- Freeradius-Users - lists.freeradius.org

Re: Help on users file
by jon Yu 05 Jul '16

05 Jul '16

Hi, I have a problem to invoke rm_ldap_groupcmp() by the users file in freeradius 3.1.x. For example, DEFAULT Huntgroup-Name == "mytest", Hint == "MYTEST", Ldap-Group == ndvm6mk9, Auth-Type := ldap-vpn Service-Type = 6, Fall-Through = Yes When entering this configuation, it only shows noop during files according to debug mode (-X) Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: calling files (rlm_files) for request 0 Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) for request 0 Mon Jun 20 15:59:36 2016 : Debug: (0) [files] = noop Mon Jun 20 15:59:36 2016 : Debug: (0) debug_control debug_control { Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == '') Mon Jun 20 15:59:36 2016 : Info: (0) Attributes matching "control:" Mon Jun 20 15:59:36 2016 : Debug: (0) EXPAND %{debug_attr:control:} Mon Jun 20 15:59:36 2016 : Debug: (0) --> Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == '') -> TRUE Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == '') { Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: calling noop (rlm_always) for request 0 Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: returned from noop (rlm_always) for request Please help, Thanks, Jon On Mon, Jun 20, 2016 at 4:33 PM, jon Yu <yunc.yu(a)nd.edu> wrote: > Hi, > > I have a probem to invoke rm_ldap_groupcmp() by the users file in > freeradius 3.1.x. > > For example, > > DEFAULT Huntgroup-Name == "mytest", Hint == "MYTEST", Ldap-Group == > ndvm6mk9, Auth-Type := ldap-vpn > > Service-Type = 6, > > Fall-Through = Yes > > > When entering this configuation, it only shows noop during files according > to debug mode (-X) > > > Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: calling files > (rlm_files) for request 0 > > Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: returned from > files (rlm_files) for request 0 > > Mon Jun 20 15:59:36 2016 : Debug: (0) [files] = noop > > Mon Jun 20 15:59:36 2016 : Debug: (0) debug_control debug_control { > > Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == > '') > > Mon Jun 20 15:59:36 2016 : Info: (0) Attributes matching "control:" > > Mon Jun 20 15:59:36 2016 : Debug: (0) EXPAND %{debug_attr:control:} > > Mon Jun 20 15:59:36 2016 : Debug: (0) --> > > Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == > '') -> TRUE > > Mon Jun 20 15:59:36 2016 : Debug: (0) if ("%{debug_attr:control:}" == > '') { > > Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: calling noop > (rlm_always) for request 0 > > Mon Jun 20 15:59:36 2016 : Debug: (0) modsingle[authorize]: returned from > noop (rlm_always) for request > > > Please help, > > Thanks, > > Jon >

5 18

ldap profile (no full dn in profile attribute)
by Adamczak Krzysztof 05 Jul '16

05 Jul '16

Hi, I have a problem with obtaining profile for ldap user. The problem is caused by not having full, valid DN to profile - that is I only have part of it. The structure is quite simple I'll show it below (simplified). Could you help me with radius configuration? I tried few options but none worked. I apologize if it was already covered - I haven't found the answer yet. Radius config: profile { default = "ou=profiles,dc=example,dc=com" attribute = "profile" } LDAP structure # users dn: dc=example,dc=com dc: example objectClass: dcObject objectClass: organization o: example dn: ou=radius,dc=example,dc=com ou: radius objectClass: organizationalUnit dn: ou=xdsl,ou=radius,dc=example,dc=com objectClass: organizationalUnit ou: xdsl dn: uid=login(a)com.pl,ou=xdsl,ou=radius,dc=example,dc=com uid: login(a)com.pl ... profile: SOME_PROFILE_NAME # profiles dn: ou=profiles,dc=example,dc=com ou: profiles objectClass: organizationalUnit dn: uid=SOME_PROFILE_NAME,ou=profiles,dc=example,dc=com uid: SOME_PROFILE_NAME ... thanks, Chris

4 8

Permissions on Log Files.
by Marc Beaumont 04 Jul '16

04 Jul '16

Hi, Despite setting my permissions in the log file setup to be 770 all my log files are only getting 644 or 640. I can't seem to explain it as I've modified all files on the mods-available directory to have these permissions set but it does not seem to actually do it. Running 3.0.4 on CentoOS 7 Marc Beaumont Network Admin / Linux Specialist Comms365 Limited ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud ______________________________________________________________________

2 1

Ubuntu on wiki page.
by Arjan Sinnige 04 Jul '16

04 Jul '16

Just a FYI. I just created a new page on the wiki for installing freeradius on Ubuntu. I did this because the debian page is kinda messy and did not seem to make any sense anymore. As I only use Ubuntu, I created a new page as Debian does look different in some aspects. Kept it very new user friendly. If someone would cast a quick look to make sure I did not make a F**kup, I'd appreciate it. Arjan Sinnige Hope this gives something back to the community that has helped me quite a bit in the past.

2 1

Can't add User-Name in reply
by saturn 04 Jul '16

04 Jul '16

Hello everyone, I use the following unlang code: if (Service-Type == "Call-Check") { if ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{User-Name}' and active_to > current_timestamp}" > "0") { update request { User-Name := "%{sql_mac-filter:select phone from vbmacs where mac='%{User-Name}' and active_to > current_timestamp}" User-Password := "12345" } update reply { User-Name = "%{sql_mac-filter:select phone from vbmacs where mac='%{User-Name}' and active_to > current_timestamp}" } updated } else { reject } } Section "update request" works fine, but section "update reply" doesn't. I get: Sending Access-Accept of id 148 to 10.25.17.2 port 32770 User-Name = "" ... I tried use "=" and ":=" operators without success. Can you help me with this issue? root@debian:/etc/freeradius/sql/mysql# freeradius -X freeradius: FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu, built on Oct 28 2014 at 16:27:11 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/python including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/mac-filter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sql/mysql/mac-filter-authorize.conf including configuration file /etc/freeradius/sql/mysql/mac-filter-preacct.conf including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 0 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ▒▒▒? modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Linked to module rlm_always Module: Instantiating module "updated" from file /etc/freeradius/modules/always always updated { rcode = "updated" simulcount = 0 mpp = no } Module: Instantiating module "reject" from file /etc/freeradius/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Linked to module rlm_sql Module: Instantiating module "sql_mac-filter" from file /etc/freeradius/sql.conf sql sql_mac-filter { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "vEdf84JEXdPAuUHv" radius_db = "radius-test" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql Creating new attribute sql_mac-filter-SQL-Group rlm_sql: Registering sql_groupcmp for sql_mac-filter-SQL-Group rlm_sql (sql_mac-filter): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_mac-filter): Attempting to connect to radius@localhost:/radius-test rlm_sql (sql_mac-filter): starting 0 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_mac-filter): Connected new DB handle, #0 rlm_sql (sql_mac-filter): starting 1 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_mac-filter): Connected new DB handle, #1 rlm_sql (sql_mac-filter): starting 2 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_mac-filter): Connected new DB handle, #2 rlm_sql (sql_mac-filter): starting 3 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_mac-filter): Connected new DB handle, #3 rlm_sql (sql_mac-filter): starting 4 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_mac-filter): Connected new DB handle, #4 rlm_sql (sql_mac-filter): starting 5 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql_mac-filter): Connected new DB handle, #5 rlm_sql (sql_mac-filter): starting 6 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql_mac-filter): Connected new DB handle, #6 rlm_sql (sql_mac-filter): starting 7 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql_mac-filter): Connected new DB handle, #7 rlm_sql (sql_mac-filter): starting 8 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql_mac-filter): Connected new DB handle, #8 rlm_sql (sql_mac-filter): starting 9 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql_mac-filter): Connected new DB handle, #9 rlm_sql (sql_mac-filter): starting 10 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql_mac-filter): Connected new DB handle, #10 rlm_sql (sql_mac-filter): starting 11 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql_mac-filter): Connected new DB handle, #11 rlm_sql (sql_mac-filter): starting 12 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql_mac-filter): Connected new DB handle, #12 rlm_sql (sql_mac-filter): starting 13 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql_mac-filter): Connected new DB handle, #13 rlm_sql (sql_mac-filter): starting 14 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql_mac-filter): Connected new DB handle, #14 rlm_sql (sql_mac-filter): starting 15 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql_mac-filter): Connected new DB handle, #15 rlm_sql (sql_mac-filter): starting 16 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql_mac-filter): Connected new DB handle, #16 rlm_sql (sql_mac-filter): starting 17 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql_mac-filter): Connected new DB handle, #17 rlm_sql (sql_mac-filter): starting 18 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql_mac-filter): Connected new DB handle, #18 rlm_sql (sql_mac-filter): starting 19 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql_mac-filter): Connected new DB handle, #19 rlm_sql (sql_mac-filter): starting 20 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql_mac-filter): Connected new DB handle, #20 rlm_sql (sql_mac-filter): starting 21 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql_mac-filter): Connected new DB handle, #21 rlm_sql (sql_mac-filter): starting 22 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql_mac-filter): Connected new DB handle, #22 rlm_sql (sql_mac-filter): starting 23 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql_mac-filter): Connected new DB handle, #23 rlm_sql (sql_mac-filter): starting 24 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql_mac-filter): Connected new DB handle, #24 rlm_sql (sql_mac-filter): starting 25 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql_mac-filter): Connected new DB handle, #25 rlm_sql (sql_mac-filter): starting 26 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql_mac-filter): Connected new DB handle, #26 rlm_sql (sql_mac-filter): starting 27 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql_mac-filter): Connected new DB handle, #27 rlm_sql (sql_mac-filter): starting 28 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql_mac-filter): Connected new DB handle, #28 rlm_sql (sql_mac-filter): starting 29 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql_mac-filter): Connected new DB handle, #29 rlm_sql (sql_mac-filter): starting 30 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql_mac-filter): Connected new DB handle, #30 rlm_sql (sql_mac-filter): starting 31 rlm_sql (sql_mac-filter): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql_mac-filter): Connected new DB handle, #31 rlm_sql (sql_mac-filter): Processing generate_sql_clients rlm_sql (sql_mac-filter) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql_mac-filter): Reserving sql socket id: 31 rlm_sql (sql_mac-filter): Read entry nasname=10.4.17.2,shortname=wlc-omc,secret=wlcradius rlm_sql (sql_mac-filter): Adding client 10.4.17.2 (wlc-omc, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.7.17.2,shortname=wlc-priut-2,secret=wlcradius rlm_sql (sql_mac-filter): Adding client 10.7.17.2 (wlc-priut-2, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.10.17.2,shortname=wlc-1389,secret=wlcradius rlm_sql (sql_mac-filter): Adding client 10.10.17.2 (wlc-1389, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.25.17.2,shortname=wlc-okc,secret=wlcradius rlm_sql (sql_mac-filter): Adding client 10.25.17.2 (wlc-okc, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.25.17.5,shortname=wlc-okc-2,secret=wlcradius rlm_sql (sql_mac-filter): Adding client 10.25.17.5 (wlc-okc-2, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.25.17.4,shortname=wlc-okc_rezerv,secret=wlcradius rlm_sql (sql_mac-filter): Adding client 10.25.17.4 (wlc-okc_rezerv, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.201.133.2,shortname=wlc-alpika,secret=wlcradius rlm_sql (sql_mac-filter): Adding client 10.201.133.2 (wlc-alpika, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=172.31.17.251,shortname=wlc-peak,secret=wlcradius rlm_sql (sql_mac-filter): Adding client 172.31.17.251 (wlc-peak, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.20.101.251,shortname=asr-okc,secret=keisgradyius rlm_sql (sql_mac-filter): Adding client 10.20.101.251 (asr-okc, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.20.101.252,shortname=asr-gk1389,secret=keisgradyius rlm_sql (sql_mac-filter): Adding client 10.20.101.252 (asr-gk1389, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.20.101.253,shortname=asr-omc,secret=keisgradyius rlm_sql (sql_mac-filter): Adding client 10.20.101.253 (asr-omc, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.20.101.13,shortname=2951-1200,secret=hg39fJ93Onf1Y rlm_sql (sql_mac-filter): Adding client 10.20.101.13 (2951-1200, server=<none>) to clients list rlm_sql (sql_mac-filter): Read entry nasname=10.25.17.1,shortname=wlc-okc-omc,secret=wlcradius rlm_sql (sql_mac-filter): Adding client 10.25.17.1 (wlc-okc-omc, server=<none>) to clients list rlm_sql (sql_mac-filter): Released sql socket id: 31 Module: Linked to module rlm_sqlcounter Module: Instantiating module "expire_on_login" from file /etc/freeradius/modules/sqlcounter_expire_on_login sqlcounter expire_on_login { counter-name = "Expire-After-Initial-Login" check-name = "Expire-After" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='%{User-Name}' ORDER BY acctstarttime LIMIT 1;" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute Expire-After is number 12001 rlm_sqlcounter: Current Time: 1467618454 [2016-07-04 10:47:34], Next reset 0 [2016-07-04 10:00:00] rlm_sqlcounter: Current Time: 1467618454 [2016-07-04 10:47:34], Prev reset 0 [2016-07-04 10:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Instantiating module "sql_main" from file /etc/freeradius/sql.conf sql sql_main { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "vEdf84JEXdPAuUHv" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql Creating new attribute sql_main-SQL-Group rlm_sql: Registering sql_groupcmp for sql_main-SQL-Group rlm_sql (sql_main): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_main): Attempting to connect to radius@localhost:/radius rlm_sql (sql_main): starting 0 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_main): Connected new DB handle, #0 rlm_sql (sql_main): starting 1 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_main): Connected new DB handle, #1 rlm_sql (sql_main): starting 2 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_main): Connected new DB handle, #2 rlm_sql (sql_main): starting 3 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_main): Connected new DB handle, #3 rlm_sql (sql_main): starting 4 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_main): Connected new DB handle, #4 rlm_sql (sql_main): starting 5 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql_main): Connected new DB handle, #5 rlm_sql (sql_main): starting 6 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql_main): Connected new DB handle, #6 rlm_sql (sql_main): starting 7 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql_main): Connected new DB handle, #7 rlm_sql (sql_main): starting 8 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql_main): Connected new DB handle, #8 rlm_sql (sql_main): starting 9 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql_main): Connected new DB handle, #9 rlm_sql (sql_main): starting 10 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql_main): Connected new DB handle, #10 rlm_sql (sql_main): starting 11 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql_main): Connected new DB handle, #11 rlm_sql (sql_main): starting 12 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql_main): Connected new DB handle, #12 rlm_sql (sql_main): starting 13 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql_main): Connected new DB handle, #13 rlm_sql (sql_main): starting 14 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql_main): Connected new DB handle, #14 rlm_sql (sql_main): starting 15 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql_main): Connected new DB handle, #15 rlm_sql (sql_main): starting 16 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql_main): Connected new DB handle, #16 rlm_sql (sql_main): starting 17 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql_main): Connected new DB handle, #17 rlm_sql (sql_main): starting 18 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql_main): Connected new DB handle, #18 rlm_sql (sql_main): starting 19 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql_main): Connected new DB handle, #19 rlm_sql (sql_main): starting 20 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql_main): Connected new DB handle, #20 rlm_sql (sql_main): starting 21 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql_main): Connected new DB handle, #21 rlm_sql (sql_main): starting 22 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql_main): Connected new DB handle, #22 rlm_sql (sql_main): starting 23 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql_main): Connected new DB handle, #23 rlm_sql (sql_main): starting 24 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql_main): Connected new DB handle, #24 rlm_sql (sql_main): starting 25 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql_main): Connected new DB handle, #25 rlm_sql (sql_main): starting 26 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql_main): Connected new DB handle, #26 rlm_sql (sql_main): starting 27 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql_main): Connected new DB handle, #27 rlm_sql (sql_main): starting 28 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql_main): Connected new DB handle, #28 rlm_sql (sql_main): starting 29 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql_main): Connected new DB handle, #29 rlm_sql (sql_main): starting 30 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql_main): Connected new DB handle, #30 rlm_sql (sql_main): starting 31 rlm_sql (sql_main): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql_main): Connected new DB handle, #31 rlm_sql (sql_main): Processing generate_sql_clients rlm_sql (sql_main) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql_main): Reserving sql socket id: 31 rlm_sql (sql_main): Read entry nasname=10.4.17.2,shortname=wlc-omc,secret=wlcradius rlm_sql (sql_main): Adding client 10.4.17.2 (wlc-omc, server=<none>) to clients list WARNING: Ignoring duplicate client 10.4.17.2 rlm_sql (sql_main): Read entry nasname=10.7.17.2,shortname=wlc-priut-2,secret=wlcradius rlm_sql (sql_main): Adding client 10.7.17.2 (wlc-priut-2, server=<none>) to clients list WARNING: Ignoring duplicate client 10.7.17.2 rlm_sql (sql_main): Read entry nasname=10.10.17.2,shortname=wlc-1389,secret=wlcradius rlm_sql (sql_main): Adding client 10.10.17.2 (wlc-1389, server=<none>) to clients list WARNING: Ignoring duplicate client 10.10.17.2 rlm_sql (sql_main): Read entry nasname=10.25.17.2,shortname=wlc-okc,secret=wlcradius rlm_sql (sql_main): Adding client 10.25.17.2 (wlc-okc, server=<none>) to clients list WARNING: Ignoring duplicate client 10.25.17.2 rlm_sql (sql_main): Read entry nasname=10.25.17.5,shortname=wlc-okc-2,secret=wlcradius rlm_sql (sql_main): Adding client 10.25.17.5 (wlc-okc-2, server=<none>) to clients list WARNING: Ignoring duplicate client 10.25.17.5 rlm_sql (sql_main): Read entry nasname=10.25.17.4,shortname=wlc-okc_rezerv,secret=wlcradius rlm_sql (sql_main): Adding client 10.25.17.4 (wlc-okc_rezerv, server=<none>) to clients list WARNING: Ignoring duplicate client 10.25.17.4 rlm_sql (sql_main): Read entry nasname=10.201.133.2,shortname=wlc-alpika,secret=wlcradius rlm_sql (sql_main): Adding client 10.201.133.2 (wlc-alpika, server=<none>) to clients list WARNING: Ignoring duplicate client 10.201.133.2 rlm_sql (sql_main): Read entry nasname=172.31.17.251,shortname=wlc-peak,secret=wlcradius rlm_sql (sql_main): Adding client 172.31.17.251 (wlc-peak, server=<none>) to clients list WARNING: Ignoring duplicate client 172.31.17.251 rlm_sql (sql_main): Read entry nasname=10.20.101.251,shortname=asr-okc,secret=keisgradyius rlm_sql (sql_main): Adding client 10.20.101.251 (asr-okc, server=<none>) to clients list WARNING: Ignoring duplicate client 10.20.101.251 rlm_sql (sql_main): Read entry nasname=10.20.101.252,shortname=asr-gk1389,secret=keisgradyius rlm_sql (sql_main): Adding client 10.20.101.252 (asr-gk1389, server=<none>) to clients list WARNING: Ignoring duplicate client 10.20.101.252 rlm_sql (sql_main): Read entry nasname=10.20.101.253,shortname=asr-omc,secret=keisgradyius rlm_sql (sql_main): Adding client 10.20.101.253 (asr-omc, server=<none>) to clients list WARNING: Ignoring duplicate client 10.20.101.253 rlm_sql (sql_main): Read entry nasname=10.20.101.13,shortname=2951-1200,secret=hg39fJ93Onf1Y rlm_sql (sql_main): Adding client 10.20.101.13 (2951-1200, server=<none>) to clients list WARNING: Ignoring duplicate client 10.20.101.13 rlm_sql (sql_main): Read entry nasname=10.25.17.1,shortname=wlc-okc-omc,secret=wlcradius rlm_sql (sql_main): Adding client 10.25.17.1 (wlc-okc-omc, server=<none>) to clients list WARNING: Ignoring duplicate client 10.25.17.1 rlm_sql (sql_main): Released sql socket id: 31 Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 10.25.17.2 port 32770, id=148, length=185 User-Name = "90:00:4e:3d:fe:a2" Called-Station-Id = "AP-Park-410:mf" Calling-Station-Id = "90-00-4e-3d-fe-a2" NAS-Port = 13 NAS-IP-Address = 10.25.17.2 NAS-Identifier = "wlc-okc-060-cth1" Airespace-Wlan-Id = 13 Service-Type = Call-Check Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "192" Acct-Session-Id = "577a14a0/90:00:4e:3d:fe:a2/71640" # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "90:00:4e:3d:fe:a2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop ++? if (Service-Type == "Call-Check") ? Evaluating (Service-Type == "Call-Check") -> TRUE ++? if (Service-Type == "Call-Check") -> TRUE ++if (Service-Type == "Call-Check") { +++? if ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{User-Name}' and active_to > current_timestamp}" > "0") sql_xlat expand: %{User-Name} -> 90:00:4e:3d:fe:a2 sql_set_user escaped user --> '90:00:4e:3d:fe:a2' expand: select count(id) from vbmacs where mac='%{User-Name}' and active_to > current_timestamp -> select count(id) from vbmacs where mac='90:00:4e:3d:fe:a2' and active_to > current_timestamp rlm_sql (sql_mac-filter): Reserving sql socket id: 30 sql_xlat finished rlm_sql (sql_mac-filter): Released sql socket id: 30 expand: %{sql_mac-filter:select count(id) from vbmacs where mac='%{User-Name}' and active_to > current_timestamp} -> 1 ? Evaluating ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{User-Name}' and active_to > current_timestamp}" > "0") -> TRUE +++? if ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{User-Name}' and active_to > current_timestamp}" > "0") -> TRUE +++if ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{User-Name}' and active_to > current_timestamp}" > "0") { ++++update request { sql_xlat expand: %{User-Name} -> 90:00:4e:3d:fe:a2 sql_set_user escaped user --> '90:00:4e:3d:fe:a2' expand: select phone from vbmacs where mac='%{User-Name}' and active_to > current_timestamp -> select phone from vbmacs where mac='90:00:4e:3d:fe:a2' and active_to > current_timestamp rlm_sql (sql_mac-filter): Reserving sql socket id: 29 sql_xlat finished rlm_sql (sql_mac-filter): Released sql socket id: 29 expand: %{sql_mac-filter:select phone from vbmacs where mac='%{User-Name}' and active_to > current_timestamp} -> 79280000000 ++++} # update request = noop ++++update reply { sql_xlat expand: %{User-Name} -> 79280000000 sql_set_user escaped user --> '79280000000' expand: select phone from vbmacs where mac='%{User-Name}' and active_to > current_timestamp -> select phone from vbmacs where mac='79280000000' and active_to > current_timestamp rlm_sql (sql_mac-filter): Reserving sql socket id: 28 SQL query did not return any results rlm_sql (sql_mac-filter): Released sql socket id: 28 expand: %{sql_mac-filter:select phone from vbmacs where mac='%{User-Name}' and active_to > current_timestamp} -> ++++} # update reply = noop ++++[updated] = updated +++} # if ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{User-Name}' and active_to > current_timestamp}" > "0") = updated +++ ... skipping else for request 0: Preceding "if" was taken ++} # if (Service-Type == "Call-Check") = updated [sql_mac-filter] expand: %{User-Name} -> 79280000000 [sql_mac-filter] sql_set_user escaped user --> '79280000000' rlm_sql (sql_mac-filter): Reserving sql socket id: 27 [sql_mac-filter] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '79280000000' ORDER BY id [sql_mac-filter] User found in radcheck table [sql_mac-filter] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '79280000000' ORDER BY id [sql_mac-filter] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '79280000000' ORDER BY priority [sql_mac-filter] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sms-test' ORDER BY id [sql_mac-filter] User found in group sms-test [sql_mac-filter] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sms-test' ORDER BY id rlm_sql (sql_mac-filter): Released sql socket id: 27 ++[sql_mac-filter] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = updated rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[expire_on_login] = noop +} # group authorize = updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +group PAP { [pap] login attempt with password "12345" [pap] Using clear text password "12345" [pap] User authenticated successfully ++[pap] = ok +} # group PAP = ok # Executing section session from file /etc/freeradius/sites-enabled/default +group session { [sql_mac-filter] expand: %{User-Name} -> 79280000000 [sql_mac-filter] sql_set_user escaped user --> '79280000000' [sql_mac-filter] expand: SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL -> SELECT COUNT(*) FROM radacct WHERE username = '79280000000' AND acctstoptime IS NULL rlm_sql (sql_mac-filter): Reserving sql socket id: 26 rlm_sql (sql_mac-filter): Released sql socket id: 26 ++[sql_mac-filter] = ok +} # group session = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 148 to 10.25.17.2 port 32770 User-Name = "" Session-Timeout = 28800 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 10.25.17.2 port 32770, id=24, length=261 User-Name = "90004e3dfea2" NAS-Port = 13 NAS-IP-Address = 10.25.17.2 Framed-IP-Address = 10.25.202.13 Framed-IPv6-Prefix = fe80::/64 NAS-Identifier = "wlc-okc-060-cth1" Airespace-Wlan-Id = 13 Acct-Session-Id = "577a14a0/90:00:4e:3d:fe:a2/71640" NAS-Port-Type = Wireless-802.11 Cisco-AVPair = "audit-session-id=0a1911020007e38f577a14a0" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "192" Event-Timestamp = "Jul 4 2016 10:47:44 MSK" Acct-Status-Type = Start Calling-Station-Id = "90-00-4e-3d-fe-a2" Called-Station-Id = "AP-Park-410:mf" # Executing section preacct from file /etc/freeradius/sites-enabled/default +group preacct { ++[preprocess] = ok ++? if (User-Name =~ /^([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})/i) ? Evaluating (User-Name =~ /^([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})/i) -> TRUE ++? if (User-Name =~ /^([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})/i) -> TRUE ++if (User-Name =~ /^([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})/i) { +++? if ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{1}:%{2}:%{3}:%{4}:%{5}:%{6}' and active_to > current_timestamp}" > "0") sql_xlat expand: %{User-Name} -> 90004e3dfea2 sql_set_user escaped user --> '90004e3dfea2' expand: select count(id) from vbmacs where mac='%{1}:%{2}:%{3}:%{4}:%{5}:%{6}' and active_to > current_timestamp -> select count(id) from vbmacs where mac='90:00:4e:3d:fe:a2' and active_to > current_timestamp rlm_sql (sql_mac-filter): Reserving sql socket id: 25 sql_xlat finished rlm_sql (sql_mac-filter): Released sql socket id: 25 expand: %{sql_mac-filter:select count(id) from vbmacs where mac='%{1}:%{2}:%{3}:%{4}:%{5}:%{6}' and active_to > current_timestamp} -> 1 ? Evaluating ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{1}:%{2}:%{3}:%{4}:%{5}:%{6}' and active_to > current_timestamp}" > "0") -> TRUE +++? if ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{1}:%{2}:%{3}:%{4}:%{5}:%{6}' and active_to > current_timestamp}" > "0") -> TRUE +++if ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{1}:%{2}:%{3}:%{4}:%{5}:%{6}' and active_to > current_timestamp}" > "0") { ++++update request { sql_xlat expand: %{User-Name} -> 90004e3dfea2 sql_set_user escaped user --> '90004e3dfea2' expand: select phone from vbmacs where mac='%{1}:%{2}:%{3}:%{4}:%{5}:%{6}' and active_to > current_timestamp -> select phone from vbmacs where mac='90:00:4e:3d:fe:a2' and active_to > current_timestamp rlm_sql (sql_mac-filter): Reserving sql socket id: 24 sql_xlat finished rlm_sql (sql_mac-filter): Released sql socket id: 24 expand: %{sql_mac-filter:select phone from vbmacs where mac='%{1}:%{2}:%{3}:%{4}:%{5}:%{6}' and active_to > current_timestamp} -> 79280000000 ++++} # update request = noop +++} # if ("%{sql_mac-filter:select count(id) from vbmacs where mac='%{1}:%{2}:%{3}:%{4}:%{5}:%{6}' and active_to > current_timestamp}" > "0") = noop ++} # if (User-Name =~ /^([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})/i) = noop [acct_unique] Hashing 'NAS-Port = 13,NAS-Identifier = "wlc-okc-060-cth1",NAS-IP-Address = 10.25.17.2,Acct-Session-Id = "577a14a0/90:00:4e:3d:fe:a2/71640",User-Name = "79280000000"' [acct_unique] Acct-Unique-Session-ID = "f5cf9dd5fc010de8". ++[acct_unique] = ok [suffix] No '@' in User-Name = "79280000000", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++[files] = noop +} # group preacct = ok # Executing section accounting from file /etc/freeradius/sites-enabled/default +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 10.25.17.2 [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/10.25.17.2/detail-20160704 [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/10.25.17.2/detail-20160704 [detail] expand: %t -> Mon Jul 4 10:47:43 2016 ++[detail] = ok ++[unix] = ok [sql_mac-filter] expand: %{User-Name} -> 79280000000 [sql_mac-filter] sql_set_user escaped user --> '79280000000' [sql_mac-filter] expand: %{Acct-Delay-Time} -> [sql_mac-filter] ... expanding second conditional [sql_mac-filter] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Addre rlm_sql (sql_mac-filter): Reserving sql socket id: 23 rlm_sql (sql_mac-filter): Released sql socket id: 23 ++[sql_mac-filter] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> 79280000000 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 24 to 10.25.17.2 port 32770 Finished request 1. Cleaning up request 1 ID 24 with timestamp +9 Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 148 with timestamp +9 Ready to process requests.

1 0

detail polling stops after failover
by denis 04 Jul '16

04 Jul '16

Hello, I was using freeradius 2.1 for a while, and at some point I had to make robust proxy accounting solution. While testing I ran into problem with multiplying Proxy-State, described here: http://permalink.gmane.org/gmane.comp.freeradius.devel/6276 Hence I decided to move to 3.0.4 (installed from networkradius.com repo) I discarded all old configs I had and making setup from scratch, at first stage trying to make minimum changes in examples. Now I'm trying to make work/understand following scenario: - start freeradius with only one upstream servers alive (home1 is alive, home2 initially dead) - auth with client (pptp + radiusclient) - stop alive upstream server (home1 dies, so no server will respond to Interim-Update) acct data starts to get logged into detail.examle.com/ folder - then I bring up home1, it's clear from logs that radius server marks it "alive" but detail polling never goes on, i.e detail files remain on disk if I restart freeradius it polls detail files immediately and send to upstream I spent a while trying to debug/understand what's going on, but at this point I'm stuck, thus asking for help. configs and log are too long to include in mail, so created gists: debug log: https://gist.github.com/dzinevich/56b3259246b62a36d2ed62836b181fac configs: https://gist.github.com/dzinevich/cd7d8510093293f4b9fab49f60535918 -- Denis

2 2

Possible certificatre problem
by Henrik Kressner 04 Jul '16

04 Jul '16

I followed the howto up til this: http://deployingradius.com/documents/configuration/ca_import.html Trying to connnect from a win 7, as described, via a hostapd based AP/NAS, I get this on the radiuserver. (61) eap_peap: <<< recv TLS 1.0 Alert [length 0002], fatal unknown_ca (61) eap_peap: ERROR: TLS Alert read:fatal:unknown CA (61) eap_peap: ERROR: TLS_accept: Failed in unknown state (61) eap_peap: ERROR: SSL says: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (61) eap_peap: ERROR: SSL_read failed inside of TLS (-1), TLS session failed (61) eap_peap: ERROR: TLS receive handshake failed during operation (61) eap_peap: ERROR: [eaptls process] = fail (61) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (61) eap: Sending EAP Failure (code 4) ID 55 length 4 I can read what it says, but I dont understand why it say so, if the howto is to be trustet. -- ------------------------------------------- Med venlig hilsen / Yours Sincerly Henrik Kressner

8 18

Differentiate between BYOD and corporate devices - looking for some input
by Mathieu Simon (Lists) 02 Jul '16

02 Jul '16

Hi I've been thinking about how FreeRADIUS would need to be configured to differentiate between authentication requests from BYOD devices and corporate (typically Windows Domain members) and i.e. put them in different VLANs. I've tried to find things that might be used as differentiators when i.e using PEAP-MSCHAPv2: Windows Domain member using PEAP-MSCHAPv2 send requests differently not having any domain part. Hosts authenticating use host/<hostname>$ formats for their username they send... IMO not really a reliable way to differentiate them in my opinion, an end user device could imitate that as well. The thing I currently see, is Calling-Station-Id being sent to FreeRADIUS where one could detect if a device is corporate-owned and thus i.e. an SQL database could be queried to check if the device figures in the known corporate devices DB. But then again we all know how easily MAC-addresses can be faked. Is there something else I'm likely missing here? Do some of you use different EAP methods like i.e. EAP-TLS for corporate devices while a password-based method is used for personal devices. Ideally if a certificate was given out for each corporate device and user as well as per BYOD device, well then it would be easy to identify things... But that's requiring a whole CA and issuing infrastructure while trying to keep onboarding personal devices as simple as possible for users. I don't have a urgent need for it right now but I have tried to get an idea on that topic yet haven't found a satisfying path (and without working every day with FreeRADIUS that is). Maybe someone is willing to share his or her experiences? -- Mathieu

2 2

RE: Possible certificatre problem
by Danner, Mearl 02 Jul '16

02 Jul '16

> On Jul 2, 2016, at 10:47 AM, Henrik Kressner <kressner(a)synkro.dk> wrote: >> Thanks for you comment, but now you are making assumption. > I'm going by what you said. And what you said contradicts itself. > >This is going nowhere. >Allan, as I know it, you are the only >devoloper in the freeradius >project, and I dont trust you. >That means I dont trust freeradius, so I >just leave the list and find >another product, if it should be >Microsoft based, so be it. If you don't put the CA on the Windows client, no product will authenticate it. The configuration of the supplicant is the problem. It has nothing to do with the server, no matter who makes it. >You are welcome to contact me if you >"come down to earth" some day, but >til then, have a nice Sent from my Android phone using Symantec TouchDown (www.symantec.com)

1 0

Connect problem
by Henrik Kressner 01 Jul '16

01 Jul '16

Installed freeradius v 3.0.11 as shown here: http://wiki.freeradius.org/building/Build No problem. Can execute #radtest bob hello localhost 0 testing123, on both the freeradus server and the NAS (With the right IP) Following this: http://deployingradius.com/documents/configuration/eap.html I get this response: .... (133) eap: Peer sent packet with method EAP MSCHAPv2 (26) (133) eap: Calling submodule eap_mschapv2 to process data (133) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (133) eap_mschapv2: Auth-Type MS-CHAP { (133) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (133) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (133) mschap: Creating challenge hash with username: bob (133) mschap: Client is using MS-CHAPv2 (133) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (133) mschap: ERROR: MS-CHAP2-Response is incorrect (133) [mschap] = reject (133) } # Auth-Type MS-CHAP = reject (133) eap: Sending EAP Failure (code 4) ID 24 length 4 (133) eap: Freeing handler .... What does it mean? -- ------------------------------------------- Med venlig hilsen / Yours Sincerly Henrik Kressner

4 14