- Freeradius-Users - lists.freeradius.org

Using multiple databases on the same freeRadius instance
by Gabriel Marais 15 Feb '17

15 Feb '17

Hi Guys, I am wondering if there are any way to use two different databases within the same freeRadius instance? Currently, I am using the default MySQL schema for AAA. I am inserting additional attributes in the pre-proxy configuration of my site. The attribute information comes from the same database. This works perfectly. I now have a site where I need to do the same but the additional attribute information needs to come from a different database (existing database on the client side), other than the AAA database. Is there a way to do this? Regards Gabriel

4 10

Active directory integration and grant access base on AD group membership
by Luc Paulin 15 Feb '17

15 Feb '17

Hi, I am trying to setup a radius server on centos6.8. I succeeded to setup the active directory integration by following the guide at http://wiki.freeradius.org/guide/freeradius-active-directory-integration-ho… . So I can get my user authentificate through the active directory. Now I would like grant system access base on group membership from active directory. How can this be done. I have tried by configuring the users and huntgroup files, but look like it grant access to everyone if username/password is good. -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

3 6

v3.0.11 Radmin problem
by LABAT, Xavier 15 Feb '17

15 Feb '17

Hi, I have some problems with radmin since version 3.0.10 (the first version in 3.0 tried) that I don't encountered in previous versions (2.1.6 and 2.2.6) . The main problem is when I try to launch the tool. The command < radmin > work correctly at first start but then I have to add options to start again as below : [proxyRadius /usr/local/etc/raddb]# radmin radmin version 3.0.11, built on Mar 31 2016 at 10:41:17 - FreeRADIUS Server administration tool. ... radmin> [proxyRadius/usr/local/etc/raddb]# radmin radmin: Error in socket: Broken pipe [proxyRadius/usr/local/etc/raddb]# radmin radmin: Error in socket: No such file or directory [proxyRadius/usr/local/etc/raddb]# ls /usr/local/var/run/radiusd/ radiusd.pid radiusd.sock [proxyRadius/usr/local/etc/raddb]# radmin -d /usr/local/etc/raddb/ radmin: Error in socket: No such file or directory [proxyRadius/usr/local/etc/raddb]# radmin -n radiusd radmin: Error in socket: No such file or directory [proxyRadius/usr/local/etc/raddb]# radmin -f /usr/local/var/run/radiusd/radiusd.sock radmin version 3.0.11, built on Mar 31 2016 at 10:41:17 - FreeRADIUS Server administration tool. ... radmin> [proxyRadius/usr/local/etc/raddb]# radmin radmin: Error in socket: No such file or directory The second problem is when I use a condition in Radmin. Previously we set a condition in order to capture only requests based on it, but since version 3.0.10, radmin log all requests received by server. I can see a < & > before the condition that I didn't have with previous versions : radmin> debug condition User-Name == "toto@foo" radmin> show debug condition &User-Name == "toto@foo" Can anyone tell me if it's better with version 3.0.12 or if there is a problem with my utilisation of the tool ? Here the configuration of my solution : radiusd.conf ... localstatedir = /usr/local/var name = radiusd run_dir = ${localstatedir}/run/${name} ... sites-enabled/control-socket listen { type = control socket = ${run_dir}/${name}.sock mode = rw } Thanks you. Regards. Xavier LABAT STN2 Axione -- Les donnees et renseignements contenus dans ce message sont personnels, confidentiels et secrets. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee. Si vous n'etes pas le bon destinataire, nous vous demandons de ne pas lire, copier, utiliser ou divulguer cette communication. Nous vous prions de notifier cette erreur a l'expediteur et d'effacer immediatement cette communication de votre systeme. Any data and information contained in this electronic mail is personal, confidential and secret. Any total or partial publication, use or distribution must be authorized. If you are not the right addressee, we ask you not to read, copy, use or disclose this communication. Please notify this error to the sender and erase at once this communication from your system.

3 12

Problems with eap certificate and MacOS
by Marco Scholl 15 Feb '17

15 Feb '17

Hi, i have a problem EAP. I have a root ca for our company with an intermediate ca. Now i have generate an certificate for the radius server with EAP OIDs (1.3.6.1.5.5.7.3.13, 1.3.6.1.5.5.7.3.14) Then i have installed our root ca as trusted for all type (eap, smime, webserver ....). When i now connect by wlan or cable to the freeradius, i got an server certificate error. But when i open the dialog for confirmation, i see our root ca als trusted, i see the intermediate as trustend and i see the radius certificate as trust! every connect i must accept the certificate for new. anybody an idea? when i use an normal webserver certificate from a public ca the problem not exists, after i confirm the certificate on first try. greets marco

4 4

Removing unused SQL drivers
by Arran Cudbard-Bell 15 Feb '17

15 Feb '17

We’re starting to investigate moving rlm_sql to the new async I/O model. The main benefits being: - Significant increase in TPS where DB benefits from increased parallelism, or RTT to the database is high. - FreeRADIUS no longer appears to “hang” when databases go away (it doesn’t actually hang, but all the worker threads get tied up until they time out). - In the hanging (not hanging) scenario, we can drain the incoming packet queue to detail files without “hiccups” (where the inbound packet queue fills) waiting for stale connections to close or queries to time out. Ongoing discussion on GitHub is here: https://github.com/FreeRADIUS/freeradius-server/issues/1913 Questions for users are: - Does anyone still use DB2? It’s virtually undocumented and it’s not clear if it has an async interface. - Does anyone still use Firebird? Is there any disadvantage in using it via ODBC. - Is there still value in maintaining IODBC compatibility? It seems to lack many features of UnixODBC. Previously IODBC was included in OSX Lion, so it was useful to keep around. It’s since been removed however, and UnixODBC can be installed with hombrew. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Unresponsive server when debugging
by Lucas Diaz 14 Feb '17

14 Feb '17

I'm running a 3.0.11 server with Firebird as the backend database. It works very well. I have an issue though when debugging (output to STDOUT): if an authentication query hangs or becomes very slow to respond, during that period of time, the server becomes unresponsive and it can be seen on the log of the nases "Radius server is not responding". Until this happens, it works just fine. If I launch the server without debug, it authorizes all users super fast (except the ones that are very slow), but it don't "hang" the server. It's like in debug mode threads are not used. Is that right? Thanks.

3 3

Multiple shared secret per IP?
by Chris Taylor (chtaylo2) 13 Feb '17

13 Feb '17

On FreeRadius v.3.0.12. I have a requirement where I need to send test authentications to the F.R. server, which are then proxy’ed. i.e: user: monitor source IP: 64.0.0.1 secret: MonitorAgent ^ - That’s easy. To complicate, I need to also authenticate real users from the same source server, using a different shared secret. (anyone can view the one above, so not secure) Ideally, I’d like to also lockdown the above secret key, to the single user. i.e: user: userA, etc, etc source IP: 64.0.0.1 secret: SD%^GHJ Is it possible to have multiple secret strings per IP or maybe different domains per IP? If not, any recommendations? Thanks!!

4 4

3.0.12 ignoring HUP (No files changed), albeit changes in passwd-file?
by macservo 13 Feb '17

13 Feb '17

Hello, I´m running 3.0.12 and use the passwd-module of 3.0.13 (because of "notfound") After changes in the passwd-file, the server receives a HUP. This worked in 2.0.2 3.0.12 will give me > Info: HUP - No files changed. Ignoring I can confirm, that the passwd-file has changed, since the server has started. What am I doing wrong? (Found some entries in the mailing list, that this was a problem in older versions but should have been fixed since 3.0.10?) Is it better to change to 3.0.13 completely? Is it stable? Thank you very much.

3 2

rlm_rest with Freeradius
by Thomas Massip 13 Feb '17

13 Feb '17

Hi all, I actually use FreeRADIUS Version 3.0.13 with PacketFence and I have an issue when i try the rlm_rest. If somoene Know why i have this issue : rest: ERROR: Server returned: (0) rest: ERROR: {"Reply-Message":"PacketFence does not support this switch for read/write access login","reply:PacketFence-Authorization-Status":"allow"} This is my output radius -x : 0) Received Access-Request Id 10 from 192.168.10.14:1812 to 192.168.10.22:1812 length 122 (0) User-Name = "UserTest" (0) User-Password = "p@55word" (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) NAS-Identifier = "las1.albari" (0) NAS-Port-Type = Ethernet (0) Acct-Session-Id = "las1.al00000000000000da6bb650001055" (0) NAS-IP-Address = 192.168.10.14 (0) # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence (0) authorize { (0) update { (0) EXPAND %{Packet-Src-IP-Address} (0) --> 192.168.10.14 (0) &request:FreeRADIUS-Client-IP-Address := 192.168.10.14 (0) &control:PacketFence-RPC-Server = 127.0.0.1 (0) &control:PacketFence-RPC-Port = 7070 (0) &control:PacketFence-RPC-User = (0) &control:PacketFence-RPC-Pass = (0) &control:PacketFence-RPC-Proto = http (0) EXPAND %l (0) --> 1486992205 (0) &control:Tmp-Integer-0 := 1486992205 (0) &control:PacketFence-Request-Time := 0 (0) } # update = noop (0) policy rewrite_calling_station_id { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy rewrite_calling_station_id = noop (0) policy rewrite_called_station_id { (0) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) { (0) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy rewrite_called_station_id = noop (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = noop (0) } # policy filter_username = noop (0) policy filter_password { (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) EXPAND %{string:User-Password} (0) --> p@55word (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (0) } # policy filter_password = noop (0) [preprocess] = ok (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "UserTest", skipping NULL due to config. (0) [suffix] = noop (0) ntdomain: Checking for prefix before "\" (0) ntdomain: No '\' in User-Name = "UserTest", looking up realm NULL (0) ntdomain: Found realm "null" (0) ntdomain: Adding Stripped-User-Name = "UserTest" (0) ntdomain: Adding Realm = "null" (0) ntdomain: Authentication realm is LOCAL (0) [ntdomain] = ok (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) if ( !EAP-Message ) { (0) if ( !EAP-Message ) -> TRUE (0) if ( !EAP-Message ) { (0) update { (0) &control:Auth-Type := Accept (0) } # update = noop (0) } # if ( !EAP-Message ) = noop (0) policy packetfence-eap-mac-policy { (0) if ( &EAP-Type ) { (0) if ( &EAP-Type ) -> FALSE (0) [noop] = noop (0) } # policy packetfence-eap-mac-policy = noop (0) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) pap: WARNING: !!! Ignoring control:User-Password. Update your !!! (0) pap: WARNING: !!! configuration so that the "known good" clear text !!! (0) pap: WARNING: !!! password is in Cleartext-Password and NOT in !!! (0) pap: WARNING: !!! User-Password. !!! (0) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /usr/local/pf/raddb/sites-enabled/packetfence (0) post-auth { (0) update { (0) EXPAND %{Packet-Src-IP-Address} (0) --> 192.168.10.14 (0) &request:FreeRADIUS-Client-IP-Address := 192.168.10.14 (0) &control:PacketFence-RPC-Server = 127.0.0.1 (0) &control:PacketFence-RPC-Port = 7070 (0) &control:PacketFence-RPC-User = (0) &control:PacketFence-RPC-Pass = (0) &control:PacketFence-RPC-Proto = http (0) } # update = noop (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) -> TRUE (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { rlm_rest (rest): Closing connection (0): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): Closing connection (1): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): Closing connection (2): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (3): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (4): Hit idle_timeout, was idle for 282 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): 0 of 0 connections in use. You may need to increase "spare" rlm_rest (rest): Opening additional connection (5), 1 of 64 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:7070/" rlm_rest (rest): Reserved connection (5) (0) rest: Expanding URI components (0) rest: EXPAND http://127.0.0.1:7070 (0) rest: --> http://127.0.0.1:7070 (0) rest: EXPAND //radius/rest/authorize (0) rest: --> //radius/rest/authorize (0) rest: Sending HTTP POST to "http://127.0.0.1:7070//radius/rest/authorize" (0) rest: Encoding attribute "User-Name" (0) rest: Encoding attribute "User-Password" (0) rest: Encoding attribute "NAS-IP-Address" (0) rest: Encoding attribute "Service-Type" (0) rest: Encoding attribute "Framed-Protocol" (0) rest: Encoding attribute "NAS-Identifier" (0) rest: Encoding attribute "NAS-Port-Type" (0) rest: Encoding attribute "Acct-Session-Id" (0) rest: Encoding attribute "Event-Timestamp" (0) rest: Encoding attribute "Stripped-User-Name" (0) rest: Encoding attribute "Realm" (0) rest: Encoding attribute "FreeRADIUS-Client-IP-Address" (0) rest: Processing response header (0) rest: Status : 401 (Unauthorized) (0) rest: Type : json (application/json) (0) rest: ERROR: Server returned: (0) rest: ERROR: {"Reply-Message":"PacketFence does not support this switch for read/write access login","reply:PacketFence-Authorization-Status":"allow"} rlm_rest (rest): Released connection (5) rlm_rest (rest): Need 2 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (6), 1 of 63 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:7070/" (0) [rest] = invalid (0) } # if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) = invalid (0) } # post-auth = invalid (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence (0) Post-Auth-Type REJECT { (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) -> TRUE (0) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { (0) policy packetfence-audit-log-reject { (0) if (&User-Name != "dummy") { (0) if (&User-Name != "dummy") -> TRUE (0) if (&User-Name != "dummy") { (0) policy request-timing { (0) if (control:PacketFence-Request-Time != 0) { (0) if (control:PacketFence-Request-Time != 0) -> FALSE (0) } # policy request-timing = noop (0) sql_reject: EXPAND type.reject.query (0) sql_reject: --> type.reject.query (0) sql_reject: Using query template 'query' rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 282 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 282 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 282 seconds rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (4): Hit idle_timeout, was idle for 282 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (0): Hit idle_timeout, was idle for 282 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 282 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (6), 1 of 64 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'pf' on Localhost via UNIX socket, server version 5.5.52-MariaDB, protocol version 10 rlm_sql (sql): Reserved connection (6) (0) sql_reject: EXPAND %{User-Name} (0) sql_reject: --> UserTest (0) sql_reject: SQL-User-Name set to 'UserTest' (0) sql_reject: EXPAND INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '%{request:Calling-Station-Id}', '%{request:Framed-IP-Address}', '%{%{control:PacketFence-Computer-Name}:-N/A}', '%{request:User-Name}', '%{request:Stripped-User-Name}', '%{request:Realm}', 'Radius-Access-Request', '%{%{control:PacketFence-Switch-Id}:-N/A}', '%{%{control:PacketFence-Switch-Mac}:-N/A}', '%{%{control:PacketFence-Switch-Ip-Address}:-N/A}', '%{Packet-Src-IP-Address}', '%{request:Called-Station-Id}', '%{request:Calling-Station-Id}', '%{request:NAS-Port-Type}', '%{request:Called-Station-SSID}', '%{request:NAS-Port-Id}', '%{%{control:PacketFence-IfIndex}:-N/A}', '%{request:NAS-Port}', '%{%{control:PacketFence-Connection-Type}:-N/A}', '%{request:NAS-IP-Address}', '%{request:NAS-Identifier}', 'Reject', '%{request:Module-Failure-Message}', '%{control:Auth-Type}', '%{request:EAP-Type}', '%{%{control:PacketFence-Role}:-N/A}', '%{%{control:PacketFence-Status}:-N/A}', '%{%{control:PacketFence-Profile}:-N/A}', '%{%{control:PacketFence-Source}:-N/A}', '%{%{control:PacketFence-AutoReg}:-N/A}', '%{%{control:PacketFence-IsPhone}:-N/A}', '%{request:PacketFence-Domain}', '', '%{pairs:&request:[*]}','%{pairs:&reply:[*]}', '%{%{control:PacketFence-Request-Time}:-N/A}') (0) sql_reject: --> INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '', '', 'N/A', 'UserTest', 'UserTest', 'null', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '192.168.10.14', '', '', 'Ethernet', '', '', 'N/A', '', 'N/A', '192.168.10.14', 'las1.albari', 'Reject', 'rest: Server returned:', 'Accept', '', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', '', '', 'User-Name =3D =22UserTest=22=2C User-Password =3D =22p@55word=22=2C NAS-IP-Address =3D 192.168.10.14=2C Service-Type =3D Framed-User=2C Framed-Protocol =3D PPP=2C NAS-Identifier =3D =22las1.albari=22=2C NAS-Port-Type =3D Ethernet=2C Acct-Session-Id =3D =22las1.al00000000000000da6bb650001055=22=2C Event-Timestamp =3D =22févr. 13 2017 14:23:25 CET=22=2C Stripped-User-Name =3D =22UserTest=22=2C Realm =3D =22null=22=2C FreeRADIUS-Client-IP-Address =3D 192.168.10.14=2C Module-Failure-Message =3D =22rest: Server returned:=22=2C Module-Failure-Message =3D =22rest: =7B=5C=22Reply-Message=5C=22:=5C=22PacketFence does not support this switch for read/write access login=5C=22=2C=5C=22reply:PacketFence-Authorization-Status=5C=22:=5C=22allow=5C=22=7D=22=2C SQL-User-Name =3D =22UserTest=22','', '0') (0) sql_reject: Executing query: INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '', '', 'N/A', 'UserTest', 'UserTest', 'null', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '192.168.10.14', '', '', 'Ethernet', '', '', 'N/A', '', 'N/A', '192.168.10.14', 'las1.albari', 'Reject', 'rest: Server returned:', 'Accept', '', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', '', '', 'User-Name =3D =22UserTest=22=2C User-Password =3D =22p@55word=22=2C NAS-IP-Address =3D 192.168.10.14=2C Service-Type =3D Framed-User=2C Framed-Protocol =3D PPP=2C NAS-Identifier =3D =22las1.albari=22=2C NAS-Port-Type =3D Ethernet=2C Acct-Session-Id =3D =22las1.al00000000000000da6bb650001055=22=2C Event-Timestamp =3D =22févr. 13 2017 14:23:25 CET=22=2C Stripped-User-Name =3D =22UserTest=22=2C Realm =3D =22null=22=2C FreeRADIUS-Client-IP-Address =3D 192.168.10.14=2C Module-Failure-Message =3D =22rest: Server returned:=22=2C Module-Failure-Message =3D =22rest: =7B=5C=22Reply-Message=5C=22:=5C=22PacketFence does not support this switch for read/write access login=5C=22=2C=5C=22reply:PacketFence-Authorization-Status=5C=22:=5C=22allow=5C=22=7D=22=2C SQL-User-Name =3D =22UserTest=22','', '0') (0) sql_reject: SQL query returned: success (0) sql_reject: 1 record(s) updated rlm_sql (sql): Released connection (6) rlm_sql (sql): Need 2 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 63 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'pf' on Localhost via UNIX socket, server version 5.5.52-MariaDB, protocol version 10 (0) [sql_reject] = ok (0) } # if (&User-Name != "dummy") = ok (0) } # policy packetfence-audit-log-reject = ok (0) } # if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> UserTest (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) attr_filter.packetfence_post_auth: EXPAND %{User-Name} (0) attr_filter.packetfence_post_auth: --> UserTest (0) attr_filter.packetfence_post_auth: Matched entry DEFAULT at line 10 (0) [attr_filter.packetfence_post_auth] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (0) linelog: --> messages.Access-Accept (0) linelog: EXPAND %t : [mac:%{Calling-Station-Id}] Accepted user: %{reply:User-Name} and returned VLAN %{reply:Tunnel-Private-Group-ID} (0) linelog: --> Mon Feb 13 14:23:25 2017 : [mac:] Accepted user: and returned VLAN (0) linelog: EXPAND /usr/local/pf/logs/radius.log (0) linelog: --> /usr/local/pf/logs/radius.log (0) [linelog] = ok (0) } # Post-Auth-Type REJECT = updated (0) Rejected in post-auth: [UserTest] (from client 192.168.10.0/24 port 0) (0) Delaying response for 1.000000 seconds Waking up in 0.1 seconds. Waking up in 0.8 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 10 from 192.168.10.22:1812 to 192.168.10.14:1812 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 10 with timestamp +282 Ready to process requests Thanks for ur help Best regards

2 2

passwd and unlang
by macservo 13 Feb '17

13 Feb '17

Am I missing something here or have there been changes to the behavior of passwd and unlang since 2.0.2? If you could please have a look at the configuration (migrated from 2.0.2, where it was working) and output below. The username for the request is Mac284-1. This username is NOT in the passwd-file, which explains the "Failed retrieving values required to evaluate condition" part. But then why is notfound -> FALSE? Should´nt notfound be true and the request thus be rejected? /etc/raddb/sites-enabled/default: authorize { ... maclist if (notfound) { reject } if ( mac-add !~ /%{Calling-Station-ID}/i) { reject } ... } /etc/raddb/mods-available/passwd: passwd maclist { filename = /etc/raddb/maclist format = "*User-Name:~mac-add" } /etc/raddb/maclist: Macxxx:00236C94ED49 And the output: Fri Feb 10 19:10:31 2017 : Debug: (5) suffix: No '@' in User-Name = "Mac284-1", looking up realm NULL Fri Feb 10 19:10:31 2017 : Debug: (5) suffix: No such realm "NULL" Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from suffix (rlm_realm) Fri Feb 10 19:10:31 2017 : Debug: (5) [suffix] = noop Fri Feb 10 19:10:31 2017 : Debug: (5) if (Called-Station-ID =~ /:test$/) { Fri Feb 10 19:10:31 2017 : Debug: No matches Fri Feb 10 19:10:31 2017 : Debug: Adding 1 matches Fri Feb 10 19:10:31 2017 : Debug: (5) if (Called-Station-ID =~ /:test$/) -> TRUE Fri Feb 10 19:10:31 2017 : Debug: (5) if (Called-Station-ID =~ /:test$/) { Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: calling eap (rlm_eap) Fri Feb 10 19:10:31 2017 : Debug: (5) eap: Peer sent EAP Response (code 2) ID 6 length 1276 Fri Feb 10 19:10:31 2017 : Debug: (5) eap: No EAP Start, assuming it's an on-going EAP conversation Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from eap (rlm_eap) Fri Feb 10 19:10:31 2017 : Debug: (5) [eap] = updated Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: calling files (rlm_files) Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from files (rlm_files) Fri Feb 10 19:10:31 2017 : Debug: (5) [files] = noop Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: calling maclist (rlm_passwd) Fri Feb 10 19:10:31 2017 : Debug: (5) modsingle[authorize]: returned from maclist (rlm_passwd) Fri Feb 10 19:10:31 2017 : Debug: (5) [maclist] = ok Fri Feb 10 19:10:31 2017 : Debug: (5) if (notfound) { Fri Feb 10 19:10:31 2017 : Debug: (5) if (notfound) -> FALSE Fri Feb 10 19:10:31 2017 : Debug: (5) if ( mac-add !~ /%{Calling-Station-ID}/i) { Fri Feb 10 19:10:31 2017 : ERROR: (5) Failed retrieving values required to evaluate condition

2 3