- Freeradius-Users - lists.freeradius.org

Removal of built in OpenSSL TLS cache in v3.1.x
by Arran Cudbard-Bell 02 Feb '16

02 Feb '16

The built in OpenSSL TLS cache has been permanently disabled in v3.1.x as per https://github.com/FreeRADIUS/freeradius-server/issues/1493. The new TLS cache uses a virtual-server with different Autz-Type sections representing the different cache actions. The TLS session blob is made available in &session-state:TLS-Session-Data and the session ID is available in &TLS-Session-ID. Certificate attributes have been moved to the &session-state: list for easy caching. The tls-cache virtual server and cache_tls_module instance are included in the default config, and replicate the behaviour of the OpenSSL cache. The current cache drivers are: - memcached - redis - rbtree If people think it would be valuable, I have about 50% of an rlm_cache driver that stores cache entries using a file system, it can be prioritised for completion before v3.2.0 is released. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

TLS: warning: cacertdir not implemented for gnutls
by Will W. 01 Feb '16

01 Feb '16

Hey Guys, Did a fresh pull of freeradius 3.1.0 this morning on a new ubuntu 14.04 instance. Trying to get my LDAP configured and I am getting an error with TLS: warning: cacertdir not implemented for gnutls lm_ldap (ldap) - libldap vendor: OpenLDAP, version: 20431 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap) - Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 connect_timeout = 3.000000 retry_delay = 30 spread = no } rlm_ldap (ldap) - Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap) - Connecting to ldaps://ldap.myhost.com:636 TLS: gcry_control GCRYCTL_SET_RNDEGD_SOCKET failed TLS: warning: cacertdir not implemented for gnutls rlm_ldap (ldap) - Failed setting connection option new TLS context: Unknown error rlm_ldap (ldap) - Opening connection failed (0) rlm_ldap (ldap) - Removing connection pool /etc/freeradius/mods-enabled/ldap[8]: Instantiation failed for module "ldap" freeradius -X output http://pastebin.com/hg8TMXKn <http://pastebin.com/hg8TMXKn> I am trying to see if there is something I can change in freeradius while I am tracking it down on the gnutls as well. thanks Will

3 5

Requiring a valid user-group-groupcheck before sending a response
by Benjamin Oh 01 Feb '16

01 Feb '16

Is it possible to authenticate or deny a request based on the radgroupcheck and radusergroup being 'satisfied'? Basically I want to make sure that all 3 of the following are satisfied: 1) the user is in a proper group (radusergroup) 2) the request is coming from a valid IP (radgroupcheck using NAS-IP-Address) 3) the user/password is valid of course (radcheck) The issue I have is a user can supply a valid user/password combination, but not have the required group membership in radusergroup, but still be pass authentication which only looks at radcheck (user/password) and nothing else. My desire is to be able to isolate different environments by group and NAS-IP-Address. There may be a much more elegant way of getting this done, which I'm open to as well.

1 0

cui question FR 3.0.11
by Alex Sharaz 01 Feb '16

01 Feb '16

Hi, Just been browsing through my cui config on a FR 3.0.11 outward facing server and found the following accounting detail logging ...... FreeRADIUS-Acct-Session-Start-Time = "Feb 1 2016 09:39:17 GMT" Module-Failure-Message = "regex failed: Found null in subject at offset 18. String unsafe for evaluation" Module-Failure-Message = "Failed retrieving values required to evaluate condition" Acct-Unique-Session-Id = "0ab90a46c2f04499b46b7d9265696856" Stripped-User-Name = "jcm1k" Realm = "DEFAULT" SQL-User-Name = "jcm1k" Chargeable-User-Identity = 0x ........ So, 1). Module-Failure-Message - never seen this in a debug log before. Assuming its something specific to FR 3.x. What's it associated with? 2). Chargeable-User-Identity = 0x Should I see this or should I see the whole string? A

3 5

Freeradius 3.x For Openwrt, Please ?
by Bruno D'Ambrosio 01 Feb '16

01 Feb '16

Hi Mate I would like to know if it is already available FreeRADIUS 3.x for openwrt? By Bruno D'Ambrosio

2 2

v3.1.x - Directory specific admonitions
by Arran Cudbard-Bell 30 Jan '16

30 Jan '16

Added some basic directory fingerprinting... rlm_ldap (ldap) - Opening additional connection (0), 1 of 24 pending slots used rlm_ldap (ldap) - Connecting to ldap://192.168.43.57:389 rlm_ldap (ldap) - Waiting for bind result... rlm_ldap (ldap) - Bind successful rlm_ldap (ldap) - Performing search in "" with filter "(objectclass=*)", scope "base" rlm_ldap (ldap) - Waiting for search result... rlm_ldap (ldap) - Directory type: OpenLDAP if (!fr_pair_find_by_num(request->config, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY) && !fr_pair_find_by_num(request->config, 0, PW_NT_PASSWORD, TAG_ANY) && !fr_pair_find_by_num(request->config, 0, PW_USER_PASSWORD, TAG_ANY) && !fr_pair_find_by_num(request->config, 0, PW_PASSWORD_WITH_HEADER, TAG_ANY) && !fr_pair_find_by_num(request->config, 0, PW_CRYPT_PASSWORD, TAG_ANY)) { if (!inst->directory->cleartext_password) switch (inst->directory->type) { case LDAP_DIRECTORY_ACTIVE_DIRECTORY: RWDEBUG("!!! Found map between LDAP attribute and a FreeRADIUS password attribute"); RWDEBUG("!!! Active Directory does not allow passwords to be read via LDAP"); RWDEBUG("!!! Remove the password map and either:"); RWDEBUG("!!! - List %s in the authenticate section, and set attribute " "&control:Auth-Type := '%s' (pap only)", inst->name, inst->name); RWDEBUG("!!! - Configure authentication via ntlm_auth (mschapv2 only)"); RWDEBUG("!!! - Configure authentication via wbclient (mschapv2 only)"); break; case LDAP_DIRECTORY_EDIRECTORY: RWDEBUG("!!! Found map between LDAP attribute and a FreeRADIUS password attribute"); RWDEBUG("!!! eDirectory does not allow passwords to be retrieved via LDAP search"); RWDEBUG("!!! Remove the password map and either:"); RWDEBUG("!!! - Set 'edir = yes' and enable the universal password feature on your " "eDir server (recommended)"); RWDEBUG("!!! - List %s in the authenticate section, and set attribute " "&control:Auth-Type := '%s' (pap only)", inst->name, inst->name); break; default: no_password: if (!inst->admin_identity) { RWDEBUG("No \"known good\" password added. Ensure \"%s\" has permission to " "read the user's password attribute", inst->admin_identity); } else { RWDEBUG("No \"known good\" password added. Set 'identity' to the dn of an " "account that has permission to read the user's password attribute"); } break; } else goto no_password; } The first user to post either of those messages to the list earns an instaban ;) -Arran

1 0

trying to get PAP-inside-TTLS working for PAM
by Michael Martinez 29 Jan '16

29 Jan '16

I am running freeradius-2.1.12. According to the last post of the following thread - http://lists.freeradius.org/pipermail/freeradius-users/2013-February/064927… - it is possible to get radius to authenticate against PAM by configuring it to use PAP inside of TTLS. The first and final posts of that thread provide the configuration that the poster used to get it working. In /etc/freeradius/users, I have DEFAULT Auth-Type := PAM In /etc/pam.d/radiusd, I have the following: ## auth requisite /lib/arm-linux-gnueabihf/security/pam_google_authenticator.so secret=/home/${USER}/.google_authenticator nullok forward_pass auth sufficient pam_ldap.so use_first_pass auth required pam_unix.so use_first_pass ## In /etc/pam.d/sshd, I have the following lines immediately before the usual @include common-auth line: auth sufficient pam_radius_auth.so # Additionally, I have mimick'ed the configuration given in the aforementioned thread - the the eap.conf changes, and sites-enabled changes. This configuration works perfectly for ssh clients. It works for both ldap users and local unix users who ssh in from another linux box. I can see in /var/log/auth.log and the radius debug log that the user's verfication code is being checked and that their password is being checked against ldap. But this setup is not working for network devices such as iPad, that are connecting to a wireless access point, and trying to login with an ldap user. Said network devices do work but only for users explicitly given in the /etc/freeradius/users file with a plaintext password attribute. The wireless device is configured to use PAP inside TTLS, as per instructions here: http://cloudessa.com/tips-and-tricks/how-to-setup-eap-ttls-with-inner-pap-o… Freeradius debug log: EAP-Message = 0x0201000a017465737432 Message-Authenticator = 0xe3e9b79324821a27d40811ef6a24de9a Fri Jan 22 23:43:36 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Fri Jan 22 23:43:36 2016 : Info: +- entering group authorize {...} Fri Jan 22 23:43:36 2016 : Info: ++[preprocess] returns ok Fri Jan 22 23:43:36 2016 : Info: ++[chap] returns noop Fri Jan 22 23:43:36 2016 : Info: ++[mschap] returns noop Fri Jan 22 23:43:36 2016 : Info: ++[digest] returns noop Fri Jan 22 23:43:36 2016 : Info: [suffix] No '@' in User-Name = "test2", looking up realm NULL Fri Jan 22 23:43:36 2016 : Info: [suffix] No such realm "NULL" Fri Jan 22 23:43:36 2016 : Info: ++[suffix] returns noop Fri Jan 22 23:43:36 2016 : Info: [eap] EAP packet type response id 1 length 10 Fri Jan 22 23:43:36 2016 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri Jan 22 23:43:36 2016 : Info: ++[eap] returns updated Fri Jan 22 23:43:36 2016 : Info: [files] users: Matched entry DEFAULT at line 216 Fri Jan 22 23:43:36 2016 : Info: ++[files] returns ok Fri Jan 22 23:43:36 2016 : Info: ++[expiration] returns noop Fri Jan 22 23:43:36 2016 : Info: ++[logintime] returns noop Fri Jan 22 23:43:36 2016 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Fri Jan 22 23:43:36 2016 : Info: ++[pap] returns noop Fri Jan 22 23:43:36 2016 : Info: Found Auth-Type = PAM Fri Jan 22 23:43:36 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri Jan 22 23:43:36 2016 : Info: +- entering group authenticate {...} Fri Jan 22 23:43:36 2016 : Auth: rlm_pam: Attribute "User-Password" is required for authentication. Fri Jan 22 23:43:36 2016 : Info: ++[pam] returns invalid Fri Jan 22 23:43:36 2016 : Info: Failed to authenticate the user. Fri Jan 22 23:43:36 2016 : Info: Using Post-Auth-Type Reject Fri Jan 22 23:43:36 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Fri Jan 22 23:43:36 2016 : Info: +- entering group REJECT {...} - Michael Martinez -- ---

3 3

Trouble with unlang
by azander 29 Jan '16

29 Jan '16

Greetings, I am having troubles wrapping my hear around the unlang concepts to make this work. Situation: My company just merged with another that is also using freeradius, though they are using 2.x instead of 3.x. We were in the process of upgrading ours to 3.x when this merger was announced internally. I am tasked with merging the radius system. Here is what I need. In proxy.conf we have 4 needed realms, each using a different virtual_server. I have the following: realm company1.org { virtual_server = company1 } realm company2.net { virtual_server = company2 } realm company3.net { virtual_server = accept } realm company4.com { virtual_server = reject } realm NULL { virtual_server = company1 } realm DEFAULT { virtual_server = default ##duplicate of company1's file for now. } I have each of the virtual servers listening on different ports and only listing on ip 127.0.0.1. Examples: company1: 9990,9991, company2: 9992,9993, etc The main server listens to ports 1812,1813. I need the accept virtual_server to accept anything sent to it. I need the reject virtual_server to reject all sent to it. company1 has realm and non-realm users, using Stripped-User-Name for final lookup to the database. Company2 always has the realm on it, and can be configured to use stripped or non-stripped usernames when going to the database. So far company1 and company2 work, but when I add company3 and company4, things start working very strangely. When I use radtest to query the server for company3 I get a result: (0) Expected Access-Accept got Access-Reject I am assuming I have my server config messed up, but I won't count on that being the issue. Any help would be appreciated. My accept and reject virtual servers are pretty basic and are almost identical. Below is my accept server config: # server accept { listen { type = auth ipaddr = * port = 9992 limit { max_connections = 16 lifetime = 0 idle_timeout = 120 } } listen { ipaddr = * port = 9993 type = acct limit { } } authorize { update control { &Auth-Type := Accept } } authenticate { Auth-Type CHAP { chap } } preacct { preprocess acct_unique suffix files } accoutning { detail unix -sql if (noop) { ok } attr_fileter.account_response } session { } post_auth { replay_log -sql Post-Auth-Type REJECT { -sql attr_filter.access_reject } } pre-proxy { } post-proxy { eap } }

3 2

RE: Index is not an integer (segfault)
by Franks Andy (IT Technical Architecture Manager) 29 Jan '16

29 Jan '16

Hi all, A segfault report sorry. Arran and Alan Dekok kindly helped me here with expanding variables from dynamic indexes, which works fine, as long as the variable is plugged into a string value. I'm trying to retrieve an integer value in the same way. Ideally, I'd like to expand in an if statement and compare, i.e. if ( "%{xlat:control:Tmp-Integer-1[%{control:Tmp-Integer-0}]}" > 1 ), rather than plug into a variable and then compare there, but maybe that's a step too far? It works fine plugging the variable into a string, xlat seems to cast fine, even if we do an if ("%{xlat:control:Tmp-String-1[%{control:Tmp-Integer-0}]}" > 1 ), so the workaround is obvious, just thought I'd best let you know about the seg anyway. Thanks Andy map sql_SP_rsh-radius-lant &control:Tmp-String-0 { control:Tmp-string-1 += tmp_acctuniqueid control:Tmp-string-2 += tmp_acctsessionid control:Tmp-string-3 += tmp_username control:Tmp-string-4 += tmp_devicetype control:Tmp-Integer-1+= tmp_macaddresslimit control:Tmp-string-5 += tmp_accounttable } update control { Tmp-Integer-0 := 0 Tmp-String-6 := "%{xlat:control:Tmp-Integer-1[%{control:Tmp-Integer-0}]}" } (0) Executing select query: call get_active_sessions_for_switchport ('192.168.105.86', '1', 864000) (0) control:Tmp-string-1 += 2863e8aa72426a2af96f7af0ef7ebdb9 (0) control:Tmp-string-2 += 000E000000E1 (0) control:Tmp-string-3 += 20b399f37010 (0) control:Tmp-string-4 += AP (0) control:Tmp-Integer-1 += 32 (0) control:Tmp-string-5 += radacct_lan0 (0) control:Tmp-string-1 += 4685a44565edf4d8aae476f8ed3b0ab9 (0) control:Tmp-string-2 += 000E0000009C (0) control:Tmp-string-3 += 20b399f37010 (0) control:Tmp-string-4 += AP (0) control:Tmp-Integer-1 += 32 (0) control:Tmp-string-5 += radacct_lan0 rlm_sql (sql_SP_rsh-radius-lant): Released connection (0) rlm_sql (sql_SP_rsh-radius-lant): Need 4 more connections to reach 3 spares rlm_sql (sql_SP_rsh-radius-lant): Opening additional connection (1), 1 of 9 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on rsh-radius-sql via TCP/IP, server version 5.5.31-0ubuntu0.13.04.1, protocol version 10 (0) } # map sql_SP_rsh-radius-lant &control:Tmp-String-0 (updated) (0) update control { (0) Tmp-Integer-0 := 0 Program received signal SIGSEGV, Segmentation fault. 0x00007ffff6839301 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 (gdb) bt #0 0x00007ffff6839301 in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007ffff70f78d9 in talloc_strdup () from /usr/lib/x86_64-linux-gnu/libtalloc.so.2 #2 0x00007ffff7951c3d in talloc_typed_strdup (t=0xd4d210, p=0x20 <Address 0x20 out of bounds>) at src/lib/missing.c:592 #3 0x00007ffff7bc087e in xlat_tokenize_request (request=0xd4d210, fmt=0x20 <Address 0x20 out of bounds>, head=0x7fffffffd100) at src/main/xlat.c:1812 #4 0x00007ffff7bc2522 in xlat_expand (out=0x7fffffffd148, outlen=2048, request=0xd4d210, fmt=0x20 <Address 0x20 out of bounds>, escape=0x0, escape_ctx=0x0) at src/main/xlat.c:2567 #5 0x00007ffff7bc2860 in radius_xlat (out=0xdc2c90 "", outlen=2048, request=0xd4d210, fmt=0x20 <Address 0x20 out of bounds>, escape=0x0, ctx=0x0) at src/main/xlat.c:2645 #6 0x00007ffff7bbd634 in xlat_xlat (out=0x7fffffffd200, outlen=2048, mod_inst=0x0, xlat_inst=0x0, request=0xd4d210, fmt=0xdc2c10 "control:Tmp-Integer-1[0]") at src/main/xlat.c:634 #7 0x00007ffff7bc1e3f in xlat_aprint (ctx=0xd4d210, request=0xd4d210, node=0xd20950, escape=0x0, escape_ctx=0x0, lvl=0) at src/main/xlat.c:2358 #8 0x00007ffff7bc2131 in xlat_process (out=0x7fffffffd380, request=0xd4d210, head=0xd20950, escape=0x0, escape_ctx=0x0) at src/main/xlat.c:2445 #9 0x00007ffff7bc243a in xlat_expand_struct (out=0x7fffffffd448, outlen=0, request=0xd4d210, node=0xd20950, escape=0x0, escape_ctx=0x0) at src/main/xlat.c:2517 #10 0x00007ffff7bc2932 in radius_axlat_struct (out=0x7fffffffd448, request=0xd4d210, xlat=0xd20950, escape=0x0, ctx=0x0) at src/main/xlat.c:2660 #11 0x00007ffff7babe3f in map_to_vp (ctx=0xd4d210, out=0x7fffffffd520, request=0xd4d210, map=0xce17d0, uctx=0x0) at src/main/map.c:813 #12 0x00007ffff7bace48 in map_to_request (request=0xd4d210, map=0xce17d0, func=0x7ffff7baba77 <map_to_vp>, ctx=0x0) at src/main/map.c:1137 #13 0x00000000004318c6 in modcall_update (request=0xd4d210, stack=0x7fffffffd810, presult=0x7fffffffd7b0, priority=0x7fffffffd7ac) at src/main/interpreter.c:587 #14 0x00000000004320e0 in modcall_recurse (request=0xd4d210, stack=0x7fffffffd810, presult=0x7fffffffd80c, ppriority=0x7fffffffd808) at src/main/interpreter.c:839 #15 0x00000000004324ee in modcall (component=MOD_AUTHORIZE, c=0xcbdde0, request=0xd4d210) at src/main/interpreter.c:1001 #16 0x0000000000427e2a in indexed_modcall (comp=MOD_AUTHORIZE, idx=0, request=0xd4d210) at src/main/modules.c:977 #17 0x000000000042a0c3 in process_authorize (autz_type=0, request=0xd4d210) at src/main/modules.c:2108 #18 0x000000000040fd07 in rad_authenticate (request=0xd4d210) at src/main/auth.c:435 #19 0x000000000043b6d5 in request_running (request=0xd4d210, action=1) at src/main/process.c:1482 #20 0x000000000043a3db in request_queue_or_run (request=0xd4d210, process=0x43b573 <request_running>) at src/main/process.c:953 #21 0x000000000043bff1 in request_receive (ctx=0xd4cf10, listener=0xb01310, packet=0xd4cf70, client=0xae51e0, fun=0x40fa64 <rad_authenticate>) at src/main/process.c:1739 #22 0x0000000000419d1a in auth_socket_recv (listener=0xb01310) at src/main/listen.c:1901 #23 0x00000000004431be in event_socket_handler (xel=0xd3ef70, fd=12, ctx=0xb01310) at src/main/process.c:4542 #24 0x00007ffff7970044 in fr_event_loop (el=0xd3ef70) at src/lib/event.c:637 #25 0x00000000004450b2 in radius_event_process () at src/main/process.c:5585 #26 0x0000000000433103 in main (argc=2, argv=0x7fffffffe6d8) at src/main/radiusd.c:586

6 15

FreeRadius DHCP Performance
by O'Connell, Ryan 28 Jan '16

28 Jan '16

Curious if any has ballpark figures for any testing they have done with a "stand alone” FreeRadius DHCP server (3.0.10). I have setup a host with a local instance of MySQL (FR & MySQL on same Cent7 host) as well as FR pointing to a “physical” MySQL server with a massive amount of resources and write capability via a SAN. Irrespective of this, I seem to be topping out at 3 req/sec which seems strange. When the server starts to fail, I start seeing errors like: Sat Jan 23 12:19:51 2016 : ERROR: (60870) dhcp_sqlippool: ERROR: rlm_sql_mysql: ERROR 1205 (Lock wait timeout exceeded; try restarting transaction): HY000 Sat Jan 23 12:19:51 2016 : WARNING: (60870) WARNING: Module rlm_sqlippool became unblocked for request 60870 Consistent with the errors in the radius log, the MySQL log has errors similar to this. 2016-01-23 12:19:52 7270 [ERROR] /usr/sbin/mysqld: Sort aborted: Lock wait timeout exceeded; try restarting transaction 2016-01-23 12:19:52 7270 [ERROR] /usr/sbin/mysqld: Lock wait timeout exceeded; try restarting transaction I’ve tried adjusting the number of servers up and down from tens to hundreds (I know this isn’t a solution per se but just commenting that this has been done) while also adjusting my.cnf and sysctl (open files / processes) but the behavior is the same. I have also tried moving the MySQL data to a ramdisk since this is just a test but irrespective of whether a high I/) SAN or ramdisk is used, the performance is the same. Has anyone achieved better performance than this? I found comments from the past talking about the mac2ip performance being really high but I can’t seem to figure out what I’m missing to make dhcp_sqlippool go faster. I’m using “dhcperf” as the test but have also tried other simulators. Here’s the server startup. There is no selection logic so just a single pool. update control { &Pool-Name := “test" } [root@dhcp01 raddb]# /usr/sbin/radiusd -X Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/dhcp_sqlippool including configuration file /etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/dhcp including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/dhcp main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 3 max_requests = 100000 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached radiusd: #### Instantiating modules #### # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_sqlippool # Loading module "dhcp_sqlippool" from file /etc/raddb/mods-enabled/dhcp_sqlippool sqlippool dhcp_sqlippool { sql_module_instance = "sql" lease_duration = 7200 pool_name = "" default_pool = "main_pool" allocate_begin = "START TRANSACTION" allocate_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NOW() WHERE expiry_time <= NOW() - INTERVAL 1 SECOND" allocate_find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (callingstationid = '%{Calling-Station-Id}' or callingstationid = '') ORDER BY (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate_update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 7200 SECOND WHERE framedipaddress = '%I'" allocate_commit = "COMMIT" pool_check = "" start_begin = "START TRANSACTION" start_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 7200 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start_commit = "COMMIT" alive_begin = "START TRANSACTION" alive_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 7200 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive_commit = "COMMIT" stop_begin = "START TRANSACTION" stop_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NOW() WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop_commit = "COMMIT" on_begin = "START TRANSACTION" on_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NOW() WHERE nasipaddress = '%{Nas-IP-Address}'" on_commit = "COMMIT" off_begin = "START TRANSACTION" off_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NOW() WHERE nasipaddress = '%{Nas-IP-Address}'" off_commit = "COMMIT" messages { } } # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' OR (NOT EXISTS (select 1 from radreply where username='%{SQL-User-Name}') AND username='DEFAULT-SF') ORDER BY priority" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = ".query" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group instantiate { } modules { # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "dhcp_sqlippool" from file /etc/raddb/mods-enabled/dhcp_sqlippool # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 5.6.27 mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 50 min = 15 max = 64 spare = 35 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 64 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 63 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 62 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 61 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 60 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (5), 1 of 59 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (6), 1 of 58 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (7), 1 of 57 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (8), 1 of 56 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (9), 1 of 55 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (10), 1 of 54 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (11), 1 of 53 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (12), 1 of 52 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (13), 1 of 51 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (14), 1 of 50 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (15), 1 of 49 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (16), 1 of 48 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (17), 1 of 47 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (18), 1 of 46 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (19), 1 of 45 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (20), 1 of 44 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (21), 1 of 43 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (22), 1 of 42 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (23), 1 of 41 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (24), 1 of 40 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (25), 1 of 39 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (26), 1 of 38 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (27), 1 of 37 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (28), 1 of 36 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (29), 1 of 35 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (30), 1 of 34 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (31), 1 of 33 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (32), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (33), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (34), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (35), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (36), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (37), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (38), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (39), 1 of 25 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (40), 1 of 24 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (41), 1 of 23 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (42), 1 of 22 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (43), 1 of 21 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (44), 1 of 20 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (45), 1 of 19 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (46), 1 of 18 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (47), 1 of 17 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (48), 1 of 16 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 rlm_sql (sql): Opening additional connection (49), 1 of 15 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.6.27, protocol version 10 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server dhcp { # from file /etc/raddb/sites-enabled/dhcp # Loading dhcp DHCP-Discover {...} # Loading dhcp DHCP-Request {...} # Loading dhcp DHCP-Decline {...} # Loading dhcp DHCP-Inform {...} # Loading dhcp DHCP-Release {...} # Loading dhcp DHCP-Lease-Query {...} } # server dhcp radiusd: #### Opening IP addresses and Ports #### listen { type = "dhcp" ipaddr = 0.0.0.0 port = 67 src_ipaddr = 10.88.198.13 } Listening on dhcp interface eth1.3118 address * port 67 bound to server dhcp Ready to process requests

4 4