December 2016 - Freeradius-Users - lists.freeradius.org

Freeradius 3.0.12 problems - redis and mysql pool connections
by Michal Tomaszewski 28 Dec '16

28 Dec '16

Hello Alan, I found 2 problems in freeradius 3.0.12 To be short: Our several freeradius servers are using MySQL cluster (percona) and redis master/slave mapped to local port using HA Proxy on each freeradius server. So in fact each Freeradius sees 1 local port for MySQL and 1 local port for redis. We are not using server pool and load balancing definition in Freeradius in order to have strict control on which database server is used for all writes from several Freeradius servers. To be sure Freeradius is starting when redis or sql is not started yet (or not available for a while) in both redis and sql pool definition we have to use: pool { start = 0 but we also want to have min number of connections defined higher than 0 (e.g. in a standard way): min = ${thread[pool].min_spare_servers} So min > start. When server (sql or redis) becomes available Freeradius opens some connections. After restart of sql or redis Freeradius should open new connections to those servers as old connections are not longer available. And we have 2 errors #1 When redis becomes unavailable for a while (restart of redis-server or simple restart of HA_Proxy) Freeradius does not check that connection is no longer available and keeps those invalid connections till lifetime time. In fact in such situation old connection should be discarded and new connection shall be opened. Standard lifetime in mods-available/redis is set to 86400 so redis module is not able to read/write anything from redis-server for 24 hours. In /var/log/freeradius/radius.log there are only ERRORs when there is redis write command, there is no error information when there is (unsuccessful) read command. To see that debug mode shall be started. So in fact redis module is not verifying redis valid/invalid connection state. Changing lifetime to e.g. 60 helps to force redis module start working (in 60 second from redis-server restart) but that is just a workaround not a solution. #2 In var/log/freeradius/radius.log we have lots of errors: ERROR: SQL query failed: no connection It seems that error shows up when connection is closed by e.g. idle-timeout... Example: Thu Dec 22 15:48:35 2016 : Debug: attribute --> User-Name Thu Dec 22 15:48:35 2016 : Debug: (81) EXPAND %{User-Name} Thu Dec 22 15:48:35 2016 : Debug: (81) --> h274_xxxxxxxxxxxxxx Thu Dec 22 15:48:35 2016 : Debug: (81) SQL-User-Name set to 'h274_xxxxxxxxxxxxxx' Thu Dec 22 15:48:35 2016 : Debug: rlm_sql (sql): Reserved connection (4) Thu Dec 22 15:48:35 2016 : Debug: (81) Executing select query: INSERT INTO radius_radacct_closed ( acctsessionid, acctuniqueid, username, hotspot_id, device_id, felogin_id, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress ) VALUES ('585be1cc00000004', 'e2a5c5294e55743ffc9169de47d5de4a', 'h274_xxxxxxxxxxxxxx', '274', '3625', '3799789', '', '192.168.176.1', '00000004', 'Wireless-802.11', FROM_UNIXTIME(1482418115 - 1460), FROM_UNIXTIME(1482418115), FROM_UNIXTIME(1482418115), 1460, '', '', '', '0' << 32 | '129433', '0' << 32 | '1435982', 'h274-xxxxxxxxxxxxxx', 'EC-9B-F3-19-4A-F2', 'Lost-Carrier', '', '', '192.168.176.5') Thu Dec 22 15:48:35 2016 : ERROR: (81) SQL query failed: no connection Thu Dec 22 15:48:35 2016 : Debug: rlm_sql (sql): Released connection (4) Thu Dec 22 15:48:35 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:48:35 2016 : Debug: (81) EXPAND %{sql: INSERT INTO radius_radacct_closed ( acctsessionid, acctuniqueid, username, hotspot_id, device_id, felogin_id, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress ) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{User-Name}', '%{LOCATION-HotspotID}', '%{LOCATION-DeviceID}', '%{LOCATION-FELogin-Id}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%l - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%l), FROM_UNIXTIME(%l), %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') } Thu Dec 22 15:48:35 2016 : Debug: (81) --> freeradius log looks like: radius1:~$ tail /var/log/freeradius/radius.log Thu Dec 22 15:59:45 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:47 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:47 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:48 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:48 2016 : ERROR: (164) ERROR: SQL query failed: no connection Thu Dec 22 15:59:48 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:51 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:54 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:54 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:54 2016 : ERROR: (172) ERROR: SQL query failed: no connection We tested to set freeradius use mysql directly, without haproxy and using default values in mods-availables/sql (including pool { start value) but it did not change this strange behavior. Any help would be appreciated... Regards, Mike ________________________________________ Uwaga: Treść niniejszej wiadomości może być poufna i objęta zakazem jej ujawniania. Jeśli czytelnik tej wiadomości nie jest jej zamierzonym adresatem, pracownikiem lub pośrednikiem upoważnionym do jej przekazania adresatowi, informujemy że wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomości jest zabronione. Jeśli otrzymałeś tę wiadomość omyłkowo, proszę bezzwłocznie odesłać ją nadawcy, a samą wiadomość usunąć z komputera. Dziękujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

3 5

Multiple realms and network validation with WPA2 Enterprise
by Henti Smith 27 Dec '16

27 Dec '16

Good morning all. I've searched a bit and while I found some information about how the client validates the SSID using certificates, it's not entirely clear how to make sure a fake SSID cannot steal user/pass from clients. As per previous mails, we're running EAP method TTLS with PAP 2nd phase against a Kerberos oracle. We're using CA signed wildcard cert for our internal network. Do we need to use a username@domain username structure to validate the realm (I assume using the domain_realm config in /etc/krb5.conf) use SSL to validate the radius server it's communicating with ? Does that also mean we can have multiple domains pointing to multiple realms using seperate realms and domain_realm configurations ? Regards Henti -- --

6 9

custom attributes per realm/proxy after auth.
by Benedikt Sveinsson 24 Dec '16

24 Dec '16

Current running environment: freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 postgres 9.3 Hi all I’m running FR for a number of BRAS’es and I’m working on implementing BNG service (cisco XR) Up to now, we have been able to do realm processing on the BRAS’es them self, just used radius for auth, but have to go to a centralised solution. We have number of proxy connections to 3rd party radius servers, based on domain name, and for each of those 3rd parties, I need to be able to reply to the NAS(BNG) number of radius attributes(AV pairs, tunnel info etc.. ) this is the flow: BNG -> my radius -> 3rd party radius 3rd party radius (auth only) -> my radius (adds attributes) -> BNG can someone point me in the right direction where this is configured - Benedikt

3 4

VLAN Assignment with RADIUS
by Valentin Heidelberger 24 Dec '16

24 Dec '16

Hey everyone, I am trying to do the following with RADIUS There is 1 AP with 2 SSIDs - lets cal them "B" and "P" I want RADIUS to assign VLAN20 to "P" and VLAN40 to "B" I have found no other method online than configuring static users in the users file with VLANs assigned to them. In my setup users are authenticated with LDAP. Do I really have to assign every single user the VLAN or is there a simpler way like assigning the VLAN to a virtual server running on a different port or something focussed on the SSIDs? Kind regards

4 6

Simultaneous-Use + MySQL + Ubuntu 16.04 Srv + Mikrotik RB + Unifi AP
by Cadu Garcia 22 Dec '16

22 Dec '16

Hello! I read a lot of docs on Internet and tried examples but I still having problems. I can't use Simultaneous-Use attribute with MySQL. Neither with groups option. My platform is on Ubuntu 16.04 Server and I'm using Mikrotik RB750 to provide DHCP and my AP is Ubiquiti Unifi UAP-LR. Everything seems works fine like Authentication on MySQL DB and Post-auth data. But radacct DB is empty. Can you help me? Best regards.

2 1

Problem with exec shell_escape option
by Brian Candler 22 Dec '16

22 Dec '16

I'm trying to get exec to pass a string as an argument without any shell quoting, but not succeeding. This is with freeradius 3.0.12 under Ubuntu 16.04. [Aside: what I'm actually trying to do is invoke an external change password program using an exec expansion in local_cpw in rlm_mschap, following the example given: # local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}" But I'm finding that passwords with special characters are being mangled] I can reproduce this using exec by itself. Here are 4 combinations: shell_escape = {yes,no} and expansion argument quoted/not quoted. # mods-available/exec - I left the original exec in there and added: exec exec1 { wait = yes input_pairs = request shell_escape = no timeout = 10 } exec exec2 { wait = yes input_pairs = request shell_escape = yes timeout = 10 } # policy.d/testpolicy testpolicy { update request { &Tmp-String-0 := " foo ' bar \" baz \\ qux " &Tmp-String-1 := "%{exec1:/usr/local/bin/showarg %{Tmp-String-0}}" &Tmp-String-2 := "%{exec1:/usr/local/bin/showarg '%{Tmp-String-0}'}" &Tmp-String-3 := "%{exec2:/usr/local/bin/showarg %{Tmp-String-0}}" &Tmp-String-4 := "%{exec2:/usr/local/bin/showarg '%{Tmp-String-0}'}" } } # /usr/local/bin/showarg #!/bin/sh echo "Arg is <$1>" >>/tmp/exec.log Results: - 1 and 3 fail with "rad_expand_xlat: Invalid string passed as argument" - 2 and 4 both apply shell quoting to the argument # cat /tmp/exec.log Arg is <\ foo\ \'\ bar\ "\ baz\ \ qux\ > Arg is <\ foo\ \'\ bar\ "\ baz\ \ qux\ > Debug output: (0) policy testpolicy { (0) update request { (0) &Tmp-String-0 := " foo ' bar \" baz \\ qux " (0) Executing: /usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ : rad_expand_xlat: Invalid string passed as argument invalid command line '/usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ '. (0) EXPAND %{exec1:/usr/local/bin/showarg %{Tmp-String-0}} (0) --> (0) &Tmp-String-1 := (0) Executing: /usr/local/bin/showarg '\ foo\ \'\ bar\ "\ baz\ \\ qux\ ': (0) Program returned code (0) and output '' (0) EXPAND %{exec1:/usr/local/bin/showarg '%{Tmp-String-0}'} (0) --> (0) &Tmp-String-2 := (0) Executing: /usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ : rad_expand_xlat: Invalid string passed as argument invalid command line '/usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ '. (0) EXPAND %{exec2:/usr/local/bin/showarg %{Tmp-String-0}} (0) --> (0) &Tmp-String-3 := (0) Executing: /usr/local/bin/showarg '\ foo\ \'\ bar\ "\ baz\ \\ qux\ ': (0) Program returned code (0) and output '' (0) EXPAND %{exec2:/usr/local/bin/showarg '%{Tmp-String-0}'} (0) --> (0) &Tmp-String-4 := (0) } # update request = noop (0) } # policy testpolicy = noop So it looks like the shell_escape setting isn't doing anything. What am I missing? Thanks, Brian. P.S. There is something else confusing. In raddb/mods-available/exec it says: # Execute external programs # # This module is useful only for 'xlat'. To use it, # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{exec:/path/to/program args}` However, I can see from the source that it has hooks for the various module lifecycle stages; indeed, the sites-available/default config invokes it in the accounting and post-auth stages: # For Exec-Program and Exec-Program-Wait exec So is the comment that exec is "useful only for 'xlat'" incorrect? I've checked the obvious places for documentation with no luck: - http://wiki.freeradius.org/search?q=exec - man rlm_exec (not found) But in any case, it doesn't affect the main issue here, since local_cpw has to use a string expansion anyway.

2 2

Re: Freeradius-Users Digest, Vol 140, Issue 40
by firing neurons 21 Dec '16

21 Dec '16

I used a Tmp-String-x and that also fixed it. About spliting the Tmp-Integer64 for sqlcounter reply name, where would I split this? Can I just put two reply attributes in sqlcounter? May be do the math there? or updating the reply list with the two attributes, calculating their value using expr in unlang is the only way? Message: 1 Date: Tue, 20 Dec 2016 20:32:54 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: attribute overflow from sql query in unlang Message-ID: <BF8722F4-167C-48A7-BD00-53C729BECA4D(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Dec 20, 2016, at 7:32 PM, firing neurons <firingneurons(a)mail.com> wrote: > Why is their an overflow in the first case? I am using radius3 Because Tmp-Integer is a 32-bit integer. > The same query is used by the relevant sqlcounter module and it works > as expected and doesn't overflow. > > I am trying to send CoA disconnect to the NAS after the user exhuasts > their data with sql and unlang logic in accounting section. > > I also tried simply using the reply attribute Mikrotik-Total-Limit but > the the NAS also expected Mikrotik-Total-Limit-Gigawords. > > The sqlcounter I made simply sent overflown value in > Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be > enforced. Use a 64-bit attribute. e.g. Tmp-Integer64 > Any way I can send the extra reply attribute from the sqlcounter? You will need to manually split Tmp-Integer64 into two different 32-bit attributes. Alan DeKok. ------------------------------

2 1

Binding MAC address with username
by Alexandre Croteau 21 Dec '16

21 Dec '16

Hello, For my setup, I'd like to bind a MAC address to a specific user when it first login. For exemple, user 1 connects from computer 00:11:22:33:44:55. I'd like the system to remember this MAC address, so that the next time the user reuses this same computer, it does not asks to connect again. This way, the users would rather be the mac addresses. Another solution I think would be to store the MAC address as a new user in the same group as user 1. Which way would be the best? Thanks, Acrilex

3 5

FreeRADIUS 3.0.12: SQL xlat return back-quoted value in response
by Alexey Dotsenko 21 Dec '16

21 Dec '16

Hello! Test environment: Centos 7 (x86_64), FreeRADIUS 3.0.12 - rpm build from upstream source 3.0.12 (based on fedoraproject spec file (without code patches)). MariaDB [radius]> select * from radgroupreply; +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ | 3 | ras | cisco-avpair | += | ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224 | | 12 | ras | cisco-avpair | += | ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224 | | 14 | ras | Fall-Through | := | Yes | | 29 | ras | Cisco-AVPair | += | `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` | +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ 4 rows in set (0.00 sec) Back-quoted string (id 29 in radgroupreply) exlat-ed properly, but remains (in response) back-quoted (and as a result, rejected by nas): Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Group "ras": Merging reply items Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Fall-Through := Yes Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "`ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l`" Tue Dec 20 11:37:46 2016 : Debug: `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` Tue Dec 20 11:37:46 2016 : Debug: Parsed xlat tree: Tue Dec 20 11:37:46 2016 : Debug: literal --> `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP- Tue Dec 20 11:37:46 2016 : Debug: if { Tue Dec 20 11:37:46 2016 : Debug: attribute --> SQL-Group Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: else { Tue Dec 20 11:37:46 2016 : Debug: if { Tue Dec 20 11:37:46 2016 : Debug: attribute --> User-Name Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: else { Tue Dec 20 11:37:46 2016 : Debug: literal --> None Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: literal --> - Tue Dec 20 11:37:46 2016 : Debug: percent --> l Tue Dec 20 11:37:46 2016 : Debug: literal --> ` Tue Dec 20 11:37:46 2016 : Debug: (1) sql: EXPAND `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` Tue Dec 20 11:37:46 2016 : Debug: (1) sql: --> `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482223066` ... Tue Dec 20 11:37:47 2016 : Debug: (1) Sent Access-Accept Id 191 from 172.18.200.21:1812 to 172.18.200.2:48332 length 0 Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "`ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482223066`" Tue Dec 20 11:37:47 2016 : Debug: (1) Reply-Message = "privacyIDEA access granted" Tue Dec 20 11:37:47 2016 : Debug: (1) Finished request I looked at the source code of the module rlm_sql (sql.c, function sql_fr_pair_list_afrom_str) - back-quoted string marked for xlat and remains in quotes. I tried to change this behavior - take the value for xlat without quotes: diff -ru freeradius-server-3.0.12.orig/src/modules/rlm_sql/sql.c freeradius-server-3.0.12/src/modules/rlm_sql/sql.c --- freeradius-server-3.0.12.orig/src/modules/rlm_sql/sql.c 2016-09-29 18:19:48.000000000 +0300 +++ freeradius-server-3.0.12/src/modules/rlm_sql/sql.c 2016-12-20 11:44:37.001299860 +0300 @@ -168,16 +168,13 @@ break; /* - * Mark the pair to be allocated later. + * Take the unquoted string and mark the pair to be allocated later. */ case T_BACK_QUOTED_STRING: do_xlat = 1; - /* FALL-THROUGH */ - - /* - * Keep the original string. - */ + value = buf; + break; default: value = row[3]; break; in this case, xlat-ed string return unquoted: Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Group "ras": Merging reply items Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Fall-Through := Yes Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l" Tue Dec 20 11:59:27 2016 : Debug: ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l Tue Dec 20 11:59:27 2016 : Debug: Parsed xlat tree: Tue Dec 20 11:59:27 2016 : Debug: literal --> ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP- Tue Dec 20 11:59:27 2016 : Debug: if { Tue Dec 20 11:59:27 2016 : Debug: attribute --> SQL-Group Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: else { Tue Dec 20 11:59:27 2016 : Debug: if { Tue Dec 20 11:59:27 2016 : Debug: attribute --> User-Name Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: else { Tue Dec 20 11:59:27 2016 : Debug: literal --> None Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: literal --> - Tue Dec 20 11:59:27 2016 : Debug: percent --> l Tue Dec 20 11:59:27 2016 : Debug: (1) sql: EXPAND ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l Tue Dec 20 11:59:27 2016 : Debug: (1) sql: --> ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482224367 ... Tue Dec 20 11:59:28 2016 : Debug: (1) Sent Access-Accept Id 120 from 172.18.200.21:1812 to 172.18.200.2:57555 length 0 Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482224367" Tue Dec 20 11:59:28 2016 : Debug: (1) Reply-Message = "privacyIDEA access granted" Tue Dec 20 11:59:28 2016 : Debug: (1) Finished request Do I understand correctly that the removal of quotes should not do later - in the xlat code area? Best regards, Alex Dotsenko.

4 5

CoA -> REST
by adrian.p.smith＠bt.com 21 Dec '16

21 Dec '16

Please can someone say whether it's possible to receive a CoA and pass that into the REST module? I tried a simple configuration using 3.0.11 and got a startup error: /home/adrian/freeradius-server-3.0.11/etc/raddb/sites-enabled/coa[38]: "rest" modules aren't allowed in 'recv-coa' sections -- they have no such method. /home/adrian/freeradius-server-3.0.11/etc/raddb/sites-enabled/coa[23]: Errors parsing recv-coa section. We use the REST module quite extensively for auth and acct requests and would like to do similar for coa. Thanks, Adrian Smith

4 19