- Freeradius-Users - lists.freeradius.org

Re: sending Filter-Id to another accounting server - need help
by Eby Mani 02 Mar '17

02 Mar '17

Hi Alan, I have 3 NAS, one for wireless/wired access, one firewall for internet access and another firewall for restricted network access. Both firewalls are in radius accounting listen mode and have built in log and reporting functions. Internet firewall is configured to provide radius single sign-on based on user group which is passed via "Class" attribute. This works fine. The other firewall is configured to provide radius single sign-on based on user group and "magic key" which is passed via "Filter-Id" attribute. Any user without the "magic key" is not allowed to the network. This is not working as Filter-Id is not sent by radius server. I can tell radius server is not sending Filter-Id to the NAS mentioned in copy-acct-to-home-server, but it is sending Filter-Id back to the wireless/wired NAS. radius debug says, # Executing section accounting from file /etc/freeradius/sites-enabled/copy-acct-to-home-server +- entering group accounting {...} ++[ok] returns ok } # server copy-acct-to-home-server WARNING: Empty pre-proxy section. Using default return values. The question is how to tell radius server to include Filter-Id values to restricted network firewall ?. I assume adding Filter-Id to the "attrs" file will work without any additional configuration, but i don't want to do that unless that is the only solution. Thanks, Eby -------------------------------------------- On Wed, 1/3/17, Alan DeKok <aland(a)deployingradius.com> wrote: Subject: Re: sending Filter-Id to another accounting server - need help To: "Eby Mani" <eby_km(a)yahoo.com>, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, 1 March, 2017, 7:22 PM On Mar 1, 2017, at 2:11 PM, Eby Mani via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > How do i configure freeradius to send user based Filter-Id to an accounting server?. Each user will have different Filter-Id value, users without any Filter-Id string will be denied access on the another NAS(listen only). > > I have the following in post-auth section of sites-enabled/default > > update reply { > Filter-Id = "%{sql:SELECT `value` FROM `radreply` WHERE > `username`='%{User-Name}';} > } That updates the Access-Accept. > Freeradius is sending Filter-Id back to the user connected NAS, but not to the accounting server(another NAS, listen only). I have no idea what that means. > To which section should i add the update reply{} section in copy-acct-to-home-server file ? or is there a special command to include Filter-Id ?. I have no idea what that means, either. Please explain what you want to do. This time, using more detail. What packet is the server receiving? What has to be updated? What packet is the server sending? Your question assumes that we already know what you're doing. We don't. You need to explain it. Alan DeKok.

2 1

Re: freeradius 3.1 sqlcounter[41]: Attribute Daily-Session-Time already defined with different flags
by mpajarin plexus 02 Mar '17

02 Mar '17

> > Hi again and thanks for he answer. > > The reason im using 3.1 is a bug, if dont remember bad, you ( Alan ) fixed > on this version. > It´s about {Sql-group} can´t be called beyond a sql instance on > authorize { } , instead of {Sql-User-name}, it can be called on, for > example post-auth secction > > Im searching the github link about the bug for more references > > Thanks > > 2017-03-01 22:45 GMT+01:00 Alan DeKok <aland(a)deployingradius.com>: > >> >> > On Mar 1, 2017, at 3:34 PM, mpajarin plexus <mpajarin.plexus(a)gmail.com> >> wrote: >> > >> > Im running freeradius 3.1.0 version, on Centos and on debug -X get >> an >> > error like this: >> >> 3.1 isn't an officially supported release. Please use v3.0. >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >> /users.html > > >

2 5

Re: Accounting on 2 tables
by Ahmed Munir 02 Mar '17

02 Mar '17

Thanks. BTW, is there a way to distinguish instances in Radius server for accounting i.e. for asterisk use instance1 and opensips use instance2? Currently using NAS table for radius client setup. id nasname shortname type ports secret server community description 1 10.0.0.0/8 Company other 5060 hatuiks \N \N RADIUS Client 2 10.3.120.100 TestSIP04 other 5060 hatuiks04 \N \N RADIUS Client Please advise and share any supported document related to above case as I'm newbie in Freeradius. Date: Fri, 24 Feb 2017 09:54:53 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Accounting on 2 tables > Message-ID: <3653CA7E-31CF-4044-98AD-68E8DC0205CF(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 24, 2017, at 9:44 AM, Ahmed Munir <ahmedmunir007(a)gmail.com> wrote: > > > > I would like to know is it possible to setup more than 1 tables for > > accounting? As by default radacct table is used. > > Yes. > > You will need to set up two instances of the SQL module, and then edit > the queries as necessary. > > > The reason I'm asking as need to setup accounting on different tables for > > Asterisk and OpenSIPs. > > > > Please advise and share the supported document. > > I would suggest taking the time to look at the wiki. This is documented > (see rlm_sql in the wiki). All it takes is for you to look. > > Alan DeKok. > -- Regards, Ahmed Munir Chohan

2 1

RADZAP - Empty Location
by Aurélio de Souza Ribeiro Neto 02 Mar '17

02 Mar '17

Dear Alan or Everyone, I had a problem in my checkrad, and some users are in radwho with an "Empty Location", like this example: Login Name What TTY When From Location eudantasal eudantasalves PPP >999 Tue 12:53 172.20.43.2 eudantasal eudantasalves PPP >999 Tue 13:16 172.20.43.2 187.120.XXX.XXX eudantasal eudantasalves PPP >999 Wed 13:30 172.20.43.2 187.120.XXX.XXX So, if I try to radzap "eudantasalves" I got an error: radclient:: failed to get value radclient: Nothing to send. Running "radwho -r -i" for this user, I have: eudantasalves,8180329f,PPP,S15741799,Tue 12:53,172.20.43.2, eudantasalves,81805b36,PPP,S15752644,Tue 13:16,172.20.43.2,187.120.XXX.XXX eudantasalves,81807c32,PPP,S15761221,Wed 13:35,172.20.43.2,187.120.XXX.XXX How can I zap this user? Thanks Aurélio

2 3

freeradius 3.1 sqlcounter[41]: Attribute Daily-Session-Time already defined with different flags
by mpajarin plexus 01 Mar '17

01 Mar '17

Im running freeradius 3.1.0 version, on Centos and on debug -X get an error like this: # Loaded module "rlm_sqlcounter" # Loading module "dailycounter" from file /etc/raddb/mods-enabled/ sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{&User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" } /etc/raddb/mods-enabled/sqlcounter[41]: Failed defining counter attribute: Attribute Daily-Session-Time already defined with different flags /etc/raddb/mods-enabled/sqlcounter[41]: Instantiation failed for module "dailycounter" Really i dont have any modification on the default config: radiusd -X -d /etc/raddb FreeRADIUS Version 3.1.0 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/freeradius/share/freeradius/dictionary including dictionary file /usr/local/freeradius/share/ freeradius/dictionary.dhcp including dictionary file /usr/local/freeradius/share/ freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/driver/mysql including configuration file /etc/raddb/mods-config/sql/ main/mysql/queries.conf including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/eap_inner including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/sqlcounter including configuration file /etc/raddb/mods-config/sql/ counter/mysql/dailycounter.conf including configuration file /etc/raddb/mods-config/sql/ counter/mysql/monthlycounter.conf including configuration file /etc/raddb/mods-config/sql/ counter/mysql/noresetcounter.conf including configuration file /etc/raddb/mods-config/sql/ counter/mysql/expire_on_login.conf including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/echo including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/vendor including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/debug including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local/freeradius" localstatedir = "/usr/local/freeradius/var" logdir = "/usr/local/freeradius/var/log/radius" run_dir = "/usr/local/freeradius/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local/freeradius" localstatedir = "/usr/local/freeradius/var" sbindir = "/usr/local/freeradius/sbin" logdir = "/usr/local/freeradius/var/log/radius" run_dir = "/usr/local/freeradius/var/run/radiusd" libdir = "/usr/local/freeradius/lib" radacctdir = "/usr/local/freeradius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 continuation_timeout = 15 max_requests = 16384 pidfile = "/usr/local/freeradius/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/freeradius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dynamic = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 queue_priority = "default" auto_limit_acct = no } listen { type = "auth" ipaddr = * port = 0 recv_buff = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 recv_buff = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 recv_buff = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 recv_buff = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = eap # Creating Auth-Type = digest listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 recv_buff = 0 } radiusd: #### Loading modules #### modules { # Loaded module "rlm_replicate" # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module "rlm_sql" # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" group_attribute = "sql-sql-Group" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql-sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql-sql-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCD EFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" query = "UPDATE radacct SET acctstarttime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), connectinfo_start = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '%{Connect-Info}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets= '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql) - Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute sql-sql-Group # Loaded module "rlm_expr" # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCD EFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇ ÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module "rlm_logintime" # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module "rlm_eap" # Loading module "inner-eap" from file /etc/raddb/mods-enabled/eap_inner eap inner-eap { default_eap_type = "mschapv2" ignore_unknown_eap_types = no cisco_accounting_username_bug = no } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } rlm_eap (inner-eap) - Ignoring EAP method tls because we don't have OpenSSL support # Loaded module "rlm_exec" # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module "rlm_pap" # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module "rlm_sqlcounter" # Loading module "dailycounter" from file /etc/raddb/mods-enabled/ sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{&User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" } /etc/raddb/mods-enabled/sqlcounter[41]: Failed defining counter attribute: Attribute Daily-Session-Time already defined with different flags /etc/raddb/mods-enabled/sqlcounter[41]: Instantiation failed for module "dailycounter" Some idea? Thanks

2 1

sending Filter-Id to another accounting server - need help
by Eby Mani 01 Mar '17

01 Mar '17

Hi, How do i configure freeradius to send user based Filter-Id to an accounting server?. Each user will have different Filter-Id value, users without any Filter-Id string will be denied access on the another NAS(listen only). I have the following in post-auth section of sites-enabled/default update reply { Filter-Id = "%{sql:SELECT `value` FROM `radreply` WHERE `username`='%{User-Name}';} } Freeradius is sending Filter-Id back to the user connected NAS, but not to the accounting server(another NAS, listen only). To which section should i add the update reply{} section in copy-acct-to-home-server file ? or is there a special command to include Filter-Id ?. Thanks, Eby

2 1

MD5 Auth Failure With Local User
by Martin, Jeremy 26 Feb '17

26 Feb '17

Hello, I am currently freeradius as a potential server and in doing so I am attempting to authenticate some devices using 802.1x that only support md5. From what I can tell this should be one of the most simplest tasks using freereadius but have as of yet have been successful in doing so. The setup could not be much simpler, there is a user in the users file and a client in the client configuration file. The request hits the server but is being rejected and from the debug output I am unable to determine why. I have reviewed most of the postings on the list serve and read just about all of the documents on the wiki and other sites and everything, unless I am missing something, is configured as documented. I am including the debug output and my users, if someone could please point me in the right direction I would be greatly appreciative. The version is 2.2.8 is a fresh and clean install from a debian 16.xx version that I just installed for this test, the only files modified are the users and clients files as the rest of the configuration files seem to indicate that eap with md5 is enabled and configured. Jeremy A009ED03287E Cleartext-Password := "1123481321" Service-Type = Framed-User, Framed-Protocol = PPP, Service-Type = Framed-User, Tunnel-Medium-Type = 6, Tunnel-Type = VLAN, Tunnel-Private-Group-ID = "U:140" Debug output freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.40.10.215 { require_message_authenticator = no secret = "supersecret" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 45349 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.40.10.215 port 1362, id=119, length=140 User-Name = "A009ED03287E" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 10.40.10.215 NAS-Port-Type = Ethernet NAS-Port = 21 NAS-Port-Id = "1/1/21" NAS-Identifier = "MH-SW-CLW1" Calling-Station-Id = "A0-09-ED-03-28-7E" EAP-Message = 0x0201001101413030394544303332383745 Message-Authenticator = 0x525aed178402b6b2751f095ee64ab3ae # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "A009ED03287E", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry A009ED03287E at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 119 to 10.40.10.215 port 1362 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "U:140" EAP-Message = 0x01020016041015bc1390ad75a179fb619b942c7243e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x83b7aef283b5aacb6f9cfdec6ddd3f8e Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.40.10.215 port 1362, id=120, length=163 User-Name = "A009ED03287E" Service-Type = Framed-User Framed-MTU = 1500 NAS-IP-Address = 10.40.10.215 NAS-Port-Type = Ethernet NAS-Port = 21 NAS-Port-Id = "1/1/21" NAS-Identifier = "MH-SW-CLW1" Calling-Station-Id = "A0-09-ED-03-28-7E" State = 0x83b7aef283b5aacb6f9cfdec6ddd3f8e EAP-Message = 0x02020016041027406b254adbbe1a933b9f0a3eb249f4 Message-Authenticator = 0xe787e7ed108939823a95e2b5d8e3db55 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "A009ED03287E", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry A009ED03287E at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] = reject +} # group authenticate = reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [eap] Reply already contained an EAP-Message, not inserting EAP-Failure ++[eap] = noop [attr_filter.access_reject] expand: %{User-Name} -> A009ED03287E attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 120 to 10.40.10.215 port 1362 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 119 with timestamp +16 Waking up in 1.0 seconds. Cleaning up request 1 ID 120 with timestamp +16 Ready to process requests.

2 1

Accounting on 2 tables
by Ahmed Munir 24 Feb '17

24 Feb '17

Hi, I would like to know is it possible to setup more than 1 tables for accounting? As by default radacct table is used. The reason I'm asking as need to setup accounting on different tables for Asterisk and OpenSIPs. Please advise and share the supported document. -- Regards, Ahmed Munir Chohan

2 1

Using radtest on port 1645
by Brett Glasson 23 Feb '17

23 Feb '17

Hi all I have a question regarding freeradius (specifically radtest) which I'm hoping somebody can shed some light on. I have configured a new radius server to replace one of our ancient legacy production systems which is currently running: FreeRADIUS Version 1.1.7, for host i386-portbld-freebsd6.2, built on Dec 2 2008 at 00:30:57. Considering the age of this system it will not be a surprise to learn that radiusd is currently listening on port 1645. I wish to replicate that behaviour on the replacement server. Consequently I have built a replacement like so: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Sep 22 2015 at 15:27:25 When I configure the server using the default port 1812 everything works fine when testing via radtest (on a remote host): # radtest test testpass 1.2.3.4 1812 testing123 Sending Access-Request of id 95 to 1.2.3.4 port 1812 User-Name = "test" User-Password = "testpass" NAS-IP-Address = 2.3.4.5 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 1.2.3.4 port 1812, id=95, length=20 However, I do have a problem when trying to TEST authenticate when the server is using port 1645 using radtest on any system that is not ancient. I have tried radtest using port 1645 from the following systems; CentOS 6 - FAIL Ubuntu 16.04 - FAIL FreeBSD 10 - FAIL FreeBSD 6 - OK So radtest works on port 1645 from the vintage FreeBSD 6 machine but from all the other, newer systems I get the same result: radtest test testpass 1.2.3.9.4 1645 testing123 Sending Access-Request of id 160 to 1.2.3.4 port 1812 User-Name = "test" User-Password = "testpass" NAS-IP-Address = 2.3.4.5 NAS-Port = 1645 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 1.2.3.4 port 1812, id=160, length=20 Note the part where radtest has ignored the provided port 1645 and has gone ahead and used 1812 anyway, although the NAS-Port is (correctly shown as being 1645 later on. In fact if I revert the radius server back to port 1812 and issue the same radtest command (using port 1645) it still works, even though the server is on port 1812. (The FreeBSD 6 machine fails as expected) Then, while looking about on google I noticed various radtest examples which use 0, or 10 for the port, some of which explicitly state that it doesn't actually matter what you put in that "port" field at all. So I tried putting random numbers in and indeed it worked when the server is on port 1812 no matter what port number I provided. This would appear to be a bug in radtest that has been around for quite some time (because CentOS 6 is hardly a spring chicken either) Either that or support for user provided ports has been removed from radtest altogether but I can't find any release notes online or any other references that suggest this. I was going to submit a bug report but the "Report a bug" link to http://bugs.freeradius.org/ as displayed on the freeradius download site appears to be broken. Also, I am not 100% sure that it is a bug anyway. If the ability to choose a port other than 1812 has been removed from radtest then it would be kind of nice if that was documented somewhere that is easy to find. It's not a showstopper for me but it would be nice to understand what is going on anyway. Anyway, if you have gotten this far then thanks for reading. Cheers Brett

3 4

Active Directory and Calling-Station-Id
by Ethariel 23 Feb '17

23 Feb '17

Thks a lot. I indeed think I don't really get the difference between := and ==. I've read several examples and doc but not so sure. I think the last entry (with the reject) is what is missing in my conf to prevent AD authentication when the CLI is not correct. I'll try asap and let you know. I can't access the site for a few days, but I'll return here with the conclusions.

2 2