- Freeradius-Users - lists.freeradius.org

Re: Re: Customization of authorize_reply_query
by Václav Pernica 02 Oct '12

02 Oct '12

Phil Mayers: > > Just set a null query e.g. > > select null where 1=0 > Thanks a lot! This was the hint I need.. I used: select null from table where 1=0 because it required FROM. One more question. I set the number of sql connections to make to server to 5 (default value). I noticed that if all connections are currently in use, the authentication fails: Tue Oct 2 16:07:10 2012 : Error: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Is there some parameter that would cause to wait until next next connection will be available instead of failing authentication? Thanks Vaclav

3 2

RE: exec module not seeming to run something
by Franks Andy (RLZ) IT Systems Engineer 02 Oct '12

02 Oct '12

Thanks Alan, Good call about the path thing. I also forgot about the ssh prompt to accept a new ssh key, which obviously can't be seen, so copied the known_hosts file from another user to the freerad/.ssh folder and altered the permissions. Works fine now Thanks very much Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 02 October 2012 10:30 To: FreeRadius users mailing list Subject: Re: exec module not seeming to run something Franks Andy (RLZ) IT Systems Engineer wrote: > The problem is it doesn’t work. I can run the script from a shell prompt > and the backup functions fine, the variables outputting to the > testssh.out file and the ssh command running ok. Freeradius fires the > script off ok after an accounting session and the bits get written to > the testssh.out file, including the PID of the ssh process but the > command itself doesn’t work. > > Am I missing something obvious (again)? PATH Use the complete filename for all executables in the shell script. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Customization of authorize_reply_query
by Václav Pernica 02 Oct '12

02 Oct '12

Hello I use the FR just to only authenticate the user. The data are stored in Oracle DD. Is there any option how to disable authorize_reply_query? The reason is that that DB contains millions of records and each query take some some time. Depending on DB load is 0.5 seconds but during the peak it goes up 7 seconds. As the users are authenticated after authorize_check_query, the reply query is in my case only delaying the authentication. Maybe there is some option how to set some static response for the reply query? Thank you Vaclav

4 3

exec module not seeming to run something
by Franks Andy (RLZ) IT Systems Engineer 02 Oct '12

02 Oct '12

Hi all, I keep coming back with questions - hopefully I'll be able to answer someone else's soon! I am trying to run a simple command to fire off a network backup each time an admin logs off a switch via accounting. I'm only testing this as a concept for now. I have rancid installed on another server, merrily doing backups fine. I have a script local to the freeradius machine that fires off a backup script job via ssh for the switch in question using the exec module in the accounting section of the default VS: if ((NAS-Port-Type == Virtual) && (Acct-Status-Type == Stop)) { testssh } Modules/exec: exec testssh { wait = no input_pairs = request program = "/etc/freeradius/testssh.sh %{User-Name} %{NAS-IP-Address}" } /etc/freeradius/testssh.sh #!/bin/bash echo $1 $2 > /etc/freeradius/testssh.out echo `date +%T` >> /etc/freeradius/testssh.out sshpass -p password ssh $1(a)10.128.176.5 /usr/local/rancid/bin/rancid-run -r $2 echo $! >> /etc/freeradius/testssh.out exit 0 The problem is it doesn't work. I can run the script from a shell prompt and the backup functions fine, the variables outputting to the testssh.out file and the ssh command running ok. Freeradius fires the script off ok after an accounting session and the bits get written to the testssh.out file, including the PID of the ssh process but the command itself doesn't work. Am I missing something obvious (again)? Comments welcome on how clever/ridiculous this idea is! :-) Thanks Andy

2 1

Disconnect Request instead of Accounting Response
by ramakrishna 02 Oct '12

02 Oct '12

Hi, I am using FreeRADIUS 2.2 and I have one query related to originating Disconnect Request. I have read the originate-coa documentation and I am able to send the Disconnect Request without any problem. But my query is I see that Accounting response is being sent before the Disconnect Request for a given request. Is it standard behavior? If yes how can we send only Disconnect request instead of Accounting response? Thanks in advance. -- Best Regards, M.Rama Krishna Prasad,

2 2

access-period-time
by John Doe 01 Oct '12

01 Oct '12

Hi all, this's my first post in this list at this time!!! i need some users can connect at least 3 times in a hour, for example if user1 connect at 8:00 AM limit him connect again in 15 minutes again, really i try it but not work for me. PLEASE THANKS in advance Johndoesms PD) sorry for my english i do not speak it

3 9

Free Radius - detail log file.
by Luis H. Forchesatto 01 Oct '12

01 Oct '12

Greetings experts. I got an radius service running on my server that stores detail account logs in files and to MySQL. Since this is redundant I would like do disable the detail log files. Searching through the internet I've found many questions about disabling detail log files but most people said the suggested configuration was mostly unsuccessful. How could I disable this logs? Server config: - Debian 5 - FreeRADIUS v. 2.1.10 -- Att.* ***

4 5

Using ldap_xlat in unlang with Chars not allowed in an ldap search
by Daniel Finger 01 Oct '12

01 Oct '12

Hi! I have a Problem using the ldap Module to search in the ldap Tree for a specific Attribute Containing a (. I am using FreeRadius (2.1.12) for 802.1X Authentification (EAP-TLS) which is working fine. After successful EAP Authentication, I want to check if the User has an Entry in the LDAP: During authenticate (I just changed a bit of formattig to have it readable here): Auth-Type eap { eap # Some Code to react to EAP Auth Failures if ( "%{TLS-Client-Cert-Common-Name}" != "" ) { update control { Tmp-String-1 = "%{ldap_WLAN_auth: ldap:///cn=UserAccounts,dc=DE?cn?sub? ( & (CommonName=%{TLS-Client-Cert-Common-Name}) (allowedSSID=%{Aruba-Essid-Name}) )}" } if ("%{control:Tmp-String-1}" == "") { update control { Auth-Type := "Reject" } update reply { Reply-Message = "The user %{User-Name} is not known or allowed to access the SSID %{Aruba-Essid- Name}" } reject } Now the {TLS-Client-Cert-Common-Name} contains a ( and a ) which leads to a bad search filter: |Debug: [ldap_WLAN_auth] - ldap_xlat |Info: expand: ldap:///cn=UserAccounts,dc=NI-NGN,dc=DE?cn?sub?(&(CommonName=%{TLS-Client-Cert-Common-Name})(allowedSSID=%{Aruba-Essid-Name})) -> ldap:///cn=UserAccounts,dc=DE?cn?sub?(&(CommonName=Testuser(10) Daniel)(allowedSSID=ssid-data)) |Debug: [ldap_WLAN_auth] ldap_get_conn: Checking Id: 0 |Debug: [ldap_WLAN_auth] ldap_get_conn: Got Id: 0 |Debug: [ldap_WLAN_auth] performing search in cn=UserAccounts,dc=DE, with filter (&(CommonName=Testuser(10) Daniel)(allowedSSID=ssid-data)) |ldap_search() failed: Bad search filter: (&(CommonName=Testuser(10) Daniel)(allowedSSID=ssid-data)) |Debug: [ldap_WLAN_auth] Search returned error |Debug: [ldap_WLAN_auth] ldap_release_conn: Release Id: 0 |Info: expand: %{ldap_WLAN_auth:ldap:///cn=UserAccounts,dc=DE?cn?sub?(&(CommonName=%{TLS-Client-Cert-Common-Name})(allowedSSID=%{Aruba-Essid-Name}))} -> If I have searched correctly it should work if I rewrite the Attribute with \28 for ( and \29 for ) (as ascii string, not escaped :-)) As it seems the rewrite Module is not the solution as i could not get it to do this :-) It works as I expected it to do if the CommonName does not contain the Parentheses. Any Ideas to work around these Parentheses? Preferably using any Char allowed in the Common Name, as i expect it to contain Umlauts or an & Char. Greetings, Daniel

2 3

Group verification with Multiple SSID
by Chitrang Srivastava 01 Oct '12

01 Oct '12

Hi, I have a use case where I have 2 SSID and 2 databases of users , one locally configured users in a group and other set of users on a LDAP server. SSID 1 - > Local group of users on radius server SSID 2 -> Set of user configured in LDAP Authentication : PEAP- MSCHAPv2 I have modified mschap module to do ntlm_auth for SSID2 and use default mschap module for SSID 1, So now I have 2 mschap module in my radiusd.conf and uses unland to place if-elsif condition in authroize and authenticate block. Above setup is working fine. But I also need to verify ldap group ( i.e. user belongs to group or not) , Issues is , for SSID 1 users , radiusd is trying to do a group comparison on ldap server , which eventually fails. I guess the reason for this we have 1 users file and for each user radiusd refers that , Their should be way for radiusd to know which user file to refer for each SSID. To solve the issues I have create 2 users file users - > for LDAP users group policy users_local -> for local users create 2 modules like this: *files_local* { usersfile = ${confdir}/*users_local* *----> Above created file* acctusersfile = ${confdir}/acct_users compat = no } and modified *authroize* block if (Wlan == "local") { * files_local * } elsif (Wlan == "ldap") { redundant { ldap_primary ldap_secondary } } else { *files_local* } It seems to be working , Just wanted to check with experts here , is this is the way to go ? or their is some other simpler way ?

2 1

Radius Stress testing
by QASIM RAO 01 Oct '12

01 Oct '12

hi, i doing stress testing of my freeradius with help of perl script. when i run perl script i runs and gives output, but in log file it genrate an error Mon Oct 1 04:45:46 2012: Error: rlm_radutmp: No Accounting-Status-Type record. on each request and when i run radiusd in debug mode radiusd -X it it shows same error and not going in procedure... and shows rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/192.168.1.13/detail-20121001:05 modcall[accounting]: module "detail" returns ok for request 932rlm_radutmp: No Accounting-Status-Type record. modcall[accounting]: module "radutmp" returns noop for request 932 modcall[accounting]: module "sql" returns ok for request 932modcall: leaving group accounting (returns ok) for request 932Sending Accounting-Response of id 79 to 192.168.1.13 port 34641 ReturnCode = 1 User-Name = "82723EH5F7560"Finished request 932Going to the next request--- Walking the entire request list ---Cleaning up request 932 ID 79 with timestamp 50695ba0Nothing to do. Sleeping until we see a request. Please help me in this.. regardsRao Qasim

4 6