- Freeradius-Users - lists.freeradius.org

HUNTGROUP WITH SQL
by Jose Quezada 31 Dec '16

31 Dec '16

Hi Everyone, I'd like your help. I'm working to link certain user to a NAS I made the radhuntgroup table (groupname, nasipaddress...) and the internal AVP sql-hubtgroup-name but I need the Unlang Code that work... Thank in advance

1 0

WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
by Narender Yadav 30 Dec '16

30 Dec '16

Hello Everyone, I am new to FreeRADIUS world and got stuck at one point. My setup: - FreeRADIUS server o Users mentioned in ‘/usr/local/etc/raddb/mods-config/files/authorize’ § test Cleartext-Password := "welcome" o clients mentioned in ‘/usr/local/etc/raddb/clients.conf’ § client x.x.x.x{ § secret=test § } § Where, x.x.x.x is the IP address of RADIUS client machine - RADIUS client o RADIUS server is defined in ‘/etc/raddb/server’ § y.y.y.y test 2 § where, y.y.y.y is the IP address of RADIUS server *we have one application server where RADIUS client is already built and its working fine with newly configured RADIUS server. The issue is with RADIUS client that I have setup.* when trying to login to RADIUS client machine using user ‘test’, I am getting below error in debug logs: I have checked again and shared secret is same on NAS and RADIUS server. -------------------------------------------------------------------------------------------------------------------------------------- (1) Received Access-Request Id 33 from x.x.x.x:44896 to 10.222.34.65:1812 length 90 (1) User-Name = "test" (1) User-Password = "\010\n\r\177INCORRECT" (1) NAS-IP-Address = 10.222.34.227 (1) NAS-Identifier = "sshd" (1) NAS-Port = 3874 (1) NAS-Port-Type = Virtual (1) Service-Type = Authenticate-Only (1) Calling-Station-Id = "115.113.149.70" (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: users: Matched entry test at line 1 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Auth-Type PAP { (1) pap: Login attempt with password (1) pap: Comparing with "known good" Cleartext-Password (1) pap: ERROR: Cleartext password "? ?INCORRECT" does not match "known good" password (1) pap: Passwords don't match (1) [pap] = reject (1) } # Auth-Type PAP = reject (1) Failed to authenticate the user (1) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> test (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 33 from 10.222.34.65:1812 to x.x.x.x:44896 length 20 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 33 with timestamp +132 Ready to process requests *Regards,* *Narender Yadav*

3 3

EAP-AKA , EAP-SIM configuartion
by Avichal Agarwal 30 Dec '16

30 Dec '16

hi I want to configure EAP-AKA and EAP-SIM configuration on my Ubuntu-16 machine, MY free radius server version is 2.2.8 $ sudo freeradius -v freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. I am following the link [1]http://freeradius.1045715.n5.nabble.com/radiusd-startup-failure-for- EAP-AKA-configuration-td5717980.html But I am getting error: main{ user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary Errors reading dictionary: dict_init: /etc/freeradius/dictionary[34]: d ict_addattr: Duplicate attribute name EAP-Type-AKA [cid:XOK0LK7CT9SZ@namo.co.kr] [update?userid=avichal.a&do=bWFpbElEPTIwMTYxMjI5MTQzODE1ZXBjbXM1cDdkMDU 2ZTBkNDk4Y2M2ZTA0NjE2ZWY2MzNmMjIxYzg2ZSZyZWNpcGllbnRBZGRyZXNzPWZyZWVyYW RpdXMtdXNlcnNAbGlzdHMuZnJlZXJhZGl1cy5vcmc_] References 1. http://freeradius.1045715.n5.nabble.com/radiusd-startup-failure-for-EAP-AKA…

2 1

Unknown or invalid value "Crypt-Local" for attribute Auth-Type"
by Christoph Schwabl 30 Dec '16

30 Dec '16

Hello, I am currently trying to upgrade from freeradius 1.x (which is running for about 10 years) to freeradius 3.0.12. The freeradius is used for shell access to Cisco routers. I am using MySQL and the tables looks like: mysql> select * from radgroupreply; +----+-----------+--------------+----+-------------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------------+ | 3 | lanmgmt | Cisco-AVPair | = | shell:priv-lvl=15 | | 4 | lanmgmt | Service-Type | = | NAS-Prompt-User | | 5 | readonly | Cisco-AVPair | = | shell:priv-lvl=2 | | 6 | readonly | Service-Type | = | NAS-Prompt-User | +----+-----------+--------------+----+-------------------+ mysql> select * from radcheck; +----+------------------+----------------+----+------------------------ ----------+ | id | username | attribute | op | value | +----+------------------+----------------+----+------------------------ ----------+ | 2 | testusersql | Crypt-Password | := | cc03e747a6afbbcbf8be7668acfebee5 | | 3 | testuserdisabled | Crypt-Password | := | cc03e747a6afbbcbf8be7668acfebee5 | +----+------------------+----------------+----+------------------------ ----------+ mysql> select * from radgroupcheck; +----+-----------+-----------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+-----------+----+-------------+ | 24 | lanmgmt | Auth-Type | := | Crypt-Local | | 25 | disabled | Auth-Type | := | Reject | +----+-----------+-----------+----+-------------+ mysql> select * from radusergroup; +------------------+-----------+----------+ | username | groupname | priority | +------------------+-----------+----------+ | testusersql | lanmgmt | 1 | | testuserdisabled | disabled | 1 | +------------------+-----------+----------+ In the debug it is possible to see the reason. Rejects because of: "(0) sql: ERROR: Error parsing value: Unknown or invalid value "Crypt-Local" for attribute Auth-Type" The corespondig debug (freeradius -X) part: ... (0) sql: SQL-User-Name set to 'testusersql' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testusersql' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testusersql' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Crypt-Password := "cc03e747a6afbbcbf8be7668acfebee5" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testusersql' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testusersql' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'testusersql' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'testusersql' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'lanmgmt' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'lanmgmt' ORDER BY id (0) sql: ERROR: Error parsing value: Unknown or invalid value "Crypt-Local" for attribute Auth-Type (0) sql: ERROR: Error parsing user data from database result (0) sql: ERROR: Error retrieving check pairs for group lanmgmt rlm_sql (sql): Released connection (1) rlm_sql (sql): Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.53-0+deb8u1, protocol version 10 (0) [sql] = fail (0) } # authorize = fail (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> testusersql (0) sql: SQL-User-Name set to 'testusersql' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testusersql', 'test123', 'Access-Reject', '2016-12-30 09:43:02') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testusersql', 'test123', 'Access-Reject', '2016-12-30 09:43:02') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) ... I know there is something wrong with the Auth-Type, but I am not aware how to solve it, even it is working under v1.x fine and also check already the documentation (e.g. http://wiki.freeradius.org/config/Auth%20Type) Is there some file where I need to specify Crypt-Local as Auth-Type? Thx br Christoph

2 1

Freeradius 3.0.12 problems - redis and mysql pool connections
by Michal Tomaszewski 28 Dec '16

28 Dec '16

Hello Alan, I found 2 problems in freeradius 3.0.12 To be short: Our several freeradius servers are using MySQL cluster (percona) and redis master/slave mapped to local port using HA Proxy on each freeradius server. So in fact each Freeradius sees 1 local port for MySQL and 1 local port for redis. We are not using server pool and load balancing definition in Freeradius in order to have strict control on which database server is used for all writes from several Freeradius servers. To be sure Freeradius is starting when redis or sql is not started yet (or not available for a while) in both redis and sql pool definition we have to use: pool { start = 0 but we also want to have min number of connections defined higher than 0 (e.g. in a standard way): min = ${thread[pool].min_spare_servers} So min > start. When server (sql or redis) becomes available Freeradius opens some connections. After restart of sql or redis Freeradius should open new connections to those servers as old connections are not longer available. And we have 2 errors #1 When redis becomes unavailable for a while (restart of redis-server or simple restart of HA_Proxy) Freeradius does not check that connection is no longer available and keeps those invalid connections till lifetime time. In fact in such situation old connection should be discarded and new connection shall be opened. Standard lifetime in mods-available/redis is set to 86400 so redis module is not able to read/write anything from redis-server for 24 hours. In /var/log/freeradius/radius.log there are only ERRORs when there is redis write command, there is no error information when there is (unsuccessful) read command. To see that debug mode shall be started. So in fact redis module is not verifying redis valid/invalid connection state. Changing lifetime to e.g. 60 helps to force redis module start working (in 60 second from redis-server restart) but that is just a workaround not a solution. #2 In var/log/freeradius/radius.log we have lots of errors: ERROR: SQL query failed: no connection It seems that error shows up when connection is closed by e.g. idle-timeout... Example: Thu Dec 22 15:48:35 2016 : Debug: attribute --> User-Name Thu Dec 22 15:48:35 2016 : Debug: (81) EXPAND %{User-Name} Thu Dec 22 15:48:35 2016 : Debug: (81) --> h274_xxxxxxxxxxxxxx Thu Dec 22 15:48:35 2016 : Debug: (81) SQL-User-Name set to 'h274_xxxxxxxxxxxxxx' Thu Dec 22 15:48:35 2016 : Debug: rlm_sql (sql): Reserved connection (4) Thu Dec 22 15:48:35 2016 : Debug: (81) Executing select query: INSERT INTO radius_radacct_closed ( acctsessionid, acctuniqueid, username, hotspot_id, device_id, felogin_id, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress ) VALUES ('585be1cc00000004', 'e2a5c5294e55743ffc9169de47d5de4a', 'h274_xxxxxxxxxxxxxx', '274', '3625', '3799789', '', '192.168.176.1', '00000004', 'Wireless-802.11', FROM_UNIXTIME(1482418115 - 1460), FROM_UNIXTIME(1482418115), FROM_UNIXTIME(1482418115), 1460, '', '', '', '0' << 32 | '129433', '0' << 32 | '1435982', 'h274-xxxxxxxxxxxxxx', 'EC-9B-F3-19-4A-F2', 'Lost-Carrier', '', '', '192.168.176.5') Thu Dec 22 15:48:35 2016 : ERROR: (81) SQL query failed: no connection Thu Dec 22 15:48:35 2016 : Debug: rlm_sql (sql): Released connection (4) Thu Dec 22 15:48:35 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:48:35 2016 : Debug: (81) EXPAND %{sql: INSERT INTO radius_radacct_closed ( acctsessionid, acctuniqueid, username, hotspot_id, device_id, felogin_id, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress ) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{User-Name}', '%{LOCATION-HotspotID}', '%{LOCATION-DeviceID}', '%{LOCATION-FELogin-Id}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%l - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%l), FROM_UNIXTIME(%l), %{%{Acct-Session-Time}:-NULL}, '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}') } Thu Dec 22 15:48:35 2016 : Debug: (81) --> freeradius log looks like: radius1:~$ tail /var/log/freeradius/radius.log Thu Dec 22 15:59:45 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:47 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:47 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:48 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:48 2016 : ERROR: (164) ERROR: SQL query failed: no connection Thu Dec 22 15:59:48 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:51 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:54 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:54 2016 : Info: Need 0 more connections to reach min connections (5) Thu Dec 22 15:59:54 2016 : ERROR: (172) ERROR: SQL query failed: no connection We tested to set freeradius use mysql directly, without haproxy and using default values in mods-availables/sql (including pool { start value) but it did not change this strange behavior. Any help would be appreciated... Regards, Mike ________________________________________ Uwaga: Treść niniejszej wiadomości może być poufna i objęta zakazem jej ujawniania. Jeśli czytelnik tej wiadomości nie jest jej zamierzonym adresatem, pracownikiem lub pośrednikiem upoważnionym do jej przekazania adresatowi, informujemy że wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomości jest zabronione. Jeśli otrzymałeś tę wiadomość omyłkowo, proszę bezzwłocznie odesłać ją nadawcy, a samą wiadomość usunąć z komputera. Dziękujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

3 5

Multiple realms and network validation with WPA2 Enterprise
by Henti Smith 27 Dec '16

27 Dec '16

Good morning all. I've searched a bit and while I found some information about how the client validates the SSID using certificates, it's not entirely clear how to make sure a fake SSID cannot steal user/pass from clients. As per previous mails, we're running EAP method TTLS with PAP 2nd phase against a Kerberos oracle. We're using CA signed wildcard cert for our internal network. Do we need to use a username@domain username structure to validate the realm (I assume using the domain_realm config in /etc/krb5.conf) use SSL to validate the radius server it's communicating with ? Does that also mean we can have multiple domains pointing to multiple realms using seperate realms and domain_realm configurations ? Regards Henti -- --

6 9

custom attributes per realm/proxy after auth.
by Benedikt Sveinsson 24 Dec '16

24 Dec '16

Current running environment: freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 postgres 9.3 Hi all I’m running FR for a number of BRAS’es and I’m working on implementing BNG service (cisco XR) Up to now, we have been able to do realm processing on the BRAS’es them self, just used radius for auth, but have to go to a centralised solution. We have number of proxy connections to 3rd party radius servers, based on domain name, and for each of those 3rd parties, I need to be able to reply to the NAS(BNG) number of radius attributes(AV pairs, tunnel info etc.. ) this is the flow: BNG -> my radius -> 3rd party radius 3rd party radius (auth only) -> my radius (adds attributes) -> BNG can someone point me in the right direction where this is configured - Benedikt

3 4

VLAN Assignment with RADIUS
by Valentin Heidelberger 24 Dec '16

24 Dec '16

Hey everyone, I am trying to do the following with RADIUS There is 1 AP with 2 SSIDs - lets cal them "B" and "P" I want RADIUS to assign VLAN20 to "P" and VLAN40 to "B" I have found no other method online than configuring static users in the users file with VLANs assigned to them. In my setup users are authenticated with LDAP. Do I really have to assign every single user the VLAN or is there a simpler way like assigning the VLAN to a virtual server running on a different port or something focussed on the SSIDs? Kind regards

4 6

Simultaneous-Use + MySQL + Ubuntu 16.04 Srv + Mikrotik RB + Unifi AP
by Cadu Garcia 22 Dec '16

22 Dec '16

Hello! I read a lot of docs on Internet and tried examples but I still having problems. I can't use Simultaneous-Use attribute with MySQL. Neither with groups option. My platform is on Ubuntu 16.04 Server and I'm using Mikrotik RB750 to provide DHCP and my AP is Ubiquiti Unifi UAP-LR. Everything seems works fine like Authentication on MySQL DB and Post-auth data. But radacct DB is empty. Can you help me? Best regards.

2 1

Problem with exec shell_escape option
by Brian Candler 22 Dec '16

22 Dec '16

I'm trying to get exec to pass a string as an argument without any shell quoting, but not succeeding. This is with freeradius 3.0.12 under Ubuntu 16.04. [Aside: what I'm actually trying to do is invoke an external change password program using an exec expansion in local_cpw in rlm_mschap, following the example given: # local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}" But I'm finding that passwords with special characters are being mangled] I can reproduce this using exec by itself. Here are 4 combinations: shell_escape = {yes,no} and expansion argument quoted/not quoted. # mods-available/exec - I left the original exec in there and added: exec exec1 { wait = yes input_pairs = request shell_escape = no timeout = 10 } exec exec2 { wait = yes input_pairs = request shell_escape = yes timeout = 10 } # policy.d/testpolicy testpolicy { update request { &Tmp-String-0 := " foo ' bar \" baz \\ qux " &Tmp-String-1 := "%{exec1:/usr/local/bin/showarg %{Tmp-String-0}}" &Tmp-String-2 := "%{exec1:/usr/local/bin/showarg '%{Tmp-String-0}'}" &Tmp-String-3 := "%{exec2:/usr/local/bin/showarg %{Tmp-String-0}}" &Tmp-String-4 := "%{exec2:/usr/local/bin/showarg '%{Tmp-String-0}'}" } } # /usr/local/bin/showarg #!/bin/sh echo "Arg is <$1>" >>/tmp/exec.log Results: - 1 and 3 fail with "rad_expand_xlat: Invalid string passed as argument" - 2 and 4 both apply shell quoting to the argument # cat /tmp/exec.log Arg is <\ foo\ \'\ bar\ "\ baz\ \ qux\ > Arg is <\ foo\ \'\ bar\ "\ baz\ \ qux\ > Debug output: (0) policy testpolicy { (0) update request { (0) &Tmp-String-0 := " foo ' bar \" baz \\ qux " (0) Executing: /usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ : rad_expand_xlat: Invalid string passed as argument invalid command line '/usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ '. (0) EXPAND %{exec1:/usr/local/bin/showarg %{Tmp-String-0}} (0) --> (0) &Tmp-String-1 := (0) Executing: /usr/local/bin/showarg '\ foo\ \'\ bar\ "\ baz\ \\ qux\ ': (0) Program returned code (0) and output '' (0) EXPAND %{exec1:/usr/local/bin/showarg '%{Tmp-String-0}'} (0) --> (0) &Tmp-String-2 := (0) Executing: /usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ : rad_expand_xlat: Invalid string passed as argument invalid command line '/usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ '. (0) EXPAND %{exec2:/usr/local/bin/showarg %{Tmp-String-0}} (0) --> (0) &Tmp-String-3 := (0) Executing: /usr/local/bin/showarg '\ foo\ \'\ bar\ "\ baz\ \\ qux\ ': (0) Program returned code (0) and output '' (0) EXPAND %{exec2:/usr/local/bin/showarg '%{Tmp-String-0}'} (0) --> (0) &Tmp-String-4 := (0) } # update request = noop (0) } # policy testpolicy = noop So it looks like the shell_escape setting isn't doing anything. What am I missing? Thanks, Brian. P.S. There is something else confusing. In raddb/mods-available/exec it says: # Execute external programs # # This module is useful only for 'xlat'. To use it, # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{exec:/path/to/program args}` However, I can see from the source that it has hooks for the various module lifecycle stages; indeed, the sites-available/default config invokes it in the accounting and post-auth stages: # For Exec-Program and Exec-Program-Wait exec So is the comment that exec is "useful only for 'xlat'" incorrect? I've checked the obvious places for documentation with no luck: - http://wiki.freeradius.org/search?q=exec - man rlm_exec (not found) But in any case, it doesn't affect the main issue here, since local_cpw has to use a string expansion anyway.

2 2