- Freeradius-Users - lists.freeradius.org

rlm_sqlcounter reset value
by Muhammad Usman 13 Dec '15

13 Dec '15

Hi, I have configured successfully the rlm_sqlcounter module and set the "reset" attribute to daily and its working properly, but I was wondering if it is possible to have this attribute dynamic for each user, based on SQL query, meaning rather than defining a static value in configuration file, is it possible to define a SQL query that runs each time and gets the value from database. Thanks

3 8

Re: Pairing a network user to an SIP ID
by fred diziel 13 Dec '15

13 Dec '15

Hello all, Thank you for the response again mr. Alan, > After Alice is connected to the network, Alice then tries to connect to the SIP server with user A ID. > Why? Because I want to try to pair two user, mainly in my case a network user and an SIP ID, so user A is paired with user B, if it's possible, then when went on like I explained. > RADIUS can't do that. > It can accept or reject users. That's it. It can't tell users to try a different username. > No. RADIUS doesn't do it. OpenSIP doesn't do it. > Get the users to log in with the correct credentials. I see, so it's not possible with either one of it, thank you for the explanation and your time, I believe this has answered my question.

2 1

Re: Pairing a network user to an SIP ID‏
by fred diziel 12 Dec '15

12 Dec '15

Hello all, Thanks for the response mr. Alan, > I'm not sure what you mean by that. The server authenticates users. It doesn't care where the user comes from. > So, yes... the server will authenticate anyone who's using a known name and password. I apologize if it's a bit confusing, what I mean is like this, I have two user IDs, user A is used for the network, and user B is for the SIP ID. Let's say the user is Alice, first, Alice will be authenticated and authorized to use the network with user A ID. After Alice is connected to the network, Alice then tries to connect to the SIP server with user A ID. The sip server, in this case opensips who uses freeradius as its AAA server, will contact freeradius with the information of user A. Then, freeradius recognize that user A is assigned to user B as its SIP ID, and freeradius proceed to reply with user B info to be used by Alice. After Alice got the info of user B ID, then she changes its ID to user B, and retry to connect to opensips again. Then freeradius authenticate and authorize as usual, finally Alice can use the SIP service. is it possible to do this in freeradius? Also, I apologize again for forgetting the server version, here is the server version freeradius-server-2.2.9 opensips-2.1.1 ubuntu 12.04 lts thank you for the responses

2 1

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 11 Dec '15

11 Dec '15

Thanks for that Arran. I'll check it a bit later. Weird that it worked on 2 field tables then failed when i moved to 4. Thanks again Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 11 December 2015 16:37 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > On Dec 11, 2015, at 11:09 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Hi. Maybe spoke too soon.. > Any chance this crash is not something I have done? Pushed fix... Looks like this is an old bug. Maybe MySQL have messed up the version macro :/ -Arran

1 0

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 11 Dec '15

11 Dec '15

Hi. Maybe spoke too soon.. Any chance this crash is not something I have done? thanks Andy (0) EXPAND call get_active_sessions_for_switchport ('%{NAS-IP-Address}', '%{NAS-Port}', 864000) (0) --> call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000) (0) Tmp-String-0 := "call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000)" (0) } # update control = noop (0) map sql_SP_rsh-radius-lant &control:Tmp-String-0 { rlm_sql (sql_SP_rsh-radius-lant): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql_SP_rsh-radius-lant): Opening additional connection (0), 1 of 10 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on rsh-radius-sql via TCP/IP, server version 5.5.31-0ubuntu0.13.04.1, protocol version 10 rlm_sql (sql_SP_rsh-radius-lant): Reserved connection (0) (0) Executing select query: call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000) Program received signal SIGSEGV, Segmentation fault. (gdb) bt #0 0x00007ffff08fcce0 in mysql_num_fields () from /usr/lib/x86_64-linux-gnu/libmysqlclient.so.18 #1 0x00007ffff0dfdf0c in sql_fields (out=0x7fffffffc3c0, handle=0xd48e20, config=0xb3d1c0) at src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c:444 #2 0x00007ffff10046bc in mod_map_proc (mod_inst=0xb3d1c0, proc_inst=0x0, request=0xd03880, query=0xd537d0 "call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000)", maps=0xcc19b0) at src/modules/rlm_sql/rlm_sql.c:332 #3 0x00007ffff7bac416 in map_proc (request=0xd03880, inst=0xcc2310) at src/main/map_proc.c:234 #4 0x000000000042b1d7 in modcall_recurse (request=0xd03880, component=MOD_AUTHORIZE, depth=2, entry=0x7fffffffd870, do_next_sibling=true) at src/main/modcall.c:649 #5 0x000000000042a86c in modcall_child (request=0xd03880, component=MOD_AUTHORIZE, depth=2, entry=0x7fffffffd858, c=0xcc1770, result=0x7fffffffcc40, do_next_sibling=true) at src/main/modcall.c:434 #6 0x000000000042ba7a in modcall_recurse (request=0xd03880, component=MOD_AUTHORIZE, depth=1, entry=0x7fffffffd858, do_next_sibling=true) at src/main/modcall.c:834 #7 0x000000000042a86c in modcall_child (request=0xd03880, component=MOD_AUTHORIZE, depth=1, entry=0x7fffffffd840, c=0xca31a0, result=0x7fffffffd280, do_next_sibling=true) at src/main/modcall.c:434 #8 0x000000000042ba7a in modcall_recurse (request=0xd03880, component=MOD_AUTHORIZE, depth=0, entry=0x7fffffffd840, do_next_sibling=true) at src/main/modcall.c:834 #9 0x000000000042c8e2 in modcall (component=MOD_AUTHORIZE, c=0xca30b0, request=0xd03880) at src/main/modcall.c:1179 #10 0x0000000000427be8 in indexed_modcall (comp=MOD_AUTHORIZE, idx=0, request=0xd03880) at src/main/modules.c:956 #11 0x0000000000429f86 in process_authorize (autz_type=0, request=0xd03880) at src/main/modules.c:2091 #12 0x000000000040fbd7 in rad_authenticate (request=0xd03880) at src/main/auth.c:435 #13 0x000000000043bf64 in request_running (request=0xd03880, action=1) at src/main/process.c:1482 #14 0x000000000043ac6a in request_queue_or_run (request=0xd03880, process=0x43be02 <request_running>) at src/main/process.c:953 #15 0x000000000043c86c in request_receive (ctx=0xd03590, listener=0xae72f0, packet=0xd035f0, client=0xacb540, fun=0x40f934 <rad_authenticate>) at src/main/process.c:1740 #16 0x0000000000419bd7 in auth_socket_recv (listener=0xae72f0) at src/main/listen.c:1901 #17 0x0000000000443a50 in event_socket_handler (xel=0xcf55f0, fd=12, ctx=0xae72f0) at src/main/process.c:4544 #18 0x00007ffff7974d6e in fr_event_loop (el=0xcf55f0) at src/lib/event.c:637 #19 0x0000000000445925 in radius_event_process () at src/main/process.c:5587 #20 0x00000000004339a6 in main (argc=2, argv=0x7fffffffe6d8) at src/main/radiusd.c:578 -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 10 December 2015 22:15 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > On 10 Dec 2015, at 16:47, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Awesome, it works! Thanks devs. Everytime I play with FR I learn something new! No problem :) and it's more, every time you come back to FreeRADIUS we've added something new ;) Both those features were added this year. One of the benefits of building from the v3.1.x branch. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Pairing a network user to an SIP ID
by fred diziel 11 Dec '15

11 Dec '15

Hello all, I have successfully implemented opensips with freeradius as AAA server, what I'd like to know is whether it's possible to assign a network user of freeradius to an SIP ID which can be used for opensips. The network is using freeradius as authenticator, after the user have been authenticated and authorized to use the network, then said user will be assigned an SIP ID to use for VoIP calls via opensips. The authentication and authorization of the SIP ID also done in freeradius too. Is it possible to do it in freeradius? Thank you for the answers.

2 1

freeradius Failed to authenticate (mysql)
by Let'sgo 11 Dec '15

11 Dec '15

hi everyone , i config freeradius 3.0,when i execute radtest ,reponse error , "ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject" , i try my best to find answer , but i can't resolve this problem ,please , i would be appreciated ,thanks! Received Access-Request Id 135 from 127.0.0.1:45824 to 127.0.0.1:1812 length 74 User-Name = 'test' User-Password = 'test' NAS-IP-Address = 10.117.14.105 NAS-Port = 1812 Message-Authenticator = 0x6795d9c62f8c6b82dd3e6e6a0ad0c275 (0) Received Access-Request packet from host 127.0.0.1 port 45824, id=135, length=74 (0) User-Name = 'test' (0) User-Password = 'test' (0) NAS-IP-Address = 10.117.14.105 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x6795d9c62f8c6b82dd3e6e6a0ad0c275 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "test", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) sql : EXPAND %{User-Name} (0) sql : --> test (0) sql : SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id' (0) sql : User found in radcheck table Found User-Password == "..." Are you sure you don't mean Cleartext-Password? See "man rlm_pap" for more information (0) sql : Check items matched (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id' (0) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority' (0) sql : User found in the group table (0) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'user' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'user' ORDER BY id' (0) sql : Group "user" check items matched (0) sql : EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql : --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'user' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'user' ORDER BY id' (0) sql : Group "user" reply items processed rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (0) WARNING: pap : Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql : EXPAND .query (0) sql : --> .query (0) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND %{User-Name} (0) sql : --> test (0) sql : SQL-User-Name set to 'test' (0) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', ' %S') (0) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test', 'Access-Reject', '2015-12-09 23:33:01') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test', 'Access-Reject', '2015-12-09 23:33:01')' rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> test (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sending Access-Reject packet to host 127.0.0.1 port 45824, id=135, length=0 Sending Access-Reject Id 135 from 127.0.0.1:1812 to 127.0.0.1:45824 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 135 with timestamp +6 Ready to process requests

4 4

daily log rotate in FR2.2.9
by srithar jeevadurai 11 Dec '15

11 Dec '15

Hi Team, We need to do daily log rotate for radius.log file. We are using FR2.2.9 (old one was 2.2.0). We don't want to use syslogd since due to some constraint at our server. Is there any way that we can achieve the same? -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

1 1

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 10 Dec '15

10 Dec '15

Awesome, it works! Thanks devs. Everytime I play with FR I learn something new! Andy Executing select query: select acctuniqueid from radacct_lant where nasportid='1' (0) control:Tmp-string-1 += 95723d0da326de4fd8dadf064357b544 (0) control:Tmp-string-1 += 4ae6bd20c2955bdbc7a61703bd811c5b (0) control:Tmp-string-1 += 2dd1180062377402bf85f927ded052a1 (0) control:Tmp-string-1 += ed39616270fc864a165d628d5e81a236 (0) control:Tmp-string-1 += 296ad0d391b50f6adf1af1184e62246f (0) control:Tmp-string-1 += 9c921f1908bb2c3a310c5e147a8478e9 (0) control:Tmp-string-1 += 342ba906a78da2b3975d84663f82133f (0) control:Tmp-string-1 += ecf782b6e59a267dfc28cdbcc8be1ba4 (0) control:Tmp-string-1 += 049f9c8b1295eb7ba5523fdf3b267edf (0) control:Tmp-string-1 += 247547b1bdbfcaa951a1a6bd6c447ed7 (0) control:Tmp-string-1 += 7c53c103b118e60c58c42416149d0cfa -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Franks Andy (IT Technical Architecture Manager) Sent: 10 December 2015 19:55 To: FreeRadius users mailing list Subject: RE: Reverse string concatenation for multiple attributes That's pretty amazing really. One day I'll task myself with looking completely at the source code, but it would likely melt my brain. The reason, behind the scenes, was we're trying to dynamically update the mac address limit on hp switch ports, but due to these horrible mitel phones with switches in the back, you've no idea whether the mac-limit 2 device (phone) comes up first, or what's plugged into it (pc), usually the pc, which means you need to do a disconnect or CoA to get the phone to present and then push the correct mac limit. Also, the mac address doesn't drop off the switch port when it disconnects from the phone, so you connect a different pc or laptop on the phone and then you have to log off the non-phone mac. All depends on accounting and lots of sql afaics. Or we could just statically map the limit on the switch, but that's no challenge at all. It's a shame you can't do mac-limit on multiple macs, with the newest counting, but HP don't work like that. Thanks Arran! Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 10 December 2015 19:27 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > .. It seems to indicate predefinition in a module, which is ok but your example looks more inline. I am guessing the sql bit matches the module instance name here and the query is loaded in a variable? Or an xlat. It's a polymorphic template type meaning it can be an attribute reference as you have below, an xlat expansion like "SELECT * FROM BLAH WHERE user = %{user-Name}", an exec `echo 'SELECT * FROM BLAH'`, or just a plain literal like 'SELECT * FROM BLAH WHERE 1' > Would an xlat type section be therefore > > Map sql_instname &var { > Control:Tmp-string-0 += myfieldname > } > > Or am i way out and it needs module definition? Nope that's good. Then update request { Tmp-String-0 := "%{pairs:&control:Tmp-String-0[*]}" } To recombine into a list of comma delimited value pairs. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 10 Dec '15

10 Dec '15

That's pretty amazing really. One day I'll task myself with looking completely at the source code, but it would likely melt my brain. The reason, behind the scenes, was we're trying to dynamically update the mac address limit on hp switch ports, but due to these horrible mitel phones with switches in the back, you've no idea whether the mac-limit 2 device (phone) comes up first, or what's plugged into it (pc), usually the pc, which means you need to do a disconnect or CoA to get the phone to present and then push the correct mac limit. Also, the mac address doesn't drop off the switch port when it disconnects from the phone, so you connect a different pc or laptop on the phone and then you have to log off the non-phone mac. All depends on accounting and lots of sql afaics. Or we could just statically map the limit on the switch, but that's no challenge at all. It's a shame you can't do mac-limit on multiple macs, with the newest counting, but HP don't work like that. Thanks Arran! Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 10 December 2015 19:27 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > .. It seems to indicate predefinition in a module, which is ok but your example looks more inline. I am guessing the sql bit matches the module instance name here and the query is loaded in a variable? Or an xlat. It's a polymorphic template type meaning it can be an attribute reference as you have below, an xlat expansion like "SELECT * FROM BLAH WHERE user = %{user-Name}", an exec `echo 'SELECT * FROM BLAH'`, or just a plain literal like 'SELECT * FROM BLAH WHERE 1' > Would an xlat type section be therefore > > Map sql_instname &var { > Control:Tmp-string-0 += myfieldname > } > > Or am i way out and it needs module definition? Nope that's good. Then update request { Tmp-String-0 := "%{pairs:&control:Tmp-String-0[*]}" } To recombine into a list of comma delimited value pairs. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0