June 2015 - Freeradius-Users - lists.freeradius.org

Freeradius2 with mysql function on openwrt.
by bruno d'ambrosio 08 Jun '15

08 Jun '15

Hi mate My ask is: - I have installed on openwrt, freeradius2, mod mysql and mysql server, have also installed all library and dependence, now i have configure all, but mysql not write in table radacct why? By Bruno D'Ambrosio

5 22

[Attrs Regex]
by Thomas Fagart 08 Jun '15

08 Jun '15

Hello, We were sucessfuly using regexp on keys in attr_filter module with FR 2.1.6 FreeBSD 8.0 Something like that in attrs file : "~\^$.+$\\.telco$" Framed-IP-Address =* ANY, Framed-IP-Netmask =* ANY, Framed-MTU =* ANY, Service-Type =* ANY, Framed-Protocol =* ANY, ERX-Virtual-Router-Name := "test", Tunnel-Type:0 =* ANY, Tunnel-Preference:0 =* ANY, Tunnel-Medium-Type:0 =* ANY, Tunnel-Client-Endpoint:0 =* ANY, Tunnel-Server-Endpoint:0 =* ANY, Tunnel-Assignment-Id:0 =* ANY, Tunnel-Client-Auth-Id:0 =* ANY, Tunnel-Server-Auth-Id:0 =* ANY, Class =* ANY After upgrading to FR 2.2.6 Freebsd 10.0, I've got the feeling that this regular expression on realm attribute does not work anymore. I've also noticed that the same regular expression still work in proxy.conf. Tue May 12 02:07:30 2015 : Debug: [suffix] Looking up realm "toto.telco" for User-Name = "test(a)toto.telco" Tue May 12 02:07:30 2015 : Debug: [suffix] Found realm "~^(.+)\.telco$" Tue May 12 02:07:30 2015 : Debug: [suffix] Adding Realm = "toto.telco" Tue May 12 02:07:30 2015 : Debug: [suffix] Proxying request from user test to realm ~^(.+)\.telco$ Tue May 12 02:07:30 2015 : Debug: [suffix] Preparing to proxy authentication request to realm "~^(.+)\.telco$" ... Tue May 12 02:07:30 2015 : Debug: +group post-proxy { Tue May 12 02:07:30 2015 : Debug: [attr_filter.post-proxy] expand: %{Realm} -> toto.telco Tue May 12 02:07:30 2015 : Debug: ++[attr_filter.post-proxy] = noop Tue May 12 02:07:30 2015 : Debug: +} # group post-proxy = noop After spending some time on the mailing list and the doc, I've got different ideas to solve that : 1. The new FR might not have been compile properly with pcre lib (as this was a package) (radiusd -Xv does not tell me wether this is the case or not) 2. The way regex work have change and I should fine the proper one 3. FR 3.x.x has been rewriten and should work better 4. Do not use rlm_attrs_filter and do something else (unlang ?) Could you advise ? Many thanks Thomas

5 9

Extra validation for EAP-TLS
by Arran Cudbard-Bell 08 Jun '15

08 Jun '15

Hi All, I've added some additional validation for EAP-TLS that caps the maximum inbound TLS record size at the length indicated in the first (L) Length Included packet. If you're using v3.0.x and EAP-TLS could you please check to make sure this isn't tripped by any of the supplicants in use at your site. I've tested with OSX 10.10.3, and IOS 8.3, and will test with wpa_supplicant/eapol_test but don't have access to all the different Windows variants. Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 2

Freeradius 3.0.8 - expansion and unlang - concatenation of AVPs
by Aleš Rygl 08 Jun '15

08 Jun '15

Hello all, With freeradius 3.0.8 and MariaDB 10.0.19 I am struggling with concatenation of AVP in case of their multiple occurrence: According to http://freeradius.org/radiusd/man/unlang.html the expansion below should produce a string separated by n _%{Attribute-Name[*]}_ _ All values of Attribute-Name, concatenated together with n as the separator. _ Basicaly it works. But what I can see is than instead of a newline there is "=2C" sequence inserted to the acct table. It regards Dynamic-QoS-Param AVP below: query = " INSERT INTO ${....acct_table1} (${...column_list}) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, NULL, '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Acct-Input-Packets}', '%{Acct-Output-Packets}', '%{Acct-Input-Gigawords}', '%{Acct-Output-Gigawords}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Callback-Number}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{Acct-Status-Type}', '%{Acct-Terminate-Cause}', '%{Mac-Addr}', '%{NAS-Identifier}', '%{Dynamic-QoS-Param[*]}')" And when sql trace tunrned on, I can see that it is being inserted in this way by freeradius: INSERT INTO radacct_adsl (......., 'pwfq-circuit-rate-max 23716 parent=2Cpolice-circuit-rate rate-absolute 2240 parent'); Client charset and DB charset is utf8. "2c" represents comma in utf8. What am I doing wrong? Regards Ales

2 2

Freeradius2 with mysql function on openwrt.
by bruno d'ambrosio 08 Jun '15

08 Jun '15

Hi mate My ask is: - I have installed on openwrt, freeradius2, mod mysql and mysql server, have also installed all library and dependence, now i have configure all, but mysql not write in table radacct why? By Bruno D'Ambrosio

1 0

Function on Openwrt, Freeradius 2 with Mysql ?
by Bruno D'Ambrosio 08 Jun '15

08 Jun '15

Hi mate They are almost three days I'm trying to run but without success, freeradius, mysql on system openwrt. Now I ask but on openwrt it is possible to operate freeradius with mysql?

1 0

on freeradius 3.0.0
by Yaisel Cruz Zuñiga 08 Jun '15

08 Jun '15

Hello list, following an old manual build and install freeradius 3.0.0m my question is. as freeradius server starts if you have any startup scripts? Universidad de Cienfuegos http://www.ucf.edu.cu/

7 8

Freeradius and Groups
by Hossein Rafighi 06 Jun '15

06 Jun '15

Hi, I have freeradius-2.1.12-6.el6.x86_64 installed and working like a charm. I have multiple groups on a LDAP server students, faculty, visitors, and so on. I want to configure the radius servre to allow access to faculty members, but not others. How do I go about that? Does anyone have a step-by-step recipe? Many thanks in advance, Hossein Rafighi -- _____ _____ _____ _ _ _ _ ____ Hossein Rafighi |_ _|| _ \ |_ _|| | | || \_/ || __|TRIUMF, 4004 Wesbrook Mall | | | |_| ) | | | | | || || |__ Vancouver BC, Canada, V6T 2A3 | | | _ / | | | \_/ || \_/ || __|Voice: (604) 222-1047 | | | | \ \ _| |_ | || | | || | Fax: (604) 222-1074 |_| |_| \_\|_____| \___/ |_| |_||_| Website: http://www.triumf.ca

2 4

Hardware Requirement for FreeRadius 3.0.8
by Sunil Kulkarni -X (sunikulk - PERSISTENT SYSTEMS INC at Cisco) 05 Jun '15

05 Jun '15

Hello All, I am new for FreeRadius. I am using FreeRadius 3.0.8 version. I wanted to know following: 1. Is there any hardware specific document and post available? 2. Is there any performance benchmark related document? --- Thanks, Sunil Kulkarni

3 2

Compiling Python & FreeRadius 3.x
by Andrew Parisio 04 Jun '15

04 Jun '15

If we use the apt/yum installed versions of python it works, but if we compile python (tried 2.7.3, .6, and .10, installing in /usr/local) and then configure freeradius to look at the compiled versions we are able to get it to work, but as soon as you import a module such as json or boto (the aws sdk) we hit the PyThreadState_Get error. When looking at the strace we have verified that all references to python are to the correct/compiled version, there are no accidental references to the local system version of python. We've tried this in several different environments (internal build tools, clean copies of ubuntu & amazon linux), and have been able to reliably reproduce the same PyThreadState_Get error message, but have been unable to figure out why it's happening. I think it's something to do with the way freeradius is compiled, however it's also possible it's related to the way python itself is compiled but I think that's less likely because we used the same flags used to compile the yum version of python. FYI we can compile freeradus 2.2.x against our compiled python and everything works just fine (but freeradius 2.2.x doesn't support threaded python). This is the script used to build/install python & freeradius on Amazon Linux 2015.03 on EC2: sudo su cd yum update -y yum groupinstall "Development Tools" -y yum install libtalloc-devel openssl-devel -y yum remove python27-devel -y # so there's no way it accidnetally compiles against the system python wget https://www.python.org/ftp/python/2.7.6/Python-2.7.6.tgz wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.8.tar.gz tar -xzvf Python-2.7.6.tgz tar -zxvf freeradius-server-3.0.8.tar.gz PATH=/usr/local/bin:$PATH export PATH PYTHONHOME=/usr/local export PYTHONHOME cd /root/Python-2.7.6 && ./configure --enable-shared LDFLAGS="-Wl,-rpath,/usr/local/lib/python2.7" LINKFORSHARED="-Xlinker --export-dynamic" CPPLAGS="-fPIC -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes" --prefix=/usr/local && make -j16 && make altinstall cd /root/freeradius-server-3.0.8 && ./configure LDFLAGS="-Wl,-rpath,/usr/local/lib/python2.7" BASECFLAGS="-fPIC -Xlinker --export-dynamic" --with-rlm-python-lib-dir=/usr/local/lib/python2.7 --with-rlm-python-include-dir=/usr/local/include/python2.7 && make -j16 && make install cp /usr/local/etc/raddb/mods-available/python /usr/local/etc/raddb/mods-enabled/python echo "import json # comment out this line and radius will run def instantiate(p): print json.dumps({}) print 'YAY!' " > /usr/local/lib/python2.7/site-packages/example.py vi /usr/local/etc/raddb/mods-enabled/python # uncomment the insantiate line (too lazy to sed) then /usr/local/sbin/radiusd -X -xxx stat("/usr/local/lib/python2.7/_locale", 0x7ffd1f05b170) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/_locale.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/_localemodule.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/_locale.py", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/_locale.pyc", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python27.zip", 0x7ffd1f059f10) = -1 ENOENT (No such file or directory) stat("/usr/local/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python27.zip", 0x7ffd1f05aec0) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7/plat-linux2", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/plat-linux2", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/plat-linux2/_locale", 0x7ffd1f05b170) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/plat-linux2/_locale.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/plat-linux2/_localemodule.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/plat-linux2/_locale.py", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/plat-linux2/_locale.pyc", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7/lib-tk", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/lib-tk", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/lib-tk/_locale", 0x7ffd1f05b170) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-tk/_locale.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-tk/_localemodule.so", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-tk/_locale.py", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-tk/_locale.pyc", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7/lib-old", 0x7ffd1f059f10) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7", {st_mode=S_IFDIR|0755, st_size=20480, ...}) = 0 stat("/usr/local/lib/python2.7/lib-old", 0x7ffd1f05aec0) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/python2.7/lib-dynload", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/lib-dynload", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat("/usr/local/lib/python2.7/lib-dynload/_locale", 0x7ffd1f05b170) = -1 ENOENT (No such file or directory) open("/usr/local/lib/python2.7/lib-dynload/_locale.so", O_RDONLY) = 5 fstat(5, {st_mode=S_IFREG|0755, st_size=60757, ...}) = 0 open("/usr/local/lib/python2.7/lib-dynload/_locale.so", O_RDONLY|O_CLOEXEC) = 6 read(6, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\32\0\0\0\0\0\0"..., 832) = 832 fstat(6, {st_mode=S_IFREG|0755, st_size=60757, ...}) = 0 mmap(NULL, 2116856, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 6, 0) = 0x7f2398e93000 mprotect(0x7f2398e97000, 2097152, PROT_NONE) = 0 mmap(0x7f2399097000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 6, 0x4000) = 0x7f2399097000 close(6) = 0 write(2, "Fatal Python error: PyThreadStat"..., 57Fatal Python error: PyThreadState_Get: no current thread ) = 57 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(1420, 1420, SIGABRT) = 0 --- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=1420, si_uid=0} --- +++ killed by SIGABRT +++ Aborted Does anybody have any thoughts / suggestions? Thanks!

2 2