- Freeradius-Users - lists.freeradius.org

Version 3 ldap Generic
by Cody Ritts 14 Oct '14

14 Oct '14

Hello, I am upgrading from FR 1.1 to 3.0.4. I am struggling to understand the the syntax for upgrading my $GENERIC$ statement. I have only found 3 threads discussing, which I did non fully understand, and am not sure they covered my problem. In my old ldap.attrmap I have the following lines: > replyItem Framed-IP-Address dslIPAddress > replyItem Idle-Timeout dslIdleTimeout > replyItem $GENERIC$ dslACLin > replyItem $GENERIC$ dslACLout > replyItem $GENERIC$ dslINSPECTin > replyItem $GENERIC$ dslINSPECTout > replyItem $GENERIC$ dslStatus The example ldap contents of dslACLin and dslACLout are: > dslACLin: cisco-avpair += "ip:inacl=OUTBOUND" > dslACLout: cisco-avpair += "ip:outacl=FIREWALL" So, in my mods-enabled/ldap, when I added: > valuepair_attribute = "dslACLin" In my radtest reply, I do get a: > Cisco-AVPair = "ip:inacl=OUTBOUND" But based on one of the other threads and the way that it is configured, I will assume that "valuepair_attribute =" is only good once? Good news for me however, down at the bottom of update{} I see the following. > # These are provided for backwards compatibility. > # Where only a list is specified as the RADIUS attribute, > # the value of the LDAP attribute is parsed as a valuepair > # in the same format as the 'valuepair_attribute' (above). > # control: += 'radiusCheckAttributes' > # reply: += 'radiusReplyAttributes' so I add: > reply: += 'dslACLout' Then radiusd -X gets: >> /usr/local/etc/raddb/mods-enabled/ldap[85]: Invalid source for list '+=' so I try :=, and = with the same. To be honest, I dont know what the source list is. After reading man unlang I see that there is "update <list>" but then again, it says right above the block that this is not a unlang update format so, I am still lost. So I try this: > reply:Cisco-AVPair += 'dslACLout' And the server will start, but it does not parse out the avpair, this is the radius reply: > Cisco-AVPair = "cisco-avpair += \"ip:outacl=FIREWALL\"" So I dont know what I am doing wrong there, but I also bear in mind that this is just a "compatibility" feature, so when that gets dropped I will still be in the same spot. That makes me wonder about how I should have done that in the first place. I suppose I used GENERIC because it was in the same file as the other attributes, I tried it and it worked. Is there a "more correct" way of doing that for long term support? Like creating dictionary entries for those attributes then map them? Also, as an interim solution until I can update my schema and management applications, if I add dslACLout to the dictionary, and map it, then is it possible to use unlang and regex in post-auth/"update reply" to parse "cisco-avpair +=" out of dslACLout and then add it back in as cisco-avpair? Thanks in advance any help, Cody

2 4

Rlm_sqlippool with Simultaneous-Use > 1
by Amir Tal 14 Oct '14

14 Oct '14

Using freeradius-2.2.5-1.centos6.x86_64. Accounting data in mysql, IP pools in psql. Is it possible to use rlm_sqlippool with Simultaneous-Use > 1 ? Currently on second connection user is assigned same IP, causing a conflict on client side. Is it possible to add some other unique parameter to allow to assign multiple IPs for duplicate connections from same user? (assuming the two sessions are registered correctly in accounting DB) Amir.

2 1

FreeRadius 3.0.3 module thread safety
by Dejan Markic 14 Oct '14

14 Oct '14

Hello! I've written a module for FreeRadius currently running on version 3.0.3. I must admit, I have a very limited understanding about the thread safety in regards to modules. I register module as RLM_TYPE_THREAD_SAFE and in my instantiate function I load several MySQL database instances and some other instances. So they are all in rlm_MYMODULE_t instance stuct. Do I understand correctly, that if RLM_TYPE_THREAD_SAFE is used, this module instance struct might be used in different threads even tough I define only 4 instances, and 4 instances are created? So to put it in another way, I have four instances that might be used by 8 threads simultaneously? I now protect each instance with a mutex and sometimes it happens, that one instance gets the reply from our service with a bit of delay and then that instance mutex stays locked for >0.2 second and an avalanche effect occours. I guess three instances are working normaly, but one gets slowed down with each additional request, since it waits for that same mutex. Is that correct? Thank you very much for your replies. Kind regards, Dejan Markic

2 1

Re: Beginner help
by KAVYA PRABHAKAR 14 Oct '14

14 Oct '14

Hi, I am trying to setup radsec using freeradius version 3.0.3. I have generated self-signed certificate on my freeradius server using openssl commands. I generates .pem and .pfx certificate. I have placed the same files in certs folder of raddb and edited tls file respectively. Command to send radius request: radtest test 456 localhost 2083 testing123 When I run the above command I could see that request is going on 1812 port. Then i checked netstat command to check ports opened for radiusd. TCP port 2083 is not opened. How to open up TCP port and any extra parameters needs to be present in radtest command? Thanks, Kavya

2 1

Re: Cert validation on Android platforms
by Alan Buxey 13 Oct '14

13 Oct '14

Seems that one part of android dev doesn't talk to another part as if you use a private CA with recent releases you get a 'your network may be monitored' message which you can either just ignore/clear every time you restart your phone or remove the CA and don't validate your remote server!!! :( alan

1 0

Cert validation on Android platforms
by Arran Cudbard-Bell 13 Oct '14

13 Oct '14

I know a lot of people on here run WPA2-Enterprise and may be surprised to hear that it is currently not possible to configure the supplicant on Android devices to validate the CN in cert presented by the server. Maybe someone could poke the correct person at google and get this fixed: https://code.google.com/p/android/issues/detail?id=37178 Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2

FW: service messages
by Franks Andy (RLZ) IT Systems Engineer 13 Oct '14

13 Oct '14

Hi again, Got a bit trigger happy on the email - testing this works fine - I added my service_messages to ${raddbdir} and it worked ok. Whereabouts is this documented - wondering on how far the scope goes.. Thanks Andy From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Franks Andy (RLZ) IT Systems Engineer Sent: 13 October 2014 17:00 To: freeradius-users(a)lists.freeradius.org Subject: service messages Hi all, Is the v2 functionality of service_messages etc (under the logging bit of radiusd.conf) in v3? I'd like to configure some standard error messages to be in one place and refer to them in policies etc without having to dig out where they are at.. Something like service_messages { # invalid mac address mac_address_incorrect = "the mac address format is invalid" } Then in policies etc Reply-Message := "${service_messages.mac_address_incorrect}" That sort of thing. Am I missing some obvious documentation somewhere? Apologies if so. Thanks Andy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

service messages
by Franks Andy (RLZ) IT Systems Engineer 13 Oct '14

13 Oct '14

Hi all, Is the v2 functionality of service_messages etc (under the logging bit of radiusd.conf) in v3? I'd like to configure some standard error messages to be in one place and refer to them in policies etc without having to dig out where they are at.. Something like service_messages { # invalid mac address mac_address_incorrect = "the mac address format is invalid" } Then in policies etc Reply-Message := "${service_messages.mac_address_incorrect}" That sort of thing. Am I missing some obvious documentation somewhere? Apologies if so. Thanks Andy

1 0

When is 2.26 available?
by Alex Sharaz 13 Oct '14

13 Oct '14

Hi, Thought I'd seen a message saying that 2.26 was going to be available but haven't seen anything appearing in the downloads section of the web site. Has this been shelved? Rgds Alex

3 2

Radmin query
by Himanshu Pandey 13 Oct '14

13 Oct '14

Hi, While printing statistics using radmin I saw following statistics: elapsed.1us elapsed.10uselapsed.100uselapsed.1ms...... Please tell me what elapsed is doing and which elapsed time it is showing us. Also, please tell me that while setting radius proxy servers which talks to main radius server,where do we have to include main radius server ip in radius proxy servers conf that is in which file.  Regards,Himanshu From: Alan DeKok <aland(a)deployingradius.com> Sent: Mon, 13 Oct 2014 01:43:33 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: [SOLVED] LDAP bind user authentication Stefan Paetow wrote: > Good question… I guess it would make sense to remove it… Arran? Alan? Am happy to send a patch to add both bits into the next release… :-)  You can still list "ldap" in the "authenticate" section.  It works. That functionality won't be removed.  What was removed was the *automatic* setting of Auth-Type := LDAP. That worked sometimes, but was often wrong.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0