- Freeradius-Users - lists.freeradius.org

Updating/overwriting attribute with rlm_python
by Norman Elton 26 Oct '23

26 Oct '23

I’m using rlm_python, returning a tuple to update attributes in the reply. I’ve noticed that if the request already has a value for that attribute, it is not overwritten. That is, my operation becomes a no-op. I suppose this matches the behavior of the “=“ operator. Is there a way to behave like the “:=“ operator, overwriting the existing value? Or should I strip the value prior to invoking my python module? Thanks, Norman

2 1

PEAP/mschapv2 password fail log guestion
by 박지연 25 Oct '23

25 Oct '23

1 0

Stuck at "More than 50 roundtrips"
by thomas＠habets.se 24 Oct '23

24 Oct '23

Hi. I'm trying to set up EAP-TLS with certificates with an Android Pixel 7 Pro, latest OS, via a Unifi U6 Pro, using FreeRadius 3.0.17 on a raspberry pi 4. I took the default config, and changed as little as possible: clients.conf, added: client wifi_aps { ipaddr = 192.168.123.0/24 secret = radiuspasswordhere } In case it would help, I also added a user. PEAP auth with username/password works. wifi Cleartext-Password := "XXXXXXX" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "13", Reply-Message = "Hello there!" Made the certificates by editing the .cnf files and doing "make ca.pem", "make server.pem", and "make client.pem". I loaded the .p12 on the Android phone, and changed the paths in mod-enabled/eap. I changed default_eap_type to tls, and added use_tunneled_reply to tls-config. Here's a selection of the output of freeradius -X: First access request in packet 1: (1) Received Access-Request Id 61 from 192.168.XX.Z:59545 to 192.168.XX.Y:1812 length 216 SSL handshake done by packet 8: (8) eap_tls: SSL Connection Established (with client cert details shown) After that there's just a bunch of apparently empty-ish repeating Access-Request/Access-Challenge[1], and it's stuck that way until: (52) eap: ERROR: rlm_eap (EAP): Aborting! More than 50 roundtrips made in session with state 0x8e36e001bc25ed47 What am I doing wrong? In this example I'm putting "wifi" as identity, in case it helps that it's present in the user config. I expect that at some point the server should reply Accepted, instead of a new challenge. I guess the client cert was not enough auth? Is there a config I need to change so that cert is sufficient? I'd appreciate any help. Thanks. [1] (14) Received Access-Request Id 74 from 192.168.XX.Z:59545 to 192.168.XX.Y:1812 length 231 (14) User-Name = "wifi" (14) NAS-IP-Address = 192.168.XX.Z (14) NAS-Identifier = "xxx" (14) Called-Station-Id = "xx-xx-xx-xx-xx-xx:secnet2" (14) NAS-Port-Type = Wireless-802.11 (14) Service-Type = Framed-User (14) Calling-Station-Id = "xx-xx-xx-xx-xx-xx" (14) Connect-Info = "CONNECT 0Mbps 802.11b" (14) Acct-Session-Id = "3E1F2B0282D15C98" (14) Acct-Multi-Session-Id = "3870EEE1F7155662" (14) WLAN-Pairwise-Cipher = 1027076 (14) WLAN-Group-Cipher = 1027076 (14) WLAN-AKM-Suite = 1027073 (14) Framed-MTU = 1400 (14) EAP-Message = 0x02ed00060d00 (14) State = 0x8e36e00182dbed476556c84932fcf3de (14) Message-Authenticator = 0x03a0ae965bd12781a50f91cd3ac1aaf6 (14) session-state: No cached attributes (14) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (14) authorize { (14) policy filter_username { (14) if (&User-Name) { (14) if (&User-Name) -> TRUE (14) if (&User-Name) { (14) if (&User-Name =~ / /) { (14) if (&User-Name =~ / /) -> FALSE (14) if (&User-Name =~ /@[^@]*@/ ) { (14) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (14) if (&User-Name =~ /\.\./ ) { (14) if (&User-Name =~ /\.\./ ) -> FALSE (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (14) if (&User-Name =~ /\.$/) { (14) if (&User-Name =~ /\.$/) -> FALSE (14) if (&User-Name =~ /(a)\./) { (14) if (&User-Name =~ /(a)\./) -> FALSE (14) } # if (&User-Name) = notfound (14) } # policy filter_username = notfound (14) [preprocess] = ok (14) [chap] = noop (14) [mschap] = noop (14) [digest] = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "wifi", looking up realm NULL (14) suffix: No such realm "NULL" (14) [suffix] = noop (14) eap: Peer sent EAP Response (code 2) ID 237 length 6 (14) eap: No EAP Start, assuming it's an on-going EAP conversation (14) [eap] = updated (14) files: users: Matched entry wifi at line 90 (14) [files] = ok (14) [expiration] = noop (14) [logintime] = noop (14) pap: WARNING: Auth-Type already set. Not setting to PAP (14) [pap] = noop (14) } # authorize = updated (14) Found Auth-Type = eap (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) authenticate { (14) eap: Expiring EAP session with state 0x8e36e00182dbed47 (14) eap: Finished EAP session with state 0x8e36e00182dbed47 (14) eap: Previous EAP request found for state 0x8e36e00182dbed47, released from the list (14) eap: Peer sent packet with method EAP TLS (13) (14) eap: Calling submodule eap_tls to process data (14) eap_tls: Continuing EAP-TLS (14) eap_tls: Peer ACKed our handshake fragment (14) eap_tls: [eaptls verify] = request (14) eap_tls: [eaptls process] = handled (14) eap: Sending EAP Request (code 1) ID 238 length 10 (14) eap: EAP session adding &reply:State = 0x8e36e00183d8ed47 (14) [eap] = handled (14) } # authenticate = handled (14) Using Post-Auth-Type Challenge (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) Challenge { ... } # empty sub-section is ignored (14) Sent Access-Challenge Id 74 from 192.168.XX.Y:1812 to 192.168.XX.Z:59545 length 0 (14) Tunnel-Type = VLAN (14) Tunnel-Medium-Type = IEEE-802 (14) Tunnel-Private-Group-Id = "13" (14) Reply-Message = "Hello there!" (14) EAP-Message = 0x01ee000a0d8000000000 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x8e36e00183d8ed476556c84932fcf3de (14) Finished request -- typedef struct me_s { char name[] = { "Thomas Habets" }; char email[] = { "thomas(a)habets.se" }; char kernel[] = { "Linux" }; char *pgpKey[] = { "http://www.habets.pp.se/pubkey.txt" }; char pgp[] = { "9907 8698 8A24 F52F 1C2E 87F6 39A4 9EEA 460A 0169" }; char coolcmd[] = { "echo '. ./_&. ./_'>_;. ./_" }; } me_t;

2 3

Identify the site in logging
by Stephane Bourque 24 Oct '23

24 Oct '23

Hello, We have a need to be able to identify the virtual-server that is generating the log messages. How would you approach this? - Is there a way to get a different logging configuration per server? - Is there a way to add the server name in logging statements? We are not too sure of how to proceed. Thanks for your guidance. -- *Stephane Bourque* *CEO & Founder* *Arilia Wireless Inc.* *"Everything connected"* stephane.bourque(a)arilia.com +1(778)558-3524 *www.arilia.com <http://www.arilia.com>*

3 3

Unable to start freeradius as service - Couldn't connect to MySQL server
by vira vva 24 Oct '23

24 Oct '23

root@ngw40:/etc/freeradius/mods-enabled# freeradius -v radiusd: FreeRADIUS Version 3.2.3 (git #db3d1924d), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.2.3 running on terminal without any issue *freeradius -X* Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 44685 Listening on proxy address :: port 57364 *run as as service always failed with sql connection issue* Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: # Instantiating module "sql" from file /etc/freeradius/mods-enabled/sql Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Info: rlm_sql_mysql: libmysql version: 8.0.34 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: mysql { Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: tls { Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011ca_file = "/etc/ssl/certs/my_ca.crt" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011ca_path = "/etc/ssl/certs/" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011certificate_file = "/etc/ssl/certs/private/client.crt" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011private_key_file = "/etc/ssl/certs/private/client.key" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011cipher = "DHE-RSA-AES256-SHA:AES128-SHA" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011tls_required = yes Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011check_cert = no Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011check_cert_cn = no Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Warning: /etc/freeradius/mods-enabled/sql[94]: The item 'tls_check_cert' is defined, but is unused by the configuration Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Warning: /etc/freeradius/mods-enabled/sql[95]: The item 'tls_check_cert_cn' is defined, but is unused by the configuration Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: } Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011warnings = "auto" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: } Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Info: rlm_sql (sql): Attempting to connect to database "radius" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql): Initialising connection pool Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: pool { Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011start = 5 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011min = 3 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011max = 32 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011spare = 10 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011uses = 0 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011lifetime = 0 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011cleanup_interval = 30 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011idle_timeout = 60 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011retry_delay = 30 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011max_retries = 5 Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: #011spread = no Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: } Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql): Processing generate_sql_clients Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Info: rlm_sql (sql): Opening additional connection (0), 1 of 1 pending slots used Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql_mysql: Starting connect to MySQL server Oct 24 14:42:43 ngw40 freeradius[168957]: WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: rlm_sql_mysql: Couldn't connect to MySQL server radius@localhost:radius Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: rlm_sql_mysql: MySQL error: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Debug: rlm_sql_mysql: Socket destructor called, closing socket Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: rlm_sql (sql): Opening connection failed (0) Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: Failed to load clients from SQL Oct 24 14:42:43 ngw40 freeradius[168957]: Tue Oct 24 14:42:43 2023 : Error: /etc/freeradius/mods-enabled/sql[27]: Instantiation failed for module "sql"

2 1

How to match Vendor specific attribute
by Vishnu 23 Oct '23

23 Oct '23

Hi, I am using freeradius as a proxy, I want to match the VSA with the if statement and add another VSA based on that. Below mentioned is my custom policy config. custom_policy { if (NAS-Identifier =~ /DUBDC1-EX2200-*/) { if (%{Switch-User-Policy} =~ /.*switch-superuser.*/) update reply { Juniper-Local-User-Name = "switch-superuser" } } } } if i use .* instead of /.*switch-superuser.*/ it works. but i want to match the string. Please let me know how i can achieve this. Below is the Access accept message. (0) Sent Access-Accept Id 203 from 10.108.25.102:1812 to 10.108.25.29:56849 length 44 (0) Switch-User-Policy = "switch-superuser" Thanks, Vishnu

2 1

supported os
by Andrei Katsuk 23 Oct '23

23 Oct '23

Hello! I found on https://wiki.freeradius.org/building/Platforms that Officially supported linux platforms are: CentOS Red Hat Debian Ubuntu Also I found on https://hub.docker.com/r/freeradius/freeradius-server/ that freeradius docker image is based on alpine image. Does it mean that alpine os is also officially supported ? Which linux os you suggest to use as the base os for docker image with freeradius ? Thanks in advance, Andrei

5 6

Konfig FreeRadius with Mikrotik-Routerboard - IP-Pool SQL
by Florian Traxler (mieX GmbH) 20 Oct '23

20 Oct '23

Hello! I currently have a FreeRADIUS version 3.0.20 installed on an Ubuntu 20.04.6 LTS and connected to a Mikrotik router board. Here the connection is made via PPP and DHCP and authentication is requested at the Radius. The aim of the configuration would be to provide the IP, which is now assigned via the IP pool by Mikrotik, directly via the FreeRadius database. Is this even possible in combination with Mikrotik? Thanks for the help.

4 5

Re: How setup simultaneous-use?
by ti.suporte＠lupusequipamentos.com.br 11 Oct '23

11 Oct '23

Alan, Firstly, thank you for your attention! I check the settings as you recommended see the details: First I sent an authentication package via radclient and everything seemed to go well. echo "User-Name=allan, User-Password=teste1234" | radclient localhost:1812 auth testing123 (0) Received Access-Request Id 30 from 127.0.0.1:39052 to 127.0.0.1:1812 length 45 (0) User-Name = "allan" (0) User-Password = "teste1234" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "allan", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> allan (0) sql: SQL-User-Name set to 'allan' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'allan' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "teste1234" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'allan' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'allan' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id (0) sql: Group "wifi": Conditional check items matched (0) sql: Group "wifi": Merging assignment check items (0) sql: Simultaneous-Use := 1 (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id (0) sql: Group "wifi": Merging reply items rlm_sql (sql): Released connection (1) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section session from file /etc/freeradius/3.0/sites-enabled/default (0) session { (0) radutmp: EXPAND /var/log/freeradius/radutmp (0) radutmp: --> /var/log/freeradius/radutmp (0) radutmp: EXPAND %{User-Name} (0) radutmp: --> allan (0) [radutmp] = ok (0) } # session = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> allan (0) sql: SQL-User-Name set to 'allan' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'allan', 'teste1234', 'Access-Accept', '2023-10-11 18:49:57.016895' ) (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'allan', 'teste1234', 'Access-Accept', '2023-10-11 18:49:57.016895' ) (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = ok (0) Sent Access-Accept Id 30 from 127.0.0.1:1812 to 127.0.0.1:39052 length 20 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 30 with timestamp +4 due to cleanup_delay was reached Ready to process requests After I sent an accounting package, but something seems wrong with the "radutmp" file. Also, there seemed to be some errors with the mysql socket but in the end it is shown that the 'accounting' operation "went well". echo "User-Name=allan, User-Password=teste1234" | radclient localhost:1813 acct testing123 Ready to process requests (1) Received Accounting-Request Id 108 from 127.0.0.1:56660 to 127.0.0.1:1813 length 45 (1) User-Name = "allan" (1) User-Password = ":\270\236\034|\236޿\214c^S\006\3361`" (1) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) policy acct_unique { (1) update request { (1) &Tmp-String-9 := "ai:" (1) } # update request = noop (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (1) EXPAND %{hex:&Class} (1) --> (1) EXPAND ^%{hex:&Tmp-String-9} (1) --> ^61693a (1) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> 375c5dce389b47d1a42e4e8d8fb01b42 (1) &Acct-Unique-Session-Id := 375c5dce389b47d1a42e4e8d8fb01b42 (1) } # update request = noop (1) } # else = noop (1) update request { (1) &Tmp-String-9 !* ANY (1) } # update request = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "allan", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/default (1) accounting { (1) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (1) detail: --> /var/log/freeradius/radacct/127.0.0.1/detail-20231011 (1) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail-20231011 (1) detail: EXPAND %t (1) detail: --> Wed Oct 11 18:51:30 2023 (1) [detail] = ok (1) unix: no Accounting-Status-Type attribute in request (1) [unix] = noop (1) radutmp: No Accounting-Status-Type record (1) [radutmp] = noop (1) sql: EXPAND %{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query} (1) sql: --> type.accounting.query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (1) sql: EXPAND %{User-Name} (1) sql: --> allan (1) sql: SQL-User-Name set to 'allan' (1) sql: EXPAND SELECT true (1) sql: --> SELECT true (1) sql: Executing query: SELECT true (1) sql: SQL query returned: success (1) sql: -1 record(s) updated (1) sql: No additional queries configured rlm_sql (sql): Released connection (3) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.11.2-MariaDB-1, protocol version 10 rlm_sql (sql): Closing expired connection (6) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (5) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (4) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (1) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing expired connection (0) - Hit idle_timeout limit rlm_sql_mysql: Socket destructor called, closing socket (1) [sql] = noop (1) [exec] = noop (1) attr_filter.accounting_response: EXPAND %{User-Name} (1) attr_filter.accounting_response: --> allan (1) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated (1) Sent Accounting-Response Id 108 from 127.0.0.1:1813 to 127.0.0.1:56660 length 20 (1) Finished request (1) Cleaning up request packet ID 108 with timestamp +97 due to done Ready to process requests look at the permissions of the "radutmp" file, it is not writing anything to it. When tested with the server in debug mode, the accounting packages are showing "failed": (62) Received Accounting-Request Id 202 from 192.168.5.122:37900 to 192.168.2.124:1813 length 217 (62) Acct-Status-Type = Start (62) Acct-Authentic = RADIUS (62) User-Name = "allan" (62) NAS-IP-Address = 192.168.5.122 (62) Framed-IP-Address = 192.168.5.71 (62) NAS-Identifier = "62223237ad6a" (62) Called-Station-Id = "62-22-32-37-AD-6A:TestLP" (62) NAS-Port-Type = Wireless-802.11 (62) Service-Type = Framed-User (62) Calling-Station-Id = "30-89-4A-03-E8-78" (62) Connect-Info = "CONNECT 0Mbps 802.11a" (62) Acct-Session-Id = "F1B9944619AE1244" (62) Acct-Multi-Session-Id = "90283D1835963A73" (62) WLAN-Pairwise-Cipher = 1027076 (62) WLAN-Group-Cipher = 1027076 (62) WLAN-AKM-Suite = 1027077 (62) WLAN-Group-Mgmt-Cipher = 1027078 (62) Event-Timestamp = "Oct 11 2023 17:07:16 -03" (62) Acct-Delay-Time = 3 (62) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (62) preacct { (62) [preprocess] = ok (62) policy acct_unique { (62) update request { (62) &Tmp-String-9 := "ai:" (62) } # update request = noop (62) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (62) EXPAND %{hex:&Class} (62) --> (62) EXPAND ^%{hex:&Tmp-String-9} (62) --> ^61693a (62) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (62) else { (62) update request { (62) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (62) --> 9d456cff7c990d3febc8914a36a8fff9 (62) &Acct-Unique-Session-Id := 9d456cff7c990d3febc8914a36a8fff9 (62) } # update request = noop (62) } # else = noop (62) update request { (62) &Tmp-String-9 !* ANY (62) } # update request = noop (62) } # policy acct_unique = noop (62) suffix: Checking for suffix after "@" (62) suffix: No '@' in User-Name = "allan", looking up realm NULL (62) suffix: No such realm "NULL" (62) [suffix] = noop (62) [files] = noop (62) } # preacct = ok (62) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/default (62) accounting { (62) detail: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (62) detail: --> /var/log/freeradius/radacct/192.168.5.122/detail-20231011 (62) detail: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.5.122/detail-20231011 (62) detail: EXPAND %t (62) detail: --> Wed Oct 11 17:07:19 2023 (62) [detail] = ok (62) [unix] = fail (62) } # accounting = fail (62) Not sending reply to client. (62) Finished request Once again, thank you for your attention! This is my first experience with RADIUS and I don't know any specialized personnel in my region. Best regards, Allan Cristian. -----Mensagem original----- De: Freeradius-Users <freeradius-users-bounces+ti.suporte=lupusequipamentos.com.br(a)lists.freeradius.org> Em nome de freeradius-users-request(a)lists.freeradius.org Enviada em: quarta-feira, 11 de outubro de 2023 09:00 Para: freeradius-users(a)lists.freeradius.org Assunto: Freeradius-Users Digest, Vol 222, Issue 12 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. And then there were 4. (Alan DeKok) 2. Re: And then there were 4. (Conrad Classen) 3. Re: And then there were 4. (Matthew Newton) 4. Re: How setup simultaneous-use? (Alan DeKok) 5. Re: And then there were 4. (Matt Zagrabelny) 6. Re: And then there were 4. (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Tue, 10 Oct 2023 15:05:26 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: And then there were 4. Message-ID: <933CD530-15C5-460E-BBB4-86075BA70C94(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii We're happy to release the first alpha of version 4.0. The full release notes are online at: https://freeradius.org/4.0/alpha.html Packages are available at: https://freeradius.org/ftp/pub/freeradius/ This isn't the full release of version 4. We expect that next year. But it has major improvements over version 3. Please try it and see what you think. Not all features are available (RadSec is missing, as is PEAP and TTLS). We don't expect major changes between now and the full 4.0. There will be changes, but the major work of re-architecture is done. Alan DeKok. ------------------------------ Message: 2 Date: Tue, 10 Oct 2023 21:08:19 +0200 From: Conrad Classen <conrad.classen(a)gmail.com> To: freeradius-users(a)lists.freeradius.org Subject: Re: And then there were 4. Message-ID: <e4ea31d4-2084-44bb-9115-f8723bad0579(a)gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Hi Alan and dev team, congratulations, that was a lot of work and effort that went into this. Thank-you, and I look forwards to playing with v4-Alpha Much appreciated On 2023/10/10 21:05, Alan DeKok wrote: > We're happy to release the first alpha of version 4.0. The full release notes are online at: > > https://freeradius.org/4.0/alpha.html > > Packages are available at: > > https://freeradius.org/ftp/pub/freeradius/ > > This isn't the full release of version 4. We expect that next year. But it has major improvements over version 3. > > Please try it and see what you think. Not all features are available (RadSec is missing, as is PEAP and TTLS). > > We don't expect major changes between now and the full 4.0. There will be changes, but the major work of re-architecture is done. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? > Seehttp://www.freeradius.org/list/users.html ------------------------------ Message: 3 Date: Tue, 10 Oct 2023 20:25:39 +0100 From: Matthew Newton <mcn(a)freeradius.org> To: freeradius-users(a)lists.freeradius.org Subject: Re: And then there were 4. Message-ID: <3744ec70-5e10-450a-b0d8-63f53eb00c65(a)freeradius.org> Content-Type: text/plain; charset=UTF-8; format=flowed On 10/10/2023 20:05, Alan DeKok wrote: > We're happy to release the first alpha of version 4.0. The full release notes are online at: > > https://freeradius.org/4.0/alpha.html > > Packages are available at: > > https://freeradius.org/ftp/pub/freeradius/ As usual, Network RADIUS are providing pre-built packages packages for common Linux distributions. Details for these repositories are available from the following web page: https://networkradius.com/packages/4.0/ Note that you *must* have the most recent version of libkqueue installed to use v4. No distributions include this (as far as I am aware). Any libkqueue packages they provide have bugs that will likely cause FreeRADIUS to randomly crash. Network RADIUS therefore also provide packages for libkqueue. The instructions on the above page include adding the "extras" repo which includes this. -- Matthew ------------------------------ Message: 4 Date: Tue, 10 Oct 2023 15:59:21 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: How setup simultaneous-use? Message-ID: <4C2EA627-71B4-44BC-A19E-B297A1D6BC0F(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Oct 10, 2023, at 8:07 AM, ti.suporte(a)lupusequipamentos.com.br wrote: > I need to block multiple connections for users and i need help to setup the > "Simultaneous-Use" with SQL. > > I see around forums, the documentation and others communities for help to > config this atribute, and i dont has no more ideas. In order for Simultaneous-Use to work, not only the server has to be configured properly. The NAS has to be configured, too. The NAS *must* send accounting packets. If it doesn't, Simultaneous-Use won't work. You have Simultaneous-Use configured, which is a good start. But the next steps are: * verify that the server is receiving accounting packets * verify that the accounting packets are going into SQL Then in order to make sure that you can test this feature without affecting production: * use the real accounting packets to create "fake" ones for a test user. Change the User-Name in the packet. * set up a test user. Make sure it's only User-Name and password. Don't worry about EAP. * use radclient to send an Access-Request. Verify that Simultaneous-use is being applied. * the server is seeing Simultaneous-Use in the configs * the server is checking SQL * the server is returning Access-Accept * Then send an accounting start packet for that user, using radclient. * verify that radclient sees an Accounting-Response * verify that the accounting data is entered in SQL * Then send _another_ Access-Request for the same user * verify that the Simultaneous-Use / SQL checks are done as above * verify that the server returns Access-Reject * use radclient to send Accounting Stop for the test user * this cleans up the entry in SQL. It's not enough to just configure Simultaneous-Use. This is RADIUS, and there's a whole lot going on behind the scenes. You have to ensure that every little piece is working correctly. Alan DeKok. ------------------------------ Message: 5 Date: Tue, 10 Oct 2023 15:08:47 -0500 From: Matt Zagrabelny <mzagrabe(a)d.umn.edu> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: And then there were 4. Message-ID: <CAOLfK3XVf4hMjz9UxKgviyJbbTK7Ae7iwnaJYY15=N1aWtB06w(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" Hello! On Tue, Oct 10, 2023 at 2:05?PM Alan DeKok <aland(a)deployingradius.com> wrote: > We're happy to release the first alpha of version 4.0. The full release > notes are online at: > Well done, Alan and team! > > https://freeradius.org/4.0/alpha.html > > Packages are available at: > > https://freeradius.org/ftp/pub/freeradius/ > > This isn't the full release of version 4. We expect that next year. > Thank you for reading my mind, Alan. I was mulling the idea of sending an email asking that exact question. Add clairvoyance to the feature list of v4. Again, we're very appreciative for your efforts, help, and generosity in both the software you provide, and assistance you give on the mailing list. Cheers! -m ------------------------------ Message: 6 Date: Tue, 10 Oct 2023 16:51:40 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: And then there were 4. Message-ID: <E883CC86-9CF6-4B61-A7A5-9DA19CFCBD84(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Oct 10, 2023, at 4:08 PM, Matt Zagrabelny via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > Well done, Alan and team! Thanks. It's been an enormous amount of work. > Thank you for reading my mind, Alan. I was mulling the idea of sending an > email asking that exact question. Add clairvoyance to the feature list of > v4. :) We plan on releasing v4 next August, in time for the 25th anniversary of FreeRADIUS. > Again, we're very appreciative for your efforts, help, and generosity in > both the software you provide, and assistance you give on the mailing list. You're welcome. Alan DeKok. ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 222, Issue 12 *************************************************

2 1

And then there were 4.
by Alan DeKok 10 Oct '23

10 Oct '23

We're happy to release the first alpha of version 4.0. The full release notes are online at: https://freeradius.org/4.0/alpha.html Packages are available at: https://freeradius.org/ftp/pub/freeradius/ This isn't the full release of version 4. We expect that next year. But it has major improvements over version 3. Please try it and see what you think. Not all features are available (RadSec is missing, as is PEAP and TTLS). We don't expect major changes between now and the full 4.0. There will be changes, but the major work of re-architecture is done. Alan DeKok.

4 4