November 2015 - Freeradius-Users - lists.freeradius.org

Slight issue after having migrated to v3.0.10 from v2.5
by Bertalan Voros 05 Nov '15

05 Nov '15

Hello All, I have just migrated our existing v2.5 server's config to a new one using the most recent stable version. The migration was done by editing each configuration file one by one, none of the files were directly copied. All is well, everything appears to be working as expected apart from one slight problem. There is a mac address check in the Authorize section that doesn't seem to take effect any more. Nobody gets rejected. Code and debug log below. I know it might be staring me in the eye but has been unable to find what could be causing it. Code: if (Called-Station-ID =~ /:SSID-Here$/) { rewrite_calling_station_id if(!"%{sql_mac:SELECT COUNT(*) FROM wifi.macaddress WHERE mac = '%{Calling-Station-ID}' = 1}"){ reject } } Debug log: (991) Received Access-Request Id 39 from 10.x.x.x:40001 to 10.11.0.83:1812 length 170 (991) User-Name = "Nexus7xx" (991) NAS-IP-Address = (991) NAS-Port = 0 (991) Called-Station-Id = "02-18-4A-14-82-B0:SSID-Here" (991) Calling-Station-Id = "BC-EE-7B-A3-6D-D9" (991) Framed-MTU = 1400 (991) NAS-Port-Type = Wireless-802.11 (991) Connect-Info = "CONNECT 0Mbps 802.11b" (991) EAP-Message = 0x02b800061900 (991) State = 0xc63b617ec58378d04d8f1ca50d306f26 (991) Message-Authenticator = 0x16faf8f9d4f9b38c39415aee (991) session-state: No cached attributes (991) # Executing section authorize from file /etc/freeradius/sites-enabled/default (991) authorize { (991) policy filter_username { (991) if (!&User-Name) { (991) if (!&User-Name) -> FALSE (991) if (&User-Name =~ / /) { (991) if (&User-Name =~ / /) -> FALSE (991) if (&User-Name =~ /@.*@/ ) { (991) if (&User-Name =~ /@.*@/ ) -> FALSE (991) if (&User-Name =~ /\.\./ ) { (991) if (&User-Name =~ /\.\./ ) -> FALSE (991) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (991) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (991) if (&User-Name =~ /\.$/) { (991) if (&User-Name =~ /\.$/) -> FALSE (991) if (&User-Name =~ /(a)\./) { (991) if (&User-Name =~ /(a)\./) -> FALSE (991) } # policy filter_username = notfound (991) [preprocess] = ok (991) if (Called-Station-ID =~ /:SSID-Here$/) { (991) if (Called-Station-ID =~ /:SSID-Here$/) -> TRUE (991) if (Called-Station-ID =~ /:SSID-Here$/) { (991) policy rewrite_calling_station_id { (991) if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i){ (991) if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE (991) if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { (991) update request { (991) EXPAND %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (991) --> bc-ee-7b-a3-6d-d9 (991) Calling-Station-Id := bc-ee-7b-a3-6d-d9 (991) } # update request = noop (991) } # if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) = noop (991) ... skipping else for request 991: Preceding "if" was taken (991) } # policy rewrite_calling_station_id = noop (991) if (!"%{sql_mac:SELECT COUNT(*) FROM wifi.macaddress WHERE mac = '%{Calling-Station-ID}' = 1}"){ rlm_sql (sql_mac): Reserved connection (13) (991) Executing select query: SELECT COUNT(*) FROM wifi.macaddress WHERE mac = 'bc-ee-7b-a3-6d-d9' = 1 rlm_sql (sql_mac): Released connection (13) (991) EXPAND %{sql_mac:SELECT COUNT(*) FROM wifi.macaddress WHERE mac = '%{Calling-Station-ID}' = 1} (991) --> 0 (991) if (!"%{sql_mac:SELECT COUNT(*) FROM wifi.macaddress WHERE mac = '%{Calling-Station-ID}' = 1}") -> FALSE (991) } # if (Called-Station-ID =~ /:SSID-Here$/) = noop (991) [mschap] = noop (991) if (!EAP-Message) { (991) if (!EAP-Message) -> FALSE (991) eap: Peer sent EAP Response (code 2) ID 184 length 6 (991) eap: Continuing tunnel setup (991) [eap] = ok (991) } # authorize = ok

1 1

RE: Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

Ok, good plan. I'll do that. :-) -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 05 November 2015 15:23 To: FreeRadius users mailing list Subject: Re: Calling a module name from a dynamic variable > On Nov 5, 2015, at 10:15 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Ok, that settles it, thought as much - I've done some code for switch/case now. > Just one last question - if we previously had something like: > > Auth-type inner-eap { > Inner-eap { > reject = 1 > ok = 1 > invalid = 1 > } > If (!ok) { > .. > } > } > > The question is if I did a switch statement : > > Auth-type inner-eap { > Switch (somevar) { > Case somevalue { > Custom-inner-eap { > Reject =1 > Ok = 1 > Invalid = 1 > } > Case someothervalue { > Custom-other-inner-eap { > Reject =1 > Ok = 1 > Invalid = 1 > } > } > } > If (!ok) { > .. > } > } > > Does the !ok bit still belong to whatever module is called in the switch statement? I guess so, but wanted to make sure the ok doesn't belong to the switch/case block. In that instance you should just set control:Auth-Type and use different Auth-Type sections. -Arran

1 0

RE: Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

Ok, that settles it, thought as much - I've done some code for switch/case now. Just one last question - if we previously had something like: Auth-type inner-eap { Inner-eap { reject = 1 ok = 1 invalid = 1 } If (!ok) { .. } } The question is if I did a switch statement : Auth-type inner-eap { Switch (somevar) { Case somevalue { Custom-inner-eap { Reject =1 Ok = 1 Invalid = 1 } Case someothervalue { Custom-other-inner-eap { Reject =1 Ok = 1 Invalid = 1 } } } If (!ok) { .. } } Does the !ok bit still belong to whatever module is called in the switch statement? I guess so, but wanted to make sure the ok doesn't belong to the switch/case block. Thanks -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 05 November 2015 14:53 To: FreeRadius users mailing list Subject: Re: Calling a module name from a dynamic variable > On Nov 5, 2015, at 9:47 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > It's an SQL "named" module, just logs results from post-auth. > Its name is really sql-radius-lan0 or sql-radius-lan1 or whatever, depending on certain circumstances. You can't do that and with the way the code is structured it'd be very hard to support that. Use switch and enumerate the possible modules you want to call. -Arran

2 1

RE: Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

It's an SQL "named" module, just logs results from post-auth. Its name is really sql-radius-lan0 or sql-radius-lan1 or whatever, depending on certain circumstances. -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Jorge Pereira Sent: 05 November 2015 14:26 To: FreeRadius users mailing list Subject: Re: Calling a module name from a dynamic variable Frank, What is your "mymodule"? a xlat function? tell more about the "mymodule" -- Jorge Pereira On Thu, Nov 5, 2015 at 12:15 PM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > Hi Jorge, > Still the same : > Failed to find "%{%{control:Tmp-String-0}}" as a module or policy. > > Oh well. > Thanks > Andy > > -----Original Message----- > From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks= > sath.nhs.uk(a)lists.freeradius.org] On Behalf Of Jorge Pereira > Sent: 05 November 2015 13:26 > To: FreeRadius users mailing list > Subject: Re: Calling a module name from a dynamic variable > > Hi Frank, > > try this... > > update control { > Tmp-String-0 := "mymodule" > } > > "%{%{control:Tmp-String-0}}" { > Fail =1 > } > > -- > Jorge Pereira > > On Thu, Nov 5, 2015 at 11:19 AM, Franks Andy (IT Technical > Architecture > Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > > Hi all, > > Freeradius 3.1 from git. > > > > Just wanted to know if I can do this : > > > > Update control { > > Tmp-String-0 := "mymodule" > > } > > > > "%{control:Tmp-String-0}" { > > Fail =1 > > } > > > > Hopefully it's obvious - I want to prepare a variable and call a > > matching module name from the variable, in this case mymodule. > > It doesn't work at the moment as the string isn't evaluated - it > > just > says: > > > > Failed to find "%{control:Tmp-String-0}" as a module or policy. > > > > If I can't, I can't no worries, I would just stop me searching if I knew. > > > > Thanks > > Andy > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

Hi Jorge, Still the same : Failed to find "%{%{control:Tmp-String-0}}" as a module or policy. Oh well. Thanks Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Jorge Pereira Sent: 05 November 2015 13:26 To: FreeRadius users mailing list Subject: Re: Calling a module name from a dynamic variable Hi Frank, try this... update control { Tmp-String-0 := "mymodule" } "%{%{control:Tmp-String-0}}" { Fail =1 } -- Jorge Pereira On Thu, Nov 5, 2015 at 11:19 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > Hi all, > Freeradius 3.1 from git. > > Just wanted to know if I can do this : > > Update control { > Tmp-String-0 := "mymodule" > } > > "%{control:Tmp-String-0}" { > Fail =1 > } > > Hopefully it's obvious - I want to prepare a variable and call a > matching module name from the variable, in this case mymodule. > It doesn't work at the moment as the string isn't evaluated - it just says: > > Failed to find "%{control:Tmp-String-0}" as a module or policy. > > If I can't, I can't no worries, I would just stop me searching if I knew. > > Thanks > Andy > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Calling a module name from a dynamic variable
by Franks Andy (IT Technical Architecture Manager) 05 Nov '15

05 Nov '15

Hi all, Freeradius 3.1 from git. Just wanted to know if I can do this : Update control { Tmp-String-0 := "mymodule" } "%{control:Tmp-String-0}" { Fail =1 } Hopefully it's obvious - I want to prepare a variable and call a matching module name from the variable, in this case mymodule. It doesn't work at the moment as the string isn't evaluated - it just says: Failed to find "%{control:Tmp-String-0}" as a module or policy. If I can't, I can't no worries, I would just stop me searching if I knew. Thanks Andy

2 1

Incremental Reject delay
by Krzysztof Grobelak 05 Nov '15

05 Nov '15

Hello List, Apologies if this was asked here before. I would like to configure freeRadius to send Access-Reject with values that increment with each failed attempt. I noticed in the mailing list some discussion about an "FreeRADIUS-Response-Delay-Usec" is there an attribute that would allow for full seconds delay? Something like "FreeRADIUS-Response-Delay" maybe? I could then query the database for the last delay and increment it accordingly like such: update reply { Tmp-String-0 := "%{sql:SELECT delay+delay FROM failed_login_delay WHERE username=&User-Name}" FreeRADIUS-Response-Delay := &Tmp-String-0 } I hope this does makes sense... Obviously i'm aware of the reject_delay setting in radiusd.conf but I would like to be able to increment the delay dynamically. Or is there some other obvious way to do this? Thanks in advance. Regards, Krzysztof Airspeed Telecom

3 7

Test
by Scott Reeve 04 Nov '15

04 Nov '15

Sorry for this but I've run out of ideas as to my posting difficulties. Scott

3 2

radsniff + collected
by Jorge Pereira 04 Nov '15

04 Nov '15

Hi, somebody has used? if yes, could give more information. -- Jorge Pereira

3 10

eap-ttls-gtc-pap
by Seike neg 04 Nov '15

04 Nov '15

Hello I'm having trouble setting an eap-ttls-gtc-pap authentication against an LDAP server. The PAP part is working without problem when I check it with radtest but i can't log with EAP-TTLS-GTC. Anyone can help me please . Thanks in advance. Here is my pastebin for my conf files: http://pastebin.com/u/Kunta

4 6