- Freeradius-Users - lists.freeradius.org

Proxy accounting packets
by Anuruddha Premalal 01 Nov '16

01 Nov '16

Hi All, I'm trying to proxy all the accounting packets to a different AAA. (Original packets doesn't have a realm) 1. I have added a new realm in proxy.conf realm vamps{ nostrip type = acct ipaddr = 34.161.1.41 port = 1813 secret = abc#16 } 2. Added followig at the top of sites-enabled/default accounting section update control { Proxy-To-Realm := vamps } However whe I sedn a accounting request to home AAA it discards proxying saying *rad_accounting: Cancelling proxy to realm vamps, as it is a LOCAL realm.* Am I doing something wrong with configurations. Appreciate your assistance on this. Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

2 2

Installing python librarries for use within rlm_python
by Shabda Raaj 01 Nov '16

01 Nov '16

> Your python environment is broken. Most likely, your python home is in a non-standard location I don't think so. "which python" gives me /usr/bin/python on the shell. I think I have figured out the problem, and I think it is a bug in the rlm_python code. I put a "import sys; print sys.path" in my python file. This gives me a ['/usr/local/etc/raddb/mods-config/python'] Which is wrong, because it should have also contained the default path: ['', '/usr/lib/python2.7', '/usr/lib/python2.7/plat-x86_64-linux-gnu', '/usr/lib/python2.7/lib-tk', '/usr/lib/python2.7/lib-old', '/usr/lib/python2.7/lib-dynload', '/home/ubuntu/.local/lib/python2.7/site-packages', '/usr/local/lib/python2.7/dist-packages', '/usr/lib/python2.7/dist-packages'] This behaviour is being caused by PySys_SetPath(path); https://github.com/FreeRADIUS/freeradius-server/blob/ce92146386b30bd7f9f576… Which sets the pythonpath to that hardcoded path, rather than appending to it. I think the correct code would be along these lines char *path, *newpath; path=Py_GetPath(); newpath=new char[strlen(path)+4]; strcpy(newpath, path); strcat(newpath, ":."); // ":." for unix, or ";." for windows PySys_SetPath(newpath); free(newpath); >From http://markmail.org/message/qwex6rhhqd43jg2o Which gets the old path from Py_GetPath, and then appends to it.

1 0

Juniper-Local-User-Name reply attribute
by Dave Aldwinckle 31 Oct '16

31 Oct '16

Hi List, I have the following unlang, which works: if (&myAttribute == "srx") { update reply { Cisco-AVPair := "limited" Service-Type := Login-User } } The reply attributes are sent in the Access-Accept as expected: (234) Thu Oct 27 14:56:56 2016: Debug: Sent Access-Accept Id 241 from IP1 to IP2 length 0 (234) Thu Oct 27 14:56:56 2016: Debug: Cisco-AVPair = "limited" (234) Thu Oct 27 14:56:56 2016: Debug: Service-Type = Login-User If I change the unlang to the following, the Juniper-Local-User-Name does not appear in the Access-Accept. The rest of the debug output for entering the if statement looks identical. if (&myAttribute == "srx") { update reply { Juniper-Local-User-Name := "limited" Service-Type := Login-User } } I have confirmed that the proper dictionary exists on the server: # grep Juniper-Local-User-Name /usr/share/freeradius/dictionary.juniper ATTRIBUTE Juniper-Local-User-Name 1 string # radiusd -v radiusd: FreeRADIUS Version 3.0.10, for host x86_64-redhat-linux-gnu, built on Oct 5 2015 at 16:30:01 Any ideas? Unfortunately, I can't trick my Juniper SRX device into accepting Cisco-AVPair attributes. Thanks, Dave

4 3

Installing python librarries for use within rlm_python
by Shabda Raaj 31 Oct '16

31 Oct '16

I have radius 3.0.13 installed and working with rlm_python. I am able to send a RLM_MODULE_OK from within the authorize function. In my sites-enabled I have python { module = example python_path = ${modconfdir}/${.:name} mod_authorize = ${.module} func_authorize = authorize } I have installed sqlalchemy, a Python library and it is correctly installed; as I can see from $ python -c "import sqlalchemy; print sqlalchemy.__version__" 1.1.3 However when I try using it inside of my file being called from rlm_python, I am getting Python version: 2.7.12 (default, Jul 1 2016, 15:12:24) [GCC 5.4.0 20160609] System exec is python_function_load - Module 'example' not found <type 'exceptions.ImportError'> (No module named sqlalchemy) python_function_load - Failed to import python function 'example.authorize' /usr/local/etc/raddb/mods-enabled/python[1]: Instantiation failed for module "python" Is the python binary being used by rlm_python different from the system binary? My radiusd version is radiusd: FreeRADIUS Version 3.0.13 (git #7758e73),

3 2

manage RADIUS clients in LDAP directory
by Michael Ströder 31 Oct '16

31 Oct '16

HI! Is there a how-to document which describes managing RADIUS clients with their shared secrets in LDAP directory? Something like this should just work? ldap { server = 'ldapi://' identity = 'uid=radiusd,ou=ae-dir' password = secret base_dn = 'ou=ae-dir' [..] client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' scope = 'sub' template { require_message_authenticator = yes } attribute { ipaddr = 'aeRemoteHost' secret = 'radiusClientSecret' shortname = 'uid' } } } Ciao, Michael.

3 2

Wiki build instructions
by Arran Cudbard-Bell 28 Oct '16

28 Oct '16

I've cleaned up the wiki pages for build/package instructions. If anyone would like to contribute, we're currently missing: - Instructions for building RHEL/Centos packages (http://wiki.freeradius.org/building/RHEL-and-Centos) - Instructions for installing GCC 4.9 on OpenSuse (http://wiki.freeradius.org/building/Suse%20and%20OpenSuse) - Instructions for satisfying dependencies on OpenSuse (http://wiki.freeradius.org/building/Suse%20and%20OpenSuse) - Complete instructions for building packages on OpenSuse (http://wiki.freeradius.org/building/Suse%20and%20OpenSuse) Please use http://wiki.freeradius.org/building/Debian%20and%20Ubuntu as a template. It'd also be good to check that the instructions actually worked :) -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

4 5

How to Restrict a Group of Users to a certain NAS or groups of NAS?
by Jose Quezada 28 Oct '16

28 Oct '16

Hello, Im new on this of FreeRADIUS but while I was reading and getting more knowledge about... I got a question, How to Restrict a User or Group of Users to a certain NAS or groups of NAS? Sorry for my misspellings.... Thanks at all!

3 2

Radtest doesn't work with a clean install of Freeradius 4.0.0
by Shabda Raaj 28 Oct '16

28 Oct '16

I have a clean install of freeradius (FreeRADIUS version 4.0.0 (git #d9a670c)). I haven't changed any configuration files, the installation was done by a git checkout and then building it on Ubuntu. I am trying radtest as described here: https://github.com/FreeRADIUS/freeradius-server/blob/ce92146386b30bd7f9f576… radtest test test localhost 0 testing123 This gives me a radclient:: Unknown attribute "User-Name" requires a hex string, not "test" I tried a radtest 0x123 test localhost 0 testing123 Which gives me a Unknown vendor name in attribute name "User-Name"

3 2

Re: ldap shared object
by John Kristoff 28 Oct '16

28 Oct '16

On Fri, 28 Oct 2016 02:29:08 +0000 Daniel Wruck <daniel.wruck(a)fbchammond.com> wrote: > Having a hard time setting up my new freeRADIUS 3.0.12 on Ubuntu 16.04. I am trying to turn on ldap; I altered the file in sites-available, and hand created a symlink to it from sites-enabled. But now I am getting an error in radiusd -X of Did you install the openldap-devel package? If not, install that then rebuild FreeRADIUS again. John

1 0

Refer to load-balance block in SQL query
by Krzysztof Grobelak 27 Oct '16

27 Oct '16

Hello List, Apologies if I missed that in documentation. Can something like the below be done in freeRadius: redundant-load-balance rlb { sql1 sql2 } %{rlb:SELECT …'} and also how to tell sqlippool module to use the load balanced sql definition. sqlippool { sql_module_instance = “rlb” } If not then how to execute a SQL query agains an sql instance that may be offline? Regards, Krzysztof

2 2