- Freeradius-Users - lists.freeradius.org

Does FreeRADIUS 2.1.12's ECDH support include ECDH-RSA-AES128-SHA?
by Edward Morris 29 Jan '14

29 Jan '14

Using FreeRADIUS 2.1.12 (from debian package) and OpenSSL 1.0.1f, I've been able to successfully configure EAP-TLS with a number of ECDHE (ephemeral) cipher suites. However, my attempts to utilize ECDH (non-ephemeral) cipher suites fail with and error of "SSL3_GET_CLIENT_HELLO:no shared cipher." I've seen that same error occur both when I was attempting to employ a cipher suite not supported by FreeRADIUS (versions prior to 2.1.12 did not support any ECDHE cipher suites) and when I had a screwy configuration (e.g., attempts to use DSA cipher suites without first giving the server a DSA key). So I'm unclear on where the problem might lie. I've confirmed that the client/supplicant I'm testing with supports the ECDH cipher suite (tcpdump and wireshark shows the Client Hello message includes the cipher), and querying debian's OpenSSL ("openssl ciphers -v aECDH") confirmed it supports the cipher The only documentation I could find on this topic was the line 'ecdh_curve = "prime256v1"' in eap.conf. Any pointers or confirmation as to whether or not FreeRADIUS (any version) supports plain ECDH cipher suites would be greatly appreciated. Thanks Ed

2 2

Problem with spaces in usernames.
by Maciej Milewski 29 Jan '14

29 Jan '14

My main goal is creating EAP-TLS configuration but I wanted to be sure the easiest way is working fine. And it's not working for me. What's wrong that 3.0.0 version doesn't treat: "A Guest" the same way as aguest? They are configured this way in users file: "A Guest" Cleartext-Password := "123456" Reply-Message = "Hello %{User-Name}" aguest Cleartext-Password := "123456" Reply-Message = "Hello, %{User-Name}" and talking with radtest from other host makes following showing in debug: rad_recv: Access-Request packet from host 10.0.6.10 port 57803, id=3, length=77 User-Name = 'A Guest' User-Password = '123456' NAS-IP-Address = 10.0.6.10 NAS-Port = 0 Message-Authenticator = 0x3499158ba2be438b4e63389ffd091332 Wed Jan 29 17:20:58 2014 : Debug: (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:20:58 2014 : Debug: (0) authorize { Wed Jan 29 17:20:58 2014 : Debug: (0) filter_username filter_username { Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (User-Name != "%{tolower:%{User-Name}}") Wed Jan 29 17:20:58 2014 : Debug: %{tolower:%{User-Name}} Wed Jan 29 17:20:58 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:20:58 2014 : Debug: xlat: tolower Wed Jan 29 17:20:58 2014 : Debug: { Wed Jan 29 17:20:58 2014 : Debug: attribute: User-Name Wed Jan 29 17:20:58 2014 : Debug: { Wed Jan 29 17:20:58 2014 : Debug: ref 2 Wed Jan 29 17:20:58 2014 : Debug: list 1 Wed Jan 29 17:20:58 2014 : Debug: tag -128 Wed Jan 29 17:20:58 2014 : Debug: } Wed Jan 29 17:20:58 2014 : Debug: } Wed Jan 29 17:20:58 2014 : Debug: (0) expand: "%{tolower:%{User-Name}}" -> 'a guest' Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> TRUE Wed Jan 29 17:20:58 2014 : Debug: (0) if (User-Name != "%{tolower:%{User-Name}}") { Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[authorize]: calling reject (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[authorize]: returned from reject (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [reject] = reject Wed Jan 29 17:20:58 2014 : Debug: (0) } # if (User-Name != "%{tolower:%{User-Name}}") = reject Wed Jan 29 17:20:58 2014 : Debug: (0) } # filter_username filter_username = reject Wed Jan 29 17:20:58 2014 : Debug: (0) } # authorize = reject Wed Jan 29 17:20:58 2014 : Debug: (0) Using Post-Auth-Type Reject Wed Jan 29 17:20:58 2014 : Debug: (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:20:58 2014 : Debug: (0) Post-Auth-Type REJECT { Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Wed Jan 29 17:20:58 2014 : Debug: %{User-Name} Wed Jan 29 17:20:58 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:20:58 2014 : Debug: attribute: User-Name Wed Jan 29 17:20:58 2014 : Debug: { Wed Jan 29 17:20:58 2014 : Debug: ref 2 Wed Jan 29 17:20:58 2014 : Debug: list 1 Wed Jan 29 17:20:58 2014 : Debug: tag -128 Wed Jan 29 17:20:58 2014 : Debug: } Wed Jan 29 17:20:58 2014 : Debug: (0) attr_filter.access_reject : expand: "%{User-Name}" -> 'A Guest' Wed Jan 29 17:20:58 2014 : Debug: (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [attr_filter.access_reject] = updated Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: calling eap (rlm_eap) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: returned from eap (rlm_eap) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [eap] = noop Wed Jan 29 17:20:58 2014 : Debug: (0) remove_reply_message_if_eap remove_reply_message_if_eap { Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (reply:EAP-Message && reply:Reply-Message) Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE Wed Jan 29 17:20:58 2014 : Debug: (0) else else { Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [noop] = noop Wed Jan 29 17:20:58 2014 : Debug: (0) } # else else = noop Wed Jan 29 17:20:58 2014 : Debug: (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop Wed Jan 29 17:20:58 2014 : Debug: (0) } # Post-Auth-Type REJECT = updated Wed Jan 29 17:20:58 2014 : Debug: (0) Finished request 0. Wed Jan 29 17:20:58 2014 : Debug: Waking up in 0.3 seconds. Wed Jan 29 17:20:58 2014 : Debug: Waking up in 0.6 seconds. Wed Jan 29 17:20:59 2014 : Debug: (0) Sending delayed reject Sending Access-Reject of id 3 from 10.0.6.207 port 1812 to 10.0.6.10 port 57803 Wed Jan 29 17:20:59 2014 : Debug: Waking up in 4.9 seconds. Wed Jan 29 17:21:04 2014 : Debug: (0) Cleaning up request packet ID 3 with timestamp +29 Wed Jan 29 17:21:04 2014 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.0.6.10 port 44948, id=210, length=76 User-Name = 'aguest' User-Password = '123456' NAS-IP-Address = 10.0.6.10 NAS-Port = 0 Message-Authenticator = 0xdfd5232531e2f84735f3a9b1b94c22c9 Wed Jan 29 17:21:10 2014 : Debug: (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:21:10 2014 : Debug: (1) authorize { Wed Jan 29 17:21:10 2014 : Debug: (1) filter_username filter_username { Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name != "%{tolower:%{User-Name}}") Wed Jan 29 17:21:10 2014 : Debug: %{tolower:%{User-Name}} Wed Jan 29 17:21:10 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:21:10 2014 : Debug: xlat: tolower Wed Jan 29 17:21:10 2014 : Debug: { Wed Jan 29 17:21:10 2014 : Debug: attribute: User-Name Wed Jan 29 17:21:10 2014 : Debug: { Wed Jan 29 17:21:10 2014 : Debug: ref 2 Wed Jan 29 17:21:10 2014 : Debug: list 1 Wed Jan 29 17:21:10 2014 : Debug: tag -128 Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: (1) expand: "%{tolower:%{User-Name}}" -> 'aguest' Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ / /) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ / /) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /@.*@/ ) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /@.*@/ ) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.\\./ ) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.\\./ ) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.$/) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.$/) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /(a)\\./) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /(a)\\./) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) } # filter_username filter_username = notfound Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [preprocess] = ok Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling chap (rlm_chap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from chap (rlm_chap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [chap] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [mschap] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling digest (rlm_digest) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from digest (rlm_digest) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [digest] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling suffix (rlm_realm) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) suffix : No '@' in User-Name = "aguest", looking up realm NULL Wed Jan 29 17:21:10 2014 : Debug: (1) suffix : No such realm "NULL" Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [suffix] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) eap : No EAP-Message, not doing EAP Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [eap] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling files (rlm_files) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) files : users: Matched entry aguest at line 57 Wed Jan 29 17:21:10 2014 : Debug: Hello, %{User-Name} Wed Jan 29 17:21:10 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:21:10 2014 : Debug: literal: 'Hello, ' Wed Jan 29 17:21:10 2014 : Debug: attribute: User-Name Wed Jan 29 17:21:10 2014 : Debug: { Wed Jan 29 17:21:10 2014 : Debug: ref 2 Wed Jan 29 17:21:10 2014 : Debug: list 1 Wed Jan 29 17:21:10 2014 : Debug: tag -128 Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: (1) files : expand: "Hello, %{User-Name}" -> 'Hello, aguest' Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from files (rlm_files) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [files] = ok Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling expiration (rlm_expiration) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from expiration (rlm_expiration) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [expiration] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling logintime (rlm_logintime) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from logintime (rlm_logintime) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [logintime] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [pap] = updated Wed Jan 29 17:21:10 2014 : Debug: (1) } # authorize = updated Wed Jan 29 17:21:10 2014 : Debug: (1) Found Auth-Type = PAP Wed Jan 29 17:21:10 2014 : Debug: (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:21:10 2014 : Debug: (1) Auth-Type PAP { Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authenticate]: calling pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) pap : login attempt with password "123456" Wed Jan 29 17:21:10 2014 : Debug: (1) pap : Using clear text password "123456" Wed Jan 29 17:21:10 2014 : Debug: (1) pap : User authenticated successfully Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authenticate]: returned from pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [pap] = ok Wed Jan 29 17:21:10 2014 : Debug: (1) } # Auth-Type PAP = ok Wed Jan 29 17:21:10 2014 : Debug: (1) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:21:10 2014 : Debug: (1) post-auth { Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: calling exec (rlm_exec) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: returned from exec (rlm_exec) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [exec] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) remove_reply_message_if_eap remove_reply_message_if_eap { Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (reply:EAP-Message && reply:Reply-Message) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) else else { Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: calling noop (rlm_always) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: returned from noop (rlm_always) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [noop] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) } # else else = noop Wed Jan 29 17:21:10 2014 : Debug: (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop Wed Jan 29 17:21:10 2014 : Debug: (1) } # post-auth = noop Sending Access-Accept of id 210 from 10.0.6.207 port 1812 to 10.0.6.10 port 44948 Reply-Message = 'Hello, aguest' Wed Jan 29 17:21:10 2014 : Debug: (1) Finished request 1. Wed Jan 29 17:21:10 2014 : Debug: Waking up in 0.3 seconds. Wed Jan 29 17:21:10 2014 : Debug: Waking up in 4.6 seconds. -- Pozdrawiam, Maciej Milewski

5 6

cui-inner.post-auth and cui.post-auth
by stefan.paetow＠diamond.ac.uk 29 Jan '14

29 Jan '14

Sorry, doing more poking around and have discovered that while the %{User-Name} attribute is turned into lower-case with %{tolower:...}, %{Operator-Name} is not. Surely to ensure consistency, shouldn't Operator-Name ALSO be turned into a lower-case? After all, 1DIAMOND.AC.UK and 1diamond.ac.uk are the same on t'Internet? Just a question... Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

4 7

How to set User access for certain clients
by dilanka nayanajith 29 Jan '14

29 Jan '14

Hi every one i am facing some problems, i configured radius server i configured a client and finally i have configured a user as well how do i block or deny access for users to log certain clients as and example -- User1 can log to the SWA but he should not be able to log to SWB please help me on this , i read so many articuls but cant fiend a way to do it -- dilanka nayanajith Thank you

3 2

How configure freeradius that check user group in Microsoft Active Direcory
by matrix30003 28 Jan '14

28 Jan '14

Hi I integrated freeradius with Microsoft Active Directory All users in Active Directory have access. How I will set freeradius that check users groups nad access accept if user belongs to groups WIFI in Active Directory.

8 15

%S short variable obsolescence
by stefan.paetow＠diamond.ac.uk 28 Jan '14

28 Jan '14

Hi, Another question... The Wiki at http://wiki.freeradius.org/config/Run%20time%20variables says that %S and others *will* be removed in the future... since I am now using %S, what future variable would be preferred for using it? The Wiki does not list one at the moment. With Regards Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

3 3

rlm_perl truncating some attributes in 3.0.1
by Leggett, Torrance I. 28 Jan '14

28 Jan '14

I'm trying to upgrade our 2.2.1 based servers to 3.0.1, but it appears that rlm_perl is truncating some attributes. Specifically Calling-Station-Id, User-Name and User-Password. Here is the debug output from the server: http://pastebin.com/GYpBS59L And here is the rlm_perl script that currently works under 2.2.1 but appears to be receiving truncated %RAD_REQUEST attributes: http://pastebin.com/auKspQcU Is this normal behavior that can be overridden at script definition time? Thanks!

2 4

SSH Logins to Cisco Switch. RADIUS/Active Directory
by Luke Ramsden 28 Jan '14

28 Jan '14

Hi, I am trying to authenticate SSH logins to my Cisco 3750 switches using RADIUS/Active Directory. I think this means I will need the Cisco switches to send an MSCHAPv2 challenge to the RADIUS server? I am struggling to achieve this and wondered if anyone else had come across this and could offer some advice? Essentially, all I want is to remotely access the switches on my network using Active Directory credentials. Are there any other/better methods if the above is not possible? Any help is greatly appreciated :-)

2 9

Changed behaviour in v3.x
by stefan.paetow＠diamond.ac.uk 28 Jan '14

28 Jan '14

Hi, In my post-auth section, I get the exact date and time in a specific format using /bin/date, and feed that back into an attribute. I've noticed though that now the back-tick exec appends a '\n' (a carriage return) to the end, which it did not do in FR2. Is that now correct (and expected) behaviour? The code in my post-auth: update control { Tmp-String-1 := `/bin/date -u +%%FT%%TZ` } FR 3 output: (20) update control { (20) Executing: "/bin/date -u +%%FT%%TZ" (20) expand: "+%%FT%%TZ" -> '+%FT%TZ' (20) Program returned code (0): 2014-01-27T17:20:42Z (20) Tmp-String-1 := '2014-01-27T17:20:42Z\n' (20) } # update control = noop FR 2 output: expand: +%%FT%%TZ -> +%FT%TZ Exec-Program output: 2014-01-27T17:35:00Z Exec-Program-Wait: plaintext: 2014-01-27T17:35:00Z Exec-Program: returned: 0 +++[control] returns noop When I then re-use the Tmp-String-1 attribute for a reply attribute I'm building, I end up with a CR in the reply attribute, which is then considered invalid (because it contains a CR). If the appended CR is now accepted behaviour, how do I remove it? With Regards Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

3 6

fr3+ldap = rad_send() failed: Invalid argument
by Zeus Panchenko 28 Jan '14

28 Jan '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello, please, help me to understand what am I missing ... I am trying to get fr3 working with ldap as storage for users, profiles and clients while I was able to auth successfully on v.2, now after upgrade to 3.0.0 I am unable to get Access-Accept with radtest ... > radtest -4 -x student2 ***** radius.es 100 testing123 0 radius.es Sending Access-Request of id 23 from 0.0.0.0 port 24919 to 10.0.0.1 port 1812 User-Name = 'student2' User-Password = '*****' NAS-IP-Address = 10.0.0.1 NAS-Port = 100 Message-Authenticator = 0x00 ... radclient: no response from server for ID 23 socket 3 here is fr debug fragment: - ---[ quotation start ]------------------------------------------- rlm_ldap (ldap): Reserved connection (14) (1) files : Using user DN from request "cn=student2,ou=users,ou=radius,dc=es" (1) files : Checking user object membership (radiusGroupName) attributes (1) files : Performing search in 'cn=student2,ou=users,ou=radius,dc=es' with filter '(null)' (1) files : Waiting for search result... (1) files : Processing group membership value "students" (1) files : Processing group membership value "teachers" (1) files : User found. Comparison between membership: name, check: name] rlm_ldap (ldap): Released connection (14) (1) files : users: Matched entry DEFAULT at line 7 (1) [files] = ok rlm_ldap (ldap): Reserved connection (14) (1) ldap : expand: "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" -> '(cn=student2)' (1) ldap : expand: "ou=users,ou=radius,dc=es" -> 'ou=users,ou=radius,dc=es' (1) ldap : Performing search in 'ou=users,ou=radius,dc=es' with filter '(cn=student2)' (1) ldap : Waiting for search result... (1) ldap : User object found at DN "cn=student2,ou=users,ou=radius,dc=es" (1) ldap : control:Cleartext-Password := '*****' (1) ldap : control:User-Profile := 'cn=students,ou=profiles,ou=radius,dc=es' rlm_ldap (ldap): Released connection (14) (1) [ldap] = ok (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Auth-Type PAP { (1) pap : login attempt with password "*****" (1) pap : Using clear text password "*****" (1) pap : User authenticated successfully (1) [pap] = ok (1) } # Auth-Type PAP = ok ... Sending Access-Accept of id 23 from 10.0.0.1 port 1812 to 10.0.0.1 port 24919 rad_send() failed: Invalid argument (1) ERROR: Failed sending reply: (1) Finished request 1. Waking up in 0.3 seconds. - ---[ quotation end ]------------------------------------------- and in addition, while the very auth is successfull as I can see, profile attributes application to the user is not occuring (as it was with v.2) ... here is ldap module configuration: - ---[ quotation start ]------------------------------------------- ldap { server = "localhost" port = 389 password = "*****" identity = "cn=ldapmaster,dc=es" edir_autz = yes user { filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "ou=users,ou=radius,dc=es" access_positive = yes } group { filter = "(objectClass=groupOfNames)" scope = "sub" base_dn = "ou=profiles,ou=radius,dc=es" name_attribute = "cn" membership_attribute = "radiusGroupName" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "ou=clients,ou=radius,dc=es" attribute { identifier = "radiusClientIdentifier" shortname = "radiusClientShortname" secret = "radiusClientSecret" } } profile { filter = "(&(objectClass=radiusprofile)(ou=profile))" } options { ldap_debug = 296 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } - ---[ quotation end ]------------------------------------------- can somebody advise, pls? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlLmpxsACgkQr3jpPg/3oyq5CQCfbhlkzaPhzwuxcj78BnAeBIsh 1PIAoOjcaDCyKH6znEfTW+eR6zDNGTiu =6U/9 -----END PGP SIGNATURE-----

2 5