- Freeradius-Users - lists.freeradius.org

3.0.9 rlm_sql startup error
by Adam Hammond 30 Jun '15

30 Jun '15

Hi list, I've checked out 3.0.x from git and configured it to my means. I get the following error when I try and start it: /etc/raddb/mods-config/sql/main/postgresql/queries.conf[150]: Failed parsing expanded string: /etc/raddb/mods-config/sql/main/postgresql/queries.conf[150]: ...M radgroupcheck WHERE GroupName = '%{SQL-Group}' ORDER BY id /etc/raddb/mods-config/sql/main/postgresql/queries.conf[150]: ^ Unknown attribute I've double check my sql module configuration and am using the stock queries.conf so I'm a little stumped. help appreciated as always, Adam Full startup debug: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/postgresql/queries.conf including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/always including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/filter including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/wicoms-test main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 2048 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 0.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } realm WICOMS { virtual_server = testrad } realm NULL { virtual_server = testrad Please use pools instead of authhost and accthost Please use pools instead of authhost and accthost } radiusd: #### Loading Clients #### client 0.0.0.0/0 { ipaddr = 0.0.0.0/0 require_message_authenticator = no secret = <<< secret >>> proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached radiusd: #### Instantiating modules #### # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_sql # Loading module "wicoms_sql" from file /etc/raddb/mods-enabled/sql sql wicoms_sql { driver = "rlm_sql_postgresql" server = "10.0.10.31" port = 5432 login = "wicoms_radius" password = <<< secret >>> radius_db = "wicoms" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-none}.query}" type { accounting-on { query = "UPDATE radacct SET AcctStopTime = TO_TIMESTAMP(%{integer:Event-Timestamp}), AcctUpdateTime = TO_TIMESTAMP(%{integer:Event-Timestamp}), AcctSessionTime = (%{integer:Event-Timestamp} - EXTRACT(EPOCH FROM(AcctStartTime))), AcctTerminateCause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE AcctStopTime IS NULL AND NASIPAddress= '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' AND AcctStartTime <= '%S'::timestamp" } accounting-off { query = "UPDATE radacct SET AcctStopTime = TO_TIMESTAMP(%{integer:Event-Timestamp}), AcctUpdateTime = TO_TIMESTAMP(%{integer:Event-Timestamp}), AcctSessionTime = (%{integer:Event-Timestamp} - EXTRACT(EPOCH FROM(AcctStartTime))), AcctTerminateCause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE AcctStopTime IS NULL AND NASIPAddress= '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' AND AcctStartTime <= '%S'::timestamp" } start { query = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_Stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIpAddress) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}', NULLIF('%{%{NAS-Port-ID}:-%{NAS-Port}}', ''), '%{NAS-Port-Type}', TO_TIMESTAMP(%{integer:Event-Timestamp}), TO_TIMESTAMP(%{integer:Event-Timestamp}), NULL, 0, '%{Acct-Authentic}', '%{Connect-Info}', NULL, 0, 0, '%{Called-Station-Id}', '%{Calling-Station-Id}', NULL, '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet)" } interim-update { query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = %{%{Acct-Session-Time}:-NULL}, AcctInterval = (%{integer:Event-Timestamp} - EXTRACT(EPOCH FROM (COALESCE(AcctUpdateTime, AcctStartTime)))), AcctUpdateTime = TO_TIMESTAMP(%{integer:Event-Timestamp}), AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND AcctStopTime IS NULL" } stop { query = "UPDATE radacct SET AcctStopTime = TO_TIMESTAMP(%{integer:Event-Timestamp}), AcctUpdateTime = TO_TIMESTAMP(%{integer:Event-Timestamp}), AcctSessionTime = COALESCE(%{%{Acct-Session-Time}:-NULL}, (%{integer:Event-Timestamp} - EXTRACT(EPOCH FROM(AcctStartTime)))), AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), AcctTerminateCause = '%{Acct-Terminate-Cause}', FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND AcctStopTime IS NULL" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())" } } rlm_sql (wicoms_sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Creating attribute wicoms_sql-SQL-Group # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_realm # Loading module "slash" from file /etc/raddb/mods-enabled/realm realm slash { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } instantiate { } modules { /etc/raddb/mods-config/sql/main/postgresql/queries.conf[150]: Failed parsing expanded string: /etc/raddb/mods-config/sql/main/postgresql/queries.conf[150]: ...M radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id /etc/raddb/mods-config/sql/main/postgresql/queries.conf[150]: ^ Unknown attribute

3 11

Freeradius 3 self signed certificate
by Jochen Demmer 30 Jun '15

30 Jun '15

Hi, I'm trying to setup Freeradius 3.0.4 under CentOS 7 with TTLS-EAP and MSCHAPv2. My first tests with using LDAP in the back and the defaultly installed server certificate were successful. There won't be any authentication via client certificate. It's all about the server certificate for the TLS encryption. There is a self signed certificate which I would like install in the server. Now I'm somewhat struggling with the server side configuration. Why do I want these cnf files in the certs directory? Honestly I expected to just place the certificate/key files there, link them in the config and be done. I found some documents in the internet saying that this server certificate need extended key usage attributes (1.3.6.1.5.5.7.3.1). Is that right? The certificate is actually issued from a subCA. What do I have to consider when installing the cert, key and cacert in the FreeRadius server? Does the ca certificate need to be concatenated from the rootCA and also the subCA? What do I need to consider when it comes to installing the cacert to the clients (iOS, Android, Windows 7+, Linux, OS X). Does the certificate be a catted cert from the rootca cert and the subca cert? I there anything else I need to consider? We're using TinyCA 0.7.5. Thank you list -- Peakwork Signature *Jochen Demmer* Network Administrator T: +49-(0)241-4131146-29 jochen.demmer(a)peakwork.com peakwork AG | Sonnenweg 15 a | D-52070 Aachen | T: +49-(0)241-4131146-29 | F: +49-(0)241-4131146-17 peakwork AG (Headquarter) | Flinger Str. 36 | D-40213 Düsseldorf | T: +49-(0)211-91368-500 | F: +49-(0)211-91368-509 Executive board: Ralf Usbeck (chairman) | Markus Pfau | Michael Schmidt | Dr. Thomas van Kaldenkerken Chairman of the supervisory board: Markus Voelkel Company register: Amtsgericht Düsseldorf HRB 71223 | VAT ID.: DE264960677 Peakwork Logo www.peakwork.com | www.peakwork.de

5 4

Problem with Hints file
by Craig Nattrass 30 Jun '15

30 Jun '15

Hi, I have just upgraded to version 3.0.8 from 3.0.0 My goal is to combine the User-Name and the Mikrotik-Realm in the hints into the following: User-Name := "%{User-Name}@%{Mikrotik-Realm}" This would be for the Authentication and the Accounting. I version 3.0.0 this part worked. However the username did not pass correctly SQL-User-Name but with fiddling with the strip username seemed to resolve this. When the Accounting packets came in I ended up with User-Names looking like this: ai:=28=5B0-9a-f=5D=7B32=7D=29 which was expanded from: (122) sql : expand: "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" -> 'ai:([0-9a-f]{32})' (122) sql : SQL-User-Name set to "ai:([0-9a-f]{32})" this was when I decided to upgrade to 3.0.8 version 3.0.0 sample log: Called-Station-Id = 'hotspot1' NAS-Port-Id = 'wlan2' User-Name = 'craign' MS-CHAP-Domain = 'wifi.co' NAS-Port = 2148532316 Acct-Session-Id = '8010005c' Framed-IP-Address = 10.254.2.245 Mikrotik-Host-IP = 10.254.2.245 User-Password = 'mmmm' Service-Type = Login-User WISPr-Logoff-URL = 'http://10.254.2.1/logout' NAS-Identifier = 'MikroTik' Mikrotik-Realm = 'wifi.co' NAS-IP-Address = 10.99.0.16 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) ? if (User-Name != "%{tolower:%{User-Name}}") (0) expand: "%{tolower:%{User-Name}}" -> 'craign' (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE (0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE (0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE (0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) preprocess : hints: Matched DEFAULT at 19 (0) preprocess : expand: "%{User-Name}@%{Mikrotik-Realm}" -> 'craign(a)wifi.co' (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) [files] = noop (0) sql : expand: "%{%{User-Name}:-DEFAULT}" -> 'craign' (0) sql : SQL-User-Name set to "craign" This is the logs from version 3.0.8 The below shows the preprocess from the hints adding neither the User-Name Nor the Mikrotik-Realm to the User-Name: the values of %{User-Name} and %{Mikrotik-Realm} are being dropped. Called-Station-Id = 'hotspot1' (0) NAS-Port-Id = 'wlan2' (0) User-Name = 'craign' (0) MS-CHAP-Domain = 'wifi.co' (0) NAS-Port = 2148532315 (0) Acct-Session-Id = '8010005b' (0) Framed-IP-Address = 10.254.2.245 (0) Mikrotik-Host-IP = 10.254.2.245 (0) User-Password = 'mmmm' (0) Service-Type = Login-User (0) WISPr-Logoff-URL = 'http://10.254.2.1/logout' (0) NAS-Identifier = 'MikroTik' (0) Mikrotik-Realm = 'wifi.co' (0) NAS-IP-Address = 10.99.0.16 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") { (0) EXPAND %{tolower:%{User-Name}} (0) --> craign (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) { (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) { (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) { (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) { (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (User-Name =~ /\\.$/) { (0) if (User-Name =~ /\\.$/) -> FALSE (0) if (User-Name =~ /(a)\\./) { (0) if (User-Name =~ /(a)\\./) -> FALSE (0) } # policy filter_username = notfound (0) preprocess: hints: Matched DEFAULT at 19 (0) preprocess: EXPAND %{User-Name}@%{Mikrotik-Realm} (0) preprocess: --> @ (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) [files] = noop (0) sql: EXPAND %{%{User-Name}:-DEFAULT} (0) sql: --> craign (0) sql: SQL-User-Name set to 'craign' Regards Craig

3 5

Delayed bind options?
by Franks Andy (IT Technical Architecture Manager) 29 Jun '15

29 Jun '15

Hi all, Am using freeradius 3.1.0 (compiled from source). Is there any way with this versions (or previous) to prevent the initial bind to at least ldap and/or mysql databases when the service starts? The situation is that sometimes a resource that is initially bound (one of our 5 AD servers for example) is unavailable, which prevents being able to restart the freeradius service. If we do, it will not start. If the resource isn't around when the service is already started, it doesn't cause too many issues since we use redundant-load-balance etc features on that module or just force-allow a connection failure, so that failure to write logging information to a DB doesn't cause rejection. I've hit this happen a couple of times, and since we're looking to relocate some AD servers with expected downtime I'd rather avoid the risk. I could remove the configuration for that server on each FR box, but it's a bit of a job as we have quite a few now. I did search for 30mins or so, but it didn't turn much up, so apologies if I've overlooked the most heavily documented feature going.. Thanks Andy

3 3

PAM authentication with Eduroam
by Kristoffer Dalby 29 Jun '15

29 Jun '15

Hi I am researching the possibility of using freeradius/eduroam as authentication backend through PAM for SSH. This far in my research, i have run into a few questions that i cant quite find the correct answer to. Currently i cannot understand if the PAM module is able to handle the password as a hash, or if it is able to use secure communication such as EAP-TLS. Also, as eduroam is a hierarchy of radius servers, where the authentication request is forwarded until it reaches the right server, it requires the credentials are encrypted so only the user and the correct server can "see" them. I do quite understand if this is even possible to achieve from the PAM side of my use case. Can anyone provide some clarification on these cases? My English is not the best, so if my explanations is hard to understand, please let me know, and i will try again. -- Kristoffer Dalby Summer intern Abels gt. 5- Teknobyen NO-7465 Trondheim

5 7

LDAP draft-wahl-ldap-session
by Michael Ströder 29 Jun '15

29 Jun '15

HI! Recently I appreciated very much that some LDAP clients send the Session Track Control [1] along with their LDAP requests. draft-wahl-ldap-session was written especially with RADIUS in mind. Any chance to see this implemented? [1] https://tools.ietf.org/html/draft-wahl-ldap-session Unfortunately I'm not a C programmer so I can only give some pointers and promise to test the feature later. Example code in OpenLDAP tools: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=clients/to… I guess the structs are here: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries/… Ciao, Michael.

2 14

freeradius Expiration attribute
by Stoian Mishev 29 Jun '15

29 Jun '15

Hi All, I have a very old installation of freeradius (1.1.4) on my production server. As I know the “Expiration” attribute disconnects the user at 00:00 at the expiration day. I want to change this to be at 12:00 for example as at 00:00 there is no support personnel at the office. I tried to change the Value of the attribute from “29 June 2015” to “29 June 2015 12:00” but it did not work. Maybe my installation is too old and it supports only date format for Expiration. I saw somewhere in this list that when the Expiration time comes the radius server sends Session-Timeout to the NAS. If so is it possible to offset this with 12 hours? Is there anyone that can help me with this. Thanks. -- Stoian Mishev NetWave Ltd. Varna, Bulgaria

2 1

Re: radiusd debug understanding help needed (EAP session for state 0x... did not finish)
by Rui Ribeiro 29 Jun '15

29 Jun '15

I confirm I am running 802.1X in a very similar equipment, a in a 2950 series. The setup has some caveats, but it is relatively simple to put it to work. > > From: "Zeus Panchenko" <zeus(a)ibs.dn.ua> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Subject: Re: radiusd debug understanding help needed (EAP session for > state 0x... did not finish > > absolutely do not know why didn't I provided this info yet ... > > the switch FR and supplicant connected to is: > > Cisco SF300-24 24-Port 10/100 Managed Switch > > > -- > Zeus V. Panchenko jid:zeus@im.ibs.dn.ua > IT Dpt., I.B.S. LLC GMT+2 (EET) >

1 0

Trying to understand change in behaviour between 2.1.12 and 2.2.5 (ok = reject) or Bug?
by Timothy White 29 Jun '15

29 Jun '15

Hey everyone I'm the main developer behind the Grase hotspot project, that internally uses Freeradius and Coova Chilli for a Captive portal hotspot. On my testing system, Freeradius recently upgraded to 2.2.5, which seems to have some strange new behaviour with my configs. I'm using the below snippit to get custom reply messages for rejections. authorize { ... logintime { reject = 1 } if(reject){ update reply { Reply-Message := "Your are not allowed to login at this time" } ok = reject } ... } This was working nicely in 2.1.12, detecting when the logintime module had returned a reject code, and then updating the Reply-Message with a nicer message. I've been doing this since at least 2012 without problems. I also use this for many other sections to return custom Reply-Messages when rejecting a user. However, in 2.2.5, it appears to be ignoring the ok = reject part, and it sends back an Accept-Accept with the Reply-Message, instead of an Access-Reject. Complete configs are available at https://github.com/GraseHotspot/grase-conf-freeradius/blob/master/freeradiu… (these configs have an extra "reject" under each ok = reject, something I tried which seems to have made no difference) My reading of the changelogs doesn't reveal anything obvious to me about a change in behaviour, so I'm starting to wonder if it's a bug? Has anyone else come across this problem/change? Regards Tim

4 4

Rejected: Realm does not have at least one dot separator
by Mohamed Lrhazi 27 Jun '15

27 Jun '15

Hello, I am redeploying 3.0.8 on a new system using the same config files as my existing prod systems... but in the new system, I get this error... Username does have a dot in the realm... but the expression somehow fails... (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") { (0) EXPAND %{tolower:%{User-Name}} (0) --> *georgetown_test(a)eduroamus.edu <georgetown_test(a)eduroamus.edu>* (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) { (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) { (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) { (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) { (0) * if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> TRUE* (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) { (0) update reply { (0) Reply-Message += "*Rejected: Realm does not have at least one dot separator*" (0) } # update reply = noop (0) [reject] = reject (0) } # if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) = reject (0) } # policy filter_username = reject (0) } # authorize = reject (0) Using Post-Auth-Type Reject In the config, the rule looks like so: sudo grep -A4 -B5 -r "dot separator" /etc/raddb /etc/raddb/policy.d/filter- # must have at least 1 string-dot-string after @ /etc/raddb/policy.d/filter- # e.g. "user(a)site.com" /etc/raddb/policy.d/filter- # /etc/raddb/policy.d/filter- if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) { /etc/raddb/policy.d/filter- update reply { /etc/raddb/policy.d/filter: Reply-Message += "Rejected: Realm does not have at least one dot separator" /etc/raddb/policy.d/filter- } /etc/raddb/policy.d/filter- reject /etc/raddb/policy.d/filter- } /etc/raddb/policy.d/filter- Thanks, Mohamed.

2 4