- Freeradius-Users - lists.freeradius.org

AW: FR 3.0.9 RADSEC with TLS 1.2
by Stabla, Daniel 18 Sep '15

18 Sep '15

Hi, I installed openssl 1.0.1p, but the error still exists. Another user mentioned to try FR 3.0.10 from github, what I did, but the error appears with this version too. Any other ideas? Kind regards. D. Stabla On Sep 17, 2015, at 6:11 AM, Stabla, Daniel <dstabla(a)materna.de <mailto:dstabla@materna.de>> wrote: > we are testing FR 3.0.9 with radsec, but it seems not to work > if our access point uses TLS 1.2. > > Environment: > FR 3.0.9 on SLES 12 > OpenSSL 1.0.1j (selfcompiled, configured with --prefix=/opt/openssl1.0.1j -fPIC shared linux-x86_64) > LANCOM L-1302acn / Firmware 9.10 I'd say upgrade OpenSSL. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Freeradius with CISCO Port Security
by Victor Sokphak 17 Sep '15

17 Sep '15

Dear All, I'm not sure if cisco port security support with radius authentication base on MAC address or not. If anyone used to do that, please give me some clue. Thanks, Sokphak

3 3

Info: No Pool-Name defined. Trying to add new APN
by Sophie Loewenthal 17 Sep '15

17 Sep '15

Hi guys, I have been trying to work out why our new APN cannot have any IP addresses allocated. The IP addresses should come from an existing pool already in use by other APNs. I've inherited this from since departed colleagues. I did post this a earlier but thought I should start a fresh thread with debug infomation. FreeRadius package is : freeradius-2.1.12-1.el6.x86_64 / Centos 6 The user name is 0TESTUSER1 The new APN is m2m.vod.trim.com In the users file I added , DEFAULT NAS-IP-Address == 195.123.123.0, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.50, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.51, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.52, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.53, Pool-Name := vodafone DEFAULT NAS-IP-Address == 195.123.123.54, Pool-Name := vodafone The first line already worked with another APN with IP addresses assigned. When I tried to authenticate with our new SIM and APN log in worked but no pool was defined. Tue Sep 15 09:42:25 2015 : Auth: Login OK: [0TESTUSER1] (from client vodafone-nas-m2m-51 port 511026 cli 882393728079768) Tue Sep 15 09:42:25 2015 : Info: No Pool-Name defined (did m2m.vod.trim.com cli 882393728079768 port 511026 user 0TESTUSER1) Debug: I ran in debug to see if I could get any more info and you'll find thus below. I'd be grateful if somebody would let me know how I mend this, or point me the right direction? Thanks and kind regards, Sophie [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2015-09-15 09:46:13', acctsessiontime = '510', acctinputoctets = '0' << 32 | '2643', acctoutputoctets = '0' << 32 | rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 000005a8a attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Finished request 128. Going to the next request Thread 4 waiting to be assigned a request Waking up in 0.6 seconds. Thread 5 got semaphore Thread 5 handling request 129, (17 handled so far) [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default [<thread>] +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[digest] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 228 ++[files] returns ok [sql] expand: %{User-Name} -> 0TESTUSER1 [sql] sql_set_user escaped user --> '0TESTUSER1' rlm_sql (sql): Reserving sql socket id: 23 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0TESTUSER1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '0TESTUSER1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0TESTUSER1' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'm2m.vod.trim.com' ORDER BY id [sql] User found in group m2m.vod.trim.com [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'm2m.vod.trim.com' ORDER BY id rlm_sql (sql): Released sql socket id: 23 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "F8BB45FCDC59995EE2C12A96E10B1091" [pap] Using clear text password "F8BB45FCDC59995EE2C12A96E10B1091" [pap] User authenticated successfully ++[pap] returns ok Login OK: [0TESTUSER1] (from client vodafone-nas-m2m-51 port 443593 cli 882393728079768) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sqlippool] No Pool-Name defined. [sqlippool] expand: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> No Pool-Name defined (did m2m.vod.trim.com cli 882393728079768 port 443593 user 0TESTUSER1) No Pool-Name defined (did m2m.vod.trim.com cli 882393728079768 port 443593 user 0TESTUSER1) ++[sqlippool] returns noop [sql] expand: %{User-Name} -> 0TESTUSER1 [sql] sql_set_user escaped user --> '0TESTUSER1' [sql] expand: %{User-Password} -> F8BB45FCDC59995EE2C12A96E10B1091 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '0TESTUSER1', 'F8BB45FCDC59995EE2C12A96E10B1091', 'Access-Accept', '2015-09-15 09:46:13') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '0TESTUSER1', 'F8BB45FCDC59995EE2C12A96E10B1091', 'Access-Accept', '2015-09-15 09:46:13') rlm_sql (sql): Reserving sql socket id: 22 rlm_sql (sql): Released sql socket id: 22 ++[sql] returns ok ++[exec] returns noop Finished request 129. Going to the next request Thread 5 waiting to be assigned a request Waking up in 0.5 seconds. Thread 6 got semaphore Thread 6 handling request 130, (17 handled so far) [<thread>] # Executing section authorize from file /etc/raddb/sites-enabled/default [<thread>] +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[digest] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok [sql] expand: %{User-Name} -> 357541001195173 [sql] sql_set_user escaped user --> '357541001195173' rlm_sql (sql): Reserving sql socket id: 21 ------------------------------------- END OF EMAIL ---------------------------------------------------

3 12

Transferring policy to v3.0.10
by David Aldwinckle 17 Sep '15

17 Sep '15

Hi All, In version 2.1.12 I had some unlang in /etc/raddb/policy.conf which I referenced in a number of virtual servers. In version 3.0.10, I notice that there is no more policy.conf. I found policy.d/filter but I was unsure if this was the correct place to put the config, and if I need to link it to mods-enabled. Any advice on where to put legacy policy.conf things, like the one I've included below? remote_netid_reject { if ((Realm == "netid.uwaterloo.ca") && \ (("%{Client-Shortname}" == "prod1-west.eduroam.ca") || \ ("%{Client-Shortname}" == "prod2-west.eduroam.ca") || \ ("%{Client-Shortname}" == "prod1-east.eduroam.ca") || \ ("%{Client-Shortname}" == "prod2-east.eduroam.ca") || \ ("%{Client-Shortname}" == "moose.bc.net") || \ ("%{Client-Shortname}" == "grizzly.bc.net"))) { reject } } Thanks, Dave

2 2

FR 3.0.9 RADSEC with TLS 1.2
by Stabla, Daniel 17 Sep '15

17 Sep '15

Hello, we are testing FR 3.0.9 with radsec, but it seems not to work if our access point uses TLS 1.2. Environment: FR 3.0.9 on SLES 12 OpenSSL 1.0.1j (selfcompiled, configured with --prefix=/opt/openssl1.0.1j -fPIC shared linux-x86_64) LANCOM L-1302acn / Firmware 9.10 If we use RADSEC with TLS 1.0/1.1 it works, but with TLS 1.2 we get this FR output: (0) Initiating new EAP-TLS session (0) Setting verify mode to require certificate from client (0) (other): before/accept initialization (0) TLS_accept: before/accept initialization (0) <<< TLS 1.2 [length 007e] (0) TLS_accept: SSLv3 read client hello A (0) >>> TLS 1.2 [length 0059] (0) TLS_accept: SSLv3 write server hello A (0) >>> TLS 1.2 [length 18c4] (0) TLS_accept: SSLv3 write certificate A (0) >>> TLS 1.2 [length 024d] (0) TLS_accept: SSLv3 write key exchange A (0) >>> TLS 1.2 [length 0096] (0) TLS_accept: SSLv3 write certificate request A (0) TLS_accept: SSLv3 flush data (0) TLS_accept: Need to read more data: SSLv3 read client certificate A (0) TLS_accept: Need to read more data: SSLv3 read client certificate A (0) In SSL Handshake Phase (0) In SSL Accept mode Waking up in 0.5 seconds. (0) <<< TLS 1.2 [length 0002] (0) ERROR: TLS Alert read:fatal:handshake failure (0) ERROR: TLS_accept: Failed in SSLv3 read client certificate A (0) ERROR: SSL says: error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (0) ERROR: SSL_read failed inside of TLS (-1), TLS session failed (0) FAILED in TLS handshake receive Closing TLS socket from client port 11906 Client has closed connection ... shutting down socket auth from client (10.0.0.2, 11906) -> (*, 2083, virtual-server=radsec-guests) A debug output from our access point shows us this: *[RADSEC] 2015/09/17 11:36:29,316 Devicetime: 2015/09/17 11:37:26,575* *Beginning to establish RADSEC connection to 10.0.0.1:2083[INTRANET]* *->establishment begins, local port is 11163* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,577* *Creating connection 890 with peer 10.0.0.1:2083 for requester 'RB':* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,577* *Sending Client Hello on connection 890:* *-> adding renegotiation_info extension to client hello* *-> all fine, receive Server Hello* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,604* *Receiving Server Hello on connection 890:* *-> protocol version is TLSv1.2* *-> server refuses session resumption* *-> selected cipher suite is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384* *-> parsing TLS extensions* *-> selected elliptic curve point format is uncompressed* *-> all fine, receive Certificate(s)* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,605* *Receiving Certificate(s) on connection 890:* *-> read certificate of CN=radius.materna.de (2182 bytes)* *-> read certificate of DC=com, DC=materna, CN=MATERNA Information & Communications (Root) (1887 bytes)* *-> read certificate of DC=com, DC=materna, CN=MATERNA-INFRASTRUCTURE-CA (2255 bytes)* *-> verification succeeded* *-> all fine, receiving Server Hello Done* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,614* *Receiving Server Key Exchange on connection 890:* *-> selected elliptic curve is secp256r1* *-> selected signature method is (sha256,rsa)* *-> signature match* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,618* *Receiving Certificate Request on connection 890:* *-> my own certificate's issuer is DC=com, DC=materna, CN=MATERNA-INFRASTRUCTURE-CA* *-> truncated CA name, exiting* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,618* *Preparing records to send on connection 890:* *-> not in application state, bailing out* ** *[TLS] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,618* *Closing connection 890 (broken packet received):* *--> application state not reached (ClientRcvServerHelloDone)* *--> sending failure to requester* ** *[RADSEC] 2015/09/17 11:36:29,332 Devicetime: 2015/09/17 11:37:26,619* *RADSEC connection to 10.0.0.1:2083[INTRANET] failed: Handshake failure* *->marking connection as dead* So is this a error created through FR or does the access point something wrong? Kind regards. D. Stabla

2 1

Radius, from 2 to 3 - radtest does not agree with its command line
by Cosme Faria Corrêa 17 Sep '15

17 Sep '15

Hi, I have an old server and this is the normal behavior: radtest johndoe 'jdsecret' 127.0.0.1 0 testing123 Sending Access-Request of id 52 to 127.0.0.1 port 1812 User-Name = "johndoe" User-Password = "jdsecret" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=52, length=20 I am doing a new server and it is different now: radtest johndoe 'jdsecret' 127.0.0.1 0 testing123 Sending Access-Request Id 250 from 0.0.0.0:43561 to 127.0.0.1:1812 User-Name = "johndoe" User-Password = "jdsecret" NAS-IP-Address = 10.0.0.3 NAS-Port = 0 Message-Authenticator = 0x00 (0) No reply from server for ID 250 socket 3 ... Why is NAS-IP-Address = 10.0.0.3? It makes no sense to me. There is no 10.0.0.3 in my interfaces. There is nothing in log, of course. TIA -- Cosme Corrêa +55 21 4042-6606

3 3

Re: best way to split by "," and interate?
by Jorge Pereira 16 Sep '15

16 Sep '15

Ah! perfect, but i can't use Tmp-String with explode? Wed Sep 16 17:13:27 2015 : Debug: rlm_redis (redis_conf): Released connection (1) Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND %{redis_conf:HGET "radius-configurations" Develop_MacAddress} Wed Sep 16 17:13:27 2015 : Debug: (0) --> ca:de:ca:fe:00:01,aa:bb:cc:dd:ee:ff *Wed Sep 16 17:13:27 2015 : Debug: (0) &control:Tmp-String-1 := ca:de:ca:fe:00:01,aa:bb:cc:dd:ee:ff* Wed Sep 16 17:13:27 2015 : Debug: (0) } # update = noop Wed Sep 16 17:13:27 2015 : Debug: (0) if (&control:Tmp-String-0 && &control:Tmp-String-1) { Wed Sep 16 17:13:27 2015 : Debug: (0) if (&control:Tmp-String-0 && &control:Tmp-String-1) -> TRUE Wed Sep 16 17:13:27 2015 : Debug: (0) if (&control:Tmp-String-0 && &control:Tmp-String-1) { *Wed Sep 16 17:13:27 2015 : Debug: %{explode: &control:Tmp-String-1 ,}* Wed Sep 16 17:13:27 2015 : Debug: Parsed xlat tree: Wed Sep 16 17:13:27 2015 : Debug: xlat --> explode Wed Sep 16 17:13:27 2015 : Debug: { Wed Sep 16 17:13:27 2015 : Debug: literal --> &control:Tmp-String-1 , Wed Sep 16 17:13:27 2015 : Debug: } *Wed Sep 16 17:13:27 2015 : ERROR: (0) Invalid attribute name* Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND %{explode: &control:Tmp-String-1 ,} Wed Sep 16 17:13:27 2015 : Debug: (0) --> Wed Sep 16 17:13:27 2015 : Debug: (0) foreach &control:Tmp-String-1 Wed Sep 16 17:13:27 2015 : Debug: (0) if (&My-Mac-Address == "%{Foreach-Variable-0}") { Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND TMPL XLAT STRUCT Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND Foreach-Variable-0 Wed Sep 16 17:13:27 2015 : Debug: (0) --> ca:de:ca:fe:00:01,aa:bb:cc:dd:ee:ff Wed Sep 16 17:13:27 2015 : Debug: (0) EXPAND %{Foreach-Variable-0} Wed Sep 16 17:13:27 2015 : Debug: (0) --> ca:de:ca:fe:00:01,aa:bb:cc:dd:ee:ff Wed Sep 16 17:13:27 2015 : Debug: (0) if (&My-Mac-Address == "%{Foreach-Variable-0}") -> FALSE Wed Sep 16 17:13:27 2015 : Debug: (0) } # foreach &control:Tmp-String-1 = noop Wed Sep 16 17:13:27 2015 : Debug: (0) } # if (&control:Tmp-String-0 && &control:Tmp-String-1) = noop -- Jorge Pereira On Wed, Sep 16, 2015 at 1:54 PM, Arran Cudbard-Bell < a.cudbardb(a)freeradius.org> wrote: > > > On 16 Sep 2015, at 17:39, Jorge Pereira <jpereiran(a)gmail.com> wrote: > > > > Hi, > > > > I have a list > > > > update control { > > &Tmp-String-0 = > "aa:bb:cc:dd:ee:ff,00:11:22:33:44:55,ff:ee:dd:cc:bb:aa" > > } > > > > And I would like to know about the best approach to split by "," and > check > > if match with my ${Called-Station-Id} > > someone have a idea? > > "%{explode:&Called-Station-ID ,}" > > foreach &Called-Station-ID { > if ("%{Foreach-Variable-0}" =~ /expr/) { > <stuff> > } > } > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS development team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 3

best way to split by "," and interate?
by Jorge Pereira 16 Sep '15

16 Sep '15

Hi, I have a list update control { &Tmp-String-0 = "aa:bb:cc:dd:ee:ff,00:11:22:33:44:55,ff:ee:dd:cc:bb:aa" } And I would like to know about the best approach to split by "," and check if match with my ${Called-Station-Id} someone have a idea? -- Jorge Pereira

3 3

xlat: something like eval()? problems with avp into in another avp
by Jorge Pereira 16 Sep '15

16 Sep '15

Hi, I would like to know how "expand" an avp into in another avp. below my example. Wed Sep 16 13:37:43 2015 : Debug: (0) policy my.captive_redirect { Wed Sep 16 13:37:43 2015 : Debug: (0) update { Wed Sep 16 13:37:43 2015 : Debug: (0) EXPAND %{My-Portal-Url} Wed Sep 16 13:37:43 2015 : Debug: (0) --> http://meu-host.intra.net/integration-bus/v1/redir/start?acctSessionId=%{Ac… Wed Sep 16 13:37:43 2015 : Debug: (0) &reply:Alc-Wlan-Portal-Url := http://meu-host.intra.net/integration-bus/v1/redir/start?acctSessionId=%{Ac… Wed Sep 16 13:37:43 2015 : Debug: (0) } # update = noop Wed Sep 16 13:37:43 2015 : Debug: (0) } # policy alcatel.captive_redirect = noop example: but, when calling the %{redis: ..}, they resolve everything fine. Wed Sep 16 13:37:43 2015 : Debug: (0) policy mcare-redis.set_my_portal_url { Wed Sep 16 13:37:43 2015 : Debug: (0) if (!&My-Portal-Url) { Wed Sep 16 13:37:43 2015 : Debug: (0) if (!&My-Portal-Url) -> FALSE Wed Sep 16 13:37:43 2015 : Debug: (0) if (&My-Portal-Url) { Wed Sep 16 13:37:43 2015 : Debug: (0) if (&My-Portal-Url) -> TRUE Wed Sep 16 13:37:43 2015 : Debug: (0) if (&My-Portal-Url) { Wed Sep 16 13:37:43 2015 : Debug: %{redis_db03:HSET %{Acct-Session-Id} My-Portal-Url "%{My-Portal-Url}"} Wed Sep 16 13:37:43 2015 : Debug: Parsed xlat tree: Wed Sep 16 13:37:43 2015 : Debug: xlat --> redis_db03 Wed Sep 16 13:37:43 2015 : Debug: { Wed Sep 16 13:37:43 2015 : Debug: literal --> HSET Wed Sep 16 13:37:43 2015 : Debug: attribute --> Acct-Session-Id Wed Sep 16 13:37:43 2015 : Debug: literal --> My-Portal-Url " Wed Sep 16 13:37:43 2015 : Debug: attribute --> My-Portal-Url Wed Sep 16 13:37:43 2015 : Debug: literal --> " Wed Sep 16 13:37:43 2015 : Debug: } Wed Sep 16 13:37:43 2015 : Debug: rlm_redis (redis_db03): Reserved connection (0) Wed Sep 16 13:37:43 2015 : Debug: http://meu-host.intra.net/integration-bus/v1/redir/start?acctSessionId=%{Ac… Wed Sep 16 13:37:43 2015 : Debug: Parsed xlat tree: Wed Sep 16 13:37:43 2015 : Debug: literal --> http://meu-host.intra.net/integration-bus/v1/redir/start?acctSessionId= Wed Sep 16 13:37:43 2015 : Debug: attribute --> Acct-Session-Id Wed Sep 16 13:37:43 2015 : Debug: (0) EXPAND http://meu-host.intra.net/integration-bus/v1/redir/start?acctSessionId=%{Ac… Wed Sep 16 13:37:43 2015 : Debug: (0) --> http://meu-host.intra.net/integration-bus/v1/redir/start?acctSessionId=AB81… Wed Sep 16 13:37:43 2015 : Debug: rlm_redis (redis_db03): executing the query: "HSET AB818B000010C355F65FA1 My-Portal-Url " http://meu-host.intra.net/integration-bus/v1/redir/start?acctSessionId=%{Ac… "" Wed Sep 16 13:37:43 2015 : Debug: rlm_redis (redis_db03): Released connection (0) Wed Sep 16 13:37:43 2015 : Debug: (0) EXPAND %{redis_db03:HSET %{Acct-Session-Id} My-Portal-Url "%{My-Portal-Url}"} Wed Sep 16 13:37:43 2015 : Debug: (0) --> 0 Wed Sep 16 13:37:43 2015 : Debug: (0) } # if (&My-Portal-Url) = ok Wed Sep 16 13:37:43 2015 : Debug: (0) } # policy mcare-redis.set_my_portal_url = ok Alan, maybe a bug? :) -- Jorge Pereira

3 4

sending POD for PPPoe
by Randeep 16 Sep '15

16 Sep '15

Hi Alan, We have both pppoe and hotspot services. If the user reaches the max data limit we are applying fup limit by sending a coa update. But with pppoe coa is not working. So we implemented the following logic. If the user exceeded the limit, then we will check whether its pppoe or hotspot. If it is pppoe we are sending disconnect. update control { #sum of the AcctInputOctets+AcctOutputOctets for this month.(From the first day of the current month to till date) Tmp-Integer-0 := "%{sql:SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) AS Total FROM radacct where radacct.username='%{User-Name}'}" #Value of Max-Data from the radgroupcheck for the group of the user Tmp-Integer-1 := "%{sql: SELECT radgroupcheck.value FROM radusergroup INNER JOIN radgroupcheck ON radusergroup.groupname = radgroupcheck.groupname WHERE radusergroup.username='%{User-Name}' AND radgroupcheck.attribute='Max-Data'}" Tmp-String-1 := "%{sql: SELECT radgroupcheck.value FROM radusergroup INNER JOIN radgroupcheck ON radusergroup.groupname = radgroupcheck.groupname WHERE radusergroup.username='%{User-Name}' AND radgroupcheck.attribute='Mikrotik-Rate-Limit'}" Tmp-String-3 = "%{sql:select calledstationid from radacct where acctsessionid='%{Acct-Session-Id}'}" } if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-Integer-1}") { #Added these to update COA for hotspot and disconnect for PPPOE if ("%{control:Tmp-String-3}" == "hotspot1"){ update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Mikrotik-Rate-Limit = "%{control:Tmp-String-1}" } } else { echo "Acct-Session-Id=\"%{Acct-Session-Id}\"" > /tmp/\"%{User-Name}\".txt echo "User-Name=\"%{User-Name}\"" >> /tmp/\"%{User-Name}\".txt echo "NAS-IP-Address=\"%{Framed-IP-Address}\"" >> /tmp/\"%{User-Name}\".txt Secret= `grep "%{NAS-IP-Address}" /usr/local/etc/raddb/clients.conf -b2 | grep secret |awk '{print $4}' ` cat "/tmp/\"%{User-Name}\".txt" | radclient -x "%{NAS-IP-Address}":3799 disconnect "$Secret" } } But when running radiusd -XXX its giving the following error. Wed Sep 16 12:14:04 2015 : Error: /usr/local/etc/raddb/sites-enabled/default[623]: Expecting section start brace '{' after "echo Acct-Session-Id="%{Acct-Session-Id}"" Wed Sep 16 12:14:04 2015 : Error: Errors reading or parsing /usr/local/etc/raddb/radiusd.conf Please help Regards, Randeep

2 2