- Freeradius-Users - lists.freeradius.org

segfault with regex and hint
by Alexander Clouter 19 Aug '09

19 Aug '09

Hi, It's that time of year to overhaul the cesspool that makes up my FreeRADIUS config files. I am running FreeRADIUS from git[1] about two days ago and found that by putting the following in my 'hints' file gives me the segfault shown below[2]. If I remove the end bit[3] then I do not get the segfault, but then I also do not get my comparison :) Any more information needed, then let me know. Cheers [1] at commit 08baab6769fea367bda5dd006b659621bb9aac18 from yesterday-ish [2] strlcpy sourced from address 0x0 [3] User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i" ---- DEFAULT NAS-Port-Type == "Ethernet", User-Name == "%{User-Password}", Calling-Station-Id =~ "/^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i", User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i" Hint = mac-auth ---- ---- server dot1x { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes with_alvarion_vsa_hack = no } Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f943272eae0 (LWP 3894)] strlcpy (dst=0x13545e8 "", src=0x0, siz=<value optimized out>) at strlcpy.c:50 50 if ((*d++ = *s++) == 0) (gdb) where #0 strlcpy (dst=0x13545e8 "", src=0x0, siz=<value optimized out>) at strlcpy.c:50 #1 0x00007f9432315164 in pairmake (attribute=<value optimized out>, value=0x0, operator=17) at valuepair.c:1549 #2 0x00007f9432315a39 in pairread (ptr=0x7fff3a7352a8, eol=0x7fff3a7352b4) at valuepair.c:1703 #3 0x00007f9432315b7f in userparse (buffer=<value optimized out>, first_pair=0x7fff3a739470) at valuepair.c:1804 #4 0x000000000040ec5c in pairlist_read (file=0x1352140 "/etc/freeradius/hints", list=0x13522b8, complain=<value optimized out>) at files.c:192 #5 0x00007f942dd21aeb in preprocess_instantiate (conf=0x1217110, instance=0x1352108) at rlm_preprocess.c:497 #6 0x0000000000413bc1 in find_module_instance (modules=<value optimized out>, instname=0x121e0c0 "preprocess", do_link=20259360) at modules.c:506 #7 0x0000000000414fee in do_compile_modsingle (parent=0x0, component=1, ci=0x121e080, grouptype=0, modname=0x7fff3a739b38) at modcall.c:1872 #8 0x0000000000412db3 in load_component_section (cs=0x121df00, components=0x1351ea0, comp=1) at modules.c:794 #9 0x0000000000413368 in load_byserver (cs=0x121d6d0) at modules.c:993 #10 0x0000000000413697 in virtual_servers_load (config=0x1203030) at modules.c:1121 #11 0x0000000000414058 in setup_modules (reload=<value optimized out>, config=0x1203030) at modules.c:1368 #12 0x000000000041245a in read_mainconfig (reload=<value optimized out>) at mainconfig.c:904 #13 0x0000000000416d1a in main (argc=2, argv=0x7fff3a73a418) at radiusd.c:257 (gdb) ---- -- Alexander Clouter .sigmonster says: Keep it short for pithy sake.

5 9

Re: Re: accounting through detail module help
by ramesh p 19 Aug '09

19 Aug '09

> Thanks Alan. > > But we have two accounting sections in default and buffered-sql. > Do i need to enable sql module only in buffered-sql? And place buffered-sql > in defualt 'accounting' section. am Confused... > > Thanks, > Rams. > > > > >> >> ------------------------------ >> >> Message: 2 >> Date: Tue, 18 Aug 2009 23:29:47 +0100 >> From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> >> Subject: Re: accounting through detail module help >> To: FreeRadius users mailing list >> <freeradius-users(a)lists.freeradius.org> >> Message-ID: <20090818222947.GD32575(a)lboro.ac.uk> >> Content-Type: text/plain; charset=us-ascii >> >> Hi, >> > Thanks Alan. >> > I enabled detail module in accounting. details files were created under >> > radacct clients directories. >> > Just wanted to check if any module already available in freeradius to >> scan >> > these detail files, parse and put attributes in mysql db every 2-3 mins? >> >> >> sites-available/buffered-sql ? >> >> just ensure that the sql stuff is configured correctly...link/copy it into >> sites-enabled and restart the daemon >> >> alan >> >> >> ------------------------------ >> >

2 3

How could I assing an IP a client.
by Rokkhan 19 Aug '09

19 Aug '09

Hello, I want to know if it is possible assign IP to clients with the freeradius. I have tried to do this with a Sql user and setting Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 values in radreply but i doesnt work. The client always take the IP from a DHCP server. I using freeradius 2.1.6 and validating wifi users with PEAP. The user validation works correctly. Thanks in advance.

2 1

Unlang Question/Problem
by Garber, Neal 19 Aug '09

19 Aug '09

I haven't had much sleep the past few days and just wanted another set of eyes on an issue I'm having. Also, I won't be able to do more testing until tomorrow (user/equip. unavailable) and wanted to try to fix it before then. I'm running FR 2.1.6 with patches to rlm_mschap & rlm_eap_mschapv2 to correct a problem with case-sensitive userids. Anyway, the patch was working great for user auth. and failing for machine auth. I used some unlang to get around the issue. I haven't done a lot with unlang (and yes I read the man page), so I may be missing something simple. I'm doing 802.1x authentication from Windows supplicant with PEAP/MS-CHAPv2. Here's the authenticate section of my inner-tunnel server: authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { if (User-Name =~ /host\/(.*)\.energyeast\.net/i) { update request { Ntlm-Auth-Username = "%{1}$" } updated } else { update request { Ntlm-Auth-Username = "%{User-Name}" } updated } mschap-inner } Auth-Type LDAP { ldap } eap-internal eap-comodo } First, if I didn't include "updated" after the "update request" actions, then it would return reject. Is that normal (I didn't call a module in there)? Should the unlang be outside of the "Auth-Type MS-CHAP" block? Also, Ntlm-Auth-Username is expanded, there's a "[request] returns reject". I think this is the source of the problem, but I don't understand where the reject is coming from. The mschap module that follows returns OK, but the subsequent eap-comodo module returns reject with no explanation in the debug. Do I need something like: eap-comodo { ok = return } Here's the relevant debug output: Tue Aug 18 15:41:15 2009 : Info: Found Auth-Type = eap-comodo Tue Aug 18 15:41:15 2009 : Info: +- entering group authenticate {...} Tue Aug 18 15:41:15 2009 : Info: [eap-comodo] Request found, released from the list Tue Aug 18 15:41:15 2009 : Info: [eap-comodo] EAP/mschapv2 Tue Aug 18 15:41:15 2009 : Info: [eap-comodo] processing type mschapv2 Tue Aug 18 15:41:15 2009 : Info: [mschapv2] +- entering group MS-CHAP {...} Tue Aug 18 15:41:15 2009 : Info: [mschapv2] ++? if (User-Name =~ /host\/(.*)\.energyeast\.net/i) Tue Aug 18 15:41:15 2009 : Info: [mschapv2] ? Evaluating (User-Name =~ /host\/(.*)\.energyeast\.net/i) -> TRUE Tue Aug 18 15:41:15 2009 : Info: [mschapv2] ++? if (User-Name =~ /host\/(.*)\.energyeast\.net/i) -> TRUE Tue Aug 18 15:41:15 2009 : Info: [mschapv2] ++- entering if (User-Name =~ /host\/(.*)\.energyeast\.net/i) {...} Tue Aug 18 15:41:15 2009 : Info: [mschapv2] expand: %{1}$ -> US62695C$ Tue Aug 18 15:41:15 2009 : Info: [mschapv2] +++[request] returns reject Tue Aug 18 15:41:15 2009 : Info: +++[updated] returns updated Tue Aug 18 15:41:15 2009 : Info: ++- if (User-Name =~ /host\/(.*)\.energyeast\.net/i) returns updated Tue Aug 18 15:41:15 2009 : Info: ++ ... skipping else for request 124: Preceding "if" was taken Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] No Cleartext-Password configured. Cannot create LM-Password. Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] No Cleartext-Password configured. Cannot create NT-Password. Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] Using MS-CHAP Response Name (host/US62695C.energyeast.net) to construct MS-CHAPv1 challenge Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] rlm_mschap: mschap_authenticate: Creating challenge hash with username: host/US62695C.energyeast.net Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] Told to do MS-CHAPv2 for host/US62695C.energyeast.net with NT-Password Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] No trailing :- after variable at %{Ntlm-Auth-UserName:-None}} Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] expand: --username=%{%{Ntlm-Auth-UserName:-None}} -> --username=US62695C$ Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] mschap2: d1 Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] Using MS-CHAP Response Name (host/US62695C.energyeast.net) to construct MS-CHAPv1 challenge Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] rlm_mschap: mschap_xlat: Creating challenge hash with username: host/US62695C.energyeast.net Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=943b358133b5bcac Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=121180cc778e59746acb8c12aa6bb9ab7ab2099604c750eb Tue Aug 18 15:41:15 2009 : Debug: Exec-Program output: NT_KEY: 8E774D7FDDFC8300DF50499B30DA1CAF Tue Aug 18 15:41:15 2009 : Debug: Exec-Program-Wait: plaintext: NT_KEY: 8E774D7FDDFC8300DF50499B30DA1CAF Tue Aug 18 15:41:15 2009 : Debug: Exec-Program: returned: 0 Tue Aug 18 15:41:15 2009 : Info: [mschap-inner] adding MS-CHAPv2 MPPE keys Tue Aug 18 15:41:15 2009 : Info: ++[mschap-inner] returns ok Tue Aug 18 15:41:15 2009 : Info: [eap-comodo] Freeing handler Tue Aug 18 15:41:15 2009 : Info: ++[eap-comodo] returns reject Tue Aug 18 15:41:15 2009 : Info: Failed to authenticate the user. Tue Aug 18 15:41:15 2009 : Auth: Login incorrect: [host/US62695C.energyeast.net] (from client eedmz02app08 port 2648774147 cli 00009de11603 via TLS tunnel) } # server inner-tunnel Thank you for your time and assistance..

2 1

Re: Freeradius-Users Digest, Vol 52, Issue 87
by ramesh p 19 Aug '09

19 Aug '09

Thanks Alan. But we have two accounting sections in default and buffered-sql. Do i need to enable sql module only in buffered-sql? And place buffered-sql in defualt 'accounting' section. am Confused... Thanks, Rams. > > ------------------------------ > > Message: 2 > Date: Tue, 18 Aug 2009 23:29:47 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: accounting through detail module help > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20090818222947.GD32575(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > Thanks Alan. > > I enabled detail module in accounting. details files were created under > > radacct clients directories. > > Just wanted to check if any module already available in freeradius to > scan > > these detail files, parse and put attributes in mysql db every 2-3 mins? > > > sites-available/buffered-sql ? > > just ensure that the sql stuff is configured correctly...link/copy it into > sites-enabled and restart the daemon > > alan > > > ------------------------------ >

1 0

RADIUS-LDAPv3.schema not found
by RANDRIAMAMPIONONA José Johnny 19 Aug '09

19 Aug '09

Hi All, I downloaded and installed freeradius-server-2.1.6 but I can-t find the radius schema to copy it in ldap directory. Help! Best regards! -- JJohnny R. Beginner vasiana09(a)gmail.com

2 2

Re: accounting through detail module help
by ramesh p 18 Aug '09

18 Aug '09

Thanks Alan. I enabled detail module in accounting. details files were created under radacct clients directories. Just wanted to check if any module already available in freeradius to scan these detail files, parse and put attributes in mysql db every 2-3 mins? Thanks, Rams. > -------------- > Message: 7 > Date: Tue, 18 Aug 2009 15:33:09 +0100 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: accounting through detail module help > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20090818143309.GA32113(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > At present our radius servers getting traffic of more than 3 million > users. > > We have only two radius servers and one mysql server active. The server > > crashing whenever more traffic comes. Due to mysql overload and slow I'm > > planning to use detail module for accounting and then take these details > and > > parse then put in database using program/script. Does this helps? Is > there > > any script already available in freeradius? > > Does palcing one more radius server and using mysql clustering helps? > > use the detail module and let FR deal with handling the detail module. > > you can speed up the MySQL using eg batter indexing and better storage > engine > > alan > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 52, Issue 81 > ************************************************ >

3 2

two ldap servers in my config
by michel＠casa.co.cu 18 Aug '09

18 Aug '09

Hello Using freeradius 2.1.6, my users are authenticated against the Active Directory. I have a primary and a secondary controller on the network. I wonder if you could specify in the configuration of two ldap servers, when one does not respond due to technical queries are then made my second controller. This is my autenticate section: authenticate { Auth-Type LDAP { ldap } } Thanks Michel ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

2 1

FreeRADIUS 2.1 proxy error "Inconsistent shared secret for home server"
by Adam Bultman 18 Aug '09

18 Aug '09

Good morning, everybody. I am setting up a new proxy realm inside proxy.conf. I have an existing proxy realm like this: realm proxydomain.com { type = radius authhost = x.x.x.x:1812 accthost = x.x.x.x:1813 secret = sharedsecret nostrip } I am trying to set up a new proxy realm, which is a different domain name, but uses the same authhost and accthost, but a new shared secret: realm anotherproxydomain.net { type = radius authhost = x.x.x.x:1812 accthost = x.x.x.x:1813 secret = differentsharedsecret nostrip } FreeRADIUS is giving me "Inconsistent shared secret for home server x.x.x.x". The authhost and accthost are reached via a VPN, and they are a "clearing house" of sorts - they proxy authentication and accounting for multiple companies (not just the one I'm worrying about). I've checked the FAQ and wiki, and haven't had any luck. I've googled for the error, and the hits I get related to source code files, which don't help. I've also looked in the freeradius docs that come with the binaries/source, etc. Is it not possible to have unique shared secrets for unique realms, proxied to the same auth and acct hosts? Thanks, Adam

2 1

NAS IPs
by Irina 18 Aug '09

18 Aug '09

Hello, I need to allow a block of 8 IP addresses in 'nasname' column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina ===========================

1 1