July 2015 - Freeradius-Users - lists.freeradius.org

Re: AD Authentication using PAM_winbind.so succeeds, but FreeRadius 3.0.4 rejects with "Failed to Authenticate User"
by Josh Miller 25 Jul '15

25 Jul '15

Hello, I am attempting to configure 2 factor authentication using Google Authenticator + AD (Winbind), ultimately for use in my Cisco and Windows VPN environment. The environment is as follows: -Fedora 22 -Freeradius 3.0.4 -Samba 4.2.2 Authentication using Winbind is successful and the journalCTL log files verifies this as you will see below. For testing purposes, I've disabled Google Authenticator line in the /etc/pam.d/radiusd config file so I can focus on PAM_Winbind functionality. This is the only line that I'm using. ---------------------- #/etc/pam.d/radius auth required /usr/lib64/security/pam_winbind.so debug ---------------------- When I authenticate via radtest I get rejected: ------------ [root@hlsfreeradius01 ~]# radtest -x -t pap test-user-123 test-password localhost 1812 testing123 Sending Access-Request Id 172 from 0.0.0.0:55300 to 127.0.0.1:1812 User-Name = 'test-user-123' User-Password = 'test-password' NAS-IP-Address = 10.101.1.8 NAS-Port = 1812 Message-Authenticator = 0x00 Received Access-Reject Id 172 from 127.0.0.1:1812 to 127.0.0.1:55300 length 20 (0) -: Expected Access-Accept got Access-Reject -------------- Here is the JournalCTL output from Fedora that proves the winbind was successful: ---------------------- Jul 24 16:37:25 hlsfreeradius01 radiusd[2995]: pam_winbind(radiusd:auth): [pamh: 0x7f0bff4029c0] ENTER: pam_sm_authenticate (flags: 0x0000) J ul 24 16:37:25 hlsfreeradius01 radiusd[2995]: pam_winbind(radiusd:auth): getting password (0x00000001) Jul 24 16:37:25 hlsfreeradius01 radiusd[2995]: pam_winbind(radiusd:auth): Verify user 'test-user-123' Jul 24 16:37:25 hlsfreeradius01 radiusd[2995]: pam_winbind(radiusd:auth): request wbcLogonUser succeeded Jul 24 16:37:25 hlsfreeradius01 radiusd[2995]: pam_winbind(radiusd:auth): user 'test-user-123' granted access Jul 24 16:37:25 hlsfreeradius01 radiusd[2995]: pam_winbind(radiusd:auth): Returned user was 'test-user-123' Jul 24 16:37:25 hlsfreeradius01 radiusd[2995]: pam_winbind(radiusd:auth): [pamh: 0x7f0bff4029c0] LEAVE: pam_sm_authenticate returning 0 (PAM_SUCCESS) Jul 24 16:37:25 hlsfreeradius01 audit[2995]: <audit-1100> pid=2995 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_winbind acct="test-user-123" exe="/usr/sbin/radiusd" hostname=? addr=? terminal=pts/1 res=success' Jul 24 16:37:25 hlsfreeradius01 audit[2995]: <audit-1101> pid=2995 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=? acct="test-user-123" exe="/usr/sbin/radiusd" hostname=? addr=? terminal=pts/1 res=failed' ----------------------- Specific radiusd -XXX log output showing the PAM user authentication rejected: ----------------------- Received Access-Request Id 172 from 127.0.0.1:55300 to 127.0.0.1:1812 length 78 User-Name = 'test-user-123' User-Password = 'test-password' NAS-IP-Address = 10.101.1.8 NAS-Port = 1812 Message-Authenticator = 0x82a2d0ae5c2192628b6263c968890117 Fri Jul 24 16:37:25 2015 : Debug: (0) Received Access-Request packet from host 127.0.0.1 port 55300, id=172, length=78 Fri Jul 24 16:37:25 2015 : Debug: (0) User-Name = 'test-user-123' Fri Jul 24 16:37:25 2015 : Debug: (0) User-Password = 'test-password' Fri Jul 24 16:37:25 2015 : Debug: (0) NAS-IP-Address = 10.101.1.8 Fri Jul 24 16:37:25 2015 : Debug: (0) NAS-Port = 1812 Fri Jul 24 16:37:25 2015 : Debug: (0) Message-Authenticator = 0x82a2d0ae5c2192628b6263c968890117 Fri Jul 24 16:37:25 2015 : Debug: (0) # Executing section authorize from file /etc/raddb/sites-enabled/default Fri Jul 24 16:37:25 2015 : Debug: (0) authorize { Fri Jul 24 16:37:25 2015 : Debug: (0) filter_username filter_username { Fri Jul 24 16:37:25 2015 : Debug: (0) if (!&User-Name) Fri Jul 24 16:37:25 2015 : Debug: (0) if (!&User-Name) -> FALSE Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ / /) Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ / /) -> FALSE Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ /@.*@/ ) Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ /@.*@/ ) -> FALSE Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ /\\.\\./ ) Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ /\\.\\./ ) -> FALSE Fri Jul 24 16:37:25 2015 : Debug: (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) Fri Jul 24 16:37:25 2015 : Debug: (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ /\\.$/) Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ /\\.$/) -> FALSE Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ /(a)\\./) Fri Jul 24 16:37:25 2015 : Debug: (0) if (&User-Name =~ /(a)\\./) -> FALSE Fri Jul 24 16:37:25 2015 : Debug: (0) } # filter_username filter_username = notfound Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [preprocess] = ok Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: calling chap (rlm_chap) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: returned from chap (rlm_chap) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [chap] = noop Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [mschap] = noop Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: calling suffix (rlm_realm) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) suffix : Checking for suffix after "@" Fri Jul 24 16:37:25 2015 : Debug: (0) suffix : No '@' in User-Name = "test-user-123", looking up realm NULL Fri Jul 24 16:37:25 2015 : Debug: (0) suffix : No such realm "NULL" Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [suffix] = noop Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: calling eap (rlm_eap) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) eap : No EAP-Message, not doing EAP Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: returned from eap (rlm_eap) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [eap] = noop Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: calling files (rlm_files) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) files : users: Matched entry DEFAULT at line 182 Fri Jul 24 16:37:25 2015 : Debug: (0) files : ::: FROM 0 TO 0 MAX 0 Fri Jul 24 16:37:25 2015 : Debug: (0) files : ::: TO in 0 out 0 Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: returned from files (rlm_files) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [files] = ok Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: calling expiration (rlm_expiration) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: returned from expiration (rlm_expiration) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [expiration] = noop Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: calling logintime (rlm_logintime) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: returned from logintime (rlm_logintime) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [logintime] = noop Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: calling pap (rlm_pap) for request 0 Fri Jul 24 16:37:25 2015 : WARNING: (0) pap : No "known good" password found for the user. Not setting Auth-Type Fri Jul 24 16:37:25 2015 : WARNING: (0) pap : Authentication will fail unless a "known good" password is available Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authorize]: returned from pap (rlm_pap) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [pap] = noop Fri Jul 24 16:37:25 2015 : Debug: (0) } # authorize = ok #PAM authentication sequence begins Fri Jul 24 16:37:25 2015 : Debug: (0) Found Auth-Type = PAM Fri Jul 24 16:37:25 2015 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Fri Jul 24 16:37:25 2015 : Debug: (0) authenticate { Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authenticate]: calling pam (rlm_pam) for request 0 Fri Jul 24 16:37:25 2015 : Debug: pam_pass: using pamauth string <radiusd> for pam.conf lookup Fri Jul 24 16:37:25 2015 : Debug: pam_pass: function pam_acct_mgmt FAILED for <test-user-123>. Reason: Authentication failure Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[authenticate]: returned from pam (rlm_pam) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [pam] = reject Fri Jul 24 16:37:25 2015 : Debug: (0) } # authenticate = reject Fri Jul 24 16:37:25 2015 : Debug: (0) Failed to authenticate the user Fri Jul 24 16:37:25 2015 : Auth: (0) Login incorrect: [test-user-123/test-password] (from client localhost port 1812) Fri Jul 24 16:37:25 2015 : Debug: (0) Using Post-Auth-Type Reject Fri Jul 24 16:37:25 2015 : Debug: (0) # Executing group from file /etc/raddb/sites-enabled/default Fri Jul 24 16:37:25 2015 : Debug: (0) Post-Auth-Type REJECT { Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Fri Jul 24 16:37:25 2015 : Debug: %{User-Name} Fri Jul 24 16:37:25 2015 : Debug: Parsed xlat tree: Fri Jul 24 16:37:25 2015 : Debug: attribute --> User-Name Fri Jul 24 16:37:25 2015 : Debug: (0) attr_filter.access_reject : EXPAND %{User-Name} Fri Jul 24 16:37:25 2015 : Debug: (0) attr_filter.access_reject : --> test-user-123 Fri Jul 24 16:37:25 2015 : Debug: (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [attr_filter.access_reject] = updated # Ends Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[post-auth]: calling eap (rlm_eap) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[post-auth]: returned from eap (rlm_eap) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [eap] = noop Fri Jul 24 16:37:25 2015 : Debug: (0) remove_reply_message_if_eap remove_reply_message_if_eap { Fri Jul 24 16:37:25 2015 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) Fri Jul 24 16:37:25 2015 : Debug: (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Fri Jul 24 16:37:25 2015 : Debug: (0) else else { Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) for request 0 Fri Jul 24 16:37:25 2015 : Debug: (0) [noop] = noop Fri Jul 24 16:37:25 2015 : Debug: (0) } # else else = noop Fri Jul 24 16:37:25 2015 : Debug: (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop Fri Jul 24 16:37:25 2015 : Debug: (0) } # Post-Auth-Type REJECT = updated Fri Jul 24 16:37:25 2015 : Debug: (0) Delaying response for 1 seconds Fri Jul 24 16:37:25 2015 : Debug: Waking up in 0.2 seconds. Fri Jul 24 16:37:26 2015 : Debug: Waking up in 0.7 seconds. Fri Jul 24 16:37:26 2015 : Debug: (0) Sending delayed response Fri Jul 24 16:37:26 2015 : Debug: (0) Sending Access-Reject packet to host 127.0.0.1 port 55300, id=172, length=0 Sending Access-Reject Id 172 from 127.0.0.1:1812 to 127.0.0.1:55300 Fri Jul 24 16:37:26 2015 : Debug: Waking up in 3.9 seconds. Fri Jul 24 16:37:30 2015 : Debug: (0) Cleaning up request packet ID 172 with timestamp +26 Fri Jul 24 16:37:30 2015 : Info: Ready to process requests ---------------- Standard NTLM via AD works very well, but utilizing the PAM module is creating a whole new can of worms. My use case for PAM is 2 factor authentication with Google Authenticator, but if there is a better way to do this while still utilizing FreeRadius, then I am very interested. However, at this point I have not been unable to find another authentication methodology for Google OTP without the PAM component. If anyone is able to shed some light on the existing authentication issue I described, or even suggest a better way of doing this 2FA sequence in question, I would be extremely grateful. Also attaching the, radius -XXX startup output separately. Have a great weekend. -Josh

2 1

Error in passwordparsing
by Stabla, Daniel 24 Jul '15

24 Jul '15

Hello, don't know if it's a bug or a change (doesn't found anything in the release notes), but if you use commas for the password in e.g. clients.conf, then the password itself gets malformed. ########################################################################### Normal request with password 123 Ready to process requests Threads: total/active/spare threads = 5/0/5 Waking up in 0.3 seconds. Thread 2 got semaphore Thread 2 handling request 0, (1 handled so far) (0) Received Access-Request Id 244 from 172.17.8.10:3072 to 172.17.8.254:1812 length 180 (0) User-Name = "123456-7890ab" (0) User-Password = "123" (0) NAS-Identifier = "wpa" (0) NAS-IP-Address = 172.17.8.10 (0) Called-Station-Id = "12-34-56-78-90-AB:WLAN TEST" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) NAS-Port = 1 (0) NAS-Port-Id = "1" (0) Calling-Station-Id = "12-34-56-78-90-AB" (0) Connect-Info = "CONNECT 144 Mbps 802.11g/n" (0) # Executing section authorize from file /etc/radiusd-mac/sites-enabled/default (0) authorize { (0) radius-station-mac: EXPAND %{User-Name} (0) radius-station-mac: --> 123456-7890ab Found User-Password == "..." Are you sure you don't mean Cleartext-Password? See "man rlm_pap" for more information (0) [radius-station-mac] = noop (0) if (!ok) { (0) if (!ok) -> TRUE (0) if (!ok) { (0) radius-station-allow-mac: EXPAND %{User-Name} (0) radius-station-allow-mac: -->123456-7890ab (0) radius-station-allow-mac: users: Matched entry 123456-7890ab at line 18 (0) [radius-station-allow-mac] = ok (0) if (!ok) { (0) if (!ok) -> FALSE (0) } # if (!ok) = ok (0) [preprocess] = ok (0) } # authorize = ok (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) Login OK: [123456-7890ab/123] (from client wpa port 1 cli 12-34-56-78-90-AB) (0) Sent Access-Accept Id 244 from 172.17.8.254:1812 to 172.17.8.10:3072 length 0 (0) Finished request ########################################################################### Malformed request with password 123, Listening on auth address * port 1812 bound to server mac_server Ready to process requests Threads: total/active/spare threads = 5/0/5 Waking up in 0.3 seconds. Thread 2 got semaphore Thread 2 handling request 0, (1 handled so far) (0) Received Access-Request Id 93 from 172.17.8.10:3072 to 172.17.8.254:1812 length 180 (0) User-Name = "123456-7890ab" (0) User-Password = "4\016\236\343\234B\177\230\006VZ\030\027E\301\324" (0) NAS-Identifier = "wpa" (0) NAS-IP-Address = 172.17.8.10 (0) Called-Station-Id = "12-34-56-78-90-AB:WLAN TEST" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) NAS-Port = 1 (0) NAS-Port-Id = "1" (0) Calling-Station-Id = "12-34-56-78-90-AB" (0) Connect-Info = "CONNECT 144 Mbps 802.11g/n" (0) # Executing section authorize from file /etc/radiusd-mac/sites-enabled/default (0) authorize { (0) radius-station-mac: EXPAND %{User-Name} (0) radius-station-mac: --> 123456-7890ab Found User-Password == "..." Are you sure you don't mean Cleartext-Password? See "man rlm_pap" for more information (0) [radius-station-mac] = noop (0) if (!ok) { (0) if (!ok) -> TRUE (0) if (!ok) { (0) radius-station-allow-mac: EXPAND %{User-Name} (0) radius-station-allow-mac: --> 123456-7890ab (0) radius-station-allow-mac: users: Matched entry 123456-7890ab at line 18 (0) [radius-station-allow-mac] = ok (0) if (!ok) { (0) if (!ok) -> FALSE (0) } # if (!ok) = ok (0) [preprocess] = ok (0) } # authorize = ok (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) Login OK: [123456-7890ab/4????B???VZ??E??] (from client wpa port 1 cli 12-34-56-78-90-AB) (0) Sent Access-Accept Id 93 from 172.17.8.254:1812 to 172.17.8.10:3072 length 0 (0) Finished request This behavior appeared with 3.0.7. If it is a bug, please fix it. Kind regards. D. Stabla

3 2

(no subject)
by D C 24 Jul '15

24 Jul '15

I recently configured a radius server with openldap backend to handle central auth for all my network equipment. The ldap module is using "radiusGroupName" as my groupmembership_attribute. I've configured post-auth and the users file in such a way that I can log into devices with my ldap credentials ONLY if I am a member of one of 2 groups. My reply-item attributes are stored in ldap within the group, and all that is working great. Valid users who are not members of these defined groups get rejected. perfect. Now the tricky part. I have a third ldap group that i want to use in order to assign vpn access to people. so some users may be members of only the vpn group, and some maybe members of the superadmin group as well as the vpn group. This causes two problems. 1) If I add allow the vpn group, then vpn users will be able to login to network equipment which is definitely not desired. 2) I don't currently have any way to determine within radius if a user is trying to login to the vpn, or if they are trying to ssh to my firewall. I'm not really sure what I should do to work around this. My only idea I've come up with (which I don't like), is to have my firewall set a different NAS-ip for the vpn users. If that is different, then I imagine I can probably write some login in post-auth to handle it. Is there a better way to do this. The radius configuration on my firewall will let me set the nas-ip, auth-type, which source ip to communicate with, and which destination port the radius server is listening on. I've not yet looked into how the virtual servers work in radius, so maybe I can setup a different port and config for my vpn users to auth against.. Using FreeRadius 2.1.12.

1 0

Radclient - Invalid Pointer error.
by Todd Smith 24 Jul '15

24 Jul '15

Hi All, We are just warming up to radius implementation, I am testing on OpenSuSE13.2 with the following packages: freeradius-server-3.0.3-3.8.1.x86_64 freeradius-server-libs-3.0.3-3.8.1.x86_64 freeradius-server-ldap-3.0.3-3.8.1.x86_64 freeradius-server-utils-3.0.3-3.8.1.x86_64 Running through the basic tests as outlined in the 'Getting Started' section of freeradius.org. radius:~ # echo "User-Name=testing,User-Password=password" | radclient 127.0.0.1 auth testing123 The result is: Sending Access-Request Id 170 from 0.0.0.0:41075 to 127.0.0.1:1812 User-Name = 'testing' User-Password = 'password' Received Access-Accept Id 170 from 127.0.0.1:1812 to 127.0.0.1:41075 length 20 As expected, however the output continues from there: *** Error in `radclient': free(): invalid pointer: 0x00007fc87820ab00 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x730bf)[0x7fc874db30bf] /lib64/libc.so.6(+0x7892e)[0x7fc874db892e] /lib64/libc.so.6(+0x79636)[0x7fc874db9636] /usr/lib64/freeradius/libfreeradius-radius.so(fr_hash_table_free+0x67)[0x7fc8761e0d37] /usr/lib64/freeradius/libfreeradius-radius.so(dict_free+0x19)[0x7fc8761dbd89] radclient(main+0xcbc)[0x7fc87662d68c] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7fc874d61b05] radclient(+0x3ecd)[0x7fc87662decd] ======= Memory map: ======== 7fc873940000-7fc873956000 r-xp 00000000 00:1f 2373 /lib64/libgcc_s.so.1 7fc873956000-7fc873b55000 ---p 00016000 00:1f 2373 /lib64/libgcc_s.so.1 7fc873b55000-7fc873b56000 r--p 00015000 00:1f 2373 /lib64/libgcc_s.so.1 7fc873b56000-7fc873b57000 rw-p 00016000 00:1f 2373 /lib64/libgcc_s.so.1 7fc873b57000-7fc873b5e000 r-xp 00000000 00:1f 1773 /lib64/librt-2.19.so 7fc873b5e000-7fc873d5d000 ---p 00007000 00:1f 1773 /lib64/librt-2.19.so 7fc873d5d000-7fc873d5e000 r--p 00006000 00:1f 1773 /lib64/librt-2.19.so 7fc873d5e000-7fc873d5f000 rw-p 00007000 00:1f 1773 /lib64/librt-2.19.so 7fc873d5f000-7fc873e5f000 r-xp 00000000 00:1f 1749 /lib64/libm-2.19.so 7fc873e5f000-7fc87405e000 ---p 00100000 00:1f 1749 /lib64/libm-2.19.so 7fc87405e000-7fc87405f000 r--p 000ff000 00:1f 1749 /lib64/libm-2.19.so 7fc87405f000-7fc874060000 rw-p 00100000 00:1f 1749 /lib64/libm-2.19.so 7fc874060000-7fc8740a6000 r-xp 00000000 00:1f 2449 /lib64/libdbus-1.so.3.8.7 7fc8740a6000-7fc8742a5000 ---p 00046000 00:1f 2449 /lib64/libdbus-1.so.3.8.7 7fc8742a5000-7fc8742a6000 r--p 00045000 00:1f 2449 /lib64/libdbus-1.so.3.8.7 7fc8742a6000-7fc8742a7000 rw-p 00046000 00:1f 2449 /lib64/libdbus-1.so.3.8.7 7fc8742a7000-7fc8742c3000 r-xp 00000000 00:1f 2240 /usr/lib64/libnl-3.so.200.20.0 7fc8742c3000-7fc8744c2000 ---p 0001c000 00:1f 2240 /usr/lib64/libnl-3.so.200.20.0 7fc8744c2000-7fc8744c4000 r--p 0001b000 00:1f 2240 /usr/lib64/libnl-3.so.200.20.0 7fc8744c4000-7fc8744c5000 rw-p 0001d000 00:1f 2240 /usr/lib64/libnl-3.so.200.20.0 7fc8744c5000-7fc8744ca000 r-xp 00000000 00:1f 2244 /usr/lib64/libnl-genl-3.so.200.20.0 7fc8744ca000-7fc8746ca000 ---p 00005000 00:1f 2244 /usr/lib64/libnl-genl-3.so.200.20.0 7fc8746ca000-7fc8746cb000 r--p 00005000 00:1f 2244 /usr/lib64/libnl-genl-3.so.200.20.0 7fc8746cb000-7fc8746cc000 rw-p 00006000 00:1f 2244 /usr/lib64/libnl-genl-3.so.200.20.0 7fc8746cc000-7fc8746e3000 r-xp 00000000 00:1f 24982 /usr/lib64/libusb-1.0.so.0.1.0 7fc8746e3000-7fc8748e2000 ---p 00017000 00:1f 24982 /usr/lib64/libusb-1.0.so.0.1.0 7fc8748e2000-7fc8748e3000 r--p 00016000 00:1f 24982 /usr/lib64/libusb-1.0.so.0.1.0 7fc8748e3000-7fc8748e4000 rw-p 00017000 00:1f 24982 /usr/lib64/libusb-1.0.so.0.1.0 7fc8748e4000-7fc8748f9000 r-xp 00000000 00:1f 2076 /lib64/libz.so.1.2.8 7fc8748f9000-7fc874af8000 ---p 00015000 00:1f 2076 /lib64/libz.so.1.2.8 7fc874af8000-7fc874af9000 r--p 00014000 00:1f 2076 /lib64/libz.so.1.2.8 7fc874af9000-7fc874afa000 rw-p 00015000 00:1f 2076 /lib64/libz.so.1.2.8 7fc874afa000-7fc874b3c000 r-xp 00000000 00:1f 34920 /usr/lib64/libpcap.so.1.6.2 7fc874b3c000-7fc874d3c000 ---p 00042000 00:1f 34920 /usr/lib64/libpcap.so.1.6.2 7fc874d3c000-7fc874d3e000 r--p 00042000 00:1f 34920 /usr/lib64/libpcap.so.1.6.2 7fc874d3e000-7fc874d3f000 rw-p 00044000 00:1f 34920 /usr/lib64/libpcap.so.1.6.2 7fc874d3f000-7fc874d40000 rw-p 00000000 00:00 0 7fc874d40000-7fc874ede000 r-xp 00000000 00:1f 1741 /lib64/libc-2.19.so 7fc874ede000-7fc8750de000 ---p 0019e000 00:1f 1741 /lib64/libc-2.19.so 7fc8750de000-7fc8750e2000 r--p 0019e000 00:1f 1741 /lib64/libc-2.19.so 7fc8750e2000-7fc8750e4000 rw-p 001a2000 00:1f 1741 /lib64/libc-2.19.so 7fc8750e4000-7fc8750e8000 rw-p 00000000 00:00 0 7fc8750e8000-7fc875100000 r-xp 00000000 00:1f 1769 /lib64/libpthread-2.19.so 7fc875100000-7fc8752ff000 ---p 00018000 00:1f 1769 /lib64/libpthread-2.19.so 7fc8752ff000-7fc875300000 r--p 00017000 00:1f 1769 /lib64/libpthread-2.19.so 7fc875300000-7fc875301000 rw-p 00018000 00:1f 1769 /lib64/libpthread-2.19.so 7fc875301000-7fc875305000 rw-p 00000000 00:00 0 7fc875305000-7fc875308000 r-xp 00000000 00:1f 1747 /lib64/libdl-2.19.so 7fc875308000-7fc875507000 ---p 00003000 00:1f 1747 /lib64/libdl-2.19.so 7fc875507000-7fc875508000 r--p 00002000 00:1f 1747 /lib64/libdl-2.19.so 7fc875508000-7fc875509000 rw-p 00003000 00:1f 1747 /lib64/libdl-2.19.so 7fc875509000-7fc87551d000 r-xp 00000000 00:1f 1771 /lib64/libresolv-2.19.so 7fc87551d000-7fc87571c000 ---p 00014000 00:1f 1771 /lib64/libresolv-2.19.so 7fc87571c000-7fc87571d000 r--p 00013000 00:1f 1771 /lib64/libresolv-2.19.so 7fc87571d000-7fc87571e000 rw-p 00014000 00:1f 1771 /lib64/libresolv-2.19.so 7fc87571e000-7fc875720000 rw-p 00000000 00:00 0 7fc875720000-7fc875735000 r-xp 00000000 00:1f 1751 /lib64/libnsl-2.19.so 7fc875735000-7fc875934000 ---p 00015000 00:1f 1751 /lib64/libnsl-2.19.so 7fc875934000-7fc875935000 r--p 00014000 00:1f 1751 /lib64/libnsl-2.19.so 7fc875935000-7fc875936000 rw-p 00015000 00:1f 1751 /lib64/libnsl-2.19.so 7fc875936000-7fc875938000 rw-p 00000000 00:00 0 7fc875938000-7fc875946000 r-xp 00000000 00:1f 35091 /usr/lib64/libtalloc.so.2.1.2 7fc875946000-7fc875b46000 ---p 0000e000 00:1f 35091 /usr/lib64/libtalloc.so.2.1.2 7fc875b46000-7fc875b47000 r--p 0000e000 00:1f 35091 /usr/lib64/libtalloc.so.2.1.2 7fc875b47000-7fc875b48000 rw-p 0000f000 00:1f 35091 /usr/lib64/libtalloc.so.2.1.2 7fc875b48000-7fc875ba5000 r-xp 00000000 00:1f 2585 /lib64/libssl.so.1.0.0 7fc875ba5000-7fc875da4000 ---p 0005d000 00:1f 2585 /lib64/libssl.so.1.0.0 7fc875da4000-7fc875da8000 r--p 0005c000 00:1f 2585 /lib64/libssl.so.1.0.0 7fc875da8000-7fc875dae000 rw-p 00060000 00:1f 2585 /lib64/libssl.so.1.0.0 7fc875dae000-7fc875fa5000 r-xp 00000000 00:1f 2584 /lib64/libcrypto.so.1.0.0 7fc875fa5000-7fc8761a4000 ---p 001f7000 00:1f 2584 /lib64/libcrypto.so.1.0.0 7fc8761a4000-7fc8761bf000 r--p 001f6000 00:1f 2584 /lib64/libcrypto.so.1.0.0 7fc8761bf000-7fc8761cc000 rw-p 00211000 00:1f 2584 /lib64/libcrypto.so.1.0.0 7fc8761cc000-7fc8761d0000 rw-p 00000000 00:00 0 7fc8761d0000-7fc876205000 r-xp 00000000 00:1f 35096 /usr/lib64/freeradius/libfreeradius-radius.so 7fc876205000-7fc876404000 ---p 00035000 00:1f 35096 /usr/lib64/freeradius/libfreeradius-radius.so 7fc876404000-7fc876405000 r--p 00034000 00:1f 35096 /usr/lib64/freeradius/libfreeradius-radius.so 7fc876405000-7fc876406000 rw-p 00035000 00:1f 35096 /usr/lib64/freeradius/libfreeradius-radius.so 7fc876406000-7fc876407000 rw-p 00000000 00:00 0 7fc876407000-7fc876427000 r-xp 00000000 00:1f 1734 /lib64/ld-2.19.so 7fc876596000-7fc8765cb000 r--s 00000000 00:11 11793 /run/nscd/services 7fc8765cb000-7fc876600000 r--s 00000000 00:11 11792 /run/nscd/dbKWMtEq (deleted) 7fc876600000-7fc876605000 rw-p 00000000 00:00 0 7fc876605000-7fc876619000 r-xp 00000000 00:1f 24754 /usr/lib64/libudev.so.1.4.0 7fc876619000-7fc87661a000 r--p 00013000 00:1f 24754 /usr/lib64/libudev.so.1.4.0 7fc87661a000-7fc87661b000 rw-p 00014000 00:1f 24754 /usr/lib64/libudev.so.1.4.0 7fc87661b000-7fc876620000 rw-p 00000000 00:00 0 7fc876623000-7fc876627000 rw-p 00000000 00:00 0 7fc876627000-7fc876628000 r--p 00020000 00:1f 1734 /lib64/ld-2.19.so 7fc876628000-7fc876629000 rw-p 00021000 00:1f 1734 /lib64/ld-2.19.so 7fc876629000-7fc87662a000 rw-p 00000000 00:00 0 7fc87662a000-7fc876632000 r-xp 00000000 00:1f 35645 /usr/bin/radclient 7fc876832000-7fc876833000 r--p 00008000 00:1f 35645 /usr/bin/radclient 7fc876833000-7fc876834000 rw-p 00009000 00:1f 35645 /usr/bin/radclient 7fc878199000-7fc87831a000 rw-p 00000000 00:00 0 [heap] 7fff80e56000-7fff80e77000 rw-p 00000000 00:00 0 [stack] 7fff80ffc000-7fff80ffe000 r-xp 00000000 00:00 0 [vdso] 7fff80ffe000-7fff81000000 r--p 00000000 00:00 0 [vvar] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] Aborted Nothing on the internet in regards to this, I'm going to see if I can replicate on another install. If anyone can offer any insight it would be appreciated. Thanks, Todd Smith Head of Information Technology soho vfx | 99 Atlantic Ave. Suite 303, Toronto, Ontario M6K 3J8 office: (416) 516-7863 fax: (416) 516-9682 web: sohovfx.com

4 8

Authentication and Content filter
by Andrés Gómez 24 Jul '15

24 Jul '15

Hi everybody!! I'm using a captive portal + freeradius + mysql to do AAA of users in a private network. All work great. I can set timeout, up/down speed, etc., by groups/profiles (using tables groupradcheck, grouradreply, etc in my mysql DB). But Now I need to do an extra control. I need to implement a content control based on the freeradius's user profiles. I mean. User of group1 can surf only on some list of websites. User of group2 can surf only on .edu domines. User of group3 have free surf. I know it's not a task of freeradius to do content filter, but I have seen than can do some integration with another free servers like Squid. I appreciate if you can give me your advices. Regards, -- *C. Andrés Gómez R.*

4 5

Custom Reply Message
by Andrés Gómez 23 Jul '15

23 Jul '15

Hi everybody. Sorry, I know it is a basic question, I know the reply message are configurable in the module files, and other files. But I can't find this one that I receive when I use the Simultaneous-use attribute: # radtest 999 999 localhost 10 password Sending Access-Request of id 48 to 127.0.0.1 port 1812 User-Name = "999" User-Password = "999" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=48, length=68 Reply-Message = "\r\nYou are already logged in - access denied\r\n\n" I want to change that Reply-Message = "\r\nYou are already logged in - access denied\r\n\n" . But I have found everywhere and I can't find its config file. How can I do it? Regards -- *C. Andrés Gómez R.*

5 6

Building 3.0.9 package
by Alex Sharaz 23 Jul '15

23 Jul '15

Hi, Just tried building a package of 3.0.9 on Ununtu 14.04 ... sort of worked. Looked at the freeradius wiki and did tar zxf freeradius-server-3.0.9.tar.gz cd freeradius-server-3.0.9 dpkg-buildpackage -b -uc # # Did a whole batch of apt-get install <package names here till dpkg-buildpackage worked # dpkg -i ../*freeradius*_3.0.9*.deb At this point, amongst other things I get :- Unpacking freeradius-dhcp (3.0.9+git) ... dpkg: error processing archive ../freeradius-dhcp_3.0.9+git_amd64.deb (--install): trying to overwrite '/usr/lib/freeradius/proto_dhcp.so', which is also in package freeradius 3.0.9+git ..... Setting up libfreeradius-dev (3.0.9+git) ... Setting up freeradius (3.0.9+git) ... * Checking FreeRADIUS daemon configuration... [fail] invoke-rc.d: initscript freeradius, action "restart" failed. Setting up freeradius-utils (3.0.9+git) ... Processing triggers for ureadahead (0.100.0-16) ... Lots more fail messages. all relating to the one above I guess. Looking radius.log I get Thu Jul 23 14:04:34 2015 : Info: Debugger not attached Thu Jul 23 14:04:34 2015 : Error: /etc/freeradius/mods-enabled/dhcp[18]: Failed to link to module 'rlm_dhcp': /usr/lib/freeradius/rlm_dhcp.so: cannot open shared object file: No such file or directory .. which is right, there isn't an rlm_dhcp.so present in /usr/lib/freeradius If I go into /etc/freeradius/mods-enabled and remove the dhcp symbolic link then I can start freeradius. Can't seem to find why the rlm_dhcp module wasn't build though ...not that I need it, but that's not the point. Anyone built 3.0.9 package on Ubuntu 14.04? Rgds A

2 2

Freeradius 2.1.12 CoA configuration
by mohammed farouk 23 Jul '15

23 Jul '15

Dear All, Please advise me for the correct configuration for the CoA disconnect, i am having missing something when i execute the command : echo "User-Name='sunny',Acct-Session-Id=55af81be0000000b" | radclient -c '1' -n '3' -r '3' -t '3' -x '127.0.0.1:3799' 'disconnect' 'testing123' 2>&1 in the sites-available/originating-coa update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" } is this correct? the debugging: rad_recv: Disconnect-Request packet from host 127.0.0.1 port 49510, id=113, length=45 User-Name = "sunny" Acct-Session-Id = "55af81be0000000b" server coa { # Executing section recv-coa from file /etc/freeradius/sites-available/coa +- entering group recv-coa {...} ++[ok] returns ok # Executing section send-coa from file /etc/freeradius/sites-available/coa +- entering group send-coa {...} ++[ok] returns ok } # server coa Sending Disconnect-ACK of id 113 to 127.0.0.1 port 49510 Finished request 0. but the user still connect and it didn't disconnect it, what exactly i need to do ? I appreciate your help *Best regards,* *Mohammed Farouk*

3 2

LDAP authentification with passwords containing special characters
by Norbert Kunth 23 Jul '15

23 Jul '15

Hi everybody, we use freeradius 2.1.1 and try to authenticate users via LDAP. But there seems to be an issue if we use special characters (such as #). #XxuwBw. is the correct user password If the users connects I can see the following messages: [...] [ldap] Added User-Password = #XxuwBw. in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... rlm_ldap: userPassword -> Password # "XxuwBw." [ldap] looking for reply items in directory... rlm_ldap: Failed to create the pair: Failed to find IP address for XxuwBw. At this point something has removed the # and changed the password to XxuwBw. Subsequently the authentication fails: [...] [chap] Using clear text password "XxuwBw." for user ABCDE authentication. [chap] Password check failed Are there any restrictions regarding the characters allowed? Best regards Norbert

2 2

Knowing the proxy's actual response in rlm_perl's post_proxy function
by Harm van Tilborg 22 Jul '15

22 Jul '15

Hey there, This is kind-of a repost of this question: http://lists.freeradius.org/pipermail/freeradius-users/2006-October/013579.… So here we go: I'm currently running FreeRADIUS version 2.2.7 and using rlm_perl. In the authorize section, I manually set the proxy where to forward the request to, like this: $RAD_CHECK{'Proxy-To-Realm'} = 'my_realm'. Now in the post_proxy section of this same Perl script, I'd like to know the proxy's response, i.e. whether it's rejected or accepted. When looking at all the environment variables available in the Perl environment (i.e. %RAD_CONFIG %RAD_REQUEST %RAD_REPLY %RAD_CHECK %RAD_REQUEST_PROXY %RAD_REQUEST_PROXY_REPLY) I cannot find any indication that these contain the information I'm looking for. Yes, the attributes replied from the proxy are there, but not the actual access decision. Is there any way to get the actual access decision? -- Kind regards, Harm van Tilborg

2 2