September 2012 - Freeradius-Users - lists.freeradius.org

.rpmnew files during RPM upgrade
by Jonathan Gazeley 10 Oct '12

10 Oct '12

I rolled and deployed an RPM of FreeRADIUS 2.2.0. As expected for RPM packages, it left a number of *.rpmnew files in /etc/raddb. Trouble is, FreeRADIUS reads these files as live configs and was unable to start after the upgrade, until I had manually intervened and deleted the .rpmnew files. This isn't a new issue, I found this old thread in the archive: http://lists.freeradius.org/pipermail/freeradius-users/2008-December/033694… It seems to me that the "broken" behaviour is not with RPM but with FreeRADIUS. Can the regular expression that includes config files and modules be tweaked to exclude *.rpmnew files? It would be nice if an automated package management system didn't require manual intervention to ensure that a critical service keeps running upon upgrade. If I hadn't rolled my own RPM, I would eventually have received an overnight update from CentOS, and my RADIUS servers would have remained broken until the morning. That's something I'd rather avoid, and something a lot of other admins would run into as well. I don't really know much C but I looked at the source code. Blacklisting specific file suffixes seems like a bad way to do it, but I suppose it's too late now to insist that all config files end with .conf. Any other ideas? Thanks, Jonathan

6 8

Execution of rlm code when remote server is not responding.
by Arka Sharma 08 Oct '12

08 Oct '12

Hi, I have a remote PPS server where I am proxying radius requests coming from the NAS. I have a requirement like when that remote PPS goes down(which I am simulating by setting a wrong ip in proxy.conf realm configuration) then I have to perform a certain task in rlm code.But my observation is when I am setting a dummy ip for PPS, the radius server running on my machine is marking that remote server as zombie after 3 retries,now I want in this case that my rlm code to execute and handle the scenario when remote server is down.Any help will be highly appreciated.Also I may have used some naive terminology being a newbie apologizing for that. Regards, Arka

3 7

bugs.freeradius.org unavailable?
by endo mitsuharu 05 Oct '12

05 Oct '12

Hello, First of all, I would like to express my utmost appreciation for being able to use FreeRADIUS, most especially to everyone involved in the development. In this regard, I tried accessing the "Report a Bug" link (http://bugs.freeradius.org/) posted in FreeRADIUS official web site. However, there seems to be a problem reaching the "Report a Bug" link. I've tried from two different local ISPs without any luck. I would like to refer to the existing bug report, so I would like to ask if bugs.freeradius.org is dead or if the URL has been changed. (or is it just me.) Any information regarding the access problem would greatly help. Please also inform me if this inquiry has been directed to the incorrect recipients and as to where this inquiry be posted. Thank you and hoping for your feedback. --- Thanks, Endo

4 15

access-period-time
by John Doe 01 Oct '12

01 Oct '12

Hi all, this's my first post in this list at this time!!! i need some users can connect at least 3 times in a hour, for example if user1 connect at 8:00 AM limit him connect again in 15 minutes again, really i try it but not work for me. PLEASE THANKS in advance Johndoesms PD) sorry for my english i do not speak it

3 9

Using ldap_xlat in unlang with Chars not allowed in an ldap search
by Daniel Finger 01 Oct '12

01 Oct '12

Hi! I have a Problem using the ldap Module to search in the ldap Tree for a specific Attribute Containing a (. I am using FreeRadius (2.1.12) for 802.1X Authentification (EAP-TLS) which is working fine. After successful EAP Authentication, I want to check if the User has an Entry in the LDAP: During authenticate (I just changed a bit of formattig to have it readable here): Auth-Type eap { eap # Some Code to react to EAP Auth Failures if ( "%{TLS-Client-Cert-Common-Name}" != "" ) { update control { Tmp-String-1 = "%{ldap_WLAN_auth: ldap:///cn=UserAccounts,dc=DE?cn?sub? ( & (CommonName=%{TLS-Client-Cert-Common-Name}) (allowedSSID=%{Aruba-Essid-Name}) )}" } if ("%{control:Tmp-String-1}" == "") { update control { Auth-Type := "Reject" } update reply { Reply-Message = "The user %{User-Name} is not known or allowed to access the SSID %{Aruba-Essid- Name}" } reject } Now the {TLS-Client-Cert-Common-Name} contains a ( and a ) which leads to a bad search filter: |Debug: [ldap_WLAN_auth] - ldap_xlat |Info: expand: ldap:///cn=UserAccounts,dc=NI-NGN,dc=DE?cn?sub?(&(CommonName=%{TLS-Client-Cert-Common-Name})(allowedSSID=%{Aruba-Essid-Name})) -> ldap:///cn=UserAccounts,dc=DE?cn?sub?(&(CommonName=Testuser(10) Daniel)(allowedSSID=ssid-data)) |Debug: [ldap_WLAN_auth] ldap_get_conn: Checking Id: 0 |Debug: [ldap_WLAN_auth] ldap_get_conn: Got Id: 0 |Debug: [ldap_WLAN_auth] performing search in cn=UserAccounts,dc=DE, with filter (&(CommonName=Testuser(10) Daniel)(allowedSSID=ssid-data)) |ldap_search() failed: Bad search filter: (&(CommonName=Testuser(10) Daniel)(allowedSSID=ssid-data)) |Debug: [ldap_WLAN_auth] Search returned error |Debug: [ldap_WLAN_auth] ldap_release_conn: Release Id: 0 |Info: expand: %{ldap_WLAN_auth:ldap:///cn=UserAccounts,dc=DE?cn?sub?(&(CommonName=%{TLS-Client-Cert-Common-Name})(allowedSSID=%{Aruba-Essid-Name}))} -> If I have searched correctly it should work if I rewrite the Attribute with \28 for ( and \29 for ) (as ascii string, not escaped :-)) As it seems the rewrite Module is not the solution as i could not get it to do this :-) It works as I expected it to do if the CommonName does not contain the Parentheses. Any Ideas to work around these Parentheses? Preferably using any Char allowed in the Common Name, as i expect it to contain Umlauts or an & Char. Greetings, Daniel

2 3

Pushing a policy for usergroup and calling station id from Free Radius Server
by Subhani sk m 30 Sep '12

30 Sep '12

Hi, I am using free radius on Linux, Fedora 13. I am able to push policy for a user.. I need help on two scenarios given below. 1.how to push policy for a specific usergroup from free radius sever 2. how to push a policy for a specific Calling-Station-ID like 00:16:6F:A2:XX:XX [ no user specific policy returned] Thanks in advance. Regards, Subhani

2 3

(no subject)
by Bryan Dobson 28 Sep '12

28 Sep '12

Thank you for the reply Thomas, this is the results of searching for that: /usr/lib64/mysql/libmysqlclient.so.16 /usr/lib64/mysql/libmysqlclient.so.16.0.0 /usr/lib64/mysql/libmysqlclient_r.so.16 /usr/lib64/mysql/libmysqlclient_r.so.16.0.0 All of that is your standard libraries included in the RPM package and fairly common really so far as I can see. >Hello Bryan, > >> [root@radiusdev ~]# rpm -qa | grep mysql >> mysql-5.1.61-4.el6.x86_64 >> mysql-devel-5.1.61-4.el6.x86_64 >> mysql-libs-5.1.61-4.el6.x86_64 >> mysql-server-5.1.61-4.el6.x86_64 > >they all belong to same release. > >> Do I need all of those or is one causing me the issue still with the >> faults? > >What does 'find /usr -name libmysql\*.so' say? > >Cheers, > Thomas

1 0

Re: MySQL Segmentation Fault
by Bryan Dobson 28 Sep '12

28 Sep '12

Thank you for the reply, I thought this as well, but, checking the system all I only see a single set of client libraries installed: [root@radiusdev ~]# rpm -qa | grep mysql mysql-5.1.61-4.el6.x86_64 mysql-devel-5.1.61-4.el6.x86_64 mysql-libs-5.1.61-4.el6.x86_64 mysql-server-5.1.61-4.el6.x86_64 Do I need all of those or is one causing me the issue still with the faults? Bryan Dobson wrote: >> I have a new installation and configuration that I am working on for >> FreeRadius on CentOS 6.3 the versions are: >> >> freeradius-2.1.12-3.el6.x86_64 >> >> Testing authentication, which goes to a remote MySQL database which >> was pre-existing with all user data. It executes the query and then >> immediately gives me a segmentation fault. Of note I have also >> compiled version 2.2 from source and receive the exact same error. I >> would prefer, if a tall possible to stick to using the RPM's from the >> distribution. > > You have two versions of the MySQL client libraries and/or headers > installed. Go fix that. > > Alan DeKok.

3 2

Load-Balance-Key usage
by lscrlstld 28 Sep '12

28 Sep '12

Hi, Can I use the Load-Balance-Key to choose a specific home_server? For sample: home_server_pool pool { type = keyed-balance home_server = server1 home_server = server2 } realm test { auth_pool = pool acct_pool = pool } authorize { ... if ( ... ) { update control { Load-Balance-Key := 1} #sends to server1 } else { update control { Load-Balance-Key := 2} #sends to server2 } ... } Thanks! JJP

3 2

MySQL Segmentation Fault
by Bryan Dobson 28 Sep '12

28 Sep '12

I have a new installation and configuration that I am working on for FreeRadius on CentOS 6.3 the versions are: freeradius-2.1.12-3.el6.x86_64 Testing authentication, which goes to a remote MySQL database which was pre-existing with all user data. It executes the query and then immediately gives me a segmentation fault. Of note I have also compiled version 2.2 from source and receive the exact same error. I would prefer, if a tall possible to stick to using the RPM's from the distribution. Including relevant output from "radiusd -X" below: rlm_sql Creating new attribute sql_acctlocal-SQL-Group rlm_sql (sql_acctlocal): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_acctlocal): Attempting to connect to radius@localhost:/radiusdb rlm_sql (sql_acctlocal): starting 0 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_acctlocal): Connected new DB handle, #0 rlm_sql (sql_acctlocal): starting 1 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_acctlocal): Connected new DB handle, #1 rlm_sql (sql_acctlocal): starting 2 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_acctlocal): Connected new DB handle, #2 rlm_sql (sql_acctlocal): starting 3 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_acctlocal): Connected new DB handle, #3 rlm_sql (sql_acctlocal): starting 4 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_acctlocal): Connected new DB handle, #4 Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 39929 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38243, id=224, length=91 User-Name = "mci-test(a)znidomain.com" User-Password = "e9d9d2jc23o330k" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0xcf05723e13f3a4e69256bb129551e1ef # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++- entering policy filter_username {...} +++? if (User-Name =~ /^ /) ? Evaluating (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ / $$/) ? Evaluating (User-Name =~ / $$/) -> FALSE +++? if (User-Name =~ / $$/) -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") expand: %{User-Name} -> mci-test(a)znidomain.com expand: %{tolower:%{User-Name}} -> mci-test(a)znidomain.com ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE ++- policy filter_username returns notfound ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "uniserve.com" for User-Name = "mci-test(a)uniserve.com" [suffix] Found realm "uniserve.com" [suffix] Adding Stripped-User-Name = "mci-test" [suffix] Adding Realm = "uniserve.com" [suffix] Proxying request from user mci-test to realm uniserve.com [suffix] Preparing to proxy authentication request to realm "uniserve.com" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql_authremote] expand: %{Stripped-User-Name} -> mci-test [sql_authremote] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> mci-test [sql_authremote] sql_set_user escaped user --> 'mci-test' rlm_sql (sql_authremote): Reserving sql socket id: 4 [sql_authremote] expand: SELECT id, u.username, u.password as value FROM users u, classes c WHERE u.username = '%{SQL-User-Name}' AND u.class = c.classid AND c.dial = 'Y' AND u.realm = (select realmid from realms where domainname = '%{Realm}') ORDER BY id -> SELECT id, u.username, u.password as value FROM users u, classes c WHERE u.username = 'mci-test' AND u.class = c.classid AND c.dial = 'Y' AND u.realm = (select realmid from realms where domainname = 'znidomain.com') ORDER BY id Segmentation fault

2 1