September 2015 - Freeradius-Users - lists.freeradius.org

sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

Hi, Having configured FR to talk to our MS SQL server which appears to work fine now (radius -X doesn't complain anymore), I've tried a quick test, a very basic condition to lookup a mac and update reply with a particular VLAN tag if its exists.. and added the following in the post-auth section of the default site. - - - - - - post-auth { - - - - - - - - - - # sql if("%{sql:SELECT COUNT(*) FROM tblwindows WHERE MacAddress ='%{Calling-Station-ID}'}" ==1){ update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = 100 } else { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = 101 } } } radiusd -X reports a segmentation fault: # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql rlm_sql (sql): Attempting to connect to database "Computing" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} Segmentation fault This same sql statement worked fine when I was initially playing around with this and it worked ok against a MySql DB (FR version 2.2.x). Ive also tried the same query against our MSSql server using isql on the same server and that works fine. What am I missing/doing wroing? Regards, Mohamed

3 2

sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

.... just to add to this, im using FR Version 3.0.9 Regards, Mohamed

1 0

Freeradius with LNS & Provider BRAS
by Neil Morris 11 Sep '15

11 Sep '15

Folks, I am looking for some guidance. I am using the users file which contains x3 user accounts aswell as the domain suffix & the necessary authentication details for the providers RADIUS server. Under the user accounts I have a number of cisco avp with VRF & static address etc for the LNS Whoever The provider is telling me that I am passing all the LNS relate info to their RADIUS which is causing the tunnel build to fail. Is there something major that I am missing here in relation to my config? Kind Regards, Neil

2 1

Identity does not match User-Name, setting from EAP Identity. (Freeradius + EAP + MSCHAPv2 + NTLM + AD)
by aquilinux 10 Sep '15

10 Sep '15

Hi all, i'm configuring RADIUS authentication against MS Active Directory. So far i've successfully joined the server to the domain and ntlm_auth works flawlessly: */usr/bin/ntlm_auth --request-nt-key --domain=EA-MILANO --username=srv_backup2 --password=xxxxxxxx* *NT_STATUS_OK: Success (0x0)* but i'm going nuts with freeradius. I've read lots of posts in mailing list and howtos about my error: Thu Sep 10 15:05:46 2015 : Debug: (0) eap : *Identity does not match User-Name, setting from EAP Identity.* Thu Sep 10 15:05:46 2015 : Debug: (0) eap : *Failed to get handler, probably already removed, not inserting EAP-Failure* but still i can't get it working. so here i am, asking myself the mailing-list. here is my debug output: http://pastebin.com/cvsfxNUA and here is the radeapclient request: http://pastebin.com/v4Kwzj66 thanks in advance! -- "Madness, like small fish, runs in hosts, in vast numbers of instances." Nessuno mi pettina bene come il vento.

3 2

Freeradius and Kerberos
by Jürgen Obermeyer 10 Sep '15

10 Sep '15

Good afternoon! I'm a german teacher and responsible for the computer network at my school. I would like to authenticate users intending to connect with our WLAN by using their credentials stored in a Kerberos database. I read a lot of documentation, but due to the fact that I'm a teacher and not a professional system adminstrator, I'm not able to get things work and I hope for some help! What I have: - an Ubuntu box (14.04 server) with a running MIT-Kerberos infrastructure - freeradius 2.1.12 on this box - an AP with "WPA enterprise" (WPA-EAP) I've done a lot of configuration and if I try to connect to the WLAN via the AP, freeradius is presenting his certificate and prompts me for user credentials. The packet freeradius-krb5 is installed and configured properly (I hope). But the authentication doesn't work. There a so much config details that I don't know exactly what kind of information may be useful to solve my problem. Maybe there is a tutorial describing step by step what I have to do? And: I hope that it is possible to an authentication against Kerberos? Thanks a lot for your hints! Jürgen -- Ökumenisches Gymnasium Bremen Oberneulander Landstr. 143a 28355 Bremen Fon: +49 421 22312913 Fax: +49 421 22312910 Web: http://www.oegym.de/

2 1

Network ranges in users files
by Sophie Loewenthal 10 Sep '15

10 Sep '15

Hi, I'dl ike to add some addresses into /etc/raddb/users Currently I have this, DEFAULT NAS-IP-Address == 195.222.222.0, Pool-Name := vodafone-nas-m2m But I should change this to, 195.232.191.50 195.232.191.51 195.232.191.52 195.232.191.53 Maybe I could use 195.232.191.52/29 allowing 195.232.191.49 - 195.232.191.54 Would these ideas work? DEFAULT NAS-IP-Address == 195.232.191.52/29, Pool-Name := vodafone-nas-m2m Or, DEFAULT NAS-IP-Address == 195.232.191.50, Pool-Name := vodafone-nas-m2m DEFAULT NAS-IP-Address == 195.232.191.51, Pool-Name := vodafone-nas-m2m DEFAULT NAS-IP-Address == 195.232.191.52, Pool-Name := vodafone-nas-m2m DEFAULT NAS-IP-Address == 195.232.191.53, Pool-Name := vodafone-nas-m2m Kind regards, Sophie

2 3

freeradius X error "failed to load module "perl""
by John Estrella 10 Sep '15

10 Sep '15

Hi All, I have Ubunto 12.04.3 server and installed LinOTP and FreeRadius using the following website instructions. Not sure the versions of LinOTP and FreeRadius installed but I'm guessing the latest versions since I didn't specify a version during download. https://thenetworkcable.wordpress.com/2014/11/28/two-factor-authentication-… I followed each step and had no errors setting anything up. When running "radtest username OTPpassword 127.0.0.1 0 mypass", I receive an error saying "radclient: no response from server for ID 234 socket 3" Afterwards, I ran freeradius -X debug and got the following message: Radius: #### Loading Virtual Servers #### server { #from the file /etc/freeradius/radius.conf modules { Module: Creating Auth-Type = perl Module: Checking authenticate {...} for more modules to load /etc/freeradius/sites-enabled/linotp[13]: Failed to load module "perl". /etc/freeradius/sites-enabled/linotp[12]: Errors parsing authenticate section. I have searched plenty and haven't found any difinitive solutions. Your help is greatly appreciated. John The information in this e-mail message and any attachments may be legally privileged and confidential. If you are not an intended recipient, you are hereby notified that you have received this communication in error and that any review, use, distribution or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by return e-mail and delete this e-mail message, any copies thereof and any attachments thereto. This email is for informational purposes only and does not constitute an offer to sell or a solicitation of an offer to purchase any interest in any investment vehicles managed by Sandler Capital Management.

4 4

sql accounting
by Edwardo Garcia 09 Sep '15

09 Sep '15

Hi, in accounting {} There is -sql and -ldap can someone explain why they are exampled that way? Does it mean do not use sql and ldap? and it is written this way to specifically not use them, over a compile time default of use them? So if I want to use sql in accounting, I need change -sql to sql? thanks

3 4

Questions regarding trimming User-Name attribute via filter.
by Pro Green European 09 Sep '15

09 Sep '15

Hi. I'm having issues with migrating from 2.1.0 to 3.0.4 (Centos 7.x). In version 2.1.0 I have in /etc/freeradius/users: DEFAULT User-Name =~ ".{5}$" User-Name = `%{0}` This does not work anymore, and I am struggling to understand how to achieve the same thing in 3.0.4. What I want to achieve is, that anything that comes before the last five characters should be removed from the User-Name attribute, and only the last five characters should be left as User-Name. I understand that I have to do this in /etc/raddb/policy.d/filter somehow, but I fail to see how. Would somebody with better knowledge please assist. BR, /PGE

2 1

eapol_test from wpa_supplicat-2.4 fails with MPPE keys mismatch for TTLS:CHAP/MSCHAP/MSCHAPv2
by Patrik Kis 09 Sep '15

09 Sep '15

Hello, I executed eapol_test from wpa_supplicat-2.4 (that is using TLS-1.2) against freeradius-2.2.8 and the following cases are failing with " [ttls] Tunneled challenge is incorrect": EAP-TTLS/CHAP EAP-TTLS/MSCHAP EAP-TTLS/MSCHAPv2 Interestingly the same tests with eapol_test from wpa_supplicat-2.4 (that is using TLS-1.0) are fine. I would be surprised if I was the first who tried to run these tests. Does anybody experienced the same issue? For configuration and test results please refer to the attached file. radiusd in debug mode write this: ... [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Tunneled challenge is incorrect [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [eap] Reply already contained an EAP-Message, not inserting EAP-Failure ++[eap] = noop [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 6 to 127.0.0.1 port 49816 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 The test configuration files looks like this: # cat EAP-TTLS_CHAP.conf ctrl_interface=wpa_supplicant.ctrl network={ ssid="QA test 802.1x network" key_mgmt=IEEE8021X eap=TTLS phase2="auth=CHAP" identity="testuser" anonymous_identity="anonymous" password="testpwd" ca_cert="/etc/raddb/certs/ca.pem" ca_cert2="/etc/raddb/certs/ca.pem" } The raiusd has the default configuration except: /etc/raddb/modules/mschap /etc/raddb/modules/pap /etc/raddb/eap.conf /etc/raddb/users and test certificates were created and added. For the details please see the attached file. The wpa_supplicant was built with the provided "defconfig" configuration. Regards, Patrik Kis

6 14