April 2018 - Freeradius-Users - lists.freeradius.org

SQL auth against existing database
by Charles Sprickman 03 Apr '18

03 Apr '18

Hi, I’m looking through the SQL docs on the wiki, and they seem very complete, but I’m not quite grasping how to accomplish what I want. In short, I have an existing database that’s primarily used for our email system. I currently also have gnu-radius using this db - in the past for dialup, but at this point just a few remaining oddball services like usenet. I’m moving away from gnu-radius because it’s not very actively developed. What I’d like to do is this: - Use existing db for user/pass check - Use static files for everything else - Optionally alter my sql query based on which client is asking for auth Is this possible? Right now I don’t need to really return anything other than Access-Accept or Access-Reject - literally any other reply items are ignored. I’m on a fresh install of FreeRadius 3.0.15. Database schema is very simple, columns are: pw_name, pw_domain, pw_passwd, pw_gid (vpopmail, for the curious) It’s not practical to change the schema at this point… Thanks, Charles

4 8

Timestamp missing in debug_level=1
by CALMELS, Thierry (SOGETI REGIONS SAS) 03 Apr '18

03 Apr '18

Hello freeradius support team, We have currently a new infrastucture using freeRadius 3 (freeradius-3.0.13-8.) on RHEL7. By default, the events in radius logs are not enough for troubleshooting purpose. We want to get a verbosity log level sufficient (not too high, not too low) without having to switch in debug_level=3. That why we think that debug_level=1 in radiusd.conf is a good compromise. Unfortunately, when this debug level is enabled, we haven’t timestamp information. Can you please tell us how to add this timestamp or there is a mean to adjust log verbosity. Thanks, Thierry - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other than the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

2 1

Releasing 3.0.17?
by Alan DeKok 02 Apr '18

02 Apr '18

There are a few issues found && fixed since 3.0.16. Unless there are major objections, I think we can release 3.0.17 next week. The next step after that would be to add support for multiple kinds of certificates at the same time. e.g. RSA and ECC. This is supported in OpenSSL since 1.0.2. It's starting to get more widely deployed, too. While we do try hard to have 3.0 in a "feature freeze", features can still be added if they are important enough. And I think this counts. Alan DeKok.

6 15

Reject User Pre-Proxy - SQL
by Andrei Antonelli 01 Apr '18

01 Apr '18

Hello, I would like to reject pre-proxy some specific users by querying the mysql database. I've created a table with these users that will be rejected. In policy.d/filter This rule worked. filter_user { if (&User-Name == 'XXX@XXX') { reject } } But I want to query these users in the database. I tried. filter_user { if ("%{sql:SELECT username FROM radcheckblock WHERE username = '%{User-Name}'}" == &User-Name) { reject } } Error: policy.d/filter[20]: Parse error in condition policy.d/filter[20]: ("%{sql:SELECT username FROM radcheckblock WHERE username = '%{User-Name}'}" == &User-Name) { policy.d/filter[20]: ^ Cannot use attribute reference on right side of condition What would be the best way to do this filter? thank you all

2 2