October 2013 - Freeradius-Users - lists.freeradius.org

Flow Chat For FR
by Russell Mike 24 Oct '13

24 Oct '13

Dear List, i want to understand Freeradius and process flow, i was looking for flow chat for FR. Can anyone please help? Thanks / RM--

3 2

Problem building 2.2.1 without OpenSSL
by Caines, Max 24 Oct '13

24 Oct '13

HI I recently built FR using: ./configure --with-openssl=no --without-rlm_eap_peap --without-rlm_eap_tls --without-rlm_eap_ttls --without-rlm_otp --without-rlm_sql_postgres --without-snmp I still got an unsatisfied reference from src/main/radius.c line 258, which calls "ssl_check_version", which of course needs the OpenSSL library. It was easy to fix, but I thought I should let you know Regards Max Max Caines | Network Design Consultant | IT Services | University of Wolverhampton | 01902 322245 | 07976 841874 | Max.Caines(a)wlv.ac.uk<mailto:Max.Caines@wlv.ac.uk> For contact details and general information on IT Services please visit http://www.wlv.ac.uk/its This email, together with any attachment, is for the exclusive and confidential use of the addressee(s) and may contain legally privileged information. If you receive this email in error, please visit http://www.wlv.ac.uk/ITS-disclaimer . Please consider the environment before printing this e-mail. -- Scanned by iCritical.

2 1

RE: Regex question
by Franks Andy (RLZ) IT Systems Engineer 24 Oct '13

24 Oct '13

Hi, thanks for the reply. My original regex was /^email:([a-z0-9_-]+(\\.[a-z0-9_-]+)*@[a-z0-9_-]+(\\.[a-z0-9_-]+)*(\\.[a -z]{2,4}))/ <mailto:*@[a-z0-9_-]+(\\.%5ba-z0-9_-%5d+)*(\\.%5ba-z%5d%7b2,4%7d))/> You're correct with the escaping thing, I was just quickly trying a shorter simpler version. I didn't know you needed to escape characters inside a match [] though. Anyway, online testers are working fine, just FR or the internal regex library that isn't. I tried compiling with and without libpcre3-dev and no change. Thanks Andy From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of JDL Sent: 23 October 2013 21:54 To: FreeRadius users mailing list Subject: Re: Regex question Not speaking to any FreeRADIUS issues but just to the regular expression, you typically need to escape the period, dash, and other special characters within the pattern if you are looking to match them. For example ^email:([a-z0-9\._\-]+@[a-z0-9\.\-]+\.[a-z]{2,4} <mailto:+@[a-z0-9\.\-%5d+\.%5ba-z%5d%7b2,4%7d> ) There are a number of regex test tools on the web as well as tools you can download and install. I would suggest that you start with those and make sure the pattern is working first and then try to implement it in FreeRADIUS. Jim Lohiser Imagine Net, inc. On Oct 23, 2013, at 4:36 PM, Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> wrote: Hi All, Got a regex thing I can't explain, but it may of course be down to my inexperience with regexs generally. Please forgive the non-ideal email address regex, it's not great, but not really my focus here at this point, I aim to improve it. For now it's as simple as I can make it, having paired it down to hopefully find the problem. We're using a captive portal which only allows pass-through of a username and password as user "fields". The system uses voucher auth, so we don't actually use the password field for a password, rather using it to capture email address, browser agent, version and OS details from the client's browser. This is a via the user-password string in the format field:<string> field2:<string> - fields, with the string following a colon, separated by spaces. e.g. email:my.email@address.com browseragent:safari version:7 os:ios5 The string is passed through a few regexes, each picking off the field string in a capture group. It's failing on the first, the email regex being pretty simple: ^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4} <mailto:+@[a-z0-9.-]+/.%5ba-z%5d%7b2,4%7d> ) I've tried various delimiters but all result in the same issue: email:my.email@address.com,browseragent:safari,version:7,os:ios5 email:my.email@address.com#browseragent:safari#version:7#os:ios5 I've also tried compiling with and without libpcre3-dev, same - the regex is not stopping at the space or , or #, whatever delimiter I choose. The non email regexes seem to work ok.. Code : (in policy.d folder) email_regexp= "^email:([a-z0-9._-]+@[a-z0-9.-]+\\.[a-z]{2,4} <mailto:+@[a-z0-9.-]+\\.%5ba-z%5d%7b2,4%7d> )" if ("%{User-Password}" =~ /${policy.email_regexp}/){ update control { Email-Address := "%{1}" } } Result: ? if ("%{User-Password}" =~ /^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4})/ <mailto:+@[a-z0-9.-]+\.%5ba-z%5d%7b2,4%7d)/> ) (0) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (0) ? if ("%{User-Password}" =~ /^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4})/ <mailto:+@[a-z0-9.-]+\.%5ba-z%5d%7b2,4%7d)/> ) -> TRUE (0) if ("%{User-Password}" =~ /^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4})/ <mailto:+@[a-z0-9.-]+\.%5ba-z%5d%7b2,4%7d)/> ) { (0) update control { (0) expand: "%{1}" -> 'my.email(a)address.com brow' (0) Email-Address := "my.email(a)address.com brow" (0) } # update control = noop (0) [noop] = noop (0) } # if ("%{User-Password}" =~ /^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4})/ <mailto:+@[a-z0-9.-]+\.%5ba-z%5d%7b2,4%7d)/> ) = noop (0) ... skipping else for request 0: Preceding "if" was taken (0) } # check_email_address check_email_address = noop (0) check_browser_agent check_browser_agent { (0) ? if ("%{User-Password}" =~ /browseragent:([a-z0-9_-]+)/) (0) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (0) ? if ("%{User-Password}" =~ /browseragent:([a-z0-9_-]+)/) -> TRUE (0) if ("%{User-Password}" =~ /browseragent:([a-z0-9_-]+)/) { (0) update control { (0) expand: "%{1}" -> 'safari' (0) Browser-Agent := "safari" (0) } # update control = noop (0) } # if ("%{User-Password}" =~ /browseragent:([a-z0-9_-]+)/) = noop (0) } # check_browser_agent check_browser_agent = noop (0) check_browser_version check_browser_version { (0) ? if ("%{User-Password}" =~ /version:([a-z0-9_-]+)/) (0) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (0) ? if ("%{User-Password}" =~ /version:([a-z0-9_-]+)/) -> TRUE (0) if ("%{User-Password}" =~ /version:([a-z0-9_-]+)/) { (0) update control { (0) expand: "%{1}" -> '7' (0) Browser-Version := "7" (0) } # update control = noop (0) } # if ("%{User-Password}" =~ /version:([a-z0-9_-]+)/) = noop (0) } # check_browser_version check_browser_version = noop (0) check_browser_os check_browser_os { (0) ? if ("%{User-Password}" =~ /os:([a-z0-9_-]+)$/) (0) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (0) ? if ("%{User-Password}" =~ /os:([a-z0-9_-]+)$/) -> TRUE (0) if ("%{User-Password}" =~ /os:([a-z0-9_-]+)$/) { (0) update control { (0) expand: "%{1}" -> 'ios5' (0) Browser-OS := "ios5" I also tried a different regex, but the problems seem worse there.. ? if ("%{User-Password}" =~ /^email:([a-z0-9_-]+(\.[a-z0-9_-]+)*@[a-z0-9_-]+(\.[a-z0-9_-]+)*(\.[a-z] {2,4}))/) <mailto:*@[a-z0-9_-]+(\.%5ba-z0-9_-%5d+)*(\.%5ba-z%5d%7b2,4%7d))/)> (1) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (1) ? if ("%{User-Password}" =~ /^email:([a-z0-9_-]+(\.[a-z0-9_-]+)*@[a-z0-9_-]+(\.[a-z0-9_-]+)*(\.[a-z] {2,4}))/) <mailto:*@[a-z0-9_-]+(\.%5ba-z0-9_-%5d+)*(\.%5ba-z%5d%7b2,4%7d))/)> -> TRUE (1) if ("%{User-Password}" =~ /^email:([a-z0-9_-]+(\.[a-z0-9_-]+)*@[a-z0-9_-]+(\.[a-z0-9_-]+)*(\.[a-z] {2,4}))/) <mailto:*@[a-z0-9_-]+(\.%5ba-z0-9_-%5d+)*(\.%5ba-z%5d%7b2,4%7d))/)> { (1) update control { (1) expand: "%{1}" -> 'my.email(a)address.com browseragent:safari version:7 os:ios' (1) Email-Address := "my.email(a)address.com browseragent:safari version:7 os:ios" (1) } # update control = noop Any ideas what I'm doing wrong? Thanks andy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Check_Item Is Always Equal To 0 When 2^32
by Russell Mike 24 Oct '13

24 Oct '13

Hello FR Gurus Any idea ? If I put a value lesser than 2^32. i.e. 4294967290 for “ ChilliSpot-Max-Total-Octets” in radgroupcheck, value can be read by FreeRadius and check_item has the correct value (4294967290). If I put value bigger than 2^32, (8589934592) check_item is always equal to 0. Thanks / Regards RM--

5 8

Re: What does FR 2.2.2 fix?
by Alex Sharaz 24 Oct '13

24 Oct '13

Is there n update on whether this is fixed? Think there were two bugs, one hidden by another and then Alan Buxey said he was having problems with the “fixed” code with the server locking up. There are some things in 2.2.1 I’d like to use that don’t seem to work in vanilla 2.2.0 Rgds Alex On 4 Oct 2013, at 12:00, Alex Sharaz <alex.sharaz(a)york.ac.uk> wrote: > Hmm > like these then? > > Fri Oct 4 11:24:12 2013 : Info: WARNING: Child is hung for request 17630 in com > ponent <core> module <thread>. > Fri Oct 4 11:24:13 2013 : Info: WARNING: Child is hung for request 17635 in com > ponent <core> module <thread>. > Fri Oct 4 11:24:14 2013 : Info: WARNING: Child is hung for request 17634 in com > ponent <core> module <thread>. > Fri Oct 4 11:24:17 2013 : Info: WARNING: Child is hung for request 17636 in com > ponent <core> module <thread>. > Fri Oct 4 11:24:44 2013 : Info: WARNING: Child is hung for request 17633 in com > ponent <core> module <thread>. > Fri Oct 4 11:24:52 2013 : Info: WARNING: Child is hung for request 17635 in com > ponent <core> module <thread>. > Fri Oct 4 11:24:53 2013 : Info: WARNING: Child is hung for request 17634 in com > ponent <core> module <thread>. > Fri Oct 4 11:24:55 2013 : Info: WARNING: Child is hung for request 17636 in com > ponent <core> module <thread>. > > Reverted back t > > On 4 Oct 2013, at 11:53, A.L.M.Buxey(a)lboro.ac.uk wrote: > >> Hi, >> >> a couple of logic issues that meant case/switch and if() worked different >> to 2.x - thats been fixed. ..and an issue if your server does a lot of proxying >> work - in which worker threads arent dealt with properly - your log file >> will be full of <core> and <module> messages if you are being hit. this *MIGHT* >> be fixed in HEAD. we are testing at the moment (looking good). if you arent doing >> the former and not hit by the latter you dont need to worry. >> >> >> alan >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

2 2

Free Raidus Support
by Yazan Jaber 24 Oct '13

24 Oct '13

Dears, Am looking for a free radius support for or company, can anybody help us in this regard. Regards, From: freeradius-users-bounces+yazan.jaber=newroztelecom.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+yazan.jaber=newroztelecom.com@lists.freeradius.org] On Behalf Of Fajar A. Nugraha Sent: Thursday, October 24, 2013 10:51 AM To: FreeRadius users mailing list Subject: Re: Flow Chat For FR On Thu, Oct 24, 2013 at 2:47 PM, Russell Mike <radius.sir(a)gmail.com<mailto:radius.sir@gmail.com>> wrote: Dear List, i want to understand Freeradius and process flow, i was looking for flow chat for FR. Can anyone please help? http://wiki.freeradius.org/guide/Concepts -- Fajar

6 9

Patch request for EAP-AKA on freeradius 2.2.1
by B, Madhu (CMS) 24 Oct '13

24 Oct '13

Hi all, Can anyone share the patch for EAP-AKA on 2.2.1 Freeradius version. Thanks and regards, Madhu B

2 1

How to properly disable a module via configure
by JDL 23 Oct '13

23 Oct '13

Hello List, I am working on a RPM spec file for FreeRADIUS using the spec file from git repository. I am trying to incorporate optional builds for some of the experimental modules. I am running into problems trying to disable modules. Specifically, I am seeing the issue with rlm_ruby. My configure options are as follows. ./configure --host=x86_64-redhat-linux-gnu --build=x86_64-redhat-linux-gnu --program-prefix= --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --libdir=/usr/lib64/freeradius --with-system-libtool --disable-ltdl-install --with-gnu-ld --with-threads --with-thread-pool --with-docdir=/usr/share/doc/freeradius-3.0.1 --with-rlm-sql_postgresql-include-dir=/usr/include/pgsql --with-rlm-sql-postgresql-lib-dir=/usr/lib64 --with-rlm-sql_mysql-include-dir=/usr/include/mysql --with-mysql-lib-dir=/usr/lib64/mysql --with-unixodbc-lib-dir=/usr/lib64 --with-rlm-dbm-lib-dir=/usr/lib64 --with-rlm-krb5-include-dir=/usr/kerberos/include --without-rlm_eap_ikev2 --without-rlm_sql_iodbc --without-rlm_sql_firebird --without-rlm_sql_db2 --without-rlm_sql_oracle --with-experimental-modules --with-rlm_sql_freetds --without-rlm_redis --without-rlm_rest --without-rlm_ruby When configure hits the rlm_ruby modules, it seems to see that it is supposed to be disabled. *** module rlm_ruby is disabled. However, when it gets to the build section, it errors out with the following. CC src/modules/rlm_ruby/rlm_ruby.c src/modules/rlm_ruby/rlm_ruby.c:44:18: error: ruby.h: No such file or directory src/modules/rlm_ruby/rlm_ruby.c:73: error: expected specifier-qualifier-list before 'VALUE' [many more errors] make: *** [build/objs/src/modules/rlm_ruby/rlm_ruby.lo] Error 1 Shouldn't the build be skipped if the module is disabled by configure? Thanks, Jim Lohiser Imagine Net, Inc.

2 4

Regex question
by Franks Andy (RLZ) IT Systems Engineer 23 Oct '13

23 Oct '13

Hi All, Got a regex thing I can't explain, but it may of course be down to my inexperience with regexs generally. Please forgive the non-ideal email address regex, it's not great, but not really my focus here at this point, I aim to improve it. For now it's as simple as I can make it, having paired it down to hopefully find the problem. We're using a captive portal which only allows pass-through of a username and password as user "fields". The system uses voucher auth, so we don't actually use the password field for a password, rather using it to capture email address, browser agent, version and OS details from the client's browser. This is a via the user-password string in the format field:<string> field2:<string> - fields, with the string following a colon, separated by spaces. e.g. email:my.email@address.com browseragent:safari version:7 os:ios5 The string is passed through a few regexes, each picking off the field string in a capture group. It's failing on the first, the email regex being pretty simple: ^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4}) I've tried various delimiters but all result in the same issue: email:my.email@address.com,browseragent:safari,version:7,os:ios5 email:my.email@address.com#browseragent:safari#version:7#os:ios5 I've also tried compiling with and without libpcre3-dev, same - the regex is not stopping at the space or , or #, whatever delimiter I choose. The non email regexes seem to work ok.. Code : (in policy.d folder) email_regexp= "^email:([a-z0-9._-]+@[a-z0-9.-]+\\.[a-z]{2,4})" if ("%{User-Password}" =~ /${policy.email_regexp}/){ update control { Email-Address := "%{1}" } } Result: ? if ("%{User-Password}" =~ /^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4})/) (0) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (0) ? if ("%{User-Password}" =~ /^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4})/) -> TRUE (0) if ("%{User-Password}" =~ /^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4})/) { (0) update control { (0) expand: "%{1}" -> 'my.email(a)address.com brow' (0) Email-Address := "my.email(a)address.com brow" (0) } # update control = noop (0) [noop] = noop (0) } # if ("%{User-Password}" =~ /^email:([a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,4})/) = noop (0) ... skipping else for request 0: Preceding "if" was taken (0) } # check_email_address check_email_address = noop (0) check_browser_agent check_browser_agent { (0) ? if ("%{User-Password}" =~ /browseragent:([a-z0-9_-]+)/) (0) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (0) ? if ("%{User-Password}" =~ /browseragent:([a-z0-9_-]+)/) -> TRUE (0) if ("%{User-Password}" =~ /browseragent:([a-z0-9_-]+)/) { (0) update control { (0) expand: "%{1}" -> 'safari' (0) Browser-Agent := "safari" (0) } # update control = noop (0) } # if ("%{User-Password}" =~ /browseragent:([a-z0-9_-]+)/) = noop (0) } # check_browser_agent check_browser_agent = noop (0) check_browser_version check_browser_version { (0) ? if ("%{User-Password}" =~ /version:([a-z0-9_-]+)/) (0) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (0) ? if ("%{User-Password}" =~ /version:([a-z0-9_-]+)/) -> TRUE (0) if ("%{User-Password}" =~ /version:([a-z0-9_-]+)/) { (0) update control { (0) expand: "%{1}" -> '7' (0) Browser-Version := "7" (0) } # update control = noop (0) } # if ("%{User-Password}" =~ /version:([a-z0-9_-]+)/) = noop (0) } # check_browser_version check_browser_version = noop (0) check_browser_os check_browser_os { (0) ? if ("%{User-Password}" =~ /os:([a-z0-9_-]+)$/) (0) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (0) ? if ("%{User-Password}" =~ /os:([a-z0-9_-]+)$/) -> TRUE (0) if ("%{User-Password}" =~ /os:([a-z0-9_-]+)$/) { (0) update control { (0) expand: "%{1}" -> 'ios5' (0) Browser-OS := "ios5" I also tried a different regex, but the problems seem worse there.. ? if ("%{User-Password}" =~ /^email:([a-z0-9_-]+(\.[a-z0-9_-]+)*@[a-z0-9_-]+(\.[a-z0-9_-]+)*(\.[a-z] {2,4}))/) (1) expand: "%{User-Password}" -> 'email:my.email@address.com browseragent:safari version:7 os:ios5' (1) ? if ("%{User-Password}" =~ /^email:([a-z0-9_-]+(\.[a-z0-9_-]+)*@[a-z0-9_-]+(\.[a-z0-9_-]+)*(\.[a-z] {2,4}))/) -> TRUE (1) if ("%{User-Password}" =~ /^email:([a-z0-9_-]+(\.[a-z0-9_-]+)*@[a-z0-9_-]+(\.[a-z0-9_-]+)*(\.[a-z] {2,4}))/) { (1) update control { (1) expand: "%{1}" -> 'my.email(a)address.com browseragent:safari version:7 os:ios' (1) Email-Address := "my.email(a)address.com browseragent:safari version:7 os:ios" (1) } # update control = noop Any ideas what I'm doing wrong? Thanks andy

2 1

Freeradius 3.0.0 Segmentation Fault
by Bertalan Voros 23 Oct '13

23 Oct '13

Hello All, I have been working on migrating my existing working config over to a server running Freeradius 3.0.0. The config was copied over by going through the config files line by line and inserting, no config file has been directly copied over. All is well until I try to authenticate against it. radiusd -X is ok, no errors. Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Opening new proxy address * port 1814 Listening on proxy address * port 1814 Ready to process requests. Then on authentication it crashes out: (11) eap : Tunneled authentication was successful. (11) eap : SUCCESS (11) eap : Saving tunneled attributes for later (11) eap : Reply was handled (11) eap : New EAP session, adding 'State' attribute to reply 0x39749cfb307e85b8 (11) [eap] = ok (11) } # post-proxy = ok Segmentation fault (core dumped) The system is Ubuntu 13.10 and freeradius was compiled using the following steps: tar -zxvf freeradius-server-3.0.0.tar.gz cd freeradius-server-3.0.0/ apt-get install gcc apt-get install make apt-get install libssl-dev apt-get install libtalloc-dev apt-get install libmysqlclient-dev ./configure --sysconfdir=/etc make make install Bertalan

2 3