On Jun 22, 2018, at 11:01 AM, Philemon Jaomalaza <philemon.jaomalaza@gmail.com> wrote:

# Database table configuration for everything except Oracle radius_db = "sql1"

It's already "sql1" and and works fine if I try it as database configured in the default sql module work fun if I make like default database for sql module.

I don't know what that means. If you edit the "radius_db" field, then ALL queries for that module will use that database. This should solve the problem you described earlier. If it doesn't, read the debug output to see what's going on. Alan DeKok.

Hello Dear,

On the same server where Freeradius 3 is installed, I would like to have more instance of sql for each NAS to use its virtual server and its database.

I do not know if it's a good idea but that's what I did:

- in proxy.conf

.....................

.......................

realm mydomaintest.com {

auth_pool = my_auth_failover

virtual_server = mydomaintest.com

}

- I then created a module sql1 which is confgured for the database "radius1" from the sql module template in /freeradius/3.0/mods-available/ and linked in /freeradius/3.0/mods-enabled/

sql sql1 {

driver = "rlm_sql_mysql"

.......................

.......................

pool = sql

......................

group_attribute = "$ {.: instance} -SQL-Group"

# This entry should be used for the default instance (sql {})

# of the SQL module.

# group_attribute = "SQL-Group"

......................................

.....................................

etc.

}

- in /freeradius/3.0/sites-available/ I created a mydomaintest.com virtual server from the deflaut.conf template and linked it to /freeradius/3.0/sites-enabled/

and I changed all the words "sql" by default to "sql1":

server mydomaintest.com {

authorize {

...........................

sql1

...........................

}

authenticate {

# all default content

}

# etc.

}

The problems now when I try to authenticate like user@mydomaintest.com, he sees realm "mydomaintest.com" and Stripped the username in "user" but he does not try to use it in the database " radius1 "but always in sql the database" radius "of the blow it does not find the user and that gives Access-Reject.

Where should I have made a mistake?

What is the best trick to make this feature?

Philemon Jaomalaza

Tél. : +261 (0) 32 05 113 26

Email : <mailto:philemon.jaomalaza@gmail.com> philemon.jaomalaza@gmail.com

- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

This the output of freeradius -X FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/sql including configuration file /etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf including configuration file /etc/freeradius/3.0/mods-enabled/sql1 including configuration file /etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/sqlcounter including configuration file /etc/freeradius/3.0/mods-config/sql/counter/mysql/dailycounter.conf including configuration file /etc/freeradius/3.0/mods-config/sql/counter/mysql/monthlycounter.conf including configuration file /etc/freeradius/3.0/mods-config/sql/counter/mysql/noresetcounter.conf including configuration file /etc/freeradius/3.0/mods-config/sql/counter/mysql/expire_on_login.conf including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/soh including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/operator-name including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/dynamic-clients including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/mydomaintest.com main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth+acct" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server mydomaintest.com { virtual_server = "mydomaintest.com" port = 1812 type = "auth+acct" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost home_server = mydomaintest.com } realm mydomaintest.com { auth_pool = my_auth_failover } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client dynamic { ipaddr = 0.0.0.0/00 require_message_authenticator = no limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } dynamic_clients = "dynamic_clients" lifetime = 3600 } including dynamic clients in /etc/freeradius/3.0/dynamic-clients/ including configuration file /etc/freeradius/3.0/dynamic-clients//172.16.0.1 client hotspot { ipaddr = 172.16.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Adding client 172.16.0.1/32 with shared secret "XXXXXXXXXXXXX" Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/3.0/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius1" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loading module "sql1" from file /etc/freeradius/3.0/mods-enabled/sql1 sql sql1 { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "kidsclub" password = <<< secret >>> radius_db = "kidsclub" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute sql1-SQL-Group # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_sqlcounter # Loading module "dailycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" } # Loading module "monthlycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter monthlycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "monthly" counter_name = "Monthly-Session-Time" check_name = "Max-Monthly-Session" reply_name = "Session-Timeout" } # Loading module "noresetcounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter noresetcounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}'" reset = "never" counter_name = "Max-All-Session-Time" check_name = "Max-All-Session" reply_name = "Session-Timeout" } # Loading module "expire_on_login" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter expire_on_login { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL( MAX(TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime))),0) FROM radacct WHERE UserName='%{User-Name}' ORDER BY acctstarttime LIMIT 1;" reset = "never" counter_name = "Expire-After-Initial-Login" check_name = "Expire-After" reply_name = "Session-Timeout" } # Loading module "weeklycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter weeklycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%%{User-Name}'" reset = "weekly" counter_name = "Weekly-Session-Time" check_name = "Max-Weekly-Session" reply_name = "Session-Timeout" } # Loading module "quaterlycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter quaterlycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%%{User-Name}'" reset = "3m" counter_name = "Quaterly-Session-Time" check_name = "Max-Quaterly-Session" reply_name = "Session-Timeout" } # Loading module "yearlycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter yearlycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%%{User-Name}'" reset = "12m" counter_name = "Yearly-Session-Time" check_name = "Max-Yearly-Session" reply_name = "Session-Timeout" } # Loading module "accessperiod" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter accessperiod { sql_module_instance = "sql" key = "User-Name" query = "SELECT IF(COUNT(radacctid>=1),(UNIX_TIMESTAMP() - IFNULL(UNIX_TIMESTAMP(AcctStartTime),0)),0) FROM radacct WHERE UserName = '%%{User-Name' AND AcctSessionTime >= 1 ORDER BY AcctStartTime LIMIT 1" reset = "never" counter_name = "Max-Access-Period-Never" check_name = "Access-Period" reply_name = "Session-Timeout" } # Loading module "counterChilliSpotMaxTotalOctetsDaily" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxTotalOctetsDaily { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "daily" counter_name = "ChilliSpot-Max-Total-Octets-Daily" check_name = "CS-Total-Octets-Daily" reply_name = "ChilliSpot-Max-Total-Octets" } # Loading module "counterChilliSpotMaxTotalOctetsWeekly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxTotalOctetsWeekly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "weekly" counter_name = "ChilliSpot-Max-Total-Octets-Weekly" check_name = "CS-Total-Octets-Weekly" reply_name = "ChilliSpot-Max-Total-Octets" } # Loading module "counterChilliSpotMaxTotalOctetsMonthly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxTotalOctetsMonthly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0)FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "monthly" counter_name = "ChilliSpot-Max-Total-Octets-Monthly" check_name = "CS-Total-Octets-Monthly" reply_name = "ChilliSpot-Max-Total-Octets" } # Loading module "counterChilliSpotMaxTotalOctetsQuarterly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxTotalOctetsQuarterly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "3m" counter_name = "ChilliSpot-Max-Total-Octets-Quarterly" check_name = "CS-Total-Octets-Quarterly" reply_name = "ChilliSpot-Max-Total-Octets" } # Loading module "counterChilliSpotMaxTotalOctetsYearly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxTotalOctetsYearly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "12m" counter_name = "ChilliSpot-Max-Total-Octets-Yearly" check_name = "CS-Total-Octets-Yearly" reply_name = "ChilliSpot-Max-Total-Octets" } # Loading module "counterChilliSpotMaxInputOctetsDaily" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxInputOctetsDaily { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctInputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "daily" counter_name = "ChilliSpot-Max-Input-Octets-Daily" check_name = "CS-Input-Octets-Daily" reply_name = "ChilliSpot-Max-Input-Octets" } # Loading module "counterChilliSpotMaxInputOctetsWeekly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxInputOctetsWeekly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctInputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "weekly" counter_name = "ChilliSpot-Max-Input-Octets-Weekly" check_name = "CS-Input-Octets-Weekly" reply_name = "ChilliSpot-Max-Input-Octets" } # Loading module "counterChilliSpotMaxInputOctetsMonthly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxInputOctetsMonthly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctInputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "monthly" counter_name = "ChilliSpot-Max-Input-Octets-Monthly" check_name = "CS-Input-Octets-Monthly" reply_name = "ChilliSpot-Max-Input-Octets" } # Loading module "counterChilliSpotMaxInputOctetsQuarterly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxInputOctetsQuarterly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctInputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "3m" counter_name = "ChilliSpot-Max-Input-Octets-Quarterly" check_name = "CS-Input-Octets-Quarterly" reply_name = "ChilliSpot-Max-Input-Octets" } # Loading module "counterChilliSpotMaxInputOctetsYearly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxInputOctetsYearly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctInputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "12m" counter_name = "ChilliSpot-Max-Input-Octets-Yearly" check_name = "CS-Input-Octets-Yearly" reply_name = "ChilliSpot-Max-Input-Octets" } # Loading module "counterChilliSpotMaxOutputOctetsDaily" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxOutputOctetsDaily { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "daily" counter_name = "ChilliSpot-Max-Output-Octets-Daily" check_name = "CS-Output-Octets-Daily" reply_name = "ChilliSpot-Max-Output-Octets" } # Loading module "counterChilliSpotMaxOutputOctetsWeekly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxOutputOctetsWeekly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "weekly" counter_name = "ChilliSpot-Max-Output-Octets-Weekly" check_name = "CS-Output-Octets-Weekly" reply_name = "ChilliSpot-Max-Output-Octets" } # Loading module "counterChilliSpotMaxOutputOctetsMonthly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxOutputOctetsMonthly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "monthly" counter_name = "ChilliSpot-Max-Output-Octets-Monthly" check_name = "CS-Output-Octets-Monthly" reply_name = "ChilliSpot-Max-Output-Octets" } # Loading module "counterChilliSpotMaxOutputOctetsQuarterly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxOutputOctetsQuarterly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "3m" counter_name = "ChilliSpot-Max-Output-Octets-Quarterly" check_name = "CS-Output-Octets-Quarterly" reply_name = "ChilliSpot-Max-Output-Octets" } # Loading module "counterChilliSpotMaxOutputOctetsYearly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter sqlcounter counterChilliSpotMaxOutputOctetsYearly { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%%{User-Name' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%%b'" reset = "12m" counter_name = "ChilliSpot-Max-Output-Octets-Yearly" check_name = "CS-Output-Octets-Yearly" reply_name = "ChilliSpot-Max-Output-Octets" } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } instantiate { } # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "sql" from file /etc/freeradius/3.0/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.1.26-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 # Instantiating module "sql1" from file /etc/freeradius/3.0/mods-enabled/sql1 mysql { tls { } warnings = "auto" } rlm_sql (sql1): Attempting to connect to database "kidsclub" rlm_sql (sql1): Processing generate_sql_clients rlm_sql (sql1) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserved connection (1) rlm_sql (sql1): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Released connection (1) # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "dailycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1529787600 [2018-06-24 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1529701200 [2018-06-23 00:00:00] # Instantiating module "monthlycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1530392400 [2018-07-01 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1527800400 [2018-06-01 00:00:00] # Instantiating module "noresetcounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 0 [2018-06-23 02:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 0 [2018-06-23 02:00:00] # Instantiating module "expire_on_login" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 0 [2018-06-23 02:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 0 [2018-06-23 02:00:00] # Instantiating module "weeklycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1529787600 [2018-06-24 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1529182800 [2018-06-17 00:00:00] # Instantiating module "quaterlycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: num=3, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1535749200 [2018-09-01 00:00:00] rlm_sqlcounter: num=3, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1522530000 [2018-04-01 00:00:00] # Instantiating module "yearlycounter" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: num=12, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1559336400 [2019-06-01 00:00:00] rlm_sqlcounter: num=12, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1498856400 [2017-07-01 00:00:00] # Instantiating module "accessperiod" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 0 [2018-06-23 02:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 0 [2018-06-23 02:00:00] # Instantiating module "counterChilliSpotMaxTotalOctetsDaily" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1529787600 [2018-06-24 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1529701200 [2018-06-23 00:00:00] # Instantiating module "counterChilliSpotMaxTotalOctetsWeekly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1529787600 [2018-06-24 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1529182800 [2018-06-17 00:00:00] # Instantiating module "counterChilliSpotMaxTotalOctetsMonthly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1530392400 [2018-07-01 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1527800400 [2018-06-01 00:00:00] # Instantiating module "counterChilliSpotMaxTotalOctetsQuarterly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: num=3, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1535749200 [2018-09-01 00:00:00] rlm_sqlcounter: num=3, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1522530000 [2018-04-01 00:00:00] # Instantiating module "counterChilliSpotMaxTotalOctetsYearly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: num=12, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1559336400 [2019-06-01 00:00:00] rlm_sqlcounter: num=12, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1498856400 [2017-07-01 00:00:00] # Instantiating module "counterChilliSpotMaxInputOctetsDaily" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1529787600 [2018-06-24 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1529701200 [2018-06-23 00:00:00] # Instantiating module "counterChilliSpotMaxInputOctetsWeekly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1529787600 [2018-06-24 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1529182800 [2018-06-17 00:00:00] # Instantiating module "counterChilliSpotMaxInputOctetsMonthly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1530392400 [2018-07-01 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1527800400 [2018-06-01 00:00:00] # Instantiating module "counterChilliSpotMaxInputOctetsQuarterly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: num=3, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1535749200 [2018-09-01 00:00:00] rlm_sqlcounter: num=3, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1522530000 [2018-04-01 00:00:00] # Instantiating module "counterChilliSpotMaxInputOctetsYearly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: num=12, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1559336400 [2019-06-01 00:00:00] rlm_sqlcounter: num=12, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1498856400 [2017-07-01 00:00:00] # Instantiating module "counterChilliSpotMaxOutputOctetsDaily" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1529787600 [2018-06-24 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1529701200 [2018-06-23 00:00:00] # Instantiating module "counterChilliSpotMaxOutputOctetsWeekly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1529787600 [2018-06-24 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1529182800 [2018-06-17 00:00:00] # Instantiating module "counterChilliSpotMaxOutputOctetsMonthly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1530392400 [2018-07-01 00:00:00] rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1527800400 [2018-06-01 00:00:00] # Instantiating module "counterChilliSpotMaxOutputOctetsQuarterly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: num=3, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1535749200 [2018-09-01 00:00:00] rlm_sqlcounter: num=3, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1522530000 [2018-04-01 00:00:00] # Instantiating module "counterChilliSpotMaxOutputOctetsYearly" from file /etc/freeradius/3.0/mods-enabled/sqlcounter rlm_sqlcounter: num=12, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Next reset 1559336400 [2019-06-01 00:00:00] rlm_sqlcounter: num=12, last=m rlm_sqlcounter: Current Time: 1529710915 [2018-06-23 02:41:55], Prev reset 1498856400 [2017-07-01 00:00:00] # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server dynamic_clients { # from file /etc/freeradius/3.0/sites-enabled/dynamic-clients # Loading authorize {...} } # server dynamic_clients server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server mydomaintest.com { # from file /etc/freeradius/3.0/sites-enabled/mydomaintest.com # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server mydomaintest.com radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 128 lifetime = 0 idle_timeout = 3600 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 45895 Listening on proxy address :: port 48176 Ready to process requests Philemon Jaomalaza -----Message d'origine----- De : Freeradius-Users [mailto:freeradius-users-bounces+philemon.jaomalaza=gmail.com@lists.freeradius.org] De la part de Alan Buxey Envoyé : vendredi 22 juin 2018 21:09 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Freeradius realm using multiple sql and virtual server post radiusd debug output, theres a slip or missing part here. the rest , from your description, sounds good alan On 22 June 2018 at 15:40, Philemon Jaomalaza <philemon.jaomalaza@gmail.com> wrote: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

This the output receiving packet when I try to authentificate for usertest1@mydomaintest.com with password: usertest1password (0) Received Access-Request Id 67 from 127.0.0.1:48406 to 127.0.0.1:1812 length 85 (0) User-Name = "usertest1@mydomaintest.com" (0) User-Password = "usertest1password" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "mydomaintest.com" for User-Name = "usertest1@mydomaintest.com" (0) suffix: Found realm "mydomaintest.com" (0) suffix: Adding Stripped-User-Name = "usertest1" (0) suffix: Adding Realm = "mydomaintest.com" (0) suffix: Proxying request from user usertest1 to realm mydomaintest.com (0) suffix: Preparing to proxy authentication request to realm "mydomaintest.com" (0) [suffix] = updated (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} (0) sql: --> usertest1 (0) sql: SQL-User-Name set to 'usertest1' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'usertest1' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'usertest1' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'usertest1' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'usertest1' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (2) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated (0) Starting proxy to home server 127.0.0.1 port 1812 (0) Proxying request to home server 127.0.0.1 port 1812 timeout 20.000000 (0) Sent Access-Request Id 136 from 0.0.0.0:49801 to 127.0.0.1:1812 length 99 (0) User-Name = "usertest1" (0) User-Password = "usertest1password" (0) Event-Timestamp = "Jun 23 2018 08:28:15 EAT" (0) NAS-IP-Address = 127.0.0.1 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x3637 Waking up in 0.3 seconds. (1) Received Access-Request Id 136 from 127.0.0.1:49801 to 127.0.0.1:1812 length 99 (1) User-Name = "usertest1" (1) User-Password = "usertest1password" (1) Event-Timestamp = "Jun 23 2018 08:28:15 EAT" (1) NAS-IP-Address = 127.0.0.1 (1) Message-Authenticator = 0x4ae66a88473e8c58666c1e669cc5a588 (1) Proxy-State = 0x3637 (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /@\./) { (1) if (&User-Name =~ /@\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "usertest1", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop (1) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} (1) sql: --> usertest1 (1) sql: SQL-User-Name set to 'usertest1' rlm_sql (sql): Reserved connection (3) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'usertest1' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'usertest1' ORDER BY id (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'usertest1' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'usertest1' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (3) (1) [sql] = notfound (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Post-Auth-Type REJECT { (1) sql: EXPAND .query (1) sql: --> .query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (4) (1) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} (1) sql: --> usertest1 (1) sql: SQL-User-Name set to 'usertest1' (1) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (1) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'usertest1', 'usertest1password', 'Access-Reject', '2018-06-23 08:28:15') (1) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'usertest1', 'usertest1password', 'Access-Reject', '2018-06-23 08:28:15') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (4) (1) [sql] = ok (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> usertest1 (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. (0) Expecting proxy response no later than 19.667290 seconds from now Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 136 from 127.0.0.1:1812 to 127.0.0.1:49801 length 24 (1) Proxy-State = 0x3637 Waking up in 3.9 seconds. (0) Marking home server 127.0.0.1 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 136 from 127.0.0.1:1812 to 127.0.0.1:49801 length 24 (0) Proxy-State = 0x3637 (0) # Executing section post-proxy from file /etc/freeradius/3.0/sites-enabled/default (0) post-proxy { (0) eap: No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = noop (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} (0) sql: --> usertest1 (0) sql: SQL-User-Name set to 'usertest1' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'usertest1', 'usertest1password', 'Access-Reject', '2018-06-23 08:28:15') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'usertest1', 'usertest1password', 'Access-Reject', '2018-06-23 08:28:15') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 3 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> usertest1@mydomaintest.com (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 67 from 127.0.0.1:1812 to 127.0.0.1:48406 length 20 Waking up in 2.9 seconds. (1) Cleaning up request packet ID 136 with timestamp +26 Waking up in 0.9 seconds. (0) Cleaning up request packet ID 67 with timestamp +26 Ready to process requests Philemon Jaomalaza -----Message d'origine----- De : Freeradius-Users [mailto:freeradius-users-bounces+philemon.jaomalaza=gmail.com@lists.freeradius.org] De la part de Alan DeKok Envoyé : samedi 23 juin 2018 04:53 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Freeradius realm using multiple sql and virtual server

On Jun 22, 2018, at 8:04 PM, Philemon Jaomalaza <philemon.jaomalaza@gmail.com> wrote:

This the output of freeradius -X

Which doesn't show the server receiving any packets. See: http://wiki.freeradius.org/list-help Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

for the moment, for each virtual server, I created a virtual server, its realm and its module sql but actually I do not know how to link them. where should I add: if realm1 sql1 elsif realm2 sql2 elsif realm3 sql3 else sql in the /freeradius/3.0/proxy.conf or in the /freeradius/3.0/mods-available/sql module? maybe that's the issues Philemon Jaomalaza Tél. : +261 (0) 32 05 113 26 Email : philemon.jaomalaza@gmail.com -----Message d'origine----- De : Freeradius-Users [mailto:freeradius-users-bounces+philemon.jaomalaza=gmail.com@lists.freeradius.org] De la part de Alan DeKok Envoyé : samedi 23 juin 2018 14:23 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Freeradius realm using multiple sql and virtual server

On Jun 23, 2018, at 1:34 AM, Philemon Jaomalaza <philemon.jaomalaza@gmail.com> wrote:

This the output receiving packet when I try to authentificate for usertest1@mydomaintest.com with password: usertest1password

And you've configured the server to use the "sql" module for all users. You've said previously that you want different domains to use different SQL modules. How did you configure that? i.e. how do you expect it to happen? It looks like you've configured multiple realms and SQL modules. But, (and the important thing here) haven't tied them together in any way. You should do something like: if realm1 sql1 elsif realm2 sql2 elsif realm3 sql3 else sql Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

All packets come from different NAS and each NAS must authenticate its users to a specific database, I thought a virtual server will select which database should I use because I saw that it calls the modules sql. and I would configure sql1 on virtual_server1 and sql2 on virtual_server2 and so on. My global scenario are : - Now, I have more Virtual Machine where run a freeradius, using database managed by daloradius for AAA and one NAS is for one VM. - I want to move all database on a single dedicated server who run a freeradius using multiple database. I want to that One NAS will authentificated their users on spcific database, I think that I can do the selection of database by using the virtuel server et do the select by realm. like this : NAS1-----> userfromnas1@realm1------virtual_server---->database1 NAS2 ----userfromnas2@realm2------virtual_server2-------> database2 What is the best scenarion to do this feature ? Philemon Jaomalaza -----Message d'origine----- De : Freeradius-Users [mailto:freeradius-users-bounces+philemon.jaomalaza=gmail.com@lists.freeradius.org] De la part de Alan DeKok Envoyé : samedi 23 juin 2018 17:17 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Freeradius realm using multiple sql and virtual server On Jun 23, 2018, at 8:30 AM, Philemon Jaomalaza <philemon.jaomalaza@gmail.com> wrote:

for the moment, for each virtual server, I created a virtual server, its realm and its module sql but actually I do not know how to link them.

Realms are global, as are modules.

where should I add: if realm1 sql1 elsif realm2 sql2 elsif realm3 sql3 else sql

in the /freeradius/3.0/proxy.conf or in the /freeradius/3.0/mods-available/sql module?

No. The "if / else" unlang keywords *cannot* go into proxy.conf or into a module configuration. They can *only* appear inside of a virtual server "authorize", etc. section. If you created a virtual server, why? How do you think that requests from the client get sent to a virtual server? Read raddb/sites-available/README. This documents how virtual servers work. If all packets are coming from one NAS, then virtual servers are not the answer. If each realm comes from a different NAS, then you can use virtual servers. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

FreeRADIUS does not connect to the database set on sql1 beacause I used pool = sql on the module sql1 so all connexion use the sql module config. I commented this line and it work now. Thank's for your help. Now, I can continue and can you suggested to decide what the best practice and give best performance and memory usage if I want to have a separate service per client : - define multiple virtual servers with one global "listen" section IP/port for all virtual server. - define multiple virtual servers and each server has its listen section IP/port difffrent - define single virtual servers and use if ....elsif....else to select the proper sql module. It will be for more than 10 NAS and can have more than 50 NAS Philemon Jaomalaza -----Message d'origine----- De : Freeradius-Users [mailto:freeradius-users-bounces+philemon.jaomalaza=gmail.com@lists.freeradius.org] De la part de Alan DeKok Envoyé : dimanche 24 juin 2018 01:58 À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Objet : Re: Freeradius realm using multiple sql and virtual server On Jun 23, 2018, at 12:30 PM, Philemon Jaomalaza <philemon.jaomalaza@gmail.com> wrote:

All packets come from different NAS and each NAS must authenticate its users to a specific database, I thought a virtual server will select which database should I use because I saw that it calls the modules sql. and I would configure sql1 on virtual_server1 and sql2 on virtual_server2 and so on.

Yes, that should happen if FreeRADIUS is configured properly.

My global scenario are :

- Now, I have more Virtual Machine where run a freeradius, using database managed by daloradius for AAA and one NAS is for one VM. - I want to move all database on a single dedicated server who run a freeradius using multiple database. I want to that One NAS will authentificated their users on spcific database, I think that I can do the selection of database by using the virtuel server et do the select by realm. like this : NAS1-----> userfromnas1@realm1------virtual_server---->database1 NAS2 ----userfromnas2@realm2------virtual_server2-------> database2

It's really more: NAS1-----> virtual_server1----> userfromnas1@realm1---->database1 It may also be good to check that people logging in at "NAS1" only use "realm1:.

What is the best scenarion to do this feature ?

As I said:

Read raddb/sites-available/README. This documents how virtual servers work.

Edit each "client" definition, and point the client to the proper virtual server. The documentation for this is in the file I already suggested you should read. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html