- Freeradius-Users - lists.freeradius.org

Unlang statement
by Clement Ogedengbe 27 May '16

27 May '16

Can someone please help me with unlang statement that rejects users (without bothering to carry out authentication) if the User-Name ends with "XYZ" Clement

3 2

Use python module to inject parameters to radius context
by Anuruddha Premalal 27 May '16

27 May '16

Hi All, I'm trying to urlencode a string and put that value in a vendor specific attribute via python; and later refer that in site configuration. Here's a snippet of the site configuration authenticate section authenticate { Auth-Type PAP { python_custom update reply { User-Name = "%{User-Name}" My-Redirection-URL = "%{*My-URL-Param*}" My-ACL-Policy = "default_unauth_sla" My-QoS-Policy = "32M_Full" Calling-Station-Id = "%{Calling-Station-Id}" } } } digest eap } Here's the python code snippet in python_custom module def authenticate(p): username = '' clientmac = '' apmac ='' ssid = 'Benu_Test' for authdata in p: if authdata[0] == 'User-Name': username = authdata[1] if authdata[0] == 'Calling-Station-Id': clientmac = authdata[1] if authdata[0] == 'Called-Station-Id': apmac = authdata[1] # how can I inject this VSA to radius context so that it can referenced in the site configuration? My-URL-Param = "http://my.org" + urllib.quote('?clientmac=' + clientmac + '&apmac=' + apmac + '&ssid=' + ssid ) return radiusd.RLM_MODULE_OK Appreciate your help in finding a solution for this. Thanks & Regards, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>Sri Lanka.*

2 3

Catching errors in SQL xlat queries
by Pshem Kowalczyk 27 May '16

27 May '16

Hi, We have a setup where a main frontend cluster (3.0.11) proxies requests to various remote radius servers. We validate and adjust responses from those serves to match the requirements of a particular BNGs the session is on (this is for a DSL/fibre setup). For example if the remote radius system wants the speed of the connection limited to a given number they reply with our own 'SV-Speed-Down' attribute and a value. We do some SQL lookups: update { &control:Tmp-String-0 := "%{frontend_sql:SELECT prefix || '#' || suffix FROM attrib_map, nas_type \ WHERE nas_type.nasid='%{request:NAS-Identifier}' AND \ attrib_map.nas_type = nas_type.type AND \ attrib_map.attribute = 'SV-Speed-Down'}" } in order to figure out the actual syntax required for the particular BNG. Then we use a regex to parse out the details: if (&control:Tmp-String-0 =~ /([a-z-]+)#[a-0-9]+)/) { Recently we had some issues with the DB running out of steam (and handles). We've noticed that this didn't stop the queries from running and returning empty results (and not matching the regex). With the regular rlm_sql queries the module returns 'fail' if there was a problem with the database or 'notfound' if there was nothing to return. Is there a way to detect the 'fail' state with the xlat queries? kind regards Pshem

5 6

FreeRADIUS not sending "Access-Accept" for Cisco Phone
by craig＠mypenguin.net.au 27 May '16

27 May '16

Hi, 802.1x Authentication with EAP-TLS, works perfectly with a Centos client, however not from a Cisco IP Phone. Basic Specs For Server; * Centos 7.2 x64 * freeradius-3.0.4-6.el7.x86_64 * Communicating through a Dell N3000 switch. * Cisco 7841 IP Phone I've been studying the debug logs as best I can, the working log clearly shows "Sending Access Accept Packet" (output below). However when I read the debug for the Cisco phone connection, we see hundreds (would eventually be thousands) of attempts without ever seeing the below successful packet sent back. I'm just after any suggestions on how to better debug the connection from the Cisco phone? ---------- CUT (working example with Centos Client) --------------- Sending Access-Accept packet to host 192.168.11.62 port 34495, id=119, length=0 (6) MS-MPPE-Recv-Key = 0x069dfe1c5f6660fe98f7d39c311e1c52bea7445e54d05f2706c154542ed5b3fa (6) MS-MPPE-Send-Key = 0x54782fc7b655096c1a45437c1cae96d4217867c8403c0f1edd3a8438330aad81 (6) EAP-MSK = 0x069dfe1c5f6660fe98f7d39c311e1c52bea7445e54d05f2706c154542ed5b3fa 54782fc7b655096c1a45437c1cae96d4217867c8403c0f1edd3a8438330aad81 (6) EAP-EMSK = 0xcfa717399d049b7ca5f438a07c6bffc0e199bd24182a903fd759c84eb13765feda5bfd396f403068ef377c20c0ea46c2628917fd644afd54556a00b79652fa3a (6) EAP-Session-Id = 0x0d57469718eb7768f033c8f06c17b709ca49254502c930e10641848a9551823e395746989ca0c8126d5fe044a497974be973775d2f5f3b401cc023e449ef983787 (6) EAP-Message = 0x03160004 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) User-Name = 'craig' Sending Access-Accept Id 119 from 192.168.11.61:1812 to 192.168.11.62:34495 MS-MPPE-Recv-Key = 0x069dfe1c5f6660fe98f7d39c311e1c52bea7445e54d05f2706c154542ed5b3fa MS-MPPE-Send-Key = 0x54782fc7b655096c1a45437c1cae96d4217867c8403c0f1edd3a8438330aad81 EAP-Message = 0x03160004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'craig' (6) Finished request ---------- CUT ------------------------------------------ Regards, Craig

2 5

FreeRadius , can't load /import python external library
by Edouard Etancelin 26 May '16

26 May '16

Hi Freeradius 3.0.11 Ubuntu 15:10 I am a freeradius newbie and i tring to import an external library into (PyJWT) for a freeradius authorization, but when i run freeradius -X i get this error message. # Instantiating module "python" from file /etc/freeradius/mods-enabled/python mod_init done rlm_python:mod_load_function: module 'example' is not found rlm_python:EXCEPT:<type 'exceptions.ImportError'>: No module named jwt rlm_python:mod_load_function: failed to import python function 'example.authorize' /etc/freeradius/mods-enabled/python[10]: Instantiation failed for module "python" When i try to import the package from the terminal, everything is ok. Python 2.7.10 (default, Oct 14 2015, 16:09:02) [GCC 5.2.1 20151010] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import jwt >>> encoded = jwt.encode({'some': 'payload'}, 'secret', algorithm='HS256') >>> jwt.decode(encoded, 'secret', algorithms=['HS256']) {u'some': u'payload'} The python file is : #! /usr/bin/env python # ... import radiusd import jwt def instantiate(p): .... def authorize(p): print "*** authorize ***" but if instead i use : #! /usr/bin/env python # ... import radiusd #import jwt def instantiate(p): .... def authorize(p): print "*** authorize ***" ,freeradius start as espected . My dockerfile is : >From ubuntu:15.10 #1;5C radiussrvbase docker image configuration file # This docker configuration file use ubuntu 15:10 willy distrib and install freeradius server 3.x. RUN apt-get update \ && apt-get install -y software-properties-common \ && apt-get install -y python2.7-dev \ && apt-get install -y python-pip \ && pip install PyJWT \ && add-apt-repository ppa:freeradius/stable-3.0 \ && apt-get update \ && apt-get install -y freeradius-mysql \ && apt-get install -y freeradius=3.0.11-ppa2~wily WORKDIR /etc/freeradius #File import Should i declare external python library in freeradius ? Does i miss something ? Best regards

1 0

FreeRadius-Response-Delay
by Pshem Kowalczyk 26 May '16

26 May '16

Hi, I would like to delay access-accept responses to some requests (we have multiple ones coming simultaneously from 2 BNGs, due to the way access network is built). I found the FreeRADIUS-Response-Delay and FreeRADIUS-Response-Delay-USec attributes, but I'm clearly doing something wrong, as the accept is sent immediately: {...} Thu May 26 15:19:17 2016 : Debug: (0) update { Thu May 26 15:19:17 2016 : Debug: (0) &control:FreeRADIUS-Response-Delay := 5 Thu May 26 15:19:17 2016 : Debug: (0) &control:FreeRADIUS-Response-Delay-USec := 500000 Thu May 26 15:19:17 2016 : Debug: (0) &reply:FreeRADIUS-Response-Delay := 5 Thu May 26 15:19:17 2016 : Debug: (0) &reply:FreeRADIUS-Response-Delay-USec := 500000 Thu May 26 15:19:17 2016 : Debug: (0) } # update = noopThu May 26 15:13:54 2016 : Debug: (0) Sent Access-Accept Id 155 from 127.0.0.1:1812 to 127.0.0.1:51976 length 0 Thu May 26 15:19:17 2016 : Debug: (0) } # post-auth = ok Thu May 26 15:19:17 2016 : Debug: (0) Sent Access-Accept Id 0 from 127.0.0.1:1812 to 127.0.0.1:33099 length 0 Thu May 26 15:19:17 2016 : Debug: (0) Cisco-AVPair += "ip:qos-policy-out=add-class(sub,(class-default),police(3000),set-ip-dscp(0),set-cos-inner(0))" {..} (I've tried various combinations of the control/reply USec/Sec) Delay on Auth-Reject works as expected. googling didn't turn up any examples either. I'm running 3.0.11 - how are these attributes supposed to be used? Thx, kind regards Pshem

2 2

Freeradius DHCP rest module
by Fabrice Durand 25 May '16

25 May '16

Hello, i am currently trying to replace isc-dhcp with freeradius dhcp server on PacketFence. The dhcp work well, i am able to give ip address on layer 2 and layer 3 network. Now i want to add hooks in DHCP-Discover and DHCP-Request with rlm_rest but i am not sure if this module can do that since there only theses scopes: authorize authenticate accounting post-auth Is there a workaround or does this is not yet implemented ? Regards Fabrice -- Fabrice Durand fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org)

3 2

Re: User login restrictions based on SSID
by Eby Mani 25 May '16

25 May '16

Hi Alan De & Alan Buxey, There is some confusion going on here. I have already attached freeradius -X output (as text file) in my first mail itself, to which Alan De replied "If only there was some kind of debug log, where you could see what the server was doing". I assumed he already gone thru the attachment and want to see the radius.log. Thus i have posted contents of radius.log If you want me to send the freeradius -X output again, i'll post it here. I understand you guys are busy with other activities and I appreciate your involvement here on the mailing list. cheers, Eby -------------------------------------------- On Wed, 25/5/16, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> wrote: Subject: Re: User login restrictions based on SSID To: "Eby Mani" <eby_km(a)yahoo.com> Cc: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, 25 May, 2016, 2:51 PM Hi, > If the SQL can't connect, how authentication work as user details are stored in db?. I was able to login thru Radius and i have not enabled Radius caching of anysort on my WLAN controller. well, it cant. but if you read the output, you'll see it has connected this time. i guess your SQL wasnt running last time..... just read the output! > Following is today's radius.log, there isn't much info, is there a command to log more info regarding this ?. run in debug mode, not just as a service radiusd -X or freeradius -X on debian/ubuntu package builds. > Wed May 25 14:54:09 2016 : Auth: Login incorrect: [sales/<via Auth-Type = EAP>] (from client aruba port 0 via TLS tunnel) > Wed May 25 14:54:09 2016 : Auth: Login incorrect: [sales/<via Auth-Type = EAP>] (from client aruba port 0 cli 38192fb2eb02) in full debug mode you'd see why this failed. > Wed May 25 16:00:08 2016 : Auth: Login OK: [eby] (from client aruba port 0 via TLS tunnel) > Wed May 25 16:00:08 2016 : Auth: Login OK: [eby] (from client aruba port 0 cli e02a82e1afbf) and that worked alan

4 3

Re: User login restrictions based on SSID
by Eby Mani 25 May '16

25 May '16

Hi Alan, If the SQL can't connect, how authentication work as user details are stored in db?. I was able to login thru Radius and i have not enabled Radius caching of anysort on my WLAN controller. Anyway, i've stopped and started the services (mysql & freeradius) several times. Following is today's radius.log, there isn't much info, is there a command to log more info regarding this ?. Eby Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Attempting to connect to root@localhost:3306/radius Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Wed May 25 12:13:00 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Wed May 25 12:13:00 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Wed May 25 12:13:00 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Wed May 25 12:13:00 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Connected new DB handle, #3 Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Wed May 25 12:13:00 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed May 25 12:13:00 2016 : Info: rlm_sql (sql): Connected new DB handle, #4 Wed May 25 12:13:00 2016 : Info: Loaded virtual server <default> Wed May 25 12:13:00 2016 : Info: Loaded virtual server inner-tunnel Wed May 25 12:13:00 2016 : Info: ... adding new socket proxy address * port 34635 Wed May 25 12:13:00 2016 : Info: Ready to process requests. Wed May 25 12:13:51 2016 : Info: Signalled to terminate Wed May 25 12:13:51 2016 : Info: Exiting normally. Wed May 25 12:13:51 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Wed May 25 12:13:51 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Wed May 25 12:13:51 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Wed May 25 12:13:51 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Wed May 25 12:13:51 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Attempting to connect to root@localhost:3306/radius Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Wed May 25 12:30:53 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Wed May 25 12:30:53 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Wed May 25 12:30:53 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Wed May 25 12:30:53 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Connected new DB handle, #3 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Wed May 25 12:30:53 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed May 25 12:30:53 2016 : Info: rlm_sql (sql): Connected new DB handle, #4 Wed May 25 12:30:53 2016 : Info: Loaded virtual server <default> Wed May 25 12:30:53 2016 : Info: Loaded virtual server inner-tunnel Wed May 25 12:30:53 2016 : Info: ... adding new socket proxy address * port 45005 Wed May 25 12:30:53 2016 : Info: Ready to process requests. Wed May 25 12:32:18 2016 : Info: Signalled to terminate Wed May 25 12:32:18 2016 : Info: Exiting normally. Wed May 25 12:32:18 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Wed May 25 12:32:18 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Wed May 25 12:32:18 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Wed May 25 12:32:18 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Wed May 25 12:32:18 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Attempting to connect to root@localhost:3306/radius Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Wed May 25 12:41:28 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Wed May 25 12:41:28 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Wed May 25 12:41:28 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Wed May 25 12:41:28 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Connected new DB handle, #3 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Wed May 25 12:41:28 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed May 25 12:41:28 2016 : Info: rlm_sql (sql): Connected new DB handle, #4 Wed May 25 12:41:28 2016 : Info: Loaded virtual server <default> Wed May 25 12:41:28 2016 : Info: Loaded virtual server inner-tunnel Wed May 25 12:41:28 2016 : Info: ... adding new socket proxy address * port 34551 Wed May 25 12:41:28 2016 : Info: Ready to process requests. Wed May 25 14:54:09 2016 : Auth: Login incorrect: [sales/<via Auth-Type = EAP>] (from client aruba port 0 via TLS tunnel) Wed May 25 14:54:09 2016 : Auth: Login incorrect: [sales/<via Auth-Type = EAP>] (from client aruba port 0 cli 38192fb2eb02) Wed May 25 14:54:14 2016 : Auth: Login incorrect: [sales/<via Auth-Type = EAP>] (from client aruba port 0 via TLS tunnel) Wed May 25 14:54:14 2016 : Auth: Login incorrect: [sales/<via Auth-Type = EAP>] (from client aruba port 0 cli 38192fb2eb02) Wed May 25 14:54:56 2016 : Auth: Login incorrect: [support/<via Auth-Type = EAP>] (from client aruba port 0 via TLS tunnel) Wed May 25 14:54:56 2016 : Auth: Login incorrect: [support/<via Auth-Type = EAP>] (from client aruba port 0 cli 38192fb2eb02) Wed May 25 14:55:00 2016 : Auth: Login incorrect: [support/<via Auth-Type = EAP>] (from client aruba port 0 via TLS tunnel) Wed May 25 14:55:00 2016 : Auth: Login incorrect: [support/<via Auth-Type = EAP>] (from client aruba port 0 cli 38192fb2eb02) Wed May 25 16:00:08 2016 : Auth: Login OK: [eby] (from client aruba port 0 via TLS tunnel) Wed May 25 16:00:08 2016 : Auth: Login OK: [eby] (from client aruba port 0 cli e02a82e1afbf) Wed May 25 16:01:27 2016 : Auth: Login OK: [eby] (from client aruba port 0 via TLS tunnel) Wed May 25 16:01:27 2016 : Auth: Login OK: [eby] (from client aruba port 0 cli e02a82e1afbf) Wed May 25 16:03:27 2016 : Auth: Login OK: [eby] (from client aruba port 0 via TLS tunnel) Wed May 25 16:03:27 2016 : Auth: Login OK: [eby] (from client aruba port 0 cli e02a82e1afbf) Wed May 25 16:05:19 2016 : Auth: Login OK: [eby] (from client aruba port 0 via TLS tunnel) Wed May 25 16:05:19 2016 : Auth: Login OK: [eby] (from client aruba port 0 cli e02a82e1afbf) -------------------------------------------- On Tue, 24/5/16, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> wrote: Subject: Re: User login restrictions based on SSID To: "Eby Mani" <eby_km(a)yahoo.com>, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tuesday, 24 May, 2016, 7:25 PM Hi, > I can login to mysql with the credentials used in sql.conf, yet not sure why it gives Mysql error. i have even restarted the server and getting same error. not sure? > Tue May 24 20:35:21 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 > Tue May 24 20:35:21 2016 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius > Tue May 24 20:35:21 2016 : Error: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.so' > Tue May 24 20:35:21 2016 : Error: rlm_sql (sql): Failed to connect DB handle #0 the error message says why...... alan

3 2

Use the last build and the other packages from system On ubuntu 16
by Spider s 25 May '16

25 May '16

Hello plp. I have got a little problem, not is a Radius problem exact. At this moment i am using the last build from source, all running and perfect on ubuntu 16 Now i need install daloradius, covachilli etc.. When i try for example install freeradius-mysql package the system want install too the freeradius package. I want use the last build, but i need the other packages for integration.a difference, the build install at /usr/local/etc/raddb/ and the original package system on /etc/ for example. other question is how update and compiling the new build without lose my actual CFG running. How i can solve this ??? where i can find the source from freeradius-mysql ??? Thank you in advanced, best regards.

3 4