- Freeradius-Users - lists.freeradius.org

Fwd: Shell script execution
by mdii 17 Apr '15

17 Apr '15

Hello, I'm trying to add a shell script value into a variable to use it in the server response. To do it, I add the following line to my /sites-available/default file (in the post-proxy section) : Filter-Id := `/usr/sbin/ldap_get_group_info.sh %{User-name}` > But nothing that happens. If I use Filter-Id := `test 123` > I end up with the message "test 123". My Freeradius version is *freeradius-2.1.12-6.el6.x86_64* and I'm running it on Redhat 6.6. My script turns ok when I run it directly from a command line. The script code is : #! /bin/bash > > userDN=$(ldapsearch -h 10.2.0.86 -D "cn=Administrator,cn=Users,dc=domain,dc=fr" > -w "pp" -b "dc=domain,dc=fr" -p 389 "(&(mail=$1)(objectClass=user))" cn > -LLL | grep "dn: ") > userDN=$(echo $userDN | sed "s/dn: //g") > > echo "userDN = $userDN" >> /tmp/test > > var=$(ldapsearch -h 10.2.0.86 -D "cn=Administrator,cn=Users,dc=domain,dc=fr" > -w "pp" -b "dc=domain,dc=fr" -p 389 -z 1 > "(&(member=$userDN)(cn=vpn_*)(objectClass=group))" cn -LLL | grep "cn: ") > > > vpn_cn=$(echo "$var" | sed "s/cn: //g") > ret=$(ldapsearch -h 10.2.0.86 -D > "cn=Administrator,cn=Users,dc=domain,dc=fr" -w "pp" -b "dc=domain,dc=fr" > -p 389 "(cn=$vpn_cn)" info -LLL | grep "info") > > attr=$(echo $ret | sed "s/info: //g") > echo "return attribute = $attr" >> /tmp/test > echo "$attr" > I also did the following tests (test -> result) Filter-Id := '/usr/sbin/ldap_get_group_info.sh %{User-name}' -> > /usr/sbin/ldap_get_group_info.sh %{User-name} > Filter-Id := "/usr/sbin/ldap_get_group_info.sh %{User-name}" -> > /usr/sbin/ldap_get_group_info.sh monUserTest > Filter-Id := /usr/sbin/ldap_get_group_info.sh %{User-name} -> > /usr/sbin/ldap_get_group_info.sh > Does someone knows why it doesn't work? Is there a way to enable some logs to see why it doesn't work? Thanks in advance for your help, Marc

9 27

Failed to create the pair: Unknown attribute Max-All-Session
by Sergio Diaz 17 Apr '15

17 Apr '15

Hello guys This is my first post. I hope i can explain my problem. I have a FreeRADIUS Version 2.1.12 with mysql db I have a hotspot with coova chilli devices like Access point (open-mesh with cloud controller cloudtrax), everything Works fine except with the attribute" Max-All-Session" in the radcheck table, when i put this attribute the users can't authenticate, if i delete this attribute users can authenticate. I need limit a user access period for 1 day ,1 hour or 1 week from his first time he login using a prepaid card. This user never has been authenticated, so he haven't registry in the radacct table Id username attribute op value 2262 a1z5 Auth-Type := Accept 2263 a1z5 Simultaneous-Use := 1 2264 a1z5 Max-All-Session := 3600 Even if i use other attribute like: Expiration it works with out problem. Id username attribute op value 5 42h7 Auth-Type := Accept 1017 42h7 Expiration == May 8 2014 11:56:01 1018 42h7 Simultaneous-Use := 1 In my debug i see this error, i hope you can help me. rlm_sql: Failed to create the pair: Unknown attribute "Max-All-Session" requires a hex string, not "3600" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 11 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} Ready to process requests. rad_recv: Access-Request packet from host 192.16.1.6 port 57160, id=68, length=301 ChilliSpot-Version = "1.2.8" User-Name = "a1z5" CHAP-Challenge = 0x29e1cac347609050f7fd312c10cbd7e0 CHAP-Password = 0x0052b8ddaf303a9513c3ed41b81e0bf852 Service-Type = Login-User Acct-Session-Id = "552d462f00000002" Framed-IP-Address = 10.255.216.9 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "40-0E-85-30-B9-03" Called-Station-Id = "AC-86-74-1D-9B-F0" NAS-IP-Address = 10.255.216.1 NAS-Identifier = "AP2" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova,Wicoin_Test" WISPr-Location-Name = "Wicoin_Test" WISPr-Logoff-URL = "http://10.255.216.1:3990/logoff" Message-Authenticator = 0x979323917417ff7a0c783751a8ff8223 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++- entering policy filter_username {...} +++? if (User-Name =~ /^ /) ? Evaluating (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ / $$/) ? Evaluating (User-Name =~ / $$/) -> FALSE +++? if (User-Name =~ / $$/) -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") expand: %{User-Name} -> a1z5 expand: %{tolower:%{User-Name}} -> a1z5 ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE ++- policy filter_username returns notfound [preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "a1z5", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> a1z5 [sql] sql_set_user escaped user --> 'a1z5' rlm_sql (sql): Reserving sql socket id: 11 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'a1z5' ORDER BY id rlm_sql: Failed to create the pair: Unknown attribute "Max-All-Session" requires a hex string, not "3600" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 11 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> a1z5 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 68 to 192.16.1.6 port 57160 Waking up in 4.9 seconds. Cleaning up request 2 ID 68 with timestamp +57 Ready to process requests. Saludos Cordiales, Sergio Diaz

3 8

forward authentication, but take reply attributes from local db
by Vld 16 Apr '15

16 Apr '15

Hello! Lets say i have primary radius server with users in file. And i also have secondary one, with the same users (logins and passwords are the same). How do i forward/proxy access-request from primary to secondary and in case it sends back access-accept to primary - it takes user attributes from local database (of primary). No just return to NAS what secondary gave me, but rewrite it according to local config. The main goal of secondary - just either accept or reject user. is it even possible?

3 4

authentication question
by john espiro 16 Apr '15

16 Apr '15

I installed my certs on my Android phones... it asked for the password for the key, andI was off... just set it to 802.1x TLS and it worked. Now, on my Nook Color, I was able to add my cert, but this time, it only let me choose 802.1x EAP. That's fine I thought, but then it was looking for a username/password for a user in my MySQL database on the radius server. That's fine with me too, but I am trying to understand why that one device was the only one that wanted a username/password.

1 0

Alternative to ClientLogin for Google Apps authentication?
by Daniel Smith 16 Apr '15

16 Apr '15

Hi, My organization has a FreeRADIUS server set up to authenticate wifi users with their Google Apps email address and generated app password. It accepts them over EAP in plain text and then runs them against the ClientLogin API in a perl script. Google has deprecated ClientLogin and is cutting it off in April this year. I have consulted with a couple cloud radius providers and they say they can keep this system working as it currently does - users create a Google app password, sign into the WiFi network with it, and they get on the network. This is ideal since we can just direct our existing server's IP to the cloud provider, and our hundreds of clients keep working without a single change. Is there any way FreeRADIUS can authenticate against Google with an app password, without ClientLogin being around anymore? I looked into OAuth2 but it looks like that will require all existing clients to manually sign in again and change details, since it'll require interaction to create the first refresh token. A horrifying other option is to start caching user's passwords on the radius server as they are successfully authenticated, so that we have their working config stored, then when Google cuts off the API we authenticate users against a local database of those stored passwords, manually adding/disabling new/old ones for any user changes. Ugly, insecure, and broken. Any advice? Thanks, Dan

3 7

FreeRadius 3.0.3 instantly segfaults (SLES11SP3)
by Thomas Stather 16 Apr '15

16 Apr '15

Hi I am in the process of setting up a mac auth configuration but when i tried to start i instantly get a segfault. The OS is SLES11SP3, the version pulled from the Software repository is 3.0.3 Heres the output: radius1:/etc/raddb/mods-enabled # radiusd -X radiusd: FreeRADIUS Version 3.0.3, for host x86_64-suse-linux-gnu, built on May 26 2014 at 23:41:11 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/pap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/filter including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/macauthtest main { security { allow_core_dumps = no } } main { name = "radiusd" Segmentation fault Is there anything i can do to troubleshoot this? Best, Thomas -- Thomas Stather IT Services Tel: +49 6221-486 628 Fax: +49 6221-486 561 ------------------------------------------------------------------------ Max Planck Institute for Medical Research (MPImF) Jahnstrasse 29, 69120 Heidelberg Germany

6 9

DHCP-Hostname + module/dhcp
by Jorge Pereira 15 Apr '15

15 Apr '15

Hi, I have searched about the modules/dhcp and i know that don't have many information about that... only the example in [1] wasn't enough for understand and uses it. btw, in my env i receive during "Access-Request" all packets sent from the UE to my BRAS (Alcatel 7750) like the packet below. Alc-ToServer-Dhcp-Options = 0x350103 Alc-ToServer-Dhcp-Options = 0x37090103060f775ffc2c2e Alc-ToServer-Dhcp-Options = 0x390205dc Alc-ToServer-Dhcp-Options = 0x3d0701facafaca0002 Alc-ToServer-Dhcp-Options = 0x3204c0a87b0b Alc-ToServer-Dhcp-Options = 0x3604c0a87bfe Alc-ToServer-Dhcp-Options = 0x0c0d4a6f7267652d50657265697261 the point is: someone here could give me some suggestion about the best way to parse this informations? e.g: The last item is the "hostname" of client (0x0c=12 as described in the rfc[2]) Maybe the module can't be the best solution for this and thinking something like a foreach() the list and fill in the fields. in this case DHCP-Hostname.... it's possible? someone have suggestions? [1] http://freeradius.org/features/dhcp.html [2] https://www.ietf.org/rfc/rfc2132.txt - section 3.14 warm regards, -- Jorge Pereira

2 4

problems with CoA post-proxy & switch
by Jorge Pereira 15 Apr '15

15 Apr '15

Hi, I am trying to use the below configuration, but never is reached... someone have suggestions? 87 post-proxy { 88 switch &proxy-reply:Packet-Type { 89 case CoA-ACK { 90 ok 91 } 92 93 case CoA-NAK { 94 # the NAS didn't like the CoA request 95 ok 96 } 97 98 case Disconnect-ACK { 99 ok 100 } 101 102 case Disconnect-NAK { 103 # the NAS didn't like the Disconnect request 104 ok 105 } 106 107 # Invalid packet type. This shouldn't happen. 108 case { 109 ok 110 #fail 111 } 112 } 113 114 # 115 # These methods are run when there is NO response 116 # to the request. 117 # 118 Post-Proxy-Type Fail-CoA { 119 ok 120 } 121 } -- Jorge Pereira

2 2

cidr cast
by Peter Balsianok 15 Apr '15

15 Apr '15

Hi, May i use cid cast also for NAP-IP-Address ? if (<cidr>&NAS-IP-Address == 192.168.0.0/24) { update request { } >From change log 3.0.x: One useful thing which i'm not sure Alan has implemented yet is: if (<cidr>&Framed-IP-Address == 192.168.0.0/24) { } I

5 6

unlang
by Peter Balsianok 15 Apr '15

15 Apr '15

Hi, I have following unlang code in the preacct section update request { Calling-Station-Id := "%{%{string:Class}:-%{Calling-Station-Id}}" } If my packet does not contain Class attribut, i expect that Calling-Station-Id will not change. (0) Received Accounting-Request Id 109 from 127.0.0.1:55999 to 127.0.0.1:1813 length 429 (0) NAS-Port-Type = Virtual (0) Framed-Pool = 'BDSLpool' (0) Acct-Input-Octets-64 = 135967391 (0) Called-Station-Id = 'orangenet' (0) Acct-Status-Type = Interim-Update (0) Connect-Info = '1000000000/1000000000' (0) Acct-Output-Packets = 1476063 (0) Framed-IP-Netmask = 255.255.255.255 (0) NAS-IP-Address = 213.151.237.216 (0) Acct-Output-Octets = 1196651182 (0) Qos-Policing-Profile-Name = 'in512K' (0) Acct-Session-Time = 2400 (0) Medium-Type = DSL (0) User-Name = '0200000005(a)orangenet.sk' (0) NAS-Identifier = 'N-001-BA-BAS-10' (0) Framed-IP-Address = 178.143.0.156 (0) Acct-Input-Packets = 514504 (0) Acct-Output-Octets-64 = 1196651182 (0) Acct-Input-Octets = 135967391 (0) Acct-Session-Id = 'FF10FFFF58000253-4F01A67C' (0) Acct-Output-Gigawords = 0 (0) Service-Type = Framed-User (0) Acct-Update-Reason = AAA-LOAD-ACCT-PERIODIC (0) Acct-Authentic = RADIUS (0) NAS-Port-Id = 'L2TP LNS 595' (0) Qos-Metering-Profile-Name = 'down12288K' (0) Acct-Input-Packets-64 = 514504 (0) Context-Name = 'INET' (0) Calling-Station-Id = '421905000001' (0) Framed-Protocol = PPP (0) Event-Timestamp = 'Jan 2 2012 14:23:41 CET' (0) Acct-Tunnel-Connection = 'LNS1:4945:9576' (0) Acct-Input-Gigawords = 0 (0) Qos-Policy-Queuing = 'pwfq12288K' (0) NAS-Port = 2432696915 (0) Acct-Output-Packets-64 = 1476063 (0) # Executing section preacct from file ../../raddb/auth/sites-enabled/default (0) preacct { (0) [preprocess] = ok ... (0) update request { (0) EXPAND %{%{string:Class}:-%{Calling-Station-Id}} (0) --> (0) Calling-Station-Id := "" ... But Calling-Station-Id is empty. Thank you for help.

3 2