April 2019 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Freeradius crashes with SIGABRT
by Daniel Feuchtinger 04 Dec '19

04 Dec '19

Hi, our radius proxy crashes regularily since we switched from version 2 to 3. First we ran freeradius version 3.0.15 (package from Suse Linux Enterprise 12.4), then version 3.0.17 and 3.0.18 (compiled with rpmbuild) with no difference. Our present configuration is like this: radius@radius-dev1:~> uname -a Linux radius-dev1 4.12.14-95.6-default #1 SMP Thu Jan 17 06:04:39 UTC 2019 (6af4ef8) x86_64 x86_64 x86_64 GNU/Linux radius@radius-dev1:~> /usr/sbin/radiusd -v radiusd: FreeRADIUS Version 3.0.18, for host x86_64-suse-linux-gnu, built on Mar 4 2019 at 00:00 FreeRADIUS Version 3.0.18 I run the radius-daemon inside of gdb with dumps enabled: Starting program: /usr/sbin/radiusd -f -d /etc/raddb ... *** Error in `/usr/sbin/radiusd': double free or corruption (fasttop): 0x00007fffe8009b40 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7411f)[0x7ffff60ba11f] /lib64/libc.so.6(+0x79596)[0x7ffff60bf596] /lib64/libc.so.6(+0x7a3db)[0x7ffff60c03db] /usr/lib64/libtalloc.so.2(+0x300d)[0x7ffff6e7a00d] /usr/lib64/libtalloc.so.2(+0x2d87)[0x7ffff6e79d87] /usr/lib64/libtalloc.so.2(+0x2d87)[0x7ffff6e79d87] /usr/sbin/radiusd(+0x37ae7)[0x55555558bae7] /usr/sbin/radiusd(+0x3a14d)[0x55555558e14d] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_run+0x74)[0x7ffff79928d4] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_loop+0x2c9)[0x7ffff7992ec9] /usr/sbin/radiusd(main+0x706)[0x555555569f06] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7ffff6066725] /usr/sbin/radiusd(_start+0x29)[0x55555556a239] Thread 1 "radiusd" received signal SIGABRT, Aborted. 0x00007ffff607af97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 55 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) (gdb) bt #0 0x00007ffff607af97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007ffff607c36a in __GI_abort () at abort.c:78 #2 0x00007ffff60ba124 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff61b3f48 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007ffff60bf596 in malloc_printerr (action=3, str=0x7ffff61b40a0 "double free or corruption (fasttop)", ptr=<optimized out>, ar_ptr=<optimized out>) at malloc.c:5018 #4 0x00007ffff60c03db in _int_free (av=0x7fffe8000020, p=<optimized out>, have_lock=0) at malloc.c:3872 #5 0x00007ffff6e7a00d in _tc_free_internal (tc=0x7fffe8009b40, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1148 #6 0x00007ffff6e79d87 in _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x7fffe801cb80, tc=0x7fffe801cb20) at ../talloc.c:1593 #7 _tc_free_internal (location=0x5555555b02ea "src/main/process.c:604", tc=0x7fffe801cb20) at ../talloc.c:1104 #8 _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c80a60, tc=0x555555c80a00) at ../talloc.c:1593 #9 _tc_free_internal (tc=0x555555c80a00, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1104 #10 0x00007ffff6e79d87 in _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c808b0, tc=0x555555c80850) at ../talloc.c:1593 #11 _tc_free_internal (location=0x5555555b02ea "src/main/process.c:604", tc=0x555555c80850) at ../talloc.c:1104 #12 _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c80690, tc=0x555555c80630) at ../talloc.c:1593 #13 _tc_free_internal (tc=0x555555c80630, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1104 #14 0x000055555558bae7 in request_done (request=request@entry=0x555555c808b0, action=<optimized out>, action@entry=2) at src/main/process.c:899 #15 0x000055555558e14d in request_cleanup_delay (request=0x555555c808b0, action=<optimized out>) at src/main/process.c:1212 #16 0x00007ffff79928d4 in fr_event_run (el=el@entry=0x555555bd60b0, when=when@entry=0x7fffffffe350) at src/lib/event.c:309 #17 0x00007ffff7992ec9 in fr_event_loop (el=0x555555bd60b0) at src/lib/event.c:632 #18 0x0000555555569f06 in main (argc=<optimized out>, argv=<optimized out>) at src/main/radiusd.c:611 The crash occures always within a few hours, sometimes soon after startup. Version 2.x with a similar setup runs stable. I didn't provide the output of -X because it contains sensible data, but I could provide cleaned logs and configs, if needed. Thanks and greetings, Daniel

4 15

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

Failed oracle db connection kills the freeradius service
by R3DNano 09 Jul '19

09 Jul '19

Some of my auth sources are oracle databases via linux odbc. At some point, those databases might become unreachable for some external reason, freeradius then enters and stays in a failed state, trying to stablish the connection. Is there a way to just reject the authentication if the source is unavailable and prevent the server failure? Is this working as intended?

3 6

MS-CHAPv2 not working
by Matthew McTague 04 Jun '19

04 Jun '19

Hi, Does anyone know why MS-CHAPv2 may not be working on a new FreeRADIUS implementation we've built? I'm trying to do MS-CHAPv2 with a SQL database, not with LDAP. The issue only occurs when a realm is added to the username (on the RADIUS client). As I understand, as nostrip is not entered in the relevant realm block in /etc/raddb/proxy.conf, this should be stripped. radiusd -X output is at https://pastebin.com/kK9JYsF0 Information and passwords have been changed / sanitized. If I've missed any required information, please tell me, and I will respond accordingly. Warm Regards, Matthew McTague Head of Infrastructure, Reliance Networks d. +64 3 222 6013 t. 0800 483 882 (+64 3 683 9090) Website | Service Desk | Internet Services Reliance Networks Ltd accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company.

3 8

Radacct Reused ?
by Oscar 09 May '19

09 May '19

Hi, I've created a Trigger to save on a new table the las time a user has been stop connection (acctstoptime). So I've createad table and created this trigger: create TRIGGER UpdateStopTime AFTER UPDATE ON radacct FOR EACH ROW BEGIN INSERT into usuario_instalacion_stoptime ( select u.department as user,u.company as insta,if(r.acctstoptime is null,now(),r.acctstoptime) stoptime from radacct r,userinfo u where r.username=u.username and r.radacctid=NEW.radacctid ) ON DUPLICATE KEY UPDATE stoptime=if(NEW.acctstoptime is null,now(),NEW.acctstoptime) ; END$$ But now I'm facing that sems that radius rows from the past are beeign used on the present I mean, my radacctid is now arround 37.000.000 And I can see a user autheticated and updating a really old row: accstoptime=09-2018 and beeing update today with accstarttime=04-2019 How is that possible ? Is it correct ? Thanks,

3 20

Extra column in radpostauth
by Sudheer S 07 May '19

07 May '19

Hello, It would be nice to have an extra column in the |radpostauth |table to store the reasons for Access-Reject. I came across this article, <https://www.dlineradio.co.uk/articles/logging-failure-reasons-in-freeradius/>. The article suggests adding a column to the radpostauth table. I also remembered, Alan DeKok mentioned in one of the earlier threads that using standard tables for custom things is not preferred. Would you consider the extra column in the radpostauth table an exception to the rule of thumb? Or would you recommend using a custom table for this purpose? - Sudheer S ||

2 3

Bootstrap overwrite my certs
by Rafael Leiva-Ochoa 30 Apr '19

30 Apr '19

Hi Everyone, I recently upgraded to 3.0.19-1 and I noticed after I restarted the service I was getting the following errors: Apr 29 22:01:29 freeradius systemd[1]: Starting FreeRADIUS high performance RADIUS server.... Apr 29 22:01:30 freeradius sh[1970]: make: *** No rule to make target 'server.cnf', needed by 'passwords.mk'. Stop. Apr 29 22:01:30 freeradius systemd[1]: radiusd.service: Control process exited, code=exited status=2 Apr 29 22:01:30 freeradius systemd[1]: radiusd.service: Failed with result 'exit-code'. Apr 29 22:01:30 freeradius systemd[1]: Failed to start FreeRADIUS high performance RADIUS server.. Apr 29 22:01:30 freeradius audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=radiusd comm="systemd " exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' After a lot of digging, I found that a "bootstrap" script on the /etc/raddb/certs/ directory was being called on the /usr/lib/systemd/system/radiusd.service. This script overwrote my current certificate files. I had to comment out the ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap to fix the problem. I am not sure if anyone else encountered this problem before. Is this being addressed on future releases? Thanks, Rafael

2 4

freeradius monitoring
by Satish Patel 30 Apr '19

30 Apr '19

Folks, I am reading this page https://wiki.freeradius.org/config/Status and trying to configure freeradius monitoring, seems like i am missing something. somehow i don't have /etc/raddb/mods-available/status file because i have install freeradius using yum install finally after google i found sample status file and i put that in mods-enabled directory and now i am getting this error Failed to link to module 'rlm_server': /usr/lib64/freeradius/rlm_server.so: cannot open shared object file: No such file or directory Now my question is by default radiusd.conf has status_server = yes so any client can query so i have try following and i got this reply. [root@radius]# echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 1, Response-Packet-Type = Access-Accept" | radclient -x localhost:1812 status testing123 Sent Status-Server Id 62 from 0.0.0.0:57892 to 127.0.0.1:18120 length 50 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = Authentication Response-Packet-Type = Access-Accept Received Access-Accept Id 62 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 getting no other data back from radius

3 5

Re: SQL not a variable
by Nicolas Breuer 30 Apr '19

30 Apr '19

Hello, It's not working... allocate-find = "SELECT ip_address FROM radippool WHERE (pool_name like '%{reply:Pool-Suffix}*%%' and pool_name not like '%%STATx%%') AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE" [IP-POOLING-01] expand: SELECT ip_address FROM radippool WHERE (pool_name like '%{reply:Pool-Suffix}*%' and pool_name not like '%STATx%') AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE -> SELECT ip_address FROM radippool WHERE (pool_name like 'BC*%' and pool_name not like '2019-04-30 17:55:08TATx%') AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE What I'm doing wrong?

2 1