- Freeradius-Users - lists.freeradius.org

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 10 Dec '15

10 Dec '15

Hi Arran, Nice one. Looking for sql map stuff i found this thread https://github.com/FreeRADIUS/freeradius-server/issues/984 .. It seems to indicate predefinition in a module, which is ok but your example looks more inline. I am guessing the sql bit matches the module instance name here and the query is loaded in a variable? Would an xlat type section be therefore Map sql_instname &var { Control:Tmp-string-0 += myfieldname } Or am i way out and it needs module definition? Thanks! ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 10 December 2015 18:06 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > On 10 Dec 2015, at 12:57, Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> wrote: > > >> On 10 Dec 2015, at 12:42, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: >> >> Hi all, >> I'm trying to do something a bit fiddly. I'm sure I've asked this before but google doesn't help. >> Can we pass back multiple attributes from a sql xlat yet on 3.1.0? >> If not, is there a reverse of %{Attribute-Name[*]} that could translate my value1\nvalue2 from an SQL stored procedure into attribute[1]=value1, attribute[2]=value2 etc? >> If not, has anyone come up with a clean way to iterate through and do the equivalent via += a number of times? >> It seems I can use explode to get the number of delimiters (maybe I'm using it wrongly). >> >> Maybe I'm missing something REALLY simple. Wouldn't be the first time. :-~ > > You can do it with maps IIRC: > > map sql <query> { > <radius attr> += <sql column> > } And then use the pairs xlat. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 10 Dec '15

10 Dec '15

Hi all, I'm trying to do something a bit fiddly. I'm sure I've asked this before but google doesn't help. Can we pass back multiple attributes from a sql xlat yet on 3.1.0? If not, is there a reverse of %{Attribute-Name[*]} that could translate my value1\nvalue2 from an SQL stored procedure into attribute[1]=value1, attribute[2]=value2 etc? If not, has anyone come up with a clean way to iterate through and do the equivalent via += a number of times? It seems I can use explode to get the number of delimiters (maybe I'm using it wrongly). Maybe I'm missing something REALLY simple. Wouldn't be the first time. :-~ Thanks Andy

2 2

Error when trying to compile 3.0.10
by Bertalan Voros 10 Dec '15

10 Dec '15

Hello All, I am getting an error when trying to compile FreeRADIUS 3.0.10 on an Ubuntu 14.04. Following this guide: http://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind All dependencies are installed according to dpkg-checkbuilddeps. I then run configure: ./configure -C --prefix=/opt/freeradius3 --with-winbind-dir=/opt/samba4.3.2 Then getting errors at the sqlite bit: src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c:802:30: error: ‘rlm_sql_sqlite_conn_t’ has no member named ‘db’ return sqlite3_changes(conn->db); ^ src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c: In function ‘sql_select_query’: src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c:594:1: warning: control reaches end of non-void function [-Wreturn-type] } ^ src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c: In function ‘sql_query’: src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.c:615:1: warning: control reaches end of non-void function [-Wreturn-type] } ^ make: *** [build/objs/src/modules/rlm_sql/drivers/rlm_sql_sqlite/rlm_sql_sqlite.lo] Error 1 Any help will be appreciated. Bertalan

3 8

How to add users into group
by dorje2007＠seznam.cz 10 Dec '15

10 Dec '15

Hi I was checking the option how to add users into groups. The ideas is to have different groups with Cisco AV pair and other parameters, and users that belongs to those groups. I was not able to find such an option, since huntgroups offers the group of the NAS clients. Like this: user1 Cleartext-Password := "user1" // should belong somwhow to the group1 Group1 Service-Type = Framed-User, Framed-Protocol = PPP, cisco-avpair = "group1;" Many thanks

2 3

Several NAS clients behind NAT
by Marius Flage 10 Dec '15

10 Dec '15

Hi! I'm running a FreeRADIUS server that's not directly accessible from the NAS clients, but they're all originating from the same source ip. Is this setup at all possible, or do I need to do some dirty hacks with NAT magic to accomplish this? When running with the same ip address (nasname), I get: "Failed to add duplicate client <shortname>". So I guess I have to do something to work around this? -- Marius

2 1

Using FreeRADIUS with SQL backend and advanced configuration
by Marius Flage 10 Dec '15

10 Dec '15

Hi! I've just set up FreeRADIUS with SQL backend and dynamic VLAN assignment, and it works great. I'm using it to put different users into different VLANs based on their username/password, using EAP. However, I want to expand on this to be able to put the clients into another VLAN if also the calling station MAC address matches. If I did this using the flat file "users", I'd suspect it'd be something like this: testuser Cleartext-Password := "example", Calling-Station-Id := "A0-A8-CD-60-AF-C2" Tunnel-Medium-Type := "IEEE-802", Tunnel-Private-Group-ID := 3, Tunnel-Type := "VLAN" testuser Cleartext-Password := "example" Tunnel-Medium-Type := "IEEE-802", Tunnel-Private-Group-ID := 4, Tunnel-Type := "VLAN" The theory here is that if the user "testuser" logs in with the password "example" from the device with MAC address "a0:a8:cd:60:af:c2", then he should be placed into the VLAN 3, if not, into VLAN 4. Is this possible with FreeRADIUS and specifically when using the SQL backend? -- Marius

3 4

accounting - more than one query
by Marcin 09 Dec '15

09 Dec '15

Hi In accounting section i'd like to run at least two quieries to database but when i write: #v+ start { query = "INSERT INTO one ..." query = "INSERT INTO two ..." } only this first is executed :/ how to execute more than one query? -- Pozdrawiam Marcin / nicraM

2 2

Machine auth fails but user auth works
by Dennis Xu 09 Dec '15

09 Dec '15

I have FreeRadius 3.0.4 and authenticate to AD. My user authentication works but machine auth fails with certificate errors. I was using the same Windows 10 machine to test both scenarios. I attached the debug logs in both tests. What could be the reasons for the machine auth problem? Below are some of my configurations: mods-available/mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-00} --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" mods-available/eap: default_eap_type = peap peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes # proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" # soh = yes # soh_virtual_server = "soh-server" # require_client_cert = yes } mschapv2 { # send_error = no } proxy.conf: realm LOCAL { } realm NULL{ } realm uoguelph.ca { } realm DEFAULT { authhost = prod1-east.eduroam.ca:1812 accthost = prod1-east.eduroam.ca:1813 secret = nostrip } Thanks! Dennis Xu

6 32

Update username attribute in NAS
by Anirudh Malhotra 09 Dec '15

09 Dec '15

Hey Everyone, I have few questions first: Can User-Name attribute be updated at NAS after authentication is completed(post auth)? Second if yes how? Third I have tried sending username in update reply but it didn't change. I can see the radius sending it though. [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'anirudh', 'superchor', 'Access-Accept', '2015-12-09 10:48:49') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'anirudh', 'superchor', 'Access-Accept', '2015-12-09 10:48:49') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 200 to 10.10.10.10 port 32769 User-Name = "anirudh" Finished request 4. Going to the next request Waking up in 4.9 seconds. PS: I am doing this to keep accounting from the sent username. Not the current username. PLEASE HELP! BR, Anirudh Malhotra

2 3

add reply attribute
by Marc Boisis 09 Dec '15

09 Dec '15

Hi, In the access-request, i receive the Aruba-Device-Type attribute, I want to put it in the access-accept response attributes, How can I do ? Thanks

4 6