- Freeradius-Users - lists.freeradius.org

rlm_cache
by BALSIANOK, Peter 03 Sep '14

03 Sep '14

Hi, Is it possible to use rlm_cache for storing all attributes (request, control & reply list) ? Somethink like update { request:ANY += &request:ANY control:ANY += &control:ANY reply:ANY += &reply:ANY } Peter

2 1

Clients not tied to a virtual server when loaded from a MySQL database
by Kev Pearce 02 Sep '14

02 Sep '14

Hi all, I'm trying to load my clients from a MySQL database and wish to 'tie' them to specific virtual servers. Using the default SQL nas table query, I get the following: rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Read entry nasname=1.1.1.1,shortname=1.1.1.1,secret=testing111 rlm_sql (sql): Adding client 1.1.1.1 (1.1.1.1, server=vs1) to clients list rlm_sql (sql): Read entry nasname=1.1.1.1,shortname=1.1.1.1,secret=testing222 rlm_sql (sql): Adding client 1.1.1.1 (1.1.1.1, server=vs2) to clients list Failed to add duplicate client 1.1.1.1 rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): Failed to add client 1.1.1.1 (1.1.1.1) to clients list. Maybe there's a duplicate? Failed to load clients from SQL. FR is clearly seeing the separate virtual server names (vs1 and ns2) but it says there's a duplicate. Now yes they do have the same IP address but they are tied to different virtual servers, making them different client definitions. If I manually place a 1.1.1.1 client inside my server vs1 block and the same in my server vs2 block, it loads them separately just fine, which is great and exactly what I'm after but I wish to load them from sql. Is it possible to have clients 'tied' into separate virtual servers like this from sql on start up? I'm also using a dynamic_clients definition inside the virtual server and this is loading 'duplicate' entries into separate virtual servers perfectly, but I guess that's because the dynamic_clients client definition is actually already inside the virtual server block. This works great but I can't get the loading on start up working from the nas table query as well. (I did notice the dynamic _clients sql query for the server is not even called, I'm presuming because it is already inside a virtual server block, it doesn't need to fire at all.) I'm running FR v2.2.5. Cheers very much all, Kev/.

2 3

Logging Accounting Packets
by J Kephart 02 Sep '14

02 Sep '14

Hello, all! We've running FreeRADIUS v2.1.12, and we're seeing some rather odd behavior. We have two problems we're trying to address. The first is that we see instances in which we have successful authentications, but for which no accounting message is ever logged, despite receiving accounting requests from the client device. In addition, packet captures show that we do, in fact, get the accounting request, but radius is not replying to it. What might cause that? The second issue is also related to the accounting process. What we believe right now is that, at some points, often right around midnight (US/Eastern), we're getting flooded with accounting packets from client devices, many of which are seriously outdated (or duplicates, or both). We originally thought that we might have an errant cron event that ran around that time, but we've checked all of those, and they only take seconds to run, so that doesn't seem to explain it. Unfortunately, while we've found all sorts of documentation on how to log access requests, we seem unable to find anything on logging accounting requests, other than those that are logged in the detail files, etc., after a successful request. What we'd like to see is some way of logging, in radius.log, for example, accounting requests, whether successful or not. We don't need all of the details, necessarily, just a means of noting that the request came in and from where (IP). Regardless, what we're trying to prove or disprove is the flood theory, and we need an unattended means of collecting the data. I'd appreciate any insight into these. Thanks, Jim

2 1

Correct login in TLS tunnel, but rejected
by Thomas Hermarij Maimann Andersen 02 Sep '14

02 Sep '14

Hi, We have +3000 users on our wifi setup using freeradius. A few users have problems logging from their personal computers where we have setup wifi with cat.eduroam.org. So we are confident that the wifi profile is correct. However when they login we get the following in the radius log Sep 2 11:34:41 server radiusd[20048]: Login OK: [xuser/<via Auth-Type = EAP>] (from client aerohive-net port 0 via TLS tunnel) Sep 2 11:34:41 server radiusd[20048]: Login OK: [xuser/<via Auth-Type = EAP>] (from client aerohive-net port 0 via TLS tunnel) Sep 2 11:34:41 server radiusd[20048]: Login incorrect: [xuser/<via Auth-Type = EAP>] (from client aerohive-net port 0 cli 90-48-9A-69-XX-XX) Sep 2 11:34:41 server radiusd[20048]: Login incorrect: [xuser/<via Auth-Type = EAP>] (from client aerohive-net port 0 cli 90-48-9A-69-XX-XX) The same user, on the same radio, on a different computer can login fine. So I am sure it’s a problem with the computer setup. Can anyone explain to me what the difference is and possibly why it would fail? -- With best regards Thomas Andersen

2 1

radius logging
by Khapare Joshi 02 Sep '14

02 Sep '14

my users are authenticating against AD that means samba+winbind. In my radius log I see login ok but logs as Domain\\username how can I change this so only Login OK: [testuser] from client ....... ---radius.log Aug 28 16:00:05 server1 radiusd[26044]: Login OK: [BILL\\testuser] (from client 192.168.1.1 port 1 cli bb1855t4vv68 via TLS tunnel) Aug 28 16:00:05 server1 radiusd[26044]: Login OK: [BILL\\testuser] (from client 192.168.1.1. port 1 cli bb1855t4vv68)

2 3

Problem with policy.d/filter
by BALSIANOK, Peter 02 Sep '14

02 Sep '14

Hi, Could you please fix this problem. Thx I have also change regular expresion from /@|\\/ to /@|\/ in the policy.d/filter file (without sucess, i got another error) radiusd: FreeRADIUS Version 3.0.3, for host i686-pc-linux-gnu, built on Aug 29 2014 at 21:00:42 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /mnt/sdcard/software/freeradius-server-3.0.3/share/freeradius/dictionary including dictionary file /mnt/sdcard/software/freeradius-server-3.0.3/share/freeradius/dictionary.dhcp including dictionary file /mnt/sdcard/software/freeradius-server-3.0.3/share/freeradius/dictionary.vqp including dictionary file ./dictionary including configuration file ./radiusd.conf including configuration file ./proxy.conf including configuration file ./clients.conf including files in directory ./mods-enabled/ including configuration file ./mods-enabled/digest including configuration file ./mods-enabled/pap including configuration file ./mods-enabled/detail including configuration file ./mods-enabled/cache including configuration file ./mods-enabled/detail.log including configuration file ./mods-enabled/attr_filter including configuration file ./mods-enabled/chap including configuration file ./mods-enabled/linelog including configuration file ./mods-enabled/expr including configuration file ./mods-enabled/preprocess including configuration file ./mods-enabled/realm including configuration file ./mods-enabled/unpack including configuration file ./mods-enabled/files including configuration file ./mods-enabled/always including files in directory ./policy.d/ including configuration file ./policy.d/cui including configuration file ./policy.d/control including configuration file ./policy.d/filter including configuration file ./policy.d/eap including configuration file ./policy.d/nas including configuration file ./policy.d/accounting including configuration file ./policy.d/dhcp including configuration file ./policy.d/operator-name including configuration file ./policy.d/canonicalization including files in directory ./sites-enabled/ including configuration file ./sites-enabled/default main { name = "radiusd" prefix = "/mnt/sdcard/software/freeradius-server-3.0.3" localstatedir = "/mnt/sdcard/software/freeradius-server-3.0.3/var" sbindir = "/mnt/sdcard/software/freeradius-server-3.0.3/sbin" logdir = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius" run_dir = "/mnt/sdcard/software/freeradius-server-3.0.3/var/run/radiusd" libdir = "/mnt/sdcard/software/freeradius-server-3.0.3/lib" radacctdir = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/mnt/sdcard/software/freeradius-server-3.0.3/var/run/radiusd/radiusd.pid" checkrad = "/mnt/sdcard/software/freeradius-server-3.0.3/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_digest # Instantiating module "digest" from file ./mods-enabled/digest # Loaded module rlm_pap # Instantiating module "pap" from file ./mods-enabled/pap pap { normalise = yes } # Loaded module rlm_detail # Instantiating module "detail" from file ./mods-enabled/detail detail { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_cache # Instantiating module "cache" from file ./mods-enabled/cache cache { key = "%{User-Name}" ttl = 10 max_entries = 16384 epoch = 0 add_stats = no } # Instantiating module "auth_log" from file ./mods-enabled/detail.log detail auth_log { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file ./mods-enabled/detail.log detail reply_log { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file ./mods-enabled/detail.log detail pre_proxy_log { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file ./mods-enabled/detail.log detail post_proxy_log { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file ./mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "./mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ./mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file ./mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "./mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ./mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file ./mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "./mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file ./mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "./mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file ./mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "./mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/accounting_response # Loaded module rlm_chap # Instantiating module "chap" from file ./mods-enabled/chap # Loaded module rlm_linelog # Instantiating module "linelog" from file ./mods-enabled/linelog linelog { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file ./mods-enabled/linelog linelog log_accounting { filename = "/mnt/sdcard/software/freeradius-server-3.0.3/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expr # Instantiating module "expr" from file ./mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_preprocess # Instantiating module "preprocess" from file ./mods-enabled/preprocess preprocess { huntgroups = "./mods-config/preprocess/huntgroups" hints = "./mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file ./mods-config/preprocess/huntgroups reading pairlist file ./mods-config/preprocess/hints # Loaded module rlm_realm # Instantiating module "IPASS" from file ./mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file ./mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file ./mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file ./mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_unpack # Instantiating module "unpack" from file ./mods-enabled/unpack # Loaded module rlm_files # Instantiating module "files" from file ./mods-enabled/files files { filename = "./mods-config/files/authorize" usersfile = "./mods-config/files/authorize" acctusersfile = "./mods-config/files/accounting" preproxy_usersfile = "./mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file ./mods-config/files/authorize [./mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [./mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [./mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file ./mods-config/files/authorize [./mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [./mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [./mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file ./mods-config/files/accounting reading pairlist file ./mods-config/files/pre-proxy # Loaded module rlm_always # Instantiating module "reject" from file ./mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file ./mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file ./mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file ./mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file ./mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file ./mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file ./mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file ./mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file ./mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file ./radiusd.conf } # server server default { # from file ./sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default ./policy.d/filter[6]: Invalid regular expression @|\: bad escape sequence at offset 3

5 4

Active Directory group check via winbind + rlm_unix, not LDAP
by Eloy Paris 01 Sep '14

01 Sep '14

Hello, I have a pretty common requirement: authenticate wireless users against Active Directory and prevent SSID cross-connections, i.e. users in group A can only connect to SSID A and users in group B can only connect to SSID B. I have seen plenty of messages in the archives about how to accomplish this. The authentication part is easy and has excellent documentation, e.g. http://deployingradius.com/documents/configuration/active_directory.html The group checking part is also well understood and documented (rlm_ldap), and whoever asks apparently gets told to use LDAP. At least I could not find anything on the alternate approach described here (apologies if this is old news). I decided to look into a different approach, which does not involve LDAP -- since the machine already has winbind running (for ntlm_auth), why not to use the Name Service Switch and rlm_unix to check for group membership and avoid usind LDAP altogether? Group membership information is already available if one has added "winbind" to "passwd" and "group" in /etc/nsswitch.conf. I apparently got this to work and wanted to share the solution in the hope that it will be helpful to someone, but also to ask if anyone sees any issues with the approach: First, I configured winbind for ntlm_auth use by FreeRADIUS, as explained elsewhere. Then, I verified that the system can see Active Directory users and groups as if they were Unix users and groups: shell$ id DOMAIN\\username uid=10017(DOMAIN\username) gid=10002(DOMAIN\domain users) groups=10002(DOMAIN\domain users),10024(DOMAIN\computer-lab-monitoring),10008(DOMAIN\domain admins),10034(DOMAIN\vdi teachers),10010(DOMAIN\teachers),10026(DOMAIN\vdi users),10011(DOMAIN\teacher assistants),10074(DOMAIN\schema admins) Then, I put this logic, which is similar to what one would normally use if LDAP and Ldap-Groups were in use, in the post-authentication section of my sites-enabled/default: if (NAS-Port-Type == Wireless-802.11) { if (Called-Station-Id =~ /.*:SSID-A/i) { # Can't do 'if (Group != "xxxxx")' because != # operator doesn't work for group checking. Careful # with the number of backslashes. if (!(Group == "DOMAIN\\\\group A") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } elsif (Called-Station-Id =~ /.*:SSID-B/i) { if (!(Group == "DOMAIN\\\\group B") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } } This works if the EAP identity is "DOMAIN\username". However, I don't want to make things unnecessarily complicated for my users so I want them to be able to enter just "username" when they configure their devices. The main issue to address, however, is that if the identity is entered as "username" (not "DOMAIN\username"), the group check will fail because the Unix user ID for users that are known to the system via winbind is "DOMAIN\username", not "username" (see output from the "id" command above). "Not a problem", I thought, "I'll just manipulate User-Name before anything happens and prefix it with "DOMAIN\". Turns out that was a bad idea because that made User-Name different than the EAP identity hidden in the EAP message, which caused the "rlm_eap: identity does not match User-Name, setting from EAP identity" message that has bitten so many people before. The solution I came up with was to still manipulate the User-Name but towards the end, in the post-auth section, instead of at the beginning. This way EAP uses the right identity, but the rlm_unix Group check uses the correct "DOMAIN\username" User-Name. The final configuration looks like this: if (NAS-Port-Type == Wireless-802.11) { # If User-Name doesn't contain our domain then add it. # It's needed for the Group check to use the correct # username. if (User-Name !~ /DOMAIN\\\\/i) { update request { User-Name := "DOMAIN\\\\%{User-Name}" } } if (Called-Station-Id =~ /.*:SSID-A/i) { # Can't do 'if (Group != "xxxxx")' because != # operator doesn't work for group checking. Careful # with the number of backslashes. if (!(Group == "DOMAIN\\\\group A") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } elsif (Called-Station-Id =~ /.*:SSID-B/i) { if (!(Group == "DOMAIN\\\\group B") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } } I do not know about the performance impact but this should not require additional network traffic to check for group membership because winbind caches this information. Another possible advantage is redundancy -- I understand the LDAP method does not allow for multiple LDAP servers. Using winbindd (I theorize, I am not sure about this) provides redundancy because the group membership comes from the domain controller, which is found using DNS lookups -- if a controller goes down then another (hopefully) takes its place and winbindd will be able to find it with no configuration changes. This approach seemed simple to me -- no additional configuration other than manipulating the User-Name in the post-authentication phase. Things can also be made to work if the user chooses to configure the supplicant with "DOMAIN\user" as the identity -- in this case one needs to configure "with_ntdomain_hack = yes" in modules/mschap, create an empty "DOMAIN" realm in proxy.conf, and enable the ntdomain realm in the authorize section of sites-enabled/inner-tunnel. Doing this will allow both "DOMAIN\user" and just "user" to work. Any thoughts, gotchas or hidden traps with this approach? I have tested this in pre-deployment and it works. I will start testing this in production to see if users have any issues. Cheers, Eloy Paris.-

5 5

There is no "Calling-Station-Id" attribute in access-requests sent in response to radius challenge from pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5)
by Dmitry Saratsky 01 Sep '14

01 Sep '14

Hi all, I'm using freeradius for custom 2-factor OTP authentication as below: RADIUS_CLIENT > Access-Request(User/Pass) > FreeRADIUS(check user pass and if ok -> generates state) > Access-Challenge > RADIUS_CLIENT> Access-Request(User/OTP/state) > FreeRADIUS In first Access-Request (before Access-Challenge) RADIUS_CLIENT is sending all required attributes well My problem is on the second Access-Request (after Access-Challenge). There is no "Calling-Station-Id" attribute on this state for some reason... I have checked this on the following radius client: pam_radius-1.3.17-2.el6.x86_64 (CentOS release 6.5) Anyone can suggest some work around for above? Maybe it is configuration issue I'm missing? Thanks a lot, Dmitry!

4 9

Oddity in regex
by Stefan Paetow 01 Sep '14

01 Sep '14

Hi, I have two servers, one here (in my office, with CentOS 6.5) and one at another facility (with RHEL 6.5). Both are running FreeRADIUS 3.0.4 rc 1 from what I can establish. I have these attributes in my reply: MS-MPPE-Encryption-Policy = Encryption-Required MS-MPPE-Encryption-Types = 4 MS-MPPE-Send-Key = 0xf1ad6cfa6e603b2bdb8480bd7ac84239 MS-MPPE-Recv-Key = 0x6cfc74047d13c6efa111a66fd9e360f4 EAP-Message = 0x03020004 Message-Authenticator = 0x00000000000000000000000000000000 SAML-AAA-Assertion = '<saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" IssueInstant=\"2014-08-22T13:48:00\" ID=\"e9e79e59-9fb5-4b4e-b8c6-a4ef77559516\" Version=\"2.0\">' SAML-AAA-Assertion = '<saml:Issuer>urn:mace:ac.uk:diamond.ac.uk</saml:Issuer>' SAML-AAA-Assertion = '<saml:AttributeStatement><saml:Attribute NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" Name=\"urn:oid:1.3.6.1.4.1.5923.1.1.1.7\">' SAML-AAA-Assertion = '<saml:AttributeValue>sysdev</saml:AttributeValue>' SAML-AAA-Assertion = '</saml:Attribute></saml:AttributeStatement></saml:Assertion>' In the server config in my office, I can use the below expression: if ("%{reply:SAML-AAA-Assertion[*]}" =~ /("urn:oid:1\.3\.6\.1\.4\.1\.5923\.1\.1\.1\.7")((\n|.)*?)(<saml:AttributeValue>)(\n*)(.*?)(\n*)(<\/saml:AttributeValue>)/) { : } This happily resolves to TRUE on the local server. However, on the second server, it resolves to FALSE, and I have to use the below there: if ("%{reply:SAML-AAA-Assertion[*]}" =~ /(urn\:oid\:1\.3\.6\.1\.4\.1\.5923\.1\.1\.1\.7)((\n|.)*?)(\<saml\:AttributeValue>)(\n*)(.*?)(\n*)(\<\/saml\:AttributeValue>)/) { : } The two regular expressions are the same with the following exceptions: All colons are escaped, all greater-as and smaller-as signs are escaped, and apparently the other server does not like having the quotes in the first regex group, even when escaped, or when using the \Q and \E modifiers before and after. According to several regex tests, the above should be ok, so... question to you regular expression whizzes and to Arran and Alan is: Why does the former not work on the second server? It seems the un-escaped colons and the quotes trip the regex up even though it should be ok? Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

5 6

Some new dictionaries for FR users
by Fred 01 Sep '14

01 Sep '14

Hi all, Here is some dictionaries currently not fount in freeradius 2.2.5 for following vendors : * Bluecoat (tested OK) * Citrix (tested OK) * Riverbed (not yet) Please note : I don't know if those vendors agree to publish their dictionary with freeradius, but I made this only by googleing, with no particular login. Hope this will be usefull to freeradius users ! # -oat-Group # dictionary.bluecoat # # Blue Coat Vendor Specific Attribute dictionary file for freeradius # # VENDOR BlueCoat 14501 BEGIN-VENDOR BlueCoat ATTRIBUTE Blue-Coat-Group 1 string ATTRIBUTE Blue-Coat-Authorization 2 integer VALUE Blue-Coat-Authorization No-Access 0 VALUE Blue-Coat-Authorization Read-Only-Access 1 VALUE Blue-Coat-Authorization Read-Write-Access 2 END-VENDOR BlueCoat # dictionary.citrix # Created for Citrix Use # # currently only using attribute 14 in this setup. VENDOR Citrix 66 BEGIN-VENDOR Citrix ATTRIBUTE UID 10 integer ATTRIBUTE GID 11 integer ATTRIBUTE Home 12 string ATTRIBUTE Shell 13 string ATTRIBUTE Group-Names 14 string ATTRIBUTE Group-Ids 15 string ATTRIBUTE CTXSUserGroups 16 string END-VENDOR Citrix # dictionary.riverbed # from https://support.riverbed.com/bin/support/static/doc/steelhead/8.5.2/html/sh… VENDOR Riverbed 17163 BEGIN-VENDOR Riverbed ATTRIBUTE Local-User 1 string END-VENDOR Riverbed

4 5