- Freeradius-Users - lists.freeradius.org

Regex match on a variable is not working if length is long
by Chinnapaiyan, Nagamani 12 Dec '19

12 Dec '19

Hi, I am using freeradius-4.0.x version. This one works, (6) if ( "%{control:Tmp-String-7}" =~ /vendor-options.*$number 43$$value (([0-9a-fA-F]{2}:)*[0-9a-fA-F]{2})/ ) { (6) EXPAND %{control:Tmp-String-7} (6) --> ((ClassName Policy)(name client-policy:1,6,00:A0:BC:6C:7E:64)(v4-reply-options [vendor-encapsulated-options])(vendor-options [((ClassName Option)(number 43)(value 01:03:00:A0:BC:14:44:01:00:02:01:03:11:05:00:44:00:44:07:00:43:00:43:01:01:02:01:03:06:07:01:BD:01:BD:01:01:02:01:07:00:87:00:88:01:01:02:01:06:C0:A8:64:00:18:07:00:16:00:17:01:01:02:01:03:11:06:C0:A8:64:00:18:07:00:A1:00:A1:19:01:01:21:01:01:26:38:68:74:74:70:3A:2F:2F:31:30:2E:34:33:2E:31:39:2E:31:38:3A:39:36:37:35:2F:6C:69:76:65:2F:43:50:45:4D:61:6E:61:67:65:72:2F:43:50:45:73:2F:67:65:6E:65:72:69:63:54:52:36:39:27:02:00:05:28:02:07:D0:36:01:FF:40:01:00)(option-definition-set-name ViasatUT))])) (6) update control { But this one is not, (15) if ( "%{control:Tmp-String-7}" =~ /vendor-options.*\(number 43$\(value (([0-9a-fA-F]{2}:)*[0-9a-fA-F]{2})/ ) { (15) EXPAND %{control:Tmp-String-7} (15) --> ((ClassName Policy)(name client-policy:1,6,00:A0:BC:6C:7D:3A)(v4-reply-options [vendor-encapsulated-options])(vendor-options [((ClassName Option)(number 43)(value 01:03:00:A0:BC:02:09:55:54:00:00:00:00:00:00:07:03:0E:55:54:32:00:00:00:00:00:03:07:03:0A:00:09:04:11:55:54:5F:33:2E:37:2E:33:2E:31:30:2E:39:2E:62:69:6E:05:04:0A:4F:FF:0F:14:44:01:00:02:01:03:11:05:00:44:00:44:07:00:43:00:43:01:01:02:01:03:06:07:01:BD:01:BD:01:01:02:01:07:00:87:00:88:01:01:02:01:06:C0:A8:64:00:18:07:00:16:00:17:01:01:02:01:03:11:06:C0:A8:64:00:18:07:00:A1:00:A1:19:01:01:26:42:68:74:74:70:3A:2F:2F:61:63:73:2E:64:65:76:2E:63:6D:74:2E:76:69:61:73:61:74:2E:69:6F:3A:39:36:37:35:2F:6C:69:76:65:2F:43:50:45:4D:61:6E:61:67:65:72:2F:43:50:45:73:2F:67:65:6E:65:72:69:63:54:52:36:39:27:02:00:05:28:02:07:D0:2A:0E:55:54:2E:35:2E:32:2E:32:2E:31:30:35:30:33:2B:04:0A:4F:FF:0F:2C:0E:55:54:2E:35:2E:32:2E:32:2E:31:30:33:39:33:33:0C:55:54:32:00:00:00:00:00:00:00:29:08:36:01:FF:3B:0E:55:54:32:00:00:00:00:00:03:07:03:0A:00:09:3C:12:55:54:32:5F:33:2E:37:2E:33:2E:31:30:2E:39:2E:62:69:6E:3D:04:0A:4F:FF:0F:3E:3C:68:74:74:70:3A:2F:2F:31:30:2E:37:39:2E:32:35:35:2E:31:36:2F:70:75:62:2F:76:77:61:5F:69:6D:61:67:65:73:2F:76:77:61:5F:55:54:2E:35:2E:32:2E:32:2E:31:30:35:30:33:2E:74:61:72:2E:67:7A:3F:3C:68:74:74:70:3A:2F:2F:31:30:2E:37:39:2E:32:35:35:2E:31:36:2F:70:75:62:2F:76:77:61:5F:69:6D:61:67:65:73:2F:76:77:61:5F:55:54:2E:35:2E:32:2E:32:2E:31:30:33:39:33:2E:74:61:72:2E:67:7A:40:01:00)(option-definition-set-name ViasatUT))])) (15) ERROR: regex failed: regex evaluation failed with code (-27): <INVALID> (15) ERROR: Condition evaluation failed because the value of an operand could not be determined (15) ... (15) } Both are same conditions with different values in them. Why second one is not working? Regards, Nagamani Chinnapaiyan

3 5

Does freeRADIUS 3 support PostgreSQL 11
by Min Wang 11 Dec '19

11 Dec '19

Does freeRADIUS 3 support PostgreSQL 11? Best regards, Min Wang Global Data Services New York Stock Exchange An Intercontinental Exchange Company (NYSE: ICE) 11 Wall St. | New York, NY 10005 Tel: +1 212.656.2441 | Mob: +1 201.936.9888 Min.Wang(a)theice.com<mailto:Min.Wang@theice.com> [ice] [Intercontinental Exchange - email.png]<https://icespace.cpex.com/servlet/JiveServlet/showImage/102-61239-14-18333/…> ________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), its subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired.

3 9

Trying not to send outer identity in the Access-Accept message
by Torres López María Isabel 11 Dec '19

11 Dec '19

Dear Sir or Madam. Currently, we are running Freeradius 3.0.11. It works correctly with our wireless controler, but when we upgrade the firmware of our wireless controlles, the users are not able to stablish sesión anymore. The problem is that the freeradius is sending two User-Name values in the Access-Accept packet (the inner and the outer identity), and the Wireless controler detects two values and drops the packet. The authentication is correct, but the Wireless controller does not stablish the user sesión. Besides, as the Freeradius sends both identities, sometimes the accountings shows the outer identity, not the inner one. ¿Is there any way to send only the inner identity in the Access-Accept packet? (6) Login OK: [pruebas.wifi(a)uah.es] (from client WLAN-1 port 0 cli B49D0B8C389F via TLS tunnel) (6) } # server inner (6) Virtual server sending reply (6) User-Name = "pruebas.wifi(a)uah.es" (6) Class = 0x414c554d4e4f53 (6) Filter-Id = "ALUMNOS" (6) eap_ttls: Got tunneled Access-Accept (6) eap: Sending EAP Success (code 3) ID 8 length 4 (6) eap: Freeing handler (6) [eap] = ok (6) } # authenticate = ok (6) Login OK: [anonymous(a)uah.es] (from client WLAN-1 port 0 cli B49D0B8C389F) (6) Sent Access-Accept Id 56 from 192.168.153.175:1812 to 172.17.47.240:37462 length 0 (6) User-Name = "anonymous(a)uah.es" (6) User-Name = "pruebas.wifi(a)uah.es" (6) Class = 0x414c554d4e4f53 (6) Filter-Id = "ALUMNOS" (6) MS-MPPE-Recv-Key = 0x567a04806953128ea5aadb908f6728a6753794d66a6ec189964c4f2e54cfb15b (6) MS-MPPE-Send-Key = 0x068df56d4605c2a4b62e8f4eee3fdb12031bdebf9eaa4201d6d08b310246d6d4 (6) EAP-Message = 0x03080004 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) Finished request Best regards. Mª Isabel Torres López Comunicaciones - Servicios Informáticos Universidad de Alcalá Correo: Isabel.torres(a)uah.es<mailto:Isabel.torres@uah.es> Telefono: 918856458

2 1

NT Status file lock conflict - 0xc0000054
by Innes Hatton 11 Dec '19

11 Dec '19

Hi, Currently I have an issue with a radius servers, every day the user authentication appears to not work for our Eduroam WIFI, after restarting the server everything begins to work again. I am currently using SAMBA to connect FreeRADIUS to Active Directory. Please see the errors below, any advice would be appreciated [root@EKCRadius5 /usr/home/netsys]# su freeradius $ /usr/local/bin/ntlm_auth --request-nt-key --domain=EASTKENT --username=service.freeradius --password=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx NT_STATUS_FILE_LOCK_CONFLICT: A requested read/write cannot be granted due to a conflicting file lock. (0xc0000054) Fri Dec 6 08:15:24 2019 : Error: No response to status check 909333 ID 41 for home server xxxxxxxxxxxxx port 1812 Fri Dec 6 08:15:24 2019 : Error: (909322) Ignoring duplicate packet from client 110-CAN-APS port 47516 - ID: 103 due to unfinished request in component authenticate module eap_peap Fri Dec 6 08:15:24 2019 : ERROR: (909214) mschap: ERROR: Failed to read from child output Thanks, Innes 'This email and any files transmitted with it are confidential and for the use of the individual or entity to whom they are addressed. If you are not the intended recipient be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is prohibited' - EKC Group

2 1

dhcpclient DHCP-Vendor display problem
by Chinnapaiyan, Nagamani 11 Dec '19

11 Dec '19

Hi, I am using freeradius 4.0.x version. The dhcpclient displays a truncated DHCP-Vendor option in reply packet. If I take a pcap it shows full DHCP-Vendor. Server side: (0) Sending DHCP-Offer XID e7ef0a2f from 10.43.18.62:6767 to 10.43.18.44:6767 via eth1 ... (0) DHCP-Vendor = 0x010300a0bc0209555400000000000007030e5554000000000000030703070016041155545f332e372e332e372e32322e62696e05040a4fff060c0200010e0100145e0100020103110500440044070043004301000201030606c0a86400180700500050010102010306070016001701010201060a000000080101020106ac1000000c0101020106c0a80000100101020106a9fe00001001010201067f00000008330c5554320000000000000029083b0e55543200000000000307030600003c115554325f332e372e332e362e302e62696e3d040a4fff06 ... Client side: # /usr/bin/dhcpclient -i eth1 -x -f /opt/viasat/dhcp_fr_citests/dhcpclient-modem_discover.txt 10.43.18.62:6767 Sending DHCP-Discover Id e7ef0a2f from 0.0.0.0:6767 to 10.43.18.62:6767 length 322 ... ... Received DHCP-Offer Id e7ef0a2f from 10.43.18.62:6767 to 0.0.0.0:6767 via eth1 length 553 ... DHCP-Vendor = 0x010300a0bc0209555400000000000007030e5554000000000000030703070016041155545f332e372e332e372e32322e62696e05040a4fff060c0200010e0100145e0100020103110500440044070043004301000201030606c0a86400180700500050010102010306070016001701010201060a000000 ... Regards, Nagamani Chinnapaiyan

2 1

Using freeradius just for device administrative access
by Coy Hile 10 Dec '19

10 Dec '19

Hi all, I'm finally getting around to setting up RADIUS in my lab so I can centralize authentication and authorization access to network devices. Assume for sanity's sake, NAS information and user information stored in a SQL database. Does anyone have any boilerplate for what can be thrown away wholesale from the default configs when *not* doing 802.1x or other end-user authentication/authorization. -- Coy Hile coy.hile(a)coyhile.com

2 1

Allow same user to authenticate with different passwords
by Taymour Gabr 10 Dec '19

10 Dec '19

Hi All, We are trying to allow users to authenticate with different passwords using an SQL database and freeradius version 3.0.17 (hotel scenario, where unrelated people can have the same family name). I've already seen these two links: http://freeradius.1045715.n5.nabble.com/Help-FreeRadius-Users-with-multiple… http://lists.freeradius.org/pipermail/freeradius-users/2009-February/035570… and I've had a look at the queries.conf file for mysql. I found the 'authorize_check_query', but that query just resolves to present all the fields for the username, and 'authorize_check_query' is not used elsewhere to use those results to retrieve the password... . So I am still at a loss of how I can change freeradius to accept a different type of radcheck table with multiple fields for the password per user, and where I would change the logic of how it accepts any of these passwords. Addiionally it should use Simultaneous-Use checks per username+password combination rather than per username. But that's of course something we can change within the sql server events and triggers. Thanks, Kind Regards, Taymour

3 4

get AP MAC Address
by juliana sales porto 06 Dec '19

06 Dec '19

Hello guys, I have a question. Is that possible I take the Mac Address from RB or AP mikrotik when the user is authenticating on hotspot system? Att, Juliana Porto

3 4

Microsoft ODBC bug
by Dom Latter 06 Dec '19

06 Dec '19

Hi all, I have been experimenting with Microsoft SQL Server as a replacement for our current mysql servers [1]. I installed Microsoft's own "ODBC Driver 17 for SQL Server" and have tested against both SQL Server running on the same Linux machine as Freeradius itself, and SQL Server running on a Windows machine. In both cases I found the same (what appears to be a) bug, which I will describe below for the benefit of the archives, even though it is (probably) not a problem with freeradius. Because people hitting this are very likely to be searching with terms including "freeradius". Also there is a chance that it is somehow specific to the interaction with freeradius. Because it is hard to imagine even Microsoft releasing something with such a glaring fault. I'll also give a work-around. I think I will now try iodbc instead - anybody here used it? Right, the bug. Here's my custom attribute: ATTRIBUTE My-Int 3004 integer Here's part of the post-auth section in the "outer" site: update control { My-Int := "%{sql:SELECT 9999 }" My-Int := "%{sql:SELECT 10000 }" My-Int := "%{sql:SELECT '10000' }" Here's debug output: EXPAND %{sql:SELECT 9999 } --> 9999 My-Int := 9999 Executing select query: SELECT 10000 rlm_sql_unixodbc: 22003 [Microsoft][ODBC Driver 17 for SQL Server]Numeric value out of range ERROR: Error fetching row ERROR: Unknown error ERROR: SQL query failed: <INVALID> EXPAND %{sql:SELECT 10000 } --> My-Int := 0 Executing select query: SELECT '10000' EXPAND %{sql:SELECT '10000' } --> 10000 My-Int := 10000 As you can see, if an integer is more than four digits long, the driver throws an error. But if you return the number as a string, it works fine. I'd love to see the source code for this... [1] Everything else is SQL Server and our current integration between the two databases is rather clunky; a homogeneous environment makes sense, whatever I personally think of Microsoft <grin>.

7 26

Redundant SQL connection. Starting radiusd and Respond with Access-Accept if all databases do not work #2
by Никита Борисенков 05 Dec '19

05 Dec '19

> The task is to allow or prohibit calls to subscribers. If the subscriber > has valid status, then we send Access-Accept. If the subscriber calls > the emergency service, then we send Access-Accept. In other cases, we > send Access-Reject. > > I configured two radius server, and two sql server. Replication > configured between sql servers. > > I write accounting and authentication to the database. > > I want that when one database is unavailable, data is written to another > database. But if both databases are not available, then we send > Access-Accept > > Some questions: > * Is there a way to not duplicate config for modules sql1 and sql2 > because they differ only in ip-address? > * Is there a way to start freeradius if one or all databases are down? > * What is the correct way to verify that sql1 and sql2 modules are fail > without checking "Calling-Station-Id-Is-Exists" for empty string? > * How can I simplify this configuration? > > > My config: > > sql sql1 { > driver = "rlm_sql_mysql" > dialect = "mysql" > > server = "localhost" > port = 3306 > login = "radius" > password = "test" > > query_timeout = 5 > > radius_db = "radius" > > read_clients = no > > # Table to keep radius client info > client_table = "nas" > > # If you want both stop and start records logged to the > # same SQL table, leave this as is. If you want them in > # different tables, put the start table in acct_table1 > # and stop table in acct_table2 > acct_table1 = "radacct" > acct_table2 = "radacct" > > # Allow for storing data after authentication > postauth_table = "radpostauth" > > # Tables containing 'check' items > authcheck_table = "radcheck" > groupcheck_table = "radgroupcheck" > > # Tables containing 'reply' items > authreply_table = "radreply" > groupreply_table = "radgroupreply" > > # Table to keep group info > usergroup_table = "radusergroup" > > pool { > start = ${thread[pool].start_servers} > min = ${thread[pool].min_spare_servers} > max = ${thread[pool].max_servers} > spare = ${thread[pool].max_spare_servers} > > uses = 0 > retry_delay = 30 > lifetime = 0 > idle_timeout = 60 > } > > # This entry should be used for additional instances (sql foo {}) > # of the SQL module. > group_attribute = "${.:instance}-SQL-Group" > > # This entry should be used for the default instance (sql {}) > # of the SQL module. > #group_attribute = "SQL-Group" > > # Read database-specific queries > # $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf > $INCLUDE ${modconfdir}/sql/main/${dialect}/queries.conf > } > > sql sql2 { > driver = "rlm_sql_mysql" > dialect = "mysql" > > server = "172.27.65.243" > port = 3306 > login = "radius" > password = "test" > > query_timeout = 5 > > radius_db = "radius" > > read_clients = no > > # Table to keep radius client info > client_table = "nas" > > # If you want both stop and start records logged to the > # same SQL table, leave this as is. If you want them in > # different tables, put the start table in acct_table1 > # and stop table in acct_table2 > acct_table1 = "radacct" > acct_table2 = "radacct" > > # Allow for storing data after authentication > postauth_table = "radpostauth" > > # Tables containing 'check' items > authcheck_table = "radcheck" > groupcheck_table = "radgroupcheck" > > # Tables containing 'reply' items > authreply_table = "radreply" > groupreply_table = "radgroupreply" > > # Table to keep group info > usergroup_table = "radusergroup" > > pool { > start = ${thread[pool].start_servers} > min = ${thread[pool].min_spare_servers} > max = ${thread[pool].max_servers} > spare = ${thread[pool].max_spare_servers} > > uses = 0 > retry_delay = 30 > lifetime = 0 > idle_timeout = 60 > } > > # This entry should be used for additional instances (sql foo {}) > # of the SQL module. > group_attribute = "${.:instance}-SQL-Group" > > # This entry should be used for the default instance (sql {}) > # of the SQL module. > #group_attribute = "SQL-Group" > > # Read database-specific queries > #$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf > $INCLUDE ${modconfdir}/sql/main/${dialect}/queries.conf > } > > # Create virtual module for SELECTs > instantiate { > redundant sql1_or_sql2 { > sql1 > sql2 > } > } > > server ats_local { > authorize { > update control { > Calling-Station-Id-Status = "%{sql1_or_sql2:SELECT > gtdb_users.status FROM gtdb_users WHERE aon='%{Calling-Station-Id}'}" > Called-Station-Id-Status = "%{sql1_or_sql2:SELECT > gtdb_users.status FROM gtdb_users WHERE aon='%{Called-Station-Id}'}" > > Calling-Station-Id-Is-Exists = "%{sql1_or_sql2:SELECT > COUNT(gtdb_users.status) FROM gtdb_users WHERE > aon='%{Calling-Station-Id}'}" > Called-Station-Id-Is-Exists = "%{sql1_or_sql2:SELECT > COUNT(gtdb_users.status) FROM gtdb_users WHERE > aon='%{Called-Station-Id}'}" > > Called-Station-Id-Emergency = "%{sql1_or_sql2:SELECT > COUNT(aon) FROM emergency_cid WHERE aon='%{Called-Station-Id}'}" > } > > # These attributes in normal condition must contain the number > >= 0 (because we use sql COUNT() ) > # If there is an empty string inside, then sql queries failed > for some reason and we return Access-Accept > > if (&control:Calling-Station-Id-Is-Exists == '' || > &control:Called-Station-Id-Is-Exists == '') { > update control { > Auth-Type := Accept > } > } > else { > if (control:Called-Station-Id-Emergency == '1') { > update control { > Auth-Type := Accept > } > } > > # ... > # bunch of elsif for Calling-Station-Id-Status and > Called-Station-Id-Status > # ... > > else { > update control { > Auth-Type := Reject > } > } > } > } > > > authenticate { > } > > preacct { > acct_unique > } > > $INCLUDE ${confdir}/ats_accounting.conf > > session { > } > > post-auth { > update reply { > cisco-avpair = "h323-credit-time=86400" > } > > if (&User-Name) { > # this not work, because I can't put "ok" to virtual module > "sql1_or_sql2" > # sql1_or_sql2 > redundant { > sql1 > sql2 > ok > } > } > > Post-Auth-Type REJECT { > if (&User-Name) { > redundant { > sql1 > sql2 > ok > } > } > } > > } > > pre-proxy { > } > > post-proxy { > } > } > See raddb/templates.conf You can put all of the configuration > *except* the "server" file into a "template" in that file. Then > configure two SQL modules: > > sql sql1 { > $template sql_template > server = localhost > } > > sql sql2 { > $template sql_template > server = 172.27.65.243 > } > > > > * Is there a way to start freeradius if one or all databases are down? > > See the pool config. This is documented. Set "start = 0", and "min > = 0" > > > * What is the correct way to verify that sql1 and sql2 modules are > fail without checking "Calling-Station-Id-Is-Exists" for empty string? > > Use a "redundant" block. > > > * How can I simplify this configuration? > > It seems OK to me. > > Alan DeKok. Sorry for repeating the message, I mistakenly deleted all previous messages. Thanks for the help. Everything worked out for me. The config began to look more simple. All my problems were due to the fact that I did not read the documentation. And I also deleted all the comments from the configuration files to make it easier to read, but in the end I made it worse for myself. Now I make a copy and rename the file to "*_with_comments" to look into it if necessary.

2 1