- Freeradius-Users - lists.freeradius.org

config section in rlm_perl module
by Peter Balsianok 21 Apr '15

21 Apr '15

Hi, I am not able to use %RAD_PERLCONF during parsing phase of radius.pm. I understand why, because section config (rlm_perl) is parsed after parsing radius.pm itself. Therefore i am able to set up global constant based on freeradius configuration. Is it correct behaviour ? Piece of radius.pm code: ... # Hashes with request / reply parameters use vars qw(%RAD_PERLCONF %RAD_REQUEST %RAD_REPLY %RAD_CHECK %RAD_REQUEST_PROXY %RAD_REQUEST_PROXY_REPLY); use constant LOG_DIR => $RAD_PERLCONF{'logdir'}; (line 47) use constant LOG_FILENAME => LOG_DIR().$RAD_PERLCONF{'name'}.'.gen'; use constant RADIUS_RADDB_DIR => $RAD_PERLCONF{'confdir'}; ... Debug output (freeradius 3.0.7): .... radiusd: #### Instantiating modules #### instantiate { # Loaded module rlm_perl # Instantiating module "perl" from file ./mods-enabled/perl perl { filename = "./mods-config/perl/radius.pm" func_authorize = "authorize" func_authenticate = "authenticate" func_post_auth = "post_auth" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } Use of uninitialized value in concatenation (.) or string at ./mods-config/perl/radius.pm line 47, <DATA> line 751. rlm_perl (perl): parsing 'config' section... config { logdir = /app_log/radius/auth/ confdir = ./ name = auth } rlm_perl (perl): done parsing 'config'.

3 6

Documentation
by Alan DeKok 21 Apr '15

21 Apr '15

We've been working behind the scenes to create more documentation for the server. Every new version from 3.0.7 onwards will have new documentation added to the site http://networkradius.com/doc/. Documentation for the old versions will be archived, but not updated. We've added some more documentation for 3.0.8. More modules are there, and we've expanded / updated the documentation for the existing modules. I've also updated the main page on freeradius.org. Apparently the "documentation" tab in the page header was hard to find. I've added a section called "Documentation", and written text pointing to the various things available. Since the largest complaint is about concepts, the first link is to the technical guide available from Network RADIUS. I've also added links to "unlang" keywords, and to documentation for each module. The documentation for each module describes what the module does, which processing sections it can be used in, what values it returns, along with the configuration items it takes. It also points to the default configuration on github, for people who want worked examples. Many modules also include short examples in their documentation page. Astute readers will note that much of the new documentation is on the commercial site. The reality is that it takes months of effort and professional copy editing to get high-quality documentation. That investment was done by Network RADIUS, so that's where the documentation resides. The FreeRADIUS wiki is still available. It contains many "how to" guides, which serve a different purpose from the detailed configuration documentation. The wiki will continue to exist, and we will still accept any and all useful patches for documentation updates. However, the *detailed* documentation on unlang, modules, string expansions, debugging guides, etc. will only be on the commercial side. As head of Network RADIUS, I'm investing not only in developing more code for the server, I'm also investing in documentation for it, too. The commercial documentation is available for free, and will always be free. It's one more contribution I can make to the community. Alan DeKok.

6 5

Freeradius rate limit
by Fazal Ahmed Malik 21 Apr '15

21 Apr '15

Dear members, I am using freeradius with mikrotik nas. Mikrotik rate limit is not working rest all is working just fine. Mikrotik rate limit work fine with mikrotik builtin radius but when I shifted to freeradius no rate limit works. Any help is much appreciated. Thanks, FAM

3 2

How to find if the LDAP server is not rechable
by Adarsha S 21 Apr '15

21 Apr '15

Hi, I've a setup with freeradius-server-2.2.3 and Windows AD 2008 [LDAP server]for authentication. I need to implement fall back feature where if Windows AD server is not reachable , I need to authenticate using local database. The problem I'm facing is : When LDAP server is reachable and giving wrong password result is RLM_MODULE_REJECT. LDAP server not reachable the result is RLM_MODULE_FAIL. But for both the case reply code will be PW_AUTHENTICATION_REJECT. So please guide me in how to differentiate LDAP server not reachability from error due to wrong credentials. Thanks, Adarsha

3 4

Re: config section in rlm_perl module
by Peter Balsianok 21 Apr '15

21 Apr '15

On Tue, Apr 21, 2015 at 1:04 PM, Arran Cudbard-Bell < a.cudbardb(a)freeradius.org> wrote: > > > On 21 Apr 2015, at 11:11, Peter Balsianok <balsianok.peter(a)gmail.com> > wrote: > > > > Hi, > > > > You are not right. %RAD_PERLCONF is available also during > 'Instantiation'. > > Yeah, but that's still calling a perl subroutine, just without a request > pointer. > > > The question is: Would it be available also during compilation phase > (like > > radiusd::radlog) > > For that to work you'd need to get it into the perl environment as a > global, before parsing the perl file. It'd also have to be made constant to > prevent people from doing stupid things. > > I'll take a look at it and see if it's doable. > Config section (example) config { path = value } in freeradius will be created before parsing: use constant RAD_PERLCONF => { path => value }; then you can use it RAD_PERLCONF->{path} Of course, if it`s possible. > > I just... feel so dirty after looking at perl... or the embedding API... > or the documentation for the embedding API. It's like digging in to a big > bowl of chocolate pudding, to discover it's actually dog shit. > > You are right.

1 0

Problem with regular expression in huntgroups
by Angel L. Mateo 21 Apr '15

21 Apr '15

Hello, I'm migrating my current freeradius2 configuration to freeradius3. In my current FR2 configuration I have rules to check for huntgroups like: test_huntgroup NAS-IP-Address =~ ^10\.57\.1\.[0-9]+$ This same rule is not working in my FR3 configuration. Running FR in debug mode shows: .... (0) NAS-IP-Address = 10.57.1.50 (0) NAS-Identifier = 'RADIUS-PRUEBAS' (0) # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam (0) authorize { (0) preprocess: EXPAND /10\.57\.1\.[0-9]+$/ (0) preprocess: --> /10\.57\.1\.[0-9]+$/ (0) preprocess: EXPAND ^10\.57\.8\.[0-9]+$ (0) preprocess: --> ^10\.57\.8\.[0-9]+$ (0) preprocess: EXPAND ^10\.57\.14\.[0-9]+$ (0) preprocess: --> ^10\.57\.14\.[0-9]+$ ... (0) [preprocess] = ok ... but no huntgroup is assigned. I have tried putting the RE inside // with the same result. Any help? Thank you. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

3 5

Log control attributes
by Peter Balsianok 21 Apr '15

21 Apr '15

Hi, Is there any way how to log all control attributes via detail or linelog in the freeradius ? Thx.

3 4

Re: Freeradius-Users Digest, Vol 120, Issue 78
by Rui Ribeiro 21 Apr '15

21 Apr '15

Olá, I won't mind answering small questions in our mother tongue. Forward them to my email. If need be, we will talk by voice. Email is so much less disruptive. Regards On 20 April 2015 at 19:28, <freeradius-users-request(a)lists.freeradius.org> wrote: > > > Message: 1 > Date: Mon, 20 Apr 2015 18:22:36 +0430 > From: "ademaiasantos(a)gmail.com" <ademaiasantos(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: need a small help urgently > Message-ID: <553504A4.20000(a)gmail.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > perfect suggestion, > you have skype i have just some small question > or please add mine: skype: morteza.22603 > > Thanks, waiting for you. > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

SQL module question...
by Stefan Paetow 20 Apr '15

20 Apr '15

So, I know that there've been several changes to how the sql module loads. On one site, there is only one query, in a sql xlat, and the question is now about an error that the site is getting: (14) sql: EXPAND .query (14) sql: --> .query No such configuration item .query Granted, all table entries and the '$INCLUDE' for query.conf were commented out on the basis that only the sql xlat would be used, but why would the xlat still be looking for the 'post-auth.query' entry in the sql module (or the query.conf for that matter)? We've gotten around it by defining a 'post-auth { query = "select * from ..." }' line in the sql module to make it happy, but it seems to me that if you use a sql xlat, and there is no other call to 'sql' or '-sql' in the post-auth section, it shouldn't be looking for the post-auth.query string... Thoughts? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

2 2

sql authorize with password and mac
by Marcin 20 Apr '15

20 Apr '15

Hi, I've that config for query: #v+ authorize_check_query = "SELECT \ id, lower(name) as UserName , 'Cleartext-Password' as Attribute , passwd as Value, ':=' as op \ FROM nodes \ WHERE name = '%{User-Name}'\ UNION \ SELECT n.id, lower(name) as UserName, 'Calling-Station-Id' as Attribute, upper(mac) as Value, ':=' as op FROM \ nodes n, macs m \ WHERE lower(name) = '%{User-Name}' and access=1 AND n.id = m.nodeid \ UNION \ SELECT id, lower(name) as UserName , 'Simultaneous-Use' as Attribute, '1' as Value, ':=' as op \ FROM nodes \ WHERE name = '%{User-Name}'\ ;" #v- callint station id from database doesn't contain proper mac, but authorization is accepted #v+ (0) Received Access-Request Id 100 from 172.21.7.176:43226 to 172.21.7.175:1812 length 145 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) NAS-Port = 15728670 (0) NAS-Port-Type = Ethernet (0) User-Name = 'serwis' (0) Calling-Station-Id = '08:00:27:D6:04:2D' (0) Called-Station-Id = 'MtekPPPoE' (0) NAS-Port-Id = 'bridge1' (0) CHAP-Challenge = 0xc2d72642e5e288f7079288c64afa13bb (0) CHAP-Password = 0x0140f664ed644130bfdf53268c444c8382 (0) NAS-Identifier = 'TestowyMT' (0) NAS-IP-Address = 172.21.7.176 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) chap: &control:Auth-Type := CHAP (0) [chap] = ok (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "serwis", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) redundant (null) { (0) sqlms: EXPAND %{User-Name} (0) sqlms: --> serwis (0) sqlms: SQL-User-Name set to 'serwis' rlm_sql (sqlms): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sqlms): Opening additional connection (0), 1 of 10 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='lms' host='172.21.7.29' port=5432 user='user' password='pass' Connected to database 'lms' on '172.21.7.29' server version 90401, protocol version 3, backend PID 17929 rlm_sql (sqlms): Reserved connection (0) (0) sqlms: EXPAND SELECT id, lower(name) as UserName , 'Cleartext-Password' as Attribute , passwd as Value, ':=' as op FROM nodes WHERE name = '%{User-Name}' UNION SELECT n.id, lower(name) as UserName, 'Calling-Station-Id' as Attribute, upper(mac) as Value, ':=' as op FROM nodes n, macs m WHERE lower(name) = '%{User-Name}' and access=1 AND n.id = m.nodeid UNION SELECT id, lower(name) as UserName , 'Simultaneous-Use' as Attribute, '1' as Value, ':=' as op FROM nodes WHERE name = '%{User-Name}' ; (0) sqlms: --> SELECT id, lower(name) as UserName , 'Cleartext-Password' as Attribute , passwd as Value, ':=' as op FROM nodes WHERE name = 'serwis' UNION SELECT n.id, lower(name) as UserName, 'Calling-Station-Id' as Attribute, upper(mac) as Value, ':=' as op FROM nodes n, macs m WHERE lower(name) = 'serwis' and access=1 AND n.id = m.nodeid UNION SELECT id, lower(name) as UserName , 'Simultaneous-Use' as Attribute, '1' as Value, ':=' as op FROM nodes WHERE name = 'serwis' ; (0) sqlms: Executing select query: SELECT id, lower(name) as UserName , 'Cleartext-Password' as Attribute , passwd as Value, ':=' as op FROM nodes WHERE name = 'serwis' UNION SELECT n.id, lower(name) as UserName, 'Calling-Station-Id' as Attribute, upper(mac) as Value, ':=' as op FROM nodes n, macs m WHERE lower(name) = 'serwis' and access=1 AND n.id = m.nodeid UNION SELECT id, lower(name) as UserName , 'Simultaneous-Use' as Attribute, '1' as Value, ':=' as op FROM nodes WHERE name = 'serwis' ; rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 3 , fields = 5 (0) sqlms: User found in radcheck table (0) sqlms: Conditional check items matched, merging assignment check items (0) sqlms: Cleartext-Password := 'serwis*' (0) sqlms: Simultaneous-Use := 1 (0) sqlms: Calling-Station-Id := '00:02:2D:8B:67:C3' (0) sqlms: EXPAND SELECT id, lower(name) as UserName , 'Framed-IP-Address' as Attribute, inet_ntoa(ipaddr) as Value, '=' as op FROM nodes WHERE name = '%{User-Name}' UNION SELECT id, lower(name) as UserName , 'Acct-Interim-Interval' as Attribute , '300' as Value, '=' as op FROM nodes WHERE name='%{User-Name}'; (0) sqlms: --> SELECT id, lower(name) as UserName , 'Framed-IP-Address' as Attribute, inet_ntoa(ipaddr) as Value, '=' as op FROM nodes WHERE name = 'serwis' UNION SELECT id, lower(name) as UserName , 'Acct-Interim-Interval' as Attribute , '300' as Value, '=' as op FROM nodes WHERE name='serwis'; (0) sqlms: Executing select query: SELECT id, lower(name) as UserName , 'Framed-IP-Address' as Attribute, inet_ntoa(ipaddr) as Value, '=' as op FROM nodes WHERE name = 'serwis' UNION SELECT id, lower(name) as UserName , 'Acct-Interim-Interval' as Attribute , '300' as Value, '=' as op FROM nodes WHERE name='serwis'; rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 (0) sqlms: User found in radreply table, merging reply items (0) sqlms: Acct-Interim-Interval = 300 (0) sqlms: Framed-IP-Address = 192.168.168.254 rlm_sql (sqlms): Released connection (0) rlm_sql (sqlms): 0 of 1 connections in use. Need more spares rlm_sql (sqlms): Opening additional connection (1), 1 of 9 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='lms' host='172.21.7.29' port=5432 user='user' password='pass' Connected to database 'lms' on '172.21.7.29' server version 90401, protocol version 3, backend PID 17930 (0) [sqlms] = ok (0) } # redundant (null) = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = CHAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type CHAP { (0) chap: Comparing with "known good" Cleartext-Password (0) chap: CHAP user "serwis" authenticated successfully (0) [chap] = ok (0) } # Auth-Type CHAP = ok (0) # Executing section session from file /etc/freeradius/sites-enabled/default (0) session { (0) radutmp: EXPAND /var/log/freeradius/radutmp (0) radutmp: --> /var/log/freeradius/radutmp (0) radutmp: EXPAND %{User-Name} (0) radutmp: --> serwis (0) [radutmp] = ok (0) } # session = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 100 from 172.21.7.175:1812 to 172.21.7.176:43226 length 0 (0) Acct-Interim-Interval = 300 (0) Framed-IP-Address = 192.168.168.254 (0) Finished request Waking up in 4.9 seconds. #v- Why authorization is ok when calling station is different from database? -- Pozdrawiam Marcin / nicraM

2 2