- Freeradius-Users - lists.freeradius.org

Case-insensitive regexps in rlm_files
by Brian Candler 21 Nov '10

21 Nov '10

In rlm_files, I can't see how to make a case-insensitive regular expression. ----------------------------------------------------------------- DEFAULT User-Name =~ "(?i:foo)" # nope, not supported by POSIX ERE. Logs: # "Invalid regular expression (?i:foo)" DEFAULT User-Name =~ /foo/i # actually matches the character sequence "/foo/i" ----------------------------------------------------------------- Am I missing a trick here? If I make a patch for this, would you prefer the first or second to be implemented? The second is nicer to use, but is probably harder to implement. The first could be done as a frig by stripping off an outer (?i: ... ) and setting the REG_ICASE flag if seen. Regards, Brian.

2 7

Changing radgroup with a sqlcounter ?
by Arrgghh 21 Nov '10

21 Nov '10

Hello, I am working on a radius config for a hotspot. I already configured a script that kick the user when the quota exceed thanks to some very useful posts in the coova forum. I used this counter : sqlcounter noresetBytecounter { counter-name = Total-Max-Octets check-name = Max-Octets reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = never query = "SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}'" } My goal is that a user belongs to a standard group with a 512kbps bandwith and a quota of 100mo. Then when he exceeds his quota, he is switched to a 128 kbps group. I know how to setup groups that limits bandwidth and volume. What I don't know is how to set up a counter that instead of kicking the user out of the network when he exceeds his quota switch him to another radgroup. Any clue how i can do it ? Thank you very much, -- View this message in context: http://freeradius.1045715.n5.nabble.com/Changing-radgroup-with-a-sqlcounter… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

http://wiki.freeradius.org/Mac-Auth is wrong
by Tóth István 21 Nov '10

21 Nov '10

Hello! I tried to set up MAC authorization for testing purposes according to the instructions at http://wiki.freeradius.org/Mac-Auth. The solution there almost worked, except for the raddb/sites-available/default post-auth{} section. The wiki contains the code: if(control:Auth-Type == 'CSID'){ # Authorization happens here authorized_macs.authorize if(notfound){ reject } } However, when the rlm_files module can't find the user, it returns noop, not notfound. As a result, EVERY mac authentication attempt is successful. When I changed the section to if(control:Auth-Type == 'CSID'){ # Authorization happens here authorized_macs.authorize if(!ok){ reject } } I got correct rejects in reply to the MACs not listed in the file. The funny thing is that I actually think that the snippet on wiki page should work, and the rlm_files module is returning the wrong result code. As far as I understand the result codes, noop should be returned when the module ignores the request, because it thinks it should not handle it, and notfound should be returned when the module accepted and tried to handle the requests, but cannot find the user in its "database". Either way, the documentation and the code do not match, and one of them should be fixed. Currently if somene just blindly copies the sample config, and does not test for correct rejects, he'll have wide-open network. I have tested on fedora 13, with the latest freeradius-2.1.10-1.fc13.x86_64 rpm. best regards István Tóth

2 1

Authenticating MACs and users
by Rudolph Bott 20 Nov '10

20 Nov '10

Hey List, I was just wondering - I have setup a freeradius server (stock packages on SLES 11, I don't have the exact version athand since I don't have access to the server right now) which is used for mac-based authentication with cisco switches - including vlan assignment. This works as intended. But I would also like to centralize my user accounts for switches and routers - am I able to do this with the same radius setup? Or do I have to setup another radius server? I am currently using flatfiles for the mac authentication. I already checked the list archive and the wiki but couldn't find anything helpful - maybe I looked for the wrong keywords ;) Any help would be appreciated! -- Mit freundlichen Grüßen/With Kind Regards Rudolph Bott

2 6

[Segmentation Fault while proxing Request to home server]
by Thomas Fagart 19 Nov '10

19 Nov '10

Hello, We're having the following authentication scenario for Wimax User Authentication : ASN -- EAP/TTLS ---> 2 freeradius used as proxy --> 2 freeradius home server. AAA is fine when both home servers are up,but when one of them or both of them are dead, we're having the following logs on the proxy : rad_recv: Access-Request packet from host a.b.c.D port 10008, id=117, length=406 Sending duplicate proxied request to home server a.b.c.d port 1812 - ID: 36 Sending Access-Request of id 36 to a.b.c.d port 1812 User-Name = "xx(a)domain.com" MS-CHAP-Challenge = 0xdcd70de41d9783aa76aa573d3d07f84d MS-CHAP2-Response = 0x4700db77a532a5ec9b28c3805d18cc35ed170000000000000000d00f9d99d46d688436477daf0cdd734b813f11e4bd115e16 NAS-IP-Address = x.y.z.w Calling-Station-Id = "002104bec153" NAS-Identifier = "WASN" Event-Timestamp = "Nov 18 2010 01:43:06 CET" WiMAX-Release = "1.1" WiMAX-Capability = 0x0105312e31020302030301040301 WiMAX-Accounting-Capabilities = Flow-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Idle-Mode-Notification-Cap = Supported WiMAX-Attr-1281 = 0x01 WiMAX-BS-Id = 0x303030303261323930633030 WiMAX-GMT-Timezone-offset = 3600 NAS-Port-Type = Wireless-802.16 WiMAX-Available-In-Client = 99 WiMAX-PPAC = 0x010600000063 Service-Type = Framed-User Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x313137 Waking up in 21.0 seconds. WARNING: Internal sanity check failed in event handler for request 6: Discarding the request! Segmentation fault And then the proxy radius dies. This happens each time at the fifth try while trying to send the request to a dead home server. Regular logs gives that Nov 18 01:37:46 vma-prdaut-08 radiusd[11028]: Marking home server a.b.c.d port 1812 as zombie (it looks like it is dead). I know I should give a gdb trace to help, but since this is production server, it might take some times to give the trace. Do you have any idea to what it could be related ? Environment is the following : FreeBSD 8.0/ Freeradius 2.1.10 compiled on threaded perl for snmp script use. Thanks Thomas

3 6

Having 2 User-Name when using Session Resumption
by Panagiotis Georgopoulos 19 Nov '10

19 Nov '10

Hello all, I am experiencing the following problem when using EAP-TLS and session resumption. When my client tries to authenticate for the 2nd time and FR recognizes that it has a valid session for it, it goes on and adds a cached attribute to the reply (User-Name) thus ending up with two User-Name attributes in my packet reply to NAS. Debug: SSL Connection Established Debug: SSL Application Data Info: [tls] eaptls_process returned 3 Info: [tls] Retrieved session data from cached session Info: [tls] Adding cached attributes to the reply: User-Name = "anonymous(a)myisp2.com" Info: [eap] Freeing handler Info: ++[eap] returns ok Auth: Login OK: [anonymous(a)myisp2.com] (from client my_proxy_AAAServer1 port 1 cli 00-1B-2F-29-00-99) Info: # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default Info: +- entering group post-auth {...} Info: ++[exec] returns noop Sending Access-Accept of id 23 to 2001:db95::100 port 1814 User-Name = "anonymous(a)myisp2.com" User-Name = "anonymous(a)myisp2.com" MS-MPPE-Recv-Key = 0x40a71fc0b17fd5ce0bee1cfc06ebf8c48a6d37aa710c436a1da4aa3459a22007 MS-MPPE-Send-Key = 0x54ef81d0a961dda08062bb5e9f433a289f3b6628622122b0314a758abacacce2 EAP-Message = 0x03c90004 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x34 How could I check if my reply has two User-Name attributes and remove one? I am guessing that I should add some code in my post-auth.. Thanks a lot in advance, Panos PS. in order for session resumption to work on EAP-TLS I am having an update reply { User-Name = "%{request:User-Name}"} section at the end of my auth stanza of default which explains why it is not surprising to have the first instance of User-Name there when FR decides to add cached attributes... (if I don't have this update reply code SR doesn't work in EAP-TLS)

2 2

Changing a Reject into an Accept
by Brian Candler 19 Nov '10

19 Nov '10

Is it possible to turn a reject into an accept inside the post-auth section? The idea is to tunnel specific groups of failed users to an appropriate help page. I have tried: post-auth { ... Post-Auth-Type REJECT { if ( .... ) { applyTunnelAttributes ok } } } The attributes are added, but the 'ok' doesn't change the packet into an Access-Accept. I also tried, unsuccessfully, update control { Packet-Type := Access-Accept Response-Packet-Type := Access-Accept } update reply { Packet-Type := Access-Accept Response-Packet-Type := Access-Accept } (freeradius reports that modifying the value of a virtual attribute is not supported) I could mess about with the authenticate section, but this goes against the stern advice in the default config: # Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for. Going against that advice, the following appears to work: authenticate { Auth-Type PAP { pap { ok = return reject = 1 } applyTunnelAttributes } Auth-Type CHAP { chap { ok = return reject = 1 } applyTunnelAttributes } } So, any better way of achieving this? Thanks, Brian.

2 1

Radmin segmentation fault
by David Seira 19 Nov '10

19 Nov '10

Hi list, I'm trying radmin with freeradius 2.1.10, in debian distro with 2.6.26-2-686 kernel. When I put the "show module config sql" I receive a segmentation fault un radiusd. Has anybody have the same bug? Regards, David

2 1

No NAS Port seen ?
by Michael Arndt 19 Nov '10

19 Nov '10

Hello * -is the error belwo caused by fault of the NAS -or a stupid mistake of mine within setup ? rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! -other attributes are sent correctly -device is a lancom 315-agn TIA Micha

2 1

Re: configure output summary
by ironrake＠yahoo.com 19 Nov '10

19 Nov '10

"But newcomers aren't that trained yet." Perhaps you should change your course material? Sent from Verizon Wireless

2 1