February 2018 - Freeradius-Users - lists.freeradius.org

RE: Cisco-AVPair regex
by Kylián Martin 26 Feb '18

26 Feb '18

> TBH, the simplest thing is to *not* use "foreach". I'd guess that the Cisco- > AVPair attributes come in the same order all the time. So you can just rely on > that. e.g. > > if (Cisco-AVPair[0] =~ /^dhcp-option=/) { > update request { > Tmp-Integer-0 := "%{unpack:&Cisco-AVPair[0] 12 > integer}" > } > } > > That will get you the binary data (4 octets) into Tmp-Integer-0. Thank you Alan. It works. AVPs always come in the same order. The unpacked data looks correctly. The last modest question yet - how the get the rest of the attribute (string following the TLV binary code)? > > i.e. *manually* check that Cisco-AVPair[0] is the "dhcp-option". Then, > *manually* check that the binary data you want is at byte offset 12. And > then write an "unpack" rule to do that... > > Alan DeKok. > > > -

2 1

Freeradius 3.0.13-8.el7_4 and external syslog server
by Bram Assendorp 26 Feb '18

26 Feb '18

Hello Freeradius Users, I have installed a freeradius server on Centos 7. Now I want to have the freeradius messages forwarded to a external syslog server. Within the radiusd.conf I have changed the "logdir" and "destination" parameter to "syslog" Also added the *.* @IPAddress:514 at the end of the rsyslog.conf file. Restarted both the rsyslog and radiusd service, but then no client will authenticate. I'm getting the following errors: *-- 2018-02-26 08:46:48 Daemon.Debug servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: (0) auth_log: ERROR: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied 2018-02-26 08:46:48 Daemon.Notice servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: (0) Invalid user (auth_log: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied): [b8386116681f/b8386116681f] (from client SWITCHNAME port 50001 cli B8-38-61-16-68-1F) 2018-02-26 08:46:48 Daemon.Info servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: Need 4 more connections to reach 10 spares 2018-02-26 08:46:48 Daemon.Info servername.local Feb 26 08:46:48 SERVERNAME radiusd[31843]: rlm_sql (SHBMSQL01): Opening additional connection (6), 1 of 26 pending slots used 2018-02-26 08:46:57 Daemon.Debug servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: (1) auth_log: ERROR: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied 2018-02-26 08:46:57 Daemon.Notice servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: (1) Invalid user (auth_log: Couldn't open file syslog/radacct/192.168.1.7/auth-detail-20180226: Failed to create directory syslog: Permission denied): [b8386116681f/b8386116681f] (from client SWITCHNAME port 50001 cli B8-38-61-16-68-1F) 2018-02-26 08:46:57 Daemon.Info servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: Need 3 more connections to reach 10 spares 2018-02-26 08:46:57 Daemon.Info servername.local Feb 26 08:46:57 SERVERNAME radiusd[31843]: rlm_sql (SHBMSQL01): Opening additional connection (7), 1 of 25 pending slots used 2018-02-26 08:47:13 Daemon.Error servername.local Feb 26 08:47:13 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:18 Daemon.Error servername.local Feb 26 08:47:18 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:23 Daemon.Error servername.local Feb 26 08:47:23 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp 2018-02-26 08:47:28 Daemon.Error servername.local Feb 26 08:47:28 SERVERNAME radiusd[31843]: Ignoring request to auth address * port 1812 bound to server default from unknown client 192.168.1.192 port 1645 proto udp *-- Thank you for your help. Kind Regards, Bram.

3 5

FreeRADIUS Proxy+CoA+TLS
by Goitom Seyoum 24 Feb '18

24 Feb '18

My team is evaluating freeradius if we can use it for a project. The requirements we have where we see freeradius can be a solution are the support of proxy, CoA and TLS. The network structure looks like: AP/Controller <-----LinkA-----> freeradius proxy <-----LinkB-----> cloud server LinkA uses RADIUS over UDP LinkB uses RadSec over TLS >From cloud server CoA messages will be sent over LinkB. So far my team has verified the following working: 1 - Proxy + TLS 2 - Proxy + CoA But we are unable to verify Proxy + TLS + CoA, is this supported/possible with freeradius? If it is possible, our goal is to use the same LinkB connection/socket that was established by the first Access-Request for cloud server initiated CoA messages. Is it possible to configure the proxy to listen CoA messages via that same socket used for sending auth+acct requests? Thank you in advance for your help!

2 1

Incorrect reply rlm_python with tagged attributes
by Юрий Иванов 23 Feb '18

23 Feb '18

Incorrect reply rlm_python with tagged attributes I've created python authorization module. It based on example provided by vendor. At first glance it works well but when trying to perform testing with radtest reply is: ... User-Password = "testing123" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "testing123" Received Access-Accept Id 188 from 127.0.0.1:1812 to 0.0.0.0:0 length 48 ERX-Service-Activate:0 = "svc-local-ipoe" There is only one ERX-Service-Activate:0 with strange zero? Python function def authorize(p) has reply tuple: reply = (('Framed-IP-Address', str(client.ipv4)), ('ERX-Service-Activate:1', 'svc-local-ipoe'), ('ERX-Service-Activate:2', 'svc-local-ipoe(%s)' % str(client.speed_localnet)), ('ERX-Service-Activate:3', 'svc-foreign-ipoe(%s,%s)' % (str(client.speed_foreign), str(client.speed_localnet))),) Of course radius started in debug mode, and radiusd -X shows me another output: authorize - 'reply:Framed-IP-Address' = '10.0.0.1' authorize - 'reply:ERX-Service-Activate:3' = 'svc-local-ipoe' authorize - 'reply:ERX-Service-Activate:4' = 'svc-localnet-ipoe(110000)' authorize - 'reply:ERX-Service-Activate:5' = 'svc-foreignnet-ipoe(110000,110000)' authorize - 'config:Auth-Type' = 'Accept' authorize - 'config:Cleartext-Password' = 'testing123' How to get all ERX-Service-Activate tagged attributes, not the strange with zero. P.S. Reply in Wireshark shown only one ERX-Service-Activate attribute too in reply packet. P.P.S. Maybe I've construct reply with tag incorrectly? But I can find no additional information about this.

2 4

DHCP and Option 82
by Daniel Ryšlink 23 Feb '18

23 Feb '18

Hello, Can anyone please provide a link to a working example of a Freeradius with DHCP virtual server where the users accessing the network are identified not by a MAC address, nor by Calling-Station-ID, but by the attributes encoded into Option 82, specifically in the radius packet: (0) ADSL-Agent-Circuit-Id = 0x4769302f31393a3130 (0) ADSL-Agent-Remote-Id = 0x010b465454582d535749544348 And in the DHCP packet: OPTION: 82 ( 26) Relay Agent Information Circuit-ID 47:69:30:2f:31:39:3a:31:30 Remote-ID 01:0b:46:54:54:58:2d:53:57:49:54:43:48 The file mods-enabled/dhcp states in comments only this: "# This module is useful only for 'xlat'. To use it, # put 'dhcp' into the 'instantiate' section. # # %{dhcp_options:<Attribute-ref>} may be used to decode # DHCP options data included in RADIUS packets by vendors # of DHCP to RADIUS gateways. # # This is known to work with the following VSAs: # * Juniper - ERX-Dhcp-Options # * Alcatel lucent SR - Alc-ToServer-Dhcp-Options # - Alc-ToClient-Dhcp-Options #" I use MySQL as a backend for my ippools, but the queries.conf work only operate with "Calling-Station-Id", or "Nas-Port-Id". Is the solution to define in mods-enabled/dhcp something like: dhcp { Calling-Station-Id = %{dhcp_options:<Circuit-ID>}%{dhcp_options:<Agent-ID>} } ? Any information will be greatly appreciated, thank you. -- S pozdravem, Daniel Ryšlink System Administrator Dial Telecom a. s. Křižíkova 36a/237 186 00 Praha 3, Česká Republika Tel.:+420.226204627 daniel.ryslink(a)dialtelecom.cz ----------------------------------------------- www.dialtelecom.cz Dial Telecom, a.s. Jednoduše se připojte -----------------------------------------------

3 7

Cisco-AVPair regex
by Kylián Martin 23 Feb '18

23 Feb '18

Hi all, I'm trying to save some of the Cisco-AVPair attributes into sql while acounting. Specifically, I'm interested in the dhcp-options and http-tlv attributes. WLC describes the connected device in these. Unfortunately, Freeradius 3.12 expands these values unregexable way. (With_cisco_vsa_hack = yes in preprocess the result is the same) Correctly expanded is just Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" Policy file: device_regex = '^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)' () fill_device_type { if (&Cisco-AVPair) { foreach &Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) { update request { &Calling-Device += "%{8} " } } } } } Processing: (98) Received Accounting-Request Id 28 from 192.168.241.30:57614 to 172.31.12.101:1813 length 482 (98) User-Name = "martin" (98) NAS-Port = 8 (98) NAS-IP-Address = 192.168.241.30 (98) Framed-IP-Address = 10.252.136.9 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = 2a07:8d84:800:325f::/64 (98) Framed-IPv6-Prefix = fe80::/64 (98) NAS-Identifier = "d4-wlc5520" (98) Airespace-Wlan-Id = 20 (98) Acct-Session-Id = "5968a7cb/34:ab:37:ed:a2:bb/90671" (98) NAS-Port-Type = Wireless-802.11 (98) Cisco-AVPair = "audit-session-id=1ef1a8c000014809cba76859" (98) Acct-Authentic = RADIUS (98) Tunnel-Type:0 = VLAN (98) Tunnel-Medium-Type:0 = IEEE-802 (98) Tunnel-Private-Group-Id:0 = "595" (98) Event-Timestamp = "Jul 14 2017 14:47:01 CEST" (98) Cisco-AVPair = "dhcp-option=\000\014\000\0056spMK" (98) Cisco-AVPair = "http-tlv=\000\001\000\030iPhone8,2/10.3.2 (14F89)" How to regex these ? (98) Acct-Status-Type = Interim-Update (98) Acct-Input-Octets = 699538 (98) Acct-Input-Gigawords = 0 (98) Acct-Output-Octets = 2957172 (98) Acct-Output-Gigawords = 0 (98) Acct-Input-Packets = 5974 (98) Acct-Output-Packets = 5319 (98) Acct-Session-Time = 5494 (98) Acct-Delay-Time = 0 (98) Calling-Station-Id = "34-ab-37-ed-a2-bb" (98) Called-Station-Id = "d4-air1702-ap-1:UI MK tst" (98) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (98) preacct { (98) [preprocess] = ok (98) policy rewrite_called_station_id { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { (98) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> FALSE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) -> TRUE (98) elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) { (98) update request { (98) EXPAND %{1} (98) --> d4-air1702-ap-1 (98) &Called-Station-Id := d4-air1702-ap-1 (98) EXPAND %{3} (98) --> UI MK tst (98) &Called-Station-SSID := UI MK tst (98) } # update request = noop (98) [updated] = updated (98) } # elsif (&Called-Station-Id && (&Called-Station-Id =~ /^(.+)(:){1}((.+))?$/i)) = updated (98) ... skipping else: Preceding "if" was taken (98) } # policy rewrite_called_station_id = updated (98) policy fill_device_type { (98) if (&Cisco-AVPair) { (98) if (&Cisco-AVPair) -> TRUE (98) if (&Cisco-AVPair) { (98) foreach &Cisco-AVPair (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) EXPAND %{Foreach-Variable-0} (98) --> audit-session-id=1ef1a8c000014809cba76859 (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> dhcp-option= (98) EXPAND %{Foreach-Variable-0} (98) --> dhcp-option= (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) { (98) EXPAND Foreach-Variable-0 (98) --> http-tlv= (98) EXPAND %{Foreach-Variable-0} (98) --> http-tlv= Both attributes are expanded till first whitespace char (98) if ("%{Foreach-Variable-0}" =~ /^((dhcp-option=)|(http-tlv=)){1}([\\].{2,5})([\\].{2,5})([\\].{3})([\\].{3})?(.*)/i) -> FALSE (98) } # foreach &Cisco-AVPair = updated (98) } # if (&Cisco-AVPair) = updated How to get text values following whitespaces? I've already tried if ("unescape:%{Foreach-Variable-0}" =~ /${policy.device_regex}/i) with no luck Martin Kylián

4 11

authorize redis
by Bassem Mettichi 23 Feb '18

23 Feb '18

Hello, is it possible add authorize method to rlm_rediswho module? i don't have good knowledge in C/C++ developpement but i will be a good idea if someone could add for example another command select like insert, trim. Regards, Bassem

3 5

radreply error
by Zubair Ayub 23 Feb '18

23 Feb '18

Hello Everyone, i have user stored in my radreply table with assigned ip . entry: for exampl 731 test123 Framed-IP-Address == 12.12.12.12(ip) my users connect with assigned ip but after dissconnect my user got deleted from radreply table .. i dont know why this is happenig i hav 20k users but this happening to only 5% users . can any one please guide me Regards Zubair Ayub Thanks.

4 4

Sending NAS-IP-Address to inner-tunnel
by Gary Gwin 23 Feb '18

23 Feb '18

I have the need to send the NAS-IP-Address to the inner-tunnel, which by default only receives the FreeRADIUS-Proxied-To. Here's what is received with the Access-Request: (7) Received Access-Request Id 0 from 74.174.75.20:55809 to 10.13.0.251:1812 length 198 (7) User-Name = "tomas(a)acme.com" (7) NAS-IP-Address = 75.174.238.20 And here's what is sent to the inner-tunnel: (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x0207001701746f6d6173406f6e656c6f67696e2e636f6d (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "tomas(a)acme.com" And here's what the inner-tunnel recieves: (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x0207001701746f6d6173406f6e656c6f67696e2e636f6d (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "tomas(a)acme.com" Is there a way to send the NAS-IP-Address to the inner-tunnel? Thanks, Gary

2 2

Freeradius 4
by Bassem Mettichi 22 Feb '18

22 Feb '18

Hello, iam trying to compile freeradius 4 but when i run make i get this error: CC src/protocols/dhcpv4/decode.c src/protocols/dhcpv4/decode.c: In function ‘fr_dhcpv4_decode_option’: src/protocols/dhcpv4/decode.c:376:55: error: ‘FR_VENDOR_SPECIFIC’ undeclared (first use in this function) parent = fr_dict_attr_child_by_num(packet_ctx->root, FR_VENDOR_SPECIFIC); ^ src/protocols/dhcpv4/decode.c:376:55: note: each undeclared identifier is reported only once for each function it appears in make: *** [build/objs/src/protocols/dhcpv4/decode.lo] Error 1 any one has an idea about this error please, how to solve this issue? Thanks, Mettichi Bassem

6 9