- Freeradius-Users - lists.freeradius.org

Re: How to log AAA Reject packets?
by Peter Lambrechtsen 03 May '17

03 May '17

Add linelog or detail depending on how much detail you want into the post-auth Reject section and the rejects get logged. On 3/05/2017 12:58, "Periko Support" <pheriko.support(a)gmail.com> wrote: I would like to know if exist a way to log AAA Reject packets on FR2.2.x.? I had read the log manual but didn't find this special flag. Thanks all for your time!!! - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

1 0

Radsec Clients
by Xavier Maysonnave 02 May '17

02 May '17

Hi All, is there a way to store the radsec clients in an sql table rather than using the tls configuration file ? Thanks -- PGP: CAE5 CE4A EFE9 134F D991 5465 081C B6FB 2EAC 6CC9 <https://goo.gl/lPjb40> -- Light Xavier / Pudhuveedu

2 3

Error when changing inner auth
by LUCA 01 May '17

01 May '17

Hi, I'm using the Version 2. I've successfully changed the default eap type. Now I'm trying to change the inner auth because I need pap as default. I've tried to change the inner auth for ttls but then this happens: ttls { default_eap_type = "pap" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } rlm_eap_ttls: Unknown EAP type pap rlm_eap: Failed to initialize type ttls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. I've tried to change the inner auth for peap as well, but same problem as before: peap { default_eap_type = "pap" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } rlm_eap_peap: Unknown EAP type pap rlm_eap: Failed to initialize type peap /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Why it doesn't recognize pap? Thank you. Luca

3 2

duplicated query insert doing accounting
by Leandro 30 Apr '17

30 Apr '17

Hi guys , Im trying to tune my accounting server. Everything is working good so far. On strange thing is the following line when debuging. rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql (sql): Duplicate entry '915bec9642b89feb789b9566b7ec6e9b' for key 'acctuniqueid' rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Duplicate entry '915bec9642b89feb789b9566b7ec6e9b' for key 'acctuniqueid'' Why is there a second attempt to insert a register ? On the client side I did: radclient -f accounting_packet 172.20.4.208 acct xxxxxxx and checked that there is only one accounting request going to the server. Regards, Leandro

2 1

Cisco problems, newbie
by James 29 Apr '17

29 Apr '17

I have a noradius user defined on my cisco switch that is not working properly, cannot login. I'm trying to debug someone else's freeradius setup and unfortunately cannot post config of debug info.So I have a couple of general questions.I have a single freeradius user defined (in users file) that is working properly from cisco perspective.A second user named noradius is defined locally on cisco (not defined in freeradius). Not working.Cisco is configured to check radius first and then locally defined users.When attempting to login as noradius I keep getting password prompts leading me to believe freeradius is not behaving properly, returning fail rather than error. Or some other issue.Questions.Are freeradius users only defined in the users file?If a user is not found in freeradius do I need config file entries to handle that or should the default behavior be sufficient to pass back response to the requestor to try the next auth method?What is SQL used for, i.e. could there be users hidden in sql I'm not seeing?Are there special cisco considerations for freeradius? I suspect not since it's handling my primary user properly.Thanks.-Jimp.s. if I disable radius on the switch I can login to noradius

2 1

Mysql, Radreply attributes are not being merged.
by Waqas Toor 28 Apr '17

28 Apr '17

Hello, I have added attributes in radreply table against the user, but they are not being merged in the Access-Accept Packet. Same i do with radtest utility they are being added. I am unable to figure out what is missing. actual Access-Request from NAS ========================================================== (0) Received Access-Request Id 92 from 10.0.0.11:1645 to 10.12.32.61:1812 length 179 (0) User-Name = "10.48.136.46" (0) Framed-IP-Address = 10.48.136.46 (0) Cisco-Account-Info = "S10.48.136.46" (0) User-Password = "cisco" (0) Calling-Station-Id = "0/0/0/103:00-00-00-00-00-00" (0) NAS-Port-Type = Virtual (0) NAS-Port = 0 (0) NAS-Port-Id = "0/0/0/103" (0) Service-Type = Outbound-User (0) NAS-IP-Address = 10.0.0.11 (0) NAS-Identifier = "IDC0100ISG02.nms.itcc.com.sa" (0) Event-Timestamp = "Apr 27 2017 02:05:39 EDT" (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) lease_check: Executing: /usr/local/bin/leasequery %{User-Name}: (0) lease_check: EXPAND %{User-Name} (0) lease_check: --> 10.48.136.46 (0) lease_check: Program returned code (0) and output 'User-Name := 1/0A:D824BD511480' (0) lease_check: Program executed successfully (0) [lease_check] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> 1/0A:D824BD511480 (0) sql: SQL-User-Name set to '1/0A:D824BD511480' rlm_sql (sql): Closing connection (0): Hit idle_timeout, was idle for 264 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 264 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 264 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 264 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 264 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (5), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.52-MariaDB, protocol version 10 rlm_sql (sql): Reserved connection (5) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1/0A:D824BD511480' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1/0A:D824BD511480' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "cisco" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1/0A:D824BD511480' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1/0A:D824BD511480' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = '1/0A:D824BD511480' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '1/0A:D824BD511480' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (5) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (6), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.52-MariaDB, protocol version 10 (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (5) (0) sql: EXPAND %{User-Name} (0) sql: --> 1/0A:D824BD511480 (0) sql: SQL-User-Name set to '1/0A:D824BD511480' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1/0A:D824BD511480', 'cisco', 'Access-Accept', '2017-04-27 02:05:39.425995') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1/0A:D824BD511480', 'cisco', 'Access-Accept', '2017-04-27 02:05:39.425995') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (5) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 92 from 10.12.32.61:1812 to 10.0.0.11:1645 length 0 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 92 with timestamp +264 Ready to process requests =================================================================== radtest snippet ============================================================== Received Access-Request Id 120 from 127.0.0.1:39450 to 127.0.0.1:1812 length 82 (2) User-Name = "10.48.136.46" (2) User-Password = "cisco" (2) NAS-IP-Address = 10.12.32.61 (2) NAS-Port = 0 (2) Message-Authenticator = 0xbd6028760e9fe9fcd41666ca91f382af (2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) lease_check: Executing: /usr/local/bin/leasequery %{User-Name}: (2) lease_check: EXPAND %{User-Name} (2) lease_check: --> 10.48.136.46 (2) lease_check: Program returned code (0) and output 'User-Name := 1/0A:D824BD511480' (2) lease_check: Program executed successfully (2) [lease_check] = ok (2) sql: EXPAND %{User-Name} (2) sql: --> 1/0A:D824BD511480 (2) sql: SQL-User-Name set to '1/0A:D824BD511480' rlm_sql (sql): Closing connection (8): Hit idle_timeout, was idle for 95 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 95 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (9), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.52-MariaDB, protocol version 10 rlm_sql (sql): Reserved connection (9) (2) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (2) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1/0A:D824BD511480' ORDER BY id (2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1/0A:D824BD511480' ORDER BY id (2) sql: User found in radcheck table (2) sql: Conditional check items matched, merging assignment check items (2) sql: Cleartext-Password := "cisco" (2) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (2) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1/0A:D824BD511480' ORDER BY id (2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1/0A:D824BD511480' ORDER BY id (2) sql: User found in radreply table, merging reply items (2) sql: Idle-Timeout := 600 (2) sql: Session-Timeout := 3600 (2) sql: Cisco-Account-Info := "ABB_business_basic_0_100_50" (2) sql: Cisco-AVPair := "accounting-list=ACCNT_LIST2" (2) sql: User-Name := "1/0A:D824BD511480" (2) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (2) sql: --> SELECT groupname FROM radusergroup WHERE username = '1/0A:D824BD511480' ORDER BY priority (2) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '1/0A:D824BD511480' ORDER BY priority (2) sql: User not found in any groups rlm_sql (sql): Released connection (9) Need 2 more connections to reach min connections (3) rlm_sql (sql): Opening additional connection (10), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.52-MariaDB, protocol version 10 (2) [sql] = ok (2) [expiration] = noop (2) [logintime] = noop (2) [pap] = updated (2) } # authorize = updated (2) Found Auth-Type = PAP (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) Auth-Type PAP { (2) pap: Login attempt with password (2) pap: Comparing with "known good" Cleartext-Password (2) pap: User authenticated successfully (2) [pap] = ok (2) } # Auth-Type PAP = ok (2) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (2) post-auth { (2) update { (2) No attributes updated (2) } # update = noop (2) sql: EXPAND .query (2) sql: --> .query (2) sql: Using query template 'query' rlm_sql (sql): Reserved connection (9) (2) sql: EXPAND %{User-Name} (2) sql: --> 1/0A:D824BD511480 (2) sql: SQL-User-Name set to '1/0A:D824BD511480' (2) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (2) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1/0A:D824BD511480', 'cisco', 'Access-Accept', '2017-04-27 03:24:06.492079') (2) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1/0A:D824BD511480', 'cisco', 'Access-Accept', '2017-04-27 03:24:06.492079') (2) sql: SQL query returned: success (2) sql: 1 record(s) updated rlm_sql (sql): Released connection (9) (2) [sql] = ok (2) [exec] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # post-auth = ok (2) Sent Access-Accept Id 120 from 127.0.0.1:1812 to 127.0.0.1:39450 length 0 (2) Idle-Timeout = 600 (2) Session-Timeout = 3600 (2) Cisco-Account-Info = "ABB_business_basic_0_100_50" (2) Cisco-AVPair = "accounting-list=ACCNT_LIST2" (2) User-Name = "1/0A:D824BD511480" (2) Finished request Waking up in 4.9 seconds. (2) Cleaning up request packet ID 120 with timestamp +4971 Ready to process request ========================================================== Waqas Toor

3 7

LDAP sync frontend in v4.0.x
by Arran Cudbard-Bell 27 Apr '17

27 Apr '17

Fancied taking a break from refactoring in v4.0.x. https://github.org/FreeRADIUS/freeradius-server/blob/v4.0.x/raddb/sites-ava… The idea is that you can "listen" on DNs within your LDAP directory. You then use the updates you receive to create/invalidate cache entries, or send CoA/DM messages to reflect the changes that have occurred in LDAP. Feel free to try it out, with the normal caveats about v4.0.x. Cookie synthesis isn't there yet, but isn't too hard for OpenLDAP. It'd really help if people using directories other than OpenLDAP that support RFC 4533 could provide their cookie blobs, and an export of their rootDSE with operational attributes. I can then add cookie synthesis for those directories, which'll allow you to do the initial sync without downloading a complete copy of the directory first. -Arran Arran Cudbard-Bell FreeRADIUS Core Developer FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 4

Segfault in linelog
by Arnab Roy 27 Apr '17

27 Apr '17

Hi , I am getting a segmentation fault when using EAP-TLS and the following linelog statement Access-Request ="%{User-Name};%{reply:Packet-Type};%S;%{%{%{Module-Failure-Message[*]} :-%{reply:Reply-Message[*]}:-%{MS-CHAP-Error[*]}}:-[AUTHENTICATED]};%{C alling-Station-Id};%{reply:[*]};%{proxy-request:Packet-Dst-IP-Address}" On running with the -XX flags it seems to seg out at as follows Thu Apr 27 17:50:57 2017 : Debug: %{User-Name};%{reply:Packet-Type};%S;%{%{%{Module-Failure-Message[*]}:- %{reply:Reply-Message[*]}:-%{MS-CHAP-Error[*]}}:-[AUTHENTICATED]};%{Cal ling-Station-Id};%{reply:[*]};%{proxy-request:Packet-Dst-IP-Address} Thu Apr 27 17:50:57 2017 : Debug: Parsed xlat tree: Thu Apr 27 17:50:57 2017 : Debug: attribute --> User-Name Thu Apr 27 17:50:57 2017 : Debug: literal --> ; Thu Apr 27 17:50:57 2017 : Debug: attribute --> Packet-Type Thu Apr 27 17:50:57 2017 : Debug: literal --> ; Thu Apr 27 17:50:57 2017 : Debug: percent --> S Thu Apr 27 17:50:57 2017 : Debug: literal --> ; Thu Apr 27 17:50:57 2017 : Debug: XLAT-IF { Thu Apr 27 17:50:57 2017 : Debug: XLAT-IF { Thu Apr 27 17:50:57 2017 : Debug: attribute --> Module-Failure-Message Thu Apr 27 17:50:57 2017 : Debug: { Thu Apr 27 17:50:57 2017 : Debug: ref 2 Thu Apr 27 17:50:57 2017 : Debug: list 1 Thu Apr 27 17:50:57 2017 : Debug: [*] Thu Apr 27 17:50:57 2017 : Debug: } Thu Apr 27 17:50:57 2017 : Debug: } Thu Apr 27 17:50:57 2017 : Debug: XLAT-ELSE { Thu Apr 27 17:50:57 2017 : Debug: attribute --> Reply-Message Thu Apr 27 17:50:57 2017 : Debug: { Thu Apr 27 17:50:57 2017 : Debug: ref 2 Thu Apr 27 17:50:57 2017 : Debug: list 2 Thu Apr 27 17:50:57 2017 : Debug: [*] Thu Apr 27 17:50:57 2017 : Debug: } Thu Apr 27 17:50:57 2017 : Debug: literal --> :- Thu Apr 27 17:50:57 2017 : Debug: attribute --> MS-CHAP-Error Thu Apr 27 17:50:57 2017 : Debug: { Thu Apr 27 17:50:57 2017 : Debug: ref 2 Thu Apr 27 17:50:57 2017 : Debug: list 1 Thu Apr 27 17:50:57 2017 : Debug: [*] Thu Apr 27 17:50:57 2017 : Debug: } Thu Apr 27 17:50:57 2017 : Debug: } Thu Apr 27 17:50:57 2017 : Debug: } Thu Apr 27 17:50:57 2017 : Debug: XLAT-ELSE { Thu Apr 27 17:50:57 2017 : Debug: literal --> [AUTHENTICATED] Thu Apr 27 17:50:57 2017 : Debug: } Thu Apr 27 17:50:57 2017 : Debug: literal --> ; Thu Apr 27 17:50:57 2017 : Debug: attribute --> Calling-Station-Id Thu Apr 27 17:50:57 2017 : Debug: literal --> ; So looks like Calling-Station-Id is the culprit. Please note this only occurs when the EAP method is TLS and not PEAP /PAP etc. Disabling the above stops the crash. Any suggestions happy provide further logs if required.

2 1

deploy accounting server
by Leandro 27 Apr '17

27 Apr '17

Hi Guys , I recently installed freeradius on my oracle linux server: yum install freeradius was the command I used. I want to setup my radius server to receive some accounting and store it on my mysql db. Question: Where are located the mysql schema ? How can I change/tune the queries to the db ? The directory /etc/raddb/mods-config/sql/main is empty. The file /mods-config/sql/main/mysql/queries.conf Where can I find the mysql schema and queries.conf ?? Im running : [root@AR-LXFEAPIDV01 main]$ radiusd -v radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 17 2017 at 10:28:38 Thanks !!! Leandro.

3 6

Check EAP Type in Unlang/Post Auth
by Arnab Roy 27 Apr '17

27 Apr '17

Hi , I am trying to configure an unlang condition in the post auth section of the virtual server which effectively needs to be able to do the following: //This is my way of trying to explain the requirements not the real unlang syntax :) if(eap-type == "PEAP"){ VSA:=Blah } elseif(eap-type=="TLS") { VSA:=Blah } Which effectively tells the NAS that if a user is using User/pass dump them in VLAN A if User using certs dump them in vlan B. Is this possible if so can someone tell me what the syntax will look like/atrributes to check for. Thanks in advance. Arnab

5 10