May 2023 - Freeradius-Users - lists.freeradius.org

Version 3.2.3 has been released
by Matthew Newton 28 May '23

28 May '23

We have released version 3.2.3. This is the latest stable v3 "feature" release. There are a number of features and bug fixes included in this version. Notably: - A notable bug occasionally causing connections to stall when using RADSEC has been fixed. - rlm_ldap and rlm_sql now have a "max_retries" option to limit the number of connection retries due to failure. - Several locking issues and small memory leaks fixed. - A number of dictionary updates, as usual. as well as several other fixes and updates as shown in the ChangeLog. Of importance please note: - Python users Debian/Ubuntu packages now have "freeradius-python2" and "freeradius-python3" packages. Previously the python module was included in the main "freeradius" package. If you are upgrading using the Network RADIUS packages and use python, please make sure you now also install the correct python package for your system. The "freeradius" package recommends both new python packages which will hopefully pull them in on upgrade, but you should check to be certain. Previously the python package built depended on the which version of python was available by default on the OS, which was e.g. python3 on Ubuntu22, but python2 on Debian11 - both options are now available. - Checkrad If anyone is still using the "checkrad" script, it is now passed NAS-Port-Id when called from SQL simultaneous use, rather than "NAS-Port". This fixes the script (the SQL queries always used NAS-Port-Id), but may break installations where the an invalid value such as 0 was previously passed, and is now the correct string. Download from all the usual places: https://freeradius.org/releases/ https://freeradius.org/ftp/pub/freeradius/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_3 Packages are available from Network RADIUS: https://packages.networkradius.com/ (Note that packages are no longer built for Debian 9 Stretch as it is EoL.) Docker images are available on Dockerhub: https://hub.docker.com/r/freeradius/freeradius-server -- Matthew

3 2

Debug logs kill radiusd on AlmaLinux 9.2 with SIGSEGV
by Gerald Vogt 26 May '23

26 May '23

Hi! I am in the process of setting up freeradius-3.0.21-37.el9.x86_64 on a new AlmaLinux 9.2 server to migrate from our old centos 7 servers. I have noticed that the server crashes with a segmentation fault if I enable debug logs (e.g. radiusd -X or with raddebug) and run a test with EAP-TLS. The test works fine and succeeds without debug logging. So it's something which only happens during debug logging. gdb backtrace from the core dump is #0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74 #1 0x00007ff611284268 in __vfprintf_internal (s=s@entry=0x7ffcc44437e0, format=format@entry=0x564c843544b8 "(TLS) Creating attributes from %s certificate", ap=ap@entry=0x7ffcc44439c0, mode_flags=mode_flags@entry=2) at vfprintf-internal.c:1647 #2 0x00007ff61129487a in __vsnprintf_internal (string=0x7ffcc4443a20 "(TLS) Creating attributes from ServerHelloDone\"\n", maxlen=<optimized out>, format=0x564c843544b8 "(TLS) Creating attributes from %s certificate", args=0x7ffcc44439c0, mode_flags=2) at vsnprintf.c:114 #3 0x00007ff611bec5dc in vsnprintf (__ap=0x7ffcc44439c0, __fmt=0x564c843544b8 "(TLS) Creating attributes from %s certificate", __n=10240, __s=0x7ffcc4443a20 "(TLS) Creating attributes from ServerHelloDone\"\n") at /usr/include/bits/stdio2.h:68 #4 vradlog_request (type=L_DBG, lvl=<optimized out>, request=0x564c85de2a30, msg=0x564c843544b8 "(TLS) Creating attributes from %s certificate", ap=0x7ffcc4446270) at src/main/log.c:695 #5 0x00007ff611bec801 in radlog_request (type=<optimized out>, lvl=<optimized out>, request=<optimized out>, msg=<optimized out>) at src/main/log.c:787 #6 0x0000564c8433b992 in ?? () #7 0x0000564c85c96368 in ?? () #8 0x0000564c85bf5aa0 in ?? () #9 0x3232363000000001 in ?? () #10 0x0000564c85c962d0 in ?? () #11 0x0000000000000003 in ?? () #12 0x3461626338663361 in ?? () #13 0x0000564c85d87380 in ?? () #14 0x0000564c85c96328 in ?? () #15 0x3039363639633635 in ?? () #16 0x6566323131383235 in ?? () #17 0x3563666364323264 in ?? () #18 0x0000000000000000 in ?? () It happens during handshake: (11) Auth-Type eap { (11) eap: Expiring EAP session with state 0x923d2dbc9836205f (11) eap: Finished EAP session with state 0x923d2dbc9836205f (11) eap: Previous EAP request found for state 0x923d2dbc9836205f, released from the list (11) eap: Peer sent packet with method EAP TLS (13) (11) eap: Calling submodule eap_tls to process data (11) eap_tls: (TLS) EAP Got final fragment (24 bytes) (11) eap_tls: (TLS) EAP Done initial handshake (11) eap_tls: (TLS) Handshake state - Server SSLv3/TLS write server done (11) eap_tls: (TLS) recv TLS 1.2 Handshake, Certificate Segmentation fault (core dumped) Tested with two different client certificates... Regards, Gerald

3 5

Need help on eap-cache
by deepika parmar 22 May '23

22 May '23

Hello, I have configured *EAP-AKA virtual-server in FreeRADIUS to perform authentication. I have enabled eap cache so that fast reauth will work and session data will be stored in cache. However during store session even if session data is there in session state, in cache while storing session data its null. Logs are like: Debug : (0.0) h9-auth-server - store session { Debug : (0.0) h9-auth-server - | debug_attr INFO : (0.0) h9-auth-server - Attributes matching "&session-state" INFO : (0.0) h9-auth-server - &session-State.session-State = { INFO : (0.0) h9-auth-server - Permanent-Identity = 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org INFO : (0.0) h9-auth-server - SIM-Ki = 0x465b5ce8b199b49faa5f0a2ee238a6bc INFO : (0.0) h9-auth-server - SIM-OPc = 0xcd63cb71954a9f4e48a5994e37a02baf INFO : (0.0) h9-auth-server - SIM-SQN = 640 INFO : (0.0) h9-auth-server - Identity = 2TGUFSvpAG13Ugm INFO : (0.0) h9-auth-server - Session-Data = 0x2d9b493ceda56d4b440d6a6b011c06b2f54ffd51 >>>>>>>>>>>>>>>>>>>>>>>>>>>> Session data is present INFO : (0.0) h9-auth-server - Counter = 0 INFO : (0.0) h9-auth-server - } Debug : (0.0) h9-auth-server - | %(debug_attr:{&session-state}) Debug : (0.0) h9-auth-server - | --> (null) Debug : (0.0) h9-auth-server - &session-state.SIM-Ki := 0x2d9b493ceda56d4b440d6a6b011c06b2f54ffd51 Debug : (0.0) eap_aka_cache - | eap-aka-sim.Session-ID Debug : (0.0) eap_aka_cache - | %{eap-aka-sim.Session-ID} Debug : (0.0) eap_aka_cache - | --> 0x345043774142776875516d30353132 Debug : (0.0) eap_aka_cache - --> 0x345043774142776875516d30353132 Debug : (0.0) eap_aka_cache - No cache entry found for "0x345043774142776875516d30353132" Debug : (0.0) eap_aka_cache - Creating new cache entry Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | session-state.Permanent-Identity Debug : (0.0) eap_aka_cache - | %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | --> 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - --> 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - &session-State[0].Permanent-Identity := "10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org" Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Session-Data} >>>>>>>>> Session data not available Debug : (0.0) eap_aka_cache - | session-state.Session-Data Debug : (0.0) eap_aka_cache - | %{session-state.Session-Data} Debug : (0.0) eap_aka_cache - | --> Debug : (0.0) eap_aka_cache - --> Debug : (0.0) eap_aka_cache - &session-State[0].Session-Data := 0x Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Encr-Data.Counter} Debug : (0.0) eap_aka_cache - | session-state.Encr-Data.Counter Debug : (0.0) eap_aka_cache - | %{session-state.Encr-Data.Counter} Store session setting in virtual server: store session { "%(debug_attr:&session-state)" eap_aka_cache "%(debug_attr:&session-state)" ok } Eap cache: cache eap_aka_cache { # # key:: Cache key. # key = "%{eap-aka-sim.Session-ID}" # # ttl:: TTL for cache entries. # ttl = 150 # # update <section> { ... }:: # update session-state { &Permanent-Identity := "%{session-state.Permanent-Identity}" &Session-Data := "%{session-state.Session-Data}" &Encr-Data.Counter := "%{session-state.Encr-Data.Counter}" } } Can anyone help? Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Thanks, Deepika

2 1

cacheable groups for ldap
by dextá 22 May '23

22 May '23

Hello, Is there any limit on how many groups can be cached via ldap module? I ask because I have some users who have 80 groups in their profile. This is because we use AD + Moodle to manage the courses. This particular user is unable to connect to the Wi-Fi. I suspect that the reason might be having too many groups in their profile. ldap module ---------------- ldap haproxy-dc { server = 172.16.7.230 port = 389 identity = 'CN=Administrator,CN=Users,dc=mydc,dc=net' password = ****** base_dn = 'dc=mydc,dc=net' group_dn = 'OU=GRUPOS,dc=mydc,dc=net' user { base_dn = "OU=USUARIOS,${..base_dn}" filter = "(samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' access_positive = yes } group { base_dn = "OU=GRUPOS,${..base_dn}" filter = "(objectClass=group)" scope = 'base' name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = 'memberOf' cacheable_name = 'no' cacheable_dn = 'yes' cache_attribute = 'LDAP-Group' } options { chase_referrals = yes rebind = yes res_timeout = 20 srv_timelimit = 20 net_timeout = 10 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } freeradius version: 3.2

3 3

rlm_cache_redis driver
by dextá 21 May '23

21 May '23

hi, I have installed freeradius via packages.networkradius.com. At first I thought the "freeradius-redis" package would include the rlm_cache_redis driver, but it doesn't. I get the output below: rlm_ldap (dc4): Bind successful # Instantiating module "redis" from file /etc/freeradius/mods-enabled/redis rlm_redis (redis): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 2 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_redis (redis): Opening additional connection (0), 1 of 10 pending slots used rlm_redis (redis): Opening additional connection (1), 1 of 9 pending slots used rlm_redis (redis): Opening additional connection (2), 1 of 8 pending slots used rlm_redis (redis): Opening additional connection (3), 1 of 7 pending slots used rlm_redis (redis): Opening additional connection (4), 1 of 6 pending slots used # Instantiating module "cache" from file /etc/freeradius/mods-enabled/cache /etc/freeradius/mods-enabled/cache[23]: Could not link driver rlm_cache_redis: (null) /etc/freeradius/mods-enabled/cache[23]: Make sure it (and all its dependent libraries!) are in the search path of your system's ld /etc/freeradius/mods-enabled/cache[23]: Instantiation failed for module "cache" In the path /usr/lib/freeradius there is no rlm_cache_redis.so root@freeradiusv3dev:/usr/lib/freeradius# ls rlm_cache rlm_cache.so rlm_cache_rbtree.so root@freeradiusv3dev:/usr/lib/freeradius# ls rlm_cache Checking the output of ldconfig -v I also found nothing about rlm_cache_redis. Which package includes the rlm_cache_redis driver? Or do I need to compile this driver?

2 4

Access-challenge with new line
by Mesut GULNAZ 20 May '23

20 May '23

How can I reply access-challenge with new line to achieve something like this below? -- İyi çalışmalar... Mesut GÜLNAZ

2 1

Re: Getting Freeradius working with LLDAP
by Matthew Macdonald-Wallace 17 May '23

17 May '23

On May 17, 2023, freeradius-users-request(a)lists.freeradius.org wrote: Message: 3 Date: Wed, 17 May 2023 07:20:27 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Getting Freeradius working with LLDAP Message-ID: <EFC4B512-AB04-4A03-A59A-F1503D781E60(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii >> My LDAP server is https://github.com/lldap/lldap and that *does not* >> expose a "plain text password" field. > Then you need to set "Auth-Type = LDAP". See the comments in sites- available/default. Done this and it's working, thanks.

1 0

Getting Freeradius working with LLDAP
by Matthew Macdonald-Wallace 17 May '23

17 May '23

Hi all, I'm new to Freeradius but want to get it working for our local hack/makerspace to ensure we can provide decent QoS on the WiFi for our members. My LDAP server is https://github.com/lldap/lldap and that *does not* expose a "plain text password" field. I am running Freeradius via docker and I've uploaded my config at https://gist.github.com/proffalken/a6213dc7266a6a9800432b3c0e1b264d (passwords and domains have been changed to protect the innocent!) As you can see from the log below, the LDAP lookup works, however the authentication request is rejected because the "Auth-Type" is not found. I'm sure this is an obvious fix, but I've not been able to find an answer in my searching! I'm using the following command to test: radtest mmw pass1234 10.x.x.5 0 testing123 and this is the log: -=-=-=-=-=-=-=-=-=-= freeradius_1 | rlm_ldap (ldap): Reserved connection (0) freeradius_1 | (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User- Name}}) freeradius_1 | (0) ldap: --> (uid=mmw) freeradius_1 | (0) ldap: Performing search in "ou=people,dc=auth,dc=mydomain,dc=co,dc=uk" with filter "(uid=mmw)", scope "sub" freeradius_1 | (0) ldap: Waiting for search result... freeradius_1 | (0) ldap: User object found at DN "uid=mmw,ou=people,dc=auth,dc=mydomain,dc=co,dc=uk" freeradius_1 | (0) ldap: Processing user attributes freeradius_1 | (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute freeradius_1 | (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) freeradius_1 | rlm_ldap (ldap): Released connection (0) freeradius_1 | (0) [ldap] = ok freeradius_1 | (0) [expiration] = noop freeradius_1 | (0) [logintime] = noop freeradius_1 | (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type freeradius_1 | (0) pap: WARNING: Authentication will fail unless a "known good" password is available freeradius_1 | (0) [pap] = noop freeradius_1 | (0) } # authorize = ok freeradius_1 | (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject freeradius_1 | (0) Failed to authenticate the user freeradius_1 | (0) Using Post-Auth-Type Reject freeradius_1 | (0) # Executing group from file /opt/etc/raddb/sites- enabled/default freeradius_1 | (0) Post-Auth-Type REJECT { freeradius_1 | (0) attr_filter.access_reject: EXPAND %{User-Name} freeradius_1 | (0) attr_filter.access_reject: --> mmw freeradius_1 | (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 freeradius_1 | (0) [attr_filter.access_reject] = updated freeradius_1 | (0) [eap] = noop freeradius_1 | (0) policy remove_reply_message_if_eap { freeradius_1 | (0) if (&reply:EAP-Message && &reply:Reply- Message) { freeradius_1 | (0) if (&reply:EAP-Message && &reply:Reply- Message) -> FALSE freeradius_1 | (0) else { freeradius_1 | (0) [noop] = noop freeradius_1 | (0) } # else = noop freeradius_1 | (0) } # policy remove_reply_message_if_eap = noop freeradius_1 | (0) } # Post-Auth-Type REJECT = updated -=-=-=-=-=-=-=-=-=-=- Thanks in advance! Matt

2 1

The problem when I run freeRadius server 4.0 in master: Failed adding new socket to network event loop: Failed inserting filters for FD 15: EFAULT: Bad address with libkqueue v2.6.1-28
by Baudouin MESMIN DES VAUX 16 May '23

16 May '23

Hi guys, I try to run freeradius V4.0 for tacas+. I clone the master and do, without issue, the ./configure, make and make install. I’m on Ubuntu 2304 up-to-date with libkqueue v2.6.1-28. When I do the radius -X, I got this error : #### Opening listener interfaces #### Network - Failed adding new socket to network event loop: Failed inserting filters for FD 17: EFAULT: Bad address /usr/local/etc/raddb/sites-enabled/default[209]: Opening radius I/O interface failed I checked the config files, but cannot find the cause. Could anyone help to tell me how to do, thank you very much. Thks, Baudouin The complete log radiusd -X: IInfo : Copyright 1999-2022 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/usr/local/etc/raddb/dictionary" gctx 0x55be4a150e40 report internal refs src/lib/server/main_config.c (1) internal refs src/lib/server/request.c (1) internal refs src/lib/tls/base.c (1) including configuration file /usr/local/etc/raddb/radiusd.conf Including files in directory "/usr/local/etc/raddb/template.d/" including configuration file /usr/local/etc/raddb/template.d/default including configuration file /usr/local/etc/raddb/clients.conf Including files in directory "/usr/local/etc/raddb/global.d/" including configuration file /usr/local/etc/raddb/global.d/ldap Including files in directory "/usr/local/etc/raddb/mods-enabled/" including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/client including configuration file /usr/local/etc/raddb/mods-enabled/delay including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/eap_inner including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/escape including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/stats including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/utf8 Including files in directory "/usr/local/etc/raddb/policy.d/" including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/canonicalisation including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/tacacs including configuration file /usr/local/etc/raddb/policy.d/time including configuration file /usr/local/etc/raddb/policy.d/vendor Including files in directory "/usr/local/etc/raddb/sites-enabled/" including configuration file /usr/local/etc/raddb/sites-enabled/default Loaded module process_radius including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Parsing security rules to bootstrap UID / GID / chroot / etc. main { prefix = \/usr\/local security { allow_core_dumps = no allow_vulnerable_openssl = no openssl_fips_mode = no } name = radiusd local_state_dir = "/usr/local/var" run_dir = \/usr\/local\/var\/run\/radiusd } Parsing main configuration main { server default { namespace = radius radius { Access-Request { log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } session { timeout = 15 max = 4096 } } } Loaded module proto_radius listen { type = Access-Request type = Status-Server transport = udp Loaded module proto_radius_udp udp { ipv4addr = 10.0.100.11 port = 1812 networks { allow = 127/8 allow = 46.192.0.0/15 } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 60.0 nak_lifetime = 30.0 max_connections = 256 max_clients = 256 max_pending_packets = 256 } priority { Access-Request = high Accounting-Request = low CoA-Request = normal Disconnect-Request = low Status-Server = now } } listen tcp_auth { type = Access-Request type = Status-Server transport = tcp Loaded module proto_radius_tcp tcp { ipaddr = * port = 1812 networks { allow = 127/8 allow = 192.0.2/24 } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 } priority { Access-Request = high Accounting-Request = low CoA-Request = normal Disconnect-Request = low Status-Server = now } } listen udp_acct { type = Accounting-Request transport = udp udp { ipaddr = * port = 1813 networks { } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 } priority { Access-Request = high Accounting-Request = low CoA-Request = normal Disconnect-Request = low Status-Server = now } } } server inner-tunnel { namespace = radius radius { Access-Request { log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } session { timeout = 15 max = 4096 } } } listen { type = Access-Request transport = udp udp { ipaddr = 127.0.0.1 port = 18120 networks { } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 } priority { Access-Request = high Accounting-Request = low CoA-Request = normal Disconnect-Request = low Status-Server = now } } } security { } sbin_dir = "/usr/local/sbin" logdir = \/usr\/local\/var\/log\/radius radacctdir = \/usr\/local\/var\/log\/radius\/radacct reverse_lookups = no hostname_lookups = yes max_request_time = 30 pidfile = \/usr\/local\/var\/run\/radiusd\/radiusd.pid debug_level = 0 max_requests = 16384 log { colourise = yes } resources { } thread pool { num_networks = 1 num_workers = 0 Setting thread.workers = 2 openssl_async_pool_init = 64 openssl_async_pool_max = 1024 } migrate { } interpret { } } Switching to configured log settings radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> require_message_authenticator = no proto = * limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30s } } Debugger not attached trigger { ... } subsection not found, triggers will be disabled #### Instantiating libraries #### #### Bootstrapping process modules #### Bootstrapping process_radius "default" Creating Auth-Type = pap Creating Auth-Type = chap Creating Auth-Type = mschap Creating Auth-Type = digest Creating Auth-Type = ldap Creating Auth-Type = eap Bootstrapping process_radius "inner-tunnel" #### Bootstrapping protocol modules #### Bootstrapping proto_radius "default.radius" client localhost { ipaddr = 192.0.2.1 secret = <<< secret >>> shortname = sample limit { max_connections = 16 lifetime = 0 idle_timeout = 30s } } Bootstrapping proto_radius "default.tcp_auth" Bootstrapping proto_radius "default.udp_acct" Bootstrapping proto_radius "inner-tunnel.radius" #### Instantiating libraries #### #### Bootstrapping modules #### modules { Loaded module rlm_always always reject { rcode = reject simulcount = 0 mpp = no } always fail { rcode = fail simulcount = 0 mpp = no } always ok { rcode = ok simulcount = 0 mpp = no } always handled { rcode = handled simulcount = 0 mpp = no } always invalid { rcode = invalid simulcount = 0 mpp = no } always disallow { rcode = disallow simulcount = 0 mpp = no } always notfound { rcode = notfound simulcount = 0 mpp = no } always noop { rcode = noop simulcount = 0 mpp = no } always updated { rcode = updated simulcount = 0 mpp = no } Loaded module rlm_attr_filter attr_filter attr_filter.pre-proxy { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/pre-proxy key = "%{Realm}" relaxed = no } attr_filter attr_filter.post-proxy { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/post-proxy key = "%{Realm}" relaxed = no } attr_filter attr_filter.access_reject { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/access_reject key = "%{User-Name}" relaxed = no } attr_filter attr_filter.access_challenge { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/access_challenge key = "%{User-Name}" relaxed = no } attr_filter attr_filter.accounting_response { filename = \/usr\/local\/etc\/raddb\/mods-config\/attr_filter\/accounting_response key = "%{User-Name}" relaxed = no } Loaded module rlm_cache cache cache_eap { driver = rbtree Loaded module rlm_cache_rbtree key = %{%{control.State}:-%{%{reply.State}:-%{State}}} ttl = 15 max_entries = 0 epoch = 0 add_stats = no } Loaded module rlm_chap Loaded module rlm_client Loaded module rlm_delay delay { delay = 1.0s relative = no force_reschedule = no } delay delay_reject { delay = "%{%{reply.FreeRADIUS-Response-Delay}:-1}" relative = yes force_reschedule = no } Loaded module rlm_detail detail { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } detail auth_log { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/auth-detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } detail reply_log { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/reply-detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } detail pre_proxy_log { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/pre-proxy-detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } detail post_proxy_log { filename = \/usr\/local\/var\/log\/radius\/radacct\/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}\/post-proxy-detail-%Y-%m-%d header = %t permissions = 0600 locking = no escape_filenames = no log_packet_header = no } Loaded module rlm_digest Loaded module rlm_eap eap { require_identity_realm = nai type = md5 Loaded module rlm_eap_md5 type = gtc Loaded module rlm_eap_gtc gtc { challenge = "Password: " auth_type = PAP } type = tls Loaded module rlm_eap_tls tls { tls = tls-common require_client_cert = yes include_length = yes } type = ttls Loaded module rlm_eap_ttls ttls { tls = tls-common virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } type = mschapv2 Loaded module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no auth_type = mschap send_error = no } type = peap Loaded module rlm_eap_peap peap { tls = tls-common virtual_server = "inner-tunnel" soh = no require_client_cert = no } ignore_unknown_eap_types = no } eap inner-eap { require_identity_realm = nai default_eap_type = mschapv2 type = md5 type = gtc gtc { challenge = "Password: " auth_type = PAP } type = mschapv2 mschapv2 { with_ntdomain_hack = no auth_type = mschap send_error = no } type = tls tls { tls = tls-peer require_client_cert = yes include_length = yes } ignore_unknown_eap_types = no } Loaded module rlm_exec exec echo { wait = yes program = "/bin/echo Tmp-String-\0 := %{User-Name}" input_pairs = &request output_pairs = &reply shell_escape = yes env_inherit = no } Loaded module rlm_escape escape { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } exec { wait = yes input_pairs = &request shell_escape = yes env_inherit = no timeout = 10 } Loaded module rlm_files files { filename = \/usr\/local\/etc\/raddb\/mods-config\/files\/authorize acctusersfile = \/usr\/local\/etc\/raddb\/mods-config\/files\/accounting key = %{%{Stripped-User-Name}:-%{User-Name}} } Loaded module rlm_linelog linelog { destination = file delimiter = "\n" format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply.Packet-Type}:-default}" file { filename = \/usr\/local\/var\/log\/radius\/linelog permissions = 0600 escape_filenames = no } syslog { severity = "info" } unix { } tcp { server = localhost port = 514 timeout = 2.0 } udp { server = localhost port = 514 timeout = 2.0 } } linelog log_accounting { destination = file delimiter = "\n" format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" file { filename = \/usr\/local\/var\/log\/radius\/linelog-accounting permissions = 0600 escape_filenames = no } syslog { severity = "info" } unix { } tcp { timeout = 1000 } udp { timeout = 1000 } } Loaded module rlm_logintime logintime { minimum_timeout = 60 } Loaded module rlm_mschap mschap { normalise = yes use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind { } } exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%(mschap:User-Name) --password=%{User-Password}" shell_escape = yes env_inherit = no } Loaded module rlm_pap pap { normalise = yes } Loaded module rlm_passwd passwd etc_passwd { filename = \/etc\/passwd format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } Loaded module rlm_radutmp radutmp { filename = \/usr\/local\/var\/log\/radius\/radutmp username = %{User-Name} check_with_nas = yes permissions = 0600 caller_id = no } Loaded module rlm_soh soh { dhcp = yes } radutmp sradutmp { filename = \/usr\/local\/var\/log\/radius\/sradutmp username = "%{User-Name}" check_with_nas = yes permissions = 0644 caller_id = no } Loaded module rlm_stats stats { } Loaded module rlm_unix unix { } Loaded module rlm_unpack Loaded module rlm_utf8 #### Bootstrapping rlm modules #### Bootstrapping rlm_cache "cache_eap" Bootstrapping rlm_delay "delay" Bootstrapping rlm_delay "delay_reject" Bootstrapping rlm_always "disallow" Bootstrapping rlm_eap "eap" Bootstrapping rlm_exec "echo" Bootstrapping rlm_escape "escape" Bootstrapping rlm_exec "exec" Bootstrapping rlm_always "fail" Bootstrapping rlm_always "handled" Bootstrapping rlm_eap "inner-eap" Bootstrapping rlm_always "invalid" Bootstrapping rlm_linelog "linelog" Bootstrapping rlm_linelog "log_accounting" Bootstrapping rlm_mschap "mschap" Bootstrapping rlm_always "noop" Bootstrapping rlm_always "notfound" Bootstrapping rlm_exec "ntlm_auth" Bootstrapping rlm_always "ok" Bootstrapping rlm_always "reject" Bootstrapping rlm_soh "soh" Bootstrapping rlm_unix "unix" Creating attribute Unix-Group Bootstrapping rlm_unpack "unpack" Bootstrapping rlm_always "updated" } # modules #### Instantiating listeners #### Compiling policies in server default { ... } Instantiating proto_radius "default.radius" Instantiating proto_radius "default.tcp_auth" Instantiating proto_radius "default.udp_acct" Instantiating process_radius "default" Compiling policies in - recv Access-Request {...} /usr/local/etc/raddb/sites-enabled/default[793]: Ignoring "-sql" as the "sql" module is not enabled. /usr/local/etc/raddb/sites-enabled/default[809]: Ignoring "-ldap" as the "ldap" module is not enabled. Compiling policies in - send Access-Accept {...} /usr/local/etc/raddb/sites-enabled/default[1115]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - send Access-Challenge {...} Compiling policies in - send Access-Reject {...} /usr/local/etc/raddb/sites-enabled/default[1228]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - recv Accounting-Request {...} Compiling policies in - send Accounting-Response {...} /usr/local/etc/raddb/sites-enabled/default[1443]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - recv Status-Server {...} Compiling policies in - authenticate pap {...} Compiling policies in - authenticate chap {...} Compiling policies in - authenticate mschap {...} Compiling policies in - authenticate digest {...} Compiling policies in - authenticate ldap {...} /usr/local/etc/raddb/sites-enabled/default[978]: Ignoring "-ldap" as the "ldap" module is not enabled. Compiling policies in - authenticate eap {...} Compiling policies in - accounting Start {...} Compiling policies in - accounting Stop {...} Compiling policies in - accounting Alive {...} Compiling policies in - accounting Accounting-On {...} Compiling policies in - accounting Accounting-Off {...} Compiling policies in - accounting Failed {...} /usr/local/etc/raddb/sites-enabled/default[80]: radius { ... } section is unused Compiling policies in server inner-tunnel { ... } Instantiating proto_radius "inner-tunnel.radius" Instantiating process_radius "inner-tunnel" Compiling policies in - recv Access-Request {...} /usr/local/etc/raddb/sites-enabled/inner-tunnel[124]: Ignoring "-sql" as the "sql" module is not enabled. /usr/local/etc/raddb/sites-enabled/inner-tunnel[134]: Ignoring "-ldap" as the "ldap" module is not enabled. Compiling policies in - send Access-Accept {...} /usr/local/etc/raddb/sites-enabled/inner-tunnel[267]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - send Access-Reject {...} /usr/local/etc/raddb/sites-enabled/inner-tunnel[302]: Ignoring "-sql" as the "sql" module is not enabled. Compiling policies in - authenticate pap {...} Compiling policies in - authenticate chap {...} Compiling policies in - authenticate mschap {...} Compiling policies in - authenticate eap {...} src/lib/server/virtual_servers.c[311]: radius { ... } section is unused #### Instantiating rlm modules #### Instantiating rlm_attr_filter "attr_filter.access_challenge" Reading file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge Instantiating rlm_attr_filter "attr_filter.access_reject" Reading file /usr/local/etc/raddb/mods-config/attr_filter/access_reject Instantiating rlm_attr_filter "attr_filter.accounting_response" Reading file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response Instantiating rlm_attr_filter "attr_filter.post-proxy" Reading file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy Instantiating rlm_attr_filter "attr_filter.pre-proxy" Reading file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy Instantiating rlm_detail "auth_log" auth_log - 'User-Password' suppressed, will not appear in detail output Instantiating rlm_cache "cache_eap" Instantiating rlm_chap "chap" Instantiating rlm_detail "detail" Instantiating rlm_digest "digest" Instantiating rlm_always "disallow" Instantiating rlm_eap "eap" Instantiating rlm_exec "echo" Instantiating rlm_passwd "etc_passwd" Instantiating rlm_exec "exec" Instantiating rlm_always "fail" Instantiating rlm_files "files" Reading file /usr/local/etc/raddb/mods-config/files/authorize Reading file /usr/local/etc/raddb/mods-config/files/accounting Instantiating rlm_always "handled" Instantiating rlm_eap "inner-eap" inner-eap - Failed to find 'authenticate inner-eap {...}' section. EAP authentication will likely not work Instantiating rlm_always "invalid" Instantiating rlm_linelog "linelog" Instantiating rlm_linelog "log_accounting" Instantiating rlm_logintime "logintime" Instantiating rlm_mschap "mschap" mschap - Using internal authentication Instantiating rlm_always "noop" Instantiating rlm_always "notfound" Instantiating rlm_exec "ntlm_auth" Instantiating rlm_always "ok" Instantiating rlm_pap "pap" Instantiating rlm_detail "post_proxy_log" Instantiating rlm_detail "pre_proxy_log" Instantiating rlm_always "reject" Instantiating rlm_detail "reply_log" Instantiating rlm_stats "stats" Instantiating rlm_always "updated" Instantiating _cache_rbtree "cache_eap.rbtree" Instantiating _eap_mschapv2 "eap.mschapv2" Instantiating _eap_peap "eap.peap" tls-config tls-common { chain rsa { format = pem certificate_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/server.pem private_key_password = <<< secret >>> private_key_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/server.key ca_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/ca.pem verify_mode = hard include_root_ca = no } verify_depth = 0 ca_path = \/usr\/local\/etc\/raddb\/certs ca_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/ca.pem dh_file = \/usr\/local\/etc\/raddb\/certs\/dh fragment_size = 1024 cipher_list = "DEFAULT" cipher_server_preference = yes allow_renegotiation = no ecdh_curve = prime256v1 tls_min_version = 1.2 session { mode = auto name = "%{EAP-Type}%{Virtual-Server}" lifetime = 1d require_extended_master_secret = yes require_perfect_forward_secrecy = no } verify { mode = all attribute_mode = client-and-issuer check_crl = no } } tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless" Instantiating _eap_tls "eap.tls" tls - Using cached TLS configuration from previous invocation Instantiating _eap_ttls "eap.ttls" tls - Using cached TLS configuration from previous invocation Instantiating _eap_mschapv2 "inner-eap.mschapv2" Instantiating _eap_tls "inner-eap.tls" tls-config tls-peer { chain { format = pem certificate_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/server.pem private_key_password = <<< secret >>> private_key_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/server.key ca_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/ca.pem verify_mode = hard include_root_ca = no } verify_depth = 0 ca_path = \/usr\/local\/etc\/raddb\/certs ca_file = \/usr\/local\/etc\/raddb\/certs\/rsa\/ca.pem dh_file = \/usr\/local\/etc\/raddb\/certs\/dh fragment_size = 16384 cipher_server_preference = yes allow_renegotiation = no ecdh_curve = "prime256v1" tls_min_version = 1.2 session { mode = auto name = "%{EAP-Type}%{Virtual-Server}" lifetime = 1d require_extended_master_secret = yes require_perfect_forward_secrecy = no } verify { mode = all attribute_mode = client-and-issuer check_crl = no } } tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless" Scheduler created in single-threaded mode #### Opening listener interfaces #### Network - Failed adding new socket to network event loop: Failed inserting filters for FD 17: EFAULT: Bad address /usr/local/etc/raddb/sites-enabled/default[209]: Opening radius I/O interface failed -- *Ce message et toutes les pièces jointes (ci-après le "message") sont établis à l’intention exclusive des destinataires désignés. Il contient des informations confidentielles et pouvant être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de détruire le message. Toute utilisation de ce message non conforme à sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite, sauf autorisation expresse de l'émetteur*

2 1

Potential issue with compiling on the HEAD of the branch
by work vlpl 15 May '23

15 May '23

Hi, for my own needs, I am building freeradius from the HEAD (d84dacda2d67fcffedb0dd75e97c71185eec37cb) of 3.0.x branch on amazonlinux2. Because of that, I am not sure if this is a real problem or just state between releases so I am not opening the issue in GitHub. The commit that is working for me is 9acf21e62de151918743de541567d13cd3e61f9a Can you say if it is a real issue? If yes I will create a proper issue in github. ``` In file included from src/main/threads.c:34:0: src/main/threads.c: In function 'ssl_locking_function': src/main/threads.c:256:28: error: invalid operands to binary != (have 'pthread_mutex_t {aka union <anonymous>}' and 'void *') rad_assert(ssl_mutexes[n] != NULL); ~~~~~~~~~~~~~~ ^ src/freeradius-devel/rad_assert.h:38:13: note: in definition of macro 'rad_assert' ((void) ((expr) ? (void) 0 : \ ^~~~ make: *** [build/objs/src/main/threads.lo] Error 1 ``` Best regards, Vladimir

2 1