- Freeradius-Users - lists.freeradius.org

radgroupreply not read on 2.2.6
by Lorenzo Milesi 12 Feb '15

12 Feb '15

Hi. I know this is a trivial and old question, but I've checked back and forth and cannot figure out what I am doing wrong. This is the user in SQL: Radcheck id username attribute op value 14123 MAXSPDGROUP MD5-Password := 485b93396235830f29f049c462a97a60 Radusergroup id username groupname priority 182424 MAXSPDGROUP noaccess 99 182423 MAXSPDGROUP c_yop1 30 Radgroupcheck id groupname attribute op value 22 c_yop1 NAS-Identifier =~ yop101|yop102|int04 3 noaccess Auth-Type = Reject Radgroupreply id groupname attribute op value 45 c_yop1 Idle-Timeout = 300 46 c_yop1 Acct-Interim-Interval = 240 73 c_yop1 WISPr-Bandwidth-Max-Up = 20 When I make a request: echo "User-Name=MAXSPDGROUP,password=MAXSPDGROUP,NAS-Identifier=yop101,NAS-IP-Address=10.12.22.159" | /usr/bin/radclient localhost:1812 auth radsecret The reply doesn't contain the Radgroupreply attributes: Received response ID 248, code 2, length = 20. According to the docs [1]: "The user IS found in radcheck, the check items DO match AND the read_groups directive is set to 'yes'" The user IS found in radcheck, password match, read_groups is yes, so why those replies are not sent back to the request, since the NAS-Identifier regexp matches? Reading on the docs: "For each group this user is a member of, the corresponding check items are pulled from radgroupcheck table and compared with the request. If there is a match, the reply items for this group are pulled from the radgroupreply table and applied." So even if the "noaccess" group don't match, the c_yop1 does and it should return the corresponding group reply items. I know there must be something wrong but I cannot figure out. Any hint is welcome. Thanks Following here request's debug: freeradius: FreeRADIUS Version 2.2.6, for host x86_64-pc-linux-gnu, built on Feb 12 2015 at 12:10:02 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/sql/mysql/ippool-dhcp.conf including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/raw including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/control-socket including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/status including configuration file /etc/freeradius/sites-enabled/inav-dynclients main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm NULL { authhost = LOCAL accthost = LOCAL } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "radsecret" shortname = "localhost" nastype = "other" } client dymamic { ipaddr = 0.0.0.0 netmask = 0 require_message_authenticator = no dynamic_clients = "dynamic_client_server" lifetime = 12600 } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = yes input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_raw Module: Instantiating module "raw" from file /etc/freeradius/modules/raw } radiusd: #### Loading Virtual Servers #### server { # from file modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no allow_retry = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "HFFU7Ms9d4" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 25 lifetime = 0 max_queries = 0 sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' OR groupname = '%{HuntGroup-Name}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' OR groupname = '%{HuntGroup-Name}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = 'NAS-Reboot', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND calledstationid = '%{Called-Station-Id}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 Module: Linked to module rlm_counter Module: Instantiating module "daily" from file /etc/freeradius/modules/counter counter daily { filename = "/etc/freeradius/db.daily" key = "User-Name" reset = "daily" count-attribute = "Acct-Session-Time" counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" allowed-servicetype = "Framed-User" cache-size = 5000 } rlm_counter: Counter attribute Daily-Session-Time is number 11273 rlm_counter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 1423782000 [2015-02-13 00:00:00] Module: Linked to module rlm_sqlcounter Module: Instantiating module "noresetcounter" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter noresetcounter { counter-name = "Max-All-Session-Time" check-name = "Max-All-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute Max-All-Session is number 11276 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 0 [2015-02-12 12:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 0 [2015-02-12 12:00:00] Module: Linked to module rlm_always Module: Instantiating module "reject" from file /etc/freeradius/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Instantiating module "dailycounter" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute Max-Daily-Session is number 11274 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 1423782000 [2015-02-13 00:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 1423695600 [2015-02-12 00:00:00] Module: Instantiating module "dailycounterlocation" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter dailycounterlocation { counter-name = "Max-Daily-Session-Location" check-name = "Max-Daily-Session-Location" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{%k}' AND (UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b') AND calledstationid = '%{Called-Station-Id}' " reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute Max-Daily-Session-Location is number 954138731 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 1423782000 [2015-02-13 00:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 1423695600 [2015-02-12 00:00:00] Module: Instantiating module "monthlycounter" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter monthlycounter { counter-name = "Monthly-Session-Time" check-name = "Max-Monthly-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute Max-Monthly-Session is number 11278 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 1425164400 [2015-03-01 00:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 1422745200 [2015-02-01 00:00:00] Module: Instantiating module "counterChilliSpotMaxTotalOctets" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter counterChilliSpotMaxTotalOctets { counter-name = "ChilliSpot-Max-All-Octets" check-name = "ChilliSpot-Max-All-Octets" reply-name = "ChilliSpot-Max-All-Octets" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute ChilliSpot-Max-All-Octets is number 954138730 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 0 [2015-02-12 12:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 0 [2015-02-12 12:00:00] Module: Instantiating module "counterChilliSpotMaxTotalOctetsDaily" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter counterChilliSpotMaxTotalOctetsDaily { counter-name = "ChilliSpot-Max-Daily-Octets" check-name = "ChilliSpot-Max-Daily-Octets" reply-name = "ChilliSpot-Max-All-Octets" key = "User-Name" sqlmod-inst = "sql" query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute ChilliSpot-Max-Daily-Octets is number 954138727 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 1423782000 [2015-02-13 00:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 1423695600 [2015-02-12 00:00:00] Module: Instantiating module "counterChilliSpotMaxTotalOctetsWeekly" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter counterChilliSpotMaxTotalOctetsWeekly { counter-name = "ChilliSpot-Max-Weekly-Octets" check-name = "ChilliSpot-Max-Weekly-Octets" reply-name = "ChilliSpot-Max-Total-Octets" key = "User-Name" sqlmod-inst = "sql" query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" reset = "weekly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute ChilliSpot-Max-Weekly-Octets is number 954138729 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 1423954800 [2015-02-15 00:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 1423436400 [2015-02-09 00:00:00] Module: Instantiating module "counterChilliSpotMaxTotalOctetsMonthly" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter counterChilliSpotMaxTotalOctetsMonthly { counter-name = "ChilliSpot-Max-Monthly-Octets" check-name = "ChilliSpot-Max-Monthly-Octets" reply-name = "ChilliSpot-Max-Total-Octets" key = "User-Name" sqlmod-inst = "sql" query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" reset = "weekly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute ChilliSpot-Max-Monthly-Octets is number 954138728 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 1423954800 [2015-02-15 00:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 1423436400 [2015-02-09 00:00:00] Module: Instantiating module "chillispot_max_bytes_in" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter chillispot_max_bytes_in { counter-name = "ChilliSpot-Max-Input-Octets" check-name = "ChilliSpot-Max-Input-Octets" reply-name = "ChilliSpot-Max-Input-Octets" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctinputoctets) FROM radacct WHERE username='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute ChilliSpot-Max-Input-Octets is number 954138625 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 0 [2015-02-12 12:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 0 [2015-02-12 12:00:00] Module: Instantiating module "chillispot_max_bytes_out" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter chillispot_max_bytes_out { counter-name = "ChilliSpot-Max-Output-Octets" check-name = "ChilliSpot-Max-Output-Octets" reply-name = "ChilliSpot-Max-Output-Octets" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctoutputoctets) FROM radacct WHERE username='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Check attribute ChilliSpot-Max-Output-Octets is number 954138626 rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Next reset 0 [2015-02-12 12:00:00] rlm_sqlcounter: Current Time: 1423739792 [2015-02-12 12:16:32], Prev reset 0 [2015-02-12 12:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server status { # from file /etc/freeradius/sites-enabled/status modules { Module: Creating Autz-Type = Status-Server Module: Checking authorize {...} for more modules to load Module: Instantiating module "ok" from file /etc/freeradius/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } } # modules } # server server dynamic_client_server { # from file /etc/freeradius/sites-enabled/inav-dynclients modules { Module: Checking authorize {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/freeradius/freeradius.sock" } } listen { type = "status" ipaddr = 127.0.0.1 port = 18120 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "mysecret" } } ... adding new socket proxy address * port 51107 ... adding new socket proxy address * port 35460 ... adding new socket proxy address * port 39125 ... adding new socket proxy address * port 33472 ... adding new socket proxy address * port 35308 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/freeradius/freeradius.sock Listening on status address 127.0.0.1 port 18120 as server status Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 56272, id=248, length=65 User-Name = "MAXSPDGROUP" User-Password = "MAXSPDGROUP" NAS-Identifier = "yop101" NAS-IP-Address = 10.12.22.159 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++update request { sql_xlat expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> MAXSPDGROUP expand: %{%{User-Name}:-DEFAULT} -> MAXSPDGROUP expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> MAXSPDGROUP sql_set_user escaped user --> 'MAXSPDGROUP' expand: SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}' -> SELECT groupname FROM radhuntgroup WHERE nasipaddress='10.12.22.159' rlm_sql (sql): Reserving sql socket id: 24 sql_xlat finished rlm_sql (sql): Released sql socket id: 24 expand: %{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}'} -> yop101 ++} # update request = noop ++? if ("%{sql:UPDATE radacct SET AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale-Session' WHERE UserName='%{User-Name}' AND CallingStationId='%{Calling-Station-Id}' AND AcctStopTime is null}") sql_xlat expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> MAXSPDGROUP expand: %{%{User-Name}:-DEFAULT} -> MAXSPDGROUP expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> MAXSPDGROUP sql_set_user escaped user --> 'MAXSPDGROUP' expand: UPDATE radacct SET AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale-Session' WHERE UserName='%{User-Name}' AND CallingStationId='%{Calling-Station-Id}' AND AcctStopTime is null -> UPDATE radacct SET AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale-Session' WHERE UserName='MAXSPDGROUP' AND CallingStationId='' AND AcctStopTime is null rlm_sql (sql): Reserving sql socket id: 23 rlm_sql (sql): SQL query affected no rows rlm_sql (sql): Released sql socket id: 23 expand: %{sql:UPDATE radacct SET AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale-Session' WHERE UserName='%{User-Name}' AND CallingStationId='%{Calling-Station-Id}' AND AcctStopTime is null} -> 0 ? Evaluating ("%{sql:UPDATE radacct SET AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale-Session' WHERE UserName='%{User-Name}' AND CallingStationId='%{Calling-Station-Id}' AND AcctStopTime is null}") -> FALSE ++? if ("%{sql:UPDATE radacct SET AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale-Session' WHERE UserName='%{User-Name}' AND CallingStationId='%{Calling-Station-Id}' AND AcctStopTime is null}") -> FALSE ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "MAXSPDGROUP", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "MAXSPDGROUP" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok ++[files] = noop [sql] expand: %{Stripped-User-Name} -> MAXSPDGROUP [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> MAXSPDGROUP [sql] sql_set_user escaped user --> 'MAXSPDGROUP' rlm_sql (sql): Reserving sql socket id: 22 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'MAXSPDGROUP' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'MAXSPDGROUP' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'MAXSPDGROUP' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' OR groupname = '%{HuntGroup-Name}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'c_yop1' OR groupname = 'yop101' ORDER BY id [sql] expand: %{NAS-Identifier} -> yop101 [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' OR groupname = '%{HuntGroup-Name}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'noaccess' OR groupname = 'yop101' ORDER BY id rlm_sql (sql): Released sql socket id: 22 ++[sql] = ok ++? if (notfound) ? Evaluating (notfound) -> FALSE ++? if (notfound) -> FALSE ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE ++[expiration] = noop rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair ++[daily] = noop ++[logintime] = noop [pap] Normalizing MD5-Password from hex encoding ++[pap] = updated rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounterlocation] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[counterChilliSpotMaxTotalOctets] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[counterChilliSpotMaxTotalOctetsDaily] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[counterChilliSpotMaxTotalOctetsWeekly] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[counterChilliSpotMaxTotalOctetsMonthly] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[chillispot_max_bytes_in] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[chillispot_max_bytes_out] = noop ++? if (reject) ? Evaluating (reject) -> FALSE ++? if (reject) -> FALSE +} # group authorize = updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +group PAP { [pap] login attempt with password "MAXSPDGROUP" [pap] Using MD5 encryption. [pap] User authenticated successfully ++[pap] = ok +} # group PAP = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { [sql] expand: %{Stripped-User-Name} -> MAXSPDGROUP [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> MAXSPDGROUP [sql] sql_set_user escaped user --> 'MAXSPDGROUP' [sql] expand: %{User-Password} -> MAXSPDGROUP [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'MAXSPDGROUP', 'MAXSPDGROUP', 'Access-Accept', '2015-02-12 12:16:40') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'MAXSPDGROUP', 'MAXSPDGROUP', 'Access-Accept', '2015-02-12 12:16:40') rlm_sql (sql): Reserving sql socket id: 21 rlm_sql (sql): Released sql socket id: 21 ++[sql] = ok ++[exec] = noop +} # group post-auth = ok Sending Access-Accept of id 248 to 127.0.0.1 port 56272 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 248 with timestamp +8 Ready to process requests. [1] http://wiki.freeradius.org/modules/Rlm_sql#SQL-Schema-and-usage -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

1 1

FreeRadius authorise against Samab 4 LDB Problem
by Thomas Miller 12 Feb '15

12 Feb '15

Hi, First time posting here. I have just started out and am trying to get a FreeRadius 3.0.6 server working with Samba 4.1.16. Specifically authorising against Samba’s LDB backend. So what I have got working is FreeRadius binding correctly to Samba’s LDB ldap server as well as the correct user objects being found when running a test with radtest. Below is the request output from FreeRadius: (0) Received Access-Request Id 150 from 127.0.0.1:39860 to 127.0.0.1:1812 length 83 (0) User-Name = ’test' (0) User-Password = ‘password' (0) NAS-IP-Address = 192.168.6.221 (0) NAS-Port = 0 (0) Message-Authenticator = 0x5a261850779b1ad52861b77dc4914cb0 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) (null) { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop rlm_ldap (ldap): Reserved connection (4) (0) ldap: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (sAMAccountName=test) (0) ldap: EXPAND OU=Users,DC=example,DC=com (0) ldap: --> OU=Users,DC=example,DC=com (0) ldap: Performing search in 'OU=Users,DC=example,DC=com' with filter '(sAMAccountName=test)', scope 'sub' (0) ldap: Waiting for search result... (0) ldap: User object found at DN “CN=test,OU=Users,DC=example,DC=com" rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop WARNING: (0) pap: No "known good" password found for the user. Not setting Auth-Type WARNING: (0) pap: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # (null) = ok ERROR: (0) No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test/password] (from client vpn port 0) (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) (null) { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) } # (null) = updated (0) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 150 from 127.0.0.1:1812 to 127.0.0.1:39860 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 150 with timestamp +4 Ready to process requests As you can see I am not sure why it fails at the pap stage and what is going on. I think it may have something to do with the user password hash not being retrieved from ldap but can’t be sure and from the searching I have done FreeRadius would seem to provide and error if this was the case. The sites-enable/default looks like the following: authorize { preprocess # auth_log chap mschap ldap expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } preacct { preprocess acct_unique # suffix files } accounting { detail radutmp attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { } And my ldap config is as follows: ldap { server = '192.168.6.221' identity = 'CN=FreeRadius,OU=Users,DC=example,DC=com' password = radpassword base_dn = 'OU=Users,DC=example,DC=com' user { base_dn = 'OU=Users,DC=example,DC=com' filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' } ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } Any help would be greatly appreciated. Kind Regards Thom

1 0

Cisco ACS and FreeRadius
by John Gill 12 Feb '15

12 Feb '15

Hi, I currently run a Cisco ASA 5510 firewall. Authentication take place via a Windows server with Cisco ACS software. Once the authentication has taken place, the ACS downloads an Access Control List (ACL) to the firewall that then restricts that user access to a single IP Address or in some cases multiple IP addresses. I only have about 20 users but this might grow to 50. I also get a few basic reports of failed and successful logins and how long the user was attached to the network. Is FreeRadius capable of doing this authentication and able to restrict access on the network and generate the basic reports? Regards John Corobrik (Pty) Ltd Reg No 2007/021571/07 P O Box 201367 Durban North KZN 4016 Tel +27 31 560 3111 Alt +27 87 359 3111 Fax +27 31 565 1532 This e-mail and all contents are subject to the following disclaimer: http://www.corobrik.co.za/disclaimer-and-legal-notices

2 1

Issues with £ character in passwords
by Mark Keyte 11 Feb '15

11 Feb '15

Hi We have been running Freeradius with 802.1x (peap-mschapv2) against edirectory authentication for a number of years. Currently running on sles 11 sp3 - freeradius-server-2.2.5-11.1 - but I have tested with older freeradius package that ships with SLES 11 SP3. Setup similar to https://www.novell.com/support/kb/doc.php?id=7009035 We have recently noticed that authentication is failing when users are using the £ sign character in their password (and also § found on macbook keyboards) - it seems to work fine with other characters - !"$%^123&*()_+-=[]{};'#:@~,./<>?\| for example. What I see in logs is Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +group MS-CHAP { [mschap] Creating challenge hash with username: lsxtestaas(a)lshtm.ac.uk [mschap] Client is using MS-CHAPv2 for lsxtestaas(a)lshtm.ac.uk, we need NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject However as soon as I remove £ sign auth is working fine. Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok Login OK: [lsxtestaas(a)lshtm.ac.uk] (from client aruba port 0 cli C48508CCE903 via TLS tunnel) It also works if you use Â£ rather than just the £ within the password when authing from a supplicant (tested with android & Windows)- suggesting some kind of encoding issue??. The cleartext password returned from eDirectory seems fine. [ldap] Added the eDirectory password ****£**** in check items as Cleartext-Password [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok Any thoughts would be appreciated. Thanks Mark

5 4

No such home_server or home_server_pool
by Scott Reeve 11 Feb '15

11 Feb '15

Keep getting this error: Wed Feb 11 11:32:21 2015 : Error: /etc/freeradius/clients.conf[210]: No such home_server or home_server_pool "my-coa" I've tried my best to read through it all. 1) Here's my section in clients.conf: client 15.234.166.129 { secret = abc shortname = abc nastype = other coa_server = my-coa } 2) Here's my section in sites-available/originate-coa: home_server my-coa { type = coa ipaddr = 15.234.166.129 port = 3799 secret = testing1234 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool coa { type = fail-over home_server = my-coa } 3) I could not understand the directions here: # CoA packets can be originated when a normal Access-Request or # Accounting-Request packet is received. Simply update the # "coa" list: # update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" } # # And the CoA packet will be sent. You can also send Disconnect # packets by using "update disconnect { ...". # # This "update coa" entry can be placed in any section (authorize, # preacct, etc.), EXCEPT for pre-proxy and post-proxy. The CoA Was I supposed to uncomment that "update coa" section? Copy and paste it somewhere else? I couldn't figure out what is meant by "can be placed in any other section" authorize/preacct, etc. It seems like it's not even looking at sites-available/originate-coa ? Thank you, Scott Reeve

2 1

Recommended version : 3.0.6 or 3.0.7 RC ?
by Osvaldo T Crispim Filho 11 Feb '15

11 Feb '15

Recommended version : 3.0.6 or 3.0.7 RC ? -- - Osvaldo T Crispim Filho -

3 2

(no subject)
by Robert Graham 10 Feb '15

10 Feb '15

Radius attribue User-password is not being passed in the authorize section. Im trying to use the attribute in an tmp-string-0 line calling sql to exec a stored proc. Its not expanding the User-Password attribute but it IS expanding the User-Name attribute... Is it just hidden or am I correct? Sent from my Android device

3 3

serial number freRADIUS 2.2.5
by Zadda Tempes 10 Feb '15

10 Feb '15

hello sir , please ,can you give me serial number of freeRADIUS 2.2.5?

3 2

Fwd: serial number freRADIUS 2.2.5
by Stefan Paetow 10 Feb '15

10 Feb '15

> On 10 Feb 2015, at 14:12, Zadda Tempes <zadda13(a)gmail.com> wrote: >> please ,can you give me serial number of freeRADIUS 2.2.5? > > FreeRADIUS is OpenSource. It does not have a serial number. Any package insisting on a serial number is *not* something you should use. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

4 4

HA scenario = failure
by Rob Walker 09 Feb '15

09 Feb '15

Hello, I'm a freerad newb, trying to get my HP Procurve 2910al working with 2 freerad servers (setup identically) and windows/linux endpoints. I've tested this setup successfully against each individual freerad server ok. As soon as I test stopping one of the free radius server hosts so that the 2910al is forced to try the other freerad server (testing a HA scenario) - authentication fails. I can only guess that it's something the switch is mishandling? If someone could advise on the below outputs it would be appreciated, it seems the packet length is much less when it doesn't work? Thanks *WORKS* # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "examiner", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 222 to 192.168.20.5 port 1812 MS-MPPE-Recv-Key = 0x5ed30fd859b49a49dd16e772a30e330d3573a5630212036937d8f2d MS-MPPE-Send-Key = 0x72687c7646048677b9bc3d82e25efbfeefeb6a5fad3ad0bc50a87c2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "examiner" Finished request 8. Going to the next request *FAILS* # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "examiner", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry examiner at line 50 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 213 to 192.168.20.5 port 1812 EAP-Message = 0x01060016041053527f160f5a194e8608d8bced20ec12 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa8a53daca8a339aa1a93d90a4cd655f7 Finished request 20. Going to the next request

3 4