- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 140, Issue 40
by firing neurons 21 Dec '16

21 Dec '16

I used a Tmp-String-x and that also fixed it. About spliting the Tmp-Integer64 for sqlcounter reply name, where would I split this? Can I just put two reply attributes in sqlcounter? May be do the math there? or updating the reply list with the two attributes, calculating their value using expr in unlang is the only way? Message: 1 Date: Tue, 20 Dec 2016 20:32:54 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: attribute overflow from sql query in unlang Message-ID: <BF8722F4-167C-48A7-BD00-53C729BECA4D(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Dec 20, 2016, at 7:32 PM, firing neurons <firingneurons(a)mail.com> wrote: > Why is their an overflow in the first case? I am using radius3 Because Tmp-Integer is a 32-bit integer. > The same query is used by the relevant sqlcounter module and it works > as expected and doesn't overflow. > > I am trying to send CoA disconnect to the NAS after the user exhuasts > their data with sql and unlang logic in accounting section. > > I also tried simply using the reply attribute Mikrotik-Total-Limit but > the the NAS also expected Mikrotik-Total-Limit-Gigawords. > > The sqlcounter I made simply sent overflown value in > Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be > enforced. Use a 64-bit attribute. e.g. Tmp-Integer64 > Any way I can send the extra reply attribute from the sqlcounter? You will need to manually split Tmp-Integer64 into two different 32-bit attributes. Alan DeKok. ------------------------------

2 1

Binding MAC address with username
by Alexandre Croteau 21 Dec '16

21 Dec '16

Hello, For my setup, I'd like to bind a MAC address to a specific user when it first login. For exemple, user 1 connects from computer 00:11:22:33:44:55. I'd like the system to remember this MAC address, so that the next time the user reuses this same computer, it does not asks to connect again. This way, the users would rather be the mac addresses. Another solution I think would be to store the MAC address as a new user in the same group as user 1. Which way would be the best? Thanks, Acrilex

3 5

FreeRADIUS 3.0.12: SQL xlat return back-quoted value in response
by Alexey Dotsenko 21 Dec '16

21 Dec '16

Hello! Test environment: Centos 7 (x86_64), FreeRADIUS 3.0.12 - rpm build from upstream source 3.0.12 (based on fedoraproject spec file (without code patches)). MariaDB [radius]> select * from radgroupreply; +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ | 3 | ras | cisco-avpair | += | ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224 | | 12 | ras | cisco-avpair | += | ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224 | | 14 | ras | Fall-Through | := | Yes | | 29 | ras | Cisco-AVPair | += | `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` | +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ 4 rows in set (0.00 sec) Back-quoted string (id 29 in radgroupreply) exlat-ed properly, but remains (in response) back-quoted (and as a result, rejected by nas): Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Group "ras": Merging reply items Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Fall-Through := Yes Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "`ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l`" Tue Dec 20 11:37:46 2016 : Debug: `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` Tue Dec 20 11:37:46 2016 : Debug: Parsed xlat tree: Tue Dec 20 11:37:46 2016 : Debug: literal --> `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP- Tue Dec 20 11:37:46 2016 : Debug: if { Tue Dec 20 11:37:46 2016 : Debug: attribute --> SQL-Group Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: else { Tue Dec 20 11:37:46 2016 : Debug: if { Tue Dec 20 11:37:46 2016 : Debug: attribute --> User-Name Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: else { Tue Dec 20 11:37:46 2016 : Debug: literal --> None Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: literal --> - Tue Dec 20 11:37:46 2016 : Debug: percent --> l Tue Dec 20 11:37:46 2016 : Debug: literal --> ` Tue Dec 20 11:37:46 2016 : Debug: (1) sql: EXPAND `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` Tue Dec 20 11:37:46 2016 : Debug: (1) sql: --> `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482223066` ... Tue Dec 20 11:37:47 2016 : Debug: (1) Sent Access-Accept Id 191 from 172.18.200.21:1812 to 172.18.200.2:48332 length 0 Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "`ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482223066`" Tue Dec 20 11:37:47 2016 : Debug: (1) Reply-Message = "privacyIDEA access granted" Tue Dec 20 11:37:47 2016 : Debug: (1) Finished request I looked at the source code of the module rlm_sql (sql.c, function sql_fr_pair_list_afrom_str) - back-quoted string marked for xlat and remains in quotes. I tried to change this behavior - take the value for xlat without quotes: diff -ru freeradius-server-3.0.12.orig/src/modules/rlm_sql/sql.c freeradius-server-3.0.12/src/modules/rlm_sql/sql.c --- freeradius-server-3.0.12.orig/src/modules/rlm_sql/sql.c 2016-09-29 18:19:48.000000000 +0300 +++ freeradius-server-3.0.12/src/modules/rlm_sql/sql.c 2016-12-20 11:44:37.001299860 +0300 @@ -168,16 +168,13 @@ break; /* - * Mark the pair to be allocated later. + * Take the unquoted string and mark the pair to be allocated later. */ case T_BACK_QUOTED_STRING: do_xlat = 1; - /* FALL-THROUGH */ - - /* - * Keep the original string. - */ + value = buf; + break; default: value = row[3]; break; in this case, xlat-ed string return unquoted: Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Group "ras": Merging reply items Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Fall-Through := Yes Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l" Tue Dec 20 11:59:27 2016 : Debug: ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l Tue Dec 20 11:59:27 2016 : Debug: Parsed xlat tree: Tue Dec 20 11:59:27 2016 : Debug: literal --> ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP- Tue Dec 20 11:59:27 2016 : Debug: if { Tue Dec 20 11:59:27 2016 : Debug: attribute --> SQL-Group Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: else { Tue Dec 20 11:59:27 2016 : Debug: if { Tue Dec 20 11:59:27 2016 : Debug: attribute --> User-Name Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: else { Tue Dec 20 11:59:27 2016 : Debug: literal --> None Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: literal --> - Tue Dec 20 11:59:27 2016 : Debug: percent --> l Tue Dec 20 11:59:27 2016 : Debug: (1) sql: EXPAND ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l Tue Dec 20 11:59:27 2016 : Debug: (1) sql: --> ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482224367 ... Tue Dec 20 11:59:28 2016 : Debug: (1) Sent Access-Accept Id 120 from 172.18.200.21:1812 to 172.18.200.2:57555 length 0 Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482224367" Tue Dec 20 11:59:28 2016 : Debug: (1) Reply-Message = "privacyIDEA access granted" Tue Dec 20 11:59:28 2016 : Debug: (1) Finished request Do I understand correctly that the removal of quotes should not do later - in the xlat code area? Best regards, Alex Dotsenko.

4 5

CoA -> REST
by adrian.p.smith＠bt.com 21 Dec '16

21 Dec '16

Please can someone say whether it's possible to receive a CoA and pass that into the REST module? I tried a simple configuration using 3.0.11 and got a startup error: /home/adrian/freeradius-server-3.0.11/etc/raddb/sites-enabled/coa[38]: "rest" modules aren't allowed in 'recv-coa' sections -- they have no such method. /home/adrian/freeradius-server-3.0.11/etc/raddb/sites-enabled/coa[23]: Errors parsing recv-coa section. We use the REST module quite extensively for auth and acct requests and would like to do similar for coa. Thanks, Adrian Smith

4 19

Re: Freeradius-Users Digest, Vol 140, Issue 39
by firing neurons 21 Dec '16

21 Dec '16

It was because Tmp-Integer-0 was used insted of Tmp-String-0. Using Tmp-String-0 now and there is no overflow. Still wondering about how to send gigawords reply attribute from sqlcounter. Message: 7 Date: Wed, 21 Dec 2016 01:32:51 +0100 From: "firing neurons" <firingneurons(a)mail.com> To: freeradius-users(a)lists.freeradius.org Subject: attribute overflow from sql query in unlang Message-ID: <trinity-89ec53bc-81a7-4948-9c3c-bd47e9d99221-1482280371811@3capp-mailc om-lxa09> Content-Type: text/plain; charset="UTF-8" Hi, The debug logs are(emphasis added): (6) Executing select query: SELECT (SUM(acctoutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='test' AND Year(acctstarttime) = (Year(NOW())) rlm_sql (sql): Released connection (6) (6) EXPAND %{sql: SELECT (SUM(acc toutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='%{User-Name}' AND Year(acctstarttime) = (Year(NOW())) } (6) --> 241450422693 (6) Tmp-Integer-0 := 932254117 (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (7) (6) Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released connection (7) (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (6) Executing select query: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='4Mbps_YR_225GB' rlm_sql (sql): Released connection (4) (6) EXPAND %{sql: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='%{sql: SELECT groupname FROM radusergroup WHERE username = '%{User-Name}' ORDER BY priority}'} (6) --> 241591910400 (6) Tmp-String-1 := 241591910400 (6) } # update control = noop Why is their an overflow in the first case? I am using radius3 The same query is used by the relevant sqlcounter module and it works as expected and doesn't overflow. I am trying to send CoA disconnect to the NAS after the user exhuasts their data with sql and unlang logic in accounting section. I also tried simply using the reply attribute Mikrotik-Total-Limit but the the NAS also expected Mikrotik-Total-Limit-Gigawords. The sqlcounter I made simply sent overflown value in Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be enforced. Any way I can send the extra reply attribute from the sqlcounter? ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See [1]http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 140, Issue 39 ************************************************* References 1. http://www.freeradius.org/list/users.html

1 0

attribute overflow from sql query in unlang
by firing neurons 21 Dec '16

21 Dec '16

Hi, The debug logs are(emphasis added): (6) Executing select query: SELECT (SUM(acctoutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='test' AND Year(acctstarttime) = (Year(NOW())) rlm_sql (sql): Released connection (6) (6) EXPAND %{sql: SELECT (SUM(acc toutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='%{User-Name}' AND Year(acctstarttime) = (Year(NOW())) } (6) --> 241450422693 (6) Tmp-Integer-0 := 932254117 (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (7) (6) Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released connection (7) (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (6) Executing select query: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='4Mbps_YR_225GB' rlm_sql (sql): Released connection (4) (6) EXPAND %{sql: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='%{sql: SELECT groupname FROM radusergroup WHERE username = '%{User-Name}' ORDER BY priority}'} (6) --> 241591910400 (6) Tmp-String-1 := 241591910400 (6) } # update control = noop Why is their an overflow in the first case? I am using radius3 The same query is used by the relevant sqlcounter module and it works as expected and doesn't overflow. I am trying to send CoA disconnect to the NAS after the user exhuasts their data with sql and unlang logic in accounting section. I also tried simply using the reply attribute Mikrotik-Total-Limit but the the NAS also expected Mikrotik-Total-Limit-Gigawords. The sqlcounter I made simply sent overflown value in Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be enforced. Any way I can send the extra reply attribute from the sqlcounter?

2 1

(no subject)
by Matteo Vocale 20 Dec '16

20 Dec '16

Inviato con AquaMail per Android http://www.aqua-mail.com

1 0

Anyone built FR 3.0.12 pon OS X 10.10 ?
by Alex Sharaz 20 Dec '16

20 Dec '16

What's the best way to install stuff such as the taloc library? A

3 4

Cross platform secure login on wpa2
by Henti Smith 20 Dec '16

20 Dec '16

Good day all. We currently have a wpapsk wifi managed by ubiquiti unif-fi. i'm in the process of trying to move this over to a WPA2-Enterprise setup using kerberos as authentication. I used Alans the guide on http://deployingradius.com/ to get PAP and EAP working with my current certs using a local user. Next I used the Edoroam freeradius for auth against kerberos guide on https://www.eduroam.us/node/90 to setup kerberos authentication. Now this is where things go south. With a test user in users, EAP is working fine. I can auth using ./rad_eap_test -H localhost -S testing123 -u kerberos-test -p secret -P 1812 -e PEAP -m WPA-EAP However if I remove the local user and add "DEFAULT Auth-Type = Kerberos" it stops working. When I then test without EAP, using radtest kerberos-test secret localhost 0 testing123 It's working. So I can get EAP working with local users, and kerberos without EAP. What am I missing or not getting about getting them to work together to allow users to log into the wireless with existing user/pass but encrypted ? Regards Henti -- --

7 18

Regarding RADIUS Authentication feature Implementation over TLS
by Javed 20 Dec '16

20 Dec '16

Hello All, I would like to let me know about my requirement first. We have a project running under RADIUS under UDP that means we have an existing architecture and APIs to support all the user authentication to RADIUS server via PAP and CHAP under UDP. We are running on top of FreeBSD OS. We have used PAM module to do and implement the same. Requirement: We need the same authentication to happen over a secure network where we need to implement RADIUS TCP/TLS .I need to change my client configuration and required code changes has to be done to adapt with RADIUS server which supports RADIUS over TLS. Queries: Is there anywhere I can find Client side program for FreeRadius which supports TLS? Is the existing PAM module any version supports RADIUS over TLS? If You have any suggestion for client configuration and file changes in order to adapt RADIUS over TLS,You may share. Your reply will be much appreciated. Thanks & Regards, Javed Akhtar Technical Lead <mailto:jaakhtar@cisco.com> jaakhtar(a)cisco.com Tel: Cisco Systems, Inc. India cisco.com Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please <http://www.cisco.com/web/about/doing_business/legal/cri/index.html> click here for Company Registration Information.

3 4