From bac33ab83efebbcfe58a1761b43a09fcd1122351 Mon Sep 17 00:00:00 2001 From: Faiq Shad Date: Wed, 9 Sep 2026 21:00:41 -0400 Subject: [PATCH] net/freeradius: simultaneous-use verify query must select by user, not group simul_verify_query filters radacct on %{SQL-Group}, which is empty on an Access-Request, so the verify step finds no live session and Simultaneous-Use never rejects: every extra login is accepted even with the sessions in radacct. The count query beside it already uses %{SQL-User-Name}, and so does the stock FreeRADIUS sqlite dialect. Use the same here. Measured on 26.7.3 with the captive portal as the client, radiusd -X: with two open rows and Simultaneous-Use := 2, before this change Access-Accept; after it, "Multiple logins (max 2)" and Access-Reject. --- .../opnsense/service/templates/OPNsense/Freeradius/queries.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/queries.conf b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/queries.conf index 7345a9b887..0300c53528 100644 --- a/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/queries.conf +++ b/net/freeradius/src/opnsense/service/templates/OPNsense/Freeradius/queries.conf @@ -157,7 +157,7 @@ simul_verify_query = "\ SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, \ callingstationid, framedprotocol \ FROM ${acct_table1} \ - WHERE username = '%{${group_attribute}}' \ + WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" #######################################################################