- Freeradius-Users - lists.freeradius.org

Segmentation fault on 2.1.7 during HUP
by coja 20 May '10

20 May '10

Hello all! We use 2.1.7 version of freeradius+mysql 5 running on RHEL4u8. We tried to apply PIN authentication based on file users which located in /etc/raddb. I inserted to crontab reload (HUP) command which runs every 30 minutes. After the period of time we found that radiusd crashed with Segmentation fault error in sql_log module. I turned off this module, but it didn't help us. Now it's happening with voip-postpaid module which was adapted to mysql. I read docs/bugs and tried to trace the bug, but in gdb radius was working 3 days without any crash. All that I have my configs and debug output after radiusd -X Could anybody please tell me what I should do? May be I have to recompile FR with some another options or my configs fail. I tried 2.1.8 and it didn't help me. Thank You very much! [sql] expand: %{User-Name} -> 2018 [sql] sql_set_user escaped user --> '2018' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '2018' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = '2018' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User 2018 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "2018" [pap] Using clear text password "2018" [pap] User authenticated successfully ++[pap] returns ok Login OK: [2018] (from client test port 0 cli 1115551212) +- entering group post-auth {...} [sql] expand: %{User-Name} -> 2018 [sql] sql_set_user escaped user --> '2018' [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', 'HIDDEN', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '2018', 'HIDDEN', 'Access-Accept', '2010-05-17 20:07:14') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '2018', 'HIDDEN', 'Access-Accept', '2010-05-17 20:07:14') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> 2018 [sql_log] expand: %{%{User-Name}:-DEFAULT} -> 2018 [sql_log] sql_set_user escaped user --> '2018' Segmentation fault -- View this message in context: http://old.nabble.com/Segmentation-fault-on-2.1.7-during-HUP-tp28590790p285… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

hostname variable ?
by Fred MAISON 20 May '10

20 May '10

Hello Freeradius-Users, Is there any way to reference hostname (in fact hostname -s) in configuration files, in order to have identical configuration files tree on both a normal and a backup freeradius 2.1.8 server ? For example, to manage differents listen addresse on normal and backup : suppose a variable %{hostname} contains result of command hostname -s, On both normal and backup servers, we could have this : $INCLUDE %{hostname}.listen.conf # expands as $INCLUDE normal.listen.conf on so called normal server # expands as $INCLUDE backup.listen.conf on so called backup server /etc/raddb/normal.listen.conf : listen { type = auth port = 1812 ipaddr = 10.1.1.1 } listen { type = acct port = 1813 ipaddr = 10.1.1.1 } ..... /etc/raddb/backup.listen.conf listen { type = auth port = 1812 ipaddr = 10.1.1.2 } listen { type = acct port = 1813 ipaddr = 10.1.1.2 } ..... best regards, Fred

2 2

State of 2.x?
by Alex French 20 May '10

20 May '10

Hi, We're running 1.1.8 on FreeBSD 5.3 and have been delaying the move to 2.x until absolutely necessary. Given the recent libtool22 issues, I'm thinking it's time to move. Just wondering if people would recommend moving now to 2.1.9 or waiting a while longer for a stable 2.2? Thanks -- Alex

3 3

freeradius + mysql trouble
by Ski Mountain 20 May '10

20 May '10

Hi everybody, I am trying to set up freeradius so that it authenticates off a myql database. sql.conf is being included in the config. But the rlm_sql is never loaded and I have been trying to figure out why. It does not appear to even try to connect to the database and I am stumped as to why. I have also followed (http://wiki.freeradius.org/SQL_HOWTO) to no avail. # /usr/sbin/freeradius -X FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { compat = "cistron" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests.

4 3

FTP and Telnet request to RADIUS server
by Arjun Prasad 20 May '10

20 May '10

Hi, Can we use RADIUS server to validate the user trying to access the NAS using ftp or telnet session. Regards Arjun prasad

2 1

problem whit home_server template
by Ana Gallardo 20 May '10

20 May '10

Hello, I'm workimg with Freeradius 2.1.8. I would like to use templates in my proxy.conf file to define some home servers. My templates.conf file is: /etc/freeradius# cat templates.conf templates { home_server tldrediris { type = auth+acct port =1812 secret = XXXX #src_ipaddr = 127.0.0.1 require_message_authenticator = no response_window = 20 #no_response_fail = no zombie_period = 40 revive_interval = 60 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } } Then, in radiusd.conf I include this file: $INCLUDE templates.conf And, if I have in proxy.conf file template = tldrediris, when FreeRADIUS starts doest take the values defines in templates.conf: /etc/freeradius# cat proxy.conf home_server tld-rediris1 { template = tldrediris ipaddr = X.X.X.X } /etc/freeradius# freeradius -X FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Jan 3 2010 at 14:14:04 . . . including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/templates.conf including configuration file /etc/freeradius/proxy.conf . . . home_server tld-rediris1 { ipaddr = X.X.X.X port = 0 response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } /etc/freeradius/proxy.conf[26]: No port, or invalid port defined for home server tld-rediris1. In the other hand, if I use $template tldrediris in templates.conf, FreeRADIUS doesn't know tldrediris: /etc/freeradius# cat proxy.conf home_server tld-rediris1 { $template tldrediris ipaddr = X.X.X.X } /etc/freeradius# freeradius -X FreeRADIUS Version 2.1.8, for host x86_64-pc-linux-gnu, built on Jan 3 2010 at 14:14:04 . . . including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/templates.conf including configuration file /etc/freeradius/proxy.conf WARNING: No such configuration item tldrediris /etc/freeradius/proxy.conf[27]: Reference "tldrediris" not found Errors reading /etc/freeradius/radiusd.conf I remember this: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg59018.… Sorry for my english and thankyou very much. -- ____________________ Ana Gallardo Gómez ____________________

1 0

authentification
by dorra aa 20 May '10

20 May '10

hi freeradius,i want to ask how to use MAC Address Authentication in my freeradius.besides, i add an address mac with the daloradius. how can i test the succes of thatthnak you _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. https://signup.live.com/signup.aspx?id=60969

3 4

windows client authentication error
by shirkavand 19 May '10

19 May '10

Hi there, i have installed freeradius 2.1.8 on ubuntu 10.04. radtest using mysql backend works fine. But when a windows supplicant tryes to connect the server always gets rejected. Freeradius debug console shows: ... ... [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for sqltest with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ... ... Any idea why am missing? Cheers

3 5

rlm_eap: SSL error error on Start Up, Compile question
by Jeff Stout 19 May '10

19 May '10

I am trying to install FreeRadius 2.1.8, on my initial package build I ran into issues with lintian Running Ubuntu with 2.6.24-27-server kernel dpkg-buildpackage -d -b -uc ( I had to use the -d option as I received dependency errors) ... dh_installman dh_lintian /bin/bash: dh_lintian: command not found make[1]: *** [binary-common] Error 127 make[1]: Leaving directory `/usr/local/freeradius' make: *** [binary-arch] Error 2 dpkg-buildpackage: failure: debian/rules binary gave error exit status 2 I modified the /usr/local/freeradius/debian/rules and removed the dh_lintian reference under the tree "Binary Common" IS dh_lintian REQUIRED for freeradius to compile and operate correctly ???? I recompiled my debian package with no errors then installed freeradius I need to use radius with my backend LDAP Database, we are configuring 802.1X for all of our LAN switches. dpkg -i freeradius-common_2.1.8+git_all.deb dpkg -i libfreeradius2_2.1.8+git_i386.deb dpkg -i freeradius_2.1.8+git_i386.deb dpkg -i freeradius-ldap_2.1.8+git_i386.deb dpkg -i freeradius-dialupadmin_2.1.8+git_all.deb then when I start freeradius I get an error for rlm_eap and SSL this is when it is Instantiating the eap-tls Module. rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading certificate file /etc/freeradius/certs/server.pem rlm_eap: Failed to initialize type tls /etc/freeradius/eap.conf[17]: Instantiation failed for module "eap" /etc/freeradius/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/freeradius/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. under my "certs" directory I do not have a server.pem certificate (how do I generate it? ) ls /etc/freeradius/certs/demoCA/index.txt.dpkg-bak serial.dpkg-bak Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 any assistance with this is greatly appreciated. Thank You Jeff Stout

2 1

freeradius 2.x EAP-MSCHAPv2 + MySQL
by Maciej Drobniuch 19 May '10

19 May '10

Hi ALL!! I'm trying to get authenticated with mikrotik wireless AP. All works but only when I add the user into the users file. The thing is that i want to get the users from mysql. In this moment the authentication requests are coming from PPPoE concentrator, and the users are in MySQL database - it works fine. The freeradius server while authenticating is not searching in the sql database. Why that? Please help and sorry for my lame eng.

4 9