- Freeradius-Users - lists.freeradius.org

Session-Timeout Problem
by Selahattin Cilek 02 Feb '17

02 Feb '17

I'll try to keep this as simple as I can. I am using FreeRADIUS 2.2.8. When I set the "Session-Timeout := 600" for a user, the NAS is supposed to renew the session every 10 minutes. My Unifi AP recognises the attribute and actually DOES terminate the first session when it times out after 10 minutes. The problem is that it terminates only the first session, the second session lasts until the NAS reboots, the user logs out or shuts down the host. This means a user could exceed his quota if he keeps his wireless connection alive. There are some users that exceed their 7GB weekly quota by 6 GBs! Should I blame the AP firmware for this or is it a bug in FreeRADIUS 2.2.8? NB: I could send more detailed TCPDUMP and MySQL information for those who are interested. Thank you in advance. --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

5 7

Accouting of Freeradius DHCP
by Nataniel Klug 02 Feb '17

02 Feb '17

Hello, I've set up a Freeradius 3 as a Dynamic DHCP Server for my network and I am trying to make it work with accouting but I am not being able to understand where to set this up to right Accouting information on MySQL radacct. I've set this using DHCP sqlippool and no authorization, everyone who request an DHCP will be offered on from a default pool. Atenciosamente, *Nataniel Klug* | nataniel.klug(a)gmail.com

2 3

Read custom file in unlang
by Timo Buhrmester 02 Feb '17

02 Feb '17

Hi list, Apologies for the seemingly trivial question, but I can't seem to find an answer in the documentation: Is there a way to read the content of a text file in unlang, for the purpose of assigning it to a variable or using it in a conditional *without* having to shell out w/ backticks? Thanks, Timo Buhrmester

2 1

RE: Freeradius 3.0.12 problems - mysql pool connections
by Michal Tomaszewski 02 Feb '17

02 Feb '17

Hi Alan, As you can see the problem described below was not exactly - as you previously stated - caused by SQL library but somehow FR itself... I understand that your fixes solved the problem, e.g.: https://github.com/FreeRADIUS/freeradius-server/commit/8aaf545d6c011dd5d4a2… Unfortunately current build of freeradius 3.0.13 makes (in our server once a minute) segmentation fault after SQL INSERT command user@server:~$ sudo freeradius -Xx > log20170127b.txt Segmentation fault (core dumped) Last lines in log: ... Fri Jan 27 13:27:28 2017 : Debug: %{User-Name} Fri Jan 27 13:27:28 2017 : Debug: Parsed xlat tree: Fri Jan 27 13:27:28 2017 : Debug: attribute --> User-Name Fri Jan 27 13:27:28 2017 : Debug: (19) EXPAND %{User-Name} Fri Jan 27 13:27:28 2017 : Debug: (19) --> h274_free Fri Jan 27 13:27:28 2017 : Debug: (19) SQL-User-Name set to 'h274_free' Fri Jan 27 13:27:28 2017 : Debug: rlm_sql (sql): Reserved connection (2) Fri Jan 27 13:27:28 2017 : Debug: (19) Executing select query: INSERT INTO radius_radacct_active ( acctsessionid, acctuniqueid, username, hotspot_id, device_id, felogin_id, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress ) VALUES ('588b3ca500000003', '477164ffa8f0efb5af020028af87b6fc', 'user_user', 'hotspotid-2', 'deviceis-36', '4988732', '', '192.168.176.1', '00000003', 'Wireless-802.11', FROM_UNIXTIME(1485520048), FROM_UNIXTIME(1485520048 + 1800), '', '', '', '0' << 32 | '0', '0' << 32 | '0', 'calledid', 'A4-70-D6-82-4C-82', 'Login-User', '', '192.168.176.83') Regards, Mike > -----Original Message----- > From: Freeradius-Users [mailto:freeradius-users- > bounces+michal.tomaszewski=cca.pl(a)lists.freeradius.org] On Behalf Of > Michal Tomaszewski > Sent: Wednesday, December 28, 2016 3:54 PM > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius 3.0.12 problems - redis and mysql pool connections > > Alan, > Some more Information in the subject. > > > >> I don't see that ERROR as much of a problem. The server tried to > > >> use an > > old connection, it failed, and when the server tried another > > connection, that one failed, too. > > > Yes. But connection has expired and probably something in > > > connection's > > pool management can be improved. > > > > How? Make a concrete suggestion. Or send a patch. > > > > There is an ERROR in case the data is written to the MySQL correctly. > As I understand this is not an ERROR situation. > Error shall be thrown where there is no possibility to write data. > > > > Server is not down. Server is working perfectly all the time. Those > > messages are not because MySQL server is down. They are appearing in > > normal operation when server is 100% available. They are probably > > because idle_timeout closes the connection and freeradius does not > > record the fact that such connection does not exist. > > > > No. And why guess? The source is available to you. > > I've checked the source and deeply checked the problem. > The problem exists on Ubuntu 16.04 and MySQL client library 5.7 and newest > build of freeradius. > The same situation we can observe on our stage environment: freeradius > 3.12 on Ubuntu 14.04 and MySQL client library 5.5.46. > So suggested bug in the SQL library or its newer/older version seems to be > not a real cause of the problem. > > There is 'ERROR: SQL query failed: no connection' ONLY in case of INSERTs or > REPLACEs to Mysql database. > Error is thrown but each INSERT and REPLACE is SUCCESSFUL. > > We made a lot of tests and: > 1. EVERY (even simple) INSERT or REPLACE throws ERROR. MySQL is available > during query. Insert or replace is successful. > We made temporary table and tested inserts in accounting start/stop > section: > Tue Dec 27 14:42:02 2016 : Debug: (2) Executing select query: > INSERT INTO debug_log (`data`) VALUES ('AAAAAAA') > Tue Dec 27 14:42:02 2016 : ERROR: (2) SQL query failed: no connection > > 2. When you change insert query to select query - there are no errors. > > 3. Nor SELECT neither DELETE query throws error (to be sure we checked > deletes with 0 rows deleted and 1 row deleted). Only INSERT and REPLACE. > Each INSERT and each REPLACE. > > 3. There is also no error thrown when you change the insert query into: > "INSERT INTO debug_log (`data`) VALUES ('AAAAAAA'); SELECT 1;" > > > Examples: > > #1 real situation: > > Mon Nov 28 21:53:09 2016 : Debug: rlm_sql (sql): Reserved connection (10) > Mon Nov 28 21:53:09 2016 : Debug: (12) Executing select query: > INSERT INTO radius_radacct_closed ( > acctsessionid, acctuniqueid, username, additional_id, > device_id, realm, nasipaddress, > nasportid, nasporttype, acctstarttime, > acctupdatetime, acctstoptime, acctsessiontime, > acctauthentic, connectinfo_start, connectinfo_stop, > acctinputoctets, acctoutputoctets, calledstationid, > callingstationid, acctterminatecause, servicetype, > framedprotocol, framedipaddress ) > VALUES ('583c98d000000001', > '79ffcccafc3b54e87403444481bf65e5', 'z555', > '555', '2', '', > '192.168.176.1', '00000001', 'Wireless- > 802.11', FROM_UNIXTIME(1480366389 - 49), > FROM_UNIXTIME(1480366389), > FROM_UNIXTIME(1480366389), 49, '', > '', '', '0' << 32 | '413029', > '0' << 32 | '3533411', > 'z5-d2', '90-B0-ED-E6-AE-15', > 'User-Request', '', '', > '192.168.176.2') > Mon Nov 28 21:53:09 2016 : ERROR: (12) SQL query failed: no connection > -- > -- > -- > -- > Mon Nov 28 21:54:45 2016 : Debug: rlm_sql (sql): Reserved connection (13) > Mon Nov 28 21:54:45 2016 : Debug: (14) Executing select query: > INSERT INTO radius_radacct_active ( > acctsessionid, acctuniqueid, username, > additional_id, device_id, realm, > nasipaddress, nasportid, nasporttype, > acctstarttime, acctstoptime, acctauthentic, > connectinfo_start, connectinfo_stop, acctinputoctets, > acctoutputoctets, calledstationid, callingstationid, > servicetype, framedprotocol, framedipaddress > ) VALUES ('583c996300000001', > '3c96a44b069782db0d7076274139e521', 'z555', > '5555', '2', '', > '192.168.176.1', '00000001', 'Wireless- > 802.11', FROM_UNIXTIME(1480366485), > FROM_UNIXTIME(1480366485 + 2700), '', > '', '', '0' << 32 | '0', > '0' << 32 | '0', 'z5-d2', '90-B0-ED-E6- > AE-15', 'Login-User', '', > '192.168.176.2') > Mon Nov 28 21:54:45 2016 : ERROR: (14) SQL query failed: no connection > > > #2 > Test scenarios: > > Tue Dec 27 14:42:02 2016 : Debug: %{sql: INSERT INTO > debug_log (`data`) VALUES ('AAAAAAA') } > Tue Dec 27 14:42:02 2016 : Debug: Parsed xlat tree: > Tue Dec 27 14:42:02 2016 : Debug: xlat --> sql Tue Dec 27 14:42:02 2016 : > Debug: { > Tue Dec 27 14:42:02 2016 : Debug: literal --> INSERT INTO > debug_log (`data`) VALUES ('AAAAAAA') > Tue Dec 27 14:42:02 2016 : Debug: } > Tue Dec 27 14:42:02 2016 : Debug: %{User-Name} Tue Dec 27 14:42:02 2016 : > Debug: Parsed xlat tree: > Tue Dec 27 14:42:02 2016 : Debug: attribute --> User-Name > Tue Dec 27 14:42:02 2016 : Debug: (2) EXPAND %{User-Name} > Tue Dec 27 14:42:02 2016 : Debug: (2) --> z555 > Tue Dec 27 14:42:02 2016 : Debug: (2) SQL-User-Name set to 'z555' > Tue Dec 27 14:42:02 2016 : Debug: rlm_sql (sql): Reserved connection (1) > Tue Dec 27 14:42:02 2016 : Debug: (2) Executing select query: > INSERT INTO debug_log (`data`) VALUES ('AAAAAAA') > **************************Tue Dec 27 14:42:02 2016 : ERROR: (2) > SQL query failed: no connection > Tue Dec 27 14:42:02 2016 : Debug: rlm_sql (sql): Released connection (1) Tue > Dec 27 14:42:02 2016 : Info: Need 2 more connections to reach min > connections (5) Tue Dec 27 14:42:02 2016 : Info: rlm_sql (sql): Opening > additional connection (3), 1 of 29 pending slots used Tue Dec 27 14:42:02 2016 > : Debug: rlm_sql_mysql: Starting connect to MySQL server Tue Dec 27 > 14:42:02 2016 : Debug: rlm_sql_mysql: Connected to database 'Radius' on > 127.0.0.1 via TCP/IP, server version 5.6.34-79.1-56-log, protocol version 10 > Tue Dec 27 14:42:02 2016 : Debug: (2) EXPAND %{sql: INSERT > INTO debug_log (`data`) VALUES ('AAAAAAA') } > Tue Dec 27 14:42:02 2016 : Debug: (2) --> > > > Wed Dec 28 10:56:08 2016 : Debug: rlm_sql (sql): Reserved connection (0) > Wed Dec 28 10:56:08 2016 : Debug: (0) Executing select query: INSERT INTO > debug_log (data) VALUES > ('CCCCCCCCCCCCCCCCCCCCCCC') > **************************Wed Dec 28 10:56:08 2016 : ERROR: (0) > SQL query failed: no connection > -- > Wed Dec 28 10:56:08 2016 : Debug: Parsed xlat tree: > Wed Dec 28 10:56:08 2016 : Debug: attribute --> User-Name > Wed Dec 28 10:56:08 2016 : Debug: (0) EXPAND %{User-Name} > Wed Dec 28 10:56:08 2016 : Debug: (0) --> z555 > Wed Dec 28 10:56:08 2016 : Debug: (0) SQL-User-Name set to 'z555' > Wed Dec 28 10:56:08 2016 : Debug: rlm_sql (sql): Reserved connection (0) > Wed Dec 28 10:56:08 2016 : Debug: (0) Executing select query: INSERT INTO > debug_log (data) VALUES ('AAAAAAAAAAAAAAAAAAAA') > **************************Wed Dec 28 10:56:08 2016 : ERROR: (0) > SQL query failed: no connection > > > Wed Dec 28 11:11:15 2016 : Debug: literal --> INSERT INTO debug_log > (data) VALUES ('BBBBBBBBBBBBBBB');SELECT 1 > Wed Dec 28 11:11:15 2016 : Debug: (0) Executing select query: INSERT INTO > debug_log (data) VALUES ('BBBBBBBBBBBBBBB');SELECT 1 > Wed Dec 28 11:11:15 2016 : Debug: (0) EXPAND %{sql: INSERT INTO > debug_log (data) VALUES ('BBBBBBBBBBBBBBB');SELECT 1 > } > Wed Dec 28 11:13:15 2016 : Debug: %{sql: INSERT INTO debug_log > (data) VALUES ('CCCCCCCCCCCCCCCCCCCCCCC');SELECT 1 } > Wed Dec 28 11:13:15 2016 : Debug: literal --> INSERT INTO debug_log > (data) VALUES ('CCCCCCCCCCCCCCCCCCCCCCC');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: (1) Executing select query: INSERT INTO > debug_log (data) VALUES > ('CCCCCCCCCCCCCCCCCCCCCCC');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: (1) Executing select query: INSERT INTO > debug_log (data) VALUES > ('CCCCCCCCCCCCCCCCCCCCCCC');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: (1) EXPAND %{sql: INSERT INTO > debug_log (data) VALUES > ('CCCCCCCCCCCCCCCCCCCCCCC');SELECT 1 } > Wed Dec 28 11:13:15 2016 : Debug: %{sql: INSERT INTO debug_log (data) > VALUES ('FFFFFFFFFFF');SELECT 1} > Wed Dec 28 11:13:15 2016 : Debug: literal --> INSERT INTO debug_log > (data) VALUES ('FFFFFFFFFFF');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: (1) Executing select query: INSERT INTO > debug_log (data) VALUES ('FFFFFFFFFFF');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: (1) Executing select query: INSERT INTO > debug_log (data) VALUES ('FFFFFFFFFFF');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: (1) EXPAND %{sql: INSERT INTO > debug_log (data) VALUES ('FFFFFFFFFFF');SELECT 1} > Wed Dec 28 11:13:15 2016 : Debug: %{sql: INSERT INTO debug_log > (data) VALUES ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 } > Wed Dec 28 11:13:15 2016 : Debug: literal --> INSERT INTO debug_log > (data) VALUES ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: (1) Executing select query: INSERT INTO > debug_log (data) VALUES > ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: (1) Executing select query: INSERT INTO > debug_log (data) VALUES > ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 > > > In case of replace: > Wed Dec 28 15:14:01 2016 : Debug: rlm_sql (sql): Reserved connection (0) > Wed Dec 28 15:14:01 2016 : Debug: (0) Executing select query: REPLACE > INTO debug_log (id,data) VALUES > (1,'CCCCCCCCCCCCCCCCCCCCCCC') > **************************Wed Dec 28 15:14:01 2016 : ERROR: (0) > SQL query failed: no connection > Wed Dec 28 15:14:01 2016 : Debug: rlm_sql (sql): Released connection (0) > Wed Dec 28 15:14:01 2016 : Info: Need 4 more connections to reach min > connections (5) Wed Dec 28 15:14:01 2016 : Info: rlm_sql (sql): Opening > additional connection (1), 1 of 31 pending slots used Wed Dec 28 15:14:01 > 2016 : Debug: rlm_sql_mysql: Starting connect to MySQL server Wed Dec 28 > 15:14:01 2016 : Debug: rlm_sql_mysql: Connected to database 'WiFi-Spot- > Radius' on 127.0.0.1 via TCP/IP, server version 5.6.34-79.1-56-log, protocol > version 10 > Wed Dec 28 15:14:01 2016 : Debug: (0) EXPAND %{sql: REPLACE INTO > debug_log (id,data) VALUES > (1,'CCCCCCCCCCCCCCCCCCCCCCC') } > Wed Dec 28 15:14:01 2016 : Debug: (0) --> > Wed Dec 28 15:14:01 2016 : Debug: %{sql: REPLACE INTO debug_log > (id,data) VALUES (3,'CCCCCCCCCCCCCCCCCCCCCCC') } > Wed Dec 28 15:14:01 2016 : Debug: Parsed xlat tree: > Wed Dec 28 15:14:01 2016 : Debug: xlat --> sql Wed Dec 28 15:14:01 2016 : > Debug: { > Wed Dec 28 15:14:01 2016 : Debug: literal --> REPLACE INTO debug_log > (id,data) VALUES (3,'CCCCCCCCCCCCCCCCCCCCCCC') > Wed Dec 28 15:14:01 2016 : Debug: } > Wed Dec 28 15:14:01 2016 : Debug: %{User-Name} Wed Dec 28 15:14:01 2016 > : Debug: Parsed xlat tree: > Wed Dec 28 15:14:01 2016 : Debug: attribute --> User-Name > Wed Dec 28 15:14:01 2016 : Debug: (0) EXPAND %{User-Name} > Wed Dec 28 15:14:01 2016 : Debug: (0) --> z555 > Wed Dec 28 15:14:01 2016 : Debug: (0) SQL-User-Name set to 'z555' > Wed Dec 28 15:14:01 2016 : Debug: rlm_sql (sql): Reserved connection (0) > Wed Dec 28 15:14:01 2016 : Debug: (0) Executing select query: REPLACE > INTO debug_log (id,data) VALUES > (3,'CCCCCCCCCCCCCCCCCCCCCCC') > **************************Wed Dec 28 15:14:01 2016 : ERROR: (0) > SQL query failed: no connection > Wed Dec 28 15:14:01 2016 : Debug: rlm_sql (sql): Released connection (0) > Wed Dec 28 15:14:01 2016 : Debug: (0) EXPAND %{sql: REPLACE INTO > debug_log (id,data) VALUES > (3,'CCCCCCCCCCCCCCCCCCCCCCC') } > Wed Dec 28 15:14:01 2016 : Debug: (0) --> > Wed Dec 28 15:14:01 2016 : Debug: %{sql: REPLACE INTO debug_log > (id,data) VALUES (4,'CCCCCCCCCCCCCCCCCCCCCCC') } > Wed Dec 28 15:14:01 2016 : Debug: Parsed xlat tree: > Wed Dec 28 15:14:01 2016 : Debug: xlat --> sql Wed Dec 28 15:14:01 2016 : > Debug: { > Wed Dec 28 15:14:01 2016 : Debug: literal --> REPLACE INTO debug_log > (id,data) VALUES (4,'CCCCCCCCCCCCCCCCCCCCCCC') > Wed Dec 28 15:14:01 2016 : Debug: } > Wed Dec 28 15:14:01 2016 : Debug: %{User-Name} Wed Dec 28 15:14:01 2016 > : Debug: Parsed xlat tree: > Wed Dec 28 15:14:01 2016 : Debug: attribute --> User-Name > Wed Dec 28 15:14:01 2016 : Debug: (0) EXPAND %{User-Name} > Wed Dec 28 15:14:01 2016 : Debug: (0) --> z555 > Wed Dec 28 15:14:01 2016 : Debug: (0) SQL-User-Name set to 'z555' > Wed Dec 28 15:14:01 2016 : Debug: rlm_sql (sql): Reserved connection (1) > Wed Dec 28 15:14:01 2016 : Debug: (0) Executing select query: REPLACE > INTO debug_log (id,data) VALUES > (4,'CCCCCCCCCCCCCCCCCCCCCCC') > **************************Wed Dec 28 15:14:01 2016 : ERROR: (0) > SQL query failed: no connection > Wed Dec 28 15:14:01 2016 : Debug: rlm_sql (sql): Released connection (1) > Wed Dec 28 15:14:01 2016 : Debug: (0) EXPAND %{sql: REPLACE INTO > debug_log (id,data) VALUES > (4,'CCCCCCCCCCCCCCCCCCCCCCC') } > Wed Dec 28 15:14:01 2016 : Debug: (0) --> > Wed Dec 28 15:14:01 2016 : Debug: %{sql: REPLACE INTO debug_log > (id,data) VALUES (5,'CCCCCCCCCCCCCCCCCCCCCCC');SELECT 1 } > Wed Dec 28 15:14:01 2016 : Debug: Parsed xlat tree: > Wed Dec 28 15:14:01 2016 : Debug: xlat --> sql Wed Dec 28 15:14:01 2016 : > Debug: { > Wed Dec 28 15:14:01 2016 : Debug: literal --> REPLACE INTO debug_log > (id,data) VALUES (5,'CCCCCCCCCCCCCCCCCCCCCCC');SELECT 1 > Wed Dec 28 15:14:01 2016 : Debug: } > Wed Dec 28 15:14:01 2016 : Debug: %{User-Name} Wed Dec 28 15:14:01 2016 > : Debug: Parsed xlat tree: > Wed Dec 28 15:14:01 2016 : Debug: attribute --> User-Name > Wed Dec 28 15:14:01 2016 : Debug: (0) EXPAND %{User-Name} > Wed Dec 28 15:14:01 2016 : Debug: (0) --> z555 > Wed Dec 28 15:14:01 2016 : Debug: (0) SQL-User-Name set to 'z555' > **************************Wed Dec 28 15:14:01 2016 : Debug: rlm_sql > (sql): Reserved connection (0) > Wed Dec 28 15:14:01 2016 : Debug: (0) Executing select query: REPLACE > INTO debug_log (id,data) VALUES > (5,'CCCCCCCCCCCCCCCCCCCCCCC');SELECT 1 > Wed Dec 28 15:14:01 2016 : Debug: rlm_sql (sql): Released connection (0) > Wed Dec 28 15:14:01 2016 : Debug: (0) EXPAND %{sql: REPLACE INTO > debug_log (id,data) VALUES > (5,'CCCCCCCCCCCCCCCCCCCCCCC');SELECT 1 } > Wed Dec 28 15:14:01 2016 : Debug: (0) --> 1 > Wed Dec 28 15:14:01 2016 : Debug: %{sql: REPLACE INTO debug_log > (id,data) VALUES (6,'CCCCCCCCCCCCCCCCCCCCCCC') } > Wed Dec 28 15:14:01 2016 : Debug: Parsed xlat tree: > Wed Dec 28 15:14:01 2016 : Debug: xlat --> sql Wed Dec 28 15:14:01 2016 : > Debug: { > Wed Dec 28 15:14:01 2016 : Debug: literal --> REPLACE INTO debug_log > (id,data) VALUES (6,'CCCCCCCCCCCCCCCCCCCCCCC') > Wed Dec 28 15:14:01 2016 : Debug: } > Wed Dec 28 15:14:01 2016 : Debug: %{User-Name} Wed Dec 28 15:14:01 2016 > : Debug: Parsed xlat tree: > Wed Dec 28 15:14:01 2016 : Debug: attribute --> User-Name > Wed Dec 28 15:14:01 2016 : Debug: (0) EXPAND %{User-Name} > Wed Dec 28 15:14:01 2016 : Debug: (0) --> z555 > Wed Dec 28 15:14:01 2016 : Debug: (0) SQL-User-Name set to 'z555' > Wed Dec 28 15:14:01 2016 : Debug: rlm_sql (sql): Reserved connection (1) > Wed Dec 28 15:14:01 2016 : Debug: (0) Executing select query: REPLACE > INTO debug_log (id,data) VALUES > (6,'CCCCCCCCCCCCCCCCCCCCCCC') > **************************Wed Dec 28 15:14:01 2016 : ERROR: (0) > SQL query failed: no connection > Wed Dec 28 15:14:01 2016 : Debug: rlm_sql (sql): Released connection (1) > Wed Dec 28 15:14:01 2016 : Debug: (0) EXPAND %{sql: REPLACE INTO > debug_log (id,data) VALUES > (6,'CCCCCCCCCCCCCCCCCCCCCCC') } > > > > > #3 > Same query log analysis: > > WITH ERROR: > Wed Dec 28 11:01:33 2016 : Debug: %{sql: INSERT INTO debug_log > (data) VALUES ('AAAAAAAAAAAAAAAAAAAA') } > Wed Dec 28 11:01:33 2016 : Debug: Parsed xlat tree: > Wed Dec 28 11:01:33 2016 : Debug: xlat --> sql Wed Dec 28 11:01:33 2016 : > Debug: { > Wed Dec 28 11:01:33 2016 : Debug: literal --> INSERT INTO debug_log > (data) VALUES ('AAAAAAAAAAAAAAAAAAAA') > Wed Dec 28 11:01:33 2016 : Debug: } > Wed Dec 28 11:01:33 2016 : Debug: %{User-Name} Wed Dec 28 11:01:33 2016 > : Debug: Parsed xlat tree: > Wed Dec 28 11:01:33 2016 : Debug: attribute --> User-Name > Wed Dec 28 11:01:33 2016 : Debug: (0) EXPAND %{User-Name} > Wed Dec 28 11:01:33 2016 : Debug: (0) --> z555 > Wed Dec 28 11:01:33 2016 : Debug: (0) SQL-User-Name set to 'z555' > Wed Dec 28 11:01:33 2016 : Debug: rlm_sql (sql): Reserved connection (1) > Wed Dec 28 11:01:33 2016 : Debug: (0) Executing select query: INSERT INTO > debug_log (data) VALUES ('AAAAAAAAAAAAAAAAAAAA') > Wed Dec 28 11:01:33 2016 : ERROR: (0) SQL query failed: no connection > Wed Dec 28 11:01:33 2016 : Debug: rlm_sql (sql): Released connection (1) > Wed Dec 28 11:01:33 2016 : Debug: (0) EXPAND %{sql: INSERT INTO > debug_log (data) VALUES ('AAAAAAAAAAAAAAAAAAAA') > } > Wed Dec 28 11:01:33 2016 : Debug: (0) --> > Wed Dec 28 11:01:33 2016 : Debug: (0) policy wifi-sessions.accounting { > Wed Dec 28 11:01:33 2016 : Debug: (0) if (&Acct-Status-Type == start){ > Wed Dec 28 11:01:33 2016 : Debug: (0) if (&Acct-Status-Type == start) -> > FALSE > Wed Dec 28 11:01:33 2016 : Debug: (0) elsif (&Acct-Status-Type == stop){ > Wed Dec 28 11:01:33 2016 : Debug: (0) elsif (&Acct-Status-Type == stop) -> > TRUE > Wed Dec 28 11:01:33 2016 : Debug: (0) elsif (&Acct-Status-Type == stop) { > > > WITHOUT ERROR (query modified to have select 1 on the end): > Wed Dec 28 11:13:15 2016 : Debug: %{sql: INSERT INTO debug_log > (data) VALUES ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 } > Wed Dec 28 11:13:15 2016 : Debug: Parsed xlat tree: > Wed Dec 28 11:13:15 2016 : Debug: xlat --> sql Wed Dec 28 11:13:15 2016 : > Debug: { > Wed Dec 28 11:13:15 2016 : Debug: literal --> INSERT INTO debug_log > (data) VALUES ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: } > Wed Dec 28 11:13:15 2016 : Debug: %{User-Name} Wed Dec 28 11:13:15 2016 > : Debug: Parsed xlat tree: > Wed Dec 28 11:13:15 2016 : Debug: attribute --> User-Name > Wed Dec 28 11:13:15 2016 : Debug: (1) EXPAND %{User-Name} > Wed Dec 28 11:13:15 2016 : Debug: (1) --> z555 > Wed Dec 28 11:13:15 2016 : Debug: (1) SQL-User-Name set to 'z555' > Wed Dec 28 11:13:15 2016 : Debug: rlm_sql (sql): Reserved connection (1) > Wed Dec 28 11:13:15 2016 : Debug: (1) Executing select query: INSERT INTO > debug_log (data) VALUES > ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: rlm_sql_mysql: Socket destructor called, > closing socket Wed Dec 28 11:13:15 2016 : Debug: rlm_sql (sql): Reconnecting > (1) Wed Dec 28 11:13:15 2016 : Debug: rlm_sql_mysql: Starting connect to > MySQL server Wed Dec 28 11:13:15 2016 : Debug: rlm_sql_mysql: Connected > to database 'Radius' on 127.0.0.1 via TCP/IP, server version 5.6.34-79.1-56-log, > protocol version 10 > Wed Dec 28 11:13:15 2016 : Debug: (1) Executing select query: INSERT INTO > debug_log (data) VALUES > ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: rlm_sql (sql): Released connection (1) > Wed Dec 28 11:13:15 2016 : Debug: (1) EXPAND %{sql: INSERT INTO > debug_log (data) VALUES > ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 } > Wed Dec 28 11:13:15 2016 : Debug: (1) --> 1 > Wed Dec 28 11:13:15 2016 : Debug: (1) policy wifi-sessions.accounting { > Wed Dec 28 11:13:15 2016 : Debug: (1) if (&Acct-Status-Type == start){ > Wed Dec 28 11:13:15 2016 : Debug: (1) if (&Acct-Status-Type == start) -> > FALSE > Wed Dec 28 11:13:15 2016 : Debug: (1) elsif (&Acct-Status-Type == stop){ > Wed Dec 28 11:13:15 2016 : Debug: (1) elsif (&Acct-Status-Type == stop) -> > TRUE > Wed Dec 28 11:13:15 2016 : Debug: (1) elsif (&Acct-Status-Type == stop) { > > > As you can in second case see in place of: > Wed Dec 28 11:01:33 2016 : ERROR: (0) SQL query failed: no connection > Wed Dec 28 11:01:33 2016 : Debug: rlm_sql (sql): Released connection (1) > > after changing the query we have no ERROR message and in case of socket > unavailable there is: > Wed Dec 28 11:13:15 2016 : Debug: rlm_sql_mysql: Socket destructor called, > closing socket Wed Dec 28 11:13:15 2016 : Debug: rlm_sql (sql): Reconnecting > (1) Wed Dec 28 11:13:15 2016 : Debug: rlm_sql_mysql: Starting connect to > MySQL server Wed Dec 28 11:13:15 2016 : Debug: rlm_sql_mysql: Connected > to database 'Radius' on 127.0.0.1 via TCP/IP, server version 5.6.34-79.1-56-log, > protocol version 10 > Wed Dec 28 11:13:15 2016 : Debug: (1) Executing select query: INSERT INTO > debug_log (data) VALUES > ('AAAAAAAAAAAAAAAAAAAA');SELECT 1 > Wed Dec 28 11:13:15 2016 : Debug: rlm_sql (sql): Released connection (1) > what - I suppose - is normal and desired situation. > ________________________________________ Uwaga: Treść niniejszej wiadomości może być poufna i objęta zakazem jej ujawniania. Jeśli czytelnik tej wiadomości nie jest jej zamierzonym adresatem, pracownikiem lub pośrednikiem upoważnionym do jej przekazania adresatowi, informujemy że wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomości jest zabronione. Jeśli otrzymałeś tę wiadomość omyłkowo, proszę bezzwłocznie odesłać ją nadawcy, a samą wiadomość usunąć z komputera. Dziękujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

4 11

Crash on missing ldap symlink in mods-enabled?
by Martin Pauly 01 Feb '17

01 Feb '17

Hello, I ran into a strange effect today (FR 3.0.12 on Debian Jessie). We use LDAP extensively, nevertheless I forgot to enable the module. I.e. I did not create the symlink in mods-enabled because I believed it to be part of the Debian package freeradius-ldap. Everything else was in place, like my ldap config in mods-available/ldap and an Auth-Type LDAP {} statement in both sites-available/default and sites-available/inner-tunnel. The effect then is that on server start (or even just config check) all modules get loaded, but the first module instantiation ends in a crash. As it turns out, the first module to be instantiated is rlm_ldap. While my configuration was definitely quite inconsistent, a crash might not be what you want either. So here is my debug output: FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/radius_shared_secret_internal.conf including configuration file /etc/freeradius/radius_shared_secret_internal.conf including configuration file /etc/freeradius/radius_shared_secret_wlc-ukgm.conf including configuration file /etc/freeradius/radius_shared_secret_wlc-ukgm.conf including configuration file /etc/freeradius/radius_shared_secret_wlc-ukgm.conf including configuration file /etc/freeradius/radius_shared_secret_internal.conf including configuration file /etc/freeradius/radius_shared_secret_internal.conf including configuration file /etc/freeradius/radius_shared_secret_internal.conf including configuration file /etc/freeradius/radius_shared_secret_internal.conf including configuration file /etc/freeradius/radius_shared_secret_internal.conf including configuration file /etc/freeradius/radius_shared_secret_internal.conf including configuration file /etc/freeradius/radius_shared_secret_internal.conf including configuration file /etc/freeradius/radius_shared_secret_wlc.conf including configuration file /etc/freeradius/radius_shared_secret_wlc.conf including configuration file /etc/freeradius/radius_shared_secret_wlc.conf including configuration file /etc/freeradius/radius_shared_secret_wlc.conf including configuration file /etc/freeradius/radius_shared_secret_wlc.conf including configuration file /etc/freeradius/radius_shared_secret_wlc.conf including configuration file /etc/freeradius/radius_shared_secret_wlc.conf including configuration file /etc/freeradius/radius_shared_secret_dfn.conf including configuration file /etc/freeradius/radius_shared_secret_dfn.conf including configuration file /etc/freeradius/radius_shared_secret_nagios.conf including configuration file /etc/freeradius/radius_shared_secret_nagios.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/certs/passphrase.conf including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/always including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/operator-name including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### realm staff.uni-marburg.de { authhost = LOCAL accthost = LOCAL } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } ... [omitted clients for brevity] ... client wlc1 { ipaddr = 192.168.80.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client wlc2 { ipaddr = 192.168.80.2 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius1.dfn.de { ipaddr = 193.174.75.134 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius2.dfn.de { ipaddr = 193.174.75.138 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = ldap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "NULL" } Creating attribute Unix-Group # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" passchange { } allow_retry = yes } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /Ã€Ã©Ã¶ÃŒÃ Ã¢ÃŠÃ§ÃšÃ©ÃªÃ«Ã®Ã¯ÃŽÅÃ¹Ã»ÃŒaÃ¿ÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÃÅÃÃÅž" } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y-%m" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } instantiate { -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 1

v3.0.12 ssl resumption
by Chris Howley 01 Feb '17

01 Feb '17

Hi, Correct me if I'm wrong but I thought the server uses an in-memory SSL cache. I thought I'd try using that approach first. Thanks, Chris

1 0

v3.0.12 session resumption
by Chris Howley 01 Feb '17

01 Feb '17

Hi, I've looked at the debug output and can see that the Stripped-User-Name is being cached from the first authentication, 9) Found Auth-Type = eap (9) # Executing group from file /etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x42a9f52b4aa0ecd4 (9) eap: Finished EAP session with state 0x42a9f52b4aa0ecd4 (9) eap: Previous EAP request found for state 0x42a9f52b4aa0ecd4, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state send tlv success (9) eap_peap: Received EAP-TLV response (9) eap_peap: Success (9) eap_peap: caching Stripped-User-Name = "xxxxxx" (9) eap_peap: Failed to find 'persist_dir' in TLS configuration. Session will not be cached on disk. (9) eap: Sending EAP Success (code 3) ID 9 length 4 (9) eap: Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) # Executing section post-auth from file /etc/raddb/sites-enabled/default (9) post-auth { (9) update { (9) &reply::Stripped-User-Name += &session-state:Stripped-User-Name[*] -> 'xxxxxx' (9) } # update = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # post-auth = noop (9) Sent Access-Accept Id 9 from 127.0.0.1:1812 to 127.0.0.1:46784 length 0 (9) MS-MPPE-Recv-Key = 0x8177f0129e6382a40366474afcbf0ce1aecbfc27dfae28446e9818664682c13e (9) MS-MPPE-Send-Key = 0x84de4618d9d1bd713ed21ac4f65c10aa1929f907307f5ffa5e09bccbe4096786 (9) EAP-Message = 0x03090004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) Finished request Am I correct in think that a subsequent authentication from the same client should result in the server looking in the cache for a SSL session id. If it finds a match the server should skip phase2 for that authentication? There's no indication in the debug output that the server checks the cache. Thanks, Chris

2 1

Re: AD Group Check - multi SSID - Pass "Require-membership-of" to NTLM_AUTH as variable.
by Pierre de Jong 31 Jan '17

31 Jan '17

Hi, Could someone give me some "ways to go" with LDAP module? Online tutos ? that goes from A to Z ? What about "FreeRadius" flow.... difference between default, inner-tunnel? Authentication and authorization? :shy: Thanks in advance Have a nice day 2017-01-30 10:39 GMT+01:00 <A.L.M.Buxey(a)lboro.ac.uk>: > Hi, > > > So, for exemple, SSID-Corp-Employee is only accessible to a certain > users, > > member of ADgroupA , and SSID-Corp-Direction, only accessible to users, > > member of ADgroupB > > > > When only authenticating with 1 single AD group, there is no problem, > the : > > > > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > > --require-membership-of=GALAXY\rad01 --username=%{%{Stripped-User- > Name}:-%{%{User-Name}:-None}} > > > --domain=%{%{mschap:NT-Domain}:-GALAXY.PRIV} > > > --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Re > > > sponse}:-00}" > > dont do that. leave authentication alone and use authorization > > > so, use simple LDAP check to verify if someone can connect - this scales > because you match > the SSID to the LDAP group..so , configure the LDAP module so it can query > your LDAP (which is AD) > for the users group and then > > if ( ldap_stuff_here != &Called-Station-SSID) { > reject > } > > LDAP stuff can either be an LDAP-Group call or a %{ldap:} call. basically, > get value from LDAP > and check against that supplied in the RADIUS request > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html >

2 1

Releasing 3.0.13 soon?
by Alan DeKok 31 Jan '17

31 Jan '17

We plan on releasing 3.0.13 soon. Is anyone using the v3.0.x head? Are there objections to releasing 3.0.13? Alan DeKok.

7 15

v3.0.12 SSL session resumption
by Chris Howley 31 Jan '17

31 Jan '17

Hi, Configuring the internal "name" of the session cache and persist_dir doesn't appear to have fixed the problem. The second and third auths continued to the second stage of authentication (mschapv2). Should the session id be the same for all three authentication? Thanks, Chris Howley (9) eap_peap: caching Stripped-User-Name = "XXXXXX" (9) eap_peap: Saving session d5ba8c1a8e0357803e77dfd11a8a2d91f128b6fb06863ac6350e718044bc0146 in the disk cache (19) eap_peap: caching Stripped-User-Name = "XXXXXX" (19) eap_peap: Saving session 62328b2e7d89b02745f1df1fb176ec2c77194f0a0621c0179e9d68ac6d203ae3 in the disk cache (29) eap_peap: caching Stripped-User-Name = "XXXXXX" (29) eap_peap: Saving session 14c5d93b36da008e5ad05edaf082cf2a86aeac255bee040345b397dc7d598777 in the disk cache

2 1