- Freeradius-Users - lists.freeradius.org

VLAN Assignment with RADIUS
by Valentin Heidelberger 24 Dec '16

24 Dec '16

Hey everyone, I am trying to do the following with RADIUS There is 1 AP with 2 SSIDs - lets cal them "B" and "P" I want RADIUS to assign VLAN20 to "P" and VLAN40 to "B" I have found no other method online than configuring static users in the users file with VLANs assigned to them. In my setup users are authenticated with LDAP. Do I really have to assign every single user the VLAN or is there a simpler way like assigning the VLAN to a virtual server running on a different port or something focussed on the SSIDs? Kind regards

4 6

Simultaneous-Use + MySQL + Ubuntu 16.04 Srv + Mikrotik RB + Unifi AP
by Cadu Garcia 22 Dec '16

22 Dec '16

Hello! I read a lot of docs on Internet and tried examples but I still having problems. I can't use Simultaneous-Use attribute with MySQL. Neither with groups option. My platform is on Ubuntu 16.04 Server and I'm using Mikrotik RB750 to provide DHCP and my AP is Ubiquiti Unifi UAP-LR. Everything seems works fine like Authentication on MySQL DB and Post-auth data. But radacct DB is empty. Can you help me? Best regards.

2 1

Problem with exec shell_escape option
by Brian Candler 22 Dec '16

22 Dec '16

I'm trying to get exec to pass a string as an argument without any shell quoting, but not succeeding. This is with freeradius 3.0.12 under Ubuntu 16.04. [Aside: what I'm actually trying to do is invoke an external change password program using an exec expansion in local_cpw in rlm_mschap, following the example given: # local_cpw = "%{exec:/path/to/script %{mschap:User-Name} %{MS-CHAP-New-Cleartext-Password}}" But I'm finding that passwords with special characters are being mangled] I can reproduce this using exec by itself. Here are 4 combinations: shell_escape = {yes,no} and expansion argument quoted/not quoted. # mods-available/exec - I left the original exec in there and added: exec exec1 { wait = yes input_pairs = request shell_escape = no timeout = 10 } exec exec2 { wait = yes input_pairs = request shell_escape = yes timeout = 10 } # policy.d/testpolicy testpolicy { update request { &Tmp-String-0 := " foo ' bar \" baz \\ qux " &Tmp-String-1 := "%{exec1:/usr/local/bin/showarg %{Tmp-String-0}}" &Tmp-String-2 := "%{exec1:/usr/local/bin/showarg '%{Tmp-String-0}'}" &Tmp-String-3 := "%{exec2:/usr/local/bin/showarg %{Tmp-String-0}}" &Tmp-String-4 := "%{exec2:/usr/local/bin/showarg '%{Tmp-String-0}'}" } } # /usr/local/bin/showarg #!/bin/sh echo "Arg is <$1>" >>/tmp/exec.log Results: - 1 and 3 fail with "rad_expand_xlat: Invalid string passed as argument" - 2 and 4 both apply shell quoting to the argument # cat /tmp/exec.log Arg is <\ foo\ \'\ bar\ "\ baz\ \ qux\ > Arg is <\ foo\ \'\ bar\ "\ baz\ \ qux\ > Debug output: (0) policy testpolicy { (0) update request { (0) &Tmp-String-0 := " foo ' bar \" baz \\ qux " (0) Executing: /usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ : rad_expand_xlat: Invalid string passed as argument invalid command line '/usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ '. (0) EXPAND %{exec1:/usr/local/bin/showarg %{Tmp-String-0}} (0) --> (0) &Tmp-String-1 := (0) Executing: /usr/local/bin/showarg '\ foo\ \'\ bar\ "\ baz\ \\ qux\ ': (0) Program returned code (0) and output '' (0) EXPAND %{exec1:/usr/local/bin/showarg '%{Tmp-String-0}'} (0) --> (0) &Tmp-String-2 := (0) Executing: /usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ : rad_expand_xlat: Invalid string passed as argument invalid command line '/usr/local/bin/showarg \ foo\ \'\ bar\ "\ baz\ \\ qux\ '. (0) EXPAND %{exec2:/usr/local/bin/showarg %{Tmp-String-0}} (0) --> (0) &Tmp-String-3 := (0) Executing: /usr/local/bin/showarg '\ foo\ \'\ bar\ "\ baz\ \\ qux\ ': (0) Program returned code (0) and output '' (0) EXPAND %{exec2:/usr/local/bin/showarg '%{Tmp-String-0}'} (0) --> (0) &Tmp-String-4 := (0) } # update request = noop (0) } # policy testpolicy = noop So it looks like the shell_escape setting isn't doing anything. What am I missing? Thanks, Brian. P.S. There is something else confusing. In raddb/mods-available/exec it says: # Execute external programs # # This module is useful only for 'xlat'. To use it, # put 'exec' into the 'instantiate' section. You can then # do dynamic translation of attributes like: # # Attribute-Name = `%{exec:/path/to/program args}` However, I can see from the source that it has hooks for the various module lifecycle stages; indeed, the sites-available/default config invokes it in the accounting and post-auth stages: # For Exec-Program and Exec-Program-Wait exec So is the comment that exec is "useful only for 'xlat'" incorrect? I've checked the obvious places for documentation with no luck: - http://wiki.freeradius.org/search?q=exec - man rlm_exec (not found) But in any case, it doesn't affect the main issue here, since local_cpw has to use a string expansion anyway.

2 2

Re: Freeradius-Users Digest, Vol 140, Issue 40
by firing neurons 21 Dec '16

21 Dec '16

I used a Tmp-String-x and that also fixed it. About spliting the Tmp-Integer64 for sqlcounter reply name, where would I split this? Can I just put two reply attributes in sqlcounter? May be do the math there? or updating the reply list with the two attributes, calculating their value using expr in unlang is the only way? Message: 1 Date: Tue, 20 Dec 2016 20:32:54 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: attribute overflow from sql query in unlang Message-ID: <BF8722F4-167C-48A7-BD00-53C729BECA4D(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Dec 20, 2016, at 7:32 PM, firing neurons <firingneurons(a)mail.com> wrote: > Why is their an overflow in the first case? I am using radius3 Because Tmp-Integer is a 32-bit integer. > The same query is used by the relevant sqlcounter module and it works > as expected and doesn't overflow. > > I am trying to send CoA disconnect to the NAS after the user exhuasts > their data with sql and unlang logic in accounting section. > > I also tried simply using the reply attribute Mikrotik-Total-Limit but > the the NAS also expected Mikrotik-Total-Limit-Gigawords. > > The sqlcounter I made simply sent overflown value in > Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be > enforced. Use a 64-bit attribute. e.g. Tmp-Integer64 > Any way I can send the extra reply attribute from the sqlcounter? You will need to manually split Tmp-Integer64 into two different 32-bit attributes. Alan DeKok. ------------------------------

2 1

Binding MAC address with username
by Alexandre Croteau 21 Dec '16

21 Dec '16

Hello, For my setup, I'd like to bind a MAC address to a specific user when it first login. For exemple, user 1 connects from computer 00:11:22:33:44:55. I'd like the system to remember this MAC address, so that the next time the user reuses this same computer, it does not asks to connect again. This way, the users would rather be the mac addresses. Another solution I think would be to store the MAC address as a new user in the same group as user 1. Which way would be the best? Thanks, Acrilex

3 5

FreeRADIUS 3.0.12: SQL xlat return back-quoted value in response
by Alexey Dotsenko 21 Dec '16

21 Dec '16

Hello! Test environment: Centos 7 (x86_64), FreeRADIUS 3.0.12 - rpm build from upstream source 3.0.12 (based on fedoraproject spec file (without code patches)). MariaDB [radius]> select * from radgroupreply; +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ | id | groupname | attribute | op | value | +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ | 3 | ras | cisco-avpair | += | ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224 | | 12 | ras | cisco-avpair | += | ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224 | | 14 | ras | Fall-Through | := | Yes | | 29 | ras | Cisco-AVPair | += | `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` | +----+-----------+--------------+----+-------------------------------------------------------------------------------------+ 4 rows in set (0.00 sec) Back-quoted string (id 29 in radgroupreply) exlat-ed properly, but remains (in response) back-quoted (and as a result, rejected by nas): Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Group "ras": Merging reply items Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Fall-Through := Yes Tue Dec 20 11:37:46 2016 : Debug: (1) sql: Cisco-AVPair += "`ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l`" Tue Dec 20 11:37:46 2016 : Debug: `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` Tue Dec 20 11:37:46 2016 : Debug: Parsed xlat tree: Tue Dec 20 11:37:46 2016 : Debug: literal --> `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP- Tue Dec 20 11:37:46 2016 : Debug: if { Tue Dec 20 11:37:46 2016 : Debug: attribute --> SQL-Group Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: else { Tue Dec 20 11:37:46 2016 : Debug: if { Tue Dec 20 11:37:46 2016 : Debug: attribute --> User-Name Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: else { Tue Dec 20 11:37:46 2016 : Debug: literal --> None Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: } Tue Dec 20 11:37:46 2016 : Debug: literal --> - Tue Dec 20 11:37:46 2016 : Debug: percent --> l Tue Dec 20 11:37:46 2016 : Debug: literal --> ` Tue Dec 20 11:37:46 2016 : Debug: (1) sql: EXPAND `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l` Tue Dec 20 11:37:46 2016 : Debug: (1) sql: --> `ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482223066` ... Tue Dec 20 11:37:47 2016 : Debug: (1) Sent Access-Accept Id 191 from 172.18.200.21:1812 to 172.18.200.2:48332 length 0 Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:37:47 2016 : Debug: (1) Cisco-AVPair += "`ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482223066`" Tue Dec 20 11:37:47 2016 : Debug: (1) Reply-Message = "privacyIDEA access granted" Tue Dec 20 11:37:47 2016 : Debug: (1) Finished request I looked at the source code of the module rlm_sql (sql.c, function sql_fr_pair_list_afrom_str) - back-quoted string marked for xlat and remains in quotes. I tried to change this behavior - take the value for xlat without quotes: diff -ru freeradius-server-3.0.12.orig/src/modules/rlm_sql/sql.c freeradius-server-3.0.12/src/modules/rlm_sql/sql.c --- freeradius-server-3.0.12.orig/src/modules/rlm_sql/sql.c 2016-09-29 18:19:48.000000000 +0300 +++ freeradius-server-3.0.12/src/modules/rlm_sql/sql.c 2016-12-20 11:44:37.001299860 +0300 @@ -168,16 +168,13 @@ break; /* - * Mark the pair to be allocated later. + * Take the unquoted string and mark the pair to be allocated later. */ case T_BACK_QUOTED_STRING: do_xlat = 1; - /* FALL-THROUGH */ - - /* - * Keep the original string. - */ + value = buf; + break; default: value = row[3]; break; in this case, xlat-ed string return unquoted: Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Group "ras": Merging reply items Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Fall-Through := Yes Tue Dec 20 11:59:27 2016 : Debug: (1) sql: Cisco-AVPair += "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l" Tue Dec 20 11:59:27 2016 : Debug: ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l Tue Dec 20 11:59:27 2016 : Debug: Parsed xlat tree: Tue Dec 20 11:59:27 2016 : Debug: literal --> ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP- Tue Dec 20 11:59:27 2016 : Debug: if { Tue Dec 20 11:59:27 2016 : Debug: attribute --> SQL-Group Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: else { Tue Dec 20 11:59:27 2016 : Debug: if { Tue Dec 20 11:59:27 2016 : Debug: attribute --> User-Name Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: else { Tue Dec 20 11:59:27 2016 : Debug: literal --> None Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: } Tue Dec 20 11:59:27 2016 : Debug: literal --> - Tue Dec 20 11:59:27 2016 : Debug: percent --> l Tue Dec 20 11:59:27 2016 : Debug: (1) sql: EXPAND ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-%{%{SQL-Group}:-%{%{User-Name}:-None}}-%l Tue Dec 20 11:59:27 2016 : Debug: (1) sql: --> ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482224367 ... Tue Dec 20 11:59:28 2016 : Debug: (1) Sent Access-Accept Id 120 from 172.18.200.21:1812 to 172.18.200.2:57555 length 0 Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#1=permit ip any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ip:inacl#2=permit tcp any 10.0.253.224 255.255.255.224" Tue Dec 20 11:59:28 2016 : Debug: (1) Cisco-AVPair += "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ras-1482224367" Tue Dec 20 11:59:28 2016 : Debug: (1) Reply-Message = "privacyIDEA access granted" Tue Dec 20 11:59:28 2016 : Debug: (1) Finished request Do I understand correctly that the removal of quotes should not do later - in the xlat code area? Best regards, Alex Dotsenko.

4 5

CoA -> REST
by adrian.p.smith＠bt.com 21 Dec '16

21 Dec '16

Please can someone say whether it's possible to receive a CoA and pass that into the REST module? I tried a simple configuration using 3.0.11 and got a startup error: /home/adrian/freeradius-server-3.0.11/etc/raddb/sites-enabled/coa[38]: "rest" modules aren't allowed in 'recv-coa' sections -- they have no such method. /home/adrian/freeradius-server-3.0.11/etc/raddb/sites-enabled/coa[23]: Errors parsing recv-coa section. We use the REST module quite extensively for auth and acct requests and would like to do similar for coa. Thanks, Adrian Smith

4 19

Re: Freeradius-Users Digest, Vol 140, Issue 39
by firing neurons 21 Dec '16

21 Dec '16

It was because Tmp-Integer-0 was used insted of Tmp-String-0. Using Tmp-String-0 now and there is no overflow. Still wondering about how to send gigawords reply attribute from sqlcounter. Message: 7 Date: Wed, 21 Dec 2016 01:32:51 +0100 From: "firing neurons" <firingneurons(a)mail.com> To: freeradius-users(a)lists.freeradius.org Subject: attribute overflow from sql query in unlang Message-ID: <trinity-89ec53bc-81a7-4948-9c3c-bd47e9d99221-1482280371811@3capp-mailc om-lxa09> Content-Type: text/plain; charset="UTF-8" Hi, The debug logs are(emphasis added): (6) Executing select query: SELECT (SUM(acctoutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='test' AND Year(acctstarttime) = (Year(NOW())) rlm_sql (sql): Released connection (6) (6) EXPAND %{sql: SELECT (SUM(acc toutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='%{User-Name}' AND Year(acctstarttime) = (Year(NOW())) } (6) --> 241450422693 (6) Tmp-Integer-0 := 932254117 (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (7) (6) Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released connection (7) (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (6) Executing select query: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='4Mbps_YR_225GB' rlm_sql (sql): Released connection (4) (6) EXPAND %{sql: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='%{sql: SELECT groupname FROM radusergroup WHERE username = '%{User-Name}' ORDER BY priority}'} (6) --> 241591910400 (6) Tmp-String-1 := 241591910400 (6) } # update control = noop Why is their an overflow in the first case? I am using radius3 The same query is used by the relevant sqlcounter module and it works as expected and doesn't overflow. I am trying to send CoA disconnect to the NAS after the user exhuasts their data with sql and unlang logic in accounting section. I also tried simply using the reply attribute Mikrotik-Total-Limit but the the NAS also expected Mikrotik-Total-Limit-Gigawords. The sqlcounter I made simply sent overflown value in Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be enforced. Any way I can send the extra reply attribute from the sqlcounter? ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See [1]http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 140, Issue 39 ************************************************* References 1. http://www.freeradius.org/list/users.html

1 0

attribute overflow from sql query in unlang
by firing neurons 21 Dec '16

21 Dec '16

Hi, The debug logs are(emphasis added): (6) Executing select query: SELECT (SUM(acctoutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='test' AND Year(acctstarttime) = (Year(NOW())) rlm_sql (sql): Released connection (6) (6) EXPAND %{sql: SELECT (SUM(acc toutputoctets+acctinputoctets)) AS total FROM radacct WHERE radacct.username='%{User-Name}' AND Year(acctstarttime) = (Year(NOW())) } (6) --> 241450422693 (6) Tmp-Integer-0 := 932254117 (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (7) (6) Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released connection (7) (6) EXPAND %{User-Name} (6) --> test (6) SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (6) Executing select query: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='4Mbps_YR_225GB' rlm_sql (sql): Released connection (4) (6) EXPAND %{sql: SELECT value FROM radgroupcheck WHERE attribute='Yearly-Bytes-Limit' AND grou pname='%{sql: SELECT groupname FROM radusergroup WHERE username = '%{User-Name}' ORDER BY priority}'} (6) --> 241591910400 (6) Tmp-String-1 := 241591910400 (6) } # update control = noop Why is their an overflow in the first case? I am using radius3 The same query is used by the relevant sqlcounter module and it works as expected and doesn't overflow. I am trying to send CoA disconnect to the NAS after the user exhuasts their data with sql and unlang logic in accounting section. I also tried simply using the reply attribute Mikrotik-Total-Limit but the the NAS also expected Mikrotik-Total-Limit-Gigawords. The sqlcounter I made simply sent overflown value in Mikrotik-Total-Limit and hence lmit of more than 4Gb couldn't be enforced. Any way I can send the extra reply attribute from the sqlcounter?

2 1

(no subject)
by Matteo Vocale 20 Dec '16

20 Dec '16

Inviato con AquaMail per Android http://www.aqua-mail.com

1 0