May 2019 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Freeradius crashes with SIGABRT
by Daniel Feuchtinger 04 Dec '19

04 Dec '19

Hi, our radius proxy crashes regularily since we switched from version 2 to 3. First we ran freeradius version 3.0.15 (package from Suse Linux Enterprise 12.4), then version 3.0.17 and 3.0.18 (compiled with rpmbuild) with no difference. Our present configuration is like this: radius@radius-dev1:~> uname -a Linux radius-dev1 4.12.14-95.6-default #1 SMP Thu Jan 17 06:04:39 UTC 2019 (6af4ef8) x86_64 x86_64 x86_64 GNU/Linux radius@radius-dev1:~> /usr/sbin/radiusd -v radiusd: FreeRADIUS Version 3.0.18, for host x86_64-suse-linux-gnu, built on Mar 4 2019 at 00:00 FreeRADIUS Version 3.0.18 I run the radius-daemon inside of gdb with dumps enabled: Starting program: /usr/sbin/radiusd -f -d /etc/raddb ... *** Error in `/usr/sbin/radiusd': double free or corruption (fasttop): 0x00007fffe8009b40 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7411f)[0x7ffff60ba11f] /lib64/libc.so.6(+0x79596)[0x7ffff60bf596] /lib64/libc.so.6(+0x7a3db)[0x7ffff60c03db] /usr/lib64/libtalloc.so.2(+0x300d)[0x7ffff6e7a00d] /usr/lib64/libtalloc.so.2(+0x2d87)[0x7ffff6e79d87] /usr/lib64/libtalloc.so.2(+0x2d87)[0x7ffff6e79d87] /usr/sbin/radiusd(+0x37ae7)[0x55555558bae7] /usr/sbin/radiusd(+0x3a14d)[0x55555558e14d] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_run+0x74)[0x7ffff79928d4] /usr/lib64/freeradius/libfreeradius-radius.so(fr_event_loop+0x2c9)[0x7ffff7992ec9] /usr/sbin/radiusd(main+0x706)[0x555555569f06] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7ffff6066725] /usr/sbin/radiusd(_start+0x29)[0x55555556a239] Thread 1 "radiusd" received signal SIGABRT, Aborted. 0x00007ffff607af97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 55 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) (gdb) bt #0 0x00007ffff607af97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007ffff607c36a in __GI_abort () at abort.c:78 #2 0x00007ffff60ba124 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff61b3f48 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007ffff60bf596 in malloc_printerr (action=3, str=0x7ffff61b40a0 "double free or corruption (fasttop)", ptr=<optimized out>, ar_ptr=<optimized out>) at malloc.c:5018 #4 0x00007ffff60c03db in _int_free (av=0x7fffe8000020, p=<optimized out>, have_lock=0) at malloc.c:3872 #5 0x00007ffff6e7a00d in _tc_free_internal (tc=0x7fffe8009b40, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1148 #6 0x00007ffff6e79d87 in _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x7fffe801cb80, tc=0x7fffe801cb20) at ../talloc.c:1593 #7 _tc_free_internal (location=0x5555555b02ea "src/main/process.c:604", tc=0x7fffe801cb20) at ../talloc.c:1104 #8 _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c80a60, tc=0x555555c80a00) at ../talloc.c:1593 #9 _tc_free_internal (tc=0x555555c80a00, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1104 #10 0x00007ffff6e79d87 in _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c808b0, tc=0x555555c80850) at ../talloc.c:1593 #11 _tc_free_internal (location=0x5555555b02ea "src/main/process.c:604", tc=0x555555c80850) at ../talloc.c:1104 #12 _tc_free_children_internal (location=0x5555555b02ea "src/main/process.c:604", ptr=0x555555c80690, tc=0x555555c80630) at ../talloc.c:1593 #13 _tc_free_internal (tc=0x555555c80630, location=0x5555555b02ea "src/main/process.c:604") at ../talloc.c:1104 #14 0x000055555558bae7 in request_done (request=request@entry=0x555555c808b0, action=<optimized out>, action@entry=2) at src/main/process.c:899 #15 0x000055555558e14d in request_cleanup_delay (request=0x555555c808b0, action=<optimized out>) at src/main/process.c:1212 #16 0x00007ffff79928d4 in fr_event_run (el=el@entry=0x555555bd60b0, when=when@entry=0x7fffffffe350) at src/lib/event.c:309 #17 0x00007ffff7992ec9 in fr_event_loop (el=0x555555bd60b0) at src/lib/event.c:632 #18 0x0000555555569f06 in main (argc=<optimized out>, argv=<optimized out>) at src/main/radiusd.c:611 The crash occures always within a few hours, sometimes soon after startup. Version 2.x with a similar setup runs stable. I didn't provide the output of -X because it contains sensible data, but I could provide cleaned logs and configs, if needed. Thanks and greetings, Daniel

4 15

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

Failed oracle db connection kills the freeradius service
by R3DNano 09 Jul '19

09 Jul '19

Some of my auth sources are oracle databases via linux odbc. At some point, those databases might become unreachable for some external reason, freeradius then enters and stays in a failed state, trying to stablish the connection. Is there a way to just reject the authentication if the source is unavailable and prevent the server failure? Is this working as intended?

3 6

MS-CHAPv2 not working
by Matthew McTague 04 Jun '19

04 Jun '19

Hi, Does anyone know why MS-CHAPv2 may not be working on a new FreeRADIUS implementation we've built? I'm trying to do MS-CHAPv2 with a SQL database, not with LDAP. The issue only occurs when a realm is added to the username (on the RADIUS client). As I understand, as nostrip is not entered in the relevant realm block in /etc/raddb/proxy.conf, this should be stripped. radiusd -X output is at https://pastebin.com/kK9JYsF0 Information and passwords have been changed / sanitized. If I've missed any required information, please tell me, and I will respond accordingly. Warm Regards, Matthew McTague Head of Infrastructure, Reliance Networks d. +64 3 222 6013 t. 0800 483 882 (+64 3 683 9090) Website | Service Desk | Internet Services Reliance Networks Ltd accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company.

3 8

Using something other than MD5 in 3.0.19 - FIPS
by Paul Pathiakis 04 Jun '19

04 Jun '19

Hi, For the next issue.... I have to use CentOS in FIPS mode which disallows MD5 use. What do I need to change to either encapsulate it in TLS on the client and server or what should I do to change the configuration to not advertise to CentOS 7 in FIPS mode that MD5 is being used? My understanding is that RADIUS uses MD5 by specification. FIPS mode disallows MD5 usage as being too weak. radiusd -X is up and ready for connections but the basic radtest with user bob generates an MD5 usage error stating that MD5 utlization is not allowed in FIPS mode.

5 8

Trying to use sql module
by Matthew McTague 01 Jun '19

01 Jun '19

Hi, When I soft link raddb/mods-available/sql to raddb/mods-enabled/sql, and comment out $INCLUDE mods-enabled/sql in raddb/radiusd.conf, I get the below debug output, ending in a segmentation fault. The only other changes I have made since compiling were to set the dialect and database connection details in raddb/mods-available/sql. I've read each file that I've modified, and I'm unsure what is causing this issue. I'm using git to manage my changes, so can go back to the very beginning easily if I need to. Debug output: Info : FreeRADIUS Version 4.0.0 Info : Copyright 1999-2019 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/freeradius/raddb/dictionary" Debug : including configuration file /etc/freeradius/raddb/radiusd.conf Debug : including configuration file /etc/freeradius/raddb/clients.conf Debug : including configuration file /etc/freeradius/raddb/mods-enabled/sql Debug : including configuration file /etc/freeradius/raddb/mods-config/sql/driver/mysql Debug : including configuration file /etc/freeradius/raddb/mods-config/sql/main/mysql/queries.conf Debug : Including files in directory "/etc/freeradius/raddb/mods-enabled/" Debug : including configuration file /etc/freeradius/raddb/mods-enabled/always Debug : including configuration file /etc/freeradius/raddb/mods-enabled/attr_filter Debug : including configuration file /etc/freeradius/raddb/mods-enabled/cache_eap Debug : including configuration file /etc/freeradius/raddb/mods-enabled/chap Debug : including configuration file /etc/freeradius/raddb/mods-enabled/client Debug : including configuration file /etc/freeradius/raddb/mods-enabled/delay Debug : including configuration file /etc/freeradius/raddb/mods-enabled/detail Debug : including configuration file /etc/freeradius/raddb/mods-enabled/detail.log Debug : including configuration file /etc/freeradius/raddb/mods-enabled/digest Debug : including configuration file /etc/freeradius/raddb/mods-enabled/dhcpv4 Debug : including configuration file /etc/freeradius/raddb/mods-enabled/echo Debug : including configuration file /etc/freeradius/raddb/mods-enabled/escape Debug : including configuration file /etc/freeradius/raddb/mods-enabled/exec Debug : including configuration file /etc/freeradius/raddb/mods-enabled/expiration Debug : including configuration file /etc/freeradius/raddb/mods-enabled/expr Debug : including configuration file /etc/freeradius/raddb/mods-enabled/files Debug : including configuration file /etc/freeradius/raddb/mods-enabled/linelog Debug : including configuration file /etc/freeradius/raddb/mods-enabled/logintime Debug : including configuration file /etc/freeradius/raddb/mods-enabled/mschap Debug : including configuration file /etc/freeradius/raddb/mods-enabled/ntlm_auth Debug : including configuration file /etc/freeradius/raddb/mods-enabled/pap Debug : including configuration file /etc/freeradius/raddb/mods-enabled/passwd Debug : including configuration file /etc/freeradius/raddb/mods-enabled/radius Debug : including configuration file /etc/freeradius/raddb/mods-enabled/radutmp Debug : including configuration file /etc/freeradius/raddb/mods-enabled/soh Debug : including configuration file /etc/freeradius/raddb/mods-enabled/sradutmp Debug : including configuration file /etc/freeradius/raddb/mods-enabled/stats Debug : including configuration file /etc/freeradius/raddb/mods-enabled/unix Debug : including configuration file /etc/freeradius/raddb/mods-enabled/unpack Debug : including configuration file /etc/freeradius/raddb/mods-enabled/utf8 CAUGHT SIGNAL: Segmentation fault Backtrace of last 12 frames: /usr/local/lib/libfreeradius-util.so(fr_fault+0xe8)[0x7fe35056e6ec] /lib64/libpthread.so.0(+0xf5d0)[0x7fe34edc25d0] /lib64/libc.so.6(fgets+0x1b)[0x7fe34ea5483b] /usr/local/lib/libfreeradius-server.so(+0x15990)[0x7fe350c40990] /usr/local/lib/libfreeradius-server.so(+0x18216)[0x7fe350c43216] /usr/local/lib/libfreeradius-server.so(+0x165dc)[0x7fe350c415dc] /usr/local/lib/libfreeradius-server.so(+0x18216)[0x7fe350c43216] /usr/local/lib/libfreeradius-server.so(cf_file_read+0x23d)[0x7fe350c434b0] /usr/local/lib/libfreeradius-server.so(main_config_init+0x42c)[0x7fe350c62c8d] radiusd(main+0x95f)[0x404982] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7fe34ea083d5] radiusd[0x403e09] No panic action set _EXIT(139) CALLED src/lib/util/debug.c[921]. Last error was: Not built with support for LSAN interface Warm Regards, Matthew McTague Head of Infrastructure, Reliance Networks d. +64 3 222 6013 t. 0800 483 882 (+64 3 683 9090) Website | Service Desk | Internet Services Reliance Networks Ltd accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company.

2 3

Importing the GPG keys
by Paul Pathiakis 31 May '19

31 May '19

Hi, I was looking at the CentOS packages here: FreeRADIUS Packages - Network RADIUS | | | | | | | | | | | FreeRADIUS Packages - Network RADIUS | | | In the middle of the CentOS section, it says: gpg --keyserver keys.gnupg.net --recv-key 0x41382202 gpg --armor --export packages(a)networkradius.com > /etc/pki/rpm-gpg/packages.networkradius.com.gpg The first one fails with an error. Keyserver timed outKeyserver error Does anyone else have this problem? Is there a workaround? Thank you! P.

2 4

Freeradius Packages
by Nicolas Breuer 30 May '19

30 May '19

Hello, Is there a way to change the link to a more recent mysql client library ? The linked library is the compat mysql lib. [root@ns1 freeradius]# ldd rlm_sql_mysql.so linux-vdso.so.1 => (0x00007ffe659bb000) libmysqlclient_r.so.16 => /usr/lib64/mysql/libmysqlclient_r.so.16 (0x00007efed1200000) libz.so.1 => /lib64/libz.so.1 (0x00007efed0fea000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007efed0dcc000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007efed0b95000) libnsl.so.1 => /lib64/libnsl.so.1 (0x00007efed097c000) libm.so.6 => /lib64/libm.so.6 (0x00007efed06f7000) libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007efed048b000) libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007efed00a6000) libc.so.6 => /lib64/libc.so.6 (0x00007efecfd11000) /lib/ld-linux.so.2 (0x000055a5f8a11000) libfreebl3.so => /lib64/libfreebl3.so (0x00007efecfb0e000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007efecf8ca000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007efecf5e2000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007efecf3de000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007efecf1b2000) libdl.so.2 => /lib64/libdl.so.2 (0x00007efecefad000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007efeceda2000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007efeceb9f000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007efece984000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007efece765000) Thanks

2 1

FR and accounting question
by dg 30 May '19

30 May '19

Hello i have question about accounting in freeradius (3.0.18) i notced in sql table radacct that from time to time i have as a "username" host/DELL-LAPBD5 logged. so in file /etc/raddb/policy.d/filter i put if (User-Name =~ /^host/) { update request { Module-Failure-Message += 'Rejected: banned host' } reject } not i have "Access-Reject" and username starting with "host" are denied. But anyway when i check accouting host/DELL-LAPBD5 still is appears (with some data downloaded). How it this possible that username is Rejected but can download data from network (browsing websites etc.. ) and appears in accounting ?? I thought that if someone is Rejected should not be able to download data from internet. best regards

2 1