May 2013 - Freeradius-Users - lists.freeradius.org

Config for 802.1x use on network switches
by Nikolaos Milas 08 May '13

08 May '13

Hello, We would like to enforce authentication for all clients connecting to our network (wired or wireless), so that when a client connects, the client will not be able to use the network unless it successfully authenticates (e.g. via web) with a valid account (LDAP-based). We have a network based mainly on Cisco 2950/2960 switches. We are running a central LDAP Server (openldap) where we hold user accounts, which are used for mail, ftp, web, Shibboleth access. I guess we can enable 802.1x on switches and require authentication of clients over freeradius. Is there a suggested sample freeradius configuration for such use? Can you please provide one or point me to a URL for it? Can you share your experience and any pitfalls we should consider? Any experiences on such use? Does this scale well (for about 20-30 switches)? Should we consider a central management solution? (Which?) Thanks in advance, Nick

2 3

multiply Cisco-AVPair request attribute process by regular expression
by Mehdi Ravanbakhsh 08 May '13

08 May '13

Hi All I have one Cisco 10000 NAS inmy network and this is the authenticate request : Packet-Type = Access-Request Cisco-AVPair = "client-mac-address=f43e.6166.dba0" Framed-Protocol = PPP User-Name = "7727221873" NAS-Port-Type = Ethernet NAS-Port = 71468299 NAS-Port-Id = "0/0/0/0" Cisco-AVPair = "circuit-id-tag=Kangan-1 atm 7/42:218:0.35" Service-Type = Framed-User NAS-IP-Address = 10.150.21.218 Acct-Session-Id = "0442850B" Calling-Station-Id = "f4:3e:61:66:db:a0" Called-Station-Id = "" SQL-User-Name = "7727221873" i have tow Cisco-AVPair attribute in request and i need to process one of them that being started by 'circuit-id-tag=' so i use this : if (Cisco-AVpair =~ /^circuit-id-tag=(.*)$/) { update request { Connect-Info := "%{1}" } } but it is not working ! in similar case that i use regular expression for updating request it work well for example : if (Cisco-AVpair =~ /^client-mac-address=([a-f0-9][a-f0-9])([a-f0-9][a-f0-9]).([a-f0-9][a-f0-9])([a-f0-9][a-f0-9]).([a-f0-9][a-f0-9])([a-f0-9][a-f0-9])$/) { if (!Calling-Station-Id) { update request { Calling-Station-Id := "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" Called-Station-Id := "%{NAS-Identifier}" } } } in last i think in this case because of multiply Cisco-AVPair attribute in request regular expression should be different but i can not find any source that can enplane this problem . Best regards.

4 11

using unlang to rewrite framed-ip-address sent from LDAP
by sebastien boucher 07 May '13

07 May '13

hello, i am trying to rewrite the framed-ip-address information that are given to radius via ldap to a null value currently many of our users have a fixed framed-ip-address value of 255.255.255.254 , since we will now be using radius and mysql to distribute IP i would like to change this value to nothing upon connection. i have tried this but was unsuccessful post-auth { reply_log sql-accounting exec Post-Auth-Type REJECT { attr_filter.access_reject } if (Framed-IP-Address =="255.255.255.254") { update control { Framed-IP-Address :="%{1.1.1.1}" } } sqlippool } debug tells me: ++? if (Framed-IP-Address =="255.255.255.254") (Attribute Framed-IP-Address was not found) ? Evaluating (Framed-IP-Address =="255.255.255.254") -> FALSE ++? if (Framed-IP-Address =="255.255.255.254") -> FALSE so of course i am wrong somewhere and i wondering if some of you guys could give me input or help or directions :) thanks seb.

3 2

Unlang comparing variable correctly
by Tyller D 07 May '13

07 May '13

Hi, I am trying to compare a variable in freeradius using unlang but it seems to not be working correctly, more than likely i've made a mistake but let me show you. ? Evaluating (control:IMS-ActiveDirectory == 0) -> FALSE ++? if (control:IMS-ActiveDirectory == 0) -> FALSE ++? if (control:IMS-Timeout < 0) ? Evaluating (control:IMS-Timeout < 0) -> FALSE ++? if (control:IMS-Timeout < 0) -> FALSE ++? elsif (control:IMS-Timeout > 0) ? Evaluating (control:IMS-Timeout > 0) -> FALSE ++? elsif (control:IMS-Timeout > 0) -> FALSE ++? if (control:IMS-Data < 0) ? Evaluating (control:IMS-Data < 0) -> TRUE ++? if (control:IMS-Data < 0) -> TRUE ++- entering if (control:IMS-Data < 0) {...} expand: %{control:IMS-Data} Voucher Depleated -> 3221197824 Voucher Depleated +++[reply] returns noop +++[reject] returns reject So as you can see it enters entering if (control:IMS-Data < 0) {...}, as it says that IMS-Data is < 0. Its not, so I echoed out the variable in the next line and its value is 3221197824... The strange thing is if the variable is equal to 2147465216 then it does not enter that function. Why?

3 4

redundant-load-balance for AD ntlmauth
by FreeRadius List 07 May '13

07 May '13

Hello I use redundant-load-balance for ldap user auth to authenticate users to a pool of active directory servers for one service. That seems to work well. I'm trying to think why I don't do that for ntlmauth (used inside mschap inner-tunnel) for another other service. I've knocked that up to test it with mschap modules like (with N being 1,2,3,4,5) mschap mschapadN { with_ntdomain_hack = yes ntlm_auth = "/usr/local/bin/mschap-ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --configfile=/etc/samba/smb-adN.conf" } where /etc/samba/smb-adN.conf is the same as the others except for "password server = adN.domain" and then in the inner-tunnel site I have authenticate { Auth-Type MS-CHAP { redundant-load-balance { mschapad1 mschapad2 .. mschapadN } } } Is this along the lines that others follow? if not how does ntlmauth handle the AD server being down. Does ntlmauth/winbind handle AD being down so freeradius does not have to? Thanks, Neil

4 7

RE: segfault error
by Chris Taylor 06 May '13

06 May '13

I forgot to include my OS and kernel type. Linux on-radius01.eastlink.ca 2.6.18-308.16.1.el5 CentOS release 5.9 (Final) -----Original Message----- From: Chris Taylor Sent: Thursday, May 02, 2013 1:31 PM To: 'FreeRadius users mailing list' Subject: RE: segfault error I think I have what you are looking for now. I have copied the whole dump from when I start using gdb. Chris [root@on-radius01 raddb]# gdb /usr/sbin/radiusd /tmp/core-radiusd-11-95-95-11609-1367435209 GNU gdb (GDB) CentOS (7.0.1-45.el5.centos) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/radiusd...done. [New Thread 11611] [New Thread 11614] [New Thread 11613] [New Thread 11612] [New Thread 11610] [New Thread 11609] Reading symbols from /usr/local/lib/libfreeradius-radius-2.2.0.so...done. Loaded symbols for /usr/local/lib/libfreeradius-radius-2.2.0.so Reading symbols from /lib64/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libnsl.so.1 Reading symbols from /lib64/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libresolv.so.2 Reading symbols from /lib64/libpthread.so.0...(no debugging symbols found)...done. [Thread debugging using libthread_db enabled] Loaded symbols for /lib64/libpthread.so.0 Reading symbols from /lib64/libcrypt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libcrypt.so.1 Reading symbols from /usr/local/lib/libltdl.so.3...done. Loaded symbols for /usr/local/lib/libltdl.so.3 Reading symbols from /lib64/libssl.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libssl.so.6 Reading symbols from /lib64/libcrypto.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libcrypto.so.6 Reading symbols from /lib64/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libdl.so.2 Reading symbols from /lib64/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /usr/lib64/libgssapi_krb5.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libgssapi_krb5.so.2 Reading symbols from /usr/lib64/libkrb5.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libkrb5.so.3 Reading symbols from /lib64/libcom_err.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libcom_err.so.2 Reading symbols from /usr/lib64/libk5crypto.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libk5crypto.so.3 Reading symbols from /lib64/libz.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libz.so.1 Reading symbols from /usr/lib64/libkrb5support.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libkrb5support.so.0 Reading symbols from /lib64/libkeyutils.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libkeyutils.so.1 Reading symbols from /lib64/libselinux.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libselinux.so.1 Reading symbols from /lib64/libsepol.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libsepol.so.1 Reading symbols from /lib64/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libnss_files.so.2 Reading symbols from /lib64/libnss_ldap.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libnss_ldap.so.2 Reading symbols from /usr/local/lib/rlm_exec-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_exec-2.2.0.so Reading symbols from /usr/local/lib/rlm_expr-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_expr-2.2.0.so Reading symbols from /usr/local/lib/rlm_expiration-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_expiration-2.2.0.so Reading symbols from /usr/local/lib/rlm_logintime-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_logintime-2.2.0.so Reading symbols from /usr/local/lib/rlm_pap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_pap-2.2.0.so Reading symbols from /usr/local/lib/rlm_chap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_chap-2.2.0.so Reading symbols from /usr/local/lib/rlm_preprocess-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_preprocess-2.2.0.so Reading symbols from /usr/local/lib/rlm_digest-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_digest-2.2.0.so Reading symbols from /usr/local/lib/rlm_realm-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_realm-2.2.0.so Reading symbols from /usr/local/lib/rlm_acct_unique-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_acct_unique-2.2.0.so Reading symbols from /usr/local/lib/rlm_files-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_files-2.2.0.so Reading symbols from /usr/local/lib/rlm_detail-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_detail-2.2.0.so Reading symbols from /usr/local/lib/rlm_unix-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_unix-2.2.0.so Reading symbols from /usr/local/lib/rlm_radutmp-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_radutmp-2.2.0.so Reading symbols from /usr/local/lib/rlm_attr_filter-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_attr_filter-2.2.0.so Reading symbols from /usr/local/lib/rlm_ldap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_ldap-2.2.0.so Reading symbols from /usr/lib64/libldap_r-2.3.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libldap_r-2.3.so.0 Reading symbols from /usr/lib64/liblber-2.3.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/liblber-2.3.so.0 Reading symbols from /usr/lib64/libsasl2.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libsasl2.so.2 Reading symbols from /usr/local/lib/rlm_sql-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_sql-2.2.0.so Reading symbols from /usr/local/lib/rlm_sql_mysql-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_sql_mysql-2.2.0.so Reading symbols from /usr/lib64/mysql/libmysqlclient_r.so.15...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/mysql/libmysqlclient_r.so.15 Reading symbols from /lib64/libm.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libm.so.6 Reading symbols from /lib64/libgcc_s.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libgcc_s.so.1 Reading symbols from /lib64/libnss_dns.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libnss_dns.so.2 Reading symbols from /usr/local/lib/rlm_eap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap-2.2.0.so Reading symbols from /usr/local/lib/libfreeradius-eap-2.2.0.so...done. Loaded symbols for /usr/local/lib/libfreeradius-eap-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_md5-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_md5-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_leap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_leap-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_gtc-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_gtc-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_tls-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_tls-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_ttls-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_ttls-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_peap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_peap-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_mschapv2-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_mschapv2-2.2.0.so Reading symbols from /usr/local/lib/rlm_always-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_always-2.2.0.so warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fffdaffd000 Core was generated by `/usr/sbin/radiusd -d /etc/raddb'. Program terminated with signal 11, Segmentation fault. #0 0x0000003c6c07b5bb in memcpy () from /lib64/libc.so.6 (gdb) set logging file /etc/raddb/gdb-radiusd.log (gdb) set logging on Copying output to /etc/raddb/gdb-radiusd.log. (gdb) info threads 6 Thread 0x2b70ff350f60 (LWP 11609) 0x0000003c6c0ce1a2 in select () from /lib64/libc.so.6 5 Thread 11610 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 4 Thread 11612 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 3 Thread 11613 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 2 Thread 11614 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 * 1 Thread 0x2b7104c7f940 (LWP 11611) 0x0000003c6c07b5bb in memcpy () from /lib64/libc.so.6 (gdb) thread apply all bt full Thread 6 (Thread 0x2b70ff350f60 (LWP 11609)): #0 0x0000003c6c0ce1a2 in select () from /lib64/libc.so.6 No symbol table info available. #1 0x00002b70fef24cf7 in fr_event_loop (el=0x12739500) at event.c:391 i = <value optimized out> rcode = 1 maxfd = 39 when = {tv_sec = 0, tv_usec = 427000} wake = 0x7fffdafcdb30 read_fds = {fds_bits = {1047972020224, 0 <repeats 15 times>}} master_fds = {fds_bits = {1047972020224, 0 <repeats 15 times>}} #2 0x000000000041cc3a in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:408 rcode = 309599712 argval = <value optimized out> spawn_flag = 1 dont_fork = 0 flag = 0 act = {__sigaction_handler = {sa_handler = 0x41cf20 <sig_fatal>, sa_sigaction = 0x41cf20 <sig_fatal>}, sa_mask = { __val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0} Thread 5 (Thread 11610): #0 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000041ff83 in request_handler_thread (arg=<value optimized out>) at threads.c:498 fun = 0x408910 <rad_authenticate> self = 0x12740a50 #2 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #3 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 No symbol table info available. Thread 4 (Thread 11612): #0 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000041ff83 in request_handler_thread (arg=<value optimized out>) at threads.c:498 fun = 0x408910 <rad_authenticate> self = 0x12740c10 #2 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #3 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 ---Type <return> to continue, or q <return> to quit--- No symbol table info available. Thread 3 (Thread 11613): #0 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000041ff83 in request_handler_thread (arg=<value optimized out>) at threads.c:498 fun = 0x408300 <rad_accounting> self = 0x12740d90 #2 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #3 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 No symbol table info available. Thread 2 (Thread 11614): #0 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000041ff83 in request_handler_thread (arg=<value optimized out>) at threads.c:498 fun = 0x408300 <rad_accounting> self = 0x12740f10 #2 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #3 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 No symbol table info available. Thread 1 (Thread 0x2b7104c7f940 (LWP 11611)): #0 0x0000003c6c07b5bb in memcpy () from /lib64/libc.so.6 No symbol table info available. #1 0x00002b710027f3e9 in normify (request=0x12756bb0, vp=0x12778160, min_length=20) at rlm_pap.c:273 decoded = 18446744073709551615 buffer = "\311-\307\004q+\000\000j\b\362\376p+\000\000+ \260\333\307\004q+\000\000p\334\307\004q+\000\000@\330\307\00 4q+\000\000\210\301v\022\000\000\000\000P\301v\022\000\000\000" #2 0x00002b710027fb57 in pap_authenticate (instance=0x12618990, request=0x12756bb0) at rlm_pap.c:707 vp = <value optimized out> module_fmsg_vp = <value optimized out> module_fmsg = '\000' <repeats 32 times>, "H\200w\022\001\000\000\000 \tb\022", '\000' <repeats 12 times>, "t\000\000\000\00 0\000\000\000\253\200\362\376p+", '\000' <repeats 18 times>"\253, \200\362\376p+\000\000\253\200\362\376\000\000\000\000v\203\361\3 76p+\000\000\024\000\000\000\000\000\000\000\274\362'\000q+\000\000\375\000\000\022\000\000\000\000\024\000\000\000\000\000\000\000 \024\000\000\000\000\000\000\000`\201w\022", '\000' <repeats 12 times>"\260, ku\022\000\000\000\000\230\201w\022\000\000\000\000\35 1\363'\000q+\000\000\321=\253\365H.f\001\360~\243v\230\001\021L\257j\024\342QDn\246\344]\354\375<\000\000\000F\004\000\000\000\000\ 000\000^\032\362\376p+\000\000HJ5l<\000\000\000\001\000\000\000\000" md5_context = {state = {0, 0, 309685208, 0}, count = {1213420411, 1862303041}, ---Type <return> to continue, or q <return> to quit--- buffer = "-Realm\000\000\340\341K\022\000\000\000\000\340I5l<", '\000' <repeats 11 times>"\340, I5l<", '\000' <repeats 11 times>, "8\001\000\000\000\000\000\000\035\367\350\000q+\000"} sha1_context = {state = {309685208, 0, 1, 0, 309821792}, count = {0, 309728429}, buffer = "\000\000\000\000\373\377\377\377\377\377\377\377\260ku\022\000\000\000\000\251\024v\022\000\000\000\000\022\365 '\000q+\000\000 \334\307\004q+\000\000 \334\307\004q+\000\000\220\211a\022\000\000\000\000\203\070\361\376"} digest = "d>u\022", '\000' <repeats 35 times> buff = "\001\000\000\000\000\000\000\000\360\335v\022\000\000\000\000\200<t\022\000\000\000\000\260ku\022\000\000\000\000\a \004\000\000\000\000\000\000A\001\000\000\000\000\000\000\070\001\000\000\000\000\000\000\005", '\000' <repeats 39 times>, "\020.w\ 022\000\000\000\000\020Xu\022", '\000' <repeats 12 times>"\262, \022B\000\000\000\000\000\000\000\000\000\001\000\000\000`\001\000\ 000(\000\000\000HJ5l<\000\000\000\300\332\307\004q+\000\000\000\000\000\000\000\000\000\000A\001\000\000\000\000\000\000\070\001\00 0\000\000\000\000\000\340I5l<\000\000\000 \004b\022\000\000\000\000`\001\000\000\000\000\000\000HJ5l<\000\000\000\000\333\307\004q+ \000\000\035\367\350\000q+\000\000A\001\000\000\000\000\000\000\070\001\000\000\000\000\000\000"... buff2 = "\001\000\000\000\000\000\000\000rTh\000q+\000\000\260ku\022\000\000\000\000\060\227a\022\000\000\000\000\001\000\0 00\000\000\000\000\000\001\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\071Xh\000q+\000\000\200\246a\022\000\000\000 \000\340(v\022\000\000\000\000\004\000\000\000\000\000\000\000`\001\000\000\000\000\000\000HJ5l<\000\000\000`\331\307\004q+\000\000 'UsA\001\000\000\000\000\000\000\070\001\000\000\000\000\000\000\005", '\000' <repeats 39 times>, "from cli\237Oh\000q+\000\00 0-bras1 port 0 vifrom client (\000\000\000-bras1 port 0"... #3 0x000000000041c0e6 in call_modsingle (component=0, c=<value optimized out>, request=0x12756bb0) at modcall.c:304 No locals. #4 modcall (component=0, c=<value optimized out>, request=0x12756bb0) at modcall.c:686 myresult = 1 stack = {pointer = 1634165107, priority = {0, 0, 0, 0, 0, 0, 0, 1634165107, 829124461, 13106, 0 <repeats 22 times>}, result = {0, 0, 2, 0 <repeats 16 times>, 24, 48, 80209248, 11121, 80209056, 11121, 0, 0, 0, 0, 0, 0, 0}, children = { 0x12706950, 0x127069c0, 0x0 <repeats 16 times>, 0x2b7104c7e320, 0x0, 0x2b7104c7ea80, 0x2b7104c7e970, 0x2b7104c7e970, 0x4c7e480, 0x4, 0x110, 0x12774b50, 0x2b7104c7e320, 0x3c6c068b5a, 0xfbad8001, 0x2b7104c7e970, 0x2b7104c7e970}, start = {0x0, 0x127069c0, 0x1270c340, 0x2b7104c7ea80, 0x2b7104c7e970, 0x2b7104c7ea80, 0x0, 0x600000000, 0x8, 0x0 <repeats 12 times>, 0xffffffff, 0x0, 0x0, 0x12619fe0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000}} parent = 0x12706950 child = 0x127069c0 if_taken = 0 was_if = 0 #5 0x0000000000419415 in indexed_modcall (comp=0, idx=1024, request=0x12756bb0) at modules.c:740 rcode = <value optimized out> list = 0x12706950 server = 0x0 #6 0x0000000000409147 in rad_check_password (request=0x12756bb0) at auth.c:382 No locals. #7 rad_authenticate (request=0x12756bb0) at auth.c:667 namepair = 0x12743dc0 check_item = <value optimized out> auth_item = 0x12743f00 ---Type <return> to continue, or q <return> to quit--- module_msg = <value optimized out> tmp = <value optimized out> result = <value optimized out> autz_retry = <value optimized out> autz_type = <value optimized out> #8 0x0000000000427751 in radius_handle_request (request=0x12756bb0, fun=0x408910 <rad_authenticate>) at event.c:3784 No locals. #9 0x00000000004278d4 in proxy_to_virtual_server (request=0x12755810) at event.c:1980 fake = 0x12756bb0 fun = 0x408910 <rad_authenticate> #10 0x000000000042763a in successfully_proxied_request (request=0x12755810) at event.c:2265 No locals. #11 request_post_handler (request=0x12755810) at event.c:2329 rcode = <value optimized out> child_state = <value optimized out> vp = <value optimized out> #12 0x000000000042778d in radius_handle_request (request=0x12755810, fun=0x408910 <rad_authenticate>) at event.c:3790 No locals. #13 0x0000000000420320 in request_handler_thread (arg=<value optimized out>) at threads.c:537 fun = 0x408910 <rad_authenticate> self = 0x12740a90 #14 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #15 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 No symbol table info available. (gdb) Chris Taylor System Administrator Network Operations Eastlink Chris.Taylor(a)corp.eastlink.ca T: 519.773.1287 -----Original Message----- From: freeradius-users-bounces+chris.taylor=corp.eastlink.ca(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, May 02, 2013 11:58 AM To: FreeRadius users mailing list Subject: Re: segfault error Chris Taylor wrote: > Sorry miscommunication on my part. Below is an example of a request that causes the segfault. I was also able to get a core dump as well which I pasted at the bottom. Which is *not* what we asked for. Please follow the instructions in doc/bugs. It gives DETAILED instructions on what to post. You are NOT posting the information we need to be able to help you. You're just showing that you can run gdb. This isn't useful. You need to run the gdb commands in doc/bugs, which tell us WHERE the problem occurred. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Support for EAP-AKA' [EAP-AKA Prime]
by K Rajesh 06 May '13

06 May '13

Hi all, I am looking to augment my freeradius AAA server with EAP-AKA' implementation [demo purposes only]. Can anyone help me with relevant key generation code? Thanks and regards, Rajesh

1 0

Question on ldap module's base_filter
by Mathieu Simon 06 May '13

06 May '13

G'day list I've come across an issue with the ldap module parameter base_filter, and I'm not yet sure whether I'm hitting a bug (I guess: less likely) than I'm missing / missunderstanding its correct use. I'm running a Debian Squeeze derivative (Univention Corporate Server), FR 2.1.10 and OpenLDAP. On squeeze base_filter come preconfigured as disabled (#base_filter = "(objectclass=radiusprofile)" Now my idea was to set base_filter = "(sambaAcctFlags=[U ])" to only let user objects (that are not disabled) get authorized. This field is present on user object so it would be great to have it used somehow. The curious thing was that radtest I always get Access-Accept even when a user has a the disabled flag (sambaAcctFlags=[UD ]). This led me to check whether I can just set base_filter="(notExisting=thisDoesntExist)" And the result also was: Access-Accept, so I guess base_filter isn't read as I'd have expected it at first sigh :-\ When I launch freeradius in debug mode I can see a message base_filter = "(sambaAcctFlags=[U ])" passing on the screen so I guess the value at least is getting read. Can you give me a clever hint where/what to look for? Best regards Mathieu

1 0

EAP authentication stopped working
by larry tembu 04 May '13

04 May '13

Hi Freeradius users, i have FR freeradius-2.2.0-0.fc17.i686 set up on fedora 17 machine. the wimax clients are supplying EAPttls Mschapv2 for authentication. a few weeks ago, the configuration was working and authenticating, but it suddenly stopped. the users are created in the users file and below is the radiusd -X output. any more info required will be promptly provided. could someone help me out on this? the wimax system is 4M alvarion and the CPe are well configured. ignore_null = no } Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 46422 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 11.0.0.205 port 1812, id=153, length=196 User-Name = "{sm=1}rawlacurone(a)adn.com" EAP-Message = 0x0201001e017b736d3d317d7261776c616375726f6e654061646e2e636f6d Message-Authenticator = 0x39a7eb8d6128461e0fa6caf5dd5c26c3 NAS-Identifier = "201" NAS-IP-Address = 11.0.0.205 Calling-Station-Id = "AC-81-12-78-CA-6E" WiMAX-BS-Id = 0xfff329010102 NAS-Port-Type = Wireless-802.16 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 256 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Attr-1793 = 0x0000028a # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/11.0.0.205/auth-detail-20130501 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/11.0.0.205/auth-detail-20130501 [auth_log] expand: %t -> Wed May 1 17:46:27 2013 ++[auth_log] returns fail Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> {sm=1}rawlacurone(a)adn.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 153 to 11.0.0.205 port 1812 Waking up in 4.9 seconds. Cleaning up request 0 ID 153 with timestamp +1 Ready to process requests. rad_recv: Access-Request packet from host 11.0.0.205 port 1812, id=154, length=196 User-Name = "{sm=1}rawlacurone(a)adn.com" EAP-Message = 0x0201001e017b736d3d317d7261776c616375726f6e654061646e2e636f6d Message-Authenticator = 0x0ddedece670902a6348d2b16c392c015 NAS-Identifier = "201" NAS-IP-Address = 11.0.0.205 Calling-Station-Id = "AC-81-12-78-CA-6E" WiMAX-BS-Id = 0xfff329010102 NAS-Port-Type = Wireless-802.16 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 256 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Attr-1793 = 0x0000028a # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/11.0.0.205/auth-detail-20130501 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/11.0.0.205/auth-detail-20130501 [auth_log] expand: %t -> Wed May 1 17:46:35 2013 ++[auth_log] returns fail Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> {sm=1}rawlacurone(a)adn.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 154 to 11.0.0.205 port 1812 Waking up in 4.9 seconds. Cleaning up request 1 ID 154 with timestamp +9 Ready to process requests. rad_recv: Access-Request packet from host 11.0.0.205 port 1812, id=155, length=196 User-Name = "{sm=1}rawlacurone(a)adn.com" EAP-Message = 0x0201001e017b736d3d317d7261776c616375726f6e654061646e2e636f6d Message-Authenticator = 0x8cbc1a4105e88c044aaa7a95df6dc98a NAS-Identifier = "201" NAS-IP-Address = 11.0.0.205 Calling-Station-Id = "AC-81-12-78-CA-6E" WiMAX-BS-Id = 0xfff329010102 NAS-Port-Type = Wireless-802.16 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 256 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Attr-1793 = 0x0000028a # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/11.0.0.205/auth-detail-20130501 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/11.0.0.205/auth-detail-20130501 [auth_log] expand: %t -> Wed May 1 17:46:43 2013 ++[auth_log] returns fail Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> {sm=1}rawlacurone(a)adn.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 155 to 11.0.0.205 port 1812 Waking up in 4.9 seconds. Cleaning up request 2 ID 155 with timestamp +17 Ready to process requests. rad_recv: Access-Request packet from host 11.0.0.205 port 1812, id=157, length=196 User-Name = "{sm=1}rawlacurone(a)adn.com" EAP-Message = 0x0201001e017b736d3d317d7261776c616375726f6e654061646e2e636f6d Message-Authenticator = 0xd84871a21825f994c68593b4d78ca653 NAS-Identifier = "201" NAS-IP-Address = 11.0.0.205 Calling-Station-Id = "AC-81-12-78-CA-6E" WiMAX-BS-Id = 0xfff329010102 NAS-Port-Type = Wireless-802.16 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 256 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Attr-1793 = 0x0000028a # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expan [auth_log] expand: %t -> Wed May 1 17:46:50 2013 ++[auth_log] returns fail Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> {sm=1}rawlacurone(a)adn.co attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 157 to 11.0.0.205 port 1812 Waking up in 4.9 seconds. ^C [root@adn larry]#

4 3

some error in log file
by Mehdi Ravanbakhsh 04 May '13

04 May '13

Hi All i have some error in log file and i do not know what is the cause of this error ? Error: WARNING: Unresponsive child for request 10785, in component authorize module WARNING: Module rlm_sql became unblocked for request 10526 Error: WARNING: Unresponsive child for request 10583, in component authorize module Error: WARNING: Unresponsive child for request 10561, in component authorize module sql WARNING: Unresponsive child for request 7478, in component authorize module <thread> best regards

2 1