- Freeradius-Users - lists.freeradius.org

Return codes in policies
by Jonathan Gazeley 29 Oct '15

29 Oct '15

Hi folks, I am porting my FreeRADIUS config from 2.x to 3.x and I've run into an issue I don't understand. I have this policy "wism-checks" which allows the server to respond to probes sent by the WLAN controllers. It is invoked in the authorize section of my virtual servers. wism-checks { if (Service-Type == "NAS-Prompt-User") { if (NAS-IP-Address =~ /^172\.17\.107\./) { if (User-Name =~ /^wism\-probe/) { update control { Auth-Type := Accept } updated } else { reject } } updated = return } } This works quite happily on FR2 but chokes on FR3 with the following: /etc/raddb/policy.d/policies[178] Invalid return code assigment inside of a if section /etc/raddb/policy.d/policies[166]: Failed to parse "if" subsection. Line 178 is the "updated = return" line. I've read the Fail-over docs[1] but that seems to deal with overriding return codes from modules rather than setting them explicitly in a policy. What's the best way to tweak this? Thanks, Jonathan [1] http://wiki.freeradius.org/config/Fail-over

3 4

3.0.10 fails to start (OpenSuse 13.2)
by Thomas Stather 29 Oct '15

29 Oct '15

Hello I installed freeradius-server 3.0.10 from the OpenSuse "network" repo (OpenSuse OBS) -------------------------------------- radius1:~ # zypper info freeradius-server Loading repository data... Reading installed packages... Information for package freeradius-server: ------------------------------------------ Repository: Networking services and related tools (openSUSE_Tumbleweed) Name: freeradius-server Version: 3.0.10-91.3 Arch: x86_64 Vendor: obs://build.opensuse.org/network Installed: Yes Status: up-to-date Installed Size: 3.0 MiB Summary: Very Highly Configurable Radius Server Description: The FreeRADIUS server has a number of features found in other servers and additional features not found in any other server. -------------------------------------- but when i try to start it, i get: -------------------------------------- radius1:~ # radiusd -X libssl version mismatch. built: 1000204f linked: 100010bf -------------------------------------- How can i fix this? I assume this is because of a mismatched OpenSSL version. The info of the installed package is: -------------------------------------- radius1:~ # zypper info openssl Loading repository data... Reading installed packages... Information for package openssl: -------------------------------- Repository: openSUSE-13.2-Update Name: openssl Version: 1.0.1k-2.24.1 Arch: x86_64 Vendor: openSUSE Installed: Yes Status: up-to-date Installed Size: 1.4 MiB Summary: Secure Sockets and Transport Layer Security Description: The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and open source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL toolkit and its related documentation. Derivation and License OpenSSL is based on the excellent SSLeay library developed by Eric A. Young and Tim J. Hudson. The OpenSSL toolkit is licensed under an Apache-style license, which basically means that you are free to get it and to use it for commercial and noncommercial purposes. -------------------------------------- Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

8 28

Define coa_server for clients in nas table
by Bryan Mesich 28 Oct '15

28 Oct '15

Hello, I have a functioning FreeRadius 3.0.10 installation that currently uses the rlm_sql module for accounting and authorization. The setup is composed of 2 FreeRadius servers with a MariaDB/Galara cluster. I'm interested in using the nas table in the database rather than clients.conf when configuring my clients. Each NAS "client" has a corresponding home_server defined in sites-enabled/originate-coa, which the client gets tied to with the coa_server parameter in clients.conf: [clients.conf] client hk-wlc1 { ipaddr = 10.129.3.13 secret = secret nas_type = cisco coa_server = hk-wlc1-coa } [originate-coa] home_server hk-wlc1-coa { type = coa ipaddr = 10.129.3.13 port = 1700 secret = secret coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } The provided radius schema does not include a coa_server field in the nas table. One would think that would be needed in order for clients that are defined in the db to use the appropriate CoA server. Looking at the source code, I located the function generate_sql_clients(), which appears to parse the records returned from the query defined for the particular DB platform (mods-config/sql/main/mysql/queries.conf in this case). It doesn't appear to be possible to define a coa_server for a client that is defined in the nas table. Is it possible for FreeRadius to identify the appropriate CoA home_server based on the IP address that originated the request (thus not requiring the coa_server parameter)? Bryan

3 2

Re: Welcome to the "Freeradius-Users" mailing list
by Orion Timbale 28 Oct '15

28 Oct '15

Thanks to all freeradius users!!!! I'm using freeradius v3.0.4 under Fedora 22. I try to proxy some Access-Request and add some check item/attribute before proxying. The radiusd -X output regarding this problem looks like this: "Wed Oct 21 18:31:19 2015 : Debug: (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default Wed Oct 21 18:31:19 2015 : Debug: (0) pre-proxy { Wed Oct 21 18:31:19 2015 : Debug: (0) node.pre-proxy node.pre-proxy { Wed Oct 21 18:31:19 2015 : Debug: (0) if ("%{request:Packet-Type}" == 'Access-Request') Wed Oct 21 18:31:19 2015 : Debug: (0) EXPAND %{request:Packet-Type} Wed Oct 21 18:31:19 2015 : Debug: (0) --> Access-Request Wed Oct 21 18:31:19 2015 : Debug: (0) if ("%{request:Packet-Type}" == 'Access-Request') -> TRUE Wed Oct 21 18:31:19 2015 : Debug: (0) if ("%{request:Packet-Type}" == 'Access-Request') { Wed Oct 21 18:31:19 2015 : Debug: (0) update proxy-request { Wed Oct 21 18:31:19 2015 : Debug: (0) &NodeID == '0000000002' Wed Oct 21 18:31:19 2015 : Debug: (0) No existing attribute to filter, adding instead Wed Oct 21 18:31:19 2015 : Debug: (0) } # update proxy-request = noop Wed Oct 21 18:31:19 2015 : Debug: (0) } # if ("%{request:Packet-Type}" == 'Access-Request') = noop Wed Oct 21 18:31:19 2015 : Debug: (0) } # byon-node.pre-proxy byon-node.pre-proxy = noop Wed Oct 21 18:31:19 2015 : Debug: (0) } # pre-proxy = noop Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Trying to allocate ID (0/2) Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Failed allocating ID: Failed finding socket, caller must allocate a new one Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Trying to open a new listener to the home server Wed Oct 21 18:31:19 2015 : Debug: Opening new proxy socket 'proxy address * port 0' Wed Oct 21 18:31:19 2015 : Debug: Listening on proxy address * port 45141 Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: Trying to allocate ID (1/2) Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: request is now in proxy hash Wed Oct 21 18:31:19 2015 : Debug: (0) proxy: allocating destination 192.168.42.193 port 1812 - Id 16 Wed Oct 21 18:31:19 2015 : Debug: (0) Proxying request to home server 192.168.42.193 port 1812 timeout 14.000000 Wed Oct 21 18:31:19 2015 : Debug: (0) Sending Access-Request packet to host 192.168.42.193 port 1812, id=16, length=0 Wed Oct 21 18:31:19 2015 : Debug: (0) User-Name = 'fname.lname(a)my-network.com' Wed Oct 21 18:31:19 2015 : Debug: (0) User-Password = 'passme' Wed Oct 21 18:31:19 2015 : Debug: (0) NAS-IP-Address = 127.0.0.1 Wed Oct 21 18:31:19 2015 : Debug: (0) NAS-Port = 100 Wed Oct 21 18:31:19 2015 : Debug: (0) Message-Authenticator = 0x29fc545638a7a1c6ec10b5f7e2c860c9 Wed Oct 21 18:31:19 2015 : Debug: (0) Event-Timestamp = 'Oct 21 2015 18:31:19 CEST' Wed Oct 21 18:31:19 2015 : Debug: (0) Realm = 'DEFAULT' Wed Oct 21 18:31:19 2015 : Debug: (0) Proxy-State = 0x3337 Wed Oct 21 18:31:19 2015 : Debug: (0) NodeID == '0000000002' Sending Access-Request Id 16 from 0.0.0.0:45141 to 192.168.42.193:1812 User-Name = 'fname.lname(a)my-network.com' User-Password = 'passme' NAS-IP-Address = 127.0.0.1 NAS-Port = 100 Message-Authenticator = 0x29fc545638a7a1c6ec10b5f7e2c860c9 Event-Timestamp = 'Oct 21 2015 18:31:19 CEST' Proxy-State = 0x3337" As you can see Realm and NodeID are not passed to the radius proxy in the access request. Can anyone suggest me something ? Sincerely yours. Tim

2 3

problem compiling eapol_test under OpenSuse 13.2
by Thomas Stather 28 Oct '15

28 Oct '15

Hello I wanted to compile the eapol_test binary to test my eap setup (Eduroam service, EAP-PEAP/MSCHAPv2 and EAP-TTLS/MSCHAPv2). The manual is here: http://deployingradius.com/scripts/eapol_test/ I downloaded the 2.5 source, additionally the OpenSuse Pattern "devel_basis" and the package "libopenss-devel" However when i do a "make eapol_test" i get: ... CC ../src/utils/ip_addr.c /usr/lib64/gcc/x86_64-suse-linux/4.8/../../../../x86_64-suse-linux/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status Makefile:1677: recipe for target 'eapol_test' failed make: *** [eapol_test] Error 1 Does sombody have a clue? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

2 2

RV: FreeRadius 3.0.6 failed
by Oscar Jofre 27 Oct '15

27 Oct '15

Hi, I have configuring a new FreeRadius 3.0.6 on Centos7 and MariaDB. Is has been working ok (had to increase max connextion and other values) but now I'm getting the radius down every time. MariaDB has radacct with over 10.000.000 rows. I'm connecting 10.000 PPTP users authentication with this Radius, Interim every 30seconds and client-pptp-session 10minutes, but after start mariadb and freeradius exits with this message: [root@rad ~]# systemctl status radiusd radiusd.service - FreeRADIUS high performance RADIUS server. Loaded: loaded (/usr/lib/systemd/system/radiusd.service; disabled) Active: failed (Result: signal) since mar 2015-10-27 22:41:14 CET; 17min ago Process: 12086 ExecStart=/usr/sbin/radiusd -d /etc/raddb (code=exited, status=0/SUCCESS) Process: 12083 ExecStartPre=/usr/sbin/radiusd -C (code=exited, status=0/SUCCESS) Process: 12080 ExecStartPre=/bin/chown -R radiusd.radiusd /var/run/radiusd (code=exited, status=0/SUCCESS) Main PID: 12090 (code=killed, signal=ABRT) CGroup: /system.slice/radiusd.service oct 27 22:36:16 rad.aaa.com systemd[1]: Starting FreeRADIUS high performance RADIUS server.... oct 27 22:36:17 rad.aaa.com systemd[1]: Started FreeRADIUS high performance RADIUS server.. oct 27 22:41:14 rad.aaa.com systemd[1]: radiusd.service: main process exited, code=killed, status=6/ABRT oct 27 22:41:14 rad.aaa.com systemd[1]: Unit radiusd.service entered failed state. Last Lines from radius.log Tue Oct 27 23:14:20 2015 : ERROR: (73758) ERROR: <queue> : Received conflicting packet from client 0.0.0.0/0 port 53359 - ID: 220 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73736) ERROR: detail : Received conflicting packet from client 0.0.0.0/0 port 48163 - ID: 146 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73737) ERROR: detail : Received conflicting packet from client 0.0.0.0/0 port 59445 - ID: 144 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : Warning: No such configuration item .type..query Tue Oct 27 23:14:20 2015 : Warning: No such configuration item .type..query Tue Oct 27 23:14:20 2015 : ERROR: (73751) ERROR: <queue> : Received conflicting packet from client 0.0.0.0/0 port 33445 - ID: 148 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73757) ERROR: <queue> : Received conflicting packet from client 0.0.0.0/0 port 53686 - ID: 147 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : Warning: No such configuration item .type..query Tue Oct 27 23:14:20 2015 : ERROR: (73752) ERROR: detail : Received conflicting packet from client 0.0.0.0/0 port 43723 - ID: 144 due to unfinished request. Giving up on old request. Tue Oct 27 23:14:20 2015 : ERROR: (73753) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 44422 - ID: 145 due to unfinished request. Giving up on old request. Also I have all this warnings/errors on log. What is really important to fix and how ??? 1) START RADIUS Tue Oct 27 22:36:17 2015 : Warning: No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 0.0.0.0/0. Please fix your configuration Tue Oct 27 22:36:17 2015 : Warning: Support for old-style clients will be removed in a future release Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Attempting to connect to database "radius" Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server <default> Tue Oct 27 22:36:17 2015 : Warning: Ignoring "ldap" (see raddb/mods-available/README.rst) Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server default Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server inner-tunnel Tue Oct 27 22:36:17 2015 : Warning: No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 0.0.0.0/0. Please fix your configuration Tue Oct 27 22:36:17 2015 : Warning: Support for old-style clients will be removed in a future release Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Attempting to connect to database "radius" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (0) Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server <default> Tue Oct 27 22:36:17 2015 : Warning: Ignoring "ldap" (see raddb/mods-available/README.rst) Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server default Tue Oct 27 22:36:17 2015 : Info: Loaded virtual server inner-tunnel Tue Oct 27 22:36:17 2015 : Info: Ready to process requests 2) Tue Oct 27 22:36:17 2015 : Warning: rlm_sql (sql): 1 of 1 connections in use. You probably need to increase "spare" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (1) Tue Oct 27 22:36:17 2015 : Warning: rlm_sql (sql): 2 of 2 connections in use. You probably need to increase "spare" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (2) Tue Oct 27 22:36:17 2015 : Warning: rlm_sql (sql): 3 of 3 connections in use. You probably need to increase "spare" Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (3) Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): 3 of 4 connections in use. Need more spares Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): Opening additional connection (4) Tue Oct 27 22:36:17 2015 : Info: rlm_sql (sql): 2 of 4 connections in use. Need more spares 3) Tue Oct 27 22:36:51 2015 : ERROR: (4217) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 39418 - ID: 59 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4220) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 50628 - ID: 62 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4221) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 55753 - ID: 63 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4224) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 41959 - ID: 66 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:51 2015 : ERROR: (4229) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 57022 - ID: 71 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4260) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 45267 - ID: 104 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4287) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 47887 - ID: 120 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4292) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 40463 - ID: 128 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4294) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 44484 - ID: 129 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4303) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 47015 - ID: 137 due to unfinished request. Giving up on old request. Tue Oct 27 22:36:52 2015 : ERROR: (4304) ERROR: sql : Received conflicting packet from client 0.0.0.0/0 port 48617 - ID: 138 due to unfinished request. Giving up on old request. 4) Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query Tue Oct 27 22:36:54 2015 : Warning: No such configuration item .type..query 5) Tue Oct 27 22:37:04 2015 : Error: (7162) Ignoring duplicate packet from client 0.0.0.0/0 port 47432 - ID: 116 due to unfinished request in component <core> module <queue> 6) Tue Oct 27 22:37:09 2015 : Error: rlm_sql (sql): Duplicate entry '30a1ada7fbf7328ec740200d6042f02b' for key 'acctuniqueid' Tue Oct 27 22:37:09 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:37:09 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '30a1ada7fbf7328ec740200d6042f02b' for key 'acctuniqueid'' Tue Oct 27 22:40:14 2015 : Error: rlm_sql (sql): Duplicate entry '51208897d76ba70d93d0a5d4486b3622' for key 'acctuniqueid' Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '51208897d76ba70d93d0a5d4486b3622' for key 'acctuniqueid'' Tue Oct 27 22:40:14 2015 : Error: rlm_sql (sql): Duplicate entry 'a2ccf69a14f3eb13105c3a5df8dcb81f' for key 'acctuniqueid' Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'a2ccf69a14f3eb13105c3a5df8dcb81f' for key 'acctuniqueid'' Tue Oct 27 22:40:14 2015 : Error: rlm_sql (sql): Duplicate entry 'b92b5f282a678d6edfec278fc07a057a' for key 'acctuniqueid' Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'b92b5f282a678d6edfec278fc07a057a' for key 'acctuniqueid'' Tue Oct 27 22:40:16 2015 : Error: rlm_sql (sql): Duplicate entry '4b8983776731b1f5da36b35a1a53d9fa' for key 'acctuniqueid' Tue Oct 27 22:40:16 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:16 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '4b8983776731b1f5da36b35a1a53d9fa' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '61cb092a85b6a15acf5d79cfb60855d6' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '61cb092a85b6a15acf5d79cfb60855d6' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '39df97f43a022814b698ebfa18065f02' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '39df97f43a022814b698ebfa18065f02' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '370a69125a04214aae019cecdccac86d' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '370a69125a04214aae019cecdccac86d' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '78108b526c3d18d0fbb5c330fae5b770' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '78108b526c3d18d0fbb5c330fae5b770' for key 'acctuniqueid'' Tue Oct 27 22:40:17 2015 : Error: rlm_sql (sql): Duplicate entry '337e085c9a8d7cde42499a130cb2d6fb' for key 'acctuniqueid' Tue Oct 27 22:40:17 2015 : Error: rlm_sql_mysql: Cannot store result 7) Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11202, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11201, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11199, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11206, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11205, in component <core> module Tue Oct 27 22:38:36 2015 : Error: Unresponsive child for request 11212, in component <core> module Thanks.

2 1

update control
by Alan Buxey 27 Oct '15

27 Oct '15

Hi Is there a fixed list of attribute pairs that can be used when doing update control (eg Proxy-To-Realm) or can any attribute defined locally in a dictionary be used? alan

2 1

[sqlippool]IP address could not be allocated as no pool exists with that name
by Rod Elias 27 Oct '15

27 Oct '15

Hello list! Could someone please help me with a problem regarding freeradius sqlippool module? I'm migrating to FreeRADIUS Version 2.1.10 with MySQL 5.1.73-1 running on a Debian GNU/Linux 6 The content of my radcheck table is something like: mysql> select * from radcheck where UserName = 'lucasmenezes'; +-------+-------------------------+--------------------+----------------+----+ | id | UserName | Attribute | Value | op | +-------+-------------------------+--------------------+----------------+----+ | 15643 | lucasmenezes | Cleartext-Password | 12110 | := | | 22342 | lucasmenezes | Pool-Name | PONTALNORTE_02 | := | +-------+-------------------------+--------------------+----------------+----+ 2 rows in set (0.00 sec) When the mentioned user tries to authenticate, I get the error message "IP address could not be allocated as no pool exists with that name". The user receives Login OK, but radius releases IP 0.0.0.0 to her/him. Here is an **example** of my radippool table: mysql> select * from radcheck where UserName = 'lucasmenezes'; +-------+----------------+-----------------+--------------+-----------------+-------------------+---------------------+-------------------------+-------------------+ | id | pool_name | FramedIPAddress | NASIPAddress | CalledStationId | CallingStationID | expiry_time | username | pool_key | +-------+----------------+-----------------+--------------+-----------------+-------------------+---------------------+-------------------------+-------------------+ | 64171 | PONTALNORTE_02 | 187.44.69.244 | 187.44.64.58 | | 00:0C:43:B4:1B:81 | 2015-10-27 16:00:10 | lucasmenezes | 00:0C:43:B4:1B:81 | +-------+----------------+-----------------+--------------+-----------------+-------------------+---------------------+-------------------------+-------------------+ 1 row in set (0.00 sec) For some reason, I noticed the %{control:Pool-Name} section in the SQL query isn't being resolved and, because that, SQL query doesn't return any results. Please let me post bellow the output of freeradius -X regarding that situation: Login OK: [lucasmenezes] (from client MK_Pontal port 15728946 cli 00:0C:43:B4:1B:81) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} rlm_sql (sql): Reserving sql socket id: 110 [sqlippool] expand: %{User-Name} -> lucasmenezes [sqlippool] sql_set_user escaped user --> 'lucasmenezes' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '187.44.64.58' [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = '' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'lucasmenezes'), (callingstationid <> '00:0C:43:B4:1B:81'), expiry_time LIMIT 1 FOR UPDATE [sqlippool] SQL query did not return any results [sqlippool] expand: COMMIT -> COMMIT [sqlippool] expand: SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1 -> SELECT id FROM radippool WHERE pool_name='' LIMIT 1 [sqlippool] SQL query did not return any results rlm_sql (sql): Released sql socket id: 110 [sqlippool] IP address could not be allocated as no pool exists with that name. ++[sqlippool] returns noop ++[exec] returns noop Any help please? What am I missing? Thanks a lot in advanced. Best regards, []'s --

3 3

Mikrotik Winbox WEBcfg Error
by Alessandro Daudt 27 Oct '15

27 Oct '15

Hi, when I log with telnet in mikrotik (PAP) the connection works, but in winbox (CHAP) and WEBCFG (MSCHAP)i get this error [ldap] user alessandro authorized to use remote access ldap_msgfree [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: alessandro [mschap] Told to do MS-CHAPv2 for alessandro with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> alessandro attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 38 to 177.39.216.125 port 33488 MS-CHAP-Error = "\000E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 5 ID 38 with timestamp +3275 Ready to process requests.

3 2

Need information on checking for SSID during group verification
by Adarsha S 27 Oct '15

27 Oct '15

Hi , I'm using free-radius on my debian linux. Free radius is contacting external WINDOWS AD server for authentication. The topology is to authenticate Mobile unites[MU] connecting to wireless network. The MU's are authenticated along with group verification. During group verification I'm able to configure Login-Time also as one of the check. Along with this I need to verify the SSID via which MU's are connecting. Please guide me what changes/add I need to do in config file of Radius. Below is my user file content: */root # more /etc/raddb/users* *DEFAULT Realm != "NULL"* *anonymous Auth-Type := EAP* * Fall-Through = No* *Anonymous Auth-Type := EAP* * Fall-Through = No* *#Access Policy for Guest Users....* *# primary ldap group policy configuration* *# Policy for the groups* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group_1",* * Symbol-Allowed-ESSID += "adarsha_wlan"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group", Login-Time := "Any0600-2359"* * Symbol-User-Group = "adarsha_radius_group",* * Symbol-Allowed-ESSID += "adhi_2"* *DEFAULT ldap_primary-Ldap-Group == "adarsha_radius_group_2", Login-Time := "Any0000-2359"* * Symbol-User-Group = "adarsha_radius_group_2",* *DEFAULT Auth-Type := Reject* I need to use Symbol-Allowed-ESSID as one of the parameter for group verification. Currently its only group and login time: *ldap_primary-Ldap-Group == "adarsha_radius_group_1", Login-Time := "Any0600-2359"* Please guide me Thanks, Adarsha

2 4