Hello, Happy Wednesday Im attempting to move from FR v3.0.20 (rpm) to v3.2.0 (docker) Noticing some interesting behavior, mostly with regex and huntgroups This no longer works in huntgroups router NAS-Identifier =~ "[[:alnum:]]+-[[:alnum:]]+-[[:alnum:]]+-(?i)rtr-[[:alnum:]]+" switch NAS-Identifier =~ "[[:alnum:]]+-[[:alnum:]]+-[[:alnum:]]+-(?i)sw-[[:alnum:]]+" switch-olt NAS-Identifier =~ "[[:alnum:]]+-[[:alnum:]]+-[[:alnum:]]+-(?i)olt-[[:alnum:]]+" So then i commented those out and attempted unlang in (sites-enabled/default) which worked ok.. #if ((&Huntgroup-Name == 'switch') && (LDAP-Group == 'switch-manager')) { if ((&NAS-Identifier =~ /[A-z,a-z,0-9]*-[A-z,a-z,0-9]*-[A-z,a-z,0-9]*-sw-[0-9]*/i) && (LDAP-Group == 'switch-manager')) { But that has issues with the users (authorize) file because I need radius to respond with specific attributes depending on both groups (ldap/huntgroup). DEFAULT Huntgroup-Name == "router", Ldap-Group == "router-manager" Service-Type += Administrative-User, Cisco-AVPair = "shell:roles=network-admin" DEFAULT Huntgroup-Name == "switch", Ldap-Group == "switch-manager" Service-Type += Administrative-User, Hp-Command-Exception = Deny-List, Hp-Command-String = "menu;", 11XXUserRoles = "Admin" NOKIA-AAA = "3", NOKIA-ATM = "3", NOKIA-Alarm = "3", ... ... If i just do DEFAULT Ldap-Group == 'router-manager' DEFAULT Ldap-Group == 'switch-manager' then if a user is part of both ldap groups, then it will always match the first DEFAULT and not the second. So that user trying to access a switch will get the router attributes as a response. I've tried different huntgroups configs but they dont get resolved switch NAS-Identifier =~ /([a-z0-9]+-){3}sw-[0-9]+/i switch NAS-Identifier =~ /[A-Za-z0-9]+-[A-Za-z0-9]+-[A-Za-z0-9]+-SW-[0-9]+/ switch NAS-Identifier =~ /[a-z0-9]+-[a-z0-9]+-[a-z0-9]+-sw-[0-9]+/i The the 2nd and 3rd one are accepted by radius but it would not resolve in site-enabled/default: freeradius | Wed Jul 13 17:18:56 2022 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) freeradius | Wed Jul 13 17:18:56 2022 : Debug: /[a-z0-9]+-[a-z0-9]+-[a-z0-9]+-sw-[0-9]+/i freeradius | Wed Jul 13 17:18:56 2022 : Debug: Parsed xlat tree: freeradius | Wed Jul 13 17:18:56 2022 : Debug: literal --> /[a-z0-9]+-[a-z0-9]+-[a-z0-9]+-sw-[0-9]+/i freeradius | Wed Jul 13 17:18:56 2022 : Debug: (0) preprocess: EXPAND /[a-z0-9]+-[a-z0-9]+-[a-z0-9]+-sw-[0-9]+/i freeradius | Wed Jul 13 17:18:56 2022 : Debug: (0) preprocess: --> /[a-z0-9]+-[a-z0-9]+-[a-z0-9]+-sw-[0-9]+/i freeradius | Wed Jul 13 17:18:56 2022 : Debug: No old matches freeradius | Wed Jul 13 17:18:56 2022 : Debug: Adding 33 matches freeradius | Wed Jul 13 17:18:56 2022 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) freeradius | Wed Jul 13 17:18:56 2022 : Debug: (0) [preprocess] = ok freeradius | Wed Jul 13 17:18:56 2022 : Debug: (0) modsingle[authorize]: calling files (rlm_files) ... ... freeradius | Wed Jul 13 17:18:57 2022 : Debug: (0) if ((&Huntgroup-Name == 'switch') && (LDAP-Group == 'switch-manager')) { freeradius | Wed Jul 13 17:18:57 2022 : ERROR: (0) Failed retrieving values required to evaluate condition What am i missing? Any input is appreciated Best, Dave
On Jul 13, 2022, at 1:24 PM, Dave Macias <davama@gmail.com> wrote:
Im attempting to move from FR v3.0.20 (rpm) to v3.2.0 (docker)
Noticing some interesting behavior, mostly with regex and huntgroups
This no longer works in huntgroups
router NAS-Identifier =~ "[[:alnum:]]+-[[:alnum:]]+-[[:alnum:]]+-(?i)rtr-[[:alnum:]]+"
So far as I know, nothing related to that has changed from 3.0.x to 3.2. Did you change which regular expression libraries the systems are using?
If i just do
DEFAULT Ldap-Group == 'router-manager' DEFAULT Ldap-Group == 'switch-manager'
then if a user is part of both ldap groups, then it will always match the first DEFAULT and not the second.
Yes... see the "Fall-Through" attribute. There's examples in mods-config/files/authorize. The same system works here. Alan DeKok.
Thank you Alan for the kind response
So far as I know, nothing related to that has changed from 3.0.x to 3.2.
Did you change which regular expression libraries the systems are using?
Well, im using the docker image FROM freeradius/freeradius-server:3.2.0 so not sure what libraries i may need to add. Comparing debug (-Xxx) output of rpm vs docker i get: docker:Wed Jul 13 18:39:46 2022 : Debug: regex-pcre : no docker:Wed Jul 13 18:39:46 2022 : Debug: regex-posix : yes docker:Wed Jul 13 18:39:46 2022 : Debug: regex-posix-extended : yes rpm:Wed Jul 13 18:44:31 2022 : Debug: regex-pcre : yes rpm:Wed Jul 13 18:44:31 2022 : Debug: regex-posix : no rpm:Wed Jul 13 18:44:31 2022 : Debug: regex-posix-extended : no Im guessing i am missing regex-pcre. Is that correct? How do i enable that? Thanks!!
On Jul 13, 2022, at 2:49 PM, Dave Macias <davama@gmail.com> wrote:
Im guessing i am missing regex-pcre. Is that correct? How do i enable that?
You can build your own docker images. See scripts/docker/ There are directories for every OS. You'll have to find the OS you're using, and then add a rule to install pcre before building the image. Alan DeKok.
You can build your own docker images. See scripts/docker/
There are directories for every OS. You'll have to find the OS you're using, and then add a rule to install pcre before building the image.
Thank you Alan I went and built an image based on python3.9-alpine with pcre and got it working. Woohoo I am struggling to get rlm_python3 to get compiled but will play around with it first. For posterity, below is my Dockerfile. Thank you again for the assistance! Best, Dave FROM python:3.9-alpine ENV VERSION v3.2.x RUN \ apk --update add \ openssl-dev mariadb-dev postgresql-dev gdbm-dev readline-dev \ bash libtool autoconf automake perl-dev python3-dev openldap-dev krb5-dev \ unixodbc-dev linux-pam-dev sqlite-dev talloc-dev libpcap-dev \ linux-headers curl-dev hiredis-dev json-c-dev \ net-snmp-tools pcre-dev pcre2-dev icu-data-full collectd-dev libcap-dev doxygen asciidoctor libmemcached-dev freetds-dev \ talloc \ ruby-dev \ openssl \ && apk add --virtual .build-dependencies \ git \ build-base \ automake \ && git clone --depth 1 --single-branch -b $VERSION \ https://github.com/FreeRADIUS/freeradius-server.git \ && cd freeradius-server \ && ln -s /usr/include/json-c json \ && ./configure \ --build=$CBUILD \ --host=$CHOST \ --prefix=/usr \ --sysconfdir=/etc \ --mandir=/usr/share/man \ --infodir=/usr/share/info \ --localstatedir=/var \ --datarootdir=/usr/share \ --libdir=/usr/lib/freeradius \ --with-logdir=/var/log/radius \ --with-radacctdir=/var/log/radius/radacct \ --with-system-libtool \ --with-system-libltdl \ --with-shared-libs \ --with-udpfromto \ --with-rlm_sql_sqlite \ --with-rlm_sql_postgresql \ --with-rlm_sql_mysql \ --with-rlm_krb5 \ --with-rlm_rest \ --with-rlm_redis \ --with-rlm_perl \ --with-rlm_ruby \ --with-rlm_rediswho \ --without-rlm_cassandra \ --without-rlm_eap_tnc \ --without-rlm_eap_ikev2 \ --without-rlm_sql_iodbc \ --without-rlm_sql_oracle \ --without-rlm_yubikey \ --without-rlm_ykclient \ --with-jsonc-include-dir="$PWD" \ --disable-developer \ --with-pcre \ --with-rlm_python3 \ --with-rlm-python3-lib-dir=/usr/local/lib/python3.9 \ --with-rlm-python3-include-dir=/usr/local/include/python3.9 \ --with-rlm-python3-config-bin=/usr/local/bin/python3-config \ && make \ && make install \ && cd - \ && rm -rf /freeradius-server \ && apk del .build-dependencies CMD ["radiusd", "-X"]
participants (2)
-
Alan DeKok -
Dave Macias