November 2018 - Freeradius-Users - lists.freeradius.org

Logging EAP-TLS failures
by Norman Elton 02 Nov '18

02 Nov '18

I'm using linelog to syslog RADIUS packets. I've found that if I call my linelog in my "authorize" section, immediately after referring to my EAP module, my linelog has access to all the certificate details. Issuer, expiration, etc. I'd like to have similar details when the certificate is invalid. If the linelog is in the "authorize" section, right after my EAP module, its never reached, as the EAP failure causes the whole authorize section to fail immediately. I've tried putting it in the post-auth section as well, but cannot get it positioned such that the certificate details are available. I've also tried configuring the EAP and linelog modules in a "redundant" section, hoping that the linelog would pick up after the EAP failure. No luck there either. Am I headed in the right direction? Is there a way to catch the certificate details in a linelog module after the certificate has been found invalid? Thanks Norman

3 3

Apostrophe in username
by Dom Latter 02 Nov '18

02 Nov '18

We are using a mysql-backed v3 server and eap / peap / mschapv2. A new user has come along whose email address contains an apostrophe, ('single quote' if you prefer) which is unusual but legitimate. By default we allow users to use their email address as a username. I have found the safe_characters list here: /etc/freeradius/mods-config/sql/main/mysql/queries.conf Without the apostrophe in the safe_characters list, it gets encoded to =27 and so the db query [1] fails to find a user with that username. With the apostrophe in the list, the query fails with "an error in your SQL syntax"... Is there any way out of this conundrum except putting mime-encoded data in the database? [1] authorize_check_query from sql/mysql/dialup.conf

5 11

LDAP OU based authentication
by Tom Yard 02 Nov '18

02 Nov '18

Dear people, I have a Freeradius 2.2.5 authenticating against Active Directory (LDAP). Past week, the AD contained groups and users, and in freeradius I used this option OK and I could authenticate users belonging to WiFi group with the corresponding User-Name: If (LDAP-Group == "WiFi") ... But now, the AD has changed and it hasn't groups anymore. So I have to do an OU based authentication for the users: Basedn: OU=technology,OU=mexico,DC=company,DC=com I've read that DN's are also accepted as LDAP-Group values, so now I'm using this condition: If (LDAP-Group == "OU=technology,OU=mexico,DC=company,DC=com")... but it doesn't work. Please how can I authenticate users in accordance with their OU and not their groups? Thanking in advance, regards. Tommy

3 2

Rewrite Rule
by Maile Halatuituia 02 Nov '18

02 Nov '18

Hi I have this Cisco-AVPair = "acct-input-octets-ipv6=xxx" on my radius acct-request packet coming from my Cisco BRAS. I want to rewrite it to something like this acct-input-octets-ipv6=xxx on my preacct section of my default server (/etc/freeradius/sites-available/default) config and update my request ..... I have this policy already if( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { update request { &acct-input-octets-ipv6 := "%{2}" } } But seems it doing nothing. Maybe my regex above is wrong or something but that's why I ask . Here is the portion of my freeradius -X I think it is relevant to this question. # Executing section preacct from file /etc/freeradius/sites-enabled/default (2) preacct { (2) policy acct_counters64.preacct { (2) update request { (2) WARNING: Can't find &Acct-Input-Gigawords. Using 0 as operand value (2) EXPAND %{expr:(&Acct-Input-Gigawords << 32) | &Acct-Input-Octets} (2) --> 52 (2) &Acct-Input-Octets64 = 52 (2) WARNING: Can't find &Acct-Output-Gigawords. Using 0 as operand value (2) EXPAND %{expr:(&Acct-Output-Gigawords << 32) | &Acct-Output-Octets} (2) --> 92 (2) &Acct-Output-Octets64 = 92 (2) } # update request = noop (2) } # policy acct_counters64.preacct = noop (2) [preprocess] = ok (2) if ( &User-Name !~ /\@/ ) { (2) if ( &User-Name !~ /\@/ ) -> FALSE (2) update request { (2) EXPAND %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} (2) --> 1541032848 (2) &FreeRADIUS-Acct-Session-Start-Time := Nov 1 2018 13:40:48 +13 (2) } # update request = noop (2) policy acct_unique { (2) update request { (2) Tmp-String-9 := "ai:" (2) } # update request = noop (2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (2) EXPAND %{hex:&Class} (2) --> (2) EXPAND ^%{hex:&Tmp-String-9} (2) --> ^61693a (2) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (2) else { (2) update request { (2) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (2) --> 8022139d00768a562a41866693fa1427 (2) &Acct-Unique-Session-Id := 8022139d00768a562a41866693fa1427 (2) } # update request = noop (2) } # else = noop (2) } # policy acct_unique = noop (2) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) { (2) if ( &Cisco-AVPair[*]=~/\(acct-input-octets-ipv6\)=\(\d+)/ ) -> FALSE (2) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) { (2) if ( &Cisco-AVPair[*]=~/\(acct-output-octets-ipv6\)=\(\d+)/ ) -> FALSE (2) } # preacct = ok Confidentiality Notice: This email (including any attachment) is intended for internal use only. Any unauthorized use, dissemination or copying of the content is prohibited. If you are not the intended recipient and have received this e-mail in error, please notify the sender by email and delete this email and any attachment.

3 16