December 2015 - Freeradius-Users - lists.freeradius.org

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 10 Dec '15

10 Dec '15

Awesome, it works! Thanks devs. Everytime I play with FR I learn something new! Andy Executing select query: select acctuniqueid from radacct_lant where nasportid='1' (0) control:Tmp-string-1 += 95723d0da326de4fd8dadf064357b544 (0) control:Tmp-string-1 += 4ae6bd20c2955bdbc7a61703bd811c5b (0) control:Tmp-string-1 += 2dd1180062377402bf85f927ded052a1 (0) control:Tmp-string-1 += ed39616270fc864a165d628d5e81a236 (0) control:Tmp-string-1 += 296ad0d391b50f6adf1af1184e62246f (0) control:Tmp-string-1 += 9c921f1908bb2c3a310c5e147a8478e9 (0) control:Tmp-string-1 += 342ba906a78da2b3975d84663f82133f (0) control:Tmp-string-1 += ecf782b6e59a267dfc28cdbcc8be1ba4 (0) control:Tmp-string-1 += 049f9c8b1295eb7ba5523fdf3b267edf (0) control:Tmp-string-1 += 247547b1bdbfcaa951a1a6bd6c447ed7 (0) control:Tmp-string-1 += 7c53c103b118e60c58c42416149d0cfa -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Franks Andy (IT Technical Architecture Manager) Sent: 10 December 2015 19:55 To: FreeRadius users mailing list Subject: RE: Reverse string concatenation for multiple attributes That's pretty amazing really. One day I'll task myself with looking completely at the source code, but it would likely melt my brain. The reason, behind the scenes, was we're trying to dynamically update the mac address limit on hp switch ports, but due to these horrible mitel phones with switches in the back, you've no idea whether the mac-limit 2 device (phone) comes up first, or what's plugged into it (pc), usually the pc, which means you need to do a disconnect or CoA to get the phone to present and then push the correct mac limit. Also, the mac address doesn't drop off the switch port when it disconnects from the phone, so you connect a different pc or laptop on the phone and then you have to log off the non-phone mac. All depends on accounting and lots of sql afaics. Or we could just statically map the limit on the switch, but that's no challenge at all. It's a shame you can't do mac-limit on multiple macs, with the newest counting, but HP don't work like that. Thanks Arran! Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 10 December 2015 19:27 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > .. It seems to indicate predefinition in a module, which is ok but your example looks more inline. I am guessing the sql bit matches the module instance name here and the query is loaded in a variable? Or an xlat. It's a polymorphic template type meaning it can be an attribute reference as you have below, an xlat expansion like "SELECT * FROM BLAH WHERE user = %{user-Name}", an exec `echo 'SELECT * FROM BLAH'`, or just a plain literal like 'SELECT * FROM BLAH WHERE 1' > Would an xlat type section be therefore > > Map sql_instname &var { > Control:Tmp-string-0 += myfieldname > } > > Or am i way out and it needs module definition? Nope that's good. Then update request { Tmp-String-0 := "%{pairs:&control:Tmp-String-0[*]}" } To recombine into a list of comma delimited value pairs. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 10 Dec '15

10 Dec '15

That's pretty amazing really. One day I'll task myself with looking completely at the source code, but it would likely melt my brain. The reason, behind the scenes, was we're trying to dynamically update the mac address limit on hp switch ports, but due to these horrible mitel phones with switches in the back, you've no idea whether the mac-limit 2 device (phone) comes up first, or what's plugged into it (pc), usually the pc, which means you need to do a disconnect or CoA to get the phone to present and then push the correct mac limit. Also, the mac address doesn't drop off the switch port when it disconnects from the phone, so you connect a different pc or laptop on the phone and then you have to log off the non-phone mac. All depends on accounting and lots of sql afaics. Or we could just statically map the limit on the switch, but that's no challenge at all. It's a shame you can't do mac-limit on multiple macs, with the newest counting, but HP don't work like that. Thanks Arran! Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 10 December 2015 19:27 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > .. It seems to indicate predefinition in a module, which is ok but your example looks more inline. I am guessing the sql bit matches the module instance name here and the query is loaded in a variable? Or an xlat. It's a polymorphic template type meaning it can be an attribute reference as you have below, an xlat expansion like "SELECT * FROM BLAH WHERE user = %{user-Name}", an exec `echo 'SELECT * FROM BLAH'`, or just a plain literal like 'SELECT * FROM BLAH WHERE 1' > Would an xlat type section be therefore > > Map sql_instname &var { > Control:Tmp-string-0 += myfieldname > } > > Or am i way out and it needs module definition? Nope that's good. Then update request { Tmp-String-0 := "%{pairs:&control:Tmp-String-0[*]}" } To recombine into a list of comma delimited value pairs. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 10 Dec '15

10 Dec '15

Hi Arran, Nice one. Looking for sql map stuff i found this thread https://github.com/FreeRADIUS/freeradius-server/issues/984 .. It seems to indicate predefinition in a module, which is ok but your example looks more inline. I am guessing the sql bit matches the module instance name here and the query is loaded in a variable? Would an xlat type section be therefore Map sql_instname &var { Control:Tmp-string-0 += myfieldname } Or am i way out and it needs module definition? Thanks! ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 10 December 2015 18:06 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > On 10 Dec 2015, at 12:57, Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> wrote: > > >> On 10 Dec 2015, at 12:42, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: >> >> Hi all, >> I'm trying to do something a bit fiddly. I'm sure I've asked this before but google doesn't help. >> Can we pass back multiple attributes from a sql xlat yet on 3.1.0? >> If not, is there a reverse of %{Attribute-Name[*]} that could translate my value1\nvalue2 from an SQL stored procedure into attribute[1]=value1, attribute[2]=value2 etc? >> If not, has anyone come up with a clean way to iterate through and do the equivalent via += a number of times? >> It seems I can use explode to get the number of delimiters (maybe I'm using it wrongly). >> >> Maybe I'm missing something REALLY simple. Wouldn't be the first time. :-~ > > You can do it with maps IIRC: > > map sql <query> { > <radius attr> += <sql column> > } And then use the pairs xlat. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 10 Dec '15

10 Dec '15

Hi all, I'm trying to do something a bit fiddly. I'm sure I've asked this before but google doesn't help. Can we pass back multiple attributes from a sql xlat yet on 3.1.0? If not, is there a reverse of %{Attribute-Name[*]} that could translate my value1\nvalue2 from an SQL stored procedure into attribute[1]=value1, attribute[2]=value2 etc? If not, has anyone come up with a clean way to iterate through and do the equivalent via += a number of times? It seems I can use explode to get the number of delimiters (maybe I'm using it wrongly). Maybe I'm missing something REALLY simple. Wouldn't be the first time. :-~ Thanks Andy

2 2

Error when trying to compile 3.0.10
by Bertalan Voros 10 Dec '15

10 Dec '15

Hello All, I am getting an error when trying to compile FreeRADIUS 3.0.10 on an Ubuntu 14.04. Following this guide: http://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind All dependencies are installed according to dpkg-checkbuilddeps. I then run configure: ./configure -C --prefix=/opt/freeradius3 --with-winbind-dir=/opt/samba4.3.2 Then getting errors at the sqlite bit: src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c:802:30: error: ‘rlm_sql_sqlite_conn_t’ has no member named ‘db’ return sqlite3_changes(conn->db); ^ src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c: In function ‘sql_select_query’: src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c:594:1: warning: control reaches end of non-void function [-Wreturn-type] } ^ src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c: In function ‘sql_query’: src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c:615:1: warning: control reaches end of non-void function [-Wreturn-type] } ^ make: *** [build/objs/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.lo] Error 1 Any help will be appreciated. Bertalan

3 8

How to add users into group
by dorje2007＠seznam.cz 10 Dec '15

10 Dec '15

Hi I was checking the option how to add users into groups. The ideas is to have different groups with Cisco AV pair and other parameters, and users that belongs to those groups. I was not able to find such an option, since huntgroups offers the group of the NAS clients. Like this: user1 Cleartext-Password := "user1" // should belong somwhow to the group1 Group1 Service-Type = Framed-User, Framed-Protocol = PPP, cisco-avpair = "group1;" Many thanks

2 3

Several NAS clients behind NAT
by Marius Flage 10 Dec '15

10 Dec '15

Hi! I'm running a FreeRADIUS server that's not directly accessible from the NAS clients, but they're all originating from the same source ip. Is this setup at all possible, or do I need to do some dirty hacks with NAT magic to accomplish this? When running with the same ip address (nasname), I get: "Failed to add duplicate client <shortname>". So I guess I have to do something to work around this? -- Marius

2 1

Using FreeRADIUS with SQL backend and advanced configuration
by Marius Flage 09 Dec '15

09 Dec '15

Hi! I've just set up FreeRADIUS with SQL backend and dynamic VLAN assignment, and it works great. I'm using it to put different users into different VLANs based on their username/password, using EAP. However, I want to expand on this to be able to put the clients into another VLAN if also the calling station MAC address matches. If I did this using the flat file "users", I'd suspect it'd be something like this: testuser Cleartext-Password := "example", Calling-Station-Id := "A0-A8-CD-60-AF-C2" Tunnel-Medium-Type := "IEEE-802", Tunnel-Private-Group-ID := 3, Tunnel-Type := "VLAN" testuser Cleartext-Password := "example" Tunnel-Medium-Type := "IEEE-802", Tunnel-Private-Group-ID := 4, Tunnel-Type := "VLAN" The theory here is that if the user "testuser" logs in with the password "example" from the device with MAC address "a0:a8:cd:60:af:c2", then he should be placed into the VLAN 3, if not, into VLAN 4. Is this possible with FreeRADIUS and specifically when using the SQL backend? -- Marius

3 4

accounting - more than one query
by Marcin 09 Dec '15

09 Dec '15

Hi In accounting section i'd like to run at least two quieries to database but when i write: #v+ start { query = "INSERT INTO one ..." query = "INSERT INTO two ..." } only this first is executed :/ how to execute more than one query? -- Pozdrawiam Marcin / nicraM

2 2

Machine auth fails but user auth works
by Dennis Xu 09 Dec '15

09 Dec '15

I have FreeRadius 3.0.4 and authenticate to AD. My user authentication works but machine auth fails with certificate errors. I was using the same Windows 10 machine to test both scenarios. I attached the debug logs in both tests. What could be the reasons for the machine auth problem? Below are some of my configurations: mods-available/mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-00} --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" mods-available/eap: default_eap_type = peap peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes # proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" # soh = yes # soh_virtual_server = "soh-server" # require_client_cert = yes } mschapv2 { # send_error = no } proxy.conf: realm LOCAL { } realm NULL{ } realm uoguelph.ca { } realm DEFAULT { authhost = prod1-east.eduroam.ca:1812 accthost = prod1-east.eduroam.ca:1813 secret = nostrip } Thanks! Dennis Xu

6 32