- Freeradius-Users - lists.freeradius.org

Freeradius Access-Reject to Access-Accept
by vanish 18 Mar '15

18 Mar '15

Hi, freeradius team! I newbye in FR and need your help with next scheme. I have: - L2TP NAS (cisco ASR1013) + freeradius2 + sql DBase I must realize next algorithm: - User connect to L2TP bras - Bras get from user login and chap password - Bras send to FR access-request: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ rad_recv: Access-Request packet from host 10.10.10.10. port 1645, id=228, length=133 Framed-Protocol = PPP User-Name = "user1" CHAP-Password = 0x018ca6f7913b5901e187a80e3f41c419c54465v565 Connect-Info = "100000000" NAS-Port-Type = Virtual ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - FR in sql module into "authorize" section select special-data from DBase by user-login. ... From here i need to realize next logic (as i see): 1. If user password is wrong - Freeradius must send to cisco access-accept and next reply: Cisco-Account-Info = "ARedirect_WRNG_PSSWRD" (This is Cisco SSG Service for redirect user to web-portal) 2. If user password is OK, but Tariff_Plan not set - Freeradius must send to cisco access-accept and next reply: Cisco-Account-Info = "ARedirect_NO_PAY" 3. If user password is OK, and Tariff_Plan is OK - Freeradius must send to cisco access-accept and next reply: Cisco-Account-Info = "AInternet_xxxIN_xxxOUT" In first and second steps - i must change access-reject to access-accept with some reply message. For example - if FR got from DBase: - "1" - wrong password (1 paragraph) - "2" - wrong tariff (2 paragraph) - "cleartext password" - allright (3 paragraph) can i in "authorize" section in module "sql" check return code from DB and by this code change access-reject to access-accept with reply valid service to cisco? Help me please.

1 0

Unknown client
by Tevfik Ceydeliler 18 Mar '15

18 Mar '15

Hi, Altough I have this configuration in client .conf: ################################## client 172.30.47.241 { secret = 877909 shortname = VodafonePinarsuAPNYeni1 nastype = other } client 172.30.47.242 { secret = 877909 shortname = VodafonePinarsuAPNYeni2 nastype = other } #################################### Why I get this error? ################################################################################################# Tue Mar 17 14:31:55 2015 : Error: Ignoring request to authentication address * port 1812 from unknown client 172.30.47.242 port 58312 Tue Mar 17 14:32:01 2015 : Error: Ignoring request to authentication address * port 1812 from unknown client 172.30.47.241 port 6040 ################################################################################################# And I am sure that secret is correct. Any idea? --

2 3

Attribute number 89 (vendor) not defined
by Clement Ogedengbe 17 Mar '15

17 Mar '15

I am seeing the following in the log. Any idea please? radiator: WARNING: Attribute number 89 (vendor 1) from x.x.x.x:50735 is not defined in your dictionary Clement

3 5

FreeRadius - 802.1X - Activce Directory
by Ronja 17 Mar '15

17 Mar '15

Hello, I try to a FreeRadiusserver on Centos 6.6. I have use that guide for my project. http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOW TO . Now I want to create certificates with CA.all : "CA.all is located in the scripts subdirectory of FREERADIUS' source directory. In case of doubt try the command. find / -name CA.all When executing CA.all, we produce the 9 following certificates " But I can not find CA.all :( I use the command find * | grep CA.all but there is nothing. Can you help me? with kind regards, Host3

3 2

Cache One Time Password OTP
by Gardner, Mark 16 Mar '15

16 Mar '15

Has anyone had success in getting free radius to cache a HOTP so it works like a TOTP. The problem I have is a ThinLinc authentication were our LDAP is configured for a HOTP, and ThinLink requires the OTP to be used twice in quick succession across the distributed architecture (once to master once to client) Looks like someone had some relative success IN Feb 2013 http://lists.freeradius.org/pipermail/freeradius-users/2013-February/065163… But I'm not following whats going on. Mark Gardner Www.gtopia.org/blog

3 7

Re: Freeradius-Users Digest, Vol 119, Issue 57
by Rui Ribeiro 15 Mar '15

15 Mar '15

Hi Jim, FR 2.1.12 is too old, and has know bugs, including mschap hanging up after a HUP. Monitor the service at layer 7, and restart it automatically while you do not upgrade. Regards Message: 2 > Date: Fri, 13 Mar 2015 11:24:05 -0400 > From: J Kephart <jkephart(a)safetynetaccess.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Odd behavior? > Message-ID: <55030115.3010706(a)safetynetaccess.com> > Content-Type: text/plain; charset=utf-8 > > We're seeing a very odd occurrence on one of our radius servers. To my > knowledge, it has only happened once (this morning), but it's the first > time it's happened, and we're not entirely sure where to look to find > the cause. > > We're running on a CentOS 6.6 system, with FR v2.1.12, which is the > package that is distributed by CentOS/RH. Each day, the logrotate > routing rotates the radius.log (and compresses it), and then restarts > FR. This morning, however, the radius log showed that the process > restarted, but that it did absolutely nothing for the next two hours and > 13 minutes. > > Fri Mar 13 03:27:01 2015 : Info: HUP - loading modules > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module > "attr_filter.access_reject" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module > "attr_filter.accounting_response" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "files" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "radutmp" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "suffix" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "mschap" > Fri Mar 13 03:27:01 2015 : Info: Module: Reloaded module "pap" > Fri Mar 13 03:27:01 2015 : Info: Loaded virtual server <default> > Fri Mar 13 03:27:01 2015 : Info: Loaded virtual server inner-tunnel > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Driver rlm_sql_mysql > (module rlm_sql_mysql) loaded and linked > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect to > radius@xxxxxxxxxxxxxxxxx:3306/radius > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #0 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to > MySQL server for #0 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Connected new DB handle, #0 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #1 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to > MySQL server for #1 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Connected new DB handle, #1 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #2 > Fri Mar 13 05:40:53 2015 : Info: rlm_sql_mysql: Starting connect to > MySQL server for #2 > ... > > Following these entries, normal authentication/accounting messages > resumed, as they had been doing just prior. > > Has anyone ever run across this? Any thoughts on how we might track it > down? > > Thanks, > > Jim > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

Re: Expansion of \t and \n in message with linelong module
by paul.moser＠bt.com 13 Mar '15

13 Mar '15

(apologies if I've broken the threading - I shouldn't have subscribed using digest mode, now corrected) On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > The reason is that attributes can have embedded \n in them, either as binary or a as a string "\n". Using those attributes in the "linelog" module would then cause spurious new lines, and break your assumptions about what the log files mean. Very good point. Because the set of attributes we happen to use in the log entry don't include end user inputted data and the source of those packets we are safe from unexpected expansion for now, but our future intended use and as a general use case this is certainly what's known as a bad idea. Time to rethink. >Not with 3.0.6. We can take a look at correcting it for the next release. We’ve made other fixes in 3.0 which made it easier to separate the "literal" strings passed in from the config files, and the “end user” strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. Certainly that would help, but I should probably the end result we are trying to achieve in case linelog was completely the wrong approach. It sound like we are doing much the same as Matthew Newton, in addition to performing some normal authentication/authorization/accounting we also send information from those to another radius server as accounting packet - in some cases this is for additional auditing, sometimes as it enables other functionality - using the linelog module we could write out a file in the standard detail format but with just the attributes we wanted (and the type as accounting even if it had originally been an access request), and use a detail listener to pick that up and send them on. Is there some other way to do this that I've missed? I suspect the reason in our case that accounting packets are always used is just because historically it was more convenient to do so. Given we own the systems that the packets get sent onto it's possible that we may be able to change those systems to handle access request or response packets as well as accounting, and modify the source systems to use a detail writer/read and Proxy-to-realm setup rather linelog Paul ------------------------------ Message: 2 Date: Tue, 23 Dec 2014 11:05:23 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <E5F57FCB-CC38-4386-B922-3F36D37A3F88(a)deployingradius.com> Content-Type: text/plain; charset=windows-1252 On Dec 23, 2014, at 10:38 AM, paul.moser(a)bt.com wrote: > I have a 3.0.3 FR instance to which some additional logging has been added using the linelog module. The log messages that are written are multi-line and tab indented with \n and \t used in the format option in the linelog modules configuration file. That?s not really the intended use of the ?linelog? module. It logs lines of text.. not multiple lines. > I have also tried migrating another, older (v2.x) FR instance to v3.0.6. I started with a vanilla 3.0.6 configuration and successfully slowly modified that to give the same behaviour as the v2.x version. However when I finally attempted to add the additional logging that had been added to the 3.0.3 instance the log statements appearing in the log file are not multi-line or tab indented, neither the newline \n nor the tab \t have been expanded, \n and \t appear in the log file where I'd expected newlines and tabs to appear. > > I note in the changelog that for v3.0.5 correct_escapes was introduced and in a vanilla 3.0.6 configuration this is set to true It?s correct, and it creates many other simplifications of the source tree. > Taking my 3.0.3 configuration as is and running it against a 3.0.6 server it behaves just as it does with a 3.0.3 server - expanding \t and \n . However if I modify the configuration to set correct_escapes to true then literal \t and \n appear in the log file rather than tabs and newlines. Yes. That?s really the correct behaviour. The reason is that attributes can have embedded \n in them, either as binary or a as a string ?\n?. Using those attributes in the ?linelog? module would then cause spurious new lines, and break your assumptions about what the log files mean. > With 3.0.6, with correct_escapes=true, is it possible to use backslash escape sequences, or some equivalent to format linelog log messages? Not with 3.0.6. We can take a look at correcting it for the next release. We?ve made other fixes in 3.0 which made it easier to separate the ?literal? strings passed in from the config files, and the ?end user? strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. > It maybe that the expansion of \n and \t in 3.0.3 was just undocumented behaviour that we stumbled upon and utilised rather than expected behaviour, the fact that the module is called line (singular) log may indicated we should not expect it to write multi-line log statements. Both. > I realise that I could just set correct_escapes=false in my 3.0.6 instances, I have briefly tried this however much of the default configuration now appears to assume the correct escapes and I'd have to unwind all those changes. I suspect if I did this I'd just be storing up trouble for myself some point in the future. I?d recommend keeping the new behaviour. It?s *much* more intuitive. Alan DeKok. ------------------------------ Message: 3 Date: Tue, 23 Dec 2014 23:27:27 +0000 From: Matthew Newton <mcn4(a)leicester.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <20141223232727.GA19006(a)rootmail.cc.le.ac.uk> Content-Type: text/plain; charset=utf-8 On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > That?s not really the intended use of the ?linelog? module. > It logs lines of text.. not multiple lines. Of course, "intended" and "what's useful" are two different things. We're also (ab-)using linelog to write out detail log format. These are then picked up by the detail reader and fed (as accounting packets) across to a central RADIUS server for common logging. It means we can set exactly which attributes to forward. Because of the way the logging and detail reader works it is also reliable if the central server goes away for some reason. I guess the alternative would be to have an "include" option for the detail module, countering the "suppress" option. But that's only for our use case. > Not with 3.0.6. We can take a look at correcting it for the > next release. We?ve made other fixes in 3.0 which made it > easier to separate the ?literal? strings passed in from the > config files, and the ?end user? strings taken from a RADIUS > packet. We can have the linelog module convert \n -> CR for > literal strings you enter, but not do that expansion for > strings taken from RADIUS packets. That would seem the more sensible option - expand \n, \t etc in the string first, then expand %{..}. But I get that string expansion is pretty tricky in the ordering it needs to be done to get a sane output for all cases. Cheers Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> ------------------------------ Message: 4 Date: Tue, 23 Dec 2014 23:48:11 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>, Matthew Newton <mcn4(a)leicester.ac.uk> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <ABEC402F-CA0B-418A-A14F-C7F97692988B(a)lboro.ac.uk> Content-Type: text/plain; charset="utf-8" buffered_sql with extra attr_filter rule? alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

3 5

Help with eduroam proxying config
by Mohamed Lrhazi 13 Mar '15

13 Mar '15

Hello, With this config, I want to say: anyuser(a)anything.edu should go to eduroam, but I get a warning that it wont be the case.. What's the correct config: Thanks a lot, Mohamed. proxy.conf: home_server eduroam1 { type = auth ipaddr = tlrs1.eduroam.us port = 1645 secret = eduroam_radius_secret } home_server eduroam2 { type = auth ipaddr = tlrs2.eduroam.us port = 1645 secret = eduroam_radius_secret } home_server_pool eduroam { type = fail-over home_server = eduroam1 home_server = eduroam2 } realm LOCAL { } realm NULL { } realm georgetown.edu { } realm gu.edu { } realm "~(.*\\.)+edu$" { nostrip auth_pool = eduroam } realm DEFAULT{ nostrip } radius/radacct/172.17.0.187/auth-detail-20150311 (0) auth_log : EXPAND %t (0) auth_log : --> Wed Mar 11 14:32:10 2015 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Looking up realm "foo.edu" for User-Name = "ml623(a)foo.edu" (0) suffix : Found realm "~(.*\.)+edu$" (0) suffix : Adding Realm = "foo.edu" (0) suffix : Proxying request from user ml623(a)foo.edu to realm ~(.*\.)+edu$ (0) suffix : Preparing to proxy authentication request to realm "~(.*\.)+edu$" (0) [suffix] = updated (0) if ("%{Realm}" != 'NULL' && "%{Realm}" != 'LOCAL' && "%{Realm}" !~ /\\.edu$/) (0) EXPAND %{Realm} (0) --> foo.edu (0) EXPAND %{Realm} (0) --> foo.edu (0) EXPAND %{Realm} (0) --> foo.edu (0) if ("%{Realm}" != 'NULL' && "%{Realm}" != 'LOCAL' && "%{Realm}" !~ /\\.edu$/) -> FALSE (0) eap : EAP packet type response id 0 length 18 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) WARNING: You set Proxy-To-Realm = DEFAULT, but it is a LOCAL realm! Cancelling proxy request. (0) Found Auth-Type = EAP

3 4

Freeadius2 with EAP-TLS - cert not available on iOS 8.2
by IT geek 31 12 Mar '15

12 Mar '15

Hi, I've finally got Freeradius 2.2.0 running on NetBSD 5.2.2 using EAP with MSCHAPv2 (and I'm very happy!). However, I'm trying to get EAP-TLS working. My CA and server certificates build and install brilliantly, but my whilst my iPhone (iOS 8.2) lets me import my client certificate, it doesn't offer to let me use it for authentication for EAP-TLS. Any ideas what I might be missing? Any help would be appreciated, Thanks, -Mark Full radiusd -X: FreeRADIUS Version 2.2.0, for host mipsel--netbsd, built on Mar 5 2015 at 23:15:08 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/pkg/etc/raddb/radiusd.conf including configuration file /usr/pkg/etc/raddb/proxy.conf including configuration file /usr/pkg/etc/raddb/clients.conf including files in directory /usr/pkg/etc/raddb/modules/ including configuration file /usr/pkg/etc/raddb/modules/acct_unique including configuration file /usr/pkg/etc/raddb/modules/always including configuration file /usr/pkg/etc/raddb/modules/attr_filter including configuration file /usr/pkg/etc/raddb/modules/attr_rewrite including configuration file /usr/pkg/etc/raddb/modules/chap including configuration file /usr/pkg/etc/raddb/modules/checkval including configuration file /usr/pkg/etc/raddb/modules/counter including configuration file /usr/pkg/etc/raddb/modules/detail including configuration file /usr/pkg/etc/raddb/modules/detail.example.com including configuration file /usr/pkg/etc/raddb/modules/detail.log including configuration file /usr/pkg/etc/raddb/modules/digest including configuration file /usr/pkg/etc/raddb/modules/echo including configuration file /usr/pkg/etc/raddb/modules/etc_group including configuration file /usr/pkg/etc/raddb/modules/exec including configuration file /usr/pkg/etc/raddb/modules/expiration including configuration file /usr/pkg/etc/raddb/modules/expr including configuration file /usr/pkg/etc/raddb/modules/files including configuration file /usr/pkg/etc/raddb/modules/inner-eap including configuration file /usr/pkg/etc/raddb/modules/ippool including configuration file /usr/pkg/etc/raddb/modules/krb5 including configuration file /usr/pkg/etc/raddb/modules/ldap including configuration file /usr/pkg/etc/raddb/modules/linelog including configuration file /usr/pkg/etc/raddb/modules/logintime including configuration file /usr/pkg/etc/raddb/modules/mac2ip including configuration file /usr/pkg/etc/raddb/modules/mac2vlan including configuration file /usr/pkg/etc/raddb/modules/mschap including configuration file /usr/pkg/etc/raddb/modules/otp including configuration file /usr/pkg/etc/raddb/modules/pam including configuration file /usr/pkg/etc/raddb/modules/pap including configuration file /usr/pkg/etc/raddb/modules/passwd including configuration file /usr/pkg/etc/raddb/modules/perl including configuration file /usr/pkg/etc/raddb/modules/policy including configuration file /usr/pkg/etc/raddb/modules/preprocess including configuration file /usr/pkg/etc/raddb/modules/radutmp including configuration file /usr/pkg/etc/raddb/modules/realm including configuration file /usr/pkg/etc/raddb/modules/smbpasswd including configuration file /usr/pkg/etc/raddb/modules/smsotp including configuration file /usr/pkg/etc/raddb/modules/sql_log including configuration file /usr/pkg/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/pkg/etc/raddb/modules/sradutmp including configuration file /usr/pkg/etc/raddb/modules/unix including configuration file /usr/pkg/etc/raddb/modules/wimax including configuration file /usr/pkg/etc/raddb/eap.conf including configuration file /usr/pkg/etc/raddb/policy.conf including files in directory /usr/pkg/etc/raddb/sites-enabled/ including configuration file /usr/pkg/etc/raddb/sites-enabled/default including configuration file /usr/pkg/etc/raddb/sites-enabled/inner-tunnel main { user = "radius" group = "radius" allow_core_dumps = no } including dictionary file /usr/pkg/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/pkg" localstatedir = "/var" sbindir = "/usr/pkg/sbin" logdir = "/var/log/radiusd" run_dir = "/var/run/radiusd" libdir = "/usr/pkg/lib" radacctdir = "/var/log/radiusd/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/pkg/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client ap { ipaddr = 192.168.1.10 require_message_authenticator = no secret = "mysecret" nastype = "Wireless-802.11" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/pkg/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/pkg/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/pkg/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/pkg/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/pkg/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/pkg/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/pkg/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/pkg/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/pkg/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/pkg/etc/raddb/modules/unix unix { radwtmp = "/var/log/radiusd/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/pkg/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/pkg/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/pkg/etc/raddb/certs/server.pem" certificate_file = "/usr/pkg/etc/raddb/certs/server.pem" CA_file = "/usr/pkg/etc/raddb/certs/ca.pem" private_key_password = "mysecret" dh_file = "/usr/pkg/etc/raddb/certs/dh" random_file = "/usr/pkg/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/pkg/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/pkg/etc/raddb/huntgroups" hints = "/usr/pkg/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/pkg/etc/raddb/huntgroups reading pairlist file /usr/pkg/etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/pkg/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/pkg/etc/raddb/modules/files files { usersfile = "/usr/pkg/etc/raddb/users" acctusersfile = "/usr/pkg/etc/raddb/acct_users" preproxy_usersfile = "/usr/pkg/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /usr/pkg/etc/raddb/users reading pairlist file /usr/pkg/etc/raddb/acct_users reading pairlist file /usr/pkg/etc/raddb/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/pkg/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/pkg/etc/raddb/modules/detail detail { detailfile = "/var/log/radiusd/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/pkg/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/pkg/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/pkg/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/pkg/etc/raddb/modules/radutmp radutmp { filename = "/var/log/radiusd/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/pkg/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/pkg/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/pkg/etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /usr/pkg/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = 192.168.1.1 port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 64838 Listening on authentication address * port 1812 Listening on accounting address 192.168.1.1 port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests.

3 7

Sql redundancy
by Paul 12 Mar '15

12 Mar '15

Hi, I have configured 2 sql instances (db1 and db2) used in authorize and accounting sections. Freeradius v3.0.4. /etc/raddb/mods-available/sql (the entire file): sql db1{ driver = "rlm_sql_mysql" dialect = "mysql" server = "172.16.20.6" port = 3306 login = "radius" password = "xxx" radius_db = "radius" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes pool { start = 5 min = 4 max = ${thread[pool].max_servers} spare = 3 uses = 0 lifetime = 0 idle_timeout = 60 } client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } sql db2{ driver = "rlm_sql_mysql" dialect = "mysql" server = "172.16.20.14" port = 3306 login = "radius" password = "xxx" radius_db = "radius" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes pool { # Number of connections to start start = 5 min = 4 max = ${thread[pool].max_servers} spare = 3 uses = 0 lifetime = 0 idle_timeout = 60 } client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } /etc/raddb/sites-enabled/pppoe_null (irrelevant portions omitted): server srv_null { authorize { (...) redundant { db1 db2 } (...) } accounting { redundant { db1 db2 } (...) } (...) } I need fully redundant sql config: 1. Freeradius should start with only one or both sql servers available 2. Freeradius should operate with only one or both sql servers available I can't start fr with only one sql server available. When I shut down db2 server, I see: (...) rlm_sql (db1): Opening additional connection (0) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (db1): Opening additional connection (1) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (db1): Opening additional connection (2) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (db1): Opening additional connection (3) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (db1): Opening additional connection (4) rlm_sql_mysql: Starting connect to MySQL server (...) rlm_sql (db2): Opening additional connection (0) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radius@172.16.20.14:radius rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '172.16.20.14' (111)' rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (db2): Opening connection failed (0) rlm_sql (db2): Removing connection pool /etc/raddb/mods-enabled/sql[33]: Instantiation failed for module "db2" Of course I can start fr with both sql reached. Is it possible to start fr with the only one sql available? -- Regards, Paul

3 3