- Freeradius-Users - lists.freeradius.org

erx router and coa requests
by Bill Schoolfield 20 Nov '15

20 Nov '15

Hi All, This isn't freeradius specific per se but I can't find anything on the web about this. Maybe someone here has experience with this. I'm trying to drop a session using radclient: Sending Disconnect-Request of id 169 to 204.101.13.1 port 1700 User-Name = "someid(a)example.com" Acct-Session-Id = "erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002" rad_recv: Disconnect-NAK packet from host 204.101.13.1 port 1700, id=169, length=26 Error-Cause = Session-Context-Not-Found But regardless of what I try I can't seem to send the right attrs to get (ie. find) an active session dropped. The NAS is a Juniper Edge Routing Switch ERX-310. Best I can tell I have the right attrs. Including others results in Unsupported attr error. Omitting either of these two results in attr missing error. Does anybody know the what should be passed? Here is the radacct record for the session: radacctid: 959301 acctsessionid: erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002 acctuniqueid: d0c22edd21381824 username: someid(a)example.com groupname: realm: nasipaddress: 204.101.13.1 nasportid: 124498 nasporttype: Virtual acctstarttime: 2015-11-19 10:28:55 acctstoptime: NULL acctsessiontime: 3600 acctauthentic: RADIUS connectinfo_start: connectinfo_stop: NULL acctinputoctets: 6638966 acctoutputoctets: 140935633 calledstationid: callingstationid: GigabitEthernet 5/0/4.1300052:130-52=23587452684=2 acctterminatecause: servicetype: Framed-User framedprotocol: PPP framedipaddress: 204.101.88.246 acctstartdelay: 0 acctstopdelay: NULL xascendsessionsvrkey: Bill

3 6

IP Allocation FAILED : Best practice for inserting new IPs into mysql
by Sophie Loewenthal 20 Nov '15

20 Nov '15

Hi, Please find attached a debug of 62 lines. My ippool seems full: [sqlippool] pool appears to be full [sqlippool] expand: IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> IP Allocation FAILED from proximus-carli (did proximus.trimbletl.com cli 32770XXXX port 29449 user 45486XXXXX) How could I check if the ippool had run out of IPs or was close to? I tried with these but clearly this was not good enough . Is there a better method of currently allocated addresses? mysql> select count(*) from radippool where username = ''; +----------+ | count(*) | +----------+ | 383727 | +----------+ and with, mysql> select count(*) from radippool where expiry_time is NULL ; +----------+ | count(*) | +----------+ | 396466 | +----------+ I am surprised this filled up, because we don't have enough devices to fill up our IP space. What could happen if NAS did not send back accounting stop packets? Can I add more IP addresses into radippol with FreeRADIUS running, or should I shut down FreeRADIUS during this insert? Kind regards, Sophie

4 10

Hoping to understand a little more on mysql table radippool ( ippool.conf )
by Sophie Loewenthal 20 Nov '15

20 Nov '15

Hi, I am interested to know under what circumstances would an IP address have a username assigned and with most other attributes empty or NULL? e.g *mysql> select * from radippool where username = '10000078e' ; id pool_name framedipaddress nasipaddress calledstationid callingstationid expiry_time username pool_key 3GPP_Imsi 392053, vodafone, 10.26.7.134,,,, NULL, 10000078e, 0, * *mysql> select * from radippool where username = '10000078e' ;* id pool_name framedipaddress nasipaddress calledstationid callingstationid expiry_time username pool_key 3GPP_Imsi 392053 vodafone 10.26.7.134 NULL 10000078e 0 mysql> select count(*) from radippool where expiry_time is NULL and username != '' ; +----------+ | count(*) | +----------+ | 12797 | +----------+ Kind regards, Sophie

2 1

Stack trace of crash with FR 3.0.10
by Sebastian Hagedorn 20 Nov '15

20 Nov '15

Hi, we've been running FR 3.0.10 in production for about a month now. We have four production servers on RHEL 6. Every few days one of the radiusd processes quits without an error message. We have now enabled the panic action and installed the debuginfo RPMs. Last night we got the first usable gbd.log. Here's the relevant part: Thread 4 (Thread 0x7f8b6cb36700 (LWP 9823)): #0 0x0000003a1ae0cdab in pthread_once () from /lib64/libpthread.so.0 No symbol table info available. #1 0x0000003a1aafea04 in backtrace () from /lib64/libc.so.6 No symbol table info available. #2 0x0000003a1aa7054b in __libc_message () from /lib64/libc.so.6 No symbol table info available. #3 0x0000003a1aa75e66 in malloc_printerr () from /lib64/libc.so.6 No symbol table info available. #4 0x0000003a1aa799a4 in _int_malloc () from /lib64/libc.so.6 No symbol table info available. #5 0x0000003a1aa7a3e6 in calloc () from /lib64/libc.so.6 No symbol table info available. #6 0x0000003a1a60addf in _dl_new_object () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #7 0x0000003a1a6071de in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #8 0x0000003a1a60839a in _dl_map_object () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #9 0x0000003a1a612b95 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #10 0x0000003a1a60e286 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #11 0x0000003a1a61263a in _dl_open () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #12 0x0000003a1ab26cd0 in do_dlopen () from /lib64/libc.so.6 No symbol table info available. #13 0x0000003a1a60e286 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #14 0x0000003a1ab26e27 in __libc_dlopen_mode () from /lib64/libc.so.6 No symbol table info available. #15 0x0000003a1aafe8d5 in init () from /lib64/libc.so.6 No symbol table info available. #16 0x0000003a1ae0cdb3 in pthread_once () from /lib64/libpthread.so.0 No symbol table info available. #17 0x0000003a1aafea04 in backtrace () from /lib64/libc.so.6 No symbol table info available. #18 0x0000003a1aa7054b in __libc_message () from /lib64/libc.so.6 No symbol table info available. #19 0x0000003a1aa75e66 in malloc_printerr () from /lib64/libc.so.6 No symbol table info available. #20 0x0000003a1aa789ba in _int_free () from /lib64/libc.so.6 No symbol table info available. #21 0x0000003a20202389 in ?? () from /usr/lib64/libtalloc.so.2 No symbol table info available. #22 0x000000396dc15dbc in fr_pair_value_strsteal (vp=0x7f8b48732dc0, src=0x7f8b4874f5e0 "leap:session-key=\200hl\240:l\236\255t\256\247\366Z\315%f\233\220q~\343-\207VΟ\334\366N%i\372p\274Q\242\243\232ީ/\257\362\315\376f\344\067>0\356\262\v\233\343\240\344pH\213\177") at /usr/src/debug/freeradius-server-3.0.10/src/lib/pair.c:2125 q = <value optimized out> #23 0x00007f8b751ac8da in mod_post_proxy (inst=0x19c0c60, request=0x1c6c590) at /usr/src/debug/freeradius-server-3.0.10/src/modules/rlm_eap/rlm_eap.c:675 i = 34 len = 130 p = 0x7f8b4874f5e0 "leap:session-key=\200hl\240:l\236\255t\256\247\366Z\315%f\233\220q~\343-\207VΟ\334\366N%i\372p\274Q\242\243\232ީ/\257\362\315\376f\344\067>0\356\262\v\233\343\240\344pH\213\177" vp = 0x7f8b48732dc0 handler = <value optimized out> cursor = {first = 0x1c170d8, found = 0x7f8b48732dc0, last = 0x0, current = 0x7f8b48732dc0, next = 0x7f8b48708160} #24 0x0000000000425f4f in call_modsingle (request=0x1c6c590, component=MOD_POST_PROXY, depth=1, entry=0x7f8b6cb359c8, do_next_sibling=true) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:302 blocked = <value optimized out> indent = 4 #25 modcall_recurse (request=0x1c6c590, component=MOD_POST_PROXY, depth=1, entry=0x7f8b6cb359c8, do_next_sibling=true) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:574 sp = 0x1a672f0 if_taken = false was_if = false c = <value optimized out> priority = <value optimized out> result = RLM_MODULE_OK #26 0x00000000004267ba in modcall_child (request=<value optimized out>, component=<value optimized out>, depth=<value optimized out>, entry=0x7f8b6cb359b0, c=<value optimized out>, result=0x7f8b6cb3580c, do_next_sibling=true) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:408 next = 0x7f8b6cb359c8 #27 0x0000000000425575 in modcall_recurse (request=0x1c6c590, component=MOD_POST_PROXY, depth=0, entry=0x7f8b6cb359b0, do_next_sibling=true) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:785 g = 0x1a67150 if_taken = false was_if = false c = <value optimized out> priority = <value optimized out> result = RLM_MODULE_UNKNOWN #28 0x0000000000426753 in modcall (component=<value optimized out>, c=<value optimized out>, request=<value optimized out>) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:1130 stack = {{result = RLM_MODULE_NOOP, priority = 0, unwind = 0, c = 0x1a67150}, {result = RLM_MODULE_OK, priority = 3, unwind = 0, c = 0x1a672f0}, {result = 1823693344, priority = 32651, unwind = 29811200, c = 0x0}, {result = 1841447521, priority = 57, unwind = 1823693888, c = 0x3a1d2e8029}, {result = RLM_MODULE_FAIL, priority = 0, unwind = 490166044, c = 0x7f8b48708160}, {result = 1215624496, priority = 32651, unwind = 3, c = 0x1d5}, {result = 24099536, priority = 0, unwind = 1823693448, c = 0x7f8b480008c0}, {result = 24099488, priority = 0, unwind = 24099536, c = 0x3a1d2e7e92}, {result = 1823693504, priority = 32651, unwind = 489586107, c = 0x0}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 0, c = 0x7f8b6cb35d20}, {result = 11, priority = 32651, unwind = 489586811, c = 0x0}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 9, c = 0x2}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 176, c = 0x0}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 0, c = 0x3200000009}, {result = 91, priority = 124, unwind = 119, c = 0x396dc2f86a}, {result = 1215353712, priority = 32651, unwind = 129, c = 0x7f8b48000020}, {result = 29454432, priority = 0, unwind = 1823693888, c = 0x7f8b6cb35c40}, {result = 4382876, priority = 0, unwind = 1215353712, c = 0xe6dfd36399d685d1}, {result = 49, priority = 0, unwind = 29454432, c = 0x1c1727c}, {result = 29811200, priority = 0, unwind = 29454432, c = 0x7f8b6cb35c40}, {result = 1823693888, priority = 32651, unwind = 1841429743, c = 0x3}, {result = RLM_MODULE_HANDLED, priority = 0, unwind = 1823693888, c = 0x10}, {result = RLM_MODULE_USERLOCK, priority = 0, unwind = 26404800, c = 0x8}, {result = 1841415815, priority = 57, unwind = 8, c = 0x7f8b589caf50}, {result = 1841506360, priority = 57, unwind = 1486663584, c = 0x0}, {result = 1843648576, priority = 57, unwind = 1843648576, c = 0x3a20202389}, {result = 1486663584, priority = 32651, unwind = 27885456, c = 0x0}, {result = 1486663584, priority = 32651, unwind = 1843648576, c = 0x396dc20f10}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 1486663584, c = 0x1a97f90}, {result = 27852576, priority = 0, unwind = 29811200, c = 0x1}, {result = 1823693984, priority = 32651, unwind = 1516734484, c = 0x7f8b6cb35ce0}, {result = 4323808, priority = 0, unwind = 1823694016, c = 0x1c6c590}} #29 0x000000000041fd95 in indexed_modcall (comp=MOD_POST_PROXY, idx=0, request=0x1c6c590) at /usr/src/debug/freeradius-server-3.0.10/src/main/modules.c:1009 rcode = <value optimized out> list = 0x1a67150 server = 0x1a5df00 #30 0x000000000042e8f3 in process_proxy_reply (request=0x1c6c590, reply=0x1c17060) at /usr/src/debug/freeradius-server-3.0.10/src/main/process.c:2394 rcode = <value optimized out> post_proxy_type = <value optimized out> vp = <value optimized out> #31 0x00000000004354c9 in proxy_running (request=0x1c6c590, action=<value optimized out>) at /usr/src/debug/freeradius-server-3.0.10/src/main/process.c:2741 __FUNCTION__ = "proxy_running" #32 0x000000000042cb4a in request_handler_thread (arg=0x16fbaa0) at /usr/src/debug/freeradius-server-3.0.10/src/main/threads.c:690 self = 0x16fbaa0 #33 0x0000003a1ae07a51 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #34 0x0000003a1aae89ad in clone () from /lib64/libc.so.6 No symbol table info available. As far as we have been able to discern, previous crashes didn't all occur in post-proxy. The same user authenticated successfully before, so it also doesn't seem to related to that specific user. I will post future backtraces if they offer new evidence. Please let me know if additional info would be helpful. -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

3 7

v3, passwords, and auth-type
by Alan Batie 20 Nov '15

20 Nov '15

I'm trying to get v3.0.9 working and running into something that seems mutually exclusive: PAP seems to require Cleartext-Password and then complain that it's not getting User-Password? Also, and probably more important, it seems to be ignoring my Auth-Type Local configuration.... excerpt from site file: authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } Auth-Type Local { pap } Relevant sections from debug output in the different cases: With Cleartext-Password and Auth-Type Local: (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = Local (0) Auth-Type sub-section not found. Ignoring. With Cleartext-Password and Auth-Type PAP: (1) [sql] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = ok (1) Found Auth-Type = PAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/peak (1) Auth-Type PAP { (1) pap: ERROR: You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute! (1) [pap] = invalid (1) } # Auth-Type PAP = invalid (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject With User-Password and Auth-Type PAP: (4) [sql] = ok (4) [expiration] = noop (4) [logintime] = noop (4) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (4) pap: WARNING: !!! Ignoring control:User-Password. Update your !!! (4) pap: WARNING: !!! configuration so that the "known good" clear text !!! (4) pap: WARNING: !!! password is in Cleartext-Password and NOT in !!! (4) pap: WARNING: !!! User-Password. !!! (4) pap: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (4) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (4) pap: WARNING: Authentication will fail unless a "known good" password is available (4) [pap] = noop (4) } # authorize = ok (4) Found Auth-Type = PAP (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/peak (4) Auth-Type PAP { (4) pap: Login attempt with password (4) pap: No password configured for the user. Cannot do authentication (4) [pap] = fail (4) } # Auth-Type PAP = fail (4) Failed to authenticate the user (4) Using Post-Auth-Type Reject

3 3

Mysql radius.radacct trying to clean up
by Sophie Loewenthal 19 Nov '15

19 Nov '15

Hi, Our radacct table in mysql reached 11 million rows and we don't need this information. Would it be safe if I stopped FreeRadius, mysql: truncate radius.radacct; started FreeRadius? How would this affect the active sessions with Radius (e.g those who had accounting records sent back after the table had been truncated )? Versions: freeradius-mysql-2.1.12-1.el6.x86_64 freeradius-utils-2.1.12-1.el6.x86_64 freeradius-2.1.12-1.el6.x86_64 Kind regards, Sophie

3 4

Re: 3com user level no applied
by Scott Reeve 18 Nov '15

18 Nov '15

What version of comware? Probably needs another attribute in the Access-Accept: IETF Login-Service = 0 or 50 (0 for telnet, 50 for SSH) On 11/13/15, Alessandro Daudt<alessandro(a)i360.net.br> wrote: Hello I am setting the radius to authenticate switches 3com 4500 when I put User and Password logo perfectly however the level of User is not applied Sending Access-Accept id of 20 to xxxx port 5001 3Com-User-Access-Level = 3Com Administrator [cid:image002.png@01D0D386.33E023B0] ALESSANDRO DAUDT Engenheiro Eletricista CREA RS213418 Infraestrutura & Engenharia Rua Saldanha Marinho, 383 - Novo Hamburgo - RS [1]alessandro(a)i360.net.br<[2]mailto:alessandro@i360.net.br>| [3]www.i360tecnologia.com.br Tel. +55 51 3065-2207 | Cel. +55 51 9865-2359 [driver?nimlet=download&fid=INBOX&mid=136527&partIndex=0.3&disp=inline] alessandro.daudt __________________________________________________________________ - List info/subscribe/unsubscribe? See [4]http://www.freeradius.org/list/users.html References 1. mailto:alessandro@i360.net.br 2. mailto:alessandro@i360.net.br 3. http://www.i360tecnologia.com.br/ 4. http://www.freeradius.org/list/users.html

1 0

re: question about mac auth, vlans and mysql queries.
by Nazzareno Taborgna 18 Nov '15

18 Nov '15

> Hi, > I have a LAN with several switches ( mostly hp procurve and > a-series ) and a freeradius server which is performing mac > authentication. In case of successfully authentication, the freeradius > send back to the switch the VLAN to set on the switch port and this > works fine. > > My problem is: > I would like to propagate to the switches all VLANs because there are > other things (i.e.: stp protocol configuration) that became easier to > manage, but I want that on a given switch some VLANs are not available. > > Unluckily, it seems that it is not possible to configure this > behaviour on the switch. > If the unwanted VLAN is propagated from the uplink to the switch and > the radius tell that the VLAN should be that, the switch sets up the > unwanted VLAN on the port. > > So I performed a try on my: FreeRADIUS Version 2.2.5, for host > x86_64-pc-linux-gnu (debian 8). > Since it uses a local mysql database, I tried to modify: > > /etc/freeradius/sql/mysql/dialup.conf > > by changing authorize_check_query from: > > authorize_check_query = "SELECT id, username, attribute, value, op \ > FROM ${authcheck_table} \ > WHERE username = '%{SQL-User-Name}' \ > ORDER BY id" > > to > > # authorize_check_query = "SELECT radcheck.id, radcheck.username, \ > # radcheck.attribute, radcheck.value, radcheck.op, \ > # radusergroup.groupname,radgroupreply.value, ptrnas, nasname \ > # FROM ${authcheck_table} LEFT JOIN radusergroup ON > radcheck.username=radusergroup.username \ > # LEFT JOIN radgroupreply on > radusergroup.groupname=radgroupreply.groupname \ > # LEFT JOIN nasvlan on radgroupreply.value=vlan \ > # LEFT JOIN nas on nasvlan.ptrnas=nas.id \ > # WHERE radcheck.username='%{SQL-User-Name}' \ > # AND > radgroupreply.attribute='Tunnel-Private-Group-ID' \ > # AND nasname = '%{NAS-IP-Address}' ORDER BY > radcheck.id" > > that now is commented out because the server deads for "unterminated > string", perhaps because the query is too big to fit inside > authorize_check_query. > In the fields I had to put the table name to fix the fieldnames > ambiguities. After radcheck.op, there are some other fields and I > don't know if this could cause other kind of problems. > This query uses only the nasvlan additional table and works fine when > given at the interactive mysql command prompt: > > root@radiuslan4:~/import# more test.sql > SELECT radcheck.id, radcheck.username, radcheck.attribute, > radcheck.value, radcheck.op, radusergroup.groupname, > radgroupreply.value, ptrnas, nasname \ > FROM radcheck LEFT JOIN radusergroup ON > radcheck.username=radusergroup.username \ > LEFT JOIN radgroupreply on > radusergroup.groupname=radgroupreply.groupname \ > LEFT JOIN nasvlan on radgroupreply.value=vlan \ > LEFT JOIN nas on nasvlan.ptrnas=nas.id \ > WHERE radcheck.username='00d059cf752c' AND > radgroupreply.attribute='Tunnel-Private-Group-ID' \ > AND nasname='172.17.1.87'; > > root@radiuslan4:~/import# mysql -u root -p radius < ./test.sql > Enter password: > id username attribute value op groupname value > ptrnas nasname > 11021 00d059cf752c Cleartext-Password 00d059cf752c := > mac-addr-008 8 71 172.17.1.87 > > My questions are: > > Is there in freeradius an easier way to get the desired result? or, > should be possible in a next release to allow a larger > authorize_check_query? Just by shortening the above query: authorize_check_query = "SELECT radcheck.id, radcheck.username, radcheck.attribute, radcheck.value, radcheck.op, \ radusergroup.groupname,radgroupreply.value, ptrnas, nasname FROM ${authcheck_table} LEFT JOIN radusergroup ON radcheck.username=radusergroup.username LEFT JOIN radgroupreply on radusergroup.groupname=radgroupreply.groupname \ LEFT JOIN nasvlan on radgroupreply.value=vlan LEFT JOIN nas on nasvlan.ptrnas=nas.id \ WHERE radcheck.username='%{SQL-User-Name}' AND radgroupreply.attribute='Tunnel-Private-Group-ID' \ AND nasname = '%{NAS-IP-Address}' ORDER BY radcheck.id" there are less backslashes breaking the string to the next line, now I got the freeradius working. However, I have a shorter query by using the table aliases that works at the mysql command prompt: root@radiuslan4:~/import# more ./test2.sql SELECT r.id, r.username, r.attribute, r.value, r.op, rg.groupname, ry.value, ptrnas, nasname \ FROM radcheck r LEFT JOIN radusergroup rg ON r.username=rg.username \ LEFT JOIN radgroupreply ry on rg.groupname=ry.groupname \ LEFT JOIN nasvlan on ry.value=vlan \ LEFT JOIN nas on nasvlan.ptrnas=nas.id \ WHERE r.username='00d059cf752c' AND ry.attribute='Tunnel-Private-Group-ID' \ AND nasname='172.17.1.87'; root@radiuslan4:~/import# mysql -u root -p radius < ./test2.sql Enter password: id username attribute value op groupname value ptrnas nasname 11021 00d059cf752c Cleartext-Password 00d059cf752c := mac-addr-011 11 71 172.17.1.87 but when it is in the file dialup.conf: # authorize_check_query = "SELECT r.id, r.username, r.attribute, r.value, r.op, rg.groupname, ry.value, ptrnas, nasname \ FROM radcheck r LEFT JOIN radusergroup rg ON r.username=rg.username \ LEFT JOIN radgroupreply ry on rg.groupname=ry.groupname \ LEFT JOIN nasvlan on ry.value=vlan \ LEFT JOIN nas on nasvlan.ptrnas=nas.id \ WHERE r.username='%{NAS-IP-Address}' AND ry.attribute='Tunnel-Private-Group-ID' \ AND nasname='%{NAS-IP-Address}' ORDER BY radcheck.id " # the freeradius deads: /usr/sbin/freeradius -X ... including configuration file /etc/freeradius/sql/mysql/dialup.conf /etc/freeradius/sql/mysql/dialup.conf[130]: Expecting section start brace '{' after "FROM radcheck" Errors reading or parsing /etc/freeradius/radiusd.conf It seems that from the freeradius parser point of view, the above working sql is not good. Why?

2 3

Start at boot
by David Peterson 18 Nov '15

18 Nov '15

Back to being a serious noob. How do I set up Freeradius to start at boot with Ubuntu 15. Systemd seems to be a very different animal. David

6 8

question about mac auth, vlans and mysql queries.
by Nazzareno Taborgna 18 Nov '15

18 Nov '15

Hi, I have a LAN with several switches ( mostly hp procurve and a-series ) and a freeradius server which is performing mac authentication. In case of successfully authentication, the freeradius send back to the switch the VLAN to set on the switch port and this works fine. My problem is: I would like to propagate to the switches all VLANs because there are other things (i.e.: stp protocol configuration) that became easier to manage, but I want that on a given switch some VLANs are not available. Unluckily, it seems that it is not possible to configure this behaviour on the switch. If the unwanted VLAN is propagated from the uplink to the switch and the radius tell that the VLAN should be that, the switch sets up the unwanted VLAN on the port. So I performed a try on my: FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu (debian 8). Since it uses a local mysql database, I tried to modify: /etc/freeradius/sql/mysql/dialup.conf by changing authorize_check_query from: authorize_check_query = "SELECT id, username, attribute, value, op \ FROM ${authcheck_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY id" to # authorize_check_query = "SELECT radcheck.id, radcheck.username, \ # radcheck.attribute, radcheck.value, radcheck.op, \ # radusergroup.groupname,radgroupreply.value, ptrnas, nasname \ # FROM ${authcheck_table} LEFT JOIN radusergroup ON radcheck.username=radusergroup.username \ # LEFT JOIN radgroupreply on radusergroup.groupname=radgroupreply.groupname \ # LEFT JOIN nasvlan on radgroupreply.value=vlan \ # LEFT JOIN nas on nasvlan.ptrnas=nas.id \ # WHERE radcheck.username='%{SQL-User-Name}' \ # AND radgroupreply.attribute='Tunnel-Private-Group-ID' \ # AND nasname = '%{NAS-IP-Address}' ORDER BY radcheck.id" that now is commented out because the server deads for "unterminated string", perhaps because the query is too big to fit inside authorize_check_query. In the fields I had to put the table name to fix the fieldnames ambiguities. After radcheck.op, there are some other fields and I don't know if this could cause other kind of problems. This query uses only the nasvlan additional table and works fine when given at the interactive mysql command prompt: root@radiuslan4:~/import# more test.sql SELECT radcheck.id, radcheck.username, radcheck.attribute, radcheck.value, radcheck.op, radusergroup.groupname, radgroupreply.value, ptrnas, nasname \ FROM radcheck LEFT JOIN radusergroup ON radcheck.username=radusergroup.username \ LEFT JOIN radgroupreply on radusergroup.groupname=radgroupreply.groupname \ LEFT JOIN nasvlan on radgroupreply.value=vlan \ LEFT JOIN nas on nasvlan.ptrnas=nas.id \ WHERE radcheck.username='00d059cf752c' AND radgroupreply.attribute='Tunnel-Private-Group-ID' \ AND nasname='172.17.1.87'; root@radiuslan4:~/import# mysql -u root -p radius < ./test.sql Enter password: id username attribute value op groupname value ptrnas nasname 11021 00d059cf752c Cleartext-Password 00d059cf752c := mac-addr-008 8 71 172.17.1.87 My questions are: Is there in freeradius an easier way to get the desired result? or, should be possible in a next release to allow a larger authorize_check_query?

1 0