- Freeradius-Users - lists.freeradius.org

Re: AW: AW: encrypted password
by Felipe Ceglia - PY1NB 18 Jun '07

18 Jun '07

Hi, Running 1.1.6 now. Crypt-Local works ok now. I would like to know if it is possible to have both User-Password and Crypt-Local Auth-Types for sql users. Now I need to disable the current System (/etc/passwd) users to Crypt-Local, and also have users with cleartext passwords. Thank you, Felipe Ceglia Rascher, Markus wrote: > If u use the db for user authentication, then db, here is my db-content: > > select * from radcheck; > +----+----------+---------------+----+---------------+ > | id | UserName | Attribute | op | Value | > +----+----------+---------------+----+---------------+ > | 1 | testuser | Crypt-Password| := | oV9XYXNTx4awE | > +----+----------+---------------+----+---------------+ > > > select * from radgroupcheck; > +----+-----------+-----------+----+---------------+ > | id | GroupName | Attribute | op | Value | > +----+-----------+-----------+----+---------------+ > | 1 | testgroup | Auth-Type | := | Crypt-Local | > +----+-----------+-----------+----+---------------+ > 1 row in set (0.01 sec) > > > If it works with cleartext pwd's and the auth-type Local then it will work with Crypt-Local and the crypted pwd in the radcheck table > > For encrypting the pwd use the encrypt("pwd") function in sql > > Do you have any further questions? > > > regards > Markus > > > > -----Ursprüngliche Nachricht----- > Von: Felipe Ceglia [mailto:felipeceglia@gmail.com] Im Auftrag von Felipe Ceglia - PY1NB > Gesendet: Mittwoch, 13. Juni 2007 13:54 > An: Rascher, Markus > Betreff: Re: AW: encrypted password > > Hi Markus, > > Where should I try it? users file, or as an attribute on the db? > > Thank you, > > Felipe > > Rascher, Markus wrote: >> Did you try Crypt-Local auth-Type? >> >> -----Ursprüngliche Nachricht----- >> Von: freeradius-users-bounces+markus.mr.rascher=siemens.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+markus.mr.rascher=siemens.com@lists.freeradius.org] Im Auftrag von Felipe Ceglia - PY1NB >> Gesendet: Mittwoch, 13. Juni 2007 00:26 >> An: FreeRadius users mailing list >> Betreff: Re: encrypted password >> >> Hi Arran, >> >> Thank you for your reply. >> >> I tried Crypt-Password := "9D8wtP7DGqgCg", but then the debug says: >> >> (...) >> modcall[authorize]: module "sql" returns ok for request 2 >> modcall: group authorize returns ok for request 2 >> rad_check_password: Found Auth-Type Local >> auth: type Local >> auth: user supplied User-Password does NOT match local User-Password >> auth: Failed to validate the user. >> Login incorrect: [anavc/2572ava] (from client localhost port 0) >> Delaying request 2 for 2 seconds >> >> When I try with a clear text password user, it says: >> >> (...) >> modcall[authorize]: module "sql" returns ok for request 3 >> modcall: group authorize returns ok for request 3 >> rad_check_password: Found Auth-Type Local >> auth: type Local >> auth: user supplied User-Password matches local User-Password >> (...) >> >> >> Thank you, >> >> Felipe >> >> >> >> Arran Cudbard-Bell wrote: >>> Felipe Ceglia - PY1NB wrote: >>>> Hi again, >>>> >>>> I need to migrate my users from plain old unix passwd file to sql. >>>> >>>> How do I have the user information in the radcheck table? >>>> >>>> Encrypted-Password == 9D8wtP7DGqgCg ? >>>> >>>> My passwd file looks like: >>>> anavc:9D8wtP7DGqgCg:1002:300:#Ana:/home/dummy:/usr/bin/passwd >>>> >>>> This password seems not to be MD5. >>>> >>>> Any guesses? >>>> >>>> Thank you again, >>>> >>>> Felipe >>>> >>>> - >>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>>> >>> That would be unix crypt. >>> >>> The attribute in radcheck is >>> >>> Crypt-Password := "9D8wtP7DGqgCg" >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >

2 1

download latest version: link broken?
by Andrew Long 18 Jun '07

18 Jun '07

ftp://ftp.freeradius.org/pub/radius/freeradius-1.1.5.tar.gz I am getting an error that the dir or file does not exist... Am I right that 2.0 is not available and/or not considered stable yet? Regards, Andrew

5 8

rlm_ldap: multiple user profile attributes combined with multiple user attributes
by Florian Reinholz 17 Jun '07

17 Jun '07

hi, i'm currently trying to setup a scalable freeradius implemention based on rlm_ldap. everything works real fine except one thing: two major profiles are provided 1. l2tp settings for my local nas 2. l2tp settings for the nas of another carrier there are always minimum 2 vendor specific attributes for each profile. all users are mapped to their specific profile. some users have their own attributes which must extend the profile attributes. for example: profiles -- local radiusTunnelServerID = local Cisco-AVPair = +=lcp:interface-config=ip vrf forwarding LO Cisco-AVPair = +=lcp:interface-config=ip os netw broadcast -- remote radiusTunnelServerID = remote Cisco-AVPair = +=lcp:interface-config=ip vrf forwarding RE Cisco-AVPair = +=lcp:interface-config=ip rip trigger users -- user01 radiusProfileDN = cn=local,ou=profiles,ou=radius,dc=acme,dc=com Cisco-AVPair = +=lcp:interface-config=descr Local Cisco-AVPair = +=lcp:interface-config=service output qos_user01 -- user02 radiusProfileDN = cn=remote,ou=profiles,ou=radius,dc=acme,dc=com Cisco-AVPair = +=lcp:interface-config=descr Remote Cisco-AVPair = +=lcp:interface-config=service output qos_user02 the radiusd debug shows me the all attributes are processed and ok but only the user specific attributes are replied. the result is ok when i define profile attributes. but not when i combine user and profile attributes. thanks in advance for your help! best regards florian -- START radiusd DEBUG -- rad_recv: Access-Request packet from host 127.0.0.1:33570, id=21, length=92 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1041 NAS-Port-Id = "Uniq-Sess-ID1041" NAS-Port-Type = Virtual NAS-IP-Address = 1.2.3.4 User-Name = "test" User-Password = "test" Sun Jun 17 13:32:46 2007 : Debug: Processing the authorize section of radiusd.conf Sun Jun 17 13:32:46 2007 : Debug: modcall: entering group authorize for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall[authorize]: module "chap" returns noop for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: calling IPASS (rlm_realm) for request 0 Sun Jun 17 13:32:46 2007 : Debug: rlm_realm: No '/' in User-Name = "test", looking up realm NULL Sun Jun 17 13:32:46 2007 : Debug: rlm_realm: No such realm "NULL" Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: returned from IPASS (rlm_realm) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall[authorize]: module "IPASS" returns noop for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 0 Sun Jun 17 13:32:46 2007 : Debug: rlm_realm: No '@' in User-Name = "test", looking up realm NULL Sun Jun 17 13:32:46 2007 : Debug: rlm_realm: No such realm "NULL" Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: calling ntdomain (rlm_realm) for request 0 Sun Jun 17 13:32:46 2007 : Debug: rlm_realm: No '\' in User-Name = "test", looking up realm NULL Sun Jun 17 13:32:46 2007 : Debug: rlm_realm: No such realm "NULL" Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: returned from ntdomain (rlm_realm) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall[authorize]: module "ntdomain" returns noop for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: rlm_eap: No EAP-Message, not doing EAP Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: - authorize Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: performing user authorization for test Sun Jun 17 13:32:46 2007 : Debug: radius_xlat: '(|(&(objectClass=radiusUser)(uid=test))(&(objectClass=radiusUser)(cn=test)))' Sun Jun 17 13:32:46 2007 : Debug: radius_xlat: 'ou=radius,ou=services,dc=acme,dc=com' Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: attempting LDAP reconnection Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: bind as cn=read,ou=radius,ou=services,dc=acme,dc=com/radius to 127.0.0.1:389 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: waiting for bind result ... Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Bind was successful Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: performing search in ou=radius,ou=services,dc=acme,dc=com, with filter (|(&(objectClass=radiusUser)(uid=test))(&(objectClass=radiusUser)(cn=test))) Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: checking if remote access for test is allowed by dialupAccess Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: performing search in cn=Default,ou=profiles,ou=radius,ou=services,dc=acme,dc=com, with filter (objectClass=radiusObject) Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusServiceType as Service-Type, value Framed & op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: performing search in cn=test,cn=wonderland,ou=profiles,ou=radius,ou=services,dc=acme,dc=com, with filter (objectClass=radiusObject) Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding Cisco-AVpair as Cisco-AVPair, value lcp:interface-config=ip rip trigger & op=8 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusTunnelServerAuthId as Tunnel-Server-Auth-ID, value server01 & op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusTunnelClientAuthId as Tunnel-Client-Auth-ID, value client01 & op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusTunnelPassword as Tunnel-Password, value acme& op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusTunnelServerEndpoint as Tunnel-Server-Endpoint, value 5.6.7.8 & op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 1 & op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value L2TP & op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding radiusServiceType as Service-Type, value Framed & op=11 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: extracted attribute Cisco-AVPair from generic item Cisco-AVPair += "lcp:interface-config=ip os netw broadcast" Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Added password test in check items Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: looking for check items in directory... Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: looking for reply items in directory... Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding Cisco-AVpair as Cisco-AVPair, value lcp:interface-config=descr User: test & op=8 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Adding Cisco-AVpair as Cisco-AVPair, value lcp:interface-config=service-policy output QoS_egress & op=8 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Setting Auth-Type = ldap Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: user test authorized to use remote access Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall[authorize]: module "ldap" returns ok for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall: leaving group authorize (returns ok) for request 0 Sun Jun 17 13:32:46 2007 : Debug: rad_check_password: Found Auth-Type ldap Sun Jun 17 13:32:46 2007 : Debug: auth: type "LDAP" Sun Jun 17 13:32:46 2007 : Debug: Processing the authenticate section of radiusd.conf Sun Jun 17 13:32:46 2007 : Debug: modcall: entering group LDAP for request 0 Sun Jun 17 13:32:46 2007 : Debug: modsingle[authenticate]: calling ldap (rlm_ldap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: - authenticate Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: login attempt by "test" with password "test" Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: user DN: cn=test,ou=cisco,ou=users,ou=radius,ou=services,dc=acme,dc=com Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: (re)connect to 127.0.0.1:389, authentication 1 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: bind as cn=test,ou=cisco,ou=users,ou=radius,ou=services,dc=acme,dc=com/test to 127.0.0.1:389 Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: waiting for bind result ... Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: Bind was successful Sun Jun 17 13:32:46 2007 : Debug: rlm_ldap: user test authenticated succesfully Sun Jun 17 13:32:46 2007 : Debug: modsingle[authenticate]: returned from ldap (rlm_ldap) for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall[authenticate]: module "ldap" returns ok for request 0 Sun Jun 17 13:32:46 2007 : Debug: modcall: leaving group LDAP (returns ok) for request 0 Sun Jun 17 13:32:46 2007 : Auth: Login OK: [test] (from client localhost port 1041) Sending Access-Accept of id 21 to 127.0.0.1 port 33570 Tunnel-Server-Auth-Id:0 = "server01" Tunnel-Client-Auth-Id:0 = "client01" Tunnel-Password:0 = "acme" Tunnel-Server-Endpoint:0 = "5.6.7.8" Tunnel-Medium-Type:0 = IPv4 Tunnel-Type:0 = L2TP Framed-Protocol = PPP Service-Type = Framed-User Cisco-AVPair += "lcp:interface-config=descr User: test" Cisco-AVPair += "lcp:interface-config=service-policy output QoS_egress" -- END radiusd DEBUG --

1 0

Freeeradius 1.16 and Radrelay Not updating
by Jeff 16 Jun '07

16 Jun '07

I have Freeradius installed on two opensuse 10.2 servers Running Freeradius 1.16 I am running radrelay on the two too keep the detail files in sync (New Setup) The combined detail work file is created on the two servers and each appear to write to it ok. But they aren't syncing with one another heres my radrelay start commands --- Primary radrelay -a /var/log/radius/radacct/ -d /etc/raddb -n Secondary-Radius detail-combined --- Secondary radrelay -a /var/log/radius/radacct/ -d /etc/raddb -n Primary-Radius detail-combined --- In the clients.conf on each server is an entry with secret pointing to the server in question.

1 0

Re: Need example mod_python
by UriCALL Support 15 Jun '07

15 Jun '07

Hey Allan, thxs for the answer. It looks bit less foggy for me now. Have a good one, DanB

1 0

Need example mod_python
by UriCALL Support 15 Jun '07

15 Jun '07

Hello, as I have mentioned before in one of my e-mails, is there anyone who can provide me a practical example of the python module? Thank you in advance, DanB

2 1

Run 2 FreeRadius simultanously
by Jaume 15 Jun '07

15 Jun '07

Hello! My machine is running FreeRADIUS Version 1.1.3, for host i686-redhat-linux-gnu under Fedora Core 6 and my question is... Can my machine run 2 FreeRadius at the same time? Each FreeRadius in a diferent IP but simultanously in the same CPU and O.S.? Somebody tell me thats possible if each radius is reading from a diferent PATH... Thanks for any documentacion, link or kind of help. Jaume, trying to start eduRoam in Peru!

4 6

1.0.0 -> 1.1.6 DB Schema conversion
by Francesco Cristofori 15 Jun '07

15 Jun '07

Hi all, perhaps my question is not totally in topic, I apologize if it hurts someone. I'm going to upgrade freeradius from v.1.0.0 to v.1.1.6 and I noticed that the database structure has changed. Are there any tools to quickly migrate the db? I have checked the differences and I think it's suitable to do a "smart" mysqldump of the tables that changed, so I can have the dump imported in the new database. Greetings, Francesco Cristofori.

2 1

2.0.0 documentation for radiusd.conf.
by Alan Dekok 15 Jun '07

15 Jun '07

I've updated the documentation for radiusd.conf, to document the new "un-language". Text is attached here for comment. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog unlang(5) FreeRADIUS Processing un-language unlang(5) NAME unlang - FreeRADIUS Processing un-language DESCRIPTION FreeRADIUS supports a simple processing language in its configuration files. We call it an "un-language" because the intention is NOT to create yet another programming language. If you need something more complicated than what is described here, we suggest using the Perl or Python modules rlm_perl, or rlm_python. The language is similar to C in some respects, and is also similar to Unix shell scripts in other respects. The keywords for the language are "if", "else", "elsif", "switch", "case", and "update". Subject to some limitations below on "switch" and "case", any keyword can appear in any context. KEYWORDS if Checks for a particular condition. If true, the block after the condition is processed. Otherwise, the block is ignored. if (condition) { ... } else Define a block to be executed only if the previous "if" condi‐ tion returned false. else { ... } elsif Define a block to be executed only if the previous "if" condi‐ tion returned false, and if the specified condition evaluates to true. elsif (condition) { ... } switch Evaluate the given string, and choose the first matching "case" statement inside of the current block. No statement other than "case" can appear in a "switch" block. switch "string" { ... } case Define a static string to match a parent "switch" statement. A "case" statement cannot appear outside of a "switch" block. case string { ... } update Update a particular attribute list, based on the attributes given in the current block. update <list> { attribute = value ... } The <list> can be one of "request", "reply", "proxy-request", "proxy-reply", or "control". The "control" list is the list of attributes maintainted internally by the server that controls how the server processes the request. Any attribute that does not go in a packet on the network will generally be placed in the "control" list. For a detailed description of the contents of the "update" sec‐ tion, see the ATTRIBUTES section below. CONDITIONS The conditions are similar to C conditions in syntax, though quoted strings are supported, as with the Unix shell. Simple conditions (foo) Evalutes to true if ’foo’ is a non-empty string, or if ’foo’ is a non-zero number. Negation (!foo) Evalutes to true if ’foo’ evaluates to false, and vice-versa. Short-circuit operators (foo || bar) (foo && bar) "&&" and "||" are short-circuit operators. "&&" evaluates the first condition, and evaluates the second condition if and only if the result of the first condition is true. "||" is similar, but executes the second command if and only if the result of the first condition is false. Comparisons (foo == bar) Compares ’foo’ to ’bar’, and evaluates to true if the comparison holds true. Valid comparison operators are "==", "!=", "<", "<=", ">", ">=", "=~", and "!~", all with their usual meanings. Invalid comparison operators are ":=" and "=". STRINGS AND NUMBERS Strings and numbers can appear as stand-alone conditions, in which case they are evaluated as described in "Simple conditions", above. They can also appear (with some exceptions noted below) on the left-hand or on the right-hand side of a comparison. Numbers Numbers are composed of decimal digits. Floating point, hex, and octal numbers are not supported. The maximum value for a number is machine-dependent, but is usually 32-bits, including one bit for a sign value. "strings" Double-quoted strings are expanded by inserting the value of any variables (see VARIABLES, below) before being evaluated. If the result is a number it can be evaluated in a numerical context. ’strings’ Single-quoted strings are evaluated as-is. ‘strings‘ Back-quoted strings are evaluated by expanding the contents of the string, as described above for double-quoted strings. The resulting command given inside of the string in a sub-shell, and taking the output as a string. This behavior is much the same as that of Unix shells. Note that for security reasons, the input string is split into command and arguments before variable expansion is done. For performance reasons, we suggest that the use of back-quoted strings be kept to a minimum. Executing external programs is relatively expensive, and executing a large number of programs for every request can quickly use all of the CPU time in a server. If you believe that you need to execute many programs, we suggest finding alternative ways to achieve the same result. In some cases, using a real language may be sufficient. /regex/i These strings are valid only on the right-hand side of a compar‐ ison, and then only when the comparison operator is "=~" or "!~". They are regular expressions, as implemented by the local regular expression library on the system. This is usually Posix regular expressions. The trailing ’i’ is optional, and indicates that the regular expression match should be done in a case-insensitive fashion. If the comparison operator is "=~", then parantheses in the reg‐ ular expression will define variables containing the matching text, as described below in the VARIABLES section. VARIABLES Run-time variables are referenced using the following syntax %{Variable-Name} Note that unlike C, there is no way to declare variables, or to refer to them outside of a string context. All references to variables MUST be contained inside of a double-quoted or back-quoted string. Many potential variables are defined in the dictionaries that accompany the server. These definitions define only the name and type, and do not define the value of the variable. When the server receives a packet, it uses the packet contents to look up entries in the dictio‐ nary, and instantiates variables with a name taken from the dictionar‐ ies, and a value taken from the packet contents. This process means that if a variable does not exist, it is usually because it was not mentioned in a packet that the server received. Once the variable is instantiated, it is added to an appropriate attribute list, as described below. In many cases, attributes and variables are inter-changeble, and are often talked about that way. However, variables can also refer to run-time calls to modules, which may perform operations like SQL SELECTs, and which may return the result as the value of the variable. Referencing attribute lists Attribute lists may be referenced via the following syntax %{<list>:Attribute-Name} Where <list> is one of "request", "reply", "proxy-request", "proxy-reply", or "control", as described above in the documen‐ tation for the "update" section. The "<list>:" prefix is optional, and if omitted, is assumed to refer to the "request" list. When a variable is encountered, the given list is examined for an attribute of the given name. If found, the variable refer‐ ence in the string is replaced with the value of that attribute. Some examples are: %{User-Name} %{request:User-Name} # same as above %{reply:User-Name} Results of regular expression matches If a regular expression match has previously been performed, then the special variable %{0} will contain a copy of the input string. The variables %{1} through %{8} will contain the sub‐ string matches, starting from the left-most parantheses, and onwards. If there are more than 8 parantheses, the additional results will not be placed into any variables. Obtaining results from databases It is useful to query a database for some information, and to use the result in a condition. The following syntax will call a module, pass it the given string, and replace the variable ref‐ erence with the resulting string returned from the module. %{module: string ...} The syntax of the string is module-specific. Please read the module documentation for additional details. Conditional Syntax Conditional syntax similar to that used in Unix shells may also be used. %{Foo:-bar} When attribute Foo is set, returns value of Foo When attribute Foo is unset, returns literal string ’bar’ %{Foo:-%{Bar}} When attribute Foo is set, returns value of attribute Foo When attribute Foo is unset, returns value of attribute Bar (if any) %{Foo:-%{Bar:-baz}} When attribute Foo is set, returns value of attribute Foo When attribute Foo is unset, returns value of attribute Bar (if any) When attribute Bar is unset, returns literal string ’baz’ String lengths and arrays Similar to a Unix shell, there are ways to reference string lenths, and the second or more instance of an attribute in a list. If you need this functionality, we recommend using a real language. %{#string} The number of characters in %{string}. If %{string} is not set, then the length is not set. e.g. %{#Junk-junk:-foo} will yeild the string "foo". %{Attribute-Name[index]} Reference the N’th occurance of the given attribute. The syntax %{<list>:Attribute-Name[index]} may also be used. The indexes start at zero. This feature is NOT available for non-attribute dynamic translations, like %{sql:...}. For example, %{User-Name[0]} is the same as %{User-Name} The variable %{Cisco-AVPair[2]} will reference the value of the THIRD Cisco-AVPair attribute (if it exists) in the request packet, %{Attribute-Name[#]} Returns the total number of attributes of that name in the relevant attribute list. The number will usually be between 0 and 200. For most requests, %{request:User-Name[#]} == 1 %{Attribute-Name[*]} Expands to a single string, with the value of each array member separated by a newline. %{#Attribute-Name[index]} Expands to the length of the string %{Attribute- Name[index]}. ATTRIBUTES The attribute lists described above may be edited by listing one or more attributes in an "update" section. Once the attributes have been defined, they may be referenced as described above in the VARIABLES section. The following syntax defines attributes in an "update" section. Each attribute and value has to be all on one line in the configuration file. There is no need for commas or semi-colons after the value. Attribute-Name = value Attribute names The Attribute-Name must be a name previously defined in a dic‐ tionary. If an undefined name is used, the server will return an error, and will not start. Operators The operator used to assign the value of the attribute may be one of the following, with the given meaning. = Add the attribute to the list, if and only if an attribute of the same name is already present in that list. := Add the attribute to the list. If any attribute of the same name is already present in that list, its value is replaced with the value of the current attribute. += Add the attribute to the tail of the list, even if attributes of the same name are already present in the list. -= Remove all matching attributes from the list. Both the attribute name and value have to match in order for the attribute to be removed from the list. Values The format of the value is attribute-specific, and is usually a string, integer, IP address, etc. Prior to the attribute being instantiated, the value is handled as described above in the STRINGS AND NUMBERS section. This flexibility means that, for example, you can assign an IP address value to an attribute by specifying the IP address directly, or by having the address returned from a database query, or by having the address returned as the output of a program that is executed. FILES /etc/raddb/vmpsd.conf, /etc/raddb/radiusd.conf SEE ALSO radiusd.conf(5), vmpsd.conf(5), dictionary(5) AUTHOR Alan DeKok <aland(a)deployingradius.com> 12 Jun 2007 unlang(5)

3 22

Errors reading dictionary - MikroTik
by Liam Farr 15 Jun '07

15 Jun '07

Hi, I get the following error trying to start freeradius; daytona:~# freeradius -x Starting - reading configuration files ... Errors reading dictionary: dict_init: /etc/freeradius/dictionary[177]: invalid ATTRIBUTE line Errors reading radiusd.conf daytona:~# Im using the dictionary file provided by MikroTik at http://www.mikrotik.com/Documentation/manual_2.9/dictionary whihc I installed by typing; cd /etc/freeradius rm dictionary wget http://www.mikrotik.com/Documentation/manual_2.9/dictionary chmod 640 dictionary chown root.freerad dictionary I'm relatively new to FreeRADIUS and any help would be appreciated. Regards Liam

4 7