- Freeradius-Users - lists.freeradius.org

Proxy
by Nicolas Breuer 25 Nov '21

25 Nov '21

Hello, According to the doc https://wiki.freeradius.org/config/Proxy ......... * he remote server replies with ACK or REJECT * On ACK: The initial Auth-Type is set to Accept * On REJECT: The initial Auth-Type is set to Reject * Then the users file is processed as usual. The username used at this point is the one after hints file processing (regardless of the "hints" option). It also includes the realm (regardless of the setting of the "nostrip" option) unless the realm is LOCAL. ........... Waking up in 0.3 seconds. (0) Marking home server 217. port 1649 alive (0) Clearing existing &reply: attributes (0) Received Access-Accept Id 112 from NAS (0) Service-Type = Framed-User (0) Cisco-AVPair = "ip:vrf-id=BEXX" (0) Cisco-AVPair = "ip:ip-unnumbered=Loopback22" (0) Framed-IP-Netmask = 255.255.255.255 (0) Proxy-State = 0x3936 (0) Framed-IP-Address = ZZZ (0) Session-Timeout = 172800 (0) server dsl { (0) # Executing section post-proxy from file /etc/raddb/config/... (0) post-proxy { (0) post_proxy_log: --> Thu Nov 25 14:48:24 2021 (0) [post_proxy_log] = ok (0) attr_filter.post-proxy: EXPAND %{Realm} (0) attr_filter.post-proxy: --> BE (0) attr_filter.post-proxy: Matched entry DEFAULT at line 106 (0) [attr_filter.post-proxy] = updated (0) } # post-proxy = updated (0) } (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/raddb/config/ (0) post-auth { (0) if (&reply:Subscription-Name=="PRO"){ (0) ERROR: Failed retrieving values required to evaluate condition (0) if (&reply:Subscription-Name=="NOSERVICE"){ (0) ERROR: Failed retrieving values required to evaluate condition (0) elsif (&reply:Subscription-Name != '') { (0) ERROR: Failed retrieving values required to evaluate condition (0) update reply { (0) Service-Type := Framed-User (0) Framed-IP-Netmask := 255.255.255.255 (0) } # update reply = noop (0) if (reply:Framed-IP-Address) { (0) if (reply:Framed-IP-Address) -> FALSE (0) else { (0) update reply { (0) Session-Timeout = 172800 (0) } # update reply = noop (0) } # else = noop (0) } # post-auth = noop (0) Login OK: [BCtest@BXXX] (from client test port 0) (0) Sent Access-Accept Id 96 from (0) Framed-IP-Netmask := 255.255.255.255 (0) Service-Type := Framed-User (0) Session-Timeout = 172800 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 96 with timestamp +8 Ready to process requests In users I have a match before the proxy (0) [suffix] = updated (0) auth_dsl: users: Matched entry DEFAULT at line 10 (0) auth_dsl: users: Matched entry DEFAULT at line 54 (0) auth_dsl: users: Matched entry DEFAULT at line 79 (0) [auth_dsl] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop But this is not applied at all after the accept.... Any ideas ?

2 8

rlm_sql_unixodbc: Driver Link failure when running radiusd -X
by Clive Allen 25 Nov '21

25 Nov '21

Hello all, Firstly, my apologies if this is not freeradius related but am hoping someone may have seen this before or could point me in the right direction please: I am trying to connect to an mssql database with freeradius on redhat. When running radiusd -X I am getting the following readout (error): Nov 25 13:40:27 rhmssql1 radiusd[7698]: Creating attribute Unix-Group Nov 25 13:40:27 rhmssql1 radiusd[7698]: Could not link driver rlm_sql_unixodbc: /usr/lib64/freeradius/rlm_sql_unixodbc.so: cannot open shared object file: No such file or directory Nov 25 13:40:27 rhmssql1 radiusd[7698]: Make sure it (and all its dependent libraries!) are in the search path of your system's Nov 25 13:40:27 rhmssql1 radiusd[7698]: /etc/raddb/mods-enabled/sql[27]: Instantiation failed for module "sql" Nov 25 13:40:27 rhmssql1 systemd[1]: radiusd.service: control process exited, code=exited status=1 Nov 25 13:40:27 rhmssql1 systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. -- Subject: Unit radiusd.service has failed I have checked the directory /usr/lib64/freeradius/ and sure enough the file rlm_sql_unixodbc.so does not exist there. I have tested with isql -v rhmssql1 radius radPass_123 and that works fine. I can also access the DB with either radius or SA. I have configured /etc/odbc.ini with the following: [rhmssql1] Driver = ODBC Driver 17 for SQL Server Description=My DSN for the FreeRADIUS Database Database = radius Server = tcp:192.168.56.167,1433 The Driver section in here should then point to the relevant part in odbcinst.ini which is configured as follows: [ODBC Driver 13 for SQL Server] Description=Microsoft ODBC Driver 13 for SQL Server Driver=/opt/microsoft/msodbcsql/lib64/libmsodbcsql-13.1.so.9.2 UsageCount=1 [ODBC Driver 17 for SQL Server] Description=Microsoft ODBC Driver 17 for SQL Server Driver=/opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.8.so.1.2 UsageCount=1 I have checked the locations as follows: [root@rhmssql1 lib64]# ldd /opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.8.so.1.2 linux-vdso.so.1 => (0x00007ffd793f3000) libdl.so.2 => /lib64/libdl.so.2 (0x00007fc7c12fa000) librt.so.1 => /lib64/librt.so.1 (0x00007fc7c10f2000) libodbcinst.so.2 => /lib64/libodbcinst.so.2 (0x00007fc7c0ed8000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007fc7c0bef000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007fc7c09a2000) libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fc7c069a000) libm.so.6 => /lib64/libm.so.6 (0x00007fc7c0398000) libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fc7c0182000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fc7bff66000) libc.so.6 => /lib64/libc.so.6 (0x00007fc7bfb98000) /lib64/ld-linux-x86-64.so.2 (0x00007fc7c190a000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007fc7bf965000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007fc7bf761000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007fc7bf551000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007fc7bf34d000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fc7bf133000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fc7bef0c000) libpcre.so.1 => /lib64/libpcre.so.1 (0x00007fc7becaa000) I have ensured that the link is correct with: [root@rhmssql1 lib64]# odbcinst -q -d -n "ODBC Driver 17 for SQL Server" [ODBC Driver 17 for SQL Server] Description=Microsoft ODBC Driver 17 for SQL Server Driver=/opt/microsoft/msodbcsql17/lib64/libmsodbcsql-17.8.so.1.2 UsageCount=1 I have also followed the excellent process doument at https://wiki.freeradius.org/modules/Rlm_sql_unixodbc and everything works as should except the very last stage (start up of freeradius). Excuse my picking up on this as it is a typo I expect - but in there you have labelled port "1443" under the DSN (Section 4:Server = tcp:192.0.2.1, 1443 and suspect you meant 1433). In the /etc/raddb/mods-available - I completed the following changes: sql { dialect = "mssql" driver = "rlm_sql_unixodbc" # driver = "rlm_sql_${dialect}" # Connection info: # server = "rhmssql1" port = 1433 login = "radius" password = "radPass_123" Again, many apologies if the answer to this is obvious (which I know it is from the error) but this e-mail has been a last resort. There are articles on the wiki but they are from 2007 and 2008. I have completed a "find" for the named file and cannot find it "find / -name "*rlm_sql*" Thank you for any pointers.

2 1

detail file locking
by Thor Spruyt 25 Nov '21

25 Nov '21

Hi, Using freeradius 3.0.25 on centos 7 I have a configuration with a "detail" module writing to a file with locking = yes I have a type = detail listener on that same file. Under some load, apparantly, very sporadically a packet seems to gets lost. Am I correct to say that with locking = yes , there should never be any packet lost due to the reader renaming the file while the writer is writing to it ? How would be a good approach to further troubleshoot this ? -- Regards, Thor

2 12

(no subject)
by Giedrius Baronas 24 Nov '21

24 Nov '21

Hi, I read a manual about comparisons. If I write IP without network mask then it works but if IP with mask I get error Maybe who sees where I make a mistake? >From https://freeradius.org/radiusd/man/unlang.txt Comparisons (foo == bar) Compares 'foo' to 'bar', and evaluates to true if the comparison holds true. Valid comparison operators are "==", "!=", "<", "<=", ">", ">=", "=~", and "!~", all with their usual meanings. The operators ":=" and "=" are assignment oper- ators, and are not allowed for comparisons. The operators "<", "<=", ">", and ">=" are also allowed for checking that an IP address is contained within a network. For example: if (<ipaddr>192.0.2.1 < 192.0.2.0/24) { This com- parison succeeds, because the address 192.0.2.1 is contained within the network 192.0.2.0/24. My debug: Wed Nov 24 21:35:27 2021 : Debug: (1) if ( <ipaddr>NAS-IP-Address == 192.0.2.0/24 ){Wed Nov 24 21:35:27 2021 : ERROR: (1) Failed casting rhs operand: Invalid IPv4 mask length "/24". Only "/32" permitted for non-prefix typesWed Nov 24 21:35:27 2021 : ERROR: (1) Failed retrieving values required to evaluate condition -- Pagarbiai, Giedrius 861569551

2 2

FreeRADIUS modules python vs python3
by Jonathan Davis 24 Nov '21

24 Nov '21

I am looking to better understand the python modules under FreeRADIUS. My initial assumption was rlm_python was for 2.7.x and rlm_python3 was for 3.x. However I am confused about the information at https://freeradius.org/modules/ - rlm_python3 is listed as obsolete with the view documentation link taking you to https://networkradius.com/doc/current/raddb/mods-available/home.html where there is neither python or python3 - rlm_python is listed as not obsolete, with "Allows the server to call a persistent, embedded Python script." Installed FreeRADIUS 3.0.25 from the networkRADIUS packages at https://networkradius.com/packages/ In the FreeRADIUS dir, I see there is both python and python3 under mods-available, and under mods-config only a python dir Was rlm_python3 made obsolete as 2.7 was EOL back in Jan of 2020 and everything is now simply under rlm_python? Looking at the latest examples on https://github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/rlm… I see both example.py and prepaid.py look to be executed as python3, both have #! /usr/bin/env python3 in their headers: Create the symlink in mods-enabled/python to mods-available/python and try with the example provided, which works, then I switch it over to my own script, start radiusd -Xx and get the following error: Tue Nov 23 16:02:41 2021 : Info: Python version: 2.7.18 (default, Oct 11 2021, 11:39:27) [GCC 8.5.0 20210514 (Red Hat 8.5.0-3)]a Tue Nov 23 16:02:41 2021 : Error: python_function_load - Module 'dr_yubikey' not found Tue Nov 23 16:02:41 2021 : Error: <type 'exceptions.ImportError'> (No module named requests) Tue Nov 23 16:02:41 2021 : Error: [0] /etc/raddb/mods-config/python/dr_yubikey.py:13 at <module>() Tue Nov 23 16:02:41 2021 : Error: python_function_load - Failed to import python function 'dr_yubikey.authorize' Tue Nov 23 16:02:41 2021 : Error: /etc/raddb/mods-enabled/python[9]: Instantiation failed for module "python" I'm aware the above is failing because requests can't be imported, but request is installed under python3, and that first info line is not python3, but Python 2.7.18 ? python2 pip install requests does get me to Tue Nov 23 16:19:55 2021 : Info: Ready to process requests when starting debug. Trying with python3 symlinked in mods-enabled, and creating mods-config/python3 and dropping my .py in there: Tue Nov 23 17:02:11 2021 : Error: /etc/raddb/mods-enabled/python3[9]: Failed to link to module 'rlm_python3': /usr/lib64/freeradius/rlm_python3.so: cannot open shared object file: No such file or directory Which is true, there is no rlm_python3.so that exists under /usr/lib64/freeradius/ Are my assumptions wildly incorrect or am I missing something super obvious? Thank you, Jonathan

3 3

sql ip pool module assign IP 0.0.0.0 to users
by Mirko Alberio 24 Nov '21

24 Nov '21

Hello! We have the following problem: When many of out NAS (which are Wireless PPPOE POPs) that are Mikrotik based are rebooted (for maintanance, updates or maybe outages) and then simultaneously connect to our Freeradius instance to authenticate again we are experiencing the following rows in the logs: Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client OpenFiber port 50242 - ID: 114 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client port 33577 - ID: 70 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client port 37882 - ID: 21 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client port 50131 - ID: 95 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : Error: Received conflicting packet from client port 40360 - ID: 211 due to unfinished request. Giving up on old request. Thu Nov 18 06:25:06 2021 : WARNING: (8349606) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349607) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349608) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349609) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349610) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349605) WARNING: Module rlm_sql became unblocked Thu Nov 18 06:25:06 2021 : WARNING: (8349611) WARNING: Module rlm_sql became unblocked ... etc ... And the customers PPPOE sessions are getting an assigned IP = 0.0.0.0 instead of one of the IP pool. If we disconnect those sessions proprerly and let them authenticate again the problem is fixed. We have some doubts that this could happen because the POPs are not sending the correct AccTerminate packets when rebooting, so it is not freeing up the pools. And also those sessions are not recognized as active because we are using NAS PORT ID as pool key and it changes, maybe would be better tu user the Mac Address as key? A final note: our IP pool is nearly exhausted, we have about 30 free IPs. Could this also give problems? Thanks. -- Mirko Alberio - Assistenza tecnica e-mail: mirko.alberio(a)telemar.it Telemar SpA Internet Quality Provider Via Enrico Fermi, 235 - 36100 Vicenza - Italia Tel 0444 291302 - Fax 0444 566310 - www.telemar.it Assistenza tecnica 0444 1420000 Reg. Imp. Di Vicenza /C.F./P.I. 02508710247 Cap. Soc. € 120.000,00 I.V. R.E.A. VI-236292

2 5

Design strategies for preventing fraudulent logins across multiple sites
by Network RADIUS 24 Nov '21

24 Nov '21

** Preventing fraudulent logins across multiple sites --------------------------------------- When an ISP has RADIUS servers across multiple sites, new attacks are possible. Users can share account information with their friends, who can then log in separately to each site. If the RADIUS system design does not take this problem into account, users can defraud the ISP of significant revenue. One solution is to post-process the user sessions. The system can check hourly, or daily, if the same user is logged in at multiple sites. If the user is found to have multiple logins, they can be kicked offline, blocked, or even banned from the network. This solution works, but is not always the best one for every situation. Another solution is to not only track user sessions at each site, but to do cross-site checks for user logins. In this approach, each site will dynamically check every other site when a user logs in. As one might expect, there are costs and benefits to this approach. This article describes why this approach may be useful, how it is done, and what are the pros and cons. Read the full article… https://networkradius.com/articles/2021/02/10/preventing-fraudulent-logins-… <https://networkradius.com/articles/2021/02/10/preventing-fraudulent-logins-…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn <http://eepurl.com/hwuWrn> ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ <https://networkradius.com/request/> ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Add client IP address to log messages
by Drew Weaver 23 Nov '21

23 Nov '21

Hello, FreeRADIUS has been working well for us but we've started to see an increase in attempts to login to some of our devices from unsavory characters. We have a lot of devices so it would really be useful if FreeRADIUS could log what client the request comes from. Currently, this is what it looks like when we see a failed login attempt. 1. Login incorrect (pap: Crypt digest does not match "known good" digest): [drew] (from client localhost port 0) Does anybody know how I can adjust it so that it says something like 1. Login incorrect (pap: Crypt digest does not match "known good" digest): [drew] (from client localhost port 0) from 192.168.55.2 Where 192.168.55.2 is the IP address that sent the RADIUS auth request? I believe that the information inside of the ( ) is sent from the device itself, I am working with the device MFG to see if they can actually fix their implementation so that it makes the device identifiable that way as well. Any way to speed up the process of remediation is tremendously helpful. Thanks, -Drew

4 12

Segfault, possibly fixed in 3.0.21
by Norman Elton 22 Nov '21

22 Nov '21

I uncovered a segfault when no home proxy servers are present. I boiled down my configuration to an easily reproducible test case, and made a Docker image to test: https://github.com/normelton/freeradius-crash/tree/main/raddb I have a dummy eduroam server configured at the bottom of proxy.conf and my sites-enabled/default file simply proxies all requests to that server. Otherwise pretty much everything is right out of the default config. Using radclient, my first request is proxied to example.org, which obviously doesn't respond. Eventually the home server is marked dead. Then I send a second request, and freeradius crashes. I'll include the complete debug output below. Here's the mystery ... this is reproducible in 3.0.20, but is seemingly fixed in 3.0.21. I reviewed the release notes for 3.0.21, and don't see anything obviously related. Can anyone confirm this was actually fixed, versus something that might reappear one day? If it were a minor bug, I probably wouldn't care. But a segfault is worth a little more digging. Thanks! Norman FreeRADIUS Version 3.0.20 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/expr including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/rfc7542 including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/cui including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server eduroam-1 { ipaddr = www.example.org IPv4 address [93.184.216.34] port = 1812 type = "auth+acct" secret = <<< secret >>> response_window = 5.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 20 status_check = "none" ping_interval = 30 check_interval = 10 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server_pool eduroam-pool { type = client-balance home_server = eduroam-1 } realm eduroam { pool = eduroam-pool nostrip } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client docker-network { ipaddr = 172.18.0.0/16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debug state unknown (cap_sys_ptrace capability not set) systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } instantiate { } # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Please use tls_min_version and tls_max_version instead of disable_tlsv1 Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server default { # from file /etc/freeradius/sites-enabled/default # Loading authorize {...} } # server default server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:336 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 53271 Ready to process requests (0) Received Access-Request Id 204 from 172.18.0.3:48457 to 172.18.0.2:1812 length 41 (0) User-Name = "testuser(a)realm.edu" (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) update control { (0) Proxy-To-Realm := "eduroam" (0) } # update control = noop (0) } # authorize = ok (0) Starting proxy to home server 93.184.216.34 port 1812 (0) server default { (0) } (0) Proxying request to home server 93.184.216.34 port 1812 timeout 5.000000 (0) Sent Access-Request Id 228 from 0.0.0.0:53271 to 93.184.216.34:1812 length 76 (0) User-Name = "testuser(a)realm.edu" (0) Event-Timestamp = "Nov 22 2021 01:25:39 UTC" (0) NAS-IP-Address = 172.18.0.3 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x323034 Waking up in 0.3 seconds. (0) Expecting proxy response no later than 4.663611 seconds from now Waking up in 4.6 seconds. (0) No proxy response, giving up on request and marking it done Marking home server 93.184.216.34 port 1812 as zombie (it has not responded in 5.000000 seconds). (0) ERROR: Failing proxied request for user "testuser(a)realm.edu", due to lack of any response from home server 93.184.216.34 port 1812 (0) Clearing existing &reply: attributes (0) Found Post-Proxy-Type Fail-Authentication (0) server default { (0) Post-Proxy-Type sub-section not found. Ignoring. (0) } (0) Login incorrect (Home Server failed to respond): [testuser(a)realm.edu] (from client docker-network port 0) (0) There was no response configured: rejecting request (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Sent Access-Reject Id 204 from 172.18.0.2:1812 to 172.18.0.3:48457 length 0 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 204 with timestamp +2 Waking up in 9.7 seconds. PING: Zombie period is over for home server eduroam-1 Marking home server 93.184.216.34 port 1812 as dead. PING: Reviving home server eduroam-1 in 120 seconds Waking up in 119.9 seconds. (1) Received Access-Request Id 39 from 172.18.0.3:46573 to 172.18.0.2:1812 length 41 (1) User-Name = "testuser(a)realm.edu" (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) update control { (1) Proxy-To-Realm := "eduroam" (1) } # update control = noop (1) } # authorize = ok (1) ERROR: Failed to find live home server: Cancelling proxy (1) WARNING: No home server selected (1) Clearing existing &reply: attributes (1) Found Post-Proxy-Type Fail-Authentication Segmentation fault

2 2

Re: rlm_python works in -X, fatal signal when started using systemctl (pRet is NULL)
by Aren Sandersen 19 Nov '21

19 Nov '21

This might be as simple as adding a parameter to your detach() function in your Python code, or commenting it out the func_detach line entirely in mods-enabled/python3: See https://github.com/FreeRADIUS/freeradius-server/commit/a6d33ebd51851a8d0c1d… Which fixes a bug in the sample code. Aren Python 3.8.10 > Ubuntu 20.04.3 LTS > FreeRADIUS 3.0.20 > > When I go to start freeradius with systemctl I get the following: > > Job for freeradius.service failed because a fatal signal was delivered to > the control process. > > See "systemctl status freeradius.service" and "journalctl -xe" for details. > > in journalctl -xe I find: > > Nov 13 16:28:51 radius-2.tor2 freeradius[318065]: # Skipping contents of > 'if' as it is always 'false' -- > /etc/freeradius/3.0/sites-enabled/inner-tunnel:3> > Nov 13 16:28:51 radius-2.tor2 freeradius[318065]: radiusd: #### Skipping > IP addresses and Ports #### > Nov 13 16:28:51 radius-2.tor2 freeradius[318065]: Configuration appears to > be OK > Nov 13 16:28:51 radius-2.tor2 freeradius[318065]: do_python_single:568, > detach - pRet is NULL > Nov 13 16:28:51 radius-2.tor2 freeradius[318065]: python_error_log:200, > Exception type: <class 'TypeError'>, Exception value: detach() takes 0 > positional > >

3 5