October 2016 - Freeradius-Users - lists.freeradius.org

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Update on 3.0, 3.1, and 3.2.
by Alan DeKok 16 Feb '17

16 Feb '17

We plan on releasing 3.0.12 on Monday. it's stable, and there no new issues being reported for it. This will ideally be the last release of the 3.0 series. Version 3.0 was released almost three years ago, and it's time for a new major version of the server. 3.1 supports a "map" keyword, redis cluster, and many other useful features. Many people have been using the 3.1 branch in production, so we're confident that it is stable and functional. To keep things simple, we don't release an official 3.1 version. Instead, we will call 3.1 a "development / experimental" branch. Once we're ready (later this summer), we'll release an official 3.2 release. The v3.1.x branch will then be frozen, and no further development will occur on it. All new development will then start with a 3.3 branch, which will likely turn into version 4.0. There are enough architecture changes needed that it warrants a 4.0. In summary: 2.1 and earlier: dead. Don't use them. 2.2: Only critical security fixes. We expect this won't happen. 3.0: stable. New installations can use 3.0. 3.1: development. Use it only if you know what you're doing. 3.2: (future stable). Mid 2016 on, new installations should use this. 3.3. (future development), more changes, with a goal of increasing performance substantially.

4 6

freeradius2 + iODBC + Informix
by vanish 28 Nov '16

28 Nov '16

Hello, Please help me set up freeradius2 + iODBC + Informix (I'm newbie in freeradius). - I have a test-machine with Ubuntu 14.04 and Freeradius-server v2.1.12. - I have a server with Informix Database Server v 10.00 Step 1: - I installed unixODBC on test-machine - I installed informix-csdk for connect to Informix Database Server (Driver) - I configured files /etc/odbc.ini and /etc/odbcinst.ini to connect to Informix Database Server - Checking with isql: +++++++++++++++++++++++++++++++++++++++++ root@test:/home/test# isql -v work +---------------------------------------+ | Connected! | | | | sql-statement | | help [tablename] | | quit | | | +---------------------------------------+ SQL> select 1 from TABLES(SET{1}) 1 +++++++++++++++++++++++++++++++++++++++++ - Everything is allright. Step 2: - I try to install freeradius-iodbc module to connect to Informix Database Server - During install I get next warning: +++++++++++++++++++++++++++++++++++++++++++++ The following packages will be REMOVED: unixodbc unixodbc-dev The following NEW packages will be installed: libiodbc2-dev +++++++++++++++++++++++++++++++++++++++++++++ - so unixodbc and unixodbc-dev packages was removed after install freeradius-iodbc - I included in radiusd.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "iodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ - freeradius -XXX showed me next error: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ... Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test Fri Nov 21 14:53:48 2014 : Debug: rlm_sql (sql): starting 0 Fri Nov 21 14:53:48 2014 : Info: rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 Fri Nov 21 14:53:48 2014 : Error: sql_create_socket: SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded Fri Nov 21 14:53:48 2014 : Error: rlm_sql (sql): Failed to connect DB handle #0 ... +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - Error - "SQLConnectfailed: [iODBC][Driver Manager]Data source name not found and no default driver specified. Driver could not be loaded." - Where did I go wrong? - I found some information in net with same problem, but clear decision nowhere not found.

4 4

ldap shared object
by Daniel Wruck 04 Nov '16

04 Nov '16

Having a hard time setting up my new freeRADIUS 3.0.12 on Ubuntu 16.04. I am trying to turn on ldap; I altered the file in sites-available, and hand created a symlink to it from sites-enabled. But now I am getting an error in radiusd -X of /usr/local/etc/raddb/mods-enabled/ldap[8]: Failed to link to module 'rlm_ldap': /usr/local/lib/rlm_ldap.so: cannot open shared object file: No such file or directory I have verified that there is no rlm-ldap.so file in /usr/local/lib. This site (https://access.redhat.com/solutions/2262901) suggests that I missed something during the make process. Are shared objects only created during the make process? How do I get one when it is missing? All the stuff I am reading implies all that is needed to make any module work is the symlink. Daniel Wruck

7 12

Transformation of the + symbol -- FRS 3.0.11
by Mark Williams 03 Nov '16

03 Nov '16

Any idea why the + symbol is being transformed in the ldap filter? Should I be using a different syntax for the attribute substitution? (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Checking for suffix after "@" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Looking up realm "vt.edu" for User-Name = "adp+ipad(a)vt.edu" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Found realm "~vt.edu$" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Adding Stripped-User-Name = "adp+ipad" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Adding Realm = "vt.edu" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Authentication realm is LOCAL (12813372) Tue Oct 18 10:08:33 2016: Debug: [suffix] = ok (12813372) Tue Oct 18 10:08:33 2016: Debug: update control { (12813372) Tue Oct 18 10:08:33 2016: Debug: } # update control = noop (12813372) Tue Oct 18 10:08:33 2016: Debug: eap: Peer sent EAP Response (code 2) ID 12 length 74 (12813372) Tue Oct 18 10:08:33 2016: Debug: eap: No EAP Start, assuming it's an on-going EAP conversation (12813372) Tue Oct 18 10:08:33 2016: Debug: [eap] = updated (12813372) Tue Oct 18 10:08:33 2016: Debug: [files] = noop (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: --> (uid=adp\5c2bipad) (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Performing search in "ou=People,ou=NIS,o=vt" with filter "(uid=adp\5c2bipad)", scope "sub" (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Waiting for search result... (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Search returned no results (12813372) Tue Oct 18 10:08:33 2016: Debug: [ldap] = notfound <http://aka.ms/weboutlook>

3 9

EAP-TTLS not working
by Marlen Caemmerer 03 Nov '16

03 Nov '16

Hello, I have a new radius instance running. Unfortunatelly users with MacOS cannot be authenticated. It seems like the password does not come through. Do you have any idea? /etc/freeradius.testing# freeradius -X -d /etc/freeradius.testing freeradius: FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu, built on Oct 24 2014 at 02:05:28 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius.testing/radiusd.conf including configuration file /etc/freeradius.testing/proxy.conf including configuration file /etc/freeradius.testing/clients.conf including configuration file /etc/freeradius.testing/wlan_clients.conf including files in directory /etc/freeradius.testing/modules/ including configuration file /etc/freeradius.testing/modules/sql_log including configuration file /etc/freeradius.testing/modules/perl including configuration file /etc/freeradius.testing/modules/attr_filter including configuration file /etc/freeradius.testing/modules/echo including configuration file /etc/freeradius.testing/modules/rediswho including configuration file /etc/freeradius.testing/modules/digest including configuration file /etc/freeradius.testing/modules/pap including configuration file /etc/freeradius.testing/modules/etc_group including configuration file /etc/freeradius.testing/modules/policy including configuration file /etc/freeradius.testing/modules/mac2ip including configuration file /etc/freeradius.testing/modules/logintime including configuration file /etc/freeradius.testing/modules/cui including configuration file /etc/freeradius.testing/modules/dhcp_sqlippool including configuration file /etc/freeradius.testing/modules/replicate including configuration file /etc/freeradius.testing/modules/radrelay including configuration file /etc/freeradius.testing/modules/ldap including configuration file /etc/freeradius.testing/modules/expr including configuration file /etc/freeradius.testing/modules/counter including configuration file /etc/freeradius.testing/modules/ippool including configuration file /etc/freeradius.testing/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius.testing/modules/cache including configuration file /etc/freeradius.testing/modules/inner-eap including configuration file /etc/freeradius.testing/modules/soh including configuration file /etc/freeradius.testing/modules/checkval including configuration file /etc/freeradius.testing/modules/radutmp including configuration file /etc/freeradius.testing/modules/dynamic_clients including configuration file /etc/freeradius.testing/modules/files including configuration file /etc/freeradius.testing/modules/realm including configuration file /etc/freeradius.testing/modules/unix including configuration file /etc/freeradius.testing/modules/detail.log including configuration file /etc/freeradius.testing/modules/sradutmp including configuration file /etc/freeradius.testing/modules/mac2vlan including configuration file /etc/freeradius.testing/modules/passwd including configuration file /etc/freeradius.testing/modules/acct_unique including configuration file /etc/freeradius.testing/modules/detail.example.com including configuration file /etc/freeradius.testing/modules/linelog including configuration file /etc/freeradius.testing/modules/mschap including configuration file /etc/freeradius.testing/modules/expiration including configuration file /etc/freeradius.testing/modules/chap including configuration file /etc/freeradius.testing/modules/opendirectory including configuration file /etc/freeradius.testing/modules/exec including configuration file /etc/freeradius.testing/modules/pam including configuration file /etc/freeradius.testing/modules/smsotp including configuration file /etc/freeradius.testing/modules/detail including configuration file /etc/freeradius.testing/modules/krb5 including configuration file /etc/freeradius.testing/modules/attr_rewrite including configuration file /etc/freeradius.testing/modules/always including configuration file /etc/freeradius.testing/modules/redis including configuration file /etc/freeradius.testing/modules/preprocess including configuration file /etc/freeradius.testing/eap.conf including configuration file /etc/freeradius.testing/policy.conf including files in directory /etc/freeradius.testing/sites-enabled/ including configuration file /etc/freeradius.testing/sites-enabled/eduroam-inner-tunnel including configuration file /etc/freeradius.testing/sites-enabled/eduroam main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius.testing/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius-eduroam" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius-eduroam/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client local { ipaddr = 192.168.11.50 require_message_authenticator = no nastype = "other" } client 192.168.11.246 { require_message_authenticator = no nastype = "other" virtual_server = "eduroam" } client 172.16.1.18 { require_message_authenticator = no nastype = "other" virtual_server = "eduroam" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no nastype = "other" virtual_server = "eduroam" } client 172.16.1.30 { require_message_authenticator = no virtual_server = "eduroam" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius.testing/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius.testing/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius.testing/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius.testing/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ? modules { } # modules } # server server eduroam-inner-tunnel { # from file /etc/freeradius.testing/sites-enabled/eduroam-inner-tunnel modules { Module: Creating Auth-Type = Perl Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius.testing/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius.testing/modules/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius.testing/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 3 CA_path = "/etc/freeradius.testing/certs" pem_file_type = yes private_key_file = "/etc/freeradius.testing/certs/server.key" certificate_file = "/etc/freeradius.testing/certs/server.pem" CA_file = "/etc/freeradius.testing/certs/ca.pem" dh_file = "/etc/freeradius.testing/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no ecdh_curve = "prime256v1" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "eduroam-inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to module rlm_perl Module: Instantiating module "perl" from file /etc/freeradius.testing/modules/perl perl { module = "/etc/freeradius.testing/auth.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } "my" variable $index_path masks earlier declaration in same scope at /etc/freeradius.testing/auth.pl line 254. Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius.testing/modules/preprocess preprocess { huntgroups = "/etc/freeradius.testing/huntgroups" hints = "/etc/freeradius.testing/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius.testing/huntgroups reading pairlist file /etc/freeradius.testing/hints Module: Linked to module rlm_detail Module: Instantiating module "auth_log" from file /etc/freeradius.testing/modules/detail.log detail auth_log { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius.testing/modules/files files { usersfile = "/etc/freeradius.testing/users" acctusersfile = "/etc/freeradius.testing/acct_users" preproxy_usersfile = "/etc/freeradius.testing/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius.testing/users reading pairlist file /etc/freeradius.testing/acct_users reading pairlist file /etc/freeradius.testing/preproxy_users Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /etc/freeradius.testing/modules/detail detail { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "reply_log" from file /etc/freeradius.testing/modules/detail.log detail reply_log { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } # modules } # server server eduroam { # from file /etc/freeradius.testing/sites-enabled/eduroam modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius.testing/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking pre-proxy {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius.testing/modules/attr_filter attr_filter attr_filter.pre-proxy { attrsfile = "/etc/freeradius.testing/attrs.pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius.testing/attrs.pre-proxy Module: Instantiating module "pre_proxy_log" from file /etc/freeradius.testing/modules/detail.log detail pre_proxy_log { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-proxy {...} for more modules to load Module: Instantiating module "post_proxy_log" from file /etc/freeradius.testing/modules/detail.log detail post_proxy_log { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.post-proxy" from file /etc/freeradius.testing/modules/attr_filter attr_filter attr_filter.post-proxy { attrsfile = "/etc/freeradius.testing/attrs" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius.testing/attrs } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1820 } listen { type = "acct" ipaddr = * port = 1821 } ... adding new socket proxy address * port 40565 Listening on authentication address * port 1820 Listening on accounting address * port 1821 Listening on proxy address * port 1822 Ready to process requests. With kind regards, Marlen Caemmerer -- ************************************************ Alice Salomon Hochschule Computerzentrum Marlen Caemmerer Alice-Salomon-Platz 5 12627 Berlin Email: caemmerer(a)ash-berlin.eu ************************************************

6 17

Proxy accounting packets
by Anuruddha Premalal 01 Nov '16

01 Nov '16

Hi All, I'm trying to proxy all the accounting packets to a different AAA. (Original packets doesn't have a realm) 1. I have added a new realm in proxy.conf realm vamps{ nostrip type = acct ipaddr = 34.161.1.41 port = 1813 secret = abc#16 } 2. Added followig at the top of sites-enabled/default accounting section update control { Proxy-To-Realm := vamps } However whe I sedn a accounting request to home AAA it discards proxying saying *rad_accounting: Cancelling proxy to realm vamps, as it is a LOCAL realm.* Am I doing something wrong with configurations. Appreciate your assistance on this. Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

2 2

Juniper-Local-User-Name reply attribute
by Dave Aldwinckle 31 Oct '16

31 Oct '16

Hi List, I have the following unlang, which works: if (&myAttribute == "srx") { update reply { Cisco-AVPair := "limited" Service-Type := Login-User } } The reply attributes are sent in the Access-Accept as expected: (234) Thu Oct 27 14:56:56 2016: Debug: Sent Access-Accept Id 241 from IP1 to IP2 length 0 (234) Thu Oct 27 14:56:56 2016: Debug: Cisco-AVPair = "limited" (234) Thu Oct 27 14:56:56 2016: Debug: Service-Type = Login-User If I change the unlang to the following, the Juniper-Local-User-Name does not appear in the Access-Accept. The rest of the debug output for entering the if statement looks identical. if (&myAttribute == "srx") { update reply { Juniper-Local-User-Name := "limited" Service-Type := Login-User } } I have confirmed that the proper dictionary exists on the server: # grep Juniper-Local-User-Name /usr/share/freeradius/dictionary.juniper ATTRIBUTE Juniper-Local-User-Name 1 string # radiusd -v radiusd: FreeRADIUS Version 3.0.10, for host x86_64-redhat-linux-gnu, built on Oct 5 2015 at 16:30:01 Any ideas? Unfortunately, I can't trick my Juniper SRX device into accepting Cisco-AVPair attributes. Thanks, Dave

4 3

Installing python librarries for use within rlm_python
by Shabda Raaj 31 Oct '16

31 Oct '16

I have radius 3.0.13 installed and working with rlm_python. I am able to send a RLM_MODULE_OK from within the authorize function. In my sites-enabled I have python { module = example python_path = ${modconfdir}/${.:name} mod_authorize = ${.module} func_authorize = authorize } I have installed sqlalchemy, a Python library and it is correctly installed; as I can see from $ python -c "import sqlalchemy; print sqlalchemy.__version__" 1.1.3 However when I try using it inside of my file being called from rlm_python, I am getting Python version: 2.7.12 (default, Jul 1 2016, 15:12:24) [GCC 5.4.0 20160609] System exec is python_function_load - Module 'example' not found <type 'exceptions.ImportError'> (No module named sqlalchemy) python_function_load - Failed to import python function 'example.authorize' /usr/local/etc/raddb/mods-enabled/python[1]: Instantiation failed for module "python" Is the python binary being used by rlm_python different from the system binary? My radiusd version is radiusd: FreeRADIUS Version 3.0.13 (git #7758e73),

3 2