June 2007 - Freeradius-Users - lists.freeradius.org

RE: FreeRadius 1.1.6 Segmentation Fault with LDAP
by Joe Vieira 26 Jun '07

26 Jun '07

You need to compile with ldap depricated option. Joe -----Original Message----- From: "Robert E. Toense" <rtoense(a)nist.gov> To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Sent: 6/25/2007 6:03 PM Subject: FreeRadius 1.1.6 Segmentation Fault with LDAP I am attempting to setup FreeRadius 1.1.6 to do PEAP authentication to an LDAP backend on another server. PEAP is working just fine to local Radius passwords. However, I get a segmentation fault whenever I try to use LDAP. Output from radiusd -X follows (sensitive information sanitized). OpenLDAP 2.3.30 is also installed. This is a Fedora Core 5 system. I see no network traffic between the Radius server and the LDAP server. Any hints? Robert .... rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(uid=username)' radius_xlat: 'ou=AAAA,dc=BBBB,dc=CCCC,dc=DDD' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to lappgen.nist.gov:636, authentication 0 Segmentation fault - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 3

daemon mode and debug mode
by Diana Robert 26 Jun '07

26 Jun '07

hi what is the difference between running the server in deamon and debug mode. thanks --------------------------------- Did you know? You can CHAT without downloading messenger. Click here

2 1

Re:users authentication failed
by Carl aniams 26 Jun '07

26 Jun '07

In the users file i commented the authtype=system for user:DEFAULT now the authentication is done through PAP but pap rejects user look the joint file No user can be authenticate whether in database or an account user. -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

users authentication failed
by Carl aniams 26 Jun '07

26 Jun '07

hi all thanks for assistance i apreciate i put in attached the result of radiusd -X so as to make my problem really understandable i used 2 users; carl pass: aniam and akim pass:willy carl failed to login and akim was successful Something new i discovered is that when i create user carl as a sytem account he is accepted by the radius so it seems my radius server checks it users elswhere than the database. what can i do? regards -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

"Clear text password not available"
by Flavio Silvestrone 26 Jun '07

26 Jun '07

Hello list, For me it's the first time with freeradius; i try to find a solution or a way to solve my problem but i have not found anything. I have this message on the log of the freeradius server when a wireless client try to estabilish a pppoe session. Auth: Login incorrect (rlm_chap: Clear text password not available): [flavio/<CHAP-Password>] (from client Erri port 1511 cli 00:35:00:04:60:99) The message is clear but i don't know where to solve. The configuration is: - two wireless client with pppoe profile - one wireless Access Point - one freeradius server If i enable the same pppoe profile (user: flavio, password: flavio) on the Access Point all work fine; When i disable the profile on the Access Point and i configure the radius client on the Access Point i have the problem This is the configuration on the file /etc/raddb/users for the user "flavio" : Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 10.1.1.8, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP Any idea to find out the prob ? Than's a lot Flavio

5 11

Re: terminating EAP tunnels, proxy and realms
by Josh Howlett 26 Jun '07

26 Jun '07

Gah, my message bounced owing to change of email address... Arran wrote: > Can you clear something up for me with inner/outer identity. > The outer identity is in the User-Name attribute , it's a standard > RADIUS attribute... Inner identity is encoded in the EAP message, and > is pulled out by the EAP module prior to internal proxying and set as > the User-Name attribute (which should overwrite the User-Name > attribute in the request) ? Correct. > And it's standard practice to leave the outer identity as anonymous, > as the only communication between the NAS and the Supplicant is EAP > based when using EAPOL, and so the NAS would have to understand EAP to > be able to extract the User-Name string and write it into the > Access-Request packet ? Nope; see RFC 3579 for the gory details: "the NAS MUST copy the contents of the Type-Data field of the EAP-Response/Identity received from the peer into the User-Name attribute" The use of "anonymous" is simply to preserve privacy; it's not a technical requirement of any EAP method (that I know of). An interesting tangent: note that "end-user identity hiding" is simply a "requirement" of RFC 4017 ("EAP Method Requirements for Wireless LANs"), which I think is a shame. > So although the NAS must send an EAP-Identity-Request when the client > connects it's not required to understand the EAP-Identity-Response ? For the reason given above, it *does* need to understand the EAP-Identity-Response. But that's about it! The NAS is a pretty dumb device. josh.

3 6

FreeRadius 1.1.6 Segmentation Fault with LDAP
by Robert E. Toense 26 Jun '07

26 Jun '07

I am attempting to setup FreeRadius 1.1.6 to do PEAP authentication to an LDAP backend on another server. PEAP is working just fine to local Radius passwords. However, I get a segmentation fault whenever I try to use LDAP. Output from radiusd -X follows (sensitive information sanitized). OpenLDAP 2.3.30 is also installed. This is a Fedora Core 5 system. I see no network traffic between the Radius server and the LDAP server. Any hints? Robert .... rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(uid=username)' radius_xlat: 'ou=AAAA,dc=BBBB,dc=CCCC,dc=DDD' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to lappgen.nist.gov:636, authentication 0 Segmentation fault

2 1

XLAT Parsing error.
by Arran Cudbard-Bell 26 Jun '07

26 Jun '07

Hi, Another small xlat parsing error, alternate values arnt being parsed correctly in xlat strings involving modules. update request { Supplicant-Flags = "%{sql_clients:SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1:-null}" } expands to SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1:-null when should expand to SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1 What would be really cool is if one query returned a null string a second query could be executed as an alternate, but i'm not sure how hard that would be to do. -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 2

Assertion failed in conffile.c, line 109,Abort
by Arran Cudbard-Bell 26 Jun '07

26 Jun '07

Including separate configuration files in major stanza subsections results in. Assertion failed in conffile.c, line 109 Abort Post-Auth-Type REJECT { # * Uniform called station ID + SSID extraction # * Uniform calling station ID # * Correct NAS Port Type # * Rewrite loopback ips $INCLUDE ${confdir}/attrrewrite.conf # Log rejected attempts to help with debugging sql attr_filter.access_reject } Does the config parser not check in sub sections for files to be included ? Adding the relevant configuration lines contained in attrrewrite.conf does not result in the error. It's definitely the include statement. This happens in authorize, post-auth etc ... Sorry, last bug for today :) -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 1

Re:users authentication failed
by Carl aniams 25 Jun '07

25 Jun '07

I used numbers (123456) and it seems to work.seems?? when i use user:akim passwd:willy everything is allwright (redirection authentication on radius and message response ok.) using browsing the net but when i try to use another user (carl passwd:aniam or all the several users i created ) i have an access-reject message with following result: modcall[authorize]: module "pap" returns noop for request 24 modcall: leaving group authorize (returns ok) for request 24 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 24 modcall[authenticate]: module "unix" returns notfound for request 24 modcall: leaving group authenticate (returns notfound) for request 24 auth: Failed to validate the user. Delaying request 24 for 1 seconds Finished request 24 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.1.3 port 2051 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 24 ID 0 with timestamp 467fea7b what might be the fault -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1