rlm_sql not checking radgroupreply

3 Sep 2018

      Hello,

   I am using FreeRADIUS 3.0.17 in a MySQL setup that seems to not check
   radgroupreply.
   "radtest" gets user attributes but does not receive attributes of
   associated group at all.

   Complete debug output of radiusd -X:

   FreeRADIUS Version 3.0.17
   Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
   There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
   PARTICULAR PURPOSE
   You may redistribute copies of FreeRADIUS under the terms of the
   GNU General Public License
   For more information about these matters, see the file named COPYRIGHT
   Starting - reading configuration files ...
   including dictionary file /usr/local/share/freeradius/dictionary
   including dictionary file /usr/local/share/freeradius/dictionary.dhcp
   including dictionary file /usr/local/share/freeradius/dictionary.vqp
   including dictionary file /usr/local/etc/raddb/dictionary
   including configuration file /usr/local/etc/raddb/radiusd.conf
   including files in directory /usr/local/etc/raddb/mods-enabled/
   including configuration file /usr/local/etc/raddb/mods-enabled/expr
   including configuration file
   /usr/local/etc/raddb/mods-enabled/expiration
   including configuration file /usr/local/etc/raddb/mods-enabled/echo
   including configuration file /usr/local/etc/raddb/mods-enabled/files
   including configuration file /usr/local/etc/raddb/mods-enabled/pap
   including configuration file /usr/local/etc/raddb/mods-enabled/soh
   including configuration file /usr/local/etc/raddb/mods-enabled/utf8
   including configuration file /usr/local/etc/raddb/mods-enabled/unix
   including configuration file
   /usr/local/etc/raddb/mods-enabled/cache_eap
   including configuration file
   /usr/local/etc/raddb/mods-enabled/detail.log
   including configuration file /usr/local/etc/raddb/mods-enabled/date
   including configuration file /usr/local/etc/raddb/mods-enabled/linelog
   including configuration file /usr/local/etc/raddb/mods-enabled/unpack
   including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
   including configuration file /usr/local/etc/raddb/mods-enabled/exec
   including configuration file /usr/local/etc/raddb/mods-enabled/always
   including configuration file
   /usr/local/etc/raddb/mods-enabled/logintime
   including configuration file /usr/local/etc/raddb/mods-enabled/mschap
   including configuration file
   /usr/local/etc/raddb/mods-enabled/replicate
   including configuration file /usr/local/etc/raddb/mods-enabled/eap
   including configuration file /usr/local/etc/raddb/mods-enabled/detail
   including configuration file /usr/local/etc/raddb/mods-enabled/digest
   including configuration file
   /usr/local/etc/raddb/mods-enabled/preprocess
   including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
   including configuration file /usr/local/etc/raddb/mods-enabled/chap
   including configuration file
   /usr/local/etc/raddb/mods-enabled/attr_filter
   including configuration file /usr/local/etc/raddb/mods-enabled/sql
   including configuration file
   /usr/local/etc/raddb/mods-config/sql/main/sqlite/queries.conf
   including configuration file /usr/local/etc/raddb/mods-enabled/realm
   including files in directory /usr/local/etc/raddb/policy.d/
   including configuration file /usr/local/etc/raddb/policy.d/filter
   including configuration file
   /usr/local/etc/raddb/policy.d/moonshot-targeted-ids
   including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
   including configuration file
   /usr/local/etc/raddb/policy.d/canonicalization
   including configuration file /usr/local/etc/raddb/policy.d/control
   including configuration file /usr/local/etc/raddb/policy.d/debug
   including configuration file
   /usr/local/etc/raddb/policy.d/operator-name
   including configuration file /usr/local/etc/raddb/policy.d/eap
   including configuration file /usr/local/etc/raddb/policy.d/cui
   including configuration file /usr/local/etc/raddb/policy.d/dhcp
   including configuration file /usr/local/etc/raddb/policy.d/accounting
   including files in directory /usr/local/etc/raddb/sites-enabled/
   including configuration file /usr/local/etc/raddb/sites-enabled/default
   including configuration file
   /usr/local/etc/raddb/sites-enabled/inner-tunnel
   main {
    security {
           allow_core_dumps = no
    }
           name = "radiusd"
           prefix = "/usr/local"
           localstatedir = "/usr/local/var"
           logdir = "/usr/local/var/log/radius"
           run_dir = "/usr/local/var/run/radiusd"
   }
   main {
           name = "radiusd"
           prefix = "/usr/local"
           localstatedir = "/usr/local/var"
           sbindir = "/usr/local/sbin"
           logdir = "/usr/local/var/log/radius"
           run_dir = "/usr/local/var/run/radiusd"
           libdir = "/usr/local/lib"
           radacctdir = "/usr/local/var/log/radius/radacct"
           hostname_lookups = no
           max_request_time = 30
           cleanup_delay = 5
           max_requests = 16384
           pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
           checkrad = "/usr/local/sbin/checkrad"
           debug_level = 0
           proxy_requests = yes
    log {
           stripped_names = no
           auth = no
           auth_badpass = no
           auth_goodpass = no
           colourise = yes
           msg_denied = "You are already logged in - access denied"
    }
    resources {
    }
    security {
           max_attributes = 200
           reject_delay = 1.000000
           status_server = yes
           allow_vulnerable_openssl = "no"
    }
   }
   radiusd: #### Loading Realms and Home Servers ####
   radiusd: #### Loading Clients ####
   Debugger not attached
    # Creating Auth-Type = mschap
    # Creating Auth-Type = digest
    # Creating Auth-Type = eap
    # Creating Auth-Type = PAP
    # Creating Auth-Type = CHAP
    # Creating Auth-Type = MS-CHAP
   radiusd: #### Instantiating modules ####
    modules {
     # Loaded module rlm_expr
     # Loading module "expr" from file
   /usr/local/etc/raddb/mods-enabled/expr
     expr {
           safe_characters =
   "#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
   /"
     }
     # Loaded module rlm_expiration
     # Loading module "expiration" from file
   /usr/local/etc/raddb/mods-enabled/expiration
     # Loaded module rlm_exec
     # Loading module "echo" from file
   /usr/local/etc/raddb/mods-enabled/echo
     exec echo {
           wait = yes
           program = "/bin/echo %{User-Name}"
           input_pairs = "request"
           output_pairs = "reply"
           shell_escape = yes
     }
     # Loaded module rlm_files
     # Loading module "files" from file
   /usr/local/etc/raddb/mods-enabled/files
     files {
           filename = "/usr/local/etc/raddb/mods-config/files/authorize"
           acctusersfile =
   "/usr/local/etc/raddb/mods-config/files/accounting"
           preproxy_usersfile =
   "/usr/local/etc/raddb/mods-config/files/pre-proxy"
     }
     # Loaded module rlm_pap
     # Loading module "pap" from file
   /usr/local/etc/raddb/mods-enabled/pap
     pap {
           normalise = yes
     }
     # Loaded module rlm_soh
     # Loading module "soh" from file
   /usr/local/etc/raddb/mods-enabled/soh
     soh {
           dhcp = yes
     }
     # Loaded module rlm_utf8
     # Loading module "utf8" from file
   /usr/local/etc/raddb/mods-enabled/utf8
     # Loaded module rlm_unix
     # Loading module "unix" from file
   /usr/local/etc/raddb/mods-enabled/unix
     unix {
           radwtmp = "/usr/local/var/log/radius/radwtmp"
     }
   Creating attribute Unix-Group
     # Loaded module rlm_cache
     # Loading module "cache_eap" from file
   /usr/local/etc/raddb/mods-enabled/cache_eap
     cache cache_eap {
           driver = "rlm_cache_rbtree"
           key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
           ttl = 15
           max_entries = 0
           epoch = 0
           add_stats = no
     }
     # Loaded module rlm_detail
     # Loading module "auth_log" from file
   /usr/local/etc/raddb/mods-enabled/detail.log
     detail auth_log {
           filename =
   "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
   -Src-IPv6-Address}}/auth-detail-%Y%m%d"
           header = "%t"
           permissions = 384
           locking = no
           escape_filenames = no
           log_packet_header = no
     }
     # Loading module "reply_log" from file
   /usr/local/etc/raddb/mods-enabled/detail.log
     detail reply_log {
           filename =
   "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
   -Src-IPv6-Address}}/reply-detail-%Y%m%d"
           header = "%t"
           permissions = 384
           locking = no
           escape_filenames = no
           log_packet_header = no
     }
     # Loading module "pre_proxy_log" from file
   /usr/local/etc/raddb/mods-enabled/detail.log
     detail pre_proxy_log {
           filename =
   "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
   -Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
           header = "%t"
           permissions = 384
           locking = no
           escape_filenames = no
           log_packet_header = no
     }
     # Loading module "post_proxy_log" from file
   /usr/local/etc/raddb/mods-enabled/detail.log
     detail post_proxy_log {
           filename =
   "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
   -Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
           header = "%t"
           permissions = 384
           locking = no
           escape_filenames = no
           log_packet_header = no
     }
     # Loaded module rlm_date
     # Loading module "date" from file
   /usr/local/etc/raddb/mods-enabled/date
     date {
           format = "%b %e %Y %H:%M:%S %Z"
           utc = no
     }
     # Loaded module rlm_linelog
     # Loading module "linelog" from file
   /usr/local/etc/raddb/mods-enabled/linelog
     linelog {
           filename = "/usr/local/var/log/radius/linelog"
           escape_filenames = no
           syslog_severity = "info"
           permissions = 384
           format = "This is a log message for %{User-Name}"
           reference = "messages.%{%{reply:Packet-Type}:-default}"
     }
     # Loading module "log_accounting" from file
   /usr/local/etc/raddb/mods-enabled/linelog
     linelog log_accounting {
           filename = "/usr/local/var/log/radius/linelog-accounting"
           escape_filenames = no
           syslog_severity = "info"
           permissions = 384
           format = ""
           reference =
   "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
     }
     # Loaded module rlm_unpack
     # Loading module "unpack" from file
   /usr/local/etc/raddb/mods-enabled/unpack
     # Loaded module rlm_radutmp
     # Loading module "sradutmp" from file
   /usr/local/etc/raddb/mods-enabled/sradutmp
     radutmp sradutmp {
           filename = "/usr/local/var/log/radius/sradutmp"
           username = "%{User-Name}"
           case_sensitive = yes
           check_with_nas = yes
           permissions = 420
           caller_id = no
     }
     # Loading module "exec" from file
   /usr/local/etc/raddb/mods-enabled/exec
     exec {
           wait = no
           input_pairs = "request"
           shell_escape = yes
           timeout = 10
     }
     # Loaded module rlm_always
     # Loading module "reject" from file
   /usr/local/etc/raddb/mods-enabled/always
     always reject {
           rcode = "reject"
           simulcount = 0
           mpp = no
     }
     # Loading module "fail" from file
   /usr/local/etc/raddb/mods-enabled/always
     always fail {
           rcode = "fail"
           simulcount = 0
           mpp = no
     }
     # Loading module "ok" from file
   /usr/local/etc/raddb/mods-enabled/always
     always ok {
           rcode = "ok"
           simulcount = 0
           mpp = no
     }
     # Loading module "handled" from file
   /usr/local/etc/raddb/mods-enabled/always
     always handled {
           rcode = "handled"
           simulcount = 0
           mpp = no
     }
     # Loading module "invalid" from file
   /usr/local/etc/raddb/mods-enabled/always
     always invalid {
           rcode = "invalid"
           simulcount = 0
           mpp = no
     }
     # Loading module "userlock" from file
   /usr/local/etc/raddb/mods-enabled/always
     always userlock {
           rcode = "userlock"
           simulcount = 0
           mpp = no
     }
     # Loading module "notfound" from file
   /usr/local/etc/raddb/mods-enabled/always
     always notfound {
           rcode = "notfound"
           simulcount = 0
           mpp = no
     }
     # Loading module "noop" from file
   /usr/local/etc/raddb/mods-enabled/always
     always noop {
           rcode = "noop"
           simulcount = 0
           mpp = no
     }
     # Loading module "updated" from file
   /usr/local/etc/raddb/mods-enabled/always
     always updated {
           rcode = "updated"
           simulcount = 0
           mpp = no
     }
     # Loaded module rlm_logintime
     # Loading module "logintime" from file
   /usr/local/etc/raddb/mods-enabled/logintime
     logintime {
           minimum_timeout = 60
     }
     # Loaded module rlm_mschap
     # Loading module "mschap" from file
   /usr/local/etc/raddb/mods-enabled/mschap
     mschap {
           use_mppe = yes
           require_encryption = no
           require_strong = no
           with_ntdomain_hack = yes
      passchange {
      }
           allow_retry = yes
           winbind_retry_with_normalised_username = no
     }
     # Loaded module rlm_replicate
     # Loading module "replicate" from file
   /usr/local/etc/raddb/mods-enabled/replicate
     # Loaded module rlm_eap
     # Loading module "eap" from file
   /usr/local/etc/raddb/mods-enabled/eap
     eap {
           default_eap_type = "md5"
           timer_expire = 60
           ignore_unknown_eap_types = no
           cisco_accounting_username_bug = no
           max_sessions = 16384
     }
     # Loading module "detail" from file
   /usr/local/etc/raddb/mods-enabled/detail
     detail {
           filename =
   "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet
   -Src-IPv6-Address}}/detail-%Y%m%d"
           header = "%t"
           permissions = 384
           locking = no
           escape_filenames = no
           log_packet_header = no
     }
     # Loaded module rlm_digest
     # Loading module "digest" from file
   /usr/local/etc/raddb/mods-enabled/digest
     # Loaded module rlm_preprocess
     # Loading module "preprocess" from file
   /usr/local/etc/raddb/mods-enabled/preprocess
     preprocess {
           huntgroups =
   "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
           hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
           with_ascend_hack = no
           ascend_channels_per_line = 23
           with_ntdomain_hack = no
           with_specialix_jetstream_hack = no
           with_cisco_vsa_hack = no
           with_alvarion_vsa_hack = no
     }
     # Loading module "radutmp" from file
   /usr/local/etc/raddb/mods-enabled/radutmp
     radutmp {
           filename = "/usr/local/var/log/radius/radutmp"
           username = "%{User-Name}"
           case_sensitive = yes
           check_with_nas = yes
           permissions = 384
           caller_id = yes
     }
     # Loaded module rlm_chap
     # Loading module "chap" from file
   /usr/local/etc/raddb/mods-enabled/chap
     # Loaded module rlm_attr_filter
     # Loading module "attr_filter.post-proxy" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
     attr_filter attr_filter.post-proxy {
           filename =
   "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
           key = "%{Realm}"
           relaxed = no
     }
     # Loading module "attr_filter.pre-proxy" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
     attr_filter attr_filter.pre-proxy {
           filename =
   "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
           key = "%{Realm}"
           relaxed = no
     }
     # Loading module "attr_filter.access_reject" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
     attr_filter attr_filter.access_reject {
           filename =
   "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
           key = "%{User-Name}"
           relaxed = no
     }
     # Loading module "attr_filter.access_challenge" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
     attr_filter attr_filter.access_challenge {
           filename =
   "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
           key = "%{User-Name}"
           relaxed = no
     }
     # Loading module "attr_filter.accounting_response" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
     attr_filter attr_filter.accounting_response {
           filename =
   "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
           key = "%{User-Name}"
           relaxed = no
     }
     # Loaded module rlm_sql
     # Loading module "sql" from file
   /usr/local/etc/raddb/mods-enabled/sql
     sql {
           driver = "rlm_sql_mysql"
           server = "sql.mydomain.de"
           port = 3306
           login = "radius"
           password = <<< secret >>>
           radius_db = "radius"
           read_groups = yes
           read_profiles = yes
           read_clients = yes
           delete_stale_sessions = yes
           sql_user_name = "%{User-Name}"
           default_user_profile = ""
           client_query = "SELECT id, nasname, shortname, type, secret,
   server FROM nas"
           authorize_check_query = "SELECT id, username, attribute, value,
   op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id"
           authorize_reply_query = "SELECT id, username, attribute, value,
   op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id"
           authorize_group_check_query = "SELECT id, groupname, attribute,
   Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY
   id"
           authorize_group_reply_query = "SELECT id, groupname, attribute,
   value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY
   id"
           group_membership_query = "SELECT groupname FROM radusergroup
   WHERE username = '%{SQL-User-Name}' ORDER BY priority"
           simul_count_query = "SELECT COUNT(*) FROM radacct WHERE
   username = '%{SQL-User-Name}' AND acctstoptime IS NULL"
           simul_verify_query = "SELECT radacctid, acctsessionid,
   username, nasipaddress, nasportid, framedipaddress, callingstationid,
   framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND
   acctstoptime IS NULL"
           safe_characters =
   "#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
   /"
      accounting {
           reference = "%{tolower:type.%{Acct-Status-Type}.query}"
       type {
        accounting-on {
           query = "UPDATE radacct SET acctstoptime =
   %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime  =
   (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} -
   strftime('%%s', acctstarttime)), acctterminatecause =
   '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress
   = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}"
        }
        accounting-off {
           query = "UPDATE radacct SET acctstoptime =
   %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime  =
   (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} -
   strftime('%%s', acctstarttime)), acctterminatecause =
   '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress
   = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}"
        }
        start {
           query = "INSERT INTO radacct (acctsessionid, acctuniqueid,
   username, realm, nasipaddress, nasportid, nasporttype, acctstarttime,
   acctupdatetime, acctstoptime, acctsessiontime, acctauthentic,
   connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets,
   calledstationid, callingstationid, acctterminatecause, servicetype,
   framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}',
   '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}',
   '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}',
   '%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-date('now')},
   %{%{integer:Event-Timestamp}:-date('now')}, NULL, '0',
   '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0',
   '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}',
   '%{Framed-Protocol}', '%{Framed-IP-Address}')"
        }
        interim-update {
           query = "UPDATE radacct SET acctupdatetime  =
   %{%{integer:Event-Timestamp}:-date('now')}, acctinterval    = 0,
   framedipaddress = '%{Framed-IP-Address}', acctsessiontime =
   %{%{Acct-Session-Time}:-NULL}, acctinputoctets =
   %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0},
   acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 |
   %{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId =
   '%{Acct-Unique-Session-Id}'"
        }
        stop {
           query = "UPDATE radacct SET acctstoptime        =
   %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime   =
   %{%{Acct-Session-Time}:-NULL}, acctinputoctets        =
   %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0},
   acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 |
   %{%{Acct-Output-Octets}:-0}, acctterminatecause =
   '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE
   AcctUniqueId = '%{Acct-Unique-Session-Id}'"
        }
       }
      }
      post-auth {
           reference = ".query"
           query = "INSERT INTO radpostauth (username, pass, reply,
   authdate) VALUES ( '%{SQL-User-Name}',
   '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')"
      }
     }
   rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and
   linked
   Creating attribute SQL-Group
     # Loaded module rlm_realm
     # Loading module "IPASS" from file
   /usr/local/etc/raddb/mods-enabled/realm
     realm IPASS {
           format = "prefix"
           delimiter = "/"
           ignore_default = no
           ignore_null = no
     }
     # Loading module "suffix" from file
   /usr/local/etc/raddb/mods-enabled/realm
     realm suffix {
           format = "suffix"
           delimiter = "@"
           ignore_default = no
           ignore_null = no
     }
     # Loading module "realmpercent" from file
   /usr/local/etc/raddb/mods-enabled/realm
     realm realmpercent {
           format = "suffix"
           delimiter = "%"
           ignore_default = no
           ignore_null = no
     }
     # Loading module "ntdomain" from file
   /usr/local/etc/raddb/mods-enabled/realm
     realm ntdomain {
           format = "prefix"
           delimiter = "\\"
           ignore_default = no
           ignore_null = no
     }
     instantiate {
     }
     # Instantiating module "expiration" from file
   /usr/local/etc/raddb/mods-enabled/expiration
     # Instantiating module "files" from file
   /usr/local/etc/raddb/mods-enabled/files
   reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
   reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
   reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
     # Instantiating module "pap" from file
   /usr/local/etc/raddb/mods-enabled/pap
     # Instantiating module "cache_eap" from file
   /usr/local/etc/raddb/mods-enabled/cache_eap
   rlm_cache (cache_eap): Driver rlm_cache_rbtree (module
   rlm_cache_rbtree) loaded and linked
     # Instantiating module "auth_log" from file
   /usr/local/etc/raddb/mods-enabled/detail.log
   rlm_detail (auth_log): 'User-Password' suppressed, will not appear in
   detail output
     # Instantiating module "reply_log" from file
   /usr/local/etc/raddb/mods-enabled/detail.log
     # Instantiating module "pre_proxy_log" from file
   /usr/local/etc/raddb/mods-enabled/detail.log
     # Instantiating module "post_proxy_log" from file
   /usr/local/etc/raddb/mods-enabled/detail.log
     # Instantiating module "linelog" from file
   /usr/local/etc/raddb/mods-enabled/linelog
     # Instantiating module "log_accounting" from file
   /usr/local/etc/raddb/mods-enabled/linelog
     # Instantiating module "reject" from file
   /usr/local/etc/raddb/mods-enabled/always
     # Instantiating module "fail" from file
   /usr/local/etc/raddb/mods-enabled/always
     # Instantiating module "ok" from file
   /usr/local/etc/raddb/mods-enabled/always
     # Instantiating module "handled" from file
   /usr/local/etc/raddb/mods-enabled/always
     # Instantiating module "invalid" from file
   /usr/local/etc/raddb/mods-enabled/always
     # Instantiating module "userlock" from file
   /usr/local/etc/raddb/mods-enabled/always
     # Instantiating module "notfound" from file
   /usr/local/etc/raddb/mods-enabled/always
     # Instantiating module "noop" from file
   /usr/local/etc/raddb/mods-enabled/always
     # Instantiating module "updated" from file
   /usr/local/etc/raddb/mods-enabled/always
     # Instantiating module "logintime" from file
   /usr/local/etc/raddb/mods-enabled/logintime
     # Instantiating module "mschap" from file
   /usr/local/etc/raddb/mods-enabled/mschap
   rlm_mschap (mschap): using internal authentication
     # Instantiating module "eap" from file
   /usr/local/etc/raddb/mods-enabled/eap
      # Linked to sub-module rlm_eap_md5
      # Linked to sub-module rlm_eap_leap
      # Linked to sub-module rlm_eap_gtc
      gtc {
           challenge = "Password: "
           auth_type = "PAP"
      }
      # Linked to sub-module rlm_eap_tls
      tls {
           tls = "tls-common"
      }
      tls-config tls-common {
           verify_depth = 0
           ca_path = "/usr/local/etc/raddb/certs"
           pem_file_type = yes
           private_key_file = "/usr/local/etc/raddb/certs/server.pem"
           certificate_file = "/usr/local/etc/raddb/certs/server.pem"
           ca_file = "/usr/local/etc/raddb/certs/ca.pem"
           private_key_password = <<< secret >>>
           dh_file = "/usr/local/etc/raddb/certs/dh"
           fragment_size = 1024
           include_length = yes
           auto_chain = yes
           check_crl = no
           check_all_crl = no
           cipher_list = "DEFAULT"
           cipher_server_preference = no
           ecdh_curve = "prime256v1"
           tls_max_version = ""
           tls_min_version = "1.0"
       cache {
           enable = no
           lifetime = 24
           max_entries = 255
       }
       verify {
           skip_if_ocsp_ok = no
       }
       ocsp {
           enable = no
           override_cert_url = yes
           url = "[1]http://127.0.0.1/ocsp/"
           use_nonce = yes
           timeout = 0
           softfail = no
       }
      }
      # Linked to sub-module rlm_eap_ttls
      ttls {
           tls = "tls-common"
           default_eap_type = "md5"
           copy_request_to_tunnel = no
           use_tunneled_reply = no
           virtual_server = "inner-tunnel"
           include_length = yes
           require_client_cert = no
      }
   tls: Using cached TLS configuration from previous invocation
      # Linked to sub-module rlm_eap_peap
      peap {
           tls = "tls-common"
           default_eap_type = "mschapv2"
           copy_request_to_tunnel = no
           use_tunneled_reply = no
           proxy_tunneled_request_as_eap = yes
           virtual_server = "inner-tunnel"
           soh = no
           require_client_cert = no
      }
   tls: Using cached TLS configuration from previous invocation
      # Linked to sub-module rlm_eap_mschapv2
      mschapv2 {
           with_ntdomain_hack = no
           send_error = no
      }
     # Instantiating module "detail" from file
   /usr/local/etc/raddb/mods-enabled/detail
     # Instantiating module "preprocess" from file
   /usr/local/etc/raddb/mods-enabled/preprocess
   reading pairlist file
   /usr/local/etc/raddb/mods-config/preprocess/huntgroups
   reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
     # Instantiating module "attr_filter.post-proxy" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
   reading pairlist file
   /usr/local/etc/raddb/mods-config/attr_filter/post-proxy
     # Instantiating module "attr_filter.pre-proxy" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
   reading pairlist file
   /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
     # Instantiating module "attr_filter.access_reject" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
   reading pairlist file
   /usr/local/etc/raddb/mods-config/attr_filter/access_reject
   [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check
   item "FreeRADIUS-Response-Delay"  found in filter list for realm
   "DEFAULT".
   [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check
   item "FreeRADIUS-Response-Delay-USec"     found in filter list for
   realm "DEFAULT".
     # Instantiating module "attr_filter.access_challenge" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
   reading pairlist file
   /usr/local/etc/raddb/mods-config/attr_filter/access_challenge
     # Instantiating module "attr_filter.accounting_response" from file
   /usr/local/etc/raddb/mods-enabled/attr_filter
   reading pairlist file
   /usr/local/etc/raddb/mods-config/attr_filter/accounting_response
     # Instantiating module "sql" from file
   /usr/local/etc/raddb/mods-enabled/sql
   rlm_sql_mysql: libmysql version: 10.1.26-MariaDB
      mysql {
       tls {
       }
           warnings = "auto"
      }
   rlm_sql (sql): Attempting to connect to database "radius"
   rlm_sql (sql): Initialising connection pool
      pool {
           start = 5
           min = 3
           max = 32
           spare = 10
           uses = 0
           lifetime = 0
           cleanup_interval = 30
           idle_timeout = 60
           retry_delay = 30
           spread = no
      }
   rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots
   used
   rlm_sql_mysql: Starting connect to MySQL server
   rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de via
   TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
   rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots
   used
   rlm_sql_mysql: Starting connect to MySQL server
   rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de via
   TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
   rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots
   used
   rlm_sql_mysql: Starting connect to MySQL server
   rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de via
   TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
   rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots
   used
   rlm_sql_mysql: Starting connect to MySQL server
   rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de via
   TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
   rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots
   used
   rlm_sql_mysql: Starting connect to MySQL server
   rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de via
   TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
   rlm_sql (sql): Processing generate_sql_clients
   rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname,
   shortname, type, secret, server FROM nas
   rlm_sql (sql): Reserved connection (0)
   rlm_sql (sql): Executing select query: SELECT id, nasname, shortname,
   type, secret, server FROM nas
   rlm_sql (sql): Adding client 10.0.0.1 (RAS1) to global clients list
   rlm_sql (10.0.0.1): Client "RAS1" (sql) added
   [...]
   rlm_sql (sql): Adding client 192.168.100.1 (radius.mydomain.de) to
   global clients list
   rlm_sql (192.168.100.1): Client "radius.mydomain.de" (sql) added
   rlm_sql (sql): Adding client 127.0.0.1 (localhost) to global clients
   list
   rlm_sql (127.0.0.1): Client "localhost" (sql) added
   rlm_sql (sql): Released connection (0)
   Need 5 more connections to reach 10 spares
   rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots
   used
   rlm_sql_mysql: Starting connect to MySQL server
   rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de via
   TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10
     # Instantiating module "IPASS" from file
   /usr/local/etc/raddb/mods-enabled/realm
     # Instantiating module "suffix" from file
   /usr/local/etc/raddb/mods-enabled/realm
     # Instantiating module "realmpercent" from file
   /usr/local/etc/raddb/mods-enabled/realm
     # Instantiating module "ntdomain" from file
   /usr/local/etc/raddb/mods-enabled/realm
    } # modules
   radiusd: #### Loading Virtual Servers ####
   server { # from file /usr/local/etc/raddb/radiusd.conf
   } # server
   server default { # from file /usr/local/etc/raddb/sites-enabled/default
    # Loading authenticate {...}
    # Loading authorize {...}
    # Loading preacct {...}
    # Loading accounting {...}
    # Loading session {...}
    # Loading post-proxy {...}
    # Loading post-auth {...}
   } # server default
   server inner-tunnel { # from file
   /usr/local/etc/raddb/sites-enabled/inner-tunnel
    # Loading authenticate {...}
    # Loading authorize {...}
   Ignoring "ldap" (see raddb/mods-available/README.rst)
    # Loading session {...}
    # Loading post-proxy {...}
    # Loading post-auth {...}
    # Skipping contents of 'if' as it is always 'false' --
   /usr/local/etc/raddb/sites-enabled/inner-tunnel:331
   } # server inner-tunnel
   radiusd: #### Opening IP addresses and Ports ####
   listen {
           type = "auth"
           ipv4addr = 192.168.100.1
           port = 1812
      limit {
           max_connections = 64
           lifetime = 0
           idle_timeout = 30
      }
   }
   listen {
           type = "acct"
           ipv4addr = 192.168.100.1
           port = 0
      limit {
           max_connections = 16
           lifetime = 0
           idle_timeout = 30
      }
   }
   listen {
           type = "auth"
           ipaddr = 127.0.0.1
           port = 18120
   }
   Listening on auth address 192.168.100.1 port 1812 bound to server
   default
   Listening on acct address 192.168.100.1 port 1813 bound to server
   default
   Listening on auth address 127.0.0.1 port 18120 bound to server
   inner-tunnel
   Ready to process requests

References

   1. http://127.0.0.1/ocsp/

rlm_sql not checking radgroupreply

tomas.meier＠fettabernett.de