- Freeradius-Users - lists.freeradius.org

Re: Freeradius/LDAP/MySQL/Huntgroup - 2 Profiles for same equipment
by Alan DeKok 02 Dec '13

02 Dec '13

Francislaine Moreno wrote: > I'm trying to find some way to differentiate the same IP / switch in 2 > different huntgroups. Don't use huntgroups. They're not meant to do multiple group membership. You can put the group membership as a property in an SQL database. Then, write a query to get it. Alan DeKok.

1 0

FreeRadius, 802.1x authentication via PEAP-MsChapv2
by Esma 02 Dec '13

02 Dec '13

Hello, We are using Freeradius server via 802.1x authentication with PEAP-MsChapv2. We want to use our own server certificate and we have three certificate files server.key, server.pem and server.crt. We kindly ask you how to configurate the radius server in order to use following certificate files in 802.1x authentication. Server.crt Bag Attributes localKeyID: ... friendlyName: ... subject... issuer=... -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- Server.key -----BEGIN RSA PRIVATE KEY----- ... -----END RSA PRIVATE KEY----- Server.pem Bag Attributes ... localKeyID: ... friendlyName: ... Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider Key Attributes ... -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: ... ... -----END RSA PRIVATE KEY----- Regards,

2 1

Freeradius/LDAP/MySQL/Huntgroup - 2 Profiles for same equipment
by Francislaine Moreno 02 Dec '13

02 Dec '13

I'm using google translator, I apologize. I'm using Freeradius with a database in MySQL and groups in OpenLDAP. Huntgroup'm using to create profiles of equipment. And the NAS table to record the switches. My problem is that when authenticating switches the Ciscos, the ENABLE profile, access works perfectly, but in the EXEC profile, no. The conflict is that signed up as the IP switch, ENABLE the first group, even if that user is logging in, belongs only to the EXEC group, FreeRadius to do the research, get the information that the switch belongs to ENABLE. I'm trying to find some way to differentiate the same IP / switch in 2 different huntgroups. Thank you for your help. Francislaine Aquino

1 0

copy-acct to home server from specific NAS
by Johansson, Daniel 02 Dec '13

02 Dec '13

Hi Freeradius-users We have configured copy-acct-to-home-serverA and copy-acct-to-home-serverB in our radius Configured two realms, two home_servers and have two detail files. This works fine it copies the accounting hitting FR to the two home_servers. However we have 20NAS servers sending accounting to the FR and we only want to copy-acct from two of the NAS servers How can we configure FR to only copy acct to home servers when it comes from NAS1 and NAS2? We can identify the NASes by Called-Station-Id == nas1 We have tried using check-items like below, but it doesn't work as we expected, nothing is sent to the home server. server copy-acct-to-home-serverA { listen { type = detail update control { Called-Station-Id == nas1, Proxy-To-Realm := realmA } I guess we are doing something wrong with check items and attributes? Server: Freeradius version 2.2.0 Ubuntu 12.04 BR /Daniel

4 3

Fwd: Setting up Radius proxy - Urgent request
by khali singh 02 Dec '13

02 Dec '13

Hi I wish to use a freeradius server which proxies all requests for users from test.com to another radius server. I read up a lot and configured the proxy.conf to have new realm as follows: realm test.com { type = radius authhost = 193.234.219.146:8180 secret = my_secret_with_other_radius_server nostrip } However, when I get a request from a user from that domain, I see the following output: Mon Dec 1 08:22:50 2013 : Info: [suffix] Looking up realm "test.com" for User-Name = "testuser(a)test.com" Mon Dec 1 08:22:50 2013 : Info: [suffix] No such realm "test.com" Mon Dec 1 08:22:50 2013 : Info: ++[suffix] returns noop Can someone help me with this. I would be really very grateful. I think I am missing some configuration but I am new to freeradius. Thanks to all!

4 5

Freeradius as DHCP server with option 82
by brijesh shingadiya 02 Dec '13

02 Dec '13

Hi All, I am a newbie trying to configure freeradius as DHCP server to authenticated DHCP requests with option 82 and assign IP addresses. I am not sure how to parse the DHCP option 82 from request validate that value and then return the DHCP offer if the option 82 has valid value. I couldnt find any documentation on that. Any help from you guys or any documentation for that will be really helpful. Regards, Brijesh

2 1

freeradius accounting disable
by scolamariano＠tiscali.it 01 Dec '13

01 Dec '13

hello, it is possible to disable accounting functionality only for a specific user? thank you Invita i tuoi amici e Tiscali ti premia! Il consiglio di un amico vale più di uno spot in TV. Per ogni nuovo abbonato 30 € di premio per te e per lui! Un amico al mese e parli e navighi sempre gratis http://freelosophy.tiscali.it/ [1] Links: ------ [1] http://freelosophy.tiscali.it/ Invita i tuoi amici e Tiscali ti premia! Il consiglio di un amico vale più di uno spot in TV. Per ogni nuovo abbonato 30 € di premio per te e per lui! Un amico al mese e parli e navighi sempre gratis http://freelosophy.tiscali.it/

2 1

Reply with Access-Reject from exec
by Adnan Miljkovic 01 Dec '13

01 Dec '13

Hello, I am using exec to check users again an external script. Up until now I am able to successfully authenticating the user and send back several attributes that are used by the NAS. So when user data are OK, everything is fine. My problem is how to deny access to the user, how to send "Access-Reject"? What should I send back in my exec program. Possible my setup is wrong? my current setup: authorize { ..... update control { Auth-Type := CheckUser } ..... } authenticate { .... Auth-Type CheckUser { checkuser } ..... } The output "Access-Accept" is always send back to NAS: ================================================== ++[sql] = notfound ++update control { ++} # update control = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok Found Auth-Type = CheckUser # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group CheckUser { [checkuser] expand: %{User-Name} -> student.name [checkuser] expand: %{User-Password} -> password Exec output: fail = 1 Exec plaintext: fail = 1 [checkuser] Exec: program returned: 0 ++[checkuser] = ok +} # group CheckUser = ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 117 to 127.0.0.1 port 57009 ================================================== I am using version 2.2.2. All help is much appreciated.

2 1

Freeradius DHCP problem
by Csőke János 01 Dec '13

01 Dec '13

Hi Everybody! I would like to use Freeradius as a DHCP server, but it's not working. I'm seen this in debug mode: ======================================================================= Received DHCP-Discover of id c38d6dab from 0.0.0.0:68 to 255.255.255.255:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 3280825771 DHCP-Number-of-Seconds = 7424 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 14:da:e9:bf:1c:da DHCP-Message-Type += DHCP-Discover DHCP-Client-Identifier += 14:da:e9:bf:1c:da DHCP-Hostname += "csovike10pc" DHCP-Vendor-Class-Identifier += "MSFT 5.0" DHCP-Parameter-Request-List += DHCP-Subnet-Mask DHCP-Parameter-Request-List += DHCP-Domain-Name DHCP-Parameter-Request-List += DHCP-Router-Address DHCP-Parameter-Request-List += DHCP-Domain-Name-Server DHCP-Parameter-Request-List += DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List += DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List += DHCP-NETBIOS DHCP-Parameter-Request-List += DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List += DHCP-Static-Routes DHCP-Parameter-Request-List += DHCP-Classless-Static-Route DHCP-Parameter-Request-List += 249 DHCP-Parameter-Request-List += DHCP-Vendor server dhcp { Trying sub-section dhcp DHCP-Discover {...} +group DHCP-Discover { ++update reply { ++} # update reply = noop ++update reply { sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask' -> SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask' rlm_sql (sql): Reserving sql socket id: 9 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 9 expand: %{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask'} -> 255.255.255.0 sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address' -> SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address' rlm_sql (sql): Reserving sql socket id: 8 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 8 expand: %{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address'} -> 152.66.235.254 sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name' -> SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name' rlm_sql (sql): Reserving sql socket id: 7 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 7 expand: %{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name'} -> teteny.bme.hu sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) -> SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) rlm_sql (sql): Reserving sql socket id: 6 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 6 expand: %{sql:SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)} -> csovike10pc sql_xlat expand: %{User-Name} -> sql_set_user escaped user --> '' expand: SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) -> SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '14:da:e9:bf:1c:da' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) rlm_sql (sql): Reserving sql socket id: 5 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 sql_xlat finished rlm_sql (sql): Released sql socket id: 5 expand: %{sql:SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)} -> 152.66.235.32 ++} # update reply = noop ++[ok] = ok +} # group DHCP-Discover = ok DHCP: Reply will be broadcast } # server dhcp Encoding DHCP-Offer of id c38d6dab from 10.42.128.0:67 to 255.255.255.255:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 3280825771 DHCP-Number-of-Seconds = 0 DHCP-Flags = Broadcast DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 152.66.235.32 DHCP-Server-IP-Address = 10.42.128.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 14:da:e9:bf:1c:da DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 152.66.235.254 DHCP-Domain-Name-Server = 10.42.128.0 DHCP-Domain-Name-Server = 10.42.128.2 DHCP-Hostname = "csovike10pc" DHCP-Domain-Name = "teteny.bme.hu" DHCP-Interface-MTU-Size = 1400 DHCP-NTP-Servers = 10.42.128.0 DHCP-NETBIOS-Name-Servers = 10.42.128.15 DHCP-IP-Address-Lease-Time = 14400 DHCP-DHCP-Server-Identifier = 10.42.128.0 DHCP-Renewal-Time = 7200 DHCP-Rebinding-Time = 12600 Sending DHCP-Offer of id c38d6dab from 10.42.128.0:67 to 255.255.255.255:68 Finished request 2. Cleaning up request 2 ID -1014141525 with timestamp +35 Going to the next request Ready to process requests. ======================================================================= It's great, because all sql query run succesful, found my client's IP address and sent correct DHCP-Offer message. But the DHCP request failed in my Windows 7 client. My dhcp configuration file: ======================================================================= server dhcp { listen { broadcast = yes ipaddr = 255.255.255.255 port = 67 interface = eth0.42 type = dhcp } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = 10.42.128.0 DHCP-Domain-Name-Server = 10.42.128.2 DHCP-Subnet-Mask = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask'}" DHCP-Router-Address = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address'}" DHCP-Domain-Name = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name'}" DHCP-IP-Address-Lease-Time = 14400 DHCP-Renewal-Time = 7200 DHCP-Rebinding-Time = 12600 DHCP-Hardware-Type = Ethernet DHCP-DHCP-Server-Identifier = 10.42.128.0 DHCP-Interface-MTU-Size = 1400 DHCP-NETBIOS-Name-Servers = 10.42.128.15 DHCP-NTP-Servers = 10.42.128.0 DHCP-Hostname = "%{sql:SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)}" DHCP-Your-IP-Address = "%{sql:SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)}" } ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 10.42.128.0 DHCP-Domain-Name-Server = 10.42.128.2 DHCP-Subnet-Mask = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Subnet-Mask'}" DHCP-Router-Address = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Router-Address'}" DHCP-Domain-Name = "%{sql:SELECT value FROM ttny.dhcp_zones,(SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL) AND ttny.dhcp_zones.zone_name = ttny.ip.type AND ttny.dhcp_zones.attribute = 'Domain-Name'}" DHCP-IP-Address-Lease-Time = 14400 DHCP-Renewal-Time = 7200 DHCP-Rebinding-Time = 12600 DHCP-Hardware-Type = Ethernet DHCP-DHCP-Server-Identifier = 10.42.128.0 DHCP-Interface-MTU-Size = 1400 DHCP-NETBIOS-Name-Servers = 10.42.128.15 DHCP-NTP-Servers = 10.42.128.0 DHCP-Hostname = "%{sql:SELECT host FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)}" DHCP-Your-IP-Address = "%{sql:SELECT ip FROM (SELECT * FROM computer_wired UNION SELECT * FROM computer_wireless) c JOIN ttny.ip ON c.ip_id = ttny.ip.id JOIN ttny.user ON c.user_id = ttny.user.id WHERE c.mac = '%{DHCP-Client-Hardware-Address}' AND c.reg_expire>= now() AND (ttny.user.ban_expire < now() OR ttny.user.ban_expire IS NULL)}" } ok } # If there's no named section for the packet type, then the packet # is processed through this section. dhcp { # send a DHCP NAK. reject } } ======================================================================= Freeradius version: freeradius: FreeRADIUS Version 2.2.3 (git #077a373), for host x86_64-pc-linux-gnu, built on Nov 25 2013 at 09:17:09 ======================================================================= Operating System: Debian 7 ======================================================================= Can you help me? Thanks, János

2 1

'Error: [ldap] unable to create filter' after SIGHUP
by Albrecht Dreß 01 Dec '13

01 Dec '13

Hi all, I run Freeradius on a Debian Wheezy (7.2) x86_64 system: <snip> root@srv-vpn:/etc/freeradius# dpkg -l | grep radius ii freeradius 2.1.12+dfsg-1.2 amd64 high-performance and highly configurable RADIUS server ii freeradius-common 2.1.12+dfsg-1.2 all FreeRADIUS common files ii freeradius-ldap 2.1.12+dfsg-1.2 amd64 LDAP module for FreeRADIUS server ii freeradius-utils 2.1.12+dfsg-1.2 amd64 FreeRADIUS client utilities ii libfreeradius2 2.1.12+dfsg-1.2 amd64 FreeRADIUS shared library </snip> It is configured using the LDAP backend through mschapv2/peap (for WLan and Strongswan access), plus a "static" user for checking the daemon by Nagios. *Sometimes*, re-starting the daemon by calling '/etc/init.d/freeradius reload' from logrotate fails: <snip> Sun Dec 1 06:24:11 2013 : Auth: Login OK: [nagios/<snipped>] (from client <snipped> port 0) Sun Dec 1 06:31:10 2013 : Info: Received HUP signal. Sun Dec 1 06:31:10 2013 : Info: HUP - Re-reading configuration files --- new log file starts here --- Sun Dec 1 06:31:11 2013 : Info: HUP - loading modules Sun Dec 1 06:31:11 2013 : Info: Module: Reloaded module "detail" Sun Dec 1 06:31:11 2013 : Info: Module: Reloaded module "attr_filter.access_reject" Sun Dec 1 06:31:11 2013 : Info: Module: Reloaded module "attr_filter.accounting_response" Sun Dec 1 06:31:11 2013 : Info: Module: Reloaded module "radutmp" Sun Dec 1 06:31:11 2013 : Info: Module: Reloaded module "pap" Sun Dec 1 06:31:11 2013 : Info: Module: Reloaded module "files" Sun Dec 1 06:31:11 2013 : Info: Module: Reloaded module "mschap" Sun Dec 1 06:31:11 2013 : Info: Module: Reloaded module "suffix" Sun Dec 1 06:31:11 2013 : Info: Loaded virtual server <default> Sun Dec 1 06:31:11 2013 : Info: Loaded virtual server inner-tunnel Sun Dec 1 06:34:11 2013 : Error: [ldap] unable to create filter. Sun Dec 1 06:34:11 2013 : Auth: Invalid user: [nagios/<snipped>] (from client <snipped> port 0) </snip> Note that 'nagios' is the local "static" user, i.e. LDAP is *not* involved here - apparently, the LDAP error seems to block freeradius completely. Re-starting the daemon again brings the operation back to normal. Any help for fixing this issue would be highly appreciated! Thanks in advance, Albrecht.

4 3