March 2015 - Freeradius-Users - lists.freeradius.org

Segmentation Fault after querying radgroupcheck in FR 3.0.7
by Susan Barnes 31 Mar '15

31 Mar '15

Hi, we have built and installed FR 3.0.7 RPMs on CentOS 6 with the specfile from <http://software.opensuse.org/download.html?project=home%3Afreeradius%3A3.0.…> (with minimal changes for the changes from 3.0.4 to 3.0.7) We have run into the following problem: Using SQL-Backend, we would like to authorize users according to huntgroups. We have set up a usergroup mgm-wlan-3 and then inserted the following attribute/value into radgroupcheck: insert into radgroupcheck (GroupName, Attribute, op, Value) values ('mgm-wlan-3', 'Huntgroup-Name', '==', 'submarine'); When testing the user is found, but just after querying radgroupcheck we get a seg fault if and only if the attribute in radgroupcheck does not match. output from radisud -X rlm_sql (sql): Reserved connection (9) (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00254bbf0584' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00254bbf0584' ORDER BY id (3) sql: User found in radcheck table (3) sql: Conditional check items matched, merging assignment check items (3) sql: Cleartext-Password := '00254bbf0584' (3) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (3) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '00254bbf0584' ORDER BY id (3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '00254bbf0584' ORDER BY id (3) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (3) sql: --> SELECT groupname FROM radusergroup WHERE username = '00254bbf0584' ORDER BY priority (3) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '00254bbf0584' ORDER BY priority (3) sql: User found in the group table (3) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (3) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'mgm-wlan-3' ORDER BY id (3) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'mgm-wlan-3' ORDER BY id Segmentation fault We have looked into the source and used gdb and think the problem lies with the following lines from rlm_sql.c within rlm_sql_process_groups(): do { next: rad_assert(entry != NULL); pairstrcpy(sql_group, entry->name); . . . if ((rows > 0) && (paircompare(request, request->packet->vps, check_tmp, &request->reply->vps) != 0)) { pairfree(&check_tmp); entry = entry->next; goto next; /* != continue */ } If the attributes from radgroupcheck do not match paircompare() returns a value not 0 and then entry->next is not defined, but we still jump into the next iteration and possibly pairstrcpy() segfaults. rad_assert does not seem to do anything, because NDEBUG was set during compilation. Is this a bug or are we doing anything wrong? Thanks in advance Susan -- S.Barnes Cologne University IT/Networking Dept.

3 2

RE: Certificate information
by Franks Andy (IT Technical Architecture Manager) 31 Mar '15

31 Mar '15

Hi Arran, So, I've partly got this, but only partly! If I create a radius attribute in the dictionary of string type, how does that link to the EKU extension part of the cert? Obviously there are predefined attributes in the internal dictionary and the one I'd expect to start reporting this is (presumably multi value attribute?) ATTRIBUTE TLS-Client-Cert-X509v3-Extended-Key-Usage 1927 .. but that returns an empty string during the debugging (7) EXPAND %{TLS-Client-Cert-X509v3-Extended-Key-Usage} (7) --> (7) Reply-Message += "" If wonder if it's either due to the openssl library version or the fact that the certs are likely DER format to start with..? I know that certain attributes are required for windows to even look at a certificate for wireless use, so we can assume "client authentication" as one of the required EKUs - I'd be looking for ones over and above that as it looks like the certificates being created randomly by the domain administrator (!) contain other things like encrypting file system use and so on. Anyway, I guess the best way forward is to download the latest git and try what you added? Am I best to try and upgrade the openssl libraries too? Thanks guys, really helpful.

2 1

php - ceck client status
by Marcin 31 Mar '15

31 Mar '15

Hi, I'd like to wrie few php script to manage users sessions Are there any posibility to ask freeradius, like nas does it, about client status? some virutal servers which can answer? for example. I'd like to know if client bob is logged still? that i send to freeradius pacect acc-status-client=bob, and FR aswer yes or no. something in that way. -- Regards Marcin / nicraM

3 7

Re: Freeradius-Users Digest, Vol 119, Issue 126
by Rui Ribeiro 30 Mar '15

30 Mar '15

Hi Adam, Install again it in a testing machine, and/or diff against sources. Try to document and understand what you have done, one of these days you will have to debug it. Become acquainted with raddebug and radmin. Regards, Rui Ribeiro > Message: 6 > Date: Mon, 30 Mar 2015 15:33:07 -0400 > From: Adam Schappell <aschappell(a)clearedgeit.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Help PLease > Message-ID: > < > CAHoRX4+Uig8kcUsr_qFdKqnKRptnxEj_kDFFUXD_H7+ksjd6hg(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Thanks for everyones help. I dont know what exactly I did but I got access > accept.. > > Found Auth-Type = LDAP > > # Executing group from file /etc/raddb/sites-enabled/default > > +- entering group LDAP {...} > > [ldap] login attempt by "radius" with password "test" > > [ldap] user DN: > CN=rtest,OU=Users,OU=Jetestp,OU=ClearEdge,DC=corp,DC=test,DC=com > > [ldap] (re)connect to dc1.corp.clearedgeit.com:389, authentication 1 > > [ldap] bind as > CN=rtests,OU=Users,OU=test,OU=ClearEdge,DC=corp,DC=testeit,DC=com/test to > dc1.corp.clearedgeit.com:389 > > [ldap] waiting for bind result ... > > [ldap] Bind was successful > > [ldap] user radius authenticated succesfully > > ++[ldap] returns ok > > # Executing section post-auth from file /etc/raddb/sites-enabled/default > > +- entering group post-auth {...} > > ++[exec] returns noop > > Sending Access-Accept of id 135 to 127.0.0.1 port 48249 > > Finished request 0. > > Going to the next request > > Waking up in 4.9 seconds. > > Cleaning up request 0 ID 135 with timestamp +8 > > Ready to process requests. > > Adam Schappell > System Administrator II > Clearedge IT Solutions, LLC > 10620 Guilford Road > Jessup, MD 20794 > Office:443-212-4712 > Fax:443-212-4809 > www.ClearEdgeIT.com <http://www.clearedgeit.com/> > > > On Mon, Mar 30, 2015 at 3:23 PM, <A.L.M.Buxey(a)lboro.ac.uk> wrote: > > > Hi, > > > > > I get its failing but I do not know what else to set it to, It is the > > > > read the error. deduce the issue > > > > > [ldap] expand: > (&(SAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) > > -> > > > (&(SAMAccountName=radius) > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > > > thats wehat came out of the expansion of your current config > > > > > [ldap] performing search in dc=corp,dc=clearedgeit,dc=com, with > filter > > > (&(SAMAccountName=radius) > > > > > > [ldap] ldap_search() failed: Bad search filter: > > (&(SAMAccountName=radius) > > > > and thats the result > > > > > [ldap] search failed > > > > which means that happens > > > > > > the binding and the searching are 2 different things. you had 'working' > > but > > failing search with uid - you've now just got a broken search > > > > I'd just hazard a guess that you should be using eg > > (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}) > > > > note how upper and lower case have been chosen. > > > > alan > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 2

FreeRADIUS High Availability with AD Integration
by Vinícius Ferrão 30 Mar '15

30 Mar '15

Hello guys, Sorry if this is a question that was already answered on this list. I've looked over the web and the only documentation that I found was about FreeRADIUS with MySQL HA, which I'm not interested. I've a single FreeRADIUS 3 server integrated in a AD domain to provide 802.1x authentication over the air and in the Ethernet cable. It's working perfectly, but I would like to implement an High Availability feature. The question is how to do this? Just install another FreeRADIUS server independently and everything would be fine? Since the supplicants can use two distinct RADIUS servers. Thanks in advance,

2 2

radwho doesn't work
by Marcin 30 Mar '15

30 Mar '15

Freeradius 3.0.7 root@radius01:/etc/freeradius/sites-enabled# radlast bob 000:testNetw Fri Mar 27 10:42 still logged in bob 000:testNetw Fri Mar 27 10:35 - 10:39 (00:04) bob 000:testNetw Fri Mar 27 10:31 - 10:34 (00:02) bob 000:testNetw Fri Mar 27 10:03 - 10:31 (00:28) bob 000:testNetw Fri Mar 27 09:53 - 10:02 (00:09) bob 000:testNetw Fri Mar 27 09:45 - 09:52 (00:07) bob 000:testNetw Fri Mar 27 09:44 - 09:44 (00:00) bob 000:testNetw Fri Mar 27 09:42 - 09:44 (00:01) bob 000:testNetw Fri Mar 27 09:41 - 09:42 (00:01) bob 000:testNetw Fri Mar 27 09:40 - 09:41 (00:00) radwtmp begins Fri Mar 27 09:40:38 2015 root@radius01:/etc/freeradius/sites-enabled# radwho Fri Mar 27 11:14:58 2015 : Error: /etc/freeradius/policy.d/abfab-tr[12]: Parse error in condition Fri Mar 27 11:14:58 2015 : Error: /etc/freeradius/policy.d/abfab-tr[12]: (TLS-PSK-Identity) { Fri Mar 27 11:14:58 2015 : Error: /etc/freeradius/policy.d/abfab-tr[12]: ^ Expected a module return code radwho: Error reading or parsing radiusd.conf root@radius01:/etc/freeradius/sites-enabled#

4 17

RE: Certificate information
by Franks Andy (IT Technical Architecture Manager) 30 Mar '15

30 Mar '15

Hi all, I need to be clearer on this obviously. We have a situation where one or two senior engineers are changing infrastructure and not being open about it, they do not want to do the "teamwork" thing and I politically cannot force them to do so since they operate at the same level as me, hence me trying to check the certificate presented to see if it fell into the "acceptable" template created at the project start. It's not ideal, but the technology route will be quicker route to resolution. Politics! End users cannot create certificates. I'll re-read the docs, but the sites-enabled/default seems to be the main place where the TLS-* attributes are mentioned. Not sure about the 3.1.0 thing - my version says: freeradius: FreeRADIUS Version 3.1.0 (git #1411859), for host x86_64-unknown-linux-gnu, built on Aug 5 2014 at 17:42:11 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors ? Thanks as always Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Michael Ströder Sent: 30 March 2015 14:14 To: FreeRadius users mailing list Subject: Re: Certificate information Franks Andy (IT Technical Architecture Manager) wrote: > I was wondering if there is any way I could read a TLS client > certificate field (probably MS specific) called "Certificate Template > Information". We have an M$ CA (for now), and one of the strings > within this field contains the name of the certificate template, which > I want to check, to make sure that people aren't making up their own > cert templates and randomly giving wireless access to people in the > wrong way (I have good reason). I think your idea is the completely wrong approach for the problem. Make sure you have your PKI under your control => ensure that "people" cannot make up their own cert templates. Ciao, Michael.

4 5

issue with building FR2.2.6 and openssl 1.0.2a
by Alex Sharaz 30 Mar '15

30 Mar '15

Hi, Just tried building R2.2.6 with latest openssl shared libraries and get /usr/local/sbin/radiusd: /usr/local/ssl/lib/libcrypto.so.1.0.0: no version information ... fail built openssl using ./config shared make make test make install then created a file openssl.confg in /etc/ld.so.conf.d with /usr/local/ssl/lib ran ldconifg -v build 2.2.6 with ./configure --with-openssl-libraries-dir=/usr/local/ssl/lib --with-openssl-includes=/usr/local/ssl/include Rgds Alex

2 1

Certificate information
by Franks Andy (IT Technical Architecture Manager) 30 Mar '15

30 Mar '15

Hi all, Using FR v3.1.0. I was wondering if there is any way I could read a TLS client certificate field (probably MS specific) called "Certificate Template Information". We have an M$ CA (for now), and one of the strings within this field contains the name of the certificate template, which I want to check, to make sure that people aren't making up their own cert templates and randomly giving wireless access to people in the wrong way (I have good reason). A less satisfactory way of doing this would be by checking the EKUs matched the template I was using, as the other templates I've found don't have quite the same makeup there. I tried all the specific dictionary TLS-* , including the seemingly EKU specific one, and they are largely empty. I also can't base it on OU structure as some certs are based on device names and some on AD users. I would like to do this via the named Template Information field if possible, since this also contains other useful stuff. I presume I can't do what I'm trying to achieve? The obvious thing would be to stop other people issuing certs, but I may as well learn to code C properly and rewrite the module, it would be easier :-) EXPAND %{TLS-Cert-Subject-Alt-Name-Email} (7) --> (7) Reply-Message += "" (7) EXPAND %{TLS-Cert-Subject-Alt-Name-Dns} (7) --> (7) Reply-Message += "" (7) EXPAND %{TLS-Cert-Subject-Alt-Name-Upn} (7) --> (7) Reply-Message += "" (7) EXPAND %{TLS-Client-Cert-Filename} (7) --> (7) Reply-Message += "" (7) EXPAND %{TLS-Client-Cert-Subject-Alt-Name-Email} (7) --> (7) Reply-Message += "" (7) EXPAND %{TLS-Client-Cert-X509v3-Extended-Key-Usage} (7) --> (7) Reply-Message += "" (7) EXPAND %{TLS-Client-Cert-X509v3-Subject-Key-Identifier} (7) --> (7) Reply-Message += "" (7) EXPAND %{TLS-Client-Cert-X509v3-Authority-Key-Identifier} (7) --> (7) Reply-Message += "" (7) EXPAND %{TLS-Client-Cert-X509v3-Basic-Constraints} (7) --> (7) Reply-Message += "" (7) EXPAND %{TLS-Client-Cert-Subject-Alt-Name-Dns} (7) --> (7) Reply-Message += "" Thanks very much Andy.

4 3

Logging inner user name instead of anonymous
by Clement Ogedengbe 27 Mar '15

27 Mar '15

On ourfFront end server, I set up the following linelog module to record snapshot status of authentication requests (Accepted or Rejected). I have however observed that for users who specify anonymous names, it's their anonymous names that get recorded instead of their real names. How can I ensure that it's the real user name that gets recorded instead of anonymous names: linelog f_ticks { filename = ${radacctdir}/%Y%m%d/linelog format = " Log Message for %{User-Name}" reference = "f_ticks.%{%{reply:Packet-Type}:-format}" f_ticks { Access-Accept = "Access accepted for %{User-Name} at %{NAS-IP-Address} received from %{Packet-Src-IP-Address} proxied to %{home_server:ipaddr} # CSI=%{Calling-Station-Id} # Time = %t " Access-Reject = "Access rejected for %{User-Name} at %{NAS-IP-Address} received from %{Packet-Src-IP-Address} proxied to %{home_server:ipaddr} # CSI=%{Calling-Station-Id} # Time = %t " } } Clement

4 4