- Freeradius-Users - lists.freeradius.org

redirecting REJECTed users
by Alan Batie 12 Feb '16

12 Feb '16

I would like to send otherwise REJECTed users to a "suspended" ip pool and pass them. When things get rejected, it seems to abort processing (e.g. if I stick a perl module after pap, it doesn't get called if pap rejects), and it doesn't look like you can make them OK in the Post-Auth-Type REJECT section. Recommendations?

3 6

freeradius 3 and "#" sign in configuration files
by gahn 12 Feb '16

12 Feb '16

hello: for those configurations files, i noticed those "#" in front of a lot of pre-set values such as those: # psk_identity = "test" # psk_hexphrase = "036363823" does that mean those values are default values being used or they would be ignored? thanks _dave

2 2

freeradius 3 and certs
by gahn 12 Feb '16

12 Feb '16

hello all: i am learning radius3 for 802.1x authentication. i have followed the web site "http://deployingradius.com/documents/configuration/eap.html" and tried to get basic 802.1x tests going. at the first step, it failed me on "snake oil"certificates creation: root@lab:/usr/local/etc/raddb/certs # radiusd -v radiusd: FreeRADIUS Version 3.0.11, for host amd64-portbld-freebsd10.1, built on Jan 31 2016 at 14:36:06 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT root@lab:/usr/local/etc/raddb/certs # make /usr/bin/openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key ..........+++ ..................................................................+++ writing new private key to 'server.key' ----- /usr/bin/openssl req -new -x509 -keyout ca.key -out ca.pem -days '60' -config ./ca.cnf Generating a 2048 bit RSA private key .....+++ .......................+++ writing new private key to 'ca.key' ----- /usr/bin/openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key 'whatever' -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 3 (0x3) Validity Not Before: Feb 12 16:09:37 2016 GMT Not After : Apr 12 16:09:37 2016 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.org X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 CRL Distribution Points: Full Name: URI:http://www.example.com/example_ca.crl Certificate is to be certified until Apr 12 16:09:37 2016 GMT (60 days) failed to update database TXT_DB error number 2 *** Error code 1 Stop. make: stopped in /usr/local/etc/raddb/certs it seemed to have passed compilation but failed on database, is it something wrong with the code? thanks _dave

2 2

Deduplication of accounting requests
by apopov＠cybervisiontech.com 12 Feb '16

12 Feb '16

>From RFC: "The RADIUS server can detect a duplicate request if it has the same client source IP address and source UDP port and Identifier within a short span of time." Does it mean, if my application send accounting requests from one port, I can send only 256 request in short span of time, next request will be handled as duplicate regardless of attributes in it? How freeradius detect that package is duplicated? What fields used for this purposes ? Where and how it configured? Thanks, --Artem

2 3

If you need to set "synchronous = no"
by apopov＠cybervisiontech.com 12 Feb '16

12 Feb '16

We want to use radius for transferring CDR records. Expected about 5000 accounting requests per second. Our plan: App(requests generator) -> Local FreeRadius proxy -> Remote FreeRadius servers. Local instance of freeradius proxy should store requests if remote server unavailable and also care about retransmissions. If proxy support only synchronous mode, I don't think it is possible to transfer 5K requests per second because of response delay. Looks like asynchronous mode can help in this case. >From my understanding synchronous mode mean - proxy does not handle next request before response on first one. Is it correct understanding? Can FreeRadius Proxy be used for my case? Thanks, --Artem

2 3

REG: module load problem
by Anirudh Malhotra 12 Feb '16

12 Feb '16

Hi, I am using v3.0.11 and sqlcounter is getting included before sql and that is creating problems i tried doing instantiate sql sqlcounter no help! including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/sqlcounter /usr/local/etc/raddb/mods-enabled/sqlcounter[43]: Reference "${modules.sql.dialect}" not found /usr/local/etc/raddb/mods-enabled/sqlcounter[52]: Reference "${modconfdir}/sql/counter/${dialect}/${.:instance}.conf" points to a variable which has not been expanded. please suggest a solution

2 2

RE: sql: ERROR: rlm_sql_oracle: ORA-01403: no data found
by Vincent MARCEL 12 Feb '16

12 Feb '16

No, sorry. There is no connection problem and radius server get the same connection string as with sqlplus : rlm_sql (sql): Attempting to connect to database "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.22.97.147)(PORT=1533))(CONNECT_DATA=(SID=MEMAD)))" rlm_sql (sql): Initialising connection pool pool { start = 4 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } If radius server really got no data, how do you want it accepts known users in my authcheck_table and rejects unknown users from my authcheck_table ? Sql is my only authorization method : authorize { filter_username preprocess sql if(ok) { update control { Auth-Type := Accept } } else { update control { Auth-Type := Reject } } expiration logintime } And here is the result in debug mode : (0) sql: EXPAND SELECT distinct 1,NUM_SERIE,'Cleartext-Password',NUM_SERIE,':=' FROM E_MEMA_TPE WHERE NUM_SERIE = '%{User-Name}' (0) sql: --> SELECT distinct 1,NUM_SERIE,'Cleartext-Password',NUM_SERIE,':=' FROM E_MEMA_TPE WHERE NUM_SERIE = 'FT10895748' (0) sql: Executing select query: SELECT distinct 1,NUM_SERIE,'Cleartext-Password',NUM_SERIE,':=' FROM E_MEMA_TPE WHERE NUM_SERIE = 'FT10895748' (0) sql: ERROR: Error fetching row (0) sql: ERROR: rlm_sql_oracle: ORA-01403: no data found (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "FT10895748" rlm_sql (sql): Released connection (4) rlm_sql (sql): Need 2 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 31 pending slots used (0) [sql] = ok (0) if (ok) { (0) if (ok) -> TRUE (0) if (ok) { (0) update control { (0) Auth-Type := Accept (0) } # update control = noop (0) } # if (ok) = noop (0) ... skipping else for request 0: Preceding "if" was taken (0) [expiration] = noop (0) [logintime] = noop (0) } # authorize = ok (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user Anyway : - this error appear whatever query I put in authorize_check_query, for example "SELECT 1,'FT10895748','User-Password','FT10895748',':=' FROM DUAL" that returns a fixed row - even in the case where data is not found (unkown user), it is not normal that radius provokes this Oracle ORA-01403 error since it is not forbidden to retrieve no data from authorize_check_query. It may say "no data found" for information but not produce an error... Cordialement, Vincent. De : Alan Buxey [mailto:A.L.M.Buxey@lboro.ac.uk] Envoyé : jeudi 11 février 2016 23:29 À : FreeRadius users mailing list; Vincent MARCEL Objet : RE: sql: ERROR: rlm_sql_oracle: ORA-01403: no data found >>Your query doesn't return data from >>the database >False : here is the query (debug mode) >for an accepted user : No. Sorry. It's true. Look: (1) sql: ERROR: Error fetching row (1) sql: ERROR: rlm_sql_oracle: ORA-01403: no data found See. Error fetching row and no data found. Ensure your sql config had suitable access user/pass and host has required access alan

1 0

sql: ERROR: rlm_sql_oracle: ORA-01403: no data found
by Vincent MARCEL 12 Feb '16

12 Feb '16

Hi, I am trying to authorize a user through a authorize_check_query on Oracle database. When I test, I get this error on my radius server : (0) sql: Executing select query: SELECT 1,'FT10895748','User-Password','FT10895748',':=' FROM DUAL (0) sql: ERROR: Error fetching row (0) sql: ERROR: rlm_sql_oracle: ORA-01403: no data found But this can't be true, this query always returns 1 row ! Below is the output of my server in debug mode, starting from database connection, ending to the authorize test : # Instantiating module "sql" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/sql rlm_sql (sql): Attempting to connect to database "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=172.22.97.147)(PORT=1533))(CONNECT_DATA=(SID=MEMAD)))" rlm_sql (sql): Initialising connection pool pool { start = 4 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used # Instantiating module "linelog" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/linelog # Instantiating module "attr_filter.post-proxy" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/attr_filter reading pairlist file /USR/radiusrec/radius/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/attr_filter reading pairlist file /USR/radiusrec/radius/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/attr_filter reading pairlist file /USR/radiusrec/radius/etc/raddb/mods-config/attr_filter/access_reject [/USR/radiusrec/radius/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/USR/radiusrec/radius/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/attr_filter reading pairlist file /USR/radiusrec/radius/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/attr_filter reading pairlist file /USR/radiusrec/radius/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "logintime" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/logintime # Instantiating module "IPASS" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/realm # Instantiating module "cache_eap" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "files" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/files reading pairlist file /USR/radiusrec/radius/etc/raddb/mods-config/files/authorize reading pairlist file /USR/radiusrec/radius/etc/raddb/mods-config/files/accounting reading pairlist file /USR/radiusrec/radius/etc/raddb/mods-config/files/pre-proxy # Instantiating module "auth_log" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/detail.log # Instantiating module "reject" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/always # Instantiating module "pap" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/pap # Instantiating module "expiration" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/expiration # Instantiating module "etc_passwd" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "mschap" from file /USR/radiusrec/radius/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication } # modules radiusd: #### Loading Virtual Servers #### server { # from file /USR/radiusrec/radius/etc/raddb/radiusd.conf } # server server default { # from file /USR/radiusrec/radius/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /USR/radiusrec/radius/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1912 limit { max_connections = 1024 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1912 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Ready to process requests (0) Received Access-Request Id 21 from 127.0.0.1:51714 to 127.0.0.1:1912 length 74 (0) User-Name = "FT10895748" (0) User-Password = "FT10895748" (0) NAS-IP-Address = 172.22.97.209 (0) NAS-Port = 0 (0) Message-Authenticator = 0x9d34c3f30a9e038d72f149648f828f45 (0) # Executing section authorize from file /USR/radiusrec/radius/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "FT10895748", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT 1,'FT10895748','User-Password','FT10895748',':=' FROM DUAL (0) sql: --> SELECT 1,'FT10895748','User-Password','FT10895748',':=' FROM DUAL (0) sql: Executing select query: SELECT 1,'FT10895748','User-Password','FT10895748',':=' FROM DUAL (0) sql: ERROR: Error fetching row (0) sql: ERROR: rlm_sql_oracle: ORA-01403: no data found (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: User-Password := "FT10895748" rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 6 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) pap: WARNING: !!! Ignoring control:User-Password. Update your !!! (0) pap: WARNING: !!! configuration so that the "known good" clear text !!! (0) pap: WARNING: !!! password is in Cleartext-Password and NOT in !!! (0) pap: WARNING: !!! User-Password. !!! (0) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /USR/radiusrec/radius/etc/raddb/sites-enabled/default (0) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 21 from 127.0.0.1:1912 to 127.0.0.1:51714 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 21 with timestamp +24 Ready to process requests Any idea of what is wrong ? Best regards, Vincent MARCEL

4 7

Attribute filtering
by Alan Batie 11 Feb '16

11 Feb '16

I'm having some trouble with attribute filtering: we're preparing to move from router assigned ip addressing to radius pool assignment. For initial testing, I thought I'd just add a Pool-Name to the user check items for a few test accounts. That doesn't work because the Framed-IP-Address that tells the router to do the assignment is added in the group reply items, which prevents sqlippool from doing an assignment. It's probably possible to do a convoluted sql statement in the group lookup, but that would be...convoluted. Our solution was to just create separate groups for these cases, but I would like to figure out how to do overrides like this. What I looked for was an operator to remove an attribute, but that doesn't seem to exist - you can only add them. I noticed the attr_filter module, and tried that with: mods-config/attr_filter/framed_ip_address: if (&control:Pool-Nmae && &control:Pool-Name != "") { Framed-IP-Address !* ANY } If I read that module right, it filters out anything that doesn't match the given patterns, but that doesn't seem to do anything: (2) Thu Feb 11 12:16:27 2016: Debug: attr_filter.framed_ip_address: EXPAND %{Framed-IP-Address} (2) Thu Feb 11 12:16:27 2016: Debug: attr_filter.framed_ip_address: --> (2) Thu Feb 11 12:16:27 2016: Debug: [attr_filter.framed_ip_address] = noop was the debug output in all cases and Framed-IP-Address was left alone. The only thing that did work was putting this in a perl module: sub post_auth { if (defined($RAD_CHECK{'Pool-Name'})) { delete $RAD_REPLY{'Framed-IP-Address'}; } return RLM_MODULE_OK; } but using perl seems heavy-handed for a simple task like this, so I'm wondering what the "approved" mechanism for deleting an attribute is? Thanks...

2 2

operator = not working
by Alan Batie 11 Feb '16

11 Feb '16

According to http://wiki.freeradius.org/config/Operators : = Attribute = Value Not allowed as a check item for RADIUS protocol attributes. It is allowed for server configuration attributes (Auth-Type, etc), and sets the value of on attribute, only if there is no other item of the same attribute. It specifically says Auth-Type (which does seem to be working), and Pool-Name is another control attribute: mysql> select * from radgroupcheck where groupname = 'test_pool'; +----+-----------+-----------+----+-----------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-----------+ | 41 | TEST_POOL | Auth-Type | = | PAP | | 42 | TEST_POOL | Pool-Name | = | test_pool | +----+-----------+-----------+----+-----------+ 2 rows in set (0.00 sec) however with things set this way (I have a perl module defined to dump the various lists for debugging), Pool-Name does not get set: > (0) Wed Feb 10 15:47:11 2016: Debug: # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/peak > (0) Wed Feb 10 15:47:11 2016: Debug: post-auth { > (0) Wed Feb 10 15:47:11 2016: Debug: update { > (0) Wed Feb 10 15:47:11 2016: Debug: No attributes updated > (0) Wed Feb 10 15:47:11 2016: Debug: } # update = noop > (0) Wed Feb 10 15:47:11 2016: Debug: sql: EXPAND .query > (0) Wed Feb 10 15:47:11 2016: Debug: sql: --> .query > (0) Wed Feb 10 15:47:11 2016: Debug: sql: Using query template 'query' > (0) Wed Feb 10 15:47:11 2016: Debug: sql: EXPAND %{User-Name} > (0) Wed Feb 10 15:47:11 2016: Debug: sql: --> radtest-pool > (0) Wed Feb 10 15:47:11 2016: Debug: sql: SQL-User-Name set to 'radtest-pool' > (0) Wed Feb 10 15:47:11 2016: Debug: sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{Cleartext-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') > (0) Wed Feb 10 15:47:11 2016: Debug: sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radtest-pool', '', 'Access-Accept', '2016-02-10 15:47:11') > (0) Wed Feb 10 15:47:11 2016: Debug: sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radtest-pool', '', 'Access-Accept', '2016-02-10 15:47:11') > (0) Wed Feb 10 15:47:11 2016: Debug: sql: SQL query returned: success > (0) Wed Feb 10 15:47:11 2016: Debug: sql: 1 record(s) updated > (0) Wed Feb 10 15:47:11 2016: Debug: [sql] = ok > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'radtest-pool' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'User-Password'} = &request:User-Password -> 'password' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '69.59.217.117' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '15762707' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '12:34:56:78:90:03' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'plo-cr1' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Feb 10 2016 15:47:11 PST' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> 'ether3.1900' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'PAP' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_CHECK{'Cleartext-Password'} = &control:Cleartext-Password -> 'password' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'PAP' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: $RAD_CONFIG{'Cleartext-Password'} = &control:Cleartext-Password -> 'password' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '12:34:56:78:90:03' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'radtest-pool' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Feb 10 2016 15:47:11 PST' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'password' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'plo-cr1' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '69.59.217.117' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '15762707' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> 'ether3.1900' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &control:Cleartext-Password = $RAD_CHECK{'Cleartext-Password'} -> 'password' > (0) Wed Feb 10 15:47:11 2016: Debug: perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'PAP' > (0) Wed Feb 10 15:47:11 2016: Debug: [perl] = ok > (0) Wed Feb 10 15:47:11 2016: Debug: sqlippool: No Pool-Name defined > (0) Wed Feb 10 15:47:11 2016: Debug: sqlippool: EXPAND No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) > (0) Wed Feb 10 15:47:11 2016: Debug: sqlippool: --> No Pool-Name defined (did cli 12:34:56:78:90:03 port 15762707 user radtest-pool) > (0) Wed Feb 10 15:47:11 2016: Debug: [sqlippool] = noop > (0) Wed Feb 10 15:47:11 2016: Debug: } # post-auth = ok If I change the operator to ":=" (the "set it dammit no matter what" operator), it does the right thing: mysql> select * from radgroupcheck where groupname = 'test_pool'; +----+-----------+-----------+----+-----------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-----------+ | 41 | TEST_POOL | Auth-Type | := | PAP | | 42 | TEST_POOL | Pool-Name | := | test_pool | +----+-----------+-----------+----+-----------+ 2 rows in set (0.00 sec) > (0) Wed Feb 10 16:13:29 2016: Debug: post-auth { > (0) Wed Feb 10 16:13:29 2016: Debug: update { > (0) Wed Feb 10 16:13:29 2016: Debug: No attributes updated > (0) Wed Feb 10 16:13:29 2016: Debug: } # update = noop > (0) Wed Feb 10 16:13:29 2016: Debug: sql: EXPAND .query > (0) Wed Feb 10 16:13:29 2016: Debug: sql: --> .query > (0) Wed Feb 10 16:13:29 2016: Debug: sql: Using query template 'query' > (0) Wed Feb 10 16:13:29 2016: Debug: sql: EXPAND %{User-Name} > (0) Wed Feb 10 16:13:29 2016: Debug: sql: --> radtest-pool > (0) Wed Feb 10 16:13:29 2016: Debug: sql: SQL-User-Name set to 'radtest-pool' > (0) Wed Feb 10 16:13:29 2016: Debug: sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{Cleartext-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') > (0) Wed Feb 10 16:13:29 2016: Debug: sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radtest-pool', '', 'Access-Accept', '2016-02-10 16:13:29') > (0) Wed Feb 10 16:13:29 2016: Debug: sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'radtest-pool', '', 'Access-Accept', '2016-02-10 16:13:29') > (0) Wed Feb 10 16:13:29 2016: Debug: sql: SQL query returned: success > (0) Wed Feb 10 16:13:29 2016: Debug: sql: 1 record(s) updated > (0) Wed Feb 10 16:13:29 2016: Debug: [sql] = ok > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'radtest-pool' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'User-Password'} = &request:User-Password -> 'password' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '69.59.217.117' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '15762707' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '12:34:56:78:90:03' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'plo-cr1' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Feb 10 2016 16:13:29 PST' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> 'ether3.1900' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Service-Type'} = &reply:Service-Type -> 'Framed-User' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Framed-Protocol'} = &reply:Framed-Protocol -> 'PPP' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Framed-IP-Netmask'} = &reply:Framed-IP-Netmask -> '255.255.255.255' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Framed-MTU'} = &reply:Framed-MTU -> '1500' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Framed-Compression'} = &reply:Framed-Compression -> 'None' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_REPLY{'Mikrotik-Rate-Limit'} = &reply:Mikrotik-Rate-Limit -> '20M/10M' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'PAP' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CHECK{'Pool-Name'} = &control:Pool-Name -> 'test_pool' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CHECK{'Cleartext-Password'} = &control:Cleartext-Password -> 'password' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'PAP' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CONFIG{'Pool-Name'} = &control:Pool-Name -> 'test_pool' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: $RAD_CONFIG{'Cleartext-Password'} = &control:Cleartext-Password -> 'password' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '12:34:56:78:90:03' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'radtest-pool' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Feb 10 2016 16:13:29 PST' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:User-Password = $RAD_REQUEST{'User-Password'} -> 'password' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'plo-cr1' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '69.59.217.117' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '15762707' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> 'ether3.1900' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Framed-Protocol = $RAD_REPLY{'Framed-Protocol'} -> 'PPP' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Service-Type = $RAD_REPLY{'Service-Type'} -> 'Framed-User' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Mikrotik-Rate-Limit = $RAD_REPLY{'Mikrotik-Rate-Limit'} -> '20M/10M' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Framed-Compression = $RAD_REPLY{'Framed-Compression'} -> 'None' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Framed-IP-Netmask = $RAD_REPLY{'Framed-IP-Netmask'} -> '255.255.255.255' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &reply:Framed-MTU = $RAD_REPLY{'Framed-MTU'} -> '1500' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &control:Cleartext-Password = $RAD_CHECK{'Cleartext-Password'} -> 'password' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'PAP' > (0) Wed Feb 10 16:13:29 2016: Debug: perl: &control:Pool-Name = $RAD_CHECK{'Pool-Name'} -> 'test_pool' > (0) Wed Feb 10 16:13:29 2016: Debug: [perl] = ok > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND %{User-Name} > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> radtest-pool > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: SQL-User-Name set to 'radtest-pool' > (0) Wed Feb 10 16:13:29 2016: ERROR: sqlippool: Clear stale connections > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND START TRANSACTION > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> START TRANSACTION > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: START TRANSACTION > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND COMMIT > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> COMMIT > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: COMMIT > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND START TRANSACTION > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> START TRANSACTION > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: START TRANSACTION > (0) Wed Feb 10 16:13:29 2016: ERROR: sqlippool: allocate_find > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL or expiry_time = 0) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> SELECT framedipaddress FROM radippool WHERE pool_name = 'test_pool' AND (expiry_time < NOW() OR expiry_time IS NULL or expiry_time = 0) ORDER BY (username <> 'radtest-pool'), (callingstationid <> '12:34:56:78:90:03'), expiry_time LIMIT 1 FOR UPDATE > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing select query: SELECT framedipaddress FROM radippool WHERE pool_name = 'test_pool' AND (expiry_time < NOW() OR expiry_time IS NULL or expiry_time = 0) ORDER BY (username <> 'radtest-pool'), (callingstationid <> '12:34:56:78:90:03'), expiry_time LIMIT 1 FOR UPDATE > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Allocated IP 10.98.0.4 > (0) Wed Feb 10 16:13:29 2016: ERROR: sqlippool: allocate_update > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.98.0.4' > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> UPDATE radippool SET nasipaddress = '69.59.217.117', pool_key = '12:34:56:78:90:03', callingstationid = '12:34:56:78:90:03', username = 'radtest-pool', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.98.0.4' > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: UPDATE radippool SET nasipaddress = '69.59.217.117', pool_key = '12:34:56:78:90:03', callingstationid = '12:34:56:78:90:03', username = 'radtest-pool', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.98.0.4' > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND COMMIT > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> COMMIT > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: Executing query: COMMIT > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: EXPAND Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) > (0) Wed Feb 10 16:13:29 2016: Debug: sqlippool: --> Allocated IP: 10.98.0.4 from test_pool (did cli 12:34:56:78:90:03 port 15762707 user radtest-pool) > (0) Wed Feb 10 16:13:29 2016: Debug: [sqlippool] = ok > (0) Wed Feb 10 16:13:29 2016: Debug: } # post-auth = ok

2 2