May 2016 - Freeradius-Users - lists.freeradius.org

Use stripped username in SQL
by Tornoci Laszlo 28 May '16

28 May '16

Hi, I am using ldap for authentication, and sql for adding dynamic VLAN IDs. For ldap, the domain is stripped, and the Stripped-User-Name is used for the lookup. However, when the the SQL-User-Name is generated, the domain is added back. I'd like to use the Stripped-User-Name for the SQL lookups as well (in the radusergroup table). How should I do that? I have 3.0.11. Laszlo

2 1

Deleting attributtes for Access-Accept
by Juanjo Abenza 27 May '16

27 May '16

Hello, In my radius server (Ver. 2.2.0), i would like to delete one attributte from the access-accept if a condition is met. The condition would be: If the access-accept packet contains a "Framed-IP-Address" and a "l" attributte, DELETE the "Framed-IP-Address". I was trying to write into "Authorize" section the following statement: if (&Framed-IP_Address !* ANY) && (&Framed-Pool !* ANY) { update reply { Framed-IP-Address -= * } } But doesn´t seems to work If its neccesary i will replicate the configuration on another server for can put here the radius -X output.. Can someone help me with this code lines? Best regards, Juanjo. Sent with Stampery <https://stampery.com/gmail>

4 5

Unlang statement
by Clement Ogedengbe 27 May '16

27 May '16

Can someone please help me with unlang statement that rejects users (without bothering to carry out authentication) if the User-Name ends with "XYZ" Clement

3 2

Use python module to inject parameters to radius context
by Anuruddha Premalal 27 May '16

27 May '16

Hi All, I'm trying to urlencode a string and put that value in a vendor specific attribute via python; and later refer that in site configuration. Here's a snippet of the site configuration authenticate section authenticate { Auth-Type PAP { python_custom update reply { User-Name = "%{User-Name}" My-Redirection-URL = "%{*My-URL-Param*}" My-ACL-Policy = "default_unauth_sla" My-QoS-Policy = "32M_Full" Calling-Station-Id = "%{Calling-Station-Id}" } } } digest eap } Here's the python code snippet in python_custom module def authenticate(p): username = '' clientmac = '' apmac ='' ssid = 'Benu_Test' for authdata in p: if authdata[0] == 'User-Name': username = authdata[1] if authdata[0] == 'Calling-Station-Id': clientmac = authdata[1] if authdata[0] == 'Called-Station-Id': apmac = authdata[1] # how can I inject this VSA to radius context so that it can referenced in the site configuration? My-URL-Param = "http://my.org" + urllib.quote('?clientmac=' + clientmac + '&apmac=' + apmac + '&ssid=' + ssid ) return radiusd.RLM_MODULE_OK Appreciate your help in finding a solution for this. Thanks & Regards, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>Sri Lanka.*

2 3

Catching errors in SQL xlat queries
by Pshem Kowalczyk 27 May '16

27 May '16

Hi, We have a setup where a main frontend cluster (3.0.11) proxies requests to various remote radius servers. We validate and adjust responses from those serves to match the requirements of a particular BNGs the session is on (this is for a DSL/fibre setup). For example if the remote radius system wants the speed of the connection limited to a given number they reply with our own 'SV-Speed-Down' attribute and a value. We do some SQL lookups: update { &control:Tmp-String-0 := "%{frontend_sql:SELECT prefix || '#' || suffix FROM attrib_map, nas_type \ WHERE nas_type.nasid='%{request:NAS-Identifier}' AND \ attrib_map.nas_type = nas_type.type AND \ attrib_map.attribute = 'SV-Speed-Down'}" } in order to figure out the actual syntax required for the particular BNG. Then we use a regex to parse out the details: if (&control:Tmp-String-0 =~ /([a-z-]+)#[a-0-9]+)/) { Recently we had some issues with the DB running out of steam (and handles). We've noticed that this didn't stop the queries from running and returning empty results (and not matching the regex). With the regular rlm_sql queries the module returns 'fail' if there was a problem with the database or 'notfound' if there was nothing to return. Is there a way to detect the 'fail' state with the xlat queries? kind regards Pshem

5 6

FreeRADIUS not sending "Access-Accept" for Cisco Phone
by craig＠mypenguin.net.au 27 May '16

27 May '16

Hi, 802.1x Authentication with EAP-TLS, works perfectly with a Centos client, however not from a Cisco IP Phone. Basic Specs For Server; * Centos 7.2 x64 * freeradius-3.0.4-6.el7.x86_64 * Communicating through a Dell N3000 switch. * Cisco 7841 IP Phone I've been studying the debug logs as best I can, the working log clearly shows "Sending Access Accept Packet" (output below). However when I read the debug for the Cisco phone connection, we see hundreds (would eventually be thousands) of attempts without ever seeing the below successful packet sent back. I'm just after any suggestions on how to better debug the connection from the Cisco phone? ---------- CUT (working example with Centos Client) --------------- Sending Access-Accept packet to host 192.168.11.62 port 34495, id=119, length=0 (6) MS-MPPE-Recv-Key = 0x069dfe1c5f6660fe98f7d39c311e1c52bea7445e54d05f2706c154542ed5b3fa (6) MS-MPPE-Send-Key = 0x54782fc7b655096c1a45437c1cae96d4217867c8403c0f1edd3a8438330aad81 (6) EAP-MSK = 0x069dfe1c5f6660fe98f7d39c311e1c52bea7445e54d05f2706c154542ed5b3fa 54782fc7b655096c1a45437c1cae96d4217867c8403c0f1edd3a8438330aad81 (6) EAP-EMSK = 0xcfa717399d049b7ca5f438a07c6bffc0e199bd24182a903fd759c84eb13765feda5bfd396f403068ef377c20c0ea46c2628917fd644afd54556a00b79652fa3a (6) EAP-Session-Id = 0x0d57469718eb7768f033c8f06c17b709ca49254502c930e10641848a9551823e395746989ca0c8126d5fe044a497974be973775d2f5f3b401cc023e449ef983787 (6) EAP-Message = 0x03160004 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) User-Name = 'craig' Sending Access-Accept Id 119 from 192.168.11.61:1812 to 192.168.11.62:34495 MS-MPPE-Recv-Key = 0x069dfe1c5f6660fe98f7d39c311e1c52bea7445e54d05f2706c154542ed5b3fa MS-MPPE-Send-Key = 0x54782fc7b655096c1a45437c1cae96d4217867c8403c0f1edd3a8438330aad81 EAP-Message = 0x03160004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'craig' (6) Finished request ---------- CUT ------------------------------------------ Regards, Craig

2 5

FreeRadius , can't load /import python external library
by Edouard Etancelin 26 May '16

26 May '16

Hi Freeradius 3.0.11 Ubuntu 15:10 I am a freeradius newbie and i tring to import an external library into (PyJWT) for a freeradius authorization, but when i run freeradius -X i get this error message. # Instantiating module "python" from file /etc/freeradius/mods-enabled/python mod_init done rlm_python:mod_load_function: module 'example' is not found rlm_python:EXCEPT:<type 'exceptions.ImportError'>: No module named jwt rlm_python:mod_load_function: failed to import python function 'example.authorize' /etc/freeradius/mods-enabled/python[10]: Instantiation failed for module "python" When i try to import the package from the terminal, everything is ok. Python 2.7.10 (default, Oct 14 2015, 16:09:02) [GCC 5.2.1 20151010] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import jwt >>> encoded = jwt.encode({'some': 'payload'}, 'secret', algorithm='HS256') >>> jwt.decode(encoded, 'secret', algorithms=['HS256']) {u'some': u'payload'} The python file is : #! /usr/bin/env python # ... import radiusd import jwt def instantiate(p): .... def authorize(p): print "*** authorize ***" but if instead i use : #! /usr/bin/env python # ... import radiusd #import jwt def instantiate(p): .... def authorize(p): print "*** authorize ***" ,freeradius start as espected . My dockerfile is : >From ubuntu:15.10 #1;5C radiussrvbase docker image configuration file # This docker configuration file use ubuntu 15:10 willy distrib and install freeradius server 3.x. RUN apt-get update \ && apt-get install -y software-properties-common \ && apt-get install -y python2.7-dev \ && apt-get install -y python-pip \ && pip install PyJWT \ && add-apt-repository ppa:freeradius/stable-3.0 \ && apt-get update \ && apt-get install -y freeradius-mysql \ && apt-get install -y freeradius=3.0.11-ppa2~wily WORKDIR /etc/freeradius #File import Should i declare external python library in freeradius ? Does i miss something ? Best regards

1 0

FreeRadius-Response-Delay
by Pshem Kowalczyk 26 May '16

26 May '16

Hi, I would like to delay access-accept responses to some requests (we have multiple ones coming simultaneously from 2 BNGs, due to the way access network is built). I found the FreeRADIUS-Response-Delay and FreeRADIUS-Response-Delay-USec attributes, but I'm clearly doing something wrong, as the accept is sent immediately: {...} Thu May 26 15:19:17 2016 : Debug: (0) update { Thu May 26 15:19:17 2016 : Debug: (0) &control:FreeRADIUS-Response-Delay := 5 Thu May 26 15:19:17 2016 : Debug: (0) &control:FreeRADIUS-Response-Delay-USec := 500000 Thu May 26 15:19:17 2016 : Debug: (0) &reply:FreeRADIUS-Response-Delay := 5 Thu May 26 15:19:17 2016 : Debug: (0) &reply:FreeRADIUS-Response-Delay-USec := 500000 Thu May 26 15:19:17 2016 : Debug: (0) } # update = noopThu May 26 15:13:54 2016 : Debug: (0) Sent Access-Accept Id 155 from 127.0.0.1:1812 to 127.0.0.1:51976 length 0 Thu May 26 15:19:17 2016 : Debug: (0) } # post-auth = ok Thu May 26 15:19:17 2016 : Debug: (0) Sent Access-Accept Id 0 from 127.0.0.1:1812 to 127.0.0.1:33099 length 0 Thu May 26 15:19:17 2016 : Debug: (0) Cisco-AVPair += "ip:qos-policy-out=add-class(sub,(class-default),police(3000),set-ip-dscp(0),set-cos-inner(0))" {..} (I've tried various combinations of the control/reply USec/Sec) Delay on Auth-Reject works as expected. googling didn't turn up any examples either. I'm running 3.0.11 - how are these attributes supposed to be used? Thx, kind regards Pshem

2 2

Freeradius DHCP rest module
by Fabrice Durand 25 May '16

25 May '16

Hello, i am currently trying to replace isc-dhcp with freeradius dhcp server on PacketFence. The dhcp work well, i am able to give ip address on layer 2 and layer 3 network. Now i want to add hooks in DHCP-Discover and DHCP-Request with rlm_rest but i am not sure if this module can do that since there only theses scopes: authorize authenticate accounting post-auth Is there a workaround or does this is not yet implemented ? Regards Fabrice -- Fabrice Durand fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org)

3 2

Re: User login restrictions based on SSID
by Eby Mani 25 May '16

25 May '16

Hi Alan De & Alan Buxey, There is some confusion going on here. I have already attached freeradius -X output (as text file) in my first mail itself, to which Alan De replied "If only there was some kind of debug log, where you could see what the server was doing". I assumed he already gone thru the attachment and want to see the radius.log. Thus i have posted contents of radius.log If you want me to send the freeradius -X output again, i'll post it here. I understand you guys are busy with other activities and I appreciate your involvement here on the mailing list. cheers, Eby -------------------------------------------- On Wed, 25/5/16, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> wrote: Subject: Re: User login restrictions based on SSID To: "Eby Mani" <eby_km(a)yahoo.com> Cc: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, 25 May, 2016, 2:51 PM Hi, > If the SQL can't connect, how authentication work as user details are stored in db?. I was able to login thru Radius and i have not enabled Radius caching of anysort on my WLAN controller. well, it cant. but if you read the output, you'll see it has connected this time. i guess your SQL wasnt running last time..... just read the output! > Following is today's radius.log, there isn't much info, is there a command to log more info regarding this ?. run in debug mode, not just as a service radiusd -X or freeradius -X on debian/ubuntu package builds. > Wed May 25 14:54:09 2016 : Auth: Login incorrect: [sales/<via Auth-Type = EAP>] (from client aruba port 0 via TLS tunnel) > Wed May 25 14:54:09 2016 : Auth: Login incorrect: [sales/<via Auth-Type = EAP>] (from client aruba port 0 cli 38192fb2eb02) in full debug mode you'd see why this failed. > Wed May 25 16:00:08 2016 : Auth: Login OK: [eby] (from client aruba port 0 via TLS tunnel) > Wed May 25 16:00:08 2016 : Auth: Login OK: [eby] (from client aruba port 0 cli e02a82e1afbf) and that worked alan

4 3