- Freeradius-Users - lists.freeradius.org

1.0.0 -> 1.1.6 DB Schema conversion
by Francesco Cristofori 15 Jun '07

15 Jun '07

Hi all, perhaps my question is not totally in topic, I apologize if it hurts someone. I'm going to upgrade freeradius from v.1.0.0 to v.1.1.6 and I noticed that the database structure has changed. Are there any tools to quickly migrate the db? I have checked the differences and I think it's suitable to do a "smart" mysqldump of the tables that changed, so I can have the dump imported in the new database. Greetings, Francesco Cristofori.

2 1

2.0.0 documentation for radiusd.conf.
by Alan Dekok 15 Jun '07

15 Jun '07

I've updated the documentation for radiusd.conf, to document the new "un-language". Text is attached here for comment. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog unlang(5) FreeRADIUS Processing un-language unlang(5) NAME unlang - FreeRADIUS Processing un-language DESCRIPTION FreeRADIUS supports a simple processing language in its configuration files. We call it an "un-language" because the intention is NOT to create yet another programming language. If you need something more complicated than what is described here, we suggest using the Perl or Python modules rlm_perl, or rlm_python. The language is similar to C in some respects, and is also similar to Unix shell scripts in other respects. The keywords for the language are "if", "else", "elsif", "switch", "case", and "update". Subject to some limitations below on "switch" and "case", any keyword can appear in any context. KEYWORDS if Checks for a particular condition. If true, the block after the condition is processed. Otherwise, the block is ignored. if (condition) { ... } else Define a block to be executed only if the previous "if" condi‐ tion returned false. else { ... } elsif Define a block to be executed only if the previous "if" condi‐ tion returned false, and if the specified condition evaluates to true. elsif (condition) { ... } switch Evaluate the given string, and choose the first matching "case" statement inside of the current block. No statement other than "case" can appear in a "switch" block. switch "string" { ... } case Define a static string to match a parent "switch" statement. A "case" statement cannot appear outside of a "switch" block. case string { ... } update Update a particular attribute list, based on the attributes given in the current block. update <list> { attribute = value ... } The <list> can be one of "request", "reply", "proxy-request", "proxy-reply", or "control". The "control" list is the list of attributes maintainted internally by the server that controls how the server processes the request. Any attribute that does not go in a packet on the network will generally be placed in the "control" list. For a detailed description of the contents of the "update" sec‐ tion, see the ATTRIBUTES section below. CONDITIONS The conditions are similar to C conditions in syntax, though quoted strings are supported, as with the Unix shell. Simple conditions (foo) Evalutes to true if ’foo’ is a non-empty string, or if ’foo’ is a non-zero number. Negation (!foo) Evalutes to true if ’foo’ evaluates to false, and vice-versa. Short-circuit operators (foo || bar) (foo && bar) "&&" and "||" are short-circuit operators. "&&" evaluates the first condition, and evaluates the second condition if and only if the result of the first condition is true. "||" is similar, but executes the second command if and only if the result of the first condition is false. Comparisons (foo == bar) Compares ’foo’ to ’bar’, and evaluates to true if the comparison holds true. Valid comparison operators are "==", "!=", "<", "<=", ">", ">=", "=~", and "!~", all with their usual meanings. Invalid comparison operators are ":=" and "=". STRINGS AND NUMBERS Strings and numbers can appear as stand-alone conditions, in which case they are evaluated as described in "Simple conditions", above. They can also appear (with some exceptions noted below) on the left-hand or on the right-hand side of a comparison. Numbers Numbers are composed of decimal digits. Floating point, hex, and octal numbers are not supported. The maximum value for a number is machine-dependent, but is usually 32-bits, including one bit for a sign value. "strings" Double-quoted strings are expanded by inserting the value of any variables (see VARIABLES, below) before being evaluated. If the result is a number it can be evaluated in a numerical context. ’strings’ Single-quoted strings are evaluated as-is. ‘strings‘ Back-quoted strings are evaluated by expanding the contents of the string, as described above for double-quoted strings. The resulting command given inside of the string in a sub-shell, and taking the output as a string. This behavior is much the same as that of Unix shells. Note that for security reasons, the input string is split into command and arguments before variable expansion is done. For performance reasons, we suggest that the use of back-quoted strings be kept to a minimum. Executing external programs is relatively expensive, and executing a large number of programs for every request can quickly use all of the CPU time in a server. If you believe that you need to execute many programs, we suggest finding alternative ways to achieve the same result. In some cases, using a real language may be sufficient. /regex/i These strings are valid only on the right-hand side of a compar‐ ison, and then only when the comparison operator is "=~" or "!~". They are regular expressions, as implemented by the local regular expression library on the system. This is usually Posix regular expressions. The trailing ’i’ is optional, and indicates that the regular expression match should be done in a case-insensitive fashion. If the comparison operator is "=~", then parantheses in the reg‐ ular expression will define variables containing the matching text, as described below in the VARIABLES section. VARIABLES Run-time variables are referenced using the following syntax %{Variable-Name} Note that unlike C, there is no way to declare variables, or to refer to them outside of a string context. All references to variables MUST be contained inside of a double-quoted or back-quoted string. Many potential variables are defined in the dictionaries that accompany the server. These definitions define only the name and type, and do not define the value of the variable. When the server receives a packet, it uses the packet contents to look up entries in the dictio‐ nary, and instantiates variables with a name taken from the dictionar‐ ies, and a value taken from the packet contents. This process means that if a variable does not exist, it is usually because it was not mentioned in a packet that the server received. Once the variable is instantiated, it is added to an appropriate attribute list, as described below. In many cases, attributes and variables are inter-changeble, and are often talked about that way. However, variables can also refer to run-time calls to modules, which may perform operations like SQL SELECTs, and which may return the result as the value of the variable. Referencing attribute lists Attribute lists may be referenced via the following syntax %{<list>:Attribute-Name} Where <list> is one of "request", "reply", "proxy-request", "proxy-reply", or "control", as described above in the documen‐ tation for the "update" section. The "<list>:" prefix is optional, and if omitted, is assumed to refer to the "request" list. When a variable is encountered, the given list is examined for an attribute of the given name. If found, the variable refer‐ ence in the string is replaced with the value of that attribute. Some examples are: %{User-Name} %{request:User-Name} # same as above %{reply:User-Name} Results of regular expression matches If a regular expression match has previously been performed, then the special variable %{0} will contain a copy of the input string. The variables %{1} through %{8} will contain the sub‐ string matches, starting from the left-most parantheses, and onwards. If there are more than 8 parantheses, the additional results will not be placed into any variables. Obtaining results from databases It is useful to query a database for some information, and to use the result in a condition. The following syntax will call a module, pass it the given string, and replace the variable ref‐ erence with the resulting string returned from the module. %{module: string ...} The syntax of the string is module-specific. Please read the module documentation for additional details. Conditional Syntax Conditional syntax similar to that used in Unix shells may also be used. %{Foo:-bar} When attribute Foo is set, returns value of Foo When attribute Foo is unset, returns literal string ’bar’ %{Foo:-%{Bar}} When attribute Foo is set, returns value of attribute Foo When attribute Foo is unset, returns value of attribute Bar (if any) %{Foo:-%{Bar:-baz}} When attribute Foo is set, returns value of attribute Foo When attribute Foo is unset, returns value of attribute Bar (if any) When attribute Bar is unset, returns literal string ’baz’ String lengths and arrays Similar to a Unix shell, there are ways to reference string lenths, and the second or more instance of an attribute in a list. If you need this functionality, we recommend using a real language. %{#string} The number of characters in %{string}. If %{string} is not set, then the length is not set. e.g. %{#Junk-junk:-foo} will yeild the string "foo". %{Attribute-Name[index]} Reference the N’th occurance of the given attribute. The syntax %{<list>:Attribute-Name[index]} may also be used. The indexes start at zero. This feature is NOT available for non-attribute dynamic translations, like %{sql:...}. For example, %{User-Name[0]} is the same as %{User-Name} The variable %{Cisco-AVPair[2]} will reference the value of the THIRD Cisco-AVPair attribute (if it exists) in the request packet, %{Attribute-Name[#]} Returns the total number of attributes of that name in the relevant attribute list. The number will usually be between 0 and 200. For most requests, %{request:User-Name[#]} == 1 %{Attribute-Name[*]} Expands to a single string, with the value of each array member separated by a newline. %{#Attribute-Name[index]} Expands to the length of the string %{Attribute- Name[index]}. ATTRIBUTES The attribute lists described above may be edited by listing one or more attributes in an "update" section. Once the attributes have been defined, they may be referenced as described above in the VARIABLES section. The following syntax defines attributes in an "update" section. Each attribute and value has to be all on one line in the configuration file. There is no need for commas or semi-colons after the value. Attribute-Name = value Attribute names The Attribute-Name must be a name previously defined in a dic‐ tionary. If an undefined name is used, the server will return an error, and will not start. Operators The operator used to assign the value of the attribute may be one of the following, with the given meaning. = Add the attribute to the list, if and only if an attribute of the same name is already present in that list. := Add the attribute to the list. If any attribute of the same name is already present in that list, its value is replaced with the value of the current attribute. += Add the attribute to the tail of the list, even if attributes of the same name are already present in the list. -= Remove all matching attributes from the list. Both the attribute name and value have to match in order for the attribute to be removed from the list. Values The format of the value is attribute-specific, and is usually a string, integer, IP address, etc. Prior to the attribute being instantiated, the value is handled as described above in the STRINGS AND NUMBERS section. This flexibility means that, for example, you can assign an IP address value to an attribute by specifying the IP address directly, or by having the address returned from a database query, or by having the address returned as the output of a program that is executed. FILES /etc/raddb/vmpsd.conf, /etc/raddb/radiusd.conf SEE ALSO radiusd.conf(5), vmpsd.conf(5), dictionary(5) AUTHOR Alan DeKok <aland(a)deployingradius.com> 12 Jun 2007 unlang(5)

3 22

Errors reading dictionary - MikroTik
by Liam Farr 15 Jun '07

15 Jun '07

Hi, I get the following error trying to start freeradius; daytona:~# freeradius -x Starting - reading configuration files ... Errors reading dictionary: dict_init: /etc/freeradius/dictionary[177]: invalid ATTRIBUTE line Errors reading radiusd.conf daytona:~# Im using the dictionary file provided by MikroTik at http://www.mikrotik.com/Documentation/manual_2.9/dictionary whihc I installed by typing; cd /etc/freeradius rm dictionary wget http://www.mikrotik.com/Documentation/manual_2.9/dictionary chmod 640 dictionary chown root.freerad dictionary I'm relatively new to FreeRADIUS and any help would be appreciated. Regards Liam

4 7

Multiple pasword files
by Archie Holland 15 Jun '07

15 Jun '07

What is the easiest way to specify which of two password files a user should authenticate against based on the client IP address? -- ========================= The Net That Works! ======================== Archie Holland http://www.blue.net 1(270)735-3553 Bluegrass Network LLC 1(270)765-6361, ext6220 Senior Systems Administrator Fax: 1(270)737-0580 ========================= The AdminBlue Team ========================= Archie Holland Mitzi Reynolds Douglas Lamb Tommy Chism Cheryl Ruckriegel Keith Corbin ===================== mailto:adminblue@blue.net ======================

2 1

Radrelay Question
by German Hernandez 15 Jun '07

15 Jun '07

Hello everybody! I need your help. I want generate accounting replication with radrelay, I read doc/radrelay, but is not clear for me where(in what file configuration) I add the line that fire up radrelay (radrelay -S secret_file <server> detail-combined). Thank in advance German --------------------------------- Llama gratis a cualquier PC del mundo. Con una excelente calidad de sonido. Yahoo! Messenger

2 1

FreeRadius 2.0 Debian Packages available yet ?
by George Embrey 15 Jun '07

15 Jun '07

Has anybody published any FreeRadius 2.0 Debian (.deb) Packages yet ? George.

2 2

RE:2.0.0 documentation for radiusd.conf
by Hugh Messenger 14 Jun '07

14 Jun '07

> From: Alan Dekok <aland(a)deployingradius.com> > Oh, and "-=" works. With the "users" file, it didn't. And there are > other corner-case bugs fixed, too. Any luck fixing this stuff: DEFAULT Called-Station-Id =~ "^([A-z0-9]+_[0-9]+)$", Pool-Name := `%{0}` Framed-IP-Netmask = 255.255.0.0, Fall-Through = 1 ... in either users or hints? If you recall, I'm trying to find a way of having just one DEFAULT for setting my sqlippool Pool-Name, rather than having to have 50+ individual entries. So far no luck with the above mechanism in either users or hints files. > > Alan DeKok. -- hugh

2 1

Modifying authorization replies by a proxy
by Martin Horcicka 14 Jun '07

14 Jun '07

Hi, when the FreeRADIUS is configured as a proxy is there any way to modify the authorization replies (Access-Accept packets) before sending them to the NAS? I need to add there a few attributes (purchased connection speed etc.). Reply attributes in the 'users' file of the proxy seem to be ignored. For example, with the following record in the 'users' file proxying works well but the Framed-IP-Address attribute seems to be ignored: username Proxy-To-Realm := xxx Framed-IP-Address := "2.2.2.2" rlm_attr_rewrite does not seem to be useful in this case as I need to define the rules on a per-user basis. (FreeRADIUS 1.1.6) Martin

2 4

sql_log and sql.conf
by Stefan Winter 14 Jun '07

14 Jun '07

Hi, the accounting queries in sql.conf and the sample sql_log module in radiusd.conf are not identical. For consistency, I'd expect to find the same things there. Any specific reason, or can I just copy over the usual queries from sql.conf into that module and expect them to work? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

PEAP fatal bad_certificate
by Ruslan N. Marchenko 14 Jun '07

14 Jun '07

It seems to be not a particular question, but... client - winxp wireless, ap - AIR-AP1131AG-E-K9, server 1.1.6. fresh install. certificates generated according to CA.all (with xp-extension and conversion to pkcs12) eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = xxxxx private_key_file = ${raddbdir}/certs/merlin-crt.pem certificate_file = ${raddbdir}/certs/merlin-crt.pem CA_file = ${raddbdir}/certs/cacert.pem dh_key_length = 1024 dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } peap { default_eap_type = mschapv2 } mschapv2 { } } Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 224 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 224 modcall: leaving group authenticate (returns reject) for request 224 auth: Failed to validate the user. -- Olimp, System Administrator IT Dept. Fax. +380(62)381-3428 Tel. +380(62)381-3978-5 ---- Looking forward to reading yours. RUFF-RIPE DI76-GANDI RUFF-6BONE Ruslan N. Marchenko

2 5