- Freeradius-Users - lists.freeradius.org

Case statement error
by Franks Andy (RLZ) IT Systems Engineer 09 Oct '13

09 Oct '13

Hi All. I have some code in an "sql" policy: sql_check_user_present { update control { Tmp-String-0 := "%{sql_pwifi:SELECT COUNT(*) from voucher v left join state s on v.id=s.voucher_id where v.id=s.voucher_id and v.code='%{User-Name}' and (s.state='Inactive' or s.state='Active')}" } switch "%{control:Tmp-String-0}" { case "0" { update control { User-RejectInformation := "Sorry, that voucher code is invalid or has expired." Debug-RejectInformation := "Voucher code not present in database table, or voucher expired" } reject } case "1" { noop } case { # voucher has multiple table entries, oooh errr. update control { User-RejectInformation := "Sorry, there has been an error. Please contact IT." Debug-RejectInformation := "Multiple voucher codes the same, or database error - SQL count not = 0 or 1. This should never happen due to primary key constraint!" } reject } } } This works fine in 3.0, git version #f66d411, but I have a problem with a regex related thing causing a segfault in that version and wouldn't mind trying the latest version to see if it's fixed. Trying version #d166290 results in /usr/local/etc/raddb/policy.d/sql[6]: "case" statements may only appear within a "switch" section /usr/local/etc/raddb/policy.d/sql[6]: Failed to parse "case" subsection. /usr/local/etc/raddb/policy.d/sql[5]: Failed to parse "switch" subsection. /usr/local/etc/raddb/sites-enabled/default[220]: Errors parsing authorize section. Do I need to change how the switch statement works? The unlang page doesn't seem to have changed as far as I can tell. Thanks Andy

2 1

Freeradius 3 and DHCP
by Rok Kosir 09 Oct '13

09 Oct '13

Hello, i had running version of freeradius 2.1.10 (from ubuntu ppa) with workable EAP-TTLS configuration. Today when i noticed that version 3 is out i decided to upgrade to it and also test the built-in dhcp server. All was goin well until i enabled dhcp (EAP-TTLS was working and authentication to mysql), when i run freeradius -X, i get Segmentation Fault when it reaches dhcp listner. It is the same if i use default dhcp site (one provided with source) or if i follow guide on freeRadius wiki ( http://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation) I built package from source as described in instruction for debian. Here is return of my freeradius -xv: Tue Oct 8 15:07:55 2013 : Info: freeradius: FreeRADIUS Version 3.0.0, for host x86_64-pc-linux-gnu, built on Oct 8 2013 at 10:44:53 Tue Oct 8 15:07:55 2013 : Debug: Server was built with: Tue Oct 8 15:07:55 2013 : Debug: accounting Tue Oct 8 15:07:55 2013 : Debug: authentication Tue Oct 8 15:07:55 2013 : Debug: ascend binary attributes Tue Oct 8 15:07:55 2013 : Debug: coa Tue Oct 8 15:07:55 2013 : Debug: control-socket Tue Oct 8 15:07:55 2013 : Debug: detail Tue Oct 8 15:07:55 2013 : Debug: dhcp Tue Oct 8 15:07:55 2013 : Debug: dynamic clients Tue Oct 8 15:07:55 2013 : Debug: proxy Tue Oct 8 15:07:55 2013 : Debug: regex-posix Tue Oct 8 15:07:55 2013 : Debug: session-management Tue Oct 8 15:07:55 2013 : Debug: stats Tue Oct 8 15:07:55 2013 : Debug: tcp Tue Oct 8 15:07:55 2013 : Debug: threads Tue Oct 8 15:07:55 2013 : Debug: tls Tue Oct 8 15:07:55 2013 : Debug: unlang Tue Oct 8 15:07:55 2013 : Debug: vmps Tue Oct 8 15:07:55 2013 : Debug: Server core libs: Tue Oct 8 15:07:55 2013 : Debug: talloc : 2.0.* Tue Oct 8 15:07:55 2013 : Debug: ssl : OpenSSL 1.0.1 14 Mar 2012 I have pasted debug from freeradius -X on pastebin so it doesn't clutter too much here: http://pastebin.com/raw.php?i=u9mM3avv Any help is appreciated. Regards, Rok

3 4

Usage of Session-Timeout
by Volker Lieder 09 Oct '13

09 Oct '13

Hi, we upgraded a freeradius setup from 1.x to 2.1.10+dfsg-2+squeeze1 on Debian Squeeze. Within the old version, we used a database config for groups with an attribute "Session-Timeout" and the value `%{expr:06:00}` With new version freeradius send an error while looking in debug mode like: Tue Oct 1 16:15:23 2013 : Info: [sql] expand: 06:00 -> 06:00 Tue Oct 1 16:15:23 2013 : Info: [sql] Not a number at ":00" Tue Oct 1 16:15:23 2013 : Info: [sql] expand: %{expr:06:00} -> Can you explain why this value isnt working with new version or what we have to change to set the Session-Timeout that user get disconnected e.g. at 06:00 am? Regards, Volker Lieder

2 1

load balancing radius with F5 devices
by Alex Sharaz 09 Oct '13

09 Oct '13

Hi, Is anyone out there load balancing RADIUS with an F5 load balancer? We're doing it here, but I can't help thinking that the actual load balancing algorithm need some tweaking. As far as I'm aware ( systems section support the F5 boxes) 1). We're using round robin to spread the load over 2 back end radius servers. 2). There is some "general" sticky persistence so that once a RAS device starts talking to a particular back end server it continues to talk to that server for a predetermined length of time ( might be an hour, not sure). This ensures that an eap dialogue will always talk to the same back end server for the duration of the "stuck" time. Not sure what happens when you get to the end of the time interval though. According to the F5 statistics, overall radius traffic seems to be shared evenly over the 2 back end servers. However, our most heavily loaded RAS client is our wireless network. While we have 900 switches doing mac and 802.1x based auth, we can have 6000+ users on our wireless network all authenticating to RADIUS via 3 RAS clients. Looking at the back end server log files, it does look as if, in general, all wireless RADIUS auths head for the same back end server. I was wondering if there's a way off having a bit more granularity in terms of how the f5 load balances incoming RADIUS requests. Rgds Alex

5 7

unlang - delete attribute - !*
by Hachmer, Tobias 09 Oct '13

09 Oct '13

Hello list, I want to delete one reply attribute from the reply list if the access-request is originating not from a special NAS-IP-Address. Currently I have solved this by adding this unlang code in authorize section: if(!NAS-IP-Address == x.x.x.x) { update reply { Aruba-Admin-Role := "" } } The man page of unlang says: !* Delete all occurances of the named attribute, no matter what the value. I think this is the better way than just to clear the attribute value. But how can I use this, what's the correct syntax? I have tested the following without success: Aruba-Admin-Role !* "" Aruba-Admin-Role !* !* Aruba-Admin-Role Thanks in advance, Tobias Hachmer

2 2

Re: Changing User Profile after depletion of set Volume
by Mulindwa 08 Oct '13

08 Oct '13

Dear pple, I have looked for this and failed to get it, i have users with set volume limits and they get knocked off once they hit the limit, however ; i want to have this taken to the next level, i.e once the limit is hit, the user's profile be changed and they can only get to certain website /URL/IPs . How can i achieve this? Eric M

2 2

2.2.2 release date
by Wang, Yu 08 Oct '13

08 Oct '13

I remember Alan mentioned that 2.2.2 may be released today. I checked git for 2.x.x and it says 2.2.1. I am wondering if it'll be released soon. Thanks, Yu Wang

2 2

What does FR 2.2.2 fix?
by Alex Sharaz 07 Oct '13

07 Oct '13

Hi, Yesterday caught an email about the release of FR 2.2.2 on Monday to "fix a proxy problem". As I've just migrated 2 of my servers from 2.2.0 to 2.2.1 the sudden release of 2.2.2 sounds important. What does 2.2.2 fix? Rgds Ale x

9 19

Re: Problem with Cisco WLC probes in FR 2.2.1
by Bruce Nunn 07 Oct '13

07 Oct '13

Thanks for the heads-up. I will look for this this coming weekend when I get 2.2.2 in production. Jonathan Gazeley <Jonathan.Gazeley(a)bristol.ac.uk> wrote: >We've recently upgraded our radius servers from 2.1.12 (CentOS 6 >packaged default) to 2.2.1 (latest stable from FR, built by hand). > >A config that used to work under 2.1.12 no longer appears to work the >same way under 2.2.1. Our Cisco WLCs send periodic probes in the form of >a test authentication. There is a snippet of config that intercepts >these authentication requests: > ># /etc/raddb/conf.d/wism-checks.conf >if (Service-Type == "NAS-Prompt-User") { > if (NAS-IP-Address =~ /^172\.17\.107\./) { > if (User-Name =~ /^wisms\-testing/) { > update control { > Auth-Type := Accept > } > updated > } > else { > reject > } > } >updated = return >} > > >This config is included in every virtual server's outer config: > ># /etc/raddb/sites-enabled/eduroamlocal >authorize { > $INCLUDE conf.d/wism-checks.conf >} > > >Looking at the output from radiusd -XC the wism-checks.conf file is >being included in multiple places, yet when the server is running there >is no record of these test probe packets being processed. This means the >WLCs think the radius server is dead, and stop using it. I've had to >roll back to 2.1.12 to restore stable wireless service for our users. > >I can only assume this code block is being skipped over for some reason. >At present I'm unable to drop production radius servers into debug mode >since they can't handle the load while debugging, and while I do have >some development radius servers, our WLCs won't sent it these probe >packets unless it is an active production radius server. > >Does anyone have any tips for debugging this in a minimally disruptive >way? At the moment we don't have any development WLCs but we might have >to get some so we can have a separate environment for testing. In the >meantime I'm trying to get this code block to work so we can use the >newer version of FR. > >Thanks, and happy Friday >Jonathan >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 9

Cache for machine authentication
by Garber, Neal 04 Oct '13

04 Oct '13

Can someone tell me if it is possible in FR to cache in memory (for a short amount of time) Calling-Station-Id from successful machine authentications so that subsequent user authentications can test whether the user is connecting from an authorized device? This is a feature that is available with Cisco ACS version 5 (using attribute Was-Machine-Authenticated) that I am trying to emulate in FR. If it's possible and anyone can share ideas, I would appreciate it. I thought about using a database, but it seems horribly inneficient compared to caching something in memory. I know I could write a custom module or use perl and maintain the cache in a file, but I don't want to reinvent the wheel and I'm hoping there's an easier and more efficient way to accomplish this.. Thanks for your time..

4 3