- Freeradius-Users - lists.freeradius.org

Request throttling
by srithar jeevadurai 02 Jul '15

02 Jul '15

Dear Friends, Can we do throttling of no of request in process queue at freeRadius? FreeRadius is depending on mysql, if mysql db connectivity is down for some time then GGSN will feed freeRadius. Radius server may run into the 'child hung' issue then we need to restart freeRadius. To avoid child hung and restart of system. Can we do following? 1) Apply a cap on freeRadius processing queue i.e. if backlog on processing queue is more than 50000 request then reject requests further request until it comes down less than 50000. It will avoid child hung issue. My understanding on child hung: 1) If backlog is more in processing queue then it will spend time on processing head of the queue. 2) messages are reaching age limit of unattended age limit at tail of the queue. 3) Due to that child hung is happening. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

3 4

Migrating to a new server from 2.x to 3.0.4 CentOS 7
by Kris Armstrong 02 Jul '15

02 Jul '15

Hi, I have migrated my root CA and free radius configs from FreeRadius 2.x to 3.0.4 on CentOS7. I’m receiving the following messages when attempting to authenticate the client with EAP/TLS. PEAP/MSCHPv2 works perfect. I have tried to recreate the ROOT CA and Client cert but that produces the same error message. I’m not sure where to go from here. (6) eap_tls : <<< TLS 1.0 Handshake [length 03d4], Certificate --> verify error:num=20:unable to get local issuer certificate (6) ERROR: eap_tls : SSL says error 20 : unable to get local issuer certificate (6) eap_tls : >>> TLS 1.0 Alert [length 0002], fatal unknown_ca (6) ERROR: eap_tls : TLS Alert write:fatal:unknown CA tls: TLS_accept: Error in SSLv3 read client certificate B (6) ERROR: eap_tls : SSL says: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation (6) eap_tls : eaptls_process returned 4 (6) ERROR: eap : Failed continuing EAP TLS (13) session. EAP sub-module failed (6) eap : Failed in EAP select (6) [eap] = invalid (6) } # authenticate = invalid

3 15

ldapi:// with path
by Michael Ströder 02 Jul '15

02 Jul '15

HI! Testing git v3.1.x 36e1b02e926df5cd75d4d548694401535c607ca9 I noticed that something's wrong with LDAPI URLs containing a URL-encoded path. This does not work: server = 'ldapi://%2Ftmp%2Fopenldap-socket' leads to: rlm_ldap (ldap): Bind with uid=radiusd,ou=sys,dc=stroeder,dc=local to ldapi:///tmp/openldap-socket failed: Can't contact LDAP server I'm not sure whether radiusd URL-decodes the path and passes "ldapi:///tmp/openldap-socket" to libldap or whether the decoding simply happens when writing the log line. It should *not* do URL-decoding because parsing the LDAP URL "ldapi:///tmp/openldap-socket" in libldap won't work since the first "/" after the "hostport" part is the next separator to the DN portion. Ciao, Michael.

3 30

The radgroupreply parameters are not coming in response
by Randeep 02 Jul '15

02 Jul '15

Hi, We have updated our FreeRadius to 3.0.8. Initially we were usiong 2.1.12. But in this we are not getting the parameters in radgroupreply for the user's group. In logs it is showing merging in reply. But in reply those parameters are not showing. What can be the possible reason? [root@radius ~]# radtest randeeps randeeps localhost 0 testing123 Sent Access-Request Id 193 from 0.0.0.0:36043 to 127.0.0.1:1812 length 78 User-Name = 'randeeps' User-Password = 'randeeps' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = 'randeeps' Received Access-Accept Id 193 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 In debug: preply WHERE groupname = 'starter' ORDER BY id *Thu Jul 2 03:26:43 2015 : Debug: (0) sql: Group "starter": Merging reply items* Thu Jul 2 03:26:43 2015 : Debug: (0) sql: Framed-Protocol == PPP Thu Jul 2 03:26:43 2015 : Debug: (0) sql: Framed-MTU == 1500 Thu Jul 2 03:26:43 2015 : Debug: (0) sql: Framed-Routing == Broadcast-Listen Thu Jul 2 03:26:43 2015 : Debug: (0) sql: Framed-Compression == Van-Jacobson-TCP-IP Thu Jul 2 03:26:43 2015 : Debug: (0) sql: Service-Type == Framed-User Thu Jul 2 03:26:43 2015 : Debug: (0) sql: Idle-Timeout == 300 Thu Jul 2 03:26:43 2015 : Debug: (0) sql: Acct-Interim-Interval == 60 Thu Jul 2 03:26:43 2015 : Debug: (0) sql: Mikrotik-Rate-Limit == '4096k/4096k' Thu Jul 2 03:26:43 2015 : Debug: (0) sql: SQL query returned: success Thu Jul 2 03:26:43 2015 : Debug: (0) sql: 1 record(s) updated Thu Jul 2 03:26:43 2015 : Debug: rlm_sql (sql): Released connection (4) Thu Jul 2 03:26:43 2015 : Debug: (0) modsingle[post-auth]: returned from sql (rlm_sql) for request 0 Thu Jul 2 03:26:43 2015 : Debug: (0) [sql] = ok Thu Jul 2 03:26:43 2015 : Debug: (0) modsingle[post-auth]: calling exec (rlm_exec) for request 0 Thu Jul 2 03:26:43 2015 : Debug: (0) modsingle[post-auth]: returned from exec (rlm_exec) for request 0 Thu Jul 2 03:26:43 2015 : Debug: (0) [exec] = noop Thu Jul 2 03:26:43 2015 : Debug: (0) policy remove_reply_message_if_eap { Thu Jul 2 03:26:43 2015 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) { Thu Jul 2 03:26:43 2015 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Thu Jul 2 03:26:43 2015 : Debug: (0) else { Thu Jul 2 03:26:43 2015 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) for request 0 Thu Jul 2 03:26:43 2015 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) for request 0 Thu Jul 2 03:26:43 2015 : Debug: (0) [noop] = noop Thu Jul 2 03:26:43 2015 : Debug: (0) } # else = noop Thu Jul 2 03:26:43 2015 : Debug: (0) } # policy remove_reply_message_if_eap = noop Thu Jul 2 03:26:43 2015 : Debug: (0) } # post-auth = ok *Thu Jul 2 03:26:43 2015 : Debug: (0) Sent Access-Accept Id 193 from 127.0.0.1:1812 <http://127.0.0.1:1812> to 127.0.0.1:36043 <http://127.0.0.1:36043> length 0* Thu Jul 2 03:26:43 2015 : Debug: (0) Finished request Thu Jul 2 03:26:43 2015 : Debug: Waking up in 4.9 seconds. Thu Jul 2 03:26:48 2015 : Debug: (0) <done>: Cleaning up request packet ID 193 with timestamp +6 Thu Jul 2 03:26:48 2015 : Info: Ready to process requests But when I uncomment user steve in users file, all the parameters are coming in reply. Please help. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 2

LDAP search failed
by Hatim CHIKHI 02 Jul '15

02 Jul '15

Hello, I'm using freeRaduis version 2.1.12+dfsg-1.2. I'm trying to get some parameters from an AD server but I have problems with the search filter. Here is my ldap configuration: ldap { server = "myldapserver" basedn = "dc=ad,dc=domain,dc=fr" identity = "cn=LinOTP-Auth,ou=AD-Man,ou=Ressources,dc=ad,dc=domain,dc=fr" filter = "sAMAccountName==%{User-Name}" #base_filter = "(objectclass=sAMAccountName)" start_tls = no groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" #profile_attribute = "radiusFramedIPAddress" profile_attribute = "radiusprofile" access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 timeout = 4 timelimit = 5 net_timeout = 1 set_auth_type = yes } I'm not sure about the filter parameter. Here are freeradius logs: [ldap] performing user authorization for hatim [ldap] expand: sAMAccountName==%{User-Name} -> sAMAccountName==hatim [ldap] expand: dc=ad,dc=domain,dc=fr -> dc=ad,dc=domain,dc=fr [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to myldapserver:389, authentication 0 [ldap] bind as cn=LinOTP-Auth,ou=AD-Man,ou=Ressources,dc=ad,dc=domain,dc=fr/ to myldapserver:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=ad,dc=domain,dc=fr, with filter sAMAccountName==hatim [ldap] ldap_search() failed: Operations error [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail Can you help me please? Thank you!

4 5

Reg coa update to mikrotik - freeradius 2.2.5
by J＠g＠dee5h 02 Jul '15

02 Jul '15

Hello, I need to send coa update to mikrotik once the client reached the limit. But its not sending the request and I am receiving the below error. -------------- Thu Jul 2 13:07:22 2015 : Info: WARNING: Empty pre-proxy section. Using default return values. Thu Jul 2 13:07:22 2015 : Debug: ... adding new socket proxy address * port 46906 Thu Jul 2 13:07:22 2015 : Info: ERROR: Failed to create a new socket for proxying requests. Thu Jul 2 13:07:22 2015 : Debug: ERROR: Failed to insert CoA request into proxy list. ----------- We have opened the port 3799 in the mikrotik router also. In orginate-coa file I have given the below parameters. -------------- home_server Mikrotik-coa { type = coa # # Note that a home server of type "coa" MUST be a real NAS, # with an ipaddr or ipv6addr. It CANNOT point to a virtual # server. # ipaddr = 192.168.1.1 port = 3799 # This secret SHOULD NOT be the same as the shared # secret in a "client" section. secret = mikrotik # CoA specific parameters. See raddb/proxy.conf for details. coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } --------------- Please help what I am doing wrong. If I use radclient command coa is updating in mikrotik.

2 1

RE: Delayed bind options?
by Franks Andy (IT Technical Architecture Manager) 02 Jul '15

02 Jul '15

Oops, been a while. Thanks for the replies! The main thing we're using in the newer version is the multi-attribute checking w/ldap. Been after that for a long time, v happy when it showed up! Thanks Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 29 June 2015 19:28 To: Alan Buxey Cc: FreeRadius users mailing list Subject: Re: Delayed bind options? > On Jun 29, 2015, at 1:55 PM, Alan Buxey <A.L.M.Buxey(a)LBORO.AC.UK> wrote: > > Dang. Beat me to the answer. > > Ps why 3.1.0 ? That's real bleedy edgy! It bleeds awesome and SEGVs! -Arran

1 0

Reg radgroupreply table attribute is not sending to mikrotik in freeradius 3.0.8
by J＠g＠dee5h 02 Jul '15

02 Jul '15

Hi, I am using the freeradius 3.0.8, mysql and mikrotik. While access request from mikrotik, freeradius is not sending the radgroupreply table attributes. I have tested with radtest command also. Here is the radtest output and debug log. -------------- radtest randeeps xxx 192.168.1.182 0 xxxx Sending Access-Request of id 204 to 192.168.1.182 port 1812 User-Name = "randeeps" User-Password = "xxx" NAS-IP-Address = 192.168.1.182 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 192.168.1.182 port 1812, id=204, length=20 -------------- ---------------- (0) Received Access-Request Id 37 from 192.168.1.1:58640 to 192.168.1.182:1812 length 195 (0) NAS-Port-Type = Ethernet (0) Calling-Station-Id = '38:63:BB:AA:23:C8' (0) Called-Station-Id = 'server1' (0) NAS-Port-Id = 'LAN' (0) User-Name = 'randeeps' (0) NAS-Port = 2161115148 (0) Acct-Session-Id = '80d0000c' (0) Framed-IP-Address = 192.168.1.178 (0) Mikrotik-Host-IP = 192.168.1.178 (0) CHAP-Challenge = 0x204416f8f4dffa7c6e61d242008309e8 (0) CHAP-Password = 0x16c3e52824bccf28b038ada822e4700776 (0) Service-Type = Login-User (0) WISPr-Logoff-URL = 'http://192.168.1.1/logout' (0) NAS-Identifier = 'MikroTik' (0) NAS-IP-Address = 192.168.1.1 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /usr/local/var/log/radius/radacct/ 192.168.1.1/auth-detail-20150702 (0) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/ 192.168.1.1/auth-detail-20150702 (0) auth_log: EXPAND %t (0) auth_log: --> Thu Jul 2 01:53:01 2015 (0) [auth_log] = ok (0) chap: &control:Auth-Type := CHAP (0) [chap] = ok (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "randeeps", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> randeeps (0) sql: SQL-User-Name set to 'randeeps' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'randeeps' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'randeeps' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := 'randeeps' (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'randeeps' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'randeeps' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'randeeps' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'randeeps' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'starter' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'starter' ORDER BY id (0) sql: Group "starter": Conditional check items matched (0) sql: Group "starter": Merging assignment check items (0) sql: Max-Data := 2147483648 (0) sql: Mikrotik-Rate-Limit := '512k/512k' (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'starter' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'starter' ORDER BY id (0) sql: Group "starter": Merging reply items (0) sql: Framed-Protocol == PPP (0) sql: Framed-MTU == 1500 (0) sql: Framed-Routing == Broadcast-Listen (0) sql: Framed-Compression == Van-Jacobson-TCP-IP (0) sql: Service-Type == Framed-User (0) sql: Idle-Timeout == 300 (0) sql: Acct-Interim-Interval == 60 (0) sql: Mikrotik-Rate-Limit == '4096k/4096k' rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = CHAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type CHAP { (0) chap: Comparing with "known good" Cleartext-Password (0) chap: CHAP user "randeeps" authenticated successfully (0) [chap] = ok (0) } # Auth-Type CHAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) reply_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /usr/local/var/log/radius/radacct/ 192.168.1.1/reply-detail-20150702 (0) reply_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/ 192.168.1.1/reply-detail-20150702 (0) reply_log: EXPAND %t (0) reply_log: --> Thu Jul 2 01:53:01 2015 (0) [reply_log] = ok (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND %{User-Name} (0) sql: --> randeeps (0) sql: SQL-User-Name set to 'randeeps' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'randeeps', '0x16c3e52824bccf28b038ada822e4700776', 'Access-Accept', '2015-07-02 01:53:01') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'randeeps', '0x16c3e52824bccf28b038ada822e4700776', 'Access-Accept', '2015-07-02 01:53:01') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 37 from 192.168.1.182:1812 to 192.168.1.1:58640 length 0 (0) Finished request Waking up in 4.9 seconds. (1) Received Accounting-Request Id 38 from 192.168.1.1:55815 to 192.168.1.182:1813 length 137 (1) Acct-Status-Type = Start (1) NAS-Port-Type = Ethernet (1) Calling-Station-Id = '38:63:BB:AA:23:C8' (1) Called-Station-Id = 'server1' (1) NAS-Port-Id = 'LAN' (1) User-Name = 'randeeps' (1) NAS-Port = 2161115148 (1) Acct-Session-Id = '80d0000c' (1) Framed-IP-Address = 192.168.1.178 (1) Mikrotik-Host-IP = 192.168.1.178 (1) Event-Timestamp = 'Jan 1 1970 21:37:55 EST' (1) NAS-Identifier = 'MikroTik' (1) Acct-Delay-Time = 0 (1) NAS-IP-Address = 192.168.1.1 (1) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (1) preacct { (1) [preprocess] = ok (1) update request { (1) EXPAND %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} (1) --> 1435816381 (1) FreeRADIUS-Acct-Session-Start-Time = Jul 2 2015 01:53:01 EDT (1) } # update request = noop (1) policy acct_unique { (1) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) { (1) EXPAND %{string:Class} (1) --> (1) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (1) else { (1) update request { (1) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (1) --> ea4d3903abb8c9b3982209738a5c2915 (1) &Acct-Unique-Session-Id := ea4d3903abb8c9b3982209738a5c2915 (1) } # update request = noop (1) } # else = noop (1) } # policy acct_unique = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "randeeps", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) } # preacct = ok (1) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (1) accounting { (1) detail: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (1) detail: --> /usr/local/var/log/radius/radacct/ 192.168.1.1/detail-20150702 (1) detail: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.1.1/detail-20150702 (1) detail: EXPAND %t (1) detail: --> Thu Jul 2 01:53:01 2015 (1) [detail] = ok (1) [unix] = ok (1) radutmp: EXPAND /usr/local/var/log/radius/radutmp (1) radutmp: --> /usr/local/var/log/radius/radutmp (1) radutmp: EXPAND %{User-Name} (1) radutmp: --> randeeps (1) [radutmp] = ok (1) sradutmp: EXPAND /usr/local/var/log/radius/sradutmp (1) sradutmp: --> /usr/local/var/log/radius/sradutmp (1) sradutmp: EXPAND %{User-Name} (1) sradutmp: --> randeeps (1) [sradutmp] = ok (1) sql: EXPAND %{tolower:type.%{Acct-Status-Type}.query} (1) sql: --> type.start.query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (4) (1) sql: EXPAND %{User-Name} (1) sql: --> randeeps (1) sql: SQL-User-Name set to 'randeeps' (1) sql: EXPAND INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') (1) sql: --> INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('80d0000c', 'ea4d3903abb8c9b3982209738a5c2915', 'randeeps', '', '192.168.1.1', '2161115148', 'Ethernet', FROM_UNIXTIME(95875), FROM_UNIXTIME(95875), NULL, '0', '', '', '', '0', '0', 'server1', '38:63:BB:AA:23:C8', '', '', '', '192.168.1.178') (1) sql: Executing query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('80d0000c', 'ea4d3903abb8c9b3982209738a5c2915', 'randeeps', '', '192.168.1.1', '2161115148', 'Ethernet', FROM_UNIXTIME(95875), FROM_UNIXTIME(95875), NULL, '0', '', '', '', '0', '0', 'server1', '38:63:BB:AA:23:C8', '', '', '', '192.168.1.178') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (4) (1) [sql] = ok (1) update control { (1) EXPAND %{User-Name} (1) --> randeeps (1) SQL-User-Name set to 'randeeps' rlm_sql (sql): Reserved connection (4) (1) Executing select query: SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) AS Total FROM radacct where (acctstarttime between DATE_FORMAT(NOW() ,'2015-07-01') AND NOW() AND acctstoptime between DATE_FORMAT(NOW() ,'2015-07-01') AND NOW()) AND radacct.username='randeeps' (1) NULL value in first column of result rlm_sql (sql): Released connection (4) (1) EXPAND %{sql:SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) AS Total FROM radacct where (acctstarttime between DATE_FORMAT(NOW() ,'%Y-%m-01') AND NOW() AND acctstoptime between DATE_FORMAT(NOW() ,'%Y-%m-01') AND NOW()) AND radacct.username='%{User-Name}'} (1) --> (1) Tmp-Integer-0 := 0 (1) EXPAND %{User-Name} (1) --> randeeps (1) SQL-User-Name set to 'randeeps' rlm_sql (sql): Reserved connection (4) (1) Executing select query: SELECT radgroupcheck.value FROM radusergroup INNER JOIN radgroupcheck ON radusergroup.groupname = radgroupcheck.groupname WHERE radusergroup.username='randeeps' AND radgroupcheck.attribute='Max-Data' rlm_sql (sql): Released connection (4) (1) EXPAND %{sql: SELECT radgroupcheck.value FROM radusergroup INNER JOIN radgroupcheck ON radusergroup.groupname = radgroupcheck.groupname WHERE radusergroup.username='%{User-Name}' AND radgroupcheck.attribute='Max-Data'} (1) --> 32212254720 (1) Tmp-Integer-1 := 2147483648 (1) EXPAND %{User-Name} (1) --> randeeps (1) SQL-User-Name set to 'randeeps' rlm_sql (sql): Reserved connection (4) (1) Executing select query: SELECT radgroupcheck.value FROM radusergroup INNER JOIN radgroupcheck ON radusergroup.groupname = radgroupcheck.groupname WHERE radusergroup.username='randeeps' AND radgroupcheck.attribute='Mikrotik-Rate-Limit' rlm_sql (sql): Released connection (4) (1) EXPAND %{sql: SELECT radgroupcheck.value FROM radusergroup INNER JOIN radgroupcheck ON radusergroup.groupname = radgroupcheck.groupname WHERE radusergroup.username='%{User-Name}' AND radgroupcheck.attribute='Mikrotik-Rate-Limit'} (1) --> 512k/512k (1) Tmp-String-1 := 512k/512k (1) } # update control = noop (1) if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-Integer-1}") { (1) EXPAND %{control:Tmp-Integer-0} (1) --> 0 (1) EXPAND %{control:Tmp-Integer-1} (1) --> 2147483648 (1) if ("%{control:Tmp-Integer-0}" > "%{control:Tmp-Integer-1}") -> FALSE (1) [exec] = noop (1) attr_filter.accounting_response: EXPAND %{User-Name} (1) attr_filter.accounting_response: --> randeeps (1) attr_filter.accounting_response: Matched entry DEFAULT at line 15 (1) [attr_filter.accounting_response] = updated (1) } # accounting = updated (1) Sent Accounting-Response Id 38 from 192.168.1.182:1813 to 192.168.1.1:55815 length 0 (1) Finished request (1) <done>: Cleaning up request packet ID 38 with timestamp +5 Waking up in 4.9 seconds. ------------- Please help me to resolve this issue. Thanks.

1 0

Reg Max-Data attribute in freeradius 3.0.8
by J＠g＠dee5h 01 Jul '15

01 Jul '15

Hello, I have upgraded the freeradius from 2.2 to 3.0.8 and now While authendicate I am getting this error. ---------- (2) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (2) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'randeeps' ORDER BY id (2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'randeeps' ORDER BY id (2) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (2) sql: --> SELECT groupname FROM radusergroup WHERE username = 'randeeps' ORDER BY priority (2) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'randeeps' ORDER BY priority (2) sql: User found in the group table (2) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (2) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'starter' ORDER BY id (2) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'starter' ORDER BY id (2) sql: ERROR: Failed to create the pair: Unknown name "Max-Data" (2) sql: ERROR: Error parsing user data from database result (2) sql: ERROR: Error retrieving check pairs for group starter ------------- Here is the table details. mysql> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'starter' ORDER BY id; +----+-----------+-----------+-------------+----+ | id | groupname | attribute | Value | op | +----+-----------+-----------+-------------+----+ | 14 | starter | Max-Data | 32212254720 | := | +----+-----------+-----------+-------------+----+ 1 row in set (0.00 sec) mysql> ------------ Please let me know which attribute I need to use it in freeradius 3.0.8 for Max-Data. Thanks.

2 1

Reg Openssl issue unable to start radius version 3.0.8
by J＠g＠dee5h 01 Jul '15

01 Jul '15

Hello, I am unable to start the freeradius due to openssl vulnerability issue. Please find the debug log. ----------- Refusing to start with libssl version OpenSSL 1.0.1e-fips 11 Feb 2013 0x1000105f (1.0.1e release) (in range 1.0.1 dev - 1.0.1f release) Security advisory CVE-2014-0160 (Heartbleed) For more information see http://heartbleed.com Once you have verified libssl has been correctly patched, set security.allow_vulnerable_openssl = 'CVE-2014-0160' ------------ I have confirmed that I have applied the patch for this bug. ----------- [root@radius raddb]# openssl version OpenSSL 1.0.1e-fips 11 Feb 2013 [root@radius raddb]# rpm -q --changelog openssl | grep CVE-2014-0160 - fix CVE-2014-0160 - information disclosure in TLS heartbeat extension [root@radius raddb]# -------------- Is it safe to enable the allow_vulnerable_openssl = yes in radiusd.conf file? Otherwise I will update the openssl to OpenSSL 1.0.1g version. Please suggest.

2 1