop] = noop Tue Jun 27 05:54:43 2017 : Debug: (1) } # else = noop Tue Jun 27 05:54:43 2017 : Debug: (1) } # policy remove_reply_message_if_eap = noop Tue Jun 27 05:54:43 2017 : Debug: (1) } # Post-Auth-Type REJECT = updated Tue Jun 27 05:54:43 2017 : Debug: (1) Delaying response for 1.000000 seconds Tue Jun 27 05:54:43 2017 : Debug: Waking up in 0.9 seconds. Tue Jun 27 05:54:44 2017 : Debug: (1) Sending delayed response Tue Jun 27 05:54:44 2017 : Debug: (1) Sent Access-Reject Id 251 from 127.0.0.1:1812 to 127.0.0.1:53093 length 20 Tue Jun 27 05:54:44 2017 : Debug: Waking up in 3.9 seconds. Tue Jun 27 05:54:48 2017 : Debug: (1) Cleaning up request packet ID 251 with timestamp +118720 Any kind of help, documentation recommendation would help. thankyou!

2 1

Freeradius + AD authentication passing Domain+User
by Alejandro Cabrera Obed 26 Jun '17

26 Jun '17

Dear, we have a Freeradius 2.2.5 server in order to authenticate WiFi users from cell phones and notebooks. In the case of cell phones, the users type the corresponding usernames and passwords and after that Freeradius passes it to the AD and everything works OK. In the case of the notebooks, the Windows users are logged into our DC domain, then they type the username or username@domain or domain\username with the corresponding passwords but in theses cases they can't authenticate against the AD (there is a reject message in the Freradius log). In case they are not logged into the domain, and they are local users in the notebooks, if they type just their usernames (without domain) they authenticate OK. So how can I authenticate Windows users against the AD when they are logged into the domain??? Do I have to define a special directive in a config file from freeradius, winbind or samba? Thanks in advance, regards!!! Alejandro

5 14

from freeradius 2 to freeradius 3 - Problems with unlang script
by hans.bornemann＠tu-dortmund.de 26 Jun '17

26 Jun '17

Hi, we are using a separate password for wlan user, we called it wlan-nt-password. in freeradius 2 config we do a little check if the wlan password is set for the user and set it as the nt-password for authentication. This works with no problems. in freeradius 3 i got: /usr/local/etc/raddb/sites-enabled/inner-wlan-peap[18]: Failed parsing expanded string: /usr/local/etc/raddb/sites-enabled/inner-wlan-peap[18]: %{check:wlan-NT-Password} /usr/local/etc/raddb/sites-enabled/inner-wlan-peap[18]: ^ Unknown module ----------- if ("%{check:wlan-NT-Password}" == "") { # ist im SQL-Server ein WLAN-Passwort gefunden worden? # Ab Stichtag Authentifizierung ohne WLAN-Password verbieten. update config { # nein, User ablehnen Auth-Type := Reject } } else { update config { # ja, also NT-Passwort mit WLAN-Passwort ueberschreiben, # damit mschapv2 gegen das WLAN-Passwort authentifiziert. NT-Password := "%{check:wlan-NT-Password}" } } ------------------- regards Hans

2 1

Re: Framed-IP-Address into Access-Request is not processed
by José María López Otero 26 Jun '17

26 Jun '17

Hello. Any idea or hint about why Framed-IP-Address into Access-Request seems to be ignored by FreeRadius? Is it an unsupported feature? Thank you. On Tue, Jun 20, 2017 at 12:57 PM, José María López Otero < jose.maria.lopez.otero(a)gmail.com> wrote: > Hello Freeradius community, > > I'm trying configure FreeRadius (v2.2.6) + sql module for users + > sqlippool module to provide an IP address which the NAS client has > suggested. The suggested IP address only should be provided if it matches > in the pool allocated for this user, in any other case, the server could > answer other allowed IP from the selected pool. The client is sending the > "Framed-IP-Address" field in the Access-Request message but FreeRadius > ignores it. > > I'm basing this philosophy in the RFC2865, section 5.8, Framed-IP-Address: > > "It MAY be used in Access-Request packet as a hint by the NAS to the > server that would prefer that address, but the server is not required to > the hint." > > Probably this feature is not supported but I want to be sure before > develop my own workaround. I wonder if I could get it using unlang code. > > A FreeRadius upgrade is not allowed by now but I would be interesting to > know if this feature could be achieve in other version. > > Thank you in advance. > > > PD: The radius -X log trace is as follows: > > radiusd -X > radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built > on Sep 10 2015 at 07:12:21 > Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License. > For more information about these matters, see the file named COPYRIGHT. > Starting - reading configuration files ... > including configuration file /etc/raddb/radiusd.conf > including configuration file /etc/raddb/proxy.conf > including configuration file /etc/raddb/clients.conf > including files in directory /etc/raddb/modules/ > including configuration file /etc/raddb/modules/dynamic_clients > including configuration file /etc/raddb/modules/sradutmp > including configuration file /etc/raddb/modules/soh > including configuration file /etc/raddb/modules/echo > including configuration file /etc/raddb/modules/mac2vlan > including configuration file /etc/raddb/modules/detail > including configuration file /etc/raddb/modules/unix > including configuration file /etc/raddb/modules/expiration > including configuration file /etc/raddb/modules/always > including configuration file /etc/raddb/modules/pam > including configuration file /etc/raddb/modules/linelog > including configuration file /etc/raddb/modules/inner-eap > including configuration file /etc/raddb/modules/radutmp > including configuration file /etc/raddb/modules/attr_rewrite > including configuration file /etc/raddb/modules/smbpasswd > including configuration file /etc/raddb/modules/ntlm_auth > including configuration file /etc/raddb/modules/detail.example.com > including configuration file /etc/raddb/modules/expr > including configuration file /etc/raddb/modules/policy > including configuration file /etc/raddb/modules/perl > including configuration file /etc/raddb/modules/realm > including configuration file /etc/raddb/modules/rediswho > including configuration file /etc/raddb/modules/checkval > including configuration file /etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /etc/raddb/modules/logintime > including configuration file /etc/raddb/modules/exec > including configuration file /etc/raddb/modules/preprocess > including configuration file /etc/raddb/modules/detail.log > including configuration file /etc/raddb/modules/cache > including configuration file /etc/raddb/modules/etc_group > including configuration file /etc/raddb/modules/digest > including configuration file /etc/raddb/modules/chap > including configuration file /etc/raddb/modules/pap > including configuration file /etc/raddb/modules/redis > including configuration file /etc/raddb/modules/opendirectory > including configuration file /etc/raddb/modules/acct_unique > including configuration file /etc/raddb/modules/counter > including configuration file /etc/raddb/modules/files > including configuration file /etc/raddb/modules/otp > including configuration file /etc/raddb/modules/attr_filter > including configuration file /etc/raddb/modules/mschap > including configuration file /etc/raddb/modules/passwd > including configuration file /etc/raddb/modules/dhcp_sqlippool > including configuration file /etc/raddb/modules/cui > including configuration file /etc/raddb/modules/ippool > including configuration file /etc/raddb/modules/replicate > including configuration file /etc/raddb/modules/mac2ip > including configuration file /etc/raddb/modules/wimax > including configuration file /etc/raddb/modules/radrelay > including configuration file /etc/raddb/modules/sql_log > including configuration file /etc/raddb/modules/smsotp > including configuration file /etc/raddb/eap.conf > including configuration file /etc/raddb/sql.conf > including configuration file /etc/raddb/sql/mysql/dialup.conf > including configuration file /etc/raddb/sqlippool.conf > including configuration file /etc/raddb/sql/mysql/ippool.conf > including configuration file /etc/raddb/policy.conf > including files in directory /etc/raddb/sites-enabled/ > including configuration file /etc/raddb/sites-enabled/default > main { > user = "radiusd" > group = "radiusd" > allow_core_dumps = no > } > including dictionary file /etc/raddb/dictionary > main { > name = "radiusd" > prefix = "/usr" > localstatedir = "/var" > sbindir = "/usr/sbin" > logdir = "/var/log/radius" > run_dir = "/var/run/radiusd" > libdir = "/usr/lib64/freeradius" > radacctdir = "/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 5 > cleanup_delay = 5 > max_requests = 1024 > pidfile = "/var/run/radiusd/radiusd.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20.000000 > response_timeouts = 1 > max_outstanding = 65536 > require_message_authenticator = yes > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > coa { > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "mysecret" > nastype = "other" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating module "exec" from file /etc/raddb/modules/exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > timeout = 10 > } > Module: Linked to module rlm_expr > Module: Instantiating module "expr" from file /etc/raddb/modules/expr > Module: Linked to module rlm_expiration > Module: Instantiating module "expiration" from file > /etc/raddb/modules/expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating module "logintime" from file > /etc/raddb/modules/logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server { # from file > modules { > Module: Creating Post-Auth-Type = REJECT > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating module "preprocess" from file > /etc/raddb/modules/preprocess > preprocess { > huntgroups = "/etc/raddb/huntgroups" > hints = "/etc/raddb/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > reading pairlist file /etc/raddb/huntgroups > reading pairlist file /etc/raddb/hints > Module: Linked to module rlm_files > Module: Instantiating module "files" from file /etc/raddb/modules/files > files { > usersfile = "/etc/raddb/users" > acctusersfile = "/etc/raddb/acct_users" > preproxy_usersfile = "/etc/raddb/preproxy_users" > compat = "no" > } > reading pairlist file /etc/raddb/users > reading pairlist file /etc/raddb/acct_users > reading pairlist file /etc/raddb/preproxy_users > Module: Linked to module rlm_sql > Module: Instantiating module "sql" from file /etc/raddb/sql.conf > sql { > driver = "rlm_sql_mysql" > server = "se3-PGW" > port = "3306" > login = "radius" > password = "mypass" > radius_db = "MY_DB" > read_groups = yes > sqltrace = no > sqltracefile = "/var/log/radius/sqltrace.sql" > readclients = no > deletestalesessions = yes > num_sql_socks = 32 > lifetime = 0 > max_queries = 0 > sql_user_name = "%{User-Name}" > default_user_profile = "" > nas_query = "SELECT id, nasname, shortname, type, secret, server > FROM nas" > authorize_check_query = "SELECT id, username, attribute, value, op > FROM radcheck WHERE username = '%{SQL-User-Name}' > ORDER BY id" > authorize_reply_query = "SELECT id, username, attribute, value, op > FROM radreply WHERE username = '%{SQL-User-Name}' > ORDER BY id" > authorize_group_check_query = "SELECT id, groupname, attribute, > Value, op FROM radgroupcheck WHERE groupname = > '%{Sql-Group}' ORDER BY id" > authorize_group_reply_query = "SELECT id, groupname, attribute, > value, op FROM radgroupreply WHERE groupname = > '%{Sql-Group}' ORDER BY id" > accounting_onoff_query = " UPDATE radacct SET > acctstoptime = '%S', acctsessiontime = > unix_timestamp('%S') - > unix_timestamp(acctstarttime), acctterminatecause = > '%{Acct-Terminate-Cause}', acctstopdelay = > %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL > AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime > <= '%S'" > accounting_update_query = " UPDATE radacct SET > framedipaddress = '%{Framed-IP-Address}', > acctsessiontime = '%{%{Acct-Session-Time}:-0}', > acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | > '%{%{Acct-Input-Octets}:-0}', > acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | > '%{%{Acct-Output-Octets}:-0}' WHERE > acctsessionid = '%{Acct-Session-Id}' AND username = > '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" > accounting_update_query_alt = " INSERT INTO radacct > (acctsessionid, acctuniqueid, username, realm, > nasipaddress, nasportid, nasporttype, > acctstarttime, acctsessiontime, acctauthentic, > connectinfo_start, acctinputoctets, acctoutputoctets, > calledstationid, callingstationid, servicetype, > framedprotocol, framedipaddress, acctstartdelay, > xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', > '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', > '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', > '%{NAS-Port-Type}', DATE_SUB('%S', > INTERVAL (%{%{Acct-Session-Time}:-0} + > %{%{Acct-Delay-Time}:-0}) SECOND), > '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', > '%{%{Acct-Input-Gigawords}:-0}' << 32 | > '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' > << 32 | '%{%{Acct-Output-Octets}:-0}', > '%{Called-Station-Id}', '%{Calling-Station-Id}', > '%{Service-Type}', '%{Framed-Protocol}', > '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" > accounting_start_query = " INSERT INTO radacct > (acctsessionid, acctuniqueid, username, realm, > nasipaddress, nasportid, nasporttype, > acctstarttime, acctstoptime, acctsessiontime, > acctauthentic, connectinfo_start, connectinfo_stop, > acctinputoctets, acctoutputoctets, calledstationid, > callingstationid, acctterminatecause, servicetype, > framedprotocol, framedipaddress, acctstartdelay, > acctstopdelay, xascendsessionsvrkey) VALUES > ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', > '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', > '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, > '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', > '%{Called-Station-Id}', '%{Calling-Station-Id}', '', > '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', > '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" > accounting_start_query_alt = " UPDATE radacct SET > acctstarttime = '%S', acctstartdelay = > '%{%{Acct-Delay-Time}:-0}', connectinfo_start = > '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' > AND username = '%{SQL-User-Name}' AND nasipaddress > = '%{NAS-IP-Address}'" > accounting_stop_query = " UPDATE radacct SET > acctstoptime = '%S', acctsessiontime = > '%{%{Acct-Session-Time}:-0}', acctinputoctets = > '%{%{Acct-Input-Gigawords}:-0}' << 32 | > '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = > '%{%{Acct-Output-Gigawords}:-0}' << 32 | > '%{%{Acct-Output-Octets}:-0}', acctterminatecause = > '%{Acct-Terminate-Cause}', acctstopdelay = > '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = > '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' > AND username = '%{SQL-User-Name}' AND > nasipaddress = '%{NAS-IP-Address}'" > accounting_stop_query_alt = " INSERT INTO radacct > (acctsessionid, acctuniqueid, username, realm, > nasipaddress, nasportid, nasporttype, acctstarttime, > acctstoptime, acctsessiontime, acctauthentic, > connectinfo_start, connectinfo_stop, acctinputoctets, > acctoutputoctets, calledstationid, callingstationid, > acctterminatecause, servicetype, framedprotocol, > framedipaddress, acctstartdelay, acctstopdelay) > VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', > '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', > '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', > INTERVAL (%{%{Acct-Session-Time}:-0} + > %{%{Acct-Delay-Time}:-0}) SECOND), '%S', > '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', > '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | > '%{%{Acct-Input-Octets}:-0}', > '%{%{Acct-Output-Gigawords}:-0}' << 32 | > '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', > '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', > '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', > '0', '%{%{Acct-Delay-Time}:-0}')" > group_membership_query = "SELECT groupname FROM > radusergroup WHERE username = '%{SQL-User-Name}' ORDER > BY priority" > connect_failure_retry_delay = 60 > simul_count_query = "" > simul_verify_query = "SELECT radacctid, acctsessionid, username, > nasipaddress, nasportid, framedipaddress, > callingstationid, framedprotocol > FROM radacct WHERE username = > '%{SQL-User-Name}' AND acctstoptime IS NULL" > postauth_query = "INSERT INTO radpostauth > (username, pass, reply, authdate) VALUES ( > '%{User-Name}', > '%{%{User-Password}:-%{Chap-Password}}', > '%{reply:Packet-Type}', '%S')" > safe-characters = "@abcdefghijklmnopqrstuvwxyzAB > CDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" > } > rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and > linked > rlm_sql (sql): Attempting to connect to radius@se3-PGW:3306/DB_BICS > rlm_sql (sql): starting 0 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 > rlm_sql_mysql: Starting connect to MySQL server for #0 > rlm_sql (sql): Connected new DB handle, #0 > rlm_sql (sql): starting 1 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 > rlm_sql_mysql: Starting connect to MySQL server for #1 > rlm_sql (sql): Connected new DB handle, #1 > rlm_sql (sql): starting 2 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 > rlm_sql_mysql: Starting connect to MySQL server for #2 > rlm_sql (sql): Connected new DB handle, #2 > rlm_sql (sql): starting 3 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 > rlm_sql_mysql: Starting connect to MySQL server for #3 > rlm_sql (sql): Connected new DB handle, #3 > rlm_sql (sql): starting 4 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 > rlm_sql_mysql: Starting connect to MySQL server for #4 > rlm_sql (sql): Connected new DB handle, #4 > rlm_sql (sql): starting 5 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 > rlm_sql_mysql: Starting connect to MySQL server for #5 > rlm_sql (sql): Connected new DB handle, #5 > rlm_sql (sql): starting 6 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 > rlm_sql_mysql: Starting connect to MySQL server for #6 > rlm_sql (sql): Connected new DB handle, #6 > rlm_sql (sql): starting 7 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 > rlm_sql_mysql: Starting connect to MySQL server for #7 > rlm_sql (sql): Connected new DB handle, #7 > rlm_sql (sql): starting 8 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 > rlm_sql_mysql: Starting connect to MySQL server for #8 > rlm_sql (sql): Connected new DB handle, #8 > rlm_sql (sql): starting 9 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 > rlm_sql_mysql: Starting connect to MySQL server for #9 > rlm_sql (sql): Connected new DB handle, #9 > rlm_sql (sql): starting 10 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 > rlm_sql_mysql: Starting connect to MySQL server for #10 > rlm_sql (sql): Connected new DB handle, #10 > rlm_sql (sql): starting 11 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 > rlm_sql_mysql: Starting connect to MySQL server for #11 > rlm_sql (sql): Connected new DB handle, #11 > rlm_sql (sql): starting 12 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 > rlm_sql_mysql: Starting connect to MySQL server for #12 > rlm_sql (sql): Connected new DB handle, #12 > rlm_sql (sql): starting 13 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 > rlm_sql_mysql: Starting connect to MySQL server for #13 > rlm_sql (sql): Connected new DB handle, #13 > rlm_sql (sql): starting 14 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 > rlm_sql_mysql: Starting connect to MySQL server for #14 > rlm_sql (sql): Connected new DB handle, #14 > rlm_sql (sql): starting 15 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 > rlm_sql_mysql: Starting connect to MySQL server for #15 > rlm_sql (sql): Connected new DB handle, #15 > rlm_sql (sql): starting 16 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 > rlm_sql_mysql: Starting connect to MySQL server for #16 > rlm_sql (sql): Connected new DB handle, #16 > rlm_sql (sql): starting 17 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 > rlm_sql_mysql: Starting connect to MySQL server for #17 > rlm_sql (sql): Connected new DB handle, #17 > rlm_sql (sql): starting 18 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 > rlm_sql_mysql: Starting connect to MySQL server for #18 > rlm_sql (sql): Connected new DB handle, #18 > rlm_sql (sql): starting 19 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 > rlm_sql_mysql: Starting connect to MySQL server for #19 > rlm_sql (sql): Connected new DB handle, #19 > rlm_sql (sql): starting 20 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 > rlm_sql_mysql: Starting connect to MySQL server for #20 > rlm_sql (sql): Connected new DB handle, #20 > rlm_sql (sql): starting 21 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 > rlm_sql_mysql: Starting connect to MySQL server for #21 > rlm_sql (sql): Connected new DB handle, #21 > rlm_sql (sql): starting 22 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 > rlm_sql_mysql: Starting connect to MySQL server for #22 > rlm_sql (sql): Connected new DB handle, #22 > rlm_sql (sql): starting 23 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 > rlm_sql_mysql: Starting connect to MySQL server for #23 > rlm_sql (sql): Connected new DB handle, #23 > rlm_sql (sql): starting 24 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 > rlm_sql_mysql: Starting connect to MySQL server for #24 > rlm_sql (sql): Connected new DB handle, #24 > rlm_sql (sql): starting 25 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 > rlm_sql_mysql: Starting connect to MySQL server for #25 > rlm_sql (sql): Connected new DB handle, #25 > rlm_sql (sql): starting 26 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 > rlm_sql_mysql: Starting connect to MySQL server for #26 > rlm_sql (sql): Connected new DB handle, #26 > rlm_sql (sql): starting 27 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 > rlm_sql_mysql: Starting connect to MySQL server for #27 > rlm_sql (sql): Connected new DB handle, #27 > rlm_sql (sql): starting 28 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 > rlm_sql_mysql: Starting connect to MySQL server for #28 > rlm_sql (sql): Connected new DB handle, #28 > rlm_sql (sql): starting 29 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 > rlm_sql_mysql: Starting connect to MySQL server for #29 > rlm_sql (sql): Connected new DB handle, #29 > rlm_sql (sql): starting 30 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 > rlm_sql_mysql: Starting connect to MySQL server for #30 > rlm_sql (sql): Connected new DB handle, #30 > rlm_sql (sql): starting 31 > rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 > rlm_sql_mysql: Starting connect to MySQL server for #31 > rlm_sql (sql): Connected new DB handle, #31 > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating module "acct_unique" from file > /etc/raddb/modules/acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, > NAS-Port" > } > Module: Linked to module rlm_realm > Module: Instantiating module "suffix" from file /etc/raddb/modules/realm > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_detail > Module: Instantiating module "detail" from file /etc/raddb/modules/detail > detail { > detailfile = "/var/log/radius/radacct/%{%{P > acket-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Linked to module rlm_sqlippool > Module: Instantiating module "sqlippool" from file > /etc/raddb/sqlippool.conf > sqlippool { > sql-instance-name = "sql" > lease-duration = 3601 > pool-name = "" > allocate-begin = "START TRANSACTION" > allocate-clear = "UPDATE radippool SET nasipaddress = '', > pool_key = 0, callingstationid = '', username = '', calledstationid = > '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND > AND pool_name = '%{control:Pool-Name}'" > allocate-find = "SELECT framedipaddress FROM radippool WHERE > pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time > IS NULL) LIMIT 1 FOR UPDATE" > allocate-update = "UPDATE radippool SET nasipaddress = > '%{NAS-IP-Address}', pool_key = '%{3GPP-IMSI}-%{3GPP-NSAPI}', > callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', > calledstationid = '%{Called-Station-Id}', expiry_time = NOW() + INTERVAL > 3601 SECOND WHERE framedipaddress = '%I' AND (expiry_time < NOW() OR > expiry_time IS NULL)" > allocate-commit = "COMMIT" > allocate-rollback = "ROLLBACK" > pool-check = "SELECT id FROM radippool WHERE > pool_name='%{control:Pool-Name}' LIMIT 1" > start-begin = "START TRANSACTION" > start-update = "UPDATE radippool SET expiry_time = NOW() + > INTERVAL 3601 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND > pool_key = '%{3GPP-IMSI}-%{3GPP-NSAPI}' AND username = '%{User-Name}' > AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = > '%{Framed-IP-Address}'" > start-commit = "COMMIT" > start-rollback = "ROLLBACK" > alive-begin = "START TRANSACTION" > alive-update = "UPDATE radippool SET expiry_time = NOW() + > INTERVAL 3601 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key > = '%{3GPP-IMSI}-%{3GPP-NSAPI}' AND username = '%{User-Name}' AND > callingstationid = '%{Calling-Station-Id}' AND framedipaddress = > '%{Framed-IP-Address}'" > alive-commit = "COMMIT" > alive-rollback = "ROLLBACK" > stop-begin = "START TRANSACTION" > stop-clear = "UPDATE radippool SET nasipaddress = '', pool_key = > 0, callingstationid = '', username = '', calledstationid = '', expiry_time > = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = > '%{3GPP-IMSI}-%{3GPP-NSAPI}' AND username = '%{User-Name}' AND > callingstationid = '%{Calling-Station-Id}' AND framedipaddress = > '%{Framed-IP-Address}'" > stop-commit = "COMMIT" > stop-rollback = "ROLLBACK" > on-begin = "START TRANSACTION" > on-clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, > callingstationid = '', username = '', expiry_time = NULL WHERE > nasipaddress = '%{Nas-IP-Address}'" > on-commit = "COMMIT" > on-rollback = "ROLLBACK" > off-begin = "START TRANSACTION" > off-clear = "UPDATE radippool SET nasipaddress = '', pool_key = > 0, callingstationid = '', username = '', expiry_time = NULL WHERE > nasipaddress = '%{Nas-IP-Address}'" > off-commit = "COMMIT" > off-rollback = "ROLLBACK" > sqlippool_log_exists = "Existing IP: %{reply:Framed-IP-Address} > (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user > %{User-Name})" > sqlippool_log_success = "Allocated IP: %{reply:Framed-IP-Address} > from %{control:Pool-Name} (did %{Called-Station-Id} cli > %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" > sqlippool_log_clear = "Released IP %{Framed-IP-Address} (did > %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" > sqlippool_log_failed = "IP Allocation FAILED from > %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} > port %{NAS-Port} user %{User-Name})" > sqlippool_log_nopool = "No Pool-Name defined (did > %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user > %{User-Name})" > defaultpool = "main_pool" > } > Module: Linked to module rlm_attr_filter > Module: Instantiating module "attr_filter.accounting_response" from file > /etc/raddb/modules/attr_filter > attr_filter attr_filter.accounting_response { > attrsfile = "/etc/raddb/attrs.accounting_response" > key = "%{User-Name}" > relaxed = no > } > reading pairlist file /etc/raddb/attrs.accounting_response > Module: Checking session {...} for more modules to load > Module: Linked to module rlm_radutmp > Module: Instantiating module "radutmp" from file > /etc/raddb/modules/radutmp > radutmp { > filename = "/var/log/radius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Checking post-proxy {...} for more modules to load > Module: Linked to module rlm_eap > Module: Instantiating module "eap" from file /etc/raddb/eap.conf > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 1024 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > CA_path = "/etc/raddb/certs" > pem_file_type = yes > private_key_file = "/etc/raddb/certs/server.pem" > certificate_file = "/etc/raddb/certs/server.pem" > CA_file = "/etc/raddb/certs/ca.pem" > private_key_password = "whatever" > dh_file = "/etc/raddb/certs/dh" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > ecdh_curve = "prime256v1" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > verify { > } > ocsp { > enable = no > override_cert_url = yes > url = "http://127.0.0.1/ocsp/" > use_nonce = yes > timeout = 0 > softfail = no > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > soh = no > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > send_error = no > } > Module: Checking post-auth {...} for more modules to load > Module: Linked to module rlm_always > Module: Instantiating module "noop" from file /etc/raddb/modules/always > always noop { > rcode = "noop" > simulcount = 0 > mpp = no > } > Module: Instantiating module "attr_filter.access_reject" from file > /etc/raddb/modules/attr_filter > attr_filter attr_filter.access_reject { > attrsfile = "/etc/raddb/attrs.access_reject" > key = "%{User-Name}" > relaxed = no > } > reading pairlist file /etc/raddb/attrs.access_reject > } # modules > } # server > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = 127.0.0.1 > port = 0 > } > listen { > type = "acct" > ipaddr = 127.0.0.1 > port = 0 > } > ... adding new socket proxy address * port 40388 > Listening on authentication address 127.0.0.1 port 1812 > Listening on accounting address 127.0.0.1 port 1813 > Listening on proxy address * port 1297 > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1 port 54156, id=187, > length=103 > User-Name = "123123000@internet" > Framed-IP-Address = 5.17.0.15 > Called-Station-Id = "internet" > Calling-Station-Id = "0034687947939" > 3GPP-IMSI = "123123000000000" > 3GPP-NSAPI = "5" > # Executing section authorize from file /etc/raddb/sites-enabled/default > +group authorize { > ++[preprocess] = ok > [files] users: Matched entry DEFAULT at line 50 > ++[files] = ok > [sql] expand: %{User-Name} -> 123123000@internet > [sql] sql_set_user escaped user --> '123123000@internet' > rlm_sql (sql): Reserving sql socket id: 30 > [sql] expand: SELECT id, username, attribute, value, op FROM > radcheck WHERE username = '%{SQL-User-Name}' ORDER BY > id -> SELECT id, username, attribute, value, op FROM radcheck > WHERE username = '123123000@internet' ORDER BY id > [sql] User found in radcheck table > [sql] expand: SELECT id, username, attribute, value, op FROM > radreply WHERE username = '%{SQL-User-Name}' ORDER BY > id -> SELECT id, username, attribute, value, op FROM radreply > WHERE username = '123123000@internet' ORDER BY id > [sql] expand: SELECT groupname FROM radusergroup > WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT > groupname FROM radusergroup WHERE username = > '123123000@internet' ORDER BY priority > rlm_sql (sql): Released sql socket id: 30 > ++[sql] = ok > ++[expiration] = noop > ++[logintime] = noop > +} # group authorize = ok > Found Auth-Type = Accept > Auth-Type = Accept, accepting the user > # Executing section post-auth from file /etc/raddb/sites-enabled/default > +group post-auth { > ++? if ("%{User-Name}" == "XTaskRadiusServerPing") > expand: %{User-Name} -> 123123000@internet > ? Evaluating ("%{User-Name}" == "XTaskRadiusServerPing") -> FALSE > ++? if ("%{User-Name}" == "XTaskRadiusServerPing") -> FALSE > ++else else { > rlm_sql (sql): Reserving sql socket id: 29 > [sqlippool] expand: %{User-Name} -> 123123000@internet > [sqlippool] sql_set_user escaped user --> '123123000@internet' > [sqlippool] expand: START TRANSACTION -> START TRANSACTION > [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key > = 0, callingstationid = '', username = '', calledstationid = '', > expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND > pool_name = '%{control:Pool-Name}' -> UPDATE radippool SET nasipaddress = > '', pool_key = 0, callingstationid = '', username = '', calledstationid > = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND > AND pool_name = 'tochada' > [sqlippool] expand: COMMIT -> COMMIT > [sqlippool] expand: START TRANSACTION -> START TRANSACTION > [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE > pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time > IS NULL) LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool > WHERE pool_name = 'tochada' AND (expiry_time < NOW() OR expiry_time IS > NULL) LIMIT 1 FOR UPDATE > [sqlippool] expand: UPDATE radippool SET nasipaddress = > '%{NAS-IP-Address}', pool_key = '%{3GPP-IMSI}-%{3GPP-NSAPI}', > callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', > calledstationid = '%{Called-Station-Id}', expiry_time = NOW() + INTERVAL > 3601 SECOND WHERE framedipaddress = '5.0.0.5' AND (expiry_time < NOW() OR > expiry_time IS NULL) -> UPDATE radippool SET nasipaddress = '127.0.0.1', > pool_key = '123123000000000-5', callingstationid = '0034687947939', > username = '123123000@internet', calledstationid = 'internet', > expiry_time = NOW() + INTERVAL 3601 SECOND WHERE framedipaddress = > '5.0.0.5' AND (expiry_time < NOW() OR expiry_time IS NULL) > [sqlippool] Allocated IP 5.0.0.5 [05000005] > [sqlippool] expand: COMMIT -> COMMIT > rlm_sql (sql): Released sql socket id: 29 > [sqlippool] expand: Allocated IP: %{reply:Framed-IP-Address} from > %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} > port %{NAS-Port} user %{User-Name}) -> Allocated IP: 5.0.0.5 from tochada > (did internet cli 0034687947939 port user 123123000@internet) > Allocated IP: 5.0.0.5 from tochada (did internet cli 0034687947939 port > user 123123000@internet) > +++[sqlippool] = ok > +++update reply { > expand: modules.sqlippool.lease-duration -> > modules.sqlippool.lease-duration > expand: %{config:modules.sqlippool.lease-duration} -> 3601 > +++} # update reply = noop > ++} # else else = ok > ++[exec] = noop > +} # group post-auth = ok > Sending Access-Accept of id 187 to 127.0.0.1 port 54156 > MS-Primary-DNS-Server = 8.8.8.8 > Framed-IP-Address = 5.0.0.5 > Session-Timeout = 3601 > Finished request 1. > Going to the next request > Waking up in 4.7 seconds. > > >

2 1