December 2013 - Freeradius-Users - lists.freeradius.org

Unable to locate mysql-devel package on Ubuntu 11.04
by brijesh shingadiya 16 Dec '13

16 Dec '13

Hi Everyone, I am trying to make my freeradius server as a DHCP server. I am trying to install mysql-devel package as mentioned in the document but I keep getting error "Unable to locate mysql-devel package". Any inputs on this would be highle appreciated. Thanks, Brijesh

4 5

LDAP + Active Directory Authentication Issue
by Luke Ramsden 16 Dec '13

16 Dec '13

Hi, I am trying to authenticate users against Active Directory using LDAP. I can perform the initial bind using an ldap bind account. I can then successfully find the Distinguished Name in Active Directory given a domain user's username. I would now like to re-bind using that Distinguished Name in order to authenticate the password they supplied as described in point 4 here: http://thecarlhall.wordpress.com/2011/01/04/ldap-authentication-authorizati… The problem I am having is my server errors out with 'No Auth-Type found' come authentication time. I added 'set_auth_type = yes' to mods-available/ldap but it seems to have had no effect. I am very new to this so am still finding my feet - can anyone help? Subset of output from terminal (redacted some personal info): (0) ldap : Performing search in 'ou=Users,dc=example,dc=domain,dc=com' with filter '(uid=example-user)' (0) ldap : Waiting for search result... (0) ldap : User object found at DN "CN=Name,OU=Users,DC=example,DC=domain,DC=com" rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): Closing connection (0): Too many free connections (5 > 3) (0) [ldap] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = 'example-user', looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (0) WARNING: pap : Authentication will fail unless a "known good" password is available. (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post Auth-Type = Reject (0) Failed to authenticate the user. (0) Using Post-Auth-Type Reject Many thanks

4 5

redundant ldap configuration
by Polish 16 Dec '13

16 Dec '13

Hello, I tried setup redundant ldap on latest git version of FR3. ldaps are defined in module ldap: ldap ldap1 { ... } ldap ldap3 { ... } sites default and inner-tunnel are changed from ldap to redundant { ldap1 ldap3 } If connections to ldap is established, fr returns "Login OK" and eapol_test SUCCESS. If someone ldap connection is down, fr returns "Login OK", but eapol_test trying resending requests (in freeradius log I see "Discarding duplicate request from client test port 36732 - ID: 11 due to unfinished request") In debug "freeradius -fxx -l stdout" returns Login incorect, and eapol_test failed immediatly: (9) redundant redundant { (9) ERROR: ldap1 : All ldap connections are in use (9) [ldap1] = fail (9) ERROR: ldap3 : All ldap connections are in use (9) [ldap3] = fail (9) } # redundant redundant = fail (9) } # authorize = fail LDAP server is eDirectory. Thank you for tips Pavel Polacek

5 11

Request ID ATTRIBUTE
by Mehdi Ravanbakhsh 14 Dec '13

14 Dec '13

Hi All what is the ATTRIBUTE of request ID ? Best regards.

2 4

received signal SIGSEGV, Segmentation fault. malloc_consolidate (av=0x7ffff5e2de80) at malloc.c:5196
by Hachmer, Tobias 13 Dec '13

13 Dec '13

Hello, I'm testing kerberos authentication with the workaround from yesterday (https://github.com/FreeRADIUS/freeradius-server/commit/ea887a2ab7308a6f612d…) After 2-3 authentication tests radiusd get a SIGSEGV. OS: CentOS 6.5 x86_64 FR built today from v3.0.x branch BT: rad_recv: Access-Request packet from host 127.0.0.1 port 55082, id=14, length=103 User-Name = 'hachmer' User-Password = 'pw' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x64454c20cfa4534882ca622de7e32c0e (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) filter_username filter_username { (2) ? if (User-Name != "%{tolower:%{User-Name}}") Program received signal SIGSEGV, Segmentation fault. malloc_consolidate (av=0x7ffff5e2de80) at malloc.c:5196 5196 nextsize = chunksize(nextchunk); Missing separate debuginfos, use: debuginfo-install ncurses-libs-5.7-3.20090208.el6.x86_64 pcre-7.8-6.el6.x86_64 sqlite-3.6.20-1.el6.x86_64 (gdb) bt #0 malloc_consolidate (av=0x7ffff5e2de80) at malloc.c:5196 #1 0x00007ffff5b17405 in _int_malloc (av=0x7ffff5e2de80, bytes=<value optimized out>) at malloc.c:4406 #2 0x00007ffff5b18991 in __libc_malloc (bytes=1104) at malloc.c:3664 #3 0x00007ffff715063f in __talloc (ctx=<value optimized out>, el_size=<value optimized out>, count=<value optimized out>, name=<value optimized out>) at ../talloc.c:560 #4 _talloc_named_const (ctx=<value optimized out>, el_size=<value optimized out>, count=<value optimized out>, name=<value optimized out>) at ../talloc.c:669 #5 _talloc_array (ctx=<value optimized out>, el_size=<value optimized out>, count=<value optimized out>, name=<value optimized out>) at ../talloc.c:2217 #6 0x00007ffff7bcf0f4 in xlat_aprint (ctx=0xa16a40, request=0xa16a40, node=0x913af0, escape=0, escape_ctx=0x0, lvl=0) at src/main/xlat.c:1895 #7 0x00007ffff7bcfcd1 in xlat_process (out=0x7fffffffc1b8, request=0xa16a40, head=<value optimized out>, escape=0, escape_ctx=0x0) at src/main/xlat.c:1976 #8 0x00007ffff7bcff8c in xlat_expand (out=0x7fffffffc2c0, outlen=0, request=0xa16a40, fmt=0x81c0c0 "%{tolower:%{User-Name}}", escape=0, escape_ctx=0x0) at src/main/xlat.c:2068 #9 0x00007ffff7bcb7e8 in radius_expand_tmpl (out=0x7fffffffc2c0, request=0xa16a40, vpt=<value optimized out>) at src/main/evaluate.c:108 #10 0x00007ffff7bcbfd8 in radius_evaluate_map (request=0xa16a40, modreturn=<value optimized out>, depth=<value optimized out>, c=0x81bd30) at src/main/evaluate.c:424 #11 0x00007ffff7bcc5b1 in radius_evaluate_cond (request=0xa16a40, modreturn=10, depth=0, c=<value optimized out>) at src/main/evaluate.c:597 #12 0x000000000041ed3b in modcall_recurse (request=0xa16a40, component=RLM_COMPONENT_AUTZ, depth=2, entry=0x7fffffffd3d0) at src/main/modcall.c:480 #13 0x00000000004201d4 in modcall_child (request=<value optimized out>, component=RLM_COMPONENT_AUTZ, depth=2, entry=0x7fffffffd3b8, c=0xa026a0, result=0x7fffffffc9ec) at src/main/modcall.c:414 #14 0x000000000041eb5f in modcall_recurse (request=0xa16a40, component=RLM_COMPONENT_AUTZ, depth=1, entry=0x7fffffffd3b8) at src/main/modcall.c:780 #15 0x00000000004201d4 in modcall_child (request=<value optimized out>, component=RLM_COMPONENT_AUTZ, depth=1, entry=0x7fffffffd3a0, c=0xa02620, result=0x7fffffffcf4c) at src/main/modcall.c:414 #16 0x000000000041eb5f in modcall_recurse (request=0xa16a40, component=RLM_COMPONENT_AUTZ, depth=0, entry=0x7fffffffd3a0) at src/main/modcall.c:780 #17 0x00000000004200fd in modcall (component=<value optimized out>, c=<value optimized out>, request=<value optimized out>) at src/main/modcall.c:1036 #18 0x000000000041af93 in indexed_modcall (comp=RLM_COMPONENT_AUTZ, idx=0, request=0xa16a40) at src/main/modules.c:747 #19 0x000000000040cc42 in rad_authenticate (request=0xa16a40) at src/main/auth.c:409 #20 0x000000000042b41c in request_running (request=0xa16a40, action=1) at src/main/process.c:1210 #21 0x000000000042af4d in request_queue_or_run (request=0xa16a40, process=0x42b2e0 <request_running>) at src/main/process.c:850 #22 0x000000000042d2b0 in request_receive (listener=0xa131f0, packet=0x8fe710, client=0x8110a0, fun=0x40c9b0 <rad_authenticate>) at src/main/process.c:1409 #23 0x00000000004158b3 in auth_socket_recv (listener=0xa131f0) at src/main/listen.c:1509 #24 0x000000000042777b in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0xa131f0) at src/main/process.c:3494 #25 0x00007ffff79abcbb in fr_event_loop (el=0xa05770) at src/lib/event.c:417 #26 0x0000000000420b14 in main (argc=<value optimized out>, argv=<value optimized out>) at src/main/radiusd.c:479 Thanks in advance, Tobias Hachmer

2 10

Stale sessions and mac auth problem
by Peter 13 Dec '13

13 Dec '13

Hi I'm using Coova and Freeradius and I have the entry below to clear stale sessions when a user logs in. I'm using freeradius version 2.1.10 and I got the code below from a previous email in this list. if(User-Name){ if("%{sql:UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale Session' WHERE UserName='%{User-Name}' and CallingStationId='%{Calling-Station-Id}' and AcctStopTime is NULL}"){ reject } } The code above works perfectly for normal users signing in by clearing the stale session on the first attempt and the user tries again and can log in. My problem is when it's a mac auth request Coova sends the request at least twice. This causes the device to log in on the first request and then out on the second request. So how could I change the empty if statement "if(User-Name)" to only run this if the the username is not a mac address "if(User-Name != macaddress)"

2 1

LDAP no group
by Jean Carlos Coelho 13 Dec '13

13 Dec '13

Hi! Simple question, my client has configured the ldap database with no ou=groups, only with ou=people and all the users have some different object classes, some “students” and some “teachers”, the ldap database does not have the posixgroup or memberUid… my ldap configuration for search “group” is: groupname_attribute = ou groupmembership_filter = "(&(dc=domain,dc=org)(uid=%u))” I have tried many other options above.. :( This is some user example: Group? dn: ou=students,dc=domain,dc=org ou: students objectClass: organizationalUnit objectClass: top dn: ou=teachers,dc=domain,dc=org ou: teachers objectClass: organizationalUnit objectClass: top dn: ou=employees,dc=domain,dc=org ou: employees objectClass: organizationalUnit objectClass: top ——— User dn: uid=19221422470,ou=student,dc=ufsm,dc=br userPassword:: DDDDDDDDDDDDDDDDDD mail: fab(a)cpd.domain.org eduPersonPrincipalName: OJLADOIA-CXQLBAAA(a)domain.org uid: 19221422470 objectClass: person objectClass: inetOrgPerson objectClass: eduPerson objectClass: sambaSamAccount objectClass: brPerson sambaNTPassword: DDDDDDDDDDDDDDDDDD sambaLMPassword: DDDDDDDDDDDDDDDDDD cn: Student Name sn: Student Last Name sambaSID: 19221422470 dn: brEduAffiliation=1,uid=19221422470,ou=students,dc=domain,dc=org objectClass: brEduPerson brEduAffiliation: 1 brEntranceDate: 20120503 brEduAffiliationType: student ————————— Radius debug output (USER OK.. But can’t search “groups”)… radtest 42833582820 teste2013 200.132.39.49:1812 100 123456789 Sending Access-Request of id 124 to 200.132.39.49 port 1812 User-Name = "42833582820" User-Password = "teste2013" NAS-IP-Address = 200.132.39.49 NAS-Port = 100 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 200.132.39.49 port 1812, id=124, length=20 # Executing section post-auth from file /etc/freeradius/sites-enabled/domain-ldap +- entering group post-auth {...} ++? if (LDAP-Group == “teachers") [ldap] Entering ldap_groupcmp() expand: dc=domain,dc=org -> dc=domain,dc=org expand: (&(dc=domain,dc=org)(uid=%u)) -> (&(dc=domain,dc=org)(uid=42833582820)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=domain,dc=org, with filter (&(ou=teachers)(&(dc=domain,dc=org)(uid=42833582820))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group teachers not found or user is not a member. ? Evaluating (LDAP-Group == “teachers") -> FALSE ++? if (LDAP-Group == “teachers") -> FALSE } # server ldap So.. I don’t have a group, I have different object classes for separate users, is there some way to collect these informations from brEduAffiliationType with rlm_ldap group options? Or I will have to create groups and add users to these groups and populate the memberUid object for (I know) it work.. Thanks Atenciosamente, Jean Carlos Coelho Analista de Soluções Teltec Solutions Fone: 48 3031.3450 | DDR: 467 | Cel: 48 9179.6013 [http://suporte.teltecnetworks.com.br/images/Assinaturas/figura.jpg]<http://www.teltecsolutions.com.br/site2009/downloads/sign.html>

2 1

3.0 and 2.x parallel?
by JB 12 Dec '13

12 Dec '13

Hi! We would like to start testing 3.0 but don't want to replace our 2.x testing environment just yet. Before we botch up our installation we wanted to make sure if ".configure --prefix=/my/dir" suffices to completely isolate the 3.0 installation. Thanks! JB

5 6

PEAP 2nd phase none
by Maxim Shoustin 12 Dec '13

12 Dec '13

Hello, I use FreeRadius 2.2.0 I wonder if FreeRadius supports PEAP option without 2nd phase of authentication. Today as I know it has PEAP MSCHAPV2. However Android (Samsung 4) has option: EAP method: PEAP Phase 2 authentication: NONE Thank you and best regards, Maxim

2 1

EAP session didn't finish
by Kiril 12 Dec '13

12 Dec '13

Hello everyone our company is now challanging the problem in EAP PEAP when the connection between AP(wireless access point) and radius server is not established successfully in log we can see messages "EAP session for state 0x2d139b202f108299 did not finish!" ssl certs are generated during freeradius install, so the problem can't be in ssl who can tell in which case this message is shown? rad_recv: Access-Request packet from host 198.18.15.246 port 38170, id=159, length=199 User-Name = "590006471604" NAS-IP-Address = 198.18.15.246 NAS-Identifier = "AP01-EXPLAB-5FLOOR-521" NAS-Port = 0 Called-Station-Id = "00-01-7A-F7-96-18:TESTING DOM.RU AUTO" Calling-Station-Id = "2C-B4-3A-E5-95-EE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0200001101353930303036343731363034 Message-Authenticator = 0x6064f207250243546f15c6bcf058e6cb Sending Access-Challenge of id 159 to 198.18.15.246 port 38170 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d139b202d128299b748d2a13b260fd9 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 198.18.15.246 port 38170, id=160, length=366 User-Name = "590006471604" NAS-IP-Address = 198.18.15.246 NAS-Identifier = "AP01-EXPLAB-5FLOOR-521" NAS-Port = 0 Called-Station-Id = "00-01-7A-F7-96-18:TESTING DOM.RU AUTO" Calling-Station-Id = "2C-B4-3A-E5-95-EE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020100a619800000009c1603010097010000930301528a15baac18e359da7efd7e5b0e1a36e8271123dc1741acebedfa98d2afbf8e00005800ffc024c023c00ac009c007c008c028c027c014c013c011c012c026c025c02ac029c004c005c002c003c00ec00fc00cc00d003d003c002f000500040035000a0067006b003300390016c006c010c001c00b003b0002000101000012000a00080006001700180019000b00020100 State = 0x2d139b202d128299b748d2a13b260fd9 Message-Authenticator = 0x9de35b4157dfe50a6450888ddeccb382 Sending Access-Challenge of id 160 to 198.18.15.246 port 38170 EAP-Message = 0x0102040019c0000013a216030100510200004d0301528a15bdaaa9e4e3170cce6a6c4ea14e2e03d0d1c7d4766f0dab8a0527d43e5e20970e12153ebebbc297638882aa00fd1f8b29251ba4f07a1aa3be72ed4bf2dd4f002f000005ff01000100160301133e0b00133a0013370005133082050f308203f7a0030201020210037b883b5ca7464ea5c48efb9f2cbbd2300d06092a864886f70d01010505003072310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564311830160603 EAP-Message = 0x550403130f457373656e7469616c53534c204341301e170d3133303932303030303030305a170d3133313231393233353935395a304e3121301f060355040b1318446f6d61696e20436f6e74726f6c2056616c6964617465643111300f060355040b1308467265652053534c311630140603550403130d776966692e646f6d72752e727530820122300d06092a864886f70d01010105000382010f003082010a0282010100c3002da01fce9e01e41edba766d47c1863d3610580ef7ec526847964d98f22892dfe933ce6bbc102834db59891dd64c3f2634528e00b311f492fbe836e3720df5dc3b3cebf9a09b0f9cb3444c75b99d7f9cbc0848e832309 EAP-Message = 0x0fd38bf14887505e674b004ae128375e6851e13397e84545d97ae8639cdc1b1ba69b461a128fef87fc0c784e0113793f3e9dff70d53700445c15f172a55003d4b8aa74ef9638e2500f540f7e286338d2f5462ef10d897776aed52ccf33c64826e46a5a64af3468de6b30bb22082ed5622e0a9b8c11175a36cdcad33942626b4fbe38c0514e243aa315f861100fb2fef361e89f89954cd5a732d95fc20e7e681362f9c4e290b165450203010001a38201c3308201bf301f0603551d23041830168014dacbeaad5b085dccfffc2654ce49e555c638f4f8301d0603551d0e0416041403d3fe4507eb155117eb12dad0992c4da36eacbe300e0603551d0f01 EAP-Message = 0x01ff0404030205a0300c0603551d130101ff0402300030340603551d25042d302b06082b0601050507030106082b06010505070302060a2b0601040182370a030306096086480186f8420401304f0603551d2004483046303a060b2b06010401b23101020207302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f4350533008060667810c010201303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f457373656e7469616c53534c43412e63726c306e06082b0601050507010104623060303806082b06010505073002862c687474703a EAP-Message = 0x2f2f6372742e636f6d6f646f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d139b202c118299b748d2a13b260fd9 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 198.18.15.246 port 38170, id=161, length=206 User-Name = "590006471604" NAS-IP-Address = 198.18.15.246 NAS-Identifier = "AP01-EXPLAB-5FLOOR-521" NAS-Port = 0 Called-Station-Id = "00-01-7A-F7-96-18:TESTING DOM.RU AUTO" Calling-Station-Id = "2C-B4-3A-E5-95-EE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020200061900 State = 0x2d139b202c118299b748d2a13b260fd9 Message-Authenticator = 0x54d34556c8cef6db245dbb45ea6d600e Sending Access-Challenge of id 161 to 198.18.15.246 port 38170 EAP-Message = 0x010303fc194063612e636f6d2f457373656e7469616c53534c43415f322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302b0603551d1104243022820d776966692e646f6d72752e727582117777772e776966692e646f6d72752e7275300d06092a864886f70d010105050003820101005276556d9ed745c3e02ababc09696109c199d6261339c4d3b63007e41cbe6002214125ed4d25808d5acc5a22548ae2cd15e7863e359e18a7e6cbb514f5260e6a890558f7bbe12e7fe202b3c4009834df873a836ec0bf22592c8a759fb82ebbdfcb86c14cdf50f074a70f387e089efe1eea93fd9309 EAP-Message = 0xe4c49c3fabe9824800a244ac9de49865c1ee3cb6b92063c3949c771c7cfb3cd0bc8e2a0657777c12d77ea3217f0ff247982fd9e98ac36a6325c39c937afcdb42a288e72d6233cf7fec6a2cf633547d975eb7ba72683c1ed30a0a470068d3bf7d1c413c7762ffedeab0171cb1529bde594f924fd046bc8ac1d42dba9a3a8e61d99ca7c59bbb77b92ef02cc300050730820503308203eba003020102021018b2cbbaa304f1a00fc1f2f326462a4a300d06092a864886f70d0101050500308181310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a EAP-Message = 0x3018060355040a1311434f4d4f444f204341204c696d69746564312730250603550403131e434f4d4f444f2043657274696669636174696f6e20417574686f72697479301e170d3036313230313030303030305a170d3139313233313233353935395a3072310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564311830160603550403130f457373656e7469616c53534c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100adf008b072 EAP-Message = 0xc6ab83123117708985a92012d4986aed80d4d1dfe48e592dd396218d76d23f180b4619630bc720f3e50bdd801af15aa0bd1d76cdb7233a745e611b75aa9bd485f4e17891d32de1affc982e06d2793d5ac01f212d1cae2153c63aa7217ebeed676f751d1a9f6a5b06b36ae3b10baa6a0ee76d6cc3ca958c37ce211f35907ddbda1a5ca88814b20fc812205fc5d37fe8e138e0dbbcf91fa1aad61b900721fa4524505d272aa02841455b7dbca0a22faa9b7e5b53c5f10516577e11d73bb4d90176dcdf7d10cf51a9e538f27b14007559f9f059db173ef7afe6022da479c15da21cc39ac8a7a80b480a6a2e7f2d9765f6c5049c44c899967e7ea4dd2f0203 EAP-Message = 0x010001a382018330 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d139b202f108299b748d2a13b260fd9 Waking up in 0.9 seconds. Waking up in 3.9 seconds. WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2d139b202f108299 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

2 1