- Freeradius-Users - lists.freeradius.org

Eduroam & FreeRadius not working so well
by Mike Diggins 05 Dec '12

05 Dec '12

I'm running FreeRadius 2.1.12 on RedHat 6 as an Eduroam proxy server and having problems. My cisco wireless controllers are constantly failing back and forth between the primary and secondary systems. My logs show these errors when it happens: Dec 4 19:12:18 server radiusd[32588]: Internal sanity check failed for child state Dec 4 19:12:18 server radiusd[32588]: Reply from home server x.x.x.x port 1812 - ID: 210 arrived too late for request 76479. Try increasing 'retry_delay' or 'max_request_time' Dec 4 19:13:18 server radiusd[32588]: Discarding duplicate request from client ct5508 port 32770 - ID: 148 due to unfinished request 76495 Dec 4 19:13:26 server radiusd[32588]: Discarding duplicate request from client ct5508 port 32770 - ID: 148 due to unfinished request 76495 Dec 4 19:13:34 server radiusd[32588]: Discarding duplicate request from client ct5508 port 32770 - ID: 148 due to unfinished request 76495 Dec 4 19:13:41 server radiusd[32588]: Internal sanity check failed for child state Dec 4 19:13:41 server radiusd[32588]: Reply from home server x.x.x.x port 1812 - ID: 102 arrived too late for request 76495. Try increasing 'retry_delay' or 'max_request_time' Dec 4 19:13:42 server radiusd[32588]: Discarding duplicate request from client ct5508 port 32770 - ID: 148 due to unfinished request 76495 I'm look for some advice as to what timeouts to adjust that might help with the errors. I didn't want to start changing retry_delay or max_request_time without some advice first. Any suggestions? I have no control over the Home Servers or how long a request takes to complete and I don't know what's causing the sanity check failure!? -Mike

1 0

Originating CoA
by amanda edades 04 Dec '12

04 Dec '12

Hello, I am trying to use my RADIUS server to designate user group memberships specifying QoS policies and monthly data caps. When authenticating, the server returns an AVP that tells what group a user is in, and the NAS will apply the associated QoS policies to his traffic. The RADIUS server checks if a user is over his data cap on every Access-Request and Interim-Update packet. When the user exceeds the data cap defined for his group, the RADIUS server originates a CoA and sends a new group assignment in which his traffic is throttled. Everything works fine now, but if the RADIUS server finds that a user is over his cap, it first returns its default group assignment taken from the radgroupreply table, then sends a CoA. Output from RADIUS: Sending Accounting-Response of id 122 to 127.0.0.1 port 33544 Access-Group = "Group1" WARNING: Empty pre-proxy section. Using default return values. Sending CoA-Request of id 223 to 127.0.0.1 port 3799 User-Name = "1907444" Access-Group = "ThrottledGroup" Finished request 8. So the NAS receives the default group assignment, then the throttled group assignment immediately after. To avoid confusion and transmitting unnecessary data, in the case when a data cap is exceeded, how to I prevent the RADIUS server from returning the default values from the radgroupreply table, and only send the CoA? Thank you, Amanda

2 1

Redundant Freeradius
by fknet 04 Dec '12

04 Dec '12

Hello people! Today I've just one FreeBSD server running FreeRadius +MySQL on my network and now I want to put a redundant server to prevent fails. I was thinking to use CARP protocol to have the same IP address of the main server on the backup server and do the MySQL Replication on the backup server but one friend told me that I can't replicate the radacct table for a reason that he doesn't know. My question is: Can I do the full replication of ALL MySQL tables of Freeradius? Will I have some problem if I replicate the radacct table? Thanks Fabrício

2 5

Segmentation fault
by Manuel Campana 04 Dec '12

04 Dec '12

Hello I'm quite new to freeradius and I experienced my first issue right away after trying the first attempt. If I run a quick test on localhost I get a segmentation fault Tue Dec 4 10:17:11 2012 : Debug: Listening on authentication address * port 1812 Tue Dec 4 10:17:11 2012 : Debug: Listening on accounting address * port 1813 Tue Dec 4 10:17:11 2012 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Tue Dec 4 10:17:11 2012 : Debug: Listening on proxy address * port 1814 Tue Dec 4 10:17:11 2012 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 53330, id=88, length=77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x0d49f27be8b1d4bd1f5c5345041acde7 Tue Dec 4 10:17:16 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Tue Dec 4 10:17:16 2012 : Info: +- entering group authorize {...} Segmentation fault This si the freeradius version installed on my debian machine freeradius: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Sep 11 2012 at 17:06:46 The configuration seems to be ok so I don't know why I get this. Anyone can help me? Thanks Br Manuel -- *Manuel Campana* Technical Support Engineer Accedian Networks T: 514 331 6181 x463 E: MCampana(a)Accedian.com @Accedian -- Avis de confidentialité Les informations contenues dans le présent message et dans toute pièce qui lui est jointe sont confidentielles et peuvent être protégées par le secret professionnel. Ces informations sont à l’usage exclusif de son ou de ses destinataires. Si vous recevez ce message par erreur, veuillez s’il vous plait communiquer immédiatement avec l’expéditeur et en détruire tout exemplaire. De plus, il vous est strictement interdit de le divulguer, de le distribuer ou de le reproduire sans l’autorisation de l’expéditeur. Merci. Confidentiality notice This e-mail message and any attachment hereto contain confidential information which may be privileged and which is intended for the exclusive use of its addressee(s). If you receive this message in error, please inform sender immediately and destroy any copy thereof. Furthermore, any disclosure, distribution or copying of this message and/or any attachment hereto without the consent of the sender is strictly prohibited. Thank you.

2 1

Radius Code set to 2??
by ashok kumar 04 Dec '12

04 Dec '12

Hey folks, I have and AP from which I get a RADIUS message with code field set to 2. It was received from on port 1812. Can anybody tell me the significance of this problem because when I change the APs everything works fine. I need to ascertain whether any configuration change is required on AP/ Radius server. Awaiting your useful suggestions. Thanks in advance Regards, Ashok Kumar.

2 1

FreeRadius authentication problems
by Taneli Virtanen 04 Dec '12

04 Dec '12

Hello, I'm currently having some trouble with FreeRadius authentication. Posting my troubles at the Ubuntu forums didn't seem to help much, so I'm trying my hand here at the mailing lists. Here is the situation: We have recently aquired a Ruckus Zone director to manage our networks. We then wanted to have a Radius server to authenticate users thourgh their mac address. So, I installed Ubuntu, followed some basic tutorials and got all the way up to the point where I can join the radius controlled network. Problem is that while connected to this wireless network, I can't connect to internet and get booted from it in less than a minute with no message in radius debug for me to solve this problem. Here is the debug when connecting to the radius network: Ready to process requests. rad_recv: Access-Request packet from host 192.168.154.12 port 1065, id=9, length=168 User-Name = "Client mac address here" User-Password = "Client mac address here" Calling-Station-Id = "Client mac address here" NAS-IP-Address = 192.168.154.12 Called-Station-Id = "Ruckus mac address here:opetusx" Service-Type = Framed-User NAS-Port-Type = Wireless-802.11 NAS-Identifier = "Ruckus mac address here" Vendor-25053-Attr-3 = 0x6f706574757378 Message-Authenticator = 0xa7676bfa2ace5b4ba05356c35cac255a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [authorized_macs] expand: %{Calling-Station-ID} -> Client mac address here [authorized_macs] users: Matched entry Client mac address here at line 2 ++[authorized_macs] returns ok ++? if (!ok) ? Evaluating !(ok) -> FALSE ++? if (!ok) -> FALSE ++- entering else else {...} +++? if (!EAP-message) ? Evaluating !(EAP-message) -> TRUE +++? if (!EAP-message) -> TRUE +++- entering if (!EAP-message) {...} ++++[control] returns ok +++- if (!EAP-message) returns ok ++- else else returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Client mac address here", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 9 to 192.168.154.12 port 1065 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 9 with timestamp +7 Ready to process requests. I followed the plain mac auth guide to get this far, and the system sort of works, but not quite. So the configs must be out of whack somehow, but since radius doesn't give any debug info when I get booted out of the network I'm at loss here. Any help?

5 7

log detail
by studyfordo 04 Dec '12

04 Dec '12

Hi, all if i do the following set in /site-enable/default file, I want to know whether i can see such as when user logout,login failure,user login time....... accounting { detail daily sql sql_log exec (for exec-program and exec-program-wait) attr_filter.accounting_response } thanks

1 0

802.1x Issue
by Brekler Custodio 03 Dec '12

03 Dec '12

Hi again people, so a week ago i posted here a problem with 802.1x i had and it turned to be all my users were MD5 password, so that was my problem.Today i created a new DB on a test server, changed on sql.conf and tested.Im getting this error, i tried to understand that, BUT im kinda a newbie on freeradius + linux (i started to learn 1 month ago) and couldnt find the error.I dont know if the error is on MYSQL or freeradius... Appreciate anything you guys can help me!Thanks in advance. nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' AND ( id_tp_usuario in (1, 2, 3) OR ( id_tp_usuario = 4 AND dt_ingresso <= CURDATE() AND dt_egresso >= CURDATE() ) ) ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" }rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linkedrlm_sql (sql): Attempting to connect to root@localhost:/radiusrlm_sql (sql): starting 0rlm_sql (sql): Attempting to connect rlm_sql_mysql #0rlm_sql_mysql: Starting connect to MySQL server for #0rlm_sql (sql): Connected new DB handle, #0rlm_sql (sql): starting 1rlm_sql (sql): Attempting to connect rlm_sql_mysql #1rlm_sql_mysql: Starting connect to MySQL server for #1rlm_sql (sql): Connected new DB handle, #1rlm_sql (sql): starting 2rlm_sql (sql): Attempting to connect rlm_sql_mysql #2rlm_sql_mysql: Starting connect to MySQL server for #2rlm_sql (sql): Connected new DB handle, #2rlm_sql (sql): starting 3rlm_sql (sql): Attempting to connect rlm_sql_mysql #3rlm_sql_mysql: Starting connect to MySQL server for #3rlm_sql (sql): Connected new DB handle, #3rlm_sql (sql): starting 4rlm_sql (sql): Attempting to connect rlm_sql_mysql #4rlm_sql_mysql: Starting connect to MySQL server for #4rlm_sql (sql): Connected new DB handle, #4rlm_sql (sql): Processing generate_sql_clientsrlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nasrlm_sql (sql): Reserving sql socket id: 4rlm_sql (sql): Read entry nasname=172.23.54.2,shortname=ruckus-controller,secret=t3st3rlm_sql (sql): Adding client 172.23.54.2 (ruckus-controller, server=<none>) to clients listrlm_sql (sql): Released sql socket id: 4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules} # serverserver { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_sql_log Module: Instantiating module "sql_log" from file /etc/freeradius/modules/sql_log sql_log { path = "/var/log/freeradius/radacct/sql-relay" Post-Auth = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S');" sql_user_name = "%{%{User-Name}:-DEFAULT}" utf8 = no safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules} # serverradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = * port = 0}listen { type = "acct" ipaddr = * port = 0}listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}Listening on authentication address * port 1812Listening on accounting address * port 1813Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnelListening on proxy address * port 1814Ready to process requests.rad_recv: Access-Request packet from host 172.23.54.2 port 32777, id=52, length=206 User-Name = "user" Calling-Station-Id = "00-22-43-09-43-BD" NAS-IP-Address = 172.23.54.2 NAS-Port = 1 Called-Station-Id = "68-92-34-91-91-48:UNIFEBE-1X" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "68-92-34-91-91-48" Connect-Info = "CONNECT 802.11b/g" WISPr-Location-Name = "2o-Andar" EAP-Message = 0x020000090175736572 Vendor-25053-Attr-3 = 0x554e49464542452d3158 Message-Authenticator = 0x53dcd42dc46e9bee1e5538df27c8ae45# Executing section authorize from file /etc/freeradius/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop++[digest] returns noop[suffix] No '@' in User-Name = "user", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] EAP packet type response id 0 length 9[eap] No EAP Start, assuming it's an on-going EAP conversation++[eap] returns updated++[unix] returns notfound++[files] returns noop[sql] expand: %{User-Name} -> user[sql] sql_set_user escaped user --> 'user'rlm_sql (sql): Reserving sql socket id: 3[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' AND ( id_tp_usuario in (1, 2, 3) OR ( id_tp_usuario = 4 AND dt_ingresso <= CURDATE() AND dt_egresso >= CURDATE() ) ) ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user' AND ( id_tp_usuario in (1, 2, 3) OR ( id_tp_usuario = 4 AND dt_ingresso <= CURDATE() AND dt_egresso >= CURDATE() ) ) ORDER BY idrlm_sql_mysql: MYSQL check_error: 1054 receivedrlm_sql_getvpdata: database query error[sql] SQL query error; rejecting userrlm_sql (sql): Released sql socket id: 3++[sql] returns failInvalid user: [user/<via Auth-Type = EAP>] (from client ruckus-controller port 1 cli 00-22-43-09-43-BD)Using Post-Auth-Type Reject# Executing group from file /etc/freeradius/sites-enabled/default+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 0 for 1 secondsGoing to the next requestWaking up in 0.9 seconds.Sending delayed reject for request 0Sending Access-Reject of id 52 to 172.23.54.2 port 32777Waking up in 4.9 seconds.Cleaning up request 0 ID 52 with timestamp +205Ready to process requests.

8 20

I wanna post
by Taneli Virtanen 03 Dec '12

03 Dec '12

virtanentaneli(a)gmail.com

5 5

Sending authentication-requests to multiple radius-servers
by Stefan Kuegler 02 Dec '12

02 Dec '12

Hello. I have a short question: Is it possible to send an authentication-request from a client to multiple servers simultaneously ? +----------+ /----->| radius A | +--------+ +--------------+ / +----------+ | client |--->| radius proxy |X +--------+ +--------------+ \ +----------+ \----->| radius B | +----------+ We now authenticate with HMAC-based One Time Password Token (aka event-based token) from a Cisco ASA via radius to only one freeradius-server. But we want to establish a second authentication server for failover reasons. When using event based tokens, it's absolute necessary that every server receives the same authentication request simultaneously from the client to trigger the next "event" on the server side. Best Regards, Stefan Kuegler

4 8