- Freeradius-Users - lists.freeradius.org

Groups in active directory and checks in MySQL
by Atomikramp 23 Aug '13

23 Aug '13

Hello everyone, i know this might be considered a bizarre situation but well... i was just wondering if it's possible to do such a thing.   I'm in a situation now where i can successfully retrieve group membership of users in the active directory LDAP tree using rlm_ldap, and check them against files.   so if i have a user with "memberOf" attribute set to groupA and i set in the raddb/users the following entry:   DEFAULTLdap-Group == "groupA", Auth-Type := Reject Reply-Message = "Not Allowed."   i successfully deny access to that user.   Since i'm already using MySQL for storing accounting informations i was really interested in being able to use the same backend (mysql) also for performing checks against groups.   If i perform checks against usernames using the table radcheck they work properly (users retrieved from the LDAP backend), i've tried setting a radcheck like the following: userA Max-Daily-Session := 7200   and after 2 hours the user is unable to authenticate to the NAS because the time allowed has expired.     But i cant seem to be able to do the same thing with the groups.   i've configured sites-enabled/default like this:   authorize { preprocess auth_log chap mschap digest suffix eap { ok = return } files ldap sql expiration logintime pap dailycounter }   authenticate { Auth-Type PAP { pap }   Auth-Type CHAP { chap }   Auth-Type MS-CHAP { mschap }   digest unix   Auth-Type LDAP { ldap }   eap }   preacct { preprocess acct_unique suffix files }   accounting { detail sql }   session { radutmp }     post-auth { ldap exec Post-Auth-Type REJECT { # log failed authentications in SQL, too. attr_filter.access_reject } }   pre-proxy { }   post-proxy { eap }   radiusd.conf like this prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct   name = freeradius   confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name}   db_dir = ${raddbdir}   libdir = /usr/lib/freeradius   pidfile = ${run_dir}/${name}.pid   user = freerad group = freerad   max_request_time = 30   cleanup_delay = 5   max_requests = 1024   listen { type = auth ipaddr = * port = 0 }   listen { ipaddr = * port = 0 type = acct }   hostname_lookups = no   allow_core_dumps = no   regular_expressions= yes extended_expressions= yes   log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no }   checkrad = ${sbindir}/checkrad   security { max_attributes = 200 reject_delay = 1 status_server = yes }   proxy_requests  = yes $INCLUDE proxy.conf   $INCLUDE clients.conf   thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 }   modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf $INCLUDE sql.conf $INCLUDE sql/mysql/counter.conf }   instantiate { exec expr expiration logintime }   and sql.conf   sql {         database = "mysql"         driver = "rlm_sql_${database}"         server = "localhost"         #port = 3306         login = "radius"         password = "<removed>"         radius_db = "radius"         acct_table1 = "radacct"         acct_table2 = "radacct"         postauth_table = "radpostauth"         authcheck_table = "radcheck"         authreply_table = "radreply"         groupcheck_table = "radgroupcheck"         groupreply_table = "radgroupreply"         usergroup_table = "radusergroup"         deletestalesessions = yes         sqltrace = no         sqltracefile = ${logdir}/sqltrace.sql         num_sql_socks = 5         connect_failure_retry_delay = 60         lifetime = 0         max_queries = 0         nas_table = "nas"         $INCLUDE sql/${database}/dialup.conf         $INCLUDE sql/${database}/counter.conf }   any help is really welcome. thanks and sorry if i couldn't explain myself properly please correct me.   -- Caselle da 1GB, trasmetti allegati fino a 3GB e in piu' IMAP, POP3 e SMTP autenticato? GRATIS solo con Email.it: http://www.email.it/f Sponsor: SUPERMARIO: Acquista Peluche e T-shirt Originali su mistercupido.com Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=12899&d=20130823 -- Caselle da 1GB, trasmetti allegati fino a 3GB e in piu' IMAP, POP3 e SMTP autenticato? GRATIS solo con Email.it http://www.email.it/f Sponsor: SIMPSON: Acquista Peluche, Gadget e Abbigliamento Originale su mistercupido.com Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=12901&d=23-8

3 2

RE: Escaping regex + character
by Franks Andy (RLZ) IT Systems Engineer 23 Aug '13

23 Aug '13

Yeh, I read that character classes don't need escaping in quite the same way somewhere, then tried it without escaping but didn't realise it was down to character position. I'll give it a try. Thanks guys. >> evluation >Well at least it'll evaluate instead of evluate now. :-P -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 23 August 2013 09:52 To: freeradius-users(a)lists.freeradius.org Subject: Re: Escaping regex + character On 08/23/2013 09:35 AM, Arran Cudbard-Bell wrote: > Or if you shift that hyphen one to the right, it'll probably work OK too :) Usually first in the range works: [-.a-z0-9] IIRC + doesn't need to be escaped inside a range, same as "." - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Escaping regex + character
by Franks Andy (RLZ) IT Systems Engineer 23 Aug '13

23 Aug '13

Hi All, Just a quick question - I've compiled FR3 with pcre regex libraries and it's working ok. I just can't get it to escape plusses ( + ) though I've tried between 0 and 6(!) backslashes but all result in: ERROR: Failed compiling regular expression: bad range inside [] at offset 10 (0) ERROR: Condition evluation failed because the value of an operand could not be determined It's the + in the character class I'm trying to escape. This is with two backslashes (what I'd expect to work as it does with dots - \\. (0) ? if ("%{Email-Address}" =~ /^[a-z0-9_-\+]+(\.[a-z0-9_-\\\+])*(a)[a-z0-9_-\\\+]+(\.[a-z0-9_-\\\+]+)*(\ .[a-z]{2,4})$/) (0) expand: "%{Email-Address}" -> 'a+b(a)c.de' ERROR: Failed compiling regular expression: bad range inside [] at offset 10 (0) ERROR: Condition evluation failed because the value of an operand could not be determined The regex works ok without the plusses, if not including them in the subject.. Thanks Andy

3 2

debian, wpa_supplicant, TTLS/TLS working, PEAP/TLS fails
by Martin Kraus 22 Aug '13

22 Aug '13

Hi. I managed to get EAP-TTLS/TLS working but EAP-PEAP/TLS fails after the outer TLS tunnel is established: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x992158e5992955e0 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! and then later on rlm_eap: No EAP session matching the State variable. [inner-eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request I've read the instructions but none of that seems to apply to my situation There is TLV result - failure in the supplicant log but I don't have a clue if that is a cause or a effect of the error in freeradius. Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: received 37 bytes encrypted data for Phase 2 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=5): 01 07 00 05 +01 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: received Phase 2: code=1 identifier=7 length=5 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: Phase 2 Request: type=1 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP-PEAP: Encrypting Phase 2 data - hexdump(len=18): [REMOVED] Aug 21 12:22:34 localhost wpa_supplicant[19681]: SSL: 90 bytes left to be sent out (of total 90 bytes) Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP: method process -> ignore=FALSE methodState=MAY_CONT +decision=FAIL Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP: EAP entering state SEND_RESPONSE Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAP: EAP entering state IDLE Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAPOL: SUPP_BE entering state RESPONSE Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAPOL: txSuppRsp Aug 21 12:22:34 localhost wpa_supplicant[19681]: TX EAPOL: dst=00:24:14:3a:95:d0 Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAPOL: SUPP_BE entering state RECEIVE Aug 21 12:22:34 localhost wpa_supplicant[19681]: EAPOL: startWhen --> 0 Aug 21 12:22:46 localhost wpa_supplicant[19681]: EAP-TLV: TLV Result - Failure Aug 21 12:22:47 localhost wpa_supplicant[19681]: wlan0: CTRL-EVENT-EAP-FAILURE EAP authentication failed Thanks for any help Martin

3 8

rlm_perl issue
by Dean, Barry 22 Aug '13

22 Aug '13

An interesting one for the list ... We are installing a Palo Alto firewall and it has a way to pass Username/IP mappings from FreeRADIUS to a Windows "User ID Agent", which is then queried by the firewall. The method employed is to use a Perl module (PAN::API), which has a simple API, basically: $var = PAN::API::UID-new( "ip of server" ); $var->add( "type <login/logout>", username, Framed-IP-Address ); $var-submit(); which is added in the "sub preacct ()" of the perl module... then call this in preacct {} There are a couple of issues with this module that I am going to try and address: 1) Connections "new" only instantiates an empty object "add" adds the values to a hash "submit" opens an TCP SSL connection, sends the hash as XML, then closes the connection. With all the work being done in "submit" you have to create and tear down an SSL TCP connection for EVERY accounting record! Which is a lot at my site! 2) Errors If the socket set-up fails, the PAN::API module calls croak(), which on my system terminated FreeRADIUS, which seems like what would happen? Thu Aug 22 13:53:03 2013 : Error: rlm_perl: perl_embed:: module = /etc/raddb/perl.pl , func = preacct exit status= Unable to connect socket. at /etc/raddb/perl.pl line 474 Socket setup failed I am guessing because of all the open/close socket activity? Looks like the Windows 2008R2 server either blocked this as a suspected DOS or the agent failed to cope with this kind of TCP activity? Obviously for problem 1, a better model would be to implement new methods on the object to open and close the SSL connection, then use a pattern like: { # Static block start my $object = PAN::API::UID->new( "<IP>" ); $object->connectssl(); sub preacct { $object->add( <params> ); $object->submit(); } } closing the SSL would not be needed in effect as we run "forever", and I wouldn't know where to place it as there is no function called on an rlm_perl module when FreeRADIUS is about to terminate, unless I am missing something. For problem 2, are there rules about what you should not do in an rlm_perl module? I would have thought exit(), die(), croak() etc are all bad and that returning quietly, optionally setting an error code, would be better? Then back in "sub preacct ()" you could check the error and log with &radiusd::radlog() and do a "return RLM_MODULE_NOOP"? Would you expect FreeRADIUS to terminate if an rlm_perl module called croak()? Anyone want to throw in 2 cents/pennies worth to this? Thanks in advance, as always, for your time ... -------------------------------------------------------- Barry Dean Principal Programmer/Analyst Networks Team Computing Service Department

2 1

ntlm_auth not respected
by Chris Parker 22 Aug '13

22 Aug '13

It seems that I have ntlm_auth configured to talk to Samba correctly. As it positively works when run from the CLI and FR even shows a positive login, but that positive login never seems to be sent to the authentication stage. More food for thought once I tackle this, is that when I try to link all this together with a Netgear WAP, plain-text users in the users file works perfectly fine. Log output: rad_recv: Access-Request packet from host 127.0.0.1 port 35826, id=114, length=57 User-Name = "wyse1" User-Password = "K503D" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "wyse1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=wyse1 [ntlm_auth] expand: --password=%{User-Password} -> --password=K503D Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [wyse1/K503D] (from client localhost port 1812) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> wyse1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 114 to 127.0.0.1 port 35826 Waking up in 4.9 seconds. Cleaning up request 7 ID 114 with timestamp +843 Ready to process requests.

2 10

User get after few minute
by Sokphak TOUCH 22 Aug '13

22 Aug '13

Dear All, I have issue with configure radius. I have one Juniper MX80 for doing as LNS in my lab and FreeRADIUS Version 2.1.12 installed. I can see there is successful connected log to radius but after around 1mn it connect again and again. I have check in MX80 but has no any significant log. Below is the full log in debug mode of radius during connect. Please advice rad_recv: Access-Request packet from host 22.0.0.77 port 51280, id=32, length=237 User-Name = "testuser(a)intel.com" Service-Type = Framed-User CHAP-Password = 0x6424072271437b7df6f638bd05496fe856 CHAP-Challenge = 0xcf44cbf713aedaac40824ffc535532d96e7b109b025cb2a3b0 Chargeable-User-Identity = "" Acct-Session-Id = "491" ERX-Dhcp-Mac-Addr = "0000.0000.0000" NAS-Identifier = "MX80-LAB-LNS" NAS-Port = 4095 NAS-Port-Id = "Ip:192.168.77.1:192 .168.77.2:55776:38107:10971:4534:2765160448" NAS-Port-Type = Virtual ERX-Attr-162 = 0x05f5e1 ERX-Attr-163 = 0x05f5e1 NAS-IP-Address = 22.0.0.77 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "eintel.com" for User-Name = "testuser(a)intel.com" [suffix] No such realm "eintel.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> testuser(a)intel.com [sql] sql_set_user escaped user --> 'testuser(a)intel.com' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser(a)intel.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser(a)intel.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = ' testuser(a)intel.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "testuser(a)intel.com" with CHAP password [chap] Using clear text password "saba" for user testuser(a)intel.comauthentication. [chap] chap user testuser(a)intel.com authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser(a)intel.com [sql] sql_set_user escaped user --> 'testuser(a)intel.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x6424072271437b7df6f638bd05496fe856 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( ' testuser(a)intel.com', '0x6424072271437b7df6f638bd05496fe856', 'Access-Accept', '2013-08-22 15:51:05') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( ' testuser(a)intel.com', '0x6424072271437b7df6f638bd05496fe856', 'Access-Accept', '2013-08-22 15:51:05') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 32 to 22.0.0.77 port 51280 Framed-IP-Address = 10.1.1.123 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 32 with timestamp +177 Ready to process requests. Regards, SP

2 1

Re: debian, wpa_supplicant, TTLS/TLS working, PEAP/TLS fails
by Alan Buxey 22 Aug '13

22 Aug '13

TLS in PEAP. Yes I've seen it. And EAP-MSCHAPV2 in PEAP alan

3 2

FR3.0/Policy.D
by ultaman khoo 22 Aug '13

22 Aug '13

Hi All, I have faced an issue with NAS IP Changes causes radius accouting insert instead of update, this has causes an issue with the reporting wenever the NAS IP changes, for example the usage of the users will be duplicate if you sum up the usage for 1 day for example. i have tested the FR3.0RC0 with the policy.d in place, below is the issue i encounter during the testing in lab. >From Debug Log: Radius accouting start - OK rad_recv: Accounting-Request packet from host 10.69.1.35 port 62260, id=11, length=39 User-Name = 'cskhoo' Acct-Status-Type = Start Acct-Session-Id = '900' (0) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (0) group preacct { (0) - entering group preacct {...} (0) [preprocess] = ok (0) policy acct_unique { (0) - entering policy acct_unique {...} (0) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (0) expand: "%{string:Class}" -> '' (0) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (0) else else { (0) - entering else else {...} (0) update request { (0) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> 'c2141489ad2dd37607b19fd75af8623f' (0) Acct-Unique-Session-Id := "c2141489ad2dd37607b19fd75af8623f" (0) } # update request = ok (0) - else else returns ok (0) - policy acct_unique returns ok (0) suffix : No '@' in User-Name = "cskhoo", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) [files] = noop (0) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (0) group accounting { (0) - entering group accounting {...} (0) detail : expand: "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/usr/local/var/log/radius/radacct/10.69.1.35/detail-20130815' (0) detail : /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.69.1.35/detail-20130815 (0) detail : expand: "%t" -> 'Thu Aug 15 02:53:59 2013' (0) [detail] = ok (0) [unix] = noop (0) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.start.query' (0) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql : expand: "%{User-Name}" -> 'cskhoo' (0) sql : SQL-User-Name updated (0) sql : expand: "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" -> 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', 'c2141489ad2dd37607b19fd75af8623f', 'cskhoo', '', '10.69.1.35', '', '', FROM_UNIXTIME(1376506439), FROM_UNIXTIME(1376506439), NULL, '0', '', '', '', '0', '0', '', '', '', '', '', '')' rlm_sql (sql): Executing query: 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', 'c2141489ad2dd37607b19fd75af8623f', 'cskhoo', '', '10.69.1.35', '', '', FROM_UNIXTIME(1376506439), FROM_UNIXTIME(1376506439), NULL, '0', '', '', '', '0', '0', '', '', '', '', '', '')' rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (0): Too many free connections (5 > 3) rlm_sql_mysql: Socket destructor called, closing socket (0) [-sql] = ok (0) [exec] = noop (0) attr_filter.accounting_response : expand: "%{User-Name}" -> 'cskhoo' (0) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (0) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 11 from 0.0.0.0 port 1813 to 10.69.1.35 port 62260 (0) Finished request 0. Waking up in 0.2 seconds. (0) Cleaning up request packet ID 11 with timestamp +10 Ready to process requests. Radius Acct Update - OK rad_recv: Accounting-Request packet from host 10.69.1.35 port 62261, id=12, length=39 User-Name = 'cskhoo' Acct-Status-Type = Interim-Update Acct-Session-Id = '900' (1) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (1) group preacct { (1) - entering group preacct {...} (1) [preprocess] = ok (1) policy acct_unique { (1) - entering policy acct_unique {...} (1) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (1) expand: "%{string:Class}" -> '' (1) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (1) else else { (1) - entering else else {...} (1) update request { (1) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> 'c2141489ad2dd37607b19fd75af8623f' (1) Acct-Unique-Session-Id := "c2141489ad2dd37607b19fd75af8623f" (1) } # update request = ok (1) - else else returns ok (1) - policy acct_unique returns ok (1) suffix : No '@' in User-Name = "cskhoo", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (1) group accounting { (1) - entering group accounting {...} (1) detail : expand: "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/usr/local/var/log/radius/radacct/10.69.1.35/detail-20130815' (1) detail : /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.69.1.35/detail-20130815 (1) detail : expand: "%t" -> 'Thu Aug 15 02:54:31 2013' (1) [detail] = ok (1) [unix] = noop (1) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.interim-update.query' (1) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (1) sql : expand: "%{User-Name}" -> 'cskhoo' (1) sql : SQL-User-Name updated (1) sql : expand: "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" -> 'UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1376506471), acctinterval = 1376506471 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '', acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.35'' rlm_sql (sql): Executing query: 'UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1376506471), acctinterval = 1376506471 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '', acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.35'' rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (1): Too many free connections (4 > 3) rlm_sql_mysql: Socket destructor called, closing socket (1) [-sql] = ok (1) [exec] = noop (1) attr_filter.accounting_response : expand: "%{User-Name}" -> 'cskhoo' (1) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (1) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 12 from 0.0.0.0 port 1813 to 10.69.1.35 port 62261 (1) Finished request 1. Waking up in 0.2 seconds. (1) Cleaning up request packet ID 12 with timestamp +42 Ready to process requests. Radius Update when NAS IP Changes - Error as below rad_recv: Accounting-Request packet from host 10.69.1.31 port 65146, id=13, length=39 User-Name = 'cskhoo' Acct-Status-Type = Interim-Update Acct-Session-Id = '900' (2) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (2) group preacct { (2) - entering group preacct {...} (2) [preprocess] = ok (2) policy acct_unique { (2) - entering policy acct_unique {...} (2) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (2) expand: "%{string:Class}" -> '' (2) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (2) else else { (2) - entering else else {...} (2) update request { (2) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> '47fe864f0f34504bea1670f9b8e542e4' (2) Acct-Unique-Session-Id := "47fe864f0f34504bea1670f9b8e542e4" (2) } # update request = ok (2) - else else returns ok (2) - policy acct_unique returns ok (2) suffix : No '@' in User-Name = "cskhoo", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) [files] = noop (2) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (2) group accounting { (2) - entering group accounting {...} (2) detail : expand: "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/usr/local/var/log/radius/radacct/10.69.1.31/detail-20130815' (2) detail : /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.69.1.31/detail-20130815 (2) detail : expand: "%t" -> 'Thu Aug 15 02:55:53 2013' (2) [detail] = ok (2) [unix] = noop (2) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.interim-update.query' (2) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (2) sql : expand: "%{User-Name}" -> 'cskhoo' (2) sql : SQL-User-Name updated (2) sql : expand: "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" -> 'UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1376506553), acctinterval = 1376506553 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '', acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.31'' rlm_sql (sql): Executing query: 'UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(1376506553), acctinterval = 1376506553 - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '', acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.31'' (2) sql : No records updated (2) sql : Trying next query... (2) sql : expand: "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" -> 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', '47fe864f0f34504bea1670f9b8e542e4', 'cskhoo', '', '10.69.1.31', '', '', FROM_UNIXTIME(1376506553 - 0), FROM_UNIXTIME(1376506553), NULL, '', '', '', '0' << 32 | '0', '0' << 32 | '0', '', '', '', '', '')' rlm_sql (sql): Executing query: 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', '47fe864f0f34504bea1670f9b8e542e4', 'cskhoo', '', '10.69.1.31', '', '', FROM_UNIXTIME(1376506553 - 0), FROM_UNIXTIME(1376506553), NULL, '', '', '', '0' << 32 | '0', '0' << 32 | '0', '', '', '', '', '')' rlm_sql_mysql: MYSQL check_error: 1136 received rlm_sql (sql): Database query error: Column count doesn't match value count at row 1 rlm_sql_mysql: MYSQL check_error: 1136 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Column count doesn't match value count at row 1' (2) sql : No additional queries configured rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 124 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 124 seconds rlm_sql_mysql: Socket destructor called, closing socket (2) [-sql] = noop (2) [exec] = noop (2) attr_filter.accounting_response : expand: "%{User-Name}" -> 'cskhoo' (2) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (2) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 13 from 0.0.0.0 port 1813 to 10.69.1.31 port 65146 (2) Finished request 2. Waking up in 0.3 seconds. (2) Cleaning up request packet ID 13 with timestamp +124 Ready to process requests. Radius Acct Stop after NAS IP Changes - another record with stop time was added into mysql DB, the previous record will not have stop time. rad_recv: Accounting-Request packet from host 10.69.1.31 port 53956, id=14, length=39 User-Name = 'cskhoo' Acct-Status-Type = Stop Acct-Session-Id = '900' (3) # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default (3) group preacct { (3) - entering group preacct {...} (3) [preprocess] = ok (3) policy acct_unique { (3) - entering policy acct_unique {...} (3) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) (3) expand: "%{string:Class}" -> '' (3) ? if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (3) else else { (3) - entering else else {...} (3) update request { (3) expand: "%{md5:%{User-Name},%{Acct-Session-ID},%{NAS-IP-Address},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}" -> '47fe864f0f34504bea1670f9b8e542e4' (3) Acct-Unique-Session-Id := "47fe864f0f34504bea1670f9b8e542e4" (3) } # update request = ok (3) - else else returns ok (3) - policy acct_unique returns ok (3) suffix : No '@' in User-Name = "cskhoo", looking up realm NULL (3) suffix : No such realm "NULL" (3) [suffix] = noop (3) [files] = noop (3) # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default (3) group accounting { (3) - entering group accounting {...} (3) detail : expand: "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" -> '/usr/local/var/log/radius/radacct/10.69.1.31/detail-20130815' (3) detail : /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.69.1.31/detail-20130815 (3) detail : expand: "%t" -> 'Thu Aug 15 02:56:37 2013' (3) [detail] = ok (3) [unix] = noop (3) sql : expand: "%{tolower:type.%{Acct-Status-Type}.query}" -> 'type.stop.query' (3) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (3) sql : expand: "%{User-Name}" -> 'cskhoo' (3) sql : SQL-User-Name updated (3) sql : expand: "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" -> 'UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1376506597), acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = '', connectinfo_stop = '' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.31'' rlm_sql (sql): Executing query: 'UPDATE radacct SET acctstoptime = FROM_UNIXTIME(1376506597), acctsessiontime = '', acctinputoctets = '0' << 32 | '0', acctoutputoctets = '0' << 32 | '0', acctterminatecause = '', connectinfo_stop = '' WHERE acctsessionid = '900' AND username = 'cskhoo' AND nasipaddress = '10.69.1.31'' (3) sql : No records updated (3) sql : Trying next query... (3) sql : expand: "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp} - %{%{Acct-Session-Time}:-0}), FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" -> 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', '47fe864f0f34504bea1670f9b8e542e4', 'cskhoo', '', '10.69.1.31', '', '', FROM_UNIXTIME(1376506597 - 0), FROM_UNIXTIME(1376506597), FROM_UNIXTIME(1376506597), '', '', '', '', '0' << 32 | '0', '0' << 32 | '0', '', '', '', '', '', '')' rlm_sql (sql): Executing query: 'INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('900', '47fe864f0f34504bea1670f9b8e542e4', 'cskhoo', '', '10.69.1.31', '', '', FROM_UNIXTIME(1376506597 - 0), FROM_UNIXTIME(1376506597), FROM_UNIXTIME(1376506597), '', '', '', '', '0' << 32 | '0', '0' << 32 | '0', '', '', '', '', '', '')' rlm_sql (sql): Released connection (4) rlm_sql (sql): Opening additional connection (5) rlm_sql_mysql: Starting connect to MySQL server (3) [-sql] = ok (3) [exec] = noop (3) attr_filter.accounting_response : expand: "%{User-Name}" -> 'cskhoo' (3) attr_filter.accounting_response : Matched entry DEFAULT at line 12 (3) [attr_filter.accounting_response] = updated Sending Accounting-Response of id 14 from 0.0.0.0 port 1813 to 10.69.1.31 port 53956 (3) Finished request 3. Waking up in 0.2 seconds. (3) Cleaning up request packet ID 14 with timestamp +168 Ready to process requests. Regards, Ultaman

2 7

rlm_python
by stefan.paetow＠diamond.ac.uk 21 Aug '13

21 Aug '13

Hello all, I'm currently attempting to use rlm_python to query LDAP (with python-ldap) and then return an XML string in a VSA (SAML-AAA-Assertion). However, when I try to load it, I get the dreaded "undefined symbol: PyExc_SystemError" error. This is on Ubuntu 12 with, I know, I know, FreeRADIUS 2.1.10. Python-LDAP was built on the local machine for the newest version (although the existing version in the Ubuntu repository has the same problem). Freeradius_samlldap exists in the correct path for Python eggs, and this is the PYTHONPATH (when I print it with Python): /usr/local/lib/python2.7/dist-packages/pysaml2-0.4.2-py2.7.egg,/usr/local/lib/python2.7/dist-packages/repoze.who-1.0.18-py2.7.egg,/usr/local/lib/python2.7/dist-packages/zope.interface-4.0.5-py2.7-linux-x86_64.egg,/usr/local/lib/python2.7/dist-packages/Paste-1.7.5.1-py2.7.egg,/usr/local/lib/python2.7/dist-packages/httplib2-0.8-py2.7.egg,/usr/local/lib/python2.7/dist-packages/decorator-3.4.0-py2.7.egg,/usr/local/lib/python2.7/dist-packages/freeradius_samlldap-0.0.1-py2.7.egg,/usr/local/lib/python2.7/dist-packages/python_ldap-2.4.13-py2.7-linux-x86_64.egg,/etc/freeradius/modules,/usr/local/lib/python2.7/dist-packages,/usr/lib/python2.7,/usr/lib/python2.7/plat-linux2,/usr/lib/python2.7/lib-tk,/usr/lib/python2.7/lib-old,/usr/lib/python2.7/lib-dynload,/usr/lib/python2.7/dist-packages,/usr/lib/pymodules/python2.7 >From what I understand, using ldd -r will list several unresolved imports, but that is supposedly correct? Or is that horribly wrong? The usual debug log is below: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Sep 24 2012 at 17:58:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/saml including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/umbrella_ldap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/umbrella-inner including configuration file /etc/freeradius/sites-enabled/umbrella main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } realm umbrellaid.org { } realm LOCAL { } realm NULL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "diamond-umbrella" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server umbrella-inner { # from file /etc/freeradius/sites-enabled/umbrella-inner modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/modules/umbrella_ldap ldap { server = "127.0.0.1" port = 389 password = "root" identity = "cn=admin" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" basedn = "ou=people,dc=eurofel,dc=eu" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id rlm_ldap: LDAP EAAHash mapped to RADIUS Chargeable-User-Identity conns: 0x1ff48d0 Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "gtc" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "umbrella-inner" include_length = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "reply_log" from file /etc/freeradius/modules/detail.log detail reply_log { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } Module: Linked to module rlm_python Module: Instantiating module "python" from file /etc/freeradius/modules/saml python_init done python { mod_instantiate = "freeradius_samlldap" func_instantiate = "instantiate" mod_post_auth = "freeradius_samlldap" func_post_auth = "post_auth" } rlm_python:python_load_function: module 'freeradius_samlldap' is not found rlm_python:EXCEPT:<type 'exceptions.ImportError'>: /usr/local/lib/python2.7/dist-packages/python_ldap-2.4.13-py2.7-linux-x86_64.egg/_ldap.so: undefined symbol: PyExc_SystemError rlm_python:python_load_function: failed to import python function 'freeradius_samlldap.instantiate' /etc/freeradius/modules/saml[1]: Instantiation failed for module "python" /etc/freeradius/sites-enabled/umbrella-inner[149]: Failed to load module "python". /etc/freeradius/sites-enabled/umbrella-inner[133]: Errors parsing post-auth section. Some help with this is very much appreciated! :-) Stefan -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

4 5