- Freeradius-Users - lists.freeradius.org

3rd-party certificates in FR3
by Иван Стрельников 02 Sep '15

02 Sep '15

Hello everyone! I'm using freeradius 3.0.9. And i want to realize next scheme: cisco wlc wi-fi -> freeradius -> mysql db. It's all ok with db, i just want to clear out the messages to end user about radius certificate. So, i want use a certificate, which root ca will be in apple\android's certificate stores. Maybe geotrust, maybe other. I didn't find how it should to install and i need help here. Thank you. tl;dr I need a cookbook how to setup chained certificate from other trusted root CA. -- BW, Ivan.

3 3

Basic problem about radius client secret
by Timmy 02 Sep '15

02 Sep '15

Dear all Users, I want to understand more about this. When we talk about freeradius client, it will include a string of characters called secret. Is this sting an encryption key string or a password for the connection? What should be the appropriate length of this sting? Thanks for your response. Yours Faithfully, Timmy

2 1

Accounting mysql
by nicolas.clo＠ricoh-industrie.fr 02 Sep '15

02 Sep '15

Hi List, I have a problem to log accounting informations to mysql, rlm_sql_mysql: ERROR 1582 (Incorrect parameter count in the call to native function 'FROM_UNIXTIME'): 42000 It seems to be that Freeradius can't retrieve "integer:Event-Timestamp" value. FreeRADIUS Version 3.0.10 (git #f7065a7), for host i486-pc-linux-gnu, built on Sep 1 2015 at 15:39:31 on Debian 7.8 Mysql 5.5.35 Wed Sep 2 08:38:21 2015 : Debug: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME (%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') Wed Sep 2 08:38:21 2015 : Debug: Parsed xlat tree: Wed Sep 2 08:38:21 2015 : Debug: literal --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES (' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Acct-Session-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Acct-Unique-Session-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> SQL-User-Name Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Realm Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-IP-Address Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: if { Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-Port-Id Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: else { Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-Port Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> NAS-Port-Type Wed Sep 2 08:38:21 2015 : Debug: literal --> ', FROM_UNIXTIME( Wed Sep 2 08:38:21 2015 : Debug: xlat --> integer Wed Sep 2 08:38:21 2015 : Debug: { Wed Sep 2 08:38:21 2015 : Debug: literal --> Event-Timestamp Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: literal --> ), FROM_UNIXTIME( Wed Sep 2 08:38:21 2015 : Debug: xlat --> integer Wed Sep 2 08:38:21 2015 : Debug: { Wed Sep 2 08:38:21 2015 : Debug: literal --> Event-Timestamp Wed Sep 2 08:38:21 2015 : Debug: } Wed Sep 2 08:38:21 2015 : Debug: literal --> ), NULL, '0', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Acct-Authentic Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Connect-Info Wed Sep 2 08:38:21 2015 : Debug: literal --> ', '', '0', '0', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Called-Station-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Calling-Station-Id Wed Sep 2 08:38:21 2015 : Debug: literal --> ', '', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Service-Type Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Framed-Protocol Wed Sep 2 08:38:21 2015 : Debug: literal --> ', ' Wed Sep 2 08:38:21 2015 : Debug: attribute --> Framed-IP-Address Wed Sep 2 08:38:21 2015 : Debug: literal --> ') Wed Sep 2 08:38:21 2015 : Debug: (10) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME (%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') Wed Sep 2 08:38:21 2015 : Debug: (10) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype,acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('00000028', '', 'Administrateur', '', '172.29.x.x', '284', 'Wireless-802.11', FROM_UNIXTIME(), FROM_UNIXTIME(), NULL, '0', 'RADIUS', '', '', '0', '0', '00xxxxxxxx', 'xxxxxxxxxxx', '', 'Framed-User', '', '') Wed Sep 2 08:38:21 2015 : Debug: (10) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('00000028', '', 'Administrateur', '', '172.29.x.x', '284', 'Wireless-802.11', FROM_UNIXTIME(), FROM_UNIXTIME(), NULL, '0', 'RADIUS', '', '', '0', '0', 'xxxxxxxxxxxxx', 'xxxxxxxxxxxxxx', '', 'Framed-User', '', '') Wed Sep 2 08:38:21 2015 : Debug: rlm_sql_mysql: No additional diagnostic info on server Wed Sep 2 08:38:21 2015 : ERROR: (10) sql: rlm_sql_mysql: ERROR 1582 (Incorrect parameter count in the call to native function 'FROM_UNIXTIME'): 42000 Wed Sep 2 08:38:21 2015 : Debug: (10) sql: SQL query returned: server error Wed Sep 2 08:38:21 2015 : Debug: rlm_sql (sql): Released connection (6) Wed Sep 2 08:38:21 2015 : Debug: (10) modsingle[accounting]: returned from sql (rlm_sql) for request 10 Wed Sep 2 08:38:21 2015 : Debug: (10) [sql] = fail Wed Sep 2 08:38:21 2015 : Debug: (10) } # accounting = fail Wed Sep 2 08:38:21 2015 : Debug: (10) Not sending reply to client. Wed Sep 2 08:38:21 2015 : Debug: (10) Finished request Any ideas ? Thanks. Nicolas.

3 3

Fwd: PAM Radius COA
by Emma Benny 01 Sep '15

01 Sep '15

Hi, I'm new to Radius so I apologize if this is a stupid question. I could not find it answered in the archive after searching quite a bit. Does the pam_radius client support RFC 5176 ? Does it have support to get pushed DM or CoA messages from a freeRadius server and disconnect or force re-authentication of the user ? Thanks in advance, Emma

2 2

Re: Rest API for authentication
by Murat BEŞER 01 Sep '15

01 Sep '15

You could write proxy which provides a restfull api. Murat BEŞER Black-Solutionshttp://www.black-solutions.com ------ Original message------From: Herwin WeststrateDate: Tue, Sep 1, 2015 13:26To: FreeRadius users mailing list;Subject:Re: Rest API for authentication On 31-08-15 09:15, Randeep wrote:> Hi Alan,> > We have two types of IPTV boxes. One has pppoe support and other one> doesn't have pppoe support.> > We are using FreeRadius 3.0.8 for authentication.> > I remember you mentioning that authentication can be done via a rest api> also. So we can use this api for authentication for the device which> doesn't have the pppoe support.I think you've got a few things mixed up here. The rest module is just amodule that can run in different sections by calling an externalprocess/server via a RESTful API to do something. The added demo.pl addsa Cleartext-Password := testing123 to the control map, this could beused in the authorize section of a server, where for example the papmodule could compare the passwords in authenticate section. A bitcomparable to a lookup in a database to find the plaintext password.I've really got no idea how this would be related to iptv boxes thatdon't use pppoe. To me this sounds a bit like you heard about a conceptand now try to retrofit that concept to some completely unrelated problem.-- Herwin Weststrate-List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Windows 10 Random Mac Address
by Danner, Mearl 01 Sep '15

01 Sep '15

FYI. Haven't seen it mentioned here. Will create many headaches for folks using MAC authorization. https://www.ietf.org/proceedings/93/slides/slides-93-intarea-5.pdf Apple IOS 8 also. Mearl

5 7

regexp in authorize-File with FR3
by Anja Ruckdaeschel 01 Sep '15

01 Sep '15

Hi there, I use a lot of regex in the users - File in FR2. With FR3 it seems the regex in the authorize-File is compared as simple string. .... Tue Sep 1 14:56:10 2015 : Debug: ^(\.*)([a-zA-Z]{3}[0-9]{5}) Tue Sep 1 14:56:10 2015 : Debug: Parsed xlat tree: Tue Sep 1 14:56:10 2015 : Debug: literal --> ^(\.*)([a-zA-Z]{3}[0-9]{5}) Tue Sep 1 14:56:10 2015 : Debug: (0) files: EXPAND ^(\.*)([a-zA-Z]{3}[0-9]{5}) Tue Sep 1 14:56:10 2015 : Debug: (0) files: --> ^(\.*)([a-zA-Z]{3}[0-9]{5}) .... ... and it never matches. This post says, that is was removed "on non string attributes" in v3.0.x: http://lists.freeradius.org/pipermail/freeradius-users/2015-April/076848.ht… I'd like to use them on the User-Name-Attribute: User-Name =~ "^(\.*)([a-zA-Z]{3}[0-9]{5})" But User-Name is a string, isn't it? dictionary.rfc2865:ATTRIBUTE User-Name 1 string So the question is: Did you remove regex completely from the files module and I need to do it with unlang or is there another notation for this one? Thank you for your time, Ciao Anja

1 0

EAP-TLS
by Jim Shi 01 Sep '15

01 Sep '15

Hi, I want to use EAP-TLS to verify client’s certificate and set policy based on the groups that the CN belongs to. How to do it? Thanks Jim

2 1

Postgresql groupreply problem
by georg＠wojti.de 01 Sep '15

01 Sep '15

Hello @ all, I want to change the user MAC-authentication with an HP-Switch from the users-file to postgresql. The first thing is, that I have a some lines which check whether it is a Call-Check or not. If not then the radius has to reject this. But I think it's ok if I put this into the users-file. I have written the Cleartext-Password in this file, too, because I get an chap error (chap: ERROR: &control:Cleartext-Password is required for authentication), when I put this into the database. In the Moment my configurations looks like this: -------------- users file -------------- DEFAULT Service-Type != Call-Check, Auth-Type := Reject Fall-Through = Yes DEFAULT Cleartext-Password := "xxxXXXxxx" Fall-Through = Yes DEFAULT Egress-VLANID := 0x3200005C #<-- check in server.conf; reject if it's the same -------------- server.conf -------------- ... authorize { suffix if (Realm != "NULL") { reject } chap files.sw-hp-mac-v3 sql.sw-hp-mac-v3 if (reply:Egress-VLANID == "0x3200005C") { reject } } -------------- Database -------------- (Hope that the format is ok. The tables radreply and radgroupcheck are empty) +----------------------------------------------------------------------+ | radcheck | +----+-------------------+--------------------+----+-------------------+ | id | username | attribute | op | value | +----+-------------------+--------------------+----+-------------------+ | 0 | 00:11:22:33:44:55 | Calling-Station-Id | == | 00-11-22-33-44-55 | +----+-------------------+--------------------+----+-------------------+ +-----------------------------------------------+ | radusergroup | +----+-------------------+-----------+----------+ | id | username | groupname | priority | +----+-------------------+-----------+----------+ | 0 | 00:11:22:33:44:55 | abc | 0 | +----+-------------------+-----------+----------+ +--------------------------------------------------+ | radgroupreply | +----+-----------+---------------+----+------------+ | id | groupname | attribute | op | value | +----+-----------+---------------+----+------------+ | 0 | abc | Egress-VLANID | := | 0x320000E0 | +----+-----------+---------------+----+------------+ The main problem is that the freeradius does not insert the GroupName in the sql-commands and so there is no correct reply. -------------- Debug-Log -------------- (0) Received Access-Request Id 138 from 172.16.xx.xx:1812 to 172.16.xx.xx:1816 length 321 (0) Framed-MTU = 1466 (0) NAS-IP-Address = 172.16..xx.xx (0) NAS-Identifier = "sw01" (0) User-Name = "00:11:22:33:44:55" (0) Service-Type = Call-Check (0) Framed-Protocol = PPP (0) NAS-Port = 23 (0) NAS-Port-Type = Ethernet (0) NAS-Port-Id = "A23" (0) Called-Station-Id = "a1-a2-a3-a4-a5-a6" (0) Calling-Station-Id = "00-11-22-33-44-55" (0) Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" (0) CHAP-Password = 0x366421f13cb0e52b71c59e9ec39f5a83fe (0) Message-Authenticator = 0x61c0cb3d1d3b1a2f5f634817119d999f (0) MS-RAS-Vendor = 11 (0) HP-Capability-Advert = 0x011a0000000b28 (0) HP-Capability-Advert = 0x011a0000000b2e (0) HP-Capability-Advert = 0x011a0000000b30 (0) HP-Capability-Advert = 0x011a0000000b3d (0) HP-Capability-Advert = 0x0138 (0) HP-Capability-Advert = 0x013a (0) HP-Capability-Advert = 0x0140 (0) HP-Capability-Advert = 0x0141 (0) HP-Capability-Advert = 0x0151 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/sw-hp-mac (0) authorize { (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "00:11:22:33:44:55", looking up realm NULL (0) suffix: Found realm "NULL" (0) suffix: Adding Stripped-User-Name = "00:11:22:33:44:55" (0) suffix: Adding Realm = "NULL" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) if (Realm != "NULL") { (0) if (Realm != "NULL") -> FALSE (0) chap: &control:Auth-Type := CHAP (0) [chap] = ok (0) files.sw-hp-mac-v3: users: Matched entry DEFAULT at line 4 (0) files.sw-hp-mac-v3: users: Matched entry DEFAULT at line 7 (0) [files.sw-hp-mac-v3] = ok (0) sql.sw-hp-mac-v3: EXPAND %{User-Name} (0) sql.sw-hp-mac-v3: --> 00:11:22:33:44:55 (0) sql.sw-hp-mac-v3: SQL-User-Name set to '00:11:22:33:44:55' rlm_sql (sql.sw-hp-mac-v3): Reserved connection (0) (0) sql.sw-hp-mac-v3: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql.sw-hp-mac-v3: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '00:11:22:33:44:55' ORDER BY id (0) sql.sw-hp-mac-v3: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '00:11:22:33:44:55' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) sql.sw-hp-mac-v3: User found in radcheck table (0) sql.sw-hp-mac-v3: Conditional check items matched, merging assignment check items (0) sql.sw-hp-mac-v3: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql.sw-hp-mac-v3: --> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '00:11:22:33:44:55' ORDER BY id (0) sql.sw-hp-mac-v3: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '00:11:22:33:44:55' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql.sw-hp-mac-v3: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql.sw-hp-mac-v3: --> SELECT GroupName FROM radusergroup WHERE UserName='00:11:22:33:44:55' ORDER BY priority (0) sql.sw-hp-mac-v3: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='00:11:22:33:44:55' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 (0) sql.sw-hp-mac-v3: User found in the group table (0) sql.sw-hp-mac-v3: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id (0) sql.sw-hp-mac-v3: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '' ORDER BY id (0) sql.sw-hp-mac-v3: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql.sw-hp-mac-v3: Group "abc": Conditional check items matched (0) sql.sw-hp-mac-v3: Group "abc": Merging assignment check items (0) sql.sw-hp-mac-v3: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id (0) sql.sw-hp-mac-v3: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '' ORDER BY id (0) sql.sw-hp-mac-v3: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql.sw-hp-mac-v3: Group "abc": Merging reply items rlm_sql (sql.sw-hp-mac-v3): Released connection (0) (0) [sql.sw-hp-mac-v3] = ok (0) if (reply:Egress-VLANID == "0x3200005C") { (0) if (reply:Egress-VLANID == "0x3200005C") -> TRUE (0) if (reply:Egress-VLANID == "0x3200005C") { (0) [reject] = reject (0) } # if (reply:Egress-VLANID == "0x3200005C") = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/sw-hp-mac (0) Post-Auth-Type REJECT { (0) sql.sw-hp-mac-v3: EXPAND .query (0) sql.sw-hp-mac-v3: --> .query (0) sql.sw-hp-mac-v3: Using query template 'query' rlm_sql (sql.sw-hp-mac-v3): Reserved connection (1) (0) sql.sw-hp-mac-v3: EXPAND %{User-Name} (0) sql.sw-hp-mac-v3: --> 00:11:22:33:44:55 (0) sql.sw-hp-mac-v3: SQL-User-Name set to '00:11:22:33:44:55' (0) sql.sw-hp-mac-v3: EXPAND INSERT INTO radpostauth (username, pass, reply, calledstationid, callingstationid, authdate) VALUES('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', '%{Called-Station-Id}', '%{Calling-Station-Id}', NOW()) (0) sql.sw-hp-mac-v3: --> INSERT INTO radpostauth (username, pass, reply, calledstationid, callingstationid, authdate) VALUES('00:11:22:33:44:55', 'Chap-Password', 'Access-Reject', 'a1-a2-a3-a4-a5-a6', '00-11-22-33-44-55', NOW()) (0) sql.sw-hp-mac-v3: Executing query: INSERT INTO radpostauth (username, pass, reply, calledstationid, callingstationid, authdate) VALUES('00:11:22:33:44:55', 'Chap-Password', 'Access-Reject', 'a1-a2-a3-a4-a5-a6', '00-11-22-33-44-55', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 (0) sql.sw-hp-mac-v3: SQL query returned: success (0) sql.sw-hp-mac-v3: 1 record(s) updated rlm_sql (sql.sw-hp-mac-v3): Released connection (1) (0) [sql.sw-hp-mac-v3] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> 00:11:22:33:44:55 (0) attr_filter.access_reject: Matched entry DEFAULT at line 18 (0) [attr_filter.access_reject] = updated (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) <delay>: Sending delayed response (0) <delay>: Sent Access-Reject Id 138 from 172.16.xx.xx:1816 to 172.16.xx.xx:1812 length 20 Waking up in 3.9 seconds. (0) <delay>: Cleaning up request packet ID 138 with timestamp +10 Does anyone have an idea? Best regards.

2 2

sqlippool
by Noel Butler 31 Aug '15

31 Aug '15

In our migration test bed from our antique radius to freeradius I seem to have issue with freeradius sql dishing out IP's... if I use ippool, sure works great, but our NAS's do this now and we are trying to move away to sql, which doesn't in fact doesn't seem to even look for it using radiusd -X We have populated radippool with pool name: 'main_pool', ' i.p.add.ress' added DEFAULT Pool-Name := main_pool

2 5