- Freeradius-Users - lists.freeradius.org

Re: group authorization
by brendan kearney 29 Mar '14

29 Mar '14

Not an option for me right now, but is something I will look to do On Mar 29, 2014 4:29 PM, "Arran Cudbard-Bell" <a.cudbardb(a)freeradius.org> wrote: On 29 Mar 2014, at 19:53, Brendan Kearney <bpk678(a)gmail.com> wrote: > resending. rejected because of size. previously attached screenshot > moved to imgur. http://imgur.com/MvEuJXb > > On Sat, 2014-03-29 at 11:07 -0400, Brendan Kearney wrote: >> Reran this test, with a packet capture running to validate the returned >> data from my directory. >> >> As expected, the authN works but the authZ fails. the uid is being >> populated with the username and not the DN. The problem is that the >> directory is replying with a successful lookup, and is giving back the >> DN of my id. See attached screenshot of the packet capture. the blue >> highlighted lines indicate the reply from the directory with the DN. >> >> where do i continue looking for the reason why the DN is not being >> populated as the value to the variable "control:Ldap-UserDn"? Honestly, just move to 3.0.2. The LDAP code in v2.x.x looked like an incontinent Chihuahua or other small kickable type dog, had dragged it's way across a source file. It got rewritten twice, once by Alan to get the code into something understandable by humans, and then once again by me to get rid of all the weird legacy crap like the attrmap file. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

group authorization
by Brendan Kearney 29 Mar '14

29 Mar '14

i am close, but need a pointer... i am using rlm_krb5 for authentication and rlm_ldap for authorization. when i add a radiusReplyItem of Cisco-AVPair = "shell:priv-lvl=15" to my user object, i am able to log into my switch. i want to have the radiusReplyItem given in a reply when the user is a member of a specific group in ldap, but i seem to be having trouble with that. it seems that when the ldap query is made for the group membership, the "short" version of the uid (uid=brendan) is being used and not matching. the actual member "value" in the group is the "long" version of the uid (uid=brendan,ou=Users,dc=bpk2,dc=com). is there something i can do to use the "long" version? radiusd -X output: FreeRADIUS Version 2.2.0, for host x86_64-redhat-linux-gnu, built on Oct 9 2012 at 17:45:02 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/mac2vlan skipping config file, invalid characters in name "/etc/raddb/modules/&krb5.orig" including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mschap skipping config file, invalid name "/etc/raddb/modules/ldap.rpmnew" including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/unix skipping config file, invalid characters in name "/etc/raddb/modules/&dhcp_sqlippool.orig" including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/cache skipping config file, invalid characters in name "/etc/raddb/modules/&ldap.orig" including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "***REMOVED***" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm BPK2.COM { authhost = server.bpk2.com:1812 accthost = server.bpk2.com:1813 secret = ***REMOVED*** } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "***REMOVED***" nastype = "other" } client 192.168.254.253 { require_message_authenticator = no secret = "***REMOVED***" shortname = "switch" nastype = "cisco" } client test.bpk2.com { require_message_authenticator = no secret = "this" shortname = "splunk" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_krb5 Module: Instantiating module "krb5" from file /etc/raddb/modules/krb5 krb5 { keytab = "/etc/radius.keytab" service_principal = "radius/server.bpk2.com" cache = yes } rlm_krb5: krb5_init ok Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap ldap { server = "ldap.bpk2.com" port = 389 password = "***REMOVED***" identity = "cn=Manager,dc=bpk2,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 max_uses = 0 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=bpk2,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member= %{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember= %{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x7fa3421a5d60 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 34812 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.254.253 port 49181, id=0, length=88 User-Name = "brendan" User-Password = "***REMOVED***" Cisco-AVPair = "shell:priv-lvl=15" NAS-IP-Address = 192.168.254.253 Acct-Session-Id = "0500001C" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++? if (EAP-Message && Access-Request) ? Evaluating (EAP-Message ) -> FALSE ? Skipping (Access-Request) ++? if (EAP-Message && Access-Request) -> FALSE ++- entering else else {...} +++[chap] returns noop +++[mschap] returns noop +++[digest] returns noop [suffix] No '@' in User-Name = "brendan", looking up realm NULL [suffix] No such realm "NULL" +++[suffix] returns noop [eap] No EAP-Message, not doing EAP +++[eap] returns noop [files] users: Matched entry DEFAULT at line 1 +++[files] returns ok [ldap] performing user authorization for brendan [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> brendan [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=brendan) [ldap] expand: dc=bpk2,dc=com -> dc=bpk2,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.bpk2.com:389, authentication 0 [ldap] bind as cn=Manager,dc=bpk2,dc=com/***REMOVED*** to ldap.bpk2.com:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=bpk2,dc=com, with filter (uid=brendan) [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}***REMOVED***" [ldap] sambaNtPassword -> NT-Password == ***REMOVED*** [ldap] sambaLmPassword -> LM-Password == ***REMOVED*** [ldap] looking for reply items in directory... [ldap] user brendan authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 +++[ldap] returns ok +++[expiration] returns noop +++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP +++[pap] returns noop ++- else else returns ok Found Auth-Type = Kerberos # Executing group from file /etc/raddb/sites-enabled/default +- entering group Kerberos {...} ++[krb5] returns ok Login OK: [brendan] (from client switch port 0) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 0 to 192.168.254.253 port 49181 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +11 Ready to process requests.

8 34

New documentation is available online
by Alan DeKok 29 Mar '14

29 Mar '14

I've been making noises about writing documentation for a long time now. Too long. However, I've had a documentation person working on the problem for a few months now, and we have something ready for release. I hope this news has a positive impact on the FreeRADIUS community. There has been a lot of discussion recently around the subject of documentation, and I'd like people to know that I have been making progress. The documentation is available online at: http://networkradius.com/doc/ The astute reader will notice that the documentation isn't GPLd, and is instead from my company. The simple reason is that it costs money to have a professional person write documentation. So the documentation has to be owned by the entity who paid for it: Network RADIUS SARL. I plan on releasing more documentation in the next few months. There are a number of additional chapters nearly ready to go. There are a number more which need a lot of work. Please provide feedback. Is it good? Are there typos? What else needs documenting? Despite the documents being corporate branded, they are available for free download, for anyone to read. The company will continue to fund development of the documentation, and will continue to release more documentation over the coming months. Alan DeKok.

4 4

FreeRadius Authorizing and Authenticating Anyone if One User Logs in
by Lennon Mazonde 29 Mar '14

29 Mar '14

Hi Lalit, > >set Port-Limit =1 attribute for user and try Tried that, but the problem still prevails. Thanks, Lennon Mazonde

1 0

Re: Freeradius-Users Digest, Vol 107, Issue 113
by Rui Ribeiro 28 Mar '14

28 Mar '14

> > Message: 4 > Date: Fri, 28 Mar 2014 08:37:29 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Why documentation is the way it is > Message-ID: <53356D09.9070101(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > > "You know, I don't want anyone else to go through the same pain I did. > So to help people like me, I'm going to write a quick howto, and put it > on the Wiki". > > No. Every single complainer cares only about their problems, and > cares nothing for anyone else. They complain that other people have to > do MORE work for them, for free. They refuse to contribute anything > themselves. It's pretty obvious after 15 years, the more someone > complains, the less they follow instructions, and the less they get done. > > Hi, I actually wrote a 100+ page wiki (in our EDUROAM federation wiki) in my native tongue Portuguese, to document my ongoing problems and provide an easy path to reconstruct my work to anybody, directed more to AD authentication+EDUROAM in the Portuguese federation. At the moment is directed to freeradius 2. I am thinking into expanding it to freeradius 3, and possibly taking the trouble to put it in iBook format, and distribute it outside of the federation. Rui F. F. Ribeiro ISCTE-IUL http://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 4

AIX client to MS RADIUS server
by Lloyd Gill 28 Mar '14

28 Mar '14

Hello all, Got a clean build of pam_radius_auth (v.1.3.17) on aix 6.1, but cannot get PAM configured correctly to use this version. I am now trying with source 2.2.4, but can anyone confirm this works with AIX as a client to a Microsoft RADIUS server? Our goal is multi-factor authentication using token password generators. This is working for Linux and Solaris, both environments using 1.3.17 and PAM configurations. Can someone confirm if AIX should work with this module, and for either version? Thanks, Lloyd

5 26

freeradius 3 cannot initiate eap-sim,
by Bill Yuan 28 Mar '14

28 Mar '14

(1) eap : EAP packet type response id 0 length 56 (1) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Peer sent Identity (1) (1) eap : Calling eap_sim to process EAP data *(1) eap_sim : Can't initiate EAP-SIM, no RAND1 attribute* (1) ERROR: eap : Failed starting EAP SIM (18) session. EAP sub-module failed (1) eap : Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user. I met this issue when I was trying to use eap-sim module in freeradius 3.0.1

3 12

configuration parameters for perl module in rlm_perl
by Cornelius Kölbel 28 Mar '14

28 Mar '14

Hi list, is there are recommended way to pass configuration parameter to a rlm_perl module? My rlm_perl module, would need to have additional configuration parameters. I would like to avoid having the perl module read an additional configuration file. Is there a possibility to add such paramters somewhere in the freeradius config like in /etc/freeradius/modules/perl and than have the perl module access these parameters? Thanks a lot and kind regards Cornelius

8 20

FreeRadius Authorizing and Authenticating Anyone if One User Logs in
by Lennon Mazonde 28 Mar '14

28 Mar '14

Hi Everyone, Newbie here. I am running freeradius administered via daloradius with coovachilli for my captive portal. My problem is that if one user logs in (via the captive portal), freeradius is granting access to any user. In other words, anyone who logs in after the first user doesn't get redirected to the captive portal, they simply gain (free) access. If any one user logs out of the session, again all the other users are logged out. I've looked at the freeradius debug output, but i can't see anything out of the ordinary, perhaps i'm not looking in the right places? Please help me :-( Output from freeradius -XXX: Thu Mar 27 21:33:31 2014 : Info: FreeRADIUS Version 2.1.10, for host x86_64-pc-l inux-gnu, built on Feb 24 2014 at 15:16:50 Thu Mar 27 21:33:31 2014 : Info: Copyright (C) 1999-2009 The FreeRADIUS server p roject and contributors. Thu Mar 27 21:33:31 2014 : Info: There is NO warranty; not even for MERCHANTABIL ITY or FITNESS FOR A Thu Mar 27 21:33:31 2014 : Info: PARTICULAR PURPOSE. Thu Mar 27 21:33:31 2014 : Info: You may redistribute copies of FreeRADIUS under the terms of the Thu Mar 27 21:33:31 2014 : Info: GNU General Public License v2. Thu Mar 27 21:33:31 2014 : Info: Starting - reading configuration files ... Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/r adiusd.conf Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/p roxy.conf Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/c lients.conf Thu Mar 27 21:33:31 2014 : Debug: including files in directory /etc/freeradius/m odules/ Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/exec Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/mac2ip Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/cui Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/detail.log Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/digest Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/files Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/counter Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/checkval Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/attr_filter Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/passwd Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/acct_unique Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/krb5 Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/sradutmp Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/chap Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/mschap Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/preprocess Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/ldap Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/ippool Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/opendirectory Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/inner-eap Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/logintime Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/mac2vlan Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/smsotp Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/sql_log Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/attr_rewrite Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/otp Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/wimax Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/linelog Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/pam Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/echo Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/pap Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/dynamic_clients Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/etc_group Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/policy Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/expiration Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/smbpasswd Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/perl Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/detail Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/realm Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/sqlcounter_expire_on_login Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/always Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/expr Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/unix Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/detail.example.com Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/ntlm_auth Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/m odules/radutmp Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/e ap.conf Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/s ql.conf Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/s ql/mysql/dialup.conf Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/s ql/mysql/counter.conf Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/p olicy.conf Thu Mar 27 21:33:31 2014 : Debug: including files in directory /etc/freeradius/s ites-enabled/ Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/s ites-enabled/inner-tunnel Thu Mar 27 21:33:31 2014 : Debug: including configuration file /etc/freeradius/s ites-enabled/default Thu Mar 27 21:33:31 2014 : Debug: main { Thu Mar 27 21:33:31 2014 : Debug: user = "freerad" Thu Mar 27 21:33:31 2014 : Debug: group = "freerad" Thu Mar 27 21:33:31 2014 : Debug: allow_core_dumps = no Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: including dictionary file /etc/freeradius/dict ionary Thu Mar 27 21:33:31 2014 : Debug: main { Thu Mar 27 21:33:31 2014 : Debug: prefix = "/usr" Thu Mar 27 21:33:31 2014 : Debug: localstatedir = "/var" Thu Mar 27 21:33:31 2014 : Debug: logdir = "/var/log/freeradius" Thu Mar 27 21:33:31 2014 : Debug: libdir = "/usr/lib/freeradius" Thu Mar 27 21:33:31 2014 : Debug: radacctdir = "/var/log/freeradius/radacc t" Thu Mar 27 21:33:31 2014 : Debug: hostname_lookups = no Thu Mar 27 21:33:31 2014 : Debug: max_request_time = 30 Thu Mar 27 21:33:31 2014 : Debug: cleanup_delay = 5 Thu Mar 27 21:33:31 2014 : Debug: max_requests = 1024 Thu Mar 27 21:33:31 2014 : Debug: pidfile = "/var/run/freeradius/freeradiu s.pid" Thu Mar 27 21:33:31 2014 : Debug: checkrad = "/usr/sbin/checkrad" Thu Mar 27 21:33:31 2014 : Debug: debug_level = 0 Thu Mar 27 21:33:31 2014 : Debug: proxy_requests = yes Thu Mar 27 21:33:31 2014 : Debug: log { Thu Mar 27 21:33:31 2014 : Debug: stripped_names = no Thu Mar 27 21:33:31 2014 : Debug: auth = no Thu Mar 27 21:33:31 2014 : Debug: auth_badpass = no Thu Mar 27 21:33:31 2014 : Debug: auth_goodpass = no Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: security { Thu Mar 27 21:33:31 2014 : Debug: max_attributes = 200 Thu Mar 27 21:33:31 2014 : Debug: reject_delay = 1 Thu Mar 27 21:33:31 2014 : Debug: status_server = yes Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: radiusd: #### Loading Realms and Home Servers #### Thu Mar 27 21:33:31 2014 : Debug: proxy server { Thu Mar 27 21:33:31 2014 : Debug: retry_delay = 5 Thu Mar 27 21:33:31 2014 : Debug: retry_count = 3 Thu Mar 27 21:33:31 2014 : Debug: default_fallback = no Thu Mar 27 21:33:31 2014 : Debug: dead_time = 120 Thu Mar 27 21:33:31 2014 : Debug: wake_all_if_all_dead = no Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: home_server localhost { Thu Mar 27 21:33:31 2014 : Debug: ipaddr = 127.0.0.1 Thu Mar 27 21:33:31 2014 : Debug: port = 1812 Thu Mar 27 21:33:31 2014 : Debug: type = "auth" Thu Mar 27 21:33:31 2014 : Debug: secret = "testing123" Thu Mar 27 21:33:31 2014 : Debug: response_window = 20 Thu Mar 27 21:33:31 2014 : Debug: max_outstanding = 65536 Thu Mar 27 21:33:31 2014 : Debug: require_message_authenticator = yes Thu Mar 27 21:33:31 2014 : Debug: zombie_period = 40 Thu Mar 27 21:33:31 2014 : Debug: status_check = "status-server" Thu Mar 27 21:33:31 2014 : Debug: ping_interval = 30 Thu Mar 27 21:33:31 2014 : Debug: check_interval = 30 Thu Mar 27 21:33:31 2014 : Debug: num_answers_to_alive = 3 Thu Mar 27 21:33:31 2014 : Debug: num_pings_to_alive = 3 Thu Mar 27 21:33:31 2014 : Debug: revive_interval = 120 Thu Mar 27 21:33:31 2014 : Debug: status_check_timeout = 4 Thu Mar 27 21:33:31 2014 : Debug: irt = 2 Thu Mar 27 21:33:31 2014 : Debug: mrt = 16 Thu Mar 27 21:33:31 2014 : Debug: mrc = 5 Thu Mar 27 21:33:31 2014 : Debug: mrd = 30 Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: home_server_pool my_auth_failover { Thu Mar 27 21:33:31 2014 : Debug: type = fail-over Thu Mar 27 21:33:31 2014 : Debug: home_server = localhost Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: realm example.com { Thu Mar 27 21:33:31 2014 : Debug: auth_pool = my_auth_failover Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: realm LOCAL { Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: radiusd: #### Loading Clients #### Thu Mar 27 21:33:31 2014 : Debug: client localhost { Thu Mar 27 21:33:31 2014 : Debug: ipaddr = 127.0.0.1 Thu Mar 27 21:33:31 2014 : Debug: require_message_authenticator = no Thu Mar 27 21:33:31 2014 : Debug: secret = "testing123" Thu Mar 27 21:33:31 2014 : Debug: nastype = "other" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: radiusd: #### Instantiating modules #### Thu Mar 27 21:33:31 2014 : Debug: instantiate { Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_exec, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_exec Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "exec" from file /etc/freeradius/modules/exec Thu Mar 27 21:33:31 2014 : Debug: exec { Thu Mar 27 21:33:31 2014 : Debug: wait = no Thu Mar 27 21:33:31 2014 : Debug: input_pairs = "request" Thu Mar 27 21:33:31 2014 : Debug: shell_escape = yes Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_expr, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_expr Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_expiration, checking if it's v alid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_expiration Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "expiration" fro m file /etc/freeradius/modules/expiration Thu Mar 27 21:33:31 2014 : Debug: expiration { Thu Mar 27 21:33:31 2014 : Debug: reply-message = "Password Has Expired " Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_logintime, checking if it's va lid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_logintime Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime Thu Mar 27 21:33:31 2014 : Debug: logintime { Thu Mar 27 21:33:31 2014 : Debug: reply-message = "You are calling outside your allowed timespan " Thu Mar 27 21:33:31 2014 : Debug: minimum-timeout = 60 Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_sqlcounter, checking if it's v alid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_sqlcounter Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "chillispot_max_ bytes" from file /etc/freeradius/sql/mysql/counter.conf Thu Mar 27 21:33:31 2014 : Debug: sqlcounter chillispot_max_bytes { Thu Mar 27 21:33:31 2014 : Debug: counter-name = "ChilliSpot-Max-Total-Oct ets" Thu Mar 27 21:33:31 2014 : Debug: check-name = "ChilliSpot-Max-Total-Octet s" Thu Mar 27 21:33:31 2014 : Debug: reply-name = "ChilliSpot-Max-Total-Octet s" Thu Mar 27 21:33:31 2014 : Debug: key = "User-Name" Thu Mar 27 21:33:31 2014 : Debug: sqlmod-inst = "sql" Thu Mar 27 21:33:31 2014 : Debug: query = "SELECT SUM(AcctInputOctets) + S UM(AcctOutputOctets) FROM radacct WHERE UserName='%{%k'" Thu Mar 27 21:33:31 2014 : Debug: reset = "never" Thu Mar 27 21:33:31 2014 : Debug: safe-characters = "@abcdefghijklmnopqrst uvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Reply attribute ChilliSpot-Max -Total-Octets is number 954138627 Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Counter attribute ChilliSpot-M ax-Total-Octets is number 954138627 Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Check attribute ChilliSpot-Max -Total-Octets is number 954138627 Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Current Time: 1395948811 [2014 -03-27 21:33:31], Next reset 0 [2014-03-27 21:00:00] Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Current Time: 1395948811 [2014 -03-27 21:33:31], Prev reset 0 [2014-03-27 21:00:00] Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "noresetcounter" from file /etc/freeradius/sql/mysql/counter.conf Thu Mar 27 21:33:31 2014 : Debug: sqlcounter noresetcounter { Thu Mar 27 21:33:31 2014 : Debug: counter-name = "Max-All-Session-Time" Thu Mar 27 21:33:31 2014 : Debug: check-name = "Max-All-Session" Thu Mar 27 21:33:31 2014 : Debug: key = "User-Name" Thu Mar 27 21:33:31 2014 : Debug: sqlmod-inst = "sql" Thu Mar 27 21:33:31 2014 : Debug: query = "SELECT IFNULL(SUM(AcctSessionTi me),0) FROM radacct WHERE UserName='%{%k}'" Thu Mar 27 21:33:31 2014 : Debug: reset = "never" Thu Mar 27 21:33:31 2014 : Debug: safe-characters = "@abcdefghijklmnopqrst uvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Reply attribute set to Session -Timeout. Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Counter attribute Max-All-Sess ion-Time is number 11273 Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Check attribute Max-All-Sessio n is number 11274 Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Current Time: 1395948811 [2014 -03-27 21:33:31], Next reset 0 [2014-03-27 21:00:00] Thu Mar 27 21:33:31 2014 : Debug: rlm_sqlcounter: Current Time: 1395948811 [2014 -03-27 21:33:31], Prev reset 0 [2014-03-27 21:00:00] Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: radiusd: #### Loading Virtual Servers #### Thu Mar 27 21:33:31 2014 : Debug: server inner-tunnel { # from file /etc/freerad ius/sites-enabled/inner-tunnel Thu Mar 27 21:33:31 2014 : Debug: modules { Thu Mar 27 21:33:31 2014 : Debug: Module: Checking authenticate {...} for more modules to load Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_pap, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_pap Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "pap" from file /etc/freeradius/modules/pap Thu Mar 27 21:33:31 2014 : Debug: pap { Thu Mar 27 21:33:31 2014 : Debug: encryption_scheme = "auto" Thu Mar 27 21:33:31 2014 : Debug: auto_header = no Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_chap, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_chap Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_mschap, checking if it's valid ) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_mschap Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "mschap" from fi le /etc/freeradius/modules/mschap Thu Mar 27 21:33:31 2014 : Debug: mschap { Thu Mar 27 21:33:31 2014 : Debug: use_mppe = yes Thu Mar 27 21:33:31 2014 : Debug: require_encryption = no Thu Mar 27 21:33:31 2014 : Debug: require_strong = no Thu Mar 27 21:33:31 2014 : Debug: with_ntdomain_hack = no Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_unix, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_unix Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "unix" from file /etc/freeradius/modules/unix Thu Mar 27 21:33:31 2014 : Debug: unix { Thu Mar 27 21:33:31 2014 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_eap, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_eap Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "eap" from file /etc/freeradius/eap.conf Thu Mar 27 21:33:31 2014 : Debug: eap { Thu Mar 27 21:33:31 2014 : Debug: default_eap_type = "md5" Thu Mar 27 21:33:31 2014 : Debug: timer_expire = 60 Thu Mar 27 21:33:31 2014 : Debug: ignore_unknown_eap_types = no Thu Mar 27 21:33:31 2014 : Debug: cisco_accounting_username_bug = no Thu Mar 27 21:33:31 2014 : Debug: max_sessions = 4096 Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to sub-module rlm_eap_md5 Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating eap-md5 Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to sub-module rlm_eap_leap Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating eap-leap Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to sub-module rlm_eap_gtc Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating eap-gtc Thu Mar 27 21:33:31 2014 : Debug: gtc { Thu Mar 27 21:33:31 2014 : Debug: challenge = "Password: " Thu Mar 27 21:33:31 2014 : Debug: auth_type = "PAP" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to sub-module rlm_eap_tls Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating eap-tls Thu Mar 27 21:33:31 2014 : Debug: tls { Thu Mar 27 21:33:31 2014 : Debug: rsa_key_exchange = no Thu Mar 27 21:33:31 2014 : Debug: dh_key_exchange = yes Thu Mar 27 21:33:31 2014 : Debug: rsa_key_length = 512 Thu Mar 27 21:33:31 2014 : Debug: dh_key_length = 512 Thu Mar 27 21:33:31 2014 : Debug: verify_depth = 0 Thu Mar 27 21:33:31 2014 : Debug: CA_path = "/etc/freeradius/certs" Thu Mar 27 21:33:31 2014 : Debug: pem_file_type = yes Thu Mar 27 21:33:31 2014 : Debug: private_key_file = "/etc/freeradius/cert s/server.key" Thu Mar 27 21:33:31 2014 : Debug: certificate_file = "/etc/freeradius/cert s/server.pem" Thu Mar 27 21:33:31 2014 : Debug: CA_file = "/etc/freeradius/certs/ca.pem" Thu Mar 27 21:33:31 2014 : Debug: private_key_password = "whatever" Thu Mar 27 21:33:31 2014 : Debug: dh_file = "/etc/freeradius/certs/dh" Thu Mar 27 21:33:31 2014 : Debug: random_file = "/dev/urandom" Thu Mar 27 21:33:31 2014 : Debug: fragment_size = 1024 Thu Mar 27 21:33:31 2014 : Debug: include_length = yes Thu Mar 27 21:33:31 2014 : Debug: check_crl = no Thu Mar 27 21:33:31 2014 : Debug: cipher_list = "DEFAULT" Thu Mar 27 21:33:31 2014 : Debug: make_cert_command = "/etc/freeradius/cer ts/bootstrap" Thu Mar 27 21:33:31 2014 : Debug: cache { Thu Mar 27 21:33:31 2014 : Debug: enable = no Thu Mar 27 21:33:31 2014 : Debug: lifetime = 24 Thu Mar 27 21:33:31 2014 : Debug: max_entries = 255 Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: verify { Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to sub-module rlm_eap_ttls Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating eap-ttls Thu Mar 27 21:33:31 2014 : Debug: ttls { Thu Mar 27 21:33:31 2014 : Debug: default_eap_type = "md5" Thu Mar 27 21:33:31 2014 : Debug: copy_request_to_tunnel = no Thu Mar 27 21:33:31 2014 : Debug: use_tunneled_reply = no Thu Mar 27 21:33:31 2014 : Debug: virtual_server = "inner-tunnel" Thu Mar 27 21:33:31 2014 : Debug: include_length = yes Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to sub-module rlm_eap_peap Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating eap-peap Thu Mar 27 21:33:31 2014 : Debug: peap { Thu Mar 27 21:33:31 2014 : Debug: default_eap_type = "mschapv2" Thu Mar 27 21:33:31 2014 : Debug: copy_request_to_tunnel = no Thu Mar 27 21:33:31 2014 : Debug: use_tunneled_reply = no Thu Mar 27 21:33:31 2014 : Debug: proxy_tunneled_request_as_eap = yes Thu Mar 27 21:33:31 2014 : Debug: virtual_server = "inner-tunnel" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating eap-mschapv2 Thu Mar 27 21:33:31 2014 : Debug: mschapv2 { Thu Mar 27 21:33:31 2014 : Debug: with_ntdomain_hack = no Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Checking authorize {...} for more mod ules to load Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_realm, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_realm Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "suffix" from fi le /etc/freeradius/modules/realm Thu Mar 27 21:33:31 2014 : Debug: realm suffix { Thu Mar 27 21:33:31 2014 : Debug: format = "suffix" Thu Mar 27 21:33:31 2014 : Debug: delimiter = "@" Thu Mar 27 21:33:31 2014 : Debug: ignore_default = no Thu Mar 27 21:33:31 2014 : Debug: ignore_null = no Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_files, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_files Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "files" from fil e /etc/freeradius/modules/files Thu Mar 27 21:33:31 2014 : Debug: files { Thu Mar 27 21:33:31 2014 : Debug: usersfile = "/etc/freeradius/users" Thu Mar 27 21:33:31 2014 : Debug: acctusersfile = "/etc/freeradius/acct_us ers" Thu Mar 27 21:33:31 2014 : Debug: preproxy_usersfile = "/etc/freeradius/pr eproxy_users" Thu Mar 27 21:33:31 2014 : Debug: compat = "no" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Checking session {...} for more modul es to load Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_radutmp, checking if it's vali d) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_radutmp Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "radutmp" from f ile /etc/freeradius/modules/radutmp Thu Mar 27 21:33:31 2014 : Debug: radutmp { Thu Mar 27 21:33:31 2014 : Debug: filename = "/var/log/freeradius/radutmp" Thu Mar 27 21:33:31 2014 : Debug: username = "%{User-Name}" Thu Mar 27 21:33:31 2014 : Debug: case_sensitive = yes Thu Mar 27 21:33:31 2014 : Debug: check_with_nas = yes Thu Mar 27 21:33:31 2014 : Debug: perm = 384 Thu Mar 27 21:33:31 2014 : Debug: callerid = yes Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Checking post-proxy {...} for more mo dules to load Thu Mar 27 21:33:31 2014 : Debug: Module: Checking post-auth {...} for more mod ules to load Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_attr_filter Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "attr_filter.acc ess_reject" from file /etc/freeradius/modules/attr_filter Thu Mar 27 21:33:31 2014 : Debug: attr_filter attr_filter.access_reject { Thu Mar 27 21:33:31 2014 : Debug: attrsfile = "/etc/freeradius/attrs.acces s_reject" Thu Mar 27 21:33:31 2014 : Debug: key = "%{User-Name}" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: } # modules Thu Mar 27 21:33:31 2014 : Debug: } # server Thu Mar 27 21:33:31 2014 : Debug: server { # from file /etc/freeradius/radiusd.c onf Thu Mar 27 21:33:31 2014 : Debug: modules { Thu Mar 27 21:33:31 2014 : Debug: Module: Checking authenticate {...} for more modules to load Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_digest, checking if it's valid ) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_digest Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "digest" from fi le /etc/freeradius/modules/digest Thu Mar 27 21:33:31 2014 : Debug: Module: Checking authorize {...} for more mod ules to load Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_preprocess, checking if it's v alid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_preprocess Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "preprocess" fro m file /etc/freeradius/modules/preprocess Thu Mar 27 21:33:31 2014 : Debug: preprocess { Thu Mar 27 21:33:31 2014 : Debug: huntgroups = "/etc/freeradius/huntgroups " Thu Mar 27 21:33:31 2014 : Debug: hints = "/etc/freeradius/hints" Thu Mar 27 21:33:31 2014 : Debug: with_ascend_hack = no Thu Mar 27 21:33:31 2014 : Debug: ascend_channels_per_line = 23 Thu Mar 27 21:33:31 2014 : Debug: with_ntdomain_hack = no Thu Mar 27 21:33:31 2014 : Debug: with_specialix_jetstream_hack = no Thu Mar 27 21:33:31 2014 : Debug: with_cisco_vsa_hack = no Thu Mar 27 21:33:31 2014 : Debug: with_alvarion_vsa_hack = no Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_sql, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_sql Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "sql" from file /etc/freeradius/sql.conf Thu Mar 27 21:33:31 2014 : Debug: sql { Thu Mar 27 21:33:31 2014 : Debug: driver = "rlm_sql_mysql" Thu Mar 27 21:33:31 2014 : Debug: server = "localhost" Thu Mar 27 21:33:31 2014 : Debug: port = "" Thu Mar 27 21:33:31 2014 : Debug: login = "radius" Thu Mar 27 21:33:31 2014 : Debug: password = "radpass" Thu Mar 27 21:33:31 2014 : Debug: radius_db = "radius" Thu Mar 27 21:33:31 2014 : Debug: read_groups = yes Thu Mar 27 21:33:31 2014 : Debug: sqltrace = no Thu Mar 27 21:33:31 2014 : Debug: sqltracefile = "/var/log/freeradius/sqlt race.sql" Thu Mar 27 21:33:31 2014 : Debug: readclients = no Thu Mar 27 21:33:31 2014 : Debug: deletestalesessions = yes Thu Mar 27 21:33:31 2014 : Debug: num_sql_socks = 5 Thu Mar 27 21:33:31 2014 : Debug: lifetime = 0 Thu Mar 27 21:33:31 2014 : Debug: max_queries = 0 Thu Mar 27 21:33:31 2014 : Debug: sql_user_name = "%{User-Name}" Thu Mar 27 21:33:31 2014 : Debug: default_user_profile = "" Thu Mar 27 21:33:31 2014 : Debug: nas_query = "SELECT id, nasname, shortna me, type, secret, server FROM nas" Thu Mar 27 21:33:31 2014 : Debug: authorize_check_query = "SELECT id, user name, attribute, value, op FROM radcheck WHERE username = '% {SQL-User-Name}' ORDER BY id" Thu Mar 27 21:33:31 2014 : Debug: authorize_reply_query = "SELECT id, user name, attribute, value, op FROM radreply WHERE username = '% {SQL-User-Name}' ORDER BY id" Thu Mar 27 21:33:31 2014 : Debug: authorize_group_check_query = "SELECT id , groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" Thu Mar 27 21:33:31 2014 : Debug: authorize_group_reply_query = "SELECT id , groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" Thu Mar 27 21:33:31 2014 : Debug: accounting_onoff_query = " UPDA TE radacct SET acctstoptime = '%S', a cctsessiontime = unix_timestamp('%S') - u nix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Termina te-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Addres s}' AND acctstarttime <= '%S'" Thu Mar 27 21:33:31 2014 : Debug: accounting_update_query = " UP DATE radacct SET framedipaddress = '%{Framed-IP-Address}' , acctsessiontime = '%{Acct-Session-Time}', acctin putoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{ %{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Ac ct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = ' %{NAS-IP-Address}'" Thu Mar 27 21:33:31 2014 : Debug: accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username , realm, nasipaddress, nasportid, nasp orttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstatio nid, callingstationid, servicetype, framedprotocol, frame dipaddress, acctstartdelay, xascendsessionsvrkey) VALUE S ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', ' %{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Ac ct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-G igawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '% {X-Ascend-Session-Svr-Key}')" Thu Mar 27 21:33:31 2014 : Debug: accounting_start_query = " INS ERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype , acctstarttime, acctstoptime, acctsessiontime, acctauthen tic, connectinfo_start, connectinfo_stop, acctinputoctets, acct outputoctets, calledstationid, callingstationid, acctterminatecaus e, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL -User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', ' %{Connect-Info}', '', '0', '0', '%{Called-Station-Id}' , '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protoco l}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X- Ascend-Session-Svr-Key}')" Thu Mar 27 21:33:31 2014 : Debug: accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstar tdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Conn ect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND u sername = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP- Address}'" Thu Mar 27 21:33:31 2014 : Debug: accounting_stop_query = " UPDA TE radacct SET acctstoptime = '%S', acctsessiont ime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Inp ut-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Oct ets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-I nfo}' WHERE acctsessionid = '%{Acct-Session-Id}' AND usern ame = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Ad dress}'" Thu Mar 27 21:33:31 2014 : Debug: accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, ac ctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calle dstationid, callingstationid, acctterminatecause, servicetype, fram edprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS- Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Tim e}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0} ' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Outp ut-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Termin ate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- Address}', '0', '%{%{Acct-Delay-Time}:-0}')" Thu Mar 27 21:33:31 2014 : Debug: group_membership_query = "SELECT groupna me FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" Thu Mar 27 21:33:31 2014 : Debug: connect_failure_retry_delay = 60 Thu Mar 27 21:33:31 2014 : Debug: simul_count_query = "" Thu Mar 27 21:33:31 2014 : Debug: simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotoco l FROM radacct WHE RE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" Thu Mar 27 21:33:31 2014 : Debug: postauth_query = "INSERT INTO radpostaut h (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply :Packet-Type}', '%S')" Thu Mar 27 21:33:31 2014 : Debug: safe-characters = "@abcdefghijklmnopqrst uvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm _sql_mysql) loaded and linked Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Attempting to connect to radius@ localhost:/radius Thu Mar 27 21:33:31 2014 : Debug: rlm_sql (sql): starting 0 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_my sql #0 Thu Mar 27 21:33:31 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Connected new DB handle, #0 Thu Mar 27 21:33:31 2014 : Debug: rlm_sql (sql): starting 1 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_my sql #1 Thu Mar 27 21:33:31 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Connected new DB handle, #1 Thu Mar 27 21:33:31 2014 : Debug: rlm_sql (sql): starting 2 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_my sql #2 Thu Mar 27 21:33:31 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Connected new DB handle, #2 Thu Mar 27 21:33:31 2014 : Debug: rlm_sql (sql): starting 3 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_my sql #3 Thu Mar 27 21:33:31 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Connected new DB handle, #3 Thu Mar 27 21:33:31 2014 : Debug: rlm_sql (sql): starting 4 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_my sql #4 Thu Mar 27 21:33:31 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Thu Mar 27 21:33:31 2014 : Info: rlm_sql (sql): Connected new DB handle, #4 Thu Mar 27 21:33:31 2014 : Debug: Module: Checking preacct {...} for more modul es to load Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_acct_unique Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "acct_unique" fr om file /etc/freeradius/modules/acct_unique Thu Mar 27 21:33:31 2014 : Debug: acct_unique { Thu Mar 27 21:33:31 2014 : Debug: key = "User-Name, Acct-Session-Id, NAS-I P-Address, Client-IP-Address, NAS-Port" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Checking accounting {...} for more mo dules to load Thu Mar 27 21:33:31 2014 : Debug: (Loaded rlm_detail, checking if it's valid ) Thu Mar 27 21:33:31 2014 : Debug: Module: Linked to module rlm_detail Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "detail" from fi le /etc/freeradius/modules/detail Thu Mar 27 21:33:31 2014 : Debug: detail { Thu Mar 27 21:33:31 2014 : Debug: detailfile = "/var/log/freeradius/radacc t/%{Client-IP-Address}/detail-%Y%m%d" Thu Mar 27 21:33:31 2014 : Debug: header = "%t" Thu Mar 27 21:33:31 2014 : Debug: detailperm = 384 Thu Mar 27 21:33:31 2014 : Debug: dirperm = 493 Thu Mar 27 21:33:31 2014 : Debug: locking = no Thu Mar 27 21:33:31 2014 : Debug: log_packet_header = no Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Instantiating module "attr_filter.acc ounting_response" from file /etc/freeradius/modules/attr_filter Thu Mar 27 21:33:31 2014 : Debug: attr_filter attr_filter.accounting_response { Thu Mar 27 21:33:31 2014 : Debug: attrsfile = "/etc/freeradius/attrs.accou nting_response" Thu Mar 27 21:33:31 2014 : Debug: key = "%{User-Name}" Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Module: Checking session {...} for more modul es to load Thu Mar 27 21:33:31 2014 : Debug: Module: Checking post-proxy {...} for more mo dules to load Thu Mar 27 21:33:31 2014 : Debug: Module: Checking post-auth {...} for more mod ules to load Thu Mar 27 21:33:31 2014 : Debug: } # modules Thu Mar 27 21:33:31 2014 : Debug: } # server Thu Mar 27 21:33:31 2014 : Debug: radiusd: #### Opening IP addresses and Ports # ### Thu Mar 27 21:33:31 2014 : Debug: listen { Thu Mar 27 21:33:31 2014 : Debug: type = "auth" Thu Mar 27 21:33:31 2014 : Debug: ipaddr = * Thu Mar 27 21:33:31 2014 : Debug: port = 0 Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: listen { Thu Mar 27 21:33:31 2014 : Debug: type = "acct" Thu Mar 27 21:33:31 2014 : Debug: ipaddr = * Thu Mar 27 21:33:31 2014 : Debug: port = 0 Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: listen { Thu Mar 27 21:33:31 2014 : Debug: type = "auth" Thu Mar 27 21:33:31 2014 : Debug: ipaddr = 127.0.0.1 Thu Mar 27 21:33:31 2014 : Debug: port = 18120 Thu Mar 27 21:33:31 2014 : Debug: } Thu Mar 27 21:33:31 2014 : Debug: Listening on authentication address * port 181 2 Thu Mar 27 21:33:31 2014 : Debug: Listening on accounting address * port 1813 Thu Mar 27 21:33:31 2014 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Thu Mar 27 21:33:31 2014 : Debug: Listening on proxy address * port 1814 Thu Mar 27 21:33:31 2014 : Info: Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 39179, id=59, lengt h=257 ChilliSpot-Version = "1.3.0" ChilliSpot-Attr-10 = 0x00000002 Event-Timestamp = "Mar 27 2014 21:35:52 CAT" User-Name = "test" Acct-Input-Octets = 101730846 Acct-Output-Octets = 4385914 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 86549 Acct-Output-Packets = 59069 Acct-Session-Time = 12303 Acct-Status-Type = Interim-Update Acct-Session-Id = "53344d3a00000002" Framed-IP-Address = 10.1.0.7 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "D8-EB-97-22-A0-8C" Called-Station-Id = "00-0A-CD-1F-F6-43" NAS-IP-Address = 10.1.0.1 NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" Thu Mar 27 21:35:53 2014 : Info: # Executing section preacct from file /etc/free radius/sites-enabled/default Thu Mar 27 21:35:53 2014 : Info: +- entering group preacct {...} Thu Mar 27 21:35:53 2014 : Info: ++[preprocess] returns ok Thu Mar 27 21:35:53 2014 : Info: [acct_unique] Hashing 'NAS-Port = 2,Client-IP-A ddress = 127.0.0.1,NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "53344d3a00000002 ",User-Name = "test"' Thu Mar 27 21:35:53 2014 : Info: [acct_unique] Acct-Unique-Session-ID = "7874c3e 20d038361". Thu Mar 27 21:35:53 2014 : Info: ++[acct_unique] returns ok Thu Mar 27 21:35:53 2014 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Thu Mar 27 21:35:53 2014 : Info: [suffix] No such realm "NULL" Thu Mar 27 21:35:53 2014 : Info: ++[suffix] returns noop Thu Mar 27 21:35:53 2014 : Info: ++[files] returns noop Thu Mar 27 21:35:53 2014 : Info: # Executing section accounting from file /etc/f reeradius/sites-enabled/default Thu Mar 27 21:35:53 2014 : Info: +- entering group accounting {...} Thu Mar 27 21:35:53 2014 : Info: [detail] expand: /var/log/freeradius/rada cct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/ detail-20140327 Thu Mar 27 21:35:53 2014 : Info: [detail] /var/log/freeradius/radacct/%{Client-I P-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail -20140327 Thu Mar 27 21:35:53 2014 : Info: [detail] expand: %t -> Thu Mar 27 21:35:5 3 2014 Thu Mar 27 21:35:53 2014 : Info: ++[detail] returns ok Thu Mar 27 21:35:53 2014 : Info: ++[unix] returns noop Thu Mar 27 21:35:53 2014 : Info: [radutmp] expand: /var/log/freeradius/radu tmp -> /var/log/freeradius/radutmp Thu Mar 27 21:35:53 2014 : Info: [radutmp] expand: %{User-Name} -> test Thu Mar 27 21:35:53 2014 : Info: ++[radutmp] returns ok Thu Mar 27 21:35:53 2014 : Info: [sql] expand: %{User-Name} -> test Thu Mar 27 21:35:53 2014 : Info: [sql] sql_set_user escaped user --> 'test' Thu Mar 27 21:35:53 2014 : Info: [sql] expand: %{Acct-Input-Gigawords} -> 0 Thu Mar 27 21:35:53 2014 : Info: [sql] expand: %{Acct-Input-Octets} -> 10173084 6 Thu Mar 27 21:35:53 2014 : Info: [sql] expand: %{Acct-Output-Gigawords} -> 0 Thu Mar 27 21:35:53 2014 : Info: [sql] expand: %{Acct-Output-Octets} -> 4385914 Thu Mar 27 21:35:53 2014 : Info: [sql] expand: UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acct sessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{ %{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Ac ct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigaw ords}:-0}' << 32 | '%{%{Acct-Output-Octets}:- 0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET framedipaddress = '10.1. 0.7', acctsessiontime = '12303', acctinputoctets = '0' << 32 | '101730846', a cctoutputoctets = '0' << 32 | '4385914' WHERE acctsessionid = '53344d3a00000002' AND username = 'test' Thu Mar 27 21:35:53 2014 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Thu Mar 27 21:35:53 2014 : Debug: rlm_sql (sql): Released sql socket id: 4 Thu Mar 27 21:35:53 2014 : Info: ++[sql] returns ok Thu Mar 27 21:35:53 2014 : Info: ++[exec] returns noop Thu Mar 27 21:35:53 2014 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> test Thu Mar 27 21:35:53 2014 : Debug: attr_filter: Matched entry DEFAULT at line 12 Thu Mar 27 21:35:53 2014 : Info: ++[attr_filter.accounting_response] returns upd ated Sending Accounting-Response of id 59 to 127.0.0.1 port 39179 Thu Mar 27 21:35:53 2014 : Info: Finished request 0. Thu Mar 27 21:35:53 2014 : Info: Cleaning up request 0 ID 59 with timestamp +142 Thu Mar 27 21:35:53 2014 : Debug: Going to the next request Thu Mar 27 21:35:53 2014 : Info: Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 39179, id=60, lengt h=263 ChilliSpot-Version = "1.3.0" ChilliSpot-Attr-10 = 0x00000002 Event-Timestamp = "Mar 27 2014 21:37:24 CAT" User-Name = "test" Acct-Input-Octets = 101746420 Acct-Output-Octets = 4396684 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 86620 Acct-Output-Packets = 59154 Acct-Session-Time = 12395 Acct-Terminate-Cause = User-Request Acct-Status-Type = Stop Acct-Session-Id = "53344d3a00000002" Framed-IP-Address = 10.1.0.7 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "D8-EB-97-22-A0-8C" Called-Station-Id = "00-0A-CD-1F-F6-43" NAS-IP-Address = 10.1.0.1 NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" Thu Mar 27 21:37:25 2014 : Info: # Executing section preacct from file /etc/free radius/sites-enabled/default Thu Mar 27 21:37:25 2014 : Info: +- entering group preacct {...} Thu Mar 27 21:37:25 2014 : Info: ++[preprocess] returns ok Thu Mar 27 21:37:25 2014 : Info: [acct_unique] Hashing 'NAS-Port = 2,Client-IP-A ddress = 127.0.0.1,NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "53344d3a00000002 ",User-Name = "test"' Thu Mar 27 21:37:25 2014 : Info: [acct_unique] Acct-Unique-Session-ID = "7874c3e 20d038361". Thu Mar 27 21:37:25 2014 : Info: ++[acct_unique] returns ok Thu Mar 27 21:37:25 2014 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Thu Mar 27 21:37:25 2014 : Info: [suffix] No such realm "NULL" Thu Mar 27 21:37:25 2014 : Info: ++[suffix] returns noop Thu Mar 27 21:37:25 2014 : Info: ++[files] returns noop Thu Mar 27 21:37:25 2014 : Info: # Executing section accounting from file /etc/f reeradius/sites-enabled/default Thu Mar 27 21:37:25 2014 : Info: +- entering group accounting {...} Thu Mar 27 21:37:25 2014 : Info: [detail] expand: /var/log/freeradius/rada cct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/ detail-20140327 Thu Mar 27 21:37:25 2014 : Info: [detail] /var/log/freeradius/radacct/%{Client-I P-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail -20140327 Thu Mar 27 21:37:25 2014 : Info: [detail] expand: %t -> Thu Mar 27 21:37:2 5 2014 Thu Mar 27 21:37:25 2014 : Info: ++[detail] returns ok Thu Mar 27 21:37:25 2014 : Info: ++[unix] returns ok Thu Mar 27 21:37:25 2014 : Info: [radutmp] expand: /var/log/freeradius/radu tmp -> /var/log/freeradius/radutmp Thu Mar 27 21:37:25 2014 : Info: [radutmp] expand: %{User-Name} -> test Thu Mar 27 21:37:25 2014 : Info: ++[radutmp] returns ok Thu Mar 27 21:37:25 2014 : Info: [sql] expand: %{User-Name} -> test Thu Mar 27 21:37:25 2014 : Info: [sql] sql_set_user escaped user --> 'test' Thu Mar 27 21:37:25 2014 : Info: [sql] expand: %{Acct-Input-Gigawords} -> 0 Thu Mar 27 21:37:25 2014 : Info: [sql] expand: %{Acct-Input-Octets} -> 10174642 0 Thu Mar 27 21:37:25 2014 : Info: [sql] expand: %{Acct-Output-Gigawords} -> 0 Thu Mar 27 21:37:25 2014 : Info: [sql] expand: %{Acct-Output-Octets} -> 4396684 Thu Mar 27 21:37:25 2014 : Info: [sql] expand: %{Acct-Delay-Time} -> Thu Mar 27 21:37:25 2014 : Info: [sql] ... expanding second conditional Thu Mar 27 21:37:25 2014 : Info: [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct- Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0} ' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminate cause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-D elay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' W HERE acctsessionid = '%{Acct-Session-Id}' AND username = '% {SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2014-03-27 21:37:25', acctsessiontime = '12395', acctinputoctets = '0 ' << 32 | '101746420', acctoutput octets = '0' < Thu Mar 27 21:37:25 2014 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Thu Mar 27 21:37:25 2014 : Debug: rlm_sql (sql): Released sql socket id: 3 Thu Mar 27 21:37:25 2014 : Info: ++[sql] returns ok Thu Mar 27 21:37:25 2014 : Info: ++[exec] returns noop Thu Mar 27 21:37:25 2014 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> test Thu Mar 27 21:37:25 2014 : Debug: attr_filter: Matched entry DEFAULT at line 12 Thu Mar 27 21:37:25 2014 : Info: ++[attr_filter.accounting_response] returns upd ated Sending Accounting-Response of id 60 to 127.0.0.1 port 39179 Thu Mar 27 21:37:25 2014 : Info: Finished request 1. Thu Mar 27 21:37:25 2014 : Info: Cleaning up request 1 ID 60 with timestamp +234 Thu Mar 27 21:37:25 2014 : Debug: Going to the next request Thu Mar 27 21:37:25 2014 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 46418, id=62, length=28 7 ChilliSpot-Version = "1.3.0" User-Name = "test" CHAP-Challenge = 0x1fd6adcd32331a15a5bc4df75319b0ca CHAP-Password = 0x00f2f275270c89c401db48362eb9d9ea77 Service-Type = Login-User Acct-Session-Id = "53347df500000002" Framed-IP-Address = 10.1.0.7 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "D8-EB-97-22-A0-8C" Called-Station-Id = "00-0A-CD-1F-F6-43" NAS-IP-Address = 10.1.0.1 NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" WISPr-Logoff-URL = "http://10.1.0.1:3990/logoff" Message-Authenticator = 0x674721e8457ec33833cc33fe1529be79 Thu Mar 27 21:37:42 2014 : Info: # Executing section authorize from file /etc/fr eeradius/sites-enabled/default Thu Mar 27 21:37:42 2014 : Info: +- entering group authorize {...} Thu Mar 27 21:37:42 2014 : Info: ++[preprocess] returns ok Thu Mar 27 21:37:42 2014 : Info: [chap] Setting 'Auth-Type := CHAP' Thu Mar 27 21:37:42 2014 : Info: ++[chap] returns ok Thu Mar 27 21:37:42 2014 : Info: ++[mschap] returns noop Thu Mar 27 21:37:42 2014 : Info: ++[digest] returns noop Thu Mar 27 21:37:42 2014 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Thu Mar 27 21:37:42 2014 : Info: [suffix] No such realm "NULL" Thu Mar 27 21:37:42 2014 : Info: ++[suffix] returns noop Thu Mar 27 21:37:42 2014 : Info: [eap] No EAP-Message, not doing EAP Thu Mar 27 21:37:42 2014 : Info: ++[eap] returns noop Thu Mar 27 21:37:42 2014 : Info: [sql] expand: %{User-Name} -> test Thu Mar 27 21:37:42 2014 : Info: [sql] sql_set_user escaped user --> 'test' Thu Mar 27 21:37:42 2014 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Thu Mar 27 21:37:42 2014 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radcheck WHERE username = 'test' ORDER BY id Thu Mar 27 21:37:42 2014 : Info: [sql] User found in radcheck table Thu Mar 27 21:37:42 2014 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radreply WHERE username = 'test' ORDER BY id Thu Mar 27 21:37:42 2014 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY pr iority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority Thu Mar 27 21:37:42 2014 : Debug: rlm_sql (sql): Released sql socket id: 2 Thu Mar 27 21:37:42 2014 : Info: ++[sql] returns ok Thu Mar 27 21:37:42 2014 : Debug: rlm_sqlcounter: Entering module authorize code Thu Mar 27 21:37:42 2014 : Debug: rlm_sqlcounter: Could not find Check item valu e pair Thu Mar 27 21:37:42 2014 : Info: ++[chillispot_max_bytes] returns noop Thu Mar 27 21:37:42 2014 : Debug: rlm_sqlcounter: Entering module authorize code Thu Mar 27 21:37:42 2014 : Debug: rlm_sqlcounter: Could not find Check item valu e pair Thu Mar 27 21:37:42 2014 : Info: ++[noresetcounter] returns noop Thu Mar 27 21:37:42 2014 : Info: ++[expiration] returns noop Thu Mar 27 21:37:42 2014 : Info: ++[logintime] returns noop Thu Mar 27 21:37:42 2014 : Info: [pap] WARNING: Auth-Type already set. Not sett ing to PAP Thu Mar 27 21:37:42 2014 : Info: ++[pap] returns noop Thu Mar 27 21:37:42 2014 : Info: Found Auth-Type = CHAP Thu Mar 27 21:37:42 2014 : Info: # Executing group from file /etc/freeradius/sit es-enabled/default Thu Mar 27 21:37:42 2014 : Info: +- entering group CHAP {...} Thu Mar 27 21:37:42 2014 : Info: [chap] login attempt by "test" with CHAP passwo rd Thu Mar 27 21:37:42 2014 : Info: [chap] Using clear text password "test" for use r test authentication. Thu Mar 27 21:37:42 2014 : Info: [chap] chap user test authenticated succesfully Thu Mar 27 21:37:42 2014 : Info: ++[chap] returns ok Thu Mar 27 21:37:42 2014 : Info: # Executing section post-auth from file /etc/fr eeradius/sites-enabled/default Thu Mar 27 21:37:42 2014 : Info: +- entering group post-auth {...} Thu Mar 27 21:37:42 2014 : Info: ++[exec] returns noop Sending Access-Accept of id 62 to 127.0.0.1 port 46418 Thu Mar 27 21:37:42 2014 : Info: Finished request 2. Thu Mar 27 21:37:42 2014 : Debug: Going to the next request Thu Mar 27 21:37:42 2014 : Debug: Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 39179, id=61, lengt h=215 ChilliSpot-Version = "1.3.0" ChilliSpot-Attr-10 = 0x00000002 Event-Timestamp = "Mar 27 2014 21:37:40 CAT" User-Name = "test" Acct-Status-Type = Start Acct-Session-Id = "53347df500000002" Framed-IP-Address = 10.1.0.7 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "D8-EB-97-22-A0-8C" Called-Station-Id = "00-0A-CD-1F-F6-43" NAS-IP-Address = 10.1.0.1 NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" Thu Mar 27 21:37:42 2014 : Info: # Executing section preacct from file /etc/free radius/sites-enabled/default Thu Mar 27 21:37:42 2014 : Info: +- entering group preacct {...} Thu Mar 27 21:37:42 2014 : Info: ++[preprocess] returns ok Thu Mar 27 21:37:42 2014 : Info: [acct_unique] Hashing 'NAS-Port = 2,Client-IP-A ddress = 127.0.0.1,NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "53347df500000002 ",User-Name = "test"' Thu Mar 27 21:37:42 2014 : Info: [acct_unique] Acct-Unique-Session-ID = "c1c7c7a b5ce9171a". Thu Mar 27 21:37:42 2014 : Info: ++[acct_unique] returns ok Thu Mar 27 21:37:42 2014 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Thu Mar 27 21:37:42 2014 : Info: [suffix] No such realm "NULL" Thu Mar 27 21:37:42 2014 : Info: ++[suffix] returns noop Thu Mar 27 21:37:42 2014 : Info: ++[files] returns noop Thu Mar 27 21:37:42 2014 : Info: # Executing section accounting from file /etc/f reeradius/sites-enabled/default Thu Mar 27 21:37:42 2014 : Info: +- entering group accounting {...} Thu Mar 27 21:37:42 2014 : Info: [detail] expand: /var/log/freeradius/rada cct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/ detail-20140327 Thu Mar 27 21:37:42 2014 : Info: [detail] /var/log/freeradius/radacct/%{Client-I P-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail -20140327 Thu Mar 27 21:37:42 2014 : Info: [detail] expand: %t -> Thu Mar 27 21:37:4 2 2014 Thu Mar 27 21:37:42 2014 : Info: ++[detail] returns ok Thu Mar 27 21:37:42 2014 : Info: ++[unix] returns ok Thu Mar 27 21:37:42 2014 : Info: [radutmp] expand: /var/log/freeradius/radu tmp -> /var/log/freeradius/radutmp Thu Mar 27 21:37:42 2014 : Info: [radutmp] expand: %{User-Name} -> test Thu Mar 27 21:37:42 2014 : Info: ++[radutmp] returns ok Thu Mar 27 21:37:42 2014 : Info: [sql] expand: %{User-Name} -> test Thu Mar 27 21:37:42 2014 : Info: [sql] sql_set_user escaped user --> 'test' Thu Mar 27 21:37:42 2014 : Info: [sql] expand: %{Acct-Delay-Time} -> Thu Mar 27 21:37:42 2014 : Info: [sql] ... expanding second conditional Thu Mar 27 21:37:42 2014 : Info: [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstartti me, acctstoptime, acctsessiontime, acctauthentic, connectinf o_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, se rvicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct- Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Por t-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Stati on-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- Address}', Thu Mar 27 21:37:42 2014 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Thu Mar 27 21:37:42 2014 : Debug: rlm_sql (sql): Released sql socket id: 1 Thu Mar 27 21:37:42 2014 : Info: ++[sql] returns ok Thu Mar 27 21:37:42 2014 : Info: ++[exec] returns noop Thu Mar 27 21:37:42 2014 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> test Thu Mar 27 21:37:42 2014 : Debug: attr_filter: Matched entry DEFAULT at line 12 Thu Mar 27 21:37:42 2014 : Info: ++[attr_filter.accounting_response] returns upd ated Sending Accounting-Response of id 61 to 127.0.0.1 port 39179 Thu Mar 27 21:37:42 2014 : Info: Finished request 3. Thu Mar 27 21:37:42 2014 : Info: Cleaning up request 3 ID 61 with timestamp +251 Thu Mar 27 21:37:42 2014 : Debug: Going to the next request Thu Mar 27 21:37:42 2014 : Debug: Waking up in 4.9 seconds. Thu Mar 27 21:37:47 2014 : Info: Cleaning up request 2 ID 62 with timestamp +251 Thu Mar 27 21:37:47 2014 : Info: Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1 port 39179, id=62, lengt h=263 ChilliSpot-Version = "1.3.0" ChilliSpot-Attr-10 = 0x00000002 Event-Timestamp = "Mar 27 2014 21:37:45 CAT" User-Name = "test" Acct-Input-Octets = 4994 Acct-Output-Octets = 19869 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 31 Acct-Output-Packets = 36 Acct-Session-Time = 5 Acct-Terminate-Cause = User-Request Acct-Status-Type = Stop Acct-Session-Id = "53347df500000002" Framed-IP-Address = 10.1.0.7 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "D8-EB-97-22-A0-8C" Called-Station-Id = "00-0A-CD-1F-F6-43" NAS-IP-Address = 10.1.0.1 NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" Thu Mar 27 21:37:47 2014 : Info: # Executing section preacct from file /etc/free radius/sites-enabled/default Thu Mar 27 21:37:47 2014 : Info: +- entering group preacct {...} Thu Mar 27 21:37:47 2014 : Info: ++[preprocess] returns ok Thu Mar 27 21:37:47 2014 : Info: [acct_unique] Hashing 'NAS-Port = 2,Client-IP-A ddress = 127.0.0.1,NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "53347df500000002 ",User-Name = "test"' Thu Mar 27 21:37:47 2014 : Info: [acct_unique] Acct-Unique-Session-ID = "c1c7c7a b5ce9171a". Thu Mar 27 21:37:47 2014 : Info: ++[acct_unique] returns ok Thu Mar 27 21:37:47 2014 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Thu Mar 27 21:37:47 2014 : Info: [suffix] No such realm "NULL" Thu Mar 27 21:37:47 2014 : Info: ++[suffix] returns noop Thu Mar 27 21:37:47 2014 : Info: ++[files] returns noop Thu Mar 27 21:37:47 2014 : Info: # Executing section accounting from file /etc/f reeradius/sites-enabled/default Thu Mar 27 21:37:47 2014 : Info: +- entering group accounting {...} Thu Mar 27 21:37:47 2014 : Info: [detail] expand: /var/log/freeradius/rada cct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/ detail-20140327 Thu Mar 27 21:37:47 2014 : Info: [detail] /var/log/freeradius/radacct/%{Client-I P-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail -20140327 Thu Mar 27 21:37:47 2014 : Info: [detail] expand: %t -> Thu Mar 27 21:37:4 7 2014 Thu Mar 27 21:37:47 2014 : Info: ++[detail] returns ok Thu Mar 27 21:37:47 2014 : Info: ++[unix] returns ok Thu Mar 27 21:37:47 2014 : Info: [radutmp] expand: /var/log/freeradius/radu tmp -> /var/log/freeradius/radutmp Thu Mar 27 21:37:47 2014 : Info: [radutmp] expand: %{User-Name} -> test Thu Mar 27 21:37:47 2014 : Info: ++[radutmp] returns ok Thu Mar 27 21:37:47 2014 : Info: [sql] expand: %{User-Name} -> test Thu Mar 27 21:37:47 2014 : Info: [sql] sql_set_user escaped user --> 'test' Thu Mar 27 21:37:47 2014 : Info: [sql] expand: %{Acct-Input-Gigawords} -> 0 Thu Mar 27 21:37:47 2014 : Info: [sql] expand: %{Acct-Input-Octets} -> 4994 Thu Mar 27 21:37:47 2014 : Info: [sql] expand: %{Acct-Output-Gigawords} -> 0 Thu Mar 27 21:37:47 2014 : Info: [sql] expand: %{Acct-Output-Octets} -> 19869 Thu Mar 27 21:37:47 2014 : Info: [sql] expand: %{Acct-Delay-Time} -> Thu Mar 27 21:37:47 2014 : Info: [sql] ... expanding second conditional Thu Mar 27 21:37:47 2014 : Info: [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct- Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0} ' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminate cause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-D elay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' W HERE acctsessionid = '%{Acct-Session-Id}' AND username = '% {SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2014-03-27 21:37:47', acctsessiontime = '5', acctinputoctets = '0' << 32 | '4994', acctoutputoctets = '0' << 32 | Thu Mar 27 21:37:47 2014 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Thu Mar 27 21:37:47 2014 : Debug: rlm_sql (sql): Released sql socket id: 0 Thu Mar 27 21:37:47 2014 : Info: ++[sql] returns ok Thu Mar 27 21:37:47 2014 : Info: ++[exec] returns noop Thu Mar 27 21:37:47 2014 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> test Thu Mar 27 21:37:47 2014 : Debug: attr_filter: Matched entry DEFAULT at line 12 Thu Mar 27 21:37:47 2014 : Info: ++[attr_filter.accounting_response] returns upd ated Sending Accounting-Response of id 62 to 127.0.0.1 port 39179 Thu Mar 27 21:37:47 2014 : Info: Finished request 4. Thu Mar 27 21:37:47 2014 : Info: Cleaning up request 4 ID 62 with timestamp +256 Thu Mar 27 21:37:47 2014 : Debug: Going to the next request Thu Mar 27 21:37:47 2014 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 43771, id=89, length=28 7 ChilliSpot-Version = "1.3.0" User-Name = "test" CHAP-Challenge = 0x1fd6adcd32331a15a5bc4df75319b0ca CHAP-Password = 0x00f2f275270c89c401db48362eb9d9ea77 Service-Type = Login-User Acct-Session-Id = "53347e0b00000002" Framed-IP-Address = 10.1.0.7 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "D8-EB-97-22-A0-8C" Called-Station-Id = "00-0A-CD-1F-F6-43" NAS-IP-Address = 10.1.0.1 NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" WISPr-Logoff-URL = "http://10.1.0.1:3990/logoff" Message-Authenticator = 0x8e0995898c93e6afe0dab83ef79781c8 Thu Mar 27 21:38:07 2014 : Info: # Executing section authorize from file /etc/fr eeradius/sites-enabled/default Thu Mar 27 21:38:07 2014 : Info: +- entering group authorize {...} Thu Mar 27 21:38:07 2014 : Info: ++[preprocess] returns ok Thu Mar 27 21:38:07 2014 : Info: [chap] Setting 'Auth-Type := CHAP' Thu Mar 27 21:38:07 2014 : Info: ++[chap] returns ok Thu Mar 27 21:38:07 2014 : Info: ++[mschap] returns noop Thu Mar 27 21:38:07 2014 : Info: ++[digest] returns noop Thu Mar 27 21:38:07 2014 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Thu Mar 27 21:38:07 2014 : Info: [suffix] No such realm "NULL" Thu Mar 27 21:38:07 2014 : Info: ++[suffix] returns noop Thu Mar 27 21:38:07 2014 : Info: [eap] No EAP-Message, not doing EAP Thu Mar 27 21:38:07 2014 : Info: ++[eap] returns noop Thu Mar 27 21:38:07 2014 : Info: [sql] expand: %{User-Name} -> test Thu Mar 27 21:38:07 2014 : Info: [sql] sql_set_user escaped user --> 'test' Thu Mar 27 21:38:07 2014 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Thu Mar 27 21:38:07 2014 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radcheck WHERE username = 'test' ORDER BY id Thu Mar 27 21:38:07 2014 : Info: [sql] User found in radcheck table Thu Mar 27 21:38:07 2014 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FRO M radreply WHERE username = 'test' ORDER BY id Thu Mar 27 21:38:07 2014 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY pr iority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority Thu Mar 27 21:38:07 2014 : Debug: rlm_sql (sql): Released sql socket id: 4 Thu Mar 27 21:38:07 2014 : Info: ++[sql] returns ok Thu Mar 27 21:38:07 2014 : Debug: rlm_sqlcounter: Entering module authorize code Thu Mar 27 21:38:07 2014 : Debug: rlm_sqlcounter: Could not find Check item valu e pair Thu Mar 27 21:38:07 2014 : Info: ++[chillispot_max_bytes] returns noop Thu Mar 27 21:38:07 2014 : Debug: rlm_sqlcounter: Entering module authorize code Thu Mar 27 21:38:07 2014 : Debug: rlm_sqlcounter: Could not find Check item valu e pair Thu Mar 27 21:38:07 2014 : Info: ++[noresetcounter] returns noop Thu Mar 27 21:38:07 2014 : Info: ++[expiration] returns noop Thu Mar 27 21:38:07 2014 : Info: ++[logintime] returns noop Thu Mar 27 21:38:07 2014 : Info: [pap] WARNING: Auth-Type already set. Not sett ing to PAP Thu Mar 27 21:38:07 2014 : Info: ++[pap] returns noop Thu Mar 27 21:38:07 2014 : Info: Found Auth-Type = CHAP Thu Mar 27 21:38:07 2014 : Info: # Executing group from file /etc/freeradius/sit es-enabled/default Thu Mar 27 21:38:07 2014 : Info: +- entering group CHAP {...} Thu Mar 27 21:38:07 2014 : Info: [chap] login attempt by "test" with CHAP passwo rd Thu Mar 27 21:38:07 2014 : Info: [chap] Using clear text password "test" for use r test authentication. Thu Mar 27 21:38:07 2014 : Info: [chap] chap user test authenticated succesfully Thu Mar 27 21:38:07 2014 : Info: ++[chap] returns ok Thu Mar 27 21:38:07 2014 : Info: # Executing section post-auth from file /etc/fr eeradius/sites-enabled/default Thu Mar 27 21:38:07 2014 : Info: +- entering group post-auth {...} Thu Mar 27 21:38:07 2014 : Info: ++[exec] returns noop Sending Access-Accept of id 89 to 127.0.0.1 port 43771 Thu Mar 27 21:38:07 2014 : Info: Finished request 5. Thu Mar 27 21:38:07 2014 : Debug: Going to the next request Thu Mar 27 21:38:07 2014 : Debug: Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 39179, id=63, lengt h=215 ChilliSpot-Version = "1.3.0" ChilliSpot-Attr-10 = 0x00000002 Event-Timestamp = "Mar 27 2014 21:38:06 CAT" User-Name = "test" Acct-Status-Type = Start Acct-Session-Id = "53347e0b00000002" Framed-IP-Address = 10.1.0.7 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "D8-EB-97-22-A0-8C" Called-Station-Id = "00-0A-CD-1F-F6-43" NAS-IP-Address = 10.1.0.1 NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" Thu Mar 27 21:38:07 2014 : Info: # Executing section preacct from file /etc/free radius/sites-enabled/default Thu Mar 27 21:38:07 2014 : Info: +- entering group preacct {...} Thu Mar 27 21:38:07 2014 : Info: ++[preprocess] returns ok Thu Mar 27 21:38:07 2014 : Info: [acct_unique] Hashing 'NAS-Port = 2,Client-IP-A ddress = 127.0.0.1,NAS-IP-Address = 10.1.0.1,Acct-Session-Id = "53347e0b00000002 ",User-Name = "test"' Thu Mar 27 21:38:07 2014 : Info: [acct_unique] Acct-Unique-Session-ID = "1f7c3e3 75e42563b". Thu Mar 27 21:38:07 2014 : Info: ++[acct_unique] returns ok Thu Mar 27 21:38:07 2014 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Thu Mar 27 21:38:07 2014 : Info: [suffix] No such realm "NULL" Thu Mar 27 21:38:07 2014 : Info: ++[suffix] returns noop Thu Mar 27 21:38:07 2014 : Info: ++[files] returns noop Thu Mar 27 21:38:07 2014 : Info: # Executing section accounting from file /etc/f reeradius/sites-enabled/default Thu Mar 27 21:38:07 2014 : Info: +- entering group accounting {...} Thu Mar 27 21:38:07 2014 : Info: [detail] expand: /var/log/freeradius/rada cct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/ detail-20140327 Thu Mar 27 21:38:07 2014 : Info: [detail] /var/log/freeradius/radacct/%{Client-I P-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/detail -20140327 Thu Mar 27 21:38:07 2014 : Info: [detail] expand: %t -> Thu Mar 27 21:38:0 7 2014 Thu Mar 27 21:38:07 2014 : Info: ++[detail] returns ok Thu Mar 27 21:38:07 2014 : Info: ++[unix] returns ok Thu Mar 27 21:38:07 2014 : Info: [radutmp] expand: /var/log/freeradius/radu tmp -> /var/log/freeradius/radutmp Thu Mar 27 21:38:07 2014 : Info: [radutmp] expand: %{User-Name} -> test Thu Mar 27 21:38:07 2014 : Info: ++[radutmp] returns ok Thu Mar 27 21:38:07 2014 : Info: [sql] expand: %{User-Name} -> test Thu Mar 27 21:38:07 2014 : Info: [sql] sql_set_user escaped user --> 'test' Thu Mar 27 21:38:07 2014 : Info: [sql] expand: %{Acct-Delay-Time} -> Thu Mar 27 21:38:07 2014 : Info: [sql] ... expanding second conditional Thu Mar 27 21:38:07 2014 : Info: [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstartti me, acctstoptime, acctsessiontime, acctauthentic, connectinf o_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, se rvicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct- Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Por t-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Stati on-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- Address}', Thu Mar 27 21:38:07 2014 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Thu Mar 27 21:38:07 2014 : Debug: rlm_sql (sql): Released sql socket id: 3 Thu Mar 27 21:38:07 2014 : Info: ++[sql] returns ok Thu Mar 27 21:38:07 2014 : Info: ++[exec] returns noop Thu Mar 27 21:38:07 2014 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> test Thu Mar 27 21:38:07 2014 : Debug: attr_filter: Matched entry DEFAULT at line 12 Thu Mar 27 21:38:07 2014 : Info: ++[attr_filter.accounting_response] returns upd ated Sending Accounting-Response of id 63 to 127.0.0.1 port 39179 Thu Mar 27 21:38:07 2014 : Info: Finished request 6. Thu Mar 27 21:38:07 2014 : Info: Cleaning up request 6 ID 63 with timestamp +276 Thu Mar 27 21:38:07 2014 : Debug: Going to the next request Thu Mar 27 21:38:07 2014 : Debug: Waking up in 4.9 seconds. Thu Mar 27 21:38:12 2014 : Info: Cleaning up request 5 ID 89 with timestamp +276 Thu Mar 27 21:38:12 2014 : Info: Ready to process requests.

3 2

Re: CPU intensize authorization module issue
by Stefan Winter 27 Mar '14

27 Mar '14

Hi, this is a usage question, redirecting to -users. You should call your module only in innner-tunnel/authorize, not in the outer request (default/authorize). Greetings, Stefan Winter On 27.03.2014 13:53, Yannick Koehler wrote: > Hi, > > I have an authorization module to write for FreeRADIUS that does a > fair amount of CPU intensive SQL queries 1-2 seconds time. But the > problem is that when a 802.1x authentication is occuring this event > occurs many times 4-5 times at each reception of RADIUS Access Request. > Also, at that time the username is not the final one (normally the final > one is sent within the MSCHAPv2 from within the TLS tunnel used by PEAP > or EAP-TLS or EAP-TTLS). > > Is there a way for my authorization module to trigger the work to be > done only if EAP is at the stage of handling the internal > authentication? Can for example my module communicate with the EAP > module and look at an internal flag somewhere to know if the TLS tunnel > has been completed? > > I would like the following: > > Access Request (EAP identity response) -> authorization module - no > CPU intensive > <-- Access Challenge (EAP TLS Server Hello) > > Access Request (EAP TLS Client Hello) -> authorization module - no > CPU intensive > <-- Access Challenge > > etc. until TLS is established > > Access Request (EAP TLS MSCHAPv2) -> authorization module - CPU > intensive query > <-- Access Accept > > -- > Yannick Koehler > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html > -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 7