- Freeradius-Users - lists.freeradius.org

Re: Proxy / reply translation
by Richard J Palmer 09 Nov '17

09 Nov '17

HI Alan That's perfect - I *should* be able to work with that (and start at least) If I get any issues I'll come back to you - I do appreciate the help here Richard > --- Original message --- > Subject: Re: Proxy / reply translation > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Date: Thursday, 09/11/2017 1:35 PM > > On Nov 9, 2017, at 8:19 AM, Richard J Palmer <richard(a)merula.net> > wrote: >> >> This is where my skills are not great (regex) most other areas I can >> work with. Ultimately I am happy to pay someone to help write the >> little bit of code that does this. I do need to cope with Netmasks >> from /32 to /24 so a few switch cases. > > It shouldn't be difficult. > >> >> Alternatively if someone can provide a few pointers on that bit I can >> probably build from there. > > If you have: > >> >>> >>>> >>>> Cisco-AVPair = "ip:route=1.2.3.1 255.255.255.240" > > Step 1, split it into pieces: > > if (&Cisco-AVPair =~ /ip:route=([^ ]+) ([^ ]+)/) { > > This matches the "ip:route" prefix. It then matches non-space > data, then a space, and more non-space data. As per the FR > documentation, the first match goes into %{1}, and the second into > %{2}. > > As there are only a limited number of net masks, you can expand the > net mask, and switch over it (inside of the "if" block from above) > > switch "%{2}" { > case "255.255.255.255" { > update reply { > Framed-Route = "%{1}/32" > } > } > > case "255.255.255.254" { > update reply { > Framed-Route = "%{1}/31" > } > } > > case "255.255.255.252" { > update reply { > Framed-Route = "%{1}/30" > } > } > > ... etc... > > # and the "catch all" case, just mash it to /28 > case { > update reply { > Framed-Route = "%{1}/28" > } > } > } > > A little verbose, but it should work. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: Proxy / reply translation
by Richard J Palmer 09 Nov '17

09 Nov '17

HI This is where my skills are not great (regex) most other areas I can work with. Ultimately I am happy to pay someone to help write the little bit of code that does this. I do need to cope with Netmasks from /32 to /24 so a few switch cases. Alternatively if someone can provide a few pointers on that bit I can probably build from there. Again I am not expecting something for nothing - so if it needs an hour or so's work I am happy to reward for that Richard > --- Original message --- > Subject: Re: Proxy / reply translation > From: Matthew Newton <mcn(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Date: Thursday, 09/11/2017 10:31 AM > > On Thu, 2017-11-09 at 10:20 +0000, Richard J Palmer wrote: >> >> * >> Framed-IP-Address = 1.2.3.1 >> Framed-IP-Netmask = 255.255.255.240 >> Cisco-AVPair = "ip:route=1.2.3.1 255.255.255.240" >> Service-Type = Framed-User >> >> However we need >> >> Framed-IP-Address = 1.2.3.1 >> Framed-IP-Netmask = 255.255.255.240 >> Framed-Route = "1.2.3.1/28" >> Service-Type = Framed-User >> >> Is this relatively easy to do ? > > Match on regex should work, something like > > if (&Cisco-AVPair =~ /ip:route=([^ ]+) /) { > update reply { > Framed-Route := "%{1}/28" > } > } > > if the netmasks aren't all the same you'll need to change that as well > of course - I don't think there's anything to convert the netmask into > the number of bits, but a switch statement should do it easily for the > limited number of cases. > > -- > Matthew > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Proxy / reply translation
by Richard J Palmer 09 Nov '17

09 Nov '17

Hi We are looking to tun an LNS for a customer who has their own radius - we will effectively proxy the radius requests to them. However we need to 'translate' the reply to work with our LNS devices and wondered if someone could provide some pointers. Their radius will currently return something like: Framed-IP-Address = 1.2.3.1 Framed-IP-Netmask = 255.255.255.240 Cisco-AVPair = "ip:route=1.2.3.1 255.255.255.240" Service-Type = Framed-User However we need Framed-IP-Address = 1.2.3.1 Framed-IP-Netmask = 255.255.255.240 Framed-Route = "1.2.3.1/28" Service-Type = Framed-User It does not matter IF the Cisco-AVPair is in place or not. As we don't hold the radius data here (and I am not convinced 100% that they can easily amend this their side I was wondering how easy ulang or similar could parse this and amend the reply on the proxy Is this relatively easy to do ? Thanks in advance Richard Palmer | Director | Merula Limited Company Registered in England and Wales No. 3243995 5 Avro Court, Huntingdon, Cambridgeshire, PE29 6XS Phone 01480 222940 | Support 0845 330 0666 Support Email support(a)merula.net

2 1

RE: Freeradius-Users Digest, Vol 151, Issue 18
by Peter Hutchison 09 Nov '17

09 Nov '17

>what you log will be dependent on what info you sent back to the NAS on the access-accept, what the NAS can send in accounting and what stage the AAA is at - at the auth stage you wont have an IP address of the client device - that'll come through after they've received an address via DHCP/SLAAC etc and the NAS has sent an interim-update - the user-name will depend on what was sent back in access accept and what the NAS decides to do - you'll otherwise have just the outerID as the user-name (and logs filled with lots of 'anonymous@realm' entries >linelog is a trivial way - just look at linelog module and see the calls for accounting...and then just enable the linelog in the accounting section of the outer server alternatively, go for SQL - enable the detail SQL module and call it in the accounting section - for performance you probably DONT want this to be syncronous so use the buffered-sql virtual server to create a file which then gets slurped into SQL when theres resources (async). That’s for the information, I eventually got it working. First I had to get the wireless AP's sending the accounting info to the correct port. Then I set up a new linelog entry for Interim-Updates (we get an Ip after they authenticate) Accounting-Requests. Then added the new wmodule to the accounting section in our virtual servers. Voila, accounting is now being logged! Peter University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

1 0

key_expiration variable not defined anywhere (in trustrouter.c in rlm_realm)
by Stefan Paetow 08 Nov '17

08 Nov '17

Hi Alan, During the build to make this all work with OpenSSL, I noticed that 'key_expiration' is used for the first time in line 422 of trustrouter.c in the rlm_realm module. According to Github this was a manual merge? Did something go missing (the declaration of key_expiration perhaps)? Build output snippet: -- begin -- CC src/modules/rlm_realm/trustrouter.c src/modules/rlm_realm/trustrouter.c: In function ‘srvr_blk_to_home_server’: src/modules/rlm_realm/trustrouter.c:422:36: error: ‘key_expiration’ undeclared (first use in this function); did you mean ‘get_realm_expiration’? tid_srvr_get_key_expiration(blk, &key_expiration); ^~~~~~~~~~~~~~ get_realm_expiration src/modules/rlm_realm/trustrouter.c:422:36: note: each undeclared identifier is reported only once for each function it appears in make: *** [scripts/boiler.mk:635: build/objs/src/modules/rlm_realm/trustrouter.lo] Error 1 -- end -- Could you have a look? I've copied Alex in, just in case. Thank you very much! With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

1 0

FreeRadius high availability lab
by Claudio Carvalho 08 Nov '17

08 Nov '17

Hi Users, I started a test for a large deployment and this topology was recommended, I tested it in the lab and apparently did it work, any comments from someone about the attached topology? is there something like this in production? Claudio.

8 12

Enabling accounting on Freeradius 3.0.15
by Peter Hutchison 08 Nov '17

08 Nov '17

I intend on enabling accounting on Freeradius so I can log user sessions including username and IP address of the user device. I think it is something to do with linelog module and the default (or my eduroam) virtual server accounting section. Is this correct? Has anyone deployed accounting logging and how they did it. Some useful instructions would be useful. Thanks. Peter University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 2

How to -> Accounting Monthly Update?
by Igor Karolesky 08 Nov '17

08 Nov '17

Hi there, May i ask for some help? I'm using freeradius 2.1.12 (can't upgrade it) My accounting is working finely but i don't know how to make it update monthly or weekly. Don't know here to configure it. Don't know where the fuck i put the Acct-Interim-Update. I have found a usefull book tho. But I can't reply what i learned on it to my actual network. --

2 1

Solved Freeradius calling station ID
by Marco Ramian 08 Nov '17

08 Nov '17

i addedd this : msg_goodpass = "%{Called-Station-Id}" msg_badpass = "%{Called-Station-Id}" in radius.conf and now can see AP Mac Address, thank u all guys

1 0

Troubleshooting apparent failed RADIUS challenges
by Turner, Ryan H 08 Nov '17

08 Nov '17

Hoping this does not invoke a beating from Alan... We are a LARGE EAP-TLS shop (one of the first), and authenticate 10s of thousands of clients every day. I am noticing (which doesn't mean it is necessarily our fault), that some percentage of our users that cannot connect appear to be breaking down in the Challenge phase. Initially it looks like they aren't even trying to authenticate on wireless (we don't log challenges), but a capture will tell me that a challenge is made, and then there are no responses... A few questions... I honestly find the Radius Challenge section difficult to understand. In our EAP-TLS environment, exactly what is happening during this challenge phase? Doing searching on this has so far returned nebulous answers. Exactly what is being checked of verified with an EAP-TLS client? Secondly, how do you even begin to troubleshoot why certain clients would not progress beyond the challenge? We have an android user that is onboarded with a certificate that will last a year. Periodically, it will just stop working. I will notice an incomplete challenge. If he reonboards with a new certificate, everything works again for some period (obviously looks like a client issue). We also notice that some users fail their challenge when traveling abroad with eduroam. We are running one of the most patched 2.X versions of FreeRadius (we are actively building for a deployment of 3 at this moment). Ryan Turner

2 2