December 2015 - Freeradius-Users - lists.freeradius.org

RE: Index is not an integer
by Franks Andy (IT Technical Architecture Manager) 14 Dec '15

14 Dec '15

Thanks Arran, Discovered the multiple disconnect thing by trial and error, using radclient seems to work, albeit not preferable calling something "external", but there we are, I can judge by return string whether to close off accounting sessions that never got updated and so on, not too bad.. Wish there was some interface to directly query the switch for account sessions, mac addresses etc on there by port rather than use accounting, but afaics snmp isn't going to help, I don't know what else to do with that one. Thanks for the help anyway, much appreciated. Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 14 December 2015 17:32 To: FreeRadius users mailing list Subject: Re: Index is not an integer > On 14 Dec 2015, at 12:30, Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> wrote: > > >> On 14 Dec 2015, at 12:24, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: >> >> Hi all, >> Is there a way of doing this or its equivalent? I'm tracking the index of a variable via expr and then trying to get the output of other variables respectively - I need to do this via a changing index that's housed in a variable, but (and I may be doing this wrong) FR won't start with the following: > > Array index is not an integer, it's an attribute reference, which is not supported. > > You'd need to use > %{xlat:%%{control:Tmp-String-3[%{control:Tmp-Integer-0}]%}} > > It's probably not hard to implement array indexes as templates, but I don't have time to look at it right now. You also can't send multiple disconnects unless you call out to radclient and do it that way. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Index is not an integer
by Franks Andy (IT Technical Architecture Manager) 14 Dec '15

14 Dec '15

Hi all, Is there a way of doing this or its equivalent? I'm tracking the index of a variable via expr and then trying to get the output of other variables respectively - I need to do this via a changing index that's housed in a variable, but (and I may be doing this wrong) FR won't start with the following: update control { Tmp-Integer-0 := 0 } foreach &control:Tmp-String-1 { # send the disconnect update control { CoA-Failure-Reason !* ANY CoA-Acct-Unique-Session-Id := "%{Foreach-Variable-0}" CoA-Acct-Session-Id := &control:Tmp-String-2[&control:Tmp-Integer-0] CoA-User-Name := &control:Tmp-String-3[&control:Tmp-Integer-0] } /usr/local/etc/raddb/policy.d/sql_active_device_disconnect[40]: CoA-Acct-Session-Id /usr/local/etc/raddb/policy.d/sql_active_device_disconnect[40]: ^ Array index is not an integer .. &control:Tmp-Integer-0 is an integer, unless it's really a string in disguise.. Thanks again, sorry for posting so much. Andy

2 2

RE: Another simple one
by Franks Andy (IT Technical Architecture Manager) 14 Dec '15

14 Dec '15

Thanks, Yeh, I guess it's always be something iterative so a counter starting at zero using expr will be fine. Cheers Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 14 December 2015 15:19 To: FreeRadius users mailing list Subject: Re: Another simple one > On 14 Dec 2015, at 09:02, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Hi, > Did a search for this, can't find an answer, so apologies if it's covered. > > FR 3.1.0 latest from git. > > Is there any way of getting the index # of the variable I'm looking at in a foreach loop? After doing a sql map (new functionality) I have back a number of rows from a sql DB, and want to reference the index of each variable I'm updating, but I need to know where I'm at in order to do a variable[x] for the other variables that match the one I'm doing a foreach on, if that makes sense. > If there isn't an easy way, I'll pass the index back from SQL as a field, but it seemed kind of unnecessary if there's a simple way. No, you'd need to use expr to create a simple counter. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 14 Dec '15

14 Dec '15

Hi Arran, Thanks, I'll give it a whirl. Could I have done anything better there? I can probably update the SP to return something if the temporary table row count is zero, so we get something regardless, but then it's extra code to check it FR side..? Thanks again Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 14 December 2015 16:01 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > On 14 Dec 2015, at 05:58, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Hi, > Just tried this and still no go.. > > rlm_sql (sql_SP_rsh-radius-lant): Reserved connection (0) > (0) Executing select query: call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000) mysql_num_fields probably doesn't like a NULL result struct *sigh*. So you have a result function which returns a NULL pointer to indicated a result set with no rows, and then a function to get the number of fields in a result set, which SEGVs (instead of returning zero) if you pass it in that NULL pointer. Great API design that :/ Anyway pushed a fix. -Arran

1 0

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 14 Dec '15

14 Dec '15

Hi, Just tried this and still no go.. rlm_sql (sql_SP_rsh-radius-lant): Reserved connection (0) (0) Executing select query: call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000) Program received signal SIGSEGV, Segmentation fault. 0x00007ffff08f3ce0 in mysql_num_fields () from /usr/lib/x86_64-linux-gnu/libmysqlclient.so.18 (gdb) bt #0 0x00007ffff08f3ce0 in mysql_num_fields () from /usr/lib/x86_64-linux-gnu/libmysqlclient.so.18 #1 0x00007ffff0df4f0c in sql_fields (out=0x7fffffffd540, handle=0xd57ec0, config=0xb41660) at src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c:450 #2 0x00007ffff0ffb6bc in mod_map_proc (mod_inst=0xb41660, proc_inst=0x0, request=0xd080b0, query=0xd59b30 "call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000)", maps=0xcc61d0) at src/modules/rlm_sql/rlm_sql.c:332 #3 0x00007ffff7baa29e in map_proc (request=0xd080b0, inst=0xcc6b30) at src/main/map_proc.c:234 #4 0x00000000004319db in modcall_map (request=0xd080b0, stack=0x7fffffffd810, presult=0x7fffffffd7b0, priority=0x7fffffffd7ac) at src/main/interpreter.c:610 #5 0x00000000004320e0 in modcall_recurse (request=0xd080b0, stack=0x7fffffffd810, presult=0x7fffffffd80c, ppriority=0x7fffffffd808) at src/main/interpreter.c:839 #6 0x00000000004324ee in modcall (component=MOD_AUTHORIZE, c=0xca7840, request=0xd080b0) at src/main/interpreter.c:1001 #7 0x0000000000427e2a in indexed_modcall (comp=MOD_AUTHORIZE, idx=0, request=0xd080b0) at src/main/modules.c:977 #8 0x000000000042a0c3 in process_authorize (autz_type=0, request=0xd080b0) at src/main/modules.c:2108 #9 0x000000000040fd07 in rad_authenticate (request=0xd080b0) at src/main/auth.c:435 #10 0x000000000043b6d5 in request_running (request=0xd080b0, action=1) at src/main/process.c:1482 #11 0x000000000043a3db in request_queue_or_run (request=0xd080b0, process=0x43b573 <request_running>) at src/main/process.c:953 #12 0x000000000043bff1 in request_receive (ctx=0xd07db0, listener=0xaeb790, packet=0xd07e10, client=0xacf660, fun=0x40fa64 <rad_authenticate>) at src/main/process.c:1739 #13 0x0000000000419d1a in auth_socket_recv (listener=0xaeb790) at src/main/listen.c:1901 #14 0x00000000004431be in event_socket_handler (xel=0xcf9e10, fd=12, ctx=0xaeb790) at src/main/process.c:4542 #15 0x00007ffff7970044 in fr_event_loop (el=0xcf9e10) at src/lib/event.c:637 #16 0x00000000004450b2 in radius_event_process () at src/main/process.c:5585 #17 0x0000000000433103 in main (argc=2, argv=0x7fffffffe6d8) at src/main/radiusd.c:586 My SQL query doesn't return any rows, which will be normal sometimes. mysql> call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000); Query OK, 0 rows affected (0.01 sec) mysql> Config is : update control { Tmp-String-0 !* ANY Tmp-String-1 !* ANY Tmp-String-2 !* ANY Tmp-String-0 := "call get_active_sessions_for_switchport ('%{NAS-IP-Address}', '%{NAS-Port}', ${policy.MaxClientAge})" } # map - get back one or more devices. map sql_SP_rsh-radius-lant &control:Tmp-String-0 { control:Tmp-string-1 += acctuniqueid control:Tmp-string-2 += username } Thanks Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Franks Andy (IT Technical Architecture Manager) Sent: 11 December 2015 17:18 To: FreeRadius users mailing list Subject: RE: Reverse string concatenation for multiple attributes Thanks for that Arran. I'll check it a bit later. Weird that it worked on 2 field tables then failed when i moved to 4. Thanks again Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 11 December 2015 16:37 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > On Dec 11, 2015, at 11:09 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Hi. Maybe spoke too soon.. > Any chance this crash is not something I have done? Pushed fix... Looks like this is an old bug. Maybe MySQL have messed up the version macro :/ -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RFC6929 - support for 4 octets vendorId?
by Vereecke, Katrien (Katrien) 14 Dec '15

14 Dec '15

Hallo, RFC6929 states that it is recommended to support 4 octets for the vendorId field. When I try to test this using freeradius server , version V3.0.x I get the error : Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.alcatel.sr.ext[117]: dict_addvendor: Cannot handle vendor ID larger than 2^24 Is it not supported yet in freeradius version V3.0.x? Thanks, Kind regards, Katrien.

3 2

Stop "Sending duplicate proxied request"
by David Aldwinckle 14 Dec '15

14 Dec '15

Hi All, I've configured FreeRadius + Duo 2-factor authentication, like so: - NAS sends Access Request to FreeRadius - FreeRadius proxies the request to the Duo Authentication Proxy (id 1) - Duo sends an Access Request to FreeRadius for the same username (id 2) - If Duo receives an Access-Accept for id 2, it then sends its 2 factor authentication request to a mobile device. - The users hits OK, Duo sends an Access-Accept for id 1, using the reply-attributes of id 2. It seems strange but it works. The problem I am having, is that if the user doesn't immediately accept or decline the Duo request, they are bombarded with duplicates. I believe it is because FreeRadius is sending duplicate requests without waiting for an answer: Waking up in 0.3 seconds. (2) Expecting proxy response no later than 19.666697 seconds from now Waking up in 2.0 seconds. (0) Sending duplicate proxied request to home server 10.10.10.10 port 1812 - ID: 186 The duplicate is sent long before the 19 second timer from above has expired. Can I stop that behaviour somehow? Thanks, Dave

2 3

Another simple one
by Franks Andy (IT Technical Architecture Manager) 14 Dec '15

14 Dec '15

Hi, Did a search for this, can't find an answer, so apologies if it's covered. FR 3.1.0 latest from git. Is there any way of getting the index # of the variable I'm looking at in a foreach loop? After doing a sql map (new functionality) I have back a number of rows from a sql DB, and want to reference the index of each variable I'm updating, but I need to know where I'm at in order to do a variable[x] for the other variables that match the one I'm doing a foreach on, if that makes sense. If there isn't an easy way, I'll pass the index back from SQL as a field, but it seemed kind of unnecessary if there's a simple way. Thanks! Andy

2 1

PHP authentication
by Arjan Sinnige 14 Dec '15

14 Dec '15

Hi All, I think I already know the answer but I'll ask it just the same. I've been asked to research the possibility to link radius to an external login server.(out of my control) The external server needs a username and cleartext password via a php script and will only reply 'ok' or 'fail'. It will not send back a password or anything. The devices we need to authenticate are numerous. From ipads, iphones, windows phones & android to all iterations of windows (7 and onwards), OSX & linux computers. Most if not all of them are students user devices which cannot be pre-configured. So it needs to work "out of the box". Now I can get this to work easily if I authenticate against a local LDAP server which has NTLM and local user passwd accounts. All of these devices can do EAP-TTLS-Mschapv2 or EAP-PEAP-Mschapv2 but not all of them do TTLS-PAP (Windows & Windows phone etc...) It is not possible with this setup to always get a cleartext password, or is it ? In your valued opinion : Can it be done or should I spend my time on advising and creating a custom capture portal for the network ? Kind regards, Arjan Sinnige

4 4

Moving to 3.0.x series and crashes
by Miika Räisänen 14 Dec '15

14 Dec '15

Hi, I've been trying to upgrade our eduroam radius server 2.1.12 to 3.0.10 or newer. Our wifi is configured to authenticate 802.1X PEAP/mschapv2 -> freeradius -> Microsoft ad. In test environment freeradius works ok but in production it randomly crashes. With 3.0.10 I got some crash but did not catch any info about it and I just decided to try directly git version without any crash investigation. So last night (2nd dec) I pulled 3.0.x from git, compiled and put it on production. It survide about 12 hours and crashed with messages below Thu Dec 3 08:16:21 2015 : Auth: (22577) Login OK: [host/tatk032054.univ.yo.oulu.fi] (from client cisco_aps port 13 cli f8-16-54-f1-5d-33) Thu Dec 3 08:16:25 2015 : ERROR: (22589) mschap: ERROR: Program returned code (1) and output 'Password expired (0xc0000071)' Thu Dec 3 08:16:25 2015 : ERROR: (22589) mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' Thu Dec 3 08:16:25 2015 : Error: ASSERT FAILED src/modules/rlm_mschap/rlm_mschap.c[1751]: nt_password CAUGHT SIGNAL: Aborted Backtrace of last 42 frames: /usr/local/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7faabee6c4c2] /usr/local/lib/libfreeradius-server.so(rad_assert_fail+0x46)[0x7faabf0cbe39] /usr/local/lib/rlm_mschap.so(+0x5624)[0x7faab9905624] /usr/local/sbin/radiusd[0x4283e4] /usr/local/sbin/radiusd[0x428aa4] /usr/local/sbin/radiusd[0x4285ba] /usr/local/sbin/radiusd[0x4294d8] /usr/local/sbin/radiusd(modcall+0xa2)[0x42a21d] /usr/local/sbin/radiusd(indexed_modcall+0x363)[0x425c2f] /usr/local/sbin/radiusd(process_authenticate+0x22)[0x427cd6] /usr/local/lib/rlm_eap_mschapv2.so(+0x25ff)[0x7faab62215ff] /usr/local/lib/rlm_eap.so(+0x3f55)[0x7faaba72bf55] /usr/local/lib/rlm_eap.so(eap_method_select+0x421)[0x7faaba72c888] /usr/local/lib/rlm_eap.so(+0x2c07)[0x7faaba72ac07] /usr/local/sbin/radiusd[0x4283e4] /usr/local/sbin/radiusd[0x428aa4] /usr/local/sbin/radiusd[0x4285ba] /usr/local/sbin/radiusd[0x4294d8] /usr/local/sbin/radiusd(modcall+0xa2)[0x42a21d] /usr/local/sbin/radiusd(indexed_modcall+0x363)[0x425c2f] /usr/local/sbin/radiusd(process_authenticate+0x22)[0x427cd6] /usr/local/sbin/radiusd[0x40f583] /usr/local/sbin/radiusd(rad_authenticate+0x51e)[0x40fe9c] /usr/local/sbin/radiusd(rad_virtual_server+0x110)[0x4104b9] /usr/local/lib/rlm_eap_peap.so(eappeap_process+0xe68)[0x7faab6428a12] /usr/local/lib/rlm_eap_peap.so(+0x1fd3)[0x7faab6425fd3] /usr/local/lib/rlm_eap.so(+0x3f55)[0x7faaba72bf55] /usr/local/lib/rlm_eap.so(eap_method_select+0x421)[0x7faaba72c888] /usr/local/lib/rlm_eap.so(+0x2c07)[0x7faaba72ac07] /usr/local/sbin/radiusd[0x4283e4] /usr/local/sbin/radiusd[0x428aa4] /usr/local/sbin/radiusd[0x4285ba] /usr/local/sbin/radiusd[0x4294d8] /usr/local/sbin/radiusd(modcall+0xa2)[0x42a21d] /usr/local/sbin/radiusd(indexed_modcall+0x363)[0x425c2f] /usr/local/sbin/radiusd(process_authenticate+0x22)[0x427cd6] /usr/local/sbin/radiusd[0x40f583] /usr/local/sbin/radiusd(rad_authenticate+0x51e)[0x40fe9c] /usr/local/sbin/radiusd[0x43cca9] /usr/local/sbin/radiusd[0x438939] /lib64/libpthread.so.0(+0x7df5)[0x7faabd943df5] /lib64/libc.so.6(clone+0x6d)[0x7faabd43a1ad] No panic action set _EXIT(1) CALLED src/lib/debug.c[745]. Last error was: Internal sanity check 3352 [root@pc184005 ~]# I know I may should provide more info, but should I set panic action or compile fr with debug etc? Looks like it has something to do with mschapv password change so heres my mschap.conf http://cc.oulu.fi/~mtr/radius/mschap

4 8