Hi there, I wonder if there is a way to "transport" data to an xlat function on another way than attaching it to a Radius request... I'm asking this because we have quite a lot of parameters that we want to be expanded in the module config file. These parameters depend on the user realm. So when a request comes in, our module does a look up in a realm to connection data table. This connection data again is used to make a REST authentication. In the module config we have something like this: uri = "https://%{control:Cust-Gateway}/api/%{control:Cust-App-Id}/etc/..." data = 'grant_type=password&username=%{urlquote:%{control:Cust-Client-Id}}&password=%{urlquote:%{control:Cust-Client-Secret}}' In the authorize function we do the DB call and when the realm is valid we add these custom attributes to the request. This works, but maybe there's a more elegant way than adding attributes to the request only for xla expansion. The xlat callback function has only a handle to the instance configuration. I don't see a way to store the data-by-realm there. Of course we could do a data lookup in the xlat callback, but I don't like this approach because this would result in two DB calls per request. Cheers, Till
On Aug 27, 2021, at 4:36 PM, g4-lisz@tonarchiv.ch wrote:
I wonder if there is a way to "transport" data to an xlat function on another way than attaching it to a Radius request...
All data is associated with a request. Or, it's static in the configuration files. There really isn't any other way to do this.
I'm asking this because we have quite a lot of parameters that we want to be expanded in the module config file.
These parameters depend on the user realm. So when a request comes in, our module does a look up in a realm to connection data table. This connection data again is used to make a REST authentication.
In the module config we have something like this:
uri = "https://%{control:Cust-Gateway}/api/%{control:Cust-App-Id}/etc/..." data = 'grant_type=password&username=%{urlquote:%{control:Cust-Client-Id}}&password=%{urlquote:%{control:Cust-Client-Secret}}'
In the authorize function we do the DB call and when the realm is valid we add these custom attributes to the request.
This works, but maybe there's a more elegant way than adding attributes to the request only for xla expansion.
That's really the best way to do it. Alan DeKok.
Wow this was fast. Thank you Alan for the straightforward answer and the confirmation of our approach. Till On 27.08.21 22:45, Alan DeKok wrote:
On Aug 27, 2021, at 4:36 PM, g4-lisz@tonarchiv.ch wrote:
I wonder if there is a way to "transport" data to an xlat function on another way than attaching it to a Radius request... All data is associated with a request. Or, it's static in the configuration files.
There really isn't any other way to do this.
I'm asking this because we have quite a lot of parameters that we want to be expanded in the module config file.
These parameters depend on the user realm. So when a request comes in, our module does a look up in a realm to connection data table. This connection data again is used to make a REST authentication.
In the module config we have something like this:
uri = "https://%{control:Cust-Gateway}/api/%{control:Cust-App-Id}/etc/..." data = 'grant_type=password&username=%{urlquote:%{control:Cust-Client-Id}}&password=%{urlquote:%{control:Cust-Client-Secret}}'
In the authorize function we do the DB call and when the realm is valid we add these custom attributes to the request.
This works, but maybe there's a more elegant way than adding attributes to the request only for xla expansion. That's really the best way to do it.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I was scratching my head to understand why, in the authorize section of a virtual server, this worked: switch Client-Shortname { case radiusd_a1_01 { update control { Pam-Auth := radiusd_a1_01 } } case radiusd_b1_01 { update control { Pam-Auth := radiusd_b1_01 } } } But this did not: update control { Pam-Auth := Client-Shortname } And remembering my previous question, started combing through the docs on unlang, attributes, and hit on run-time variables where it says Client-Shortname is a meta-attributes that can only be queried, and cannot be assigned. Which I take it is why the second one does not work? I can keep going with the switch case, but I am wondering if this is the a bad solution? Can attributes or variables be set at the client level which are accessible? Should I use a dictionary option? I know I need to dig deeper, but a nudge (either towards good, or away from bad) would be appreciated. Enjoy the weekend, Jonathan
On Aug 27, 2021, at 5:29 PM, Jonathan Davis <jonathan@prioritycolo.com> wrote:
I was scratching my head to understand why, in the authorize section of a virtual server, this worked:
switch Client-Shortname {
See "man unlang". The default is for the "switch" statement to treat Client-Shortname as an attribute reference, if the attribute exists. This is for compatibility with older versions. So you should really be using switch &Client-Shortname { and arguably the server should warn you about *not* including the &. I'll push a fix to highlight this.
But this did not:
update control { Pam-Auth := Client-Shortname
That just assigned the string "Client-Shortname" to the PAM-Auth attribute. If you want the value, you have to use: PAM-Auth := "%{Client-Shortname}" or tell the assignment that you're referring to an attribute: PAM-Auth := &Client-Shortname
And remembering my previous question, started combing through the docs on unlang, attributes, and hit on run-time variables where it says Client-Shortname is a meta-attributes that can only be queried, and cannot be assigned. Which I take it is why the second one does not work?
No, it's just an artifact of historical issues.
I can keep going with the switch case, but I am wondering if this is the a bad solution? Can attributes or variables be set at the client level which are accessible? Should I use a dictionary option? I know I need to dig deeper, but a nudge (either towards good, or away from bad) would be appreciated.
It's fine. Alan DeKok.
On 2021-08-27 6:08 p.m., Alan DeKok wrote:
On Aug 27, 2021, at 5:29 PM, Jonathan Davis<jonathan@prioritycolo.com> wrote:
I was scratching my head to understand why, in the authorize section of a virtual server, this worked:
switch Client-Shortname { See "man unlang". The default is for the "switch" statement to treat Client-Shortname as an attribute reference, if the attribute exists. This is for compatibility with older versions.
So you should really be using
switch &Client-Shortname {
and arguably the server should warn you about*not* including the &. I'll push a fix to highlight this.
I did read a doc on networkradius.com specific to the &attribute-name operator, and don't know why I pulled them out. Funnily enough I did look for some red text in the debug, I was however throwing the & in front of also the &Pam-Auth = which I take it isn't required as you would never assgin values to a string?
But this did not:
update control { Pam-Auth := Client-Shortname That just assigned the string "Client-Shortname" to the PAM-Auth attribute. If you want the value, you have to use:
PAM-Auth := "%{Client-Shortname}"
or tell the assignment that you're referring to an attribute:
PAM-Auth := &Client-Shortname
I had previously tried the following which didn't work: Pam-Auth := %{Client-Shortname} In the logs I saw %{Client-Shortname} being passed as the string to PAM (which I understand why now). But had also tried: Pam-Auth := &Client-Shortname And this did not work, in the logs I saw the default "radiusd" from the mods-enabled/pam conf being passed. However, the follow does work: Pam-Auth := "%{Client-Shortname}" It's successful in passing the client's shortname to PAM to use as the PAM config file to check. Thanks! A lot cleaner (and easier to read) than multiple redundant switch and cases statements. For the Pam-Auth := &Client-Shortname -- If it's of interest, here are the full logs: FreeRADIUS Version 3.0.20 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/clients.conf including configuration file /etc/freeradius/3.0/mods-enabled/sql including configuration file /etc/freeradius/3.0/mods-config/sql/main/mysql/queries.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/pam including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/expr including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/control including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/virtual01 including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel main { security { user = "root" group = "root" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.10 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radiusd_b1_01 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" virtual_server = "virtual01" proto = "*" limit { max_connections = 32 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = PAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/3.0/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" logfile = "/var/log/freeradius/sqllog.sql" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype,framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_pam # Loading module "pam" from file /etc/freeradius/3.0/mods-enabled/pam pam { pam_auth = "radiusd" } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } instantiate { } # Instantiating module "sql" from file /etc/freeradius/3.0/mods-enabled/sql rlm_sql_mysql: libmysql version: 8.0.26 mysql { tls { tls_required = no check_cert = no check_cert_cn = no } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server virtual01 { # from file /etc/freeradius/3.0/sites-enabled/virtual01 # Loading authenticate {...} # Loading authorize {...} } # server virtual01 server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Ready to process requests (0) Received Access-Request Id 102 from 127.0.0.1:47621 to 127.0.0.1:1812 length 75 (0) User-Name = "admin" (0) User-Password = "adminpass" (0) NAS-IP-Address = 173.237.216.130 (0) NAS-Port = 0 (0) Message-Authenticator = 0xecf1b26c3b9e82557ff6fe3478ccfbb7 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/virtual01 (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) update control { (0) No attributes updated for RHS &Client-Shortname (0) } # update control = noop (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20210828 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20210828 (0) auth_log: EXPAND %t (0) auth_log: --> Sat Aug 28 14:55:35 2021 (0) [auth_log] = ok (0) [chap] = noop (0) files: users: Matched entry admin at line 91 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> admin (0) sql: SQL-User-Name set to 'admin' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'admin' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'admin' ORDER BY id (0) sql: WARNING: User not found in radcheck table. rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.3.31-MariaDB-0ubuntu0.20.04.1, protocol version 10 (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'admin' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'admin' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (0) (0) [sql] = notfound (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/virtual01 (0) Auth-Type PAP { (0) pam: Using pamauth string "radiusd" for pam.conf lookup debug: pam_yubico.c:933 (parse_cfg): called. debug: pam_yubico.c:934 (parse_cfg): flags 0 argc 3 debug: pam_yubico.c:936 (parse_cfg): argv[0]=id=66772 debug: pam_yubico.c:936 (parse_cfg): argv[1]=debug debug: pam_yubico.c:936 (parse_cfg): argv[2]=authfile=/etc/yubikey_mappings/yubikey_default debug: pam_yubico.c:937 (parse_cfg): id=66772 debug: pam_yubico.c:938 (parse_cfg): key=(null) debug: pam_yubico.c:939 (parse_cfg): debug=1 debug: pam_yubico.c:940 (parse_cfg): debug_file=1 debug: pam_yubico.c:941 (parse_cfg): alwaysok=0 debug: pam_yubico.c:942 (parse_cfg): verbose_otp=0 debug: pam_yubico.c:943 (parse_cfg): try_first_pass=0 debug: pam_yubico.c:944 (parse_cfg): use_first_pass=0 debug: pam_yubico.c:945 (parse_cfg): always_prompt=0 debug: pam_yubico.c:946 (parse_cfg): nullok=0 debug: pam_yubico.c:947 (parse_cfg): ldap_starttls=0 debug: pam_yubico.c:948 (parse_cfg): ldap_bind_as_user=0 debug: pam_yubico.c:949 (parse_cfg): authfile=/etc/yubikey_mappings/yubikey_default debug: pam_yubico.c:950 (parse_cfg): ldapserver=(null) debug: pam_yubico.c:951 (parse_cfg): ldap_uri=(null) debug: pam_yubico.c:952 (parse_cfg): ldap_bind_user=(null) debug: pam_yubico.c:953 (parse_cfg): ldap_bind_password=(null) debug: pam_yubico.c:954 (parse_cfg): ldap_filter=(null) debug: pam_yubico.c:955 (parse_cfg): ldap_cacertfile=(null) debug: pam_yubico.c:956 (parse_cfg): ldapdn=(null) debug: pam_yubico.c:957 (parse_cfg): ldap_clientcertfile=(null) debug: pam_yubico.c:958 (parse_cfg): ldap_clientkeyfile=(null) debug: pam_yubico.c:959 (parse_cfg): user_attr=(null) debug: pam_yubico.c:960 (parse_cfg): yubi_attr=(null) debug: pam_yubico.c:961 (parse_cfg): yubi_attr_prefix=(null) debug: pam_yubico.c:962 (parse_cfg): url=(null) debug: pam_yubico.c:963 (parse_cfg): urllist=(null) debug: pam_yubico.c:964 (parse_cfg): capath=(null) debug: pam_yubico.c:965 (parse_cfg): cainfo=(null) debug: pam_yubico.c:966 (parse_cfg): proxy=(null) debug: pam_yubico.c:967 (parse_cfg): token_id_length=12 debug: pam_yubico.c:968 (parse_cfg): mode=client debug: pam_yubico.c:969 (parse_cfg): chalresp_path=(null) debug: pam_yubico.c:970 (parse_cfg): mysql_server=(null) debug: pam_yubico.c:971 (parse_cfg): mysql_port=0 debug: pam_yubico.c:972 (parse_cfg): mysql_user=(null) debug: pam_yubico.c:973 (parse_cfg): mysql_database=(null) debug: pam_yubico.c:1009 (pam_sm_authenticate): pam_yubico version: 2.27 debug: pam_yubico.c:1024 (pam_sm_authenticate): get user returned: admin debug: pam_yubico.c:190 (authorize_user_token): Using system-wide auth_file /etc/yubikey_mappings/yubikey_default debug: util.c:351 (check_user_token): Authorization line: default1:ccccccttufva debug: util.c:351 (check_user_token): Authorization line: default2:ccccccttufvd debug: util.c:351 (check_user_token): Authorization line: default3:ccccccttufvg debug: pam_yubico.c:1149 (pam_sm_authenticate): No tokens found for user debug: pam_yubico.c:1337 (pam_sm_authenticate): done. [User not known to the underlying authentication module] (0) pam: ERROR: pam_authenticate failed: User not known to the underlying authentication module (0) [pam] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Login incorrect (pam: pam_authenticate failed: User not known to the underlying authentication module): [admin] (from client radiusd_b1_01 port 0) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 102 from 127.0.0.1:1812 to 127.0.0.1:47621 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 102 with timestamp +7 Ready to process requests
And remembering my previous question, started combing through the docs on unlang, attributes, and hit on run-time variables where it says Client-Shortname is a meta-attributes that can only be queried, and cannot be assigned. Which I take it is why the second one does not work? No, it's just an artifact of historical issues.
I can keep going with the switch case, but I am wondering if this is the a bad solution? Can attributes or variables be set at the client level which are accessible? Should I use a dictionary option? I know I need to dig deeper, but a nudge (either towards good, or away from bad) would be appreciated. It's fine.
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
On Aug 28, 2021, at 11:00 AM, Jonathan Davis <jonathan@prioritycolo.com> wrote:
I did read a doc on networkradius.com specific to the &attribute-name operator, and don't know why I pulled them out. Funnily enough I did look for some red text in the debug, I was however throwing the & in front of also the &Pam-Auth = which I take it isn't required as you would never assgin values to a string?
The & can go there. In v4 it will be required, to make it clear that the PAM-Auth thing refers to an attribute, and not to anything else.
I had previously tried the following which didn't work:
Pam-Auth := %{Client-Shortname}
Yeah, that should be an error. I'll push a patch.
In the logs I saw %{Client-Shortname} being passed as the string to PAM (which I understand why now).
But had also tried:
Pam-Auth := &Client-Shortname
That doesn't work because Client-Shortname doesn't really exist. I'll push a patch telling you what does work. i.e. the server shouldn't *knowingly* do the wrong thing. If it sees something which is known to not work, it should complain.
And this did not work, in the logs I saw the default "radiusd" from the mods-enabled/pam conf being passed.
However, the follow does work:
Pam-Auth := "%{Client-Shortname}"
Yes. that's documented as working. Alan DeKok.
participants (3)
-
Alan DeKok -
g4-lisz＠tonarchiv.ch -
Jonathan Davis