September 2012 - Freeradius-Users - lists.freeradius.org

Using username@example.com and plain username
by Kriston 19 Sep '12

19 Sep '12

I have users who log in as "username(a)example.com" and just as "username". How do I append @example.com only to those users who don't have @example.com already? I have a fairly generic FreeRADIUS 2.1.10 installation that connects to a MySQL server. I've tried a number of different things in dialup.conf but none have worked. Example 1: sql_user_name = "{%{Stripped-User-Name}:-%{User-Name}}@{%{Realm}:-example.com}" This results in a string in the SQL queries for User-Name that looks like "=7B:-username=7D@=7B:-example.com=7D". Example 2: I have also tried regular expressions like this: if ( %{User-Name} !~ /.example\.com/i) { sql_user_name = "%{User-Name}(a)example.com" } But this one results in a blank string for in the SQL queries that use sql_user_name. I'm open to any and all comments. Thank you.

3 2

Setting final response attributes for EAP
by Brian Candler 19 Sep '12

19 Sep '12

When a user logs into a wireless AP, I would to include some per-user response attributes, in particular Acct-Interim-Interval = 600 However freeradius -X shows that this isn't happening, and it appears to be because of the following stanza in the default config: # The example below uses module failover to avoid querying all # of the following modules if the EAP module returns "ok". # Therefore, your LDAP and/or SQL servers will not be queried # for the many packets that go back and forth to set up TTLS # or PEAP. The load on those servers will therefore be reduced. # eap { ok = return } What's the recommended solution here? Is it possible to distinguish between the final EAP accept and the earlier Access-Challenge, so that just the final response does a database lookup for the required user response attributes? Thanks, Brian.

3 3

Re: Using username@example.com and plain username
by Kriston 19 Sep '12

19 Sep '12

> Very well... I don't use a SQL database for users, but it occurs > to me that Arran's only slightly tongue-in-cheeck comment about > lonely curly braces might have convinced you to look at whether > all the characters in your sql_user_name string are being > properly escaped or quoted. Since 7B is the hex code for "left > curly bracket" and 7D for "right curly bracket", it seems that > those characters are being taken literally, rather than as part > of a variable construction. It looks like you're fairly close to > getting that to work... just experiment with some single quotes? > By the way, I got this idea by looking at the wiki: > http://wiki.freeradius.org/modules/Rlm_sql Steve Lovaas Thanks, Steve, I think I'm really close and I appreciate your suggestion as to why the variable substitution isn't working the way I thought it would. I have not seen whether it handles the substitution of "@example.com" properly yet, though. Thanks again, Kriston

2 1

Re: Using username@example.com and plain username
by Kriston 19 Sep '12

19 Sep '12

As expected, your correspondence has been worse than helpful. I have thoroughly read the documentation, example configuration files, and the Wiki. Why not prove to us all that any one of these resources contains the exact example that I am enquiring about. I'd love to be wrong, but I just don't see it in any of these resources. Is it a realm? Is it a variable substitution? This is what an online community is supposed to provide--help. And, Mr. DeKok, a correction is in order: you did *not* provide a working example, in spite of the fact that you claim that you did. I could look it up in your book but, oh, wait, that's right, there is no published book yet. Thanks for nothing. Kriston

3 2

RE: Using username@example.com an d plain username
by Lovaas,Steven 18 Sep '12

18 Sep '12

Very well... I don't use a SQL database for users, but it occurs to me that Arran's only slightly tongue-in-cheeck comment about lonely curly braces might have convinced you to look at whether all the characters in your sql_user_name string are being properly escaped or quoted. Since 7B is the hex code for "left curly bracket" and 7D for "right curly bracket", it seems that those characters are being taken literally, rather than as part of a variable construction. It looks like you're fairly close to getting that to work... just experiment with some single quotes? By the way, I got this idea by looking at the wiki: http://wiki.freeradius.org/modules/Rlm_sql Steve Lovaas ________________________________________ From: freeradius-users-bounces+steven.lovaas=colostate.edu(a)lists.freeradius.org [freeradius-users-bounces+steven.lovaas=colostate.edu(a)lists.freeradius.org] on behalf of Kriston [me(a)kriston.net] Sent: Tuesday, September 18, 2012 8:52 PM To: FreeRadius users mailing list Subject: Re: Using username(a)example.com and plain username As expected, your correspondence has been worse than helpful. I have thoroughly read the documentation, example configuration files, and the Wiki. Why not prove to us all that any one of these resources contains the exact example that I am enquiring about. I'd love to be wrong, but I just don't see it in any of these resources. Is it a realm? Is it a variable substitution? This is what an online community is supposed to provide--help. And, Mr. DeKok, a correction is in order: you did *not* provide a working example, in spite of the fact that you claim that you did. I could look it up in your book but, oh, wait, that's right, there is no published book yet. Thanks for nothing. Kriston - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

error of segmentation during the implementation of eap2
by arnauld ndefo 18 Sep '12

18 Sep '12

Hi everyone, i want to implement the freeradius with eap-psk. In many forum it is recommend to read the experimental.conf for configure the module eap2. After reading the experimental.conf, i have created the file eap2.conf which is attached to my email. Also, in the radius.conf, i have put in module section $INCLUDE eap2.conf. In the default file, i have put in the authenticate section eap2 { ok = return}; replace in that file, all the eap by eap2. When i launch the radius with export LD_PRELOAD=/home/dibus/hostap-06/eap_example/libeap.so && radiusd -X ; i have the output which is in file sortie_freerad_ubuntu. At the end, you will see and error of segmentation when it starts to load the module files Someone can help me to find the issue please??? It is very urgent for me. Thank you for your help.

4 17

unlang time / date comparison
by Franks Andy (RLZ) IT Systems Engineer 18 Sep '12

18 Sep '12

Hi, Hopefully a simple question. I've looked around for a while but can't find the answer to this. I'd like to be able to take a date/time from a sql database, use unlang (not a module) to compare it to the current time and make a decision based on the fact that it's, for example, less or more than 3600 seconds/60 minutes/1 hour etc ago. I can't really work out the comparison of dates, or simple mathematical functions for that matter. Perhaps I'm missing something obvious - apologies if so, I've not been using FR for that long. Thanks as always. Andy

3 3

Discarding of Access Requests by Radius server
by ramakrishna 18 Sep '12

18 Sep '12

Hi I am using FreeRADIUS 2.1.12 and I have some queries regarding the working of Radius server. 1) Does Radius server discard any Access Request messages for any reasons? 2) If Radius server received two Access Requests with different attributed but with same identifier within short span of time, How does Radius server behave? Any help is highly appreciated. Thanks in Advance. -- Best Regards, M.Rama Krishna Prasad,

2 1

Customization of RADIUS reply
by Václav Pernica 18 Sep '12

18 Sep '12

Hello I’m configuring the FreeRADIUS together with the Oracle DB. I need to get the user authenticated and in the reply provide the parameter "mailbox_fullname" from the DB. The Oracle DB has for my purpose only one view which contains the following columns. mailbox_id,mailbox_email,mailbox_fullname,mailbox_password I created new attribute in dictionary: ATTRIBUTE Full-Mailbox-Name 3000 string And customized the SQL queries as following (dialup.conf): authorize_check_query = "SELECT mailbox_id,mailbox_email,'Cleartext-Password',mailbox_password,':=' FROM ${authcheck_table} WHERE mailbox_email = '%{SQL-User-Name}' ORDER BY mailbox_id" authorize_reply_query = "SELECT mailbox_id,mailbox_email,'Full-Mailbox-Name',mailbox_fullname,':=' FROM ${authreply_table} WHERE mailbox_email = '%{SQL-User-Name}' ORDER BY mailbox_id" The user authentication works, however I need to have in the reply the value of “mailbox_fullname” from DB query. Instead of it, there is nothing. Could you please advise how to get in the reply “mailbox_fullname” for the corresponding mailbox_email? Here is the sample radtest output and in attachment full output from debug mode. radtest -x a00000012 password localhost 0 testing123 Sending Access-Request of id 26 to 127.0.0.1 port 1812 User-Name = "a00000012" User-Password = "password" NAS-IP-Address = 10.7.96.25 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=26, length=20 Thanks a lot! Vaclav

3 6

proxied server and right flamed IP to ppp clients
by lscrlstld 18 Sep '12

18 Sep '12

Is there any way to ensure (or check) that the proxied server assigned a right framed IP within a specific range of IPs? unlang perhaps? Main Server proxy to +-> freeradius Server 1 | (must be use ip pool 10.0.0.0/24) +------+ | | | +-> freeradius Server 2 | (must be use ip pool 10.0.1.0/24) | Main server check if the framed IP is within the correct pool, if not reject. Thank you.

3 4