- Freeradius-Users - lists.freeradius.org

Post-Auth-Type reject not insert in radpostauth table
by Muhammed Buvaydani 13 Sep '20

13 Sep '20

hi there,I have freeradius version3 which has an external authentication script in the users file this is the users file content DEFAULT Auth-Type := accept Exec-Program-Wait="/usr/bin/php /var/www/html/cloudradius/captiveportal/auth.php \"%{User-Name}\" \"%{User-Password}\" \"%{Calling-Station-Id}\" \"%{NAS-Port}\" \"%{NAS-IP-Address}\" and this is the post auth section in default file under sites-enables post-auth { reply_log exec sql Post-Auth-Type reject { sql attr_filter.access_reject } } and this is the output which is returned from my external script in reject status Reply-Message="User not found" the problem is when I get rejected user it is not insert in radpost auth rable but it insert without any problem when I get accepted user this is the debug when I get rejected user (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) reply_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /usr/local/var/log/radius/radacct/127.0.0.1/reply-detail-20200913 (0) reply_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/reply-detail-20200913 (0) reply_log: EXPAND %t (0) reply_log: --> Sun Sep 13 23:40:40 2020 (0) [reply_log] = ok (0) exec: Executing: /usr/bin/php /var/www/html/cloudradius/captiveportal/auth.php "28:C6:8E:3F:6E:dB1" "1234" "28:C6:8E:3F:6E:BB" "102" "103.81.214.233" "PPP" "192.168.0.1" "" "nas": (0) exec: ERROR: Program returned code (1) and output 'Reply-Message="User not found"' (0) [exec] = reject (0) } # post-auth = reject (0) EXPAND User : %{User-Name}, MAC : %{Calling-Station-Id}, Nas : %{NAS-IP-Address}, Nas Port : %{NAS-Port-Id}, Ip : %{Framed-IP-Address} (0) --> User : 28:C6:8E:3F:6E:dB1, MAC : 28:C6:8E:3F:6E:BB, Nas : 103.81.214.233, Nas Port : , Ip : 192.168.0.1 (0) Rejected in post-auth: [28:C6:8E:3F:6E:dB1/1234] (from client localhost port 102 cli 28:C6:8E:3F:6E:BB) User : 28:C6:8E:3F:6E:dB1, MAC : 28:C6:8E:3F:6E:BB, Nas : 103.81.214.233, Nas Port : , Ip : 192.168.0.1 (0) EXPAND User : %{User-Name}, MAC : %{Calling-Station-Id}, Nas : %{NAS-IP-Address}, Nas Port : %{NAS-Port-Id}, Ip : %{Framed-IP-Address} (0) --> User : 28:C6:8E:3F:6E:dB1, MAC : 28:C6:8E:3F:6E:BB, Nas : 103.81.214.233, Nas Port : , Ip : 192.168.0.1 (0) Login incorrect (exec: Program returned code (1) and output 'Reply-Message="User not found"'): [28:C6:8E:3F:6E:dB1/1234] (from client localhost port 102 cli 28:C6:8E:3F:6E:BB) User : 28:C6:8E:3F:6E:dB1, MAC : 28:C6:8E:3F:6E:BB, Nas : 103.81.214.233, Nas Port : , Ip : 192.168.0.1 (0) Delaying response for 1.000000 seconds Waking up in 0.2 seconds.

2 1

[Auto Reply] stop
by 4794094048＠vtext.com 13 Sep '20

13 Sep '20

[Auto Reply] stop

1 0

[Auto-Reply] I'm driving right now - I'll get bac...
by 4794094048＠vtext.com 13 Sep '20

13 Sep '20

[Auto-Reply] I'm driving right now - I'll get back to you later.

1 0

Add VSA in pre-proxy stage
by Arnaud LAURIOU 11 Sep '20

11 Sep '20

Hello, I'm trying to add a VSA in an Access-Request before proxing it to an authentification RADIUS server. I use this attribute definition : BEGIN-VENDOR FreeRADIUS format=Extended-Vendor-Specific-1 ATTRIBUTE FreeRADIUS-Eduroam-Prevent-Loop 1 integer END-VENDOR FreeRADIUS I add this VSA in the pre-proxy stage, but I get : (0) # Executing section pre-proxy from file /etc/freeradius/sites-enabled/default (0) pre-proxy { ... (0) if (!FreeRADIUS-Eduroam-Prevent-Loop) { (0) if (!FreeRADIUS-Eduroam-Prevent-Loop) -> TRUE (0) if (!FreeRADIUS-Eduroam-Prevent-Loop) { (0) update request { (0) &FreeRADIUS-Eduroam-Prevent-Loop := 1 (0) } # update request = noop (0) } # if (!FreeRADIUS-Eduroam-Prevent-Loop) = noop (0) ... skipping else: Preceding "if" was taken Why is the return state of this update to 'noop' ? I shoud not get a 'ok' or 'updated' return state ? And this VSA does not seem to be added to the forwarded Access-Request : (0) Proxying request to home server 194.57.4.197 port 1812 timeout 14.000000 (0) Sent Access-Request Id 255 from 0.0.0.0:47596 to 194.57.4.197:1812 length 162 (0) User-Name = "anonymous(a)renater.fr" (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id := "02-00-00-00-00-01" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Connect-Info = "eduroam.fr monitoring" (0) EAP-Message = 0x02c8001901616e6f6e796d6f75734072656e617465722e6672 (0) Message-Authenticator = 0x0705ffe079dfb7dc4cd3bdaad44477d4 (0) Event-Timestamp = "Sep 11 2020 15:14:17 CEST" (0) Proxy-State = 0x30 It seems that I missed something, but where ? Regards, Arnaud Lauriou

3 2

Linelog module sending message twice that has "warning" or higher severity level.
by Yiğit YAŞAR 11 Sep '20

11 Sep '20

Hi all, I have some issue with the linelog module. My "linelog" configuration as in below; *linelog {filename = syslogescape_filenames = nopermissions = 0600syslog_facility = daemonsyslog_severity = infoformat = "This is a log message for %{User-Name}"reference = "messages.%{%{reply:Packet-Type}:-default}"}linelog log_postauth {filename = syslogsyslog_facility = authprivsyslog_severity = infoformat = "User '%{User-Name}' authenticated via Radius"}linelog log_postreject {filename = syslogsyslog_facility = authprivsyslog_severity = warningformat = "User '%{User-Name}' authentication request rejected by Radius!"}* Also in "default" configuration file is like ; *post-auth {log_postauthlog_postrejectif (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {update reply {&User-Name !* ANY}}update {&reply: += &session-state:}-sqlexecremove_reply_message_if_eapPost-Auth-Type REJECT {-sqllog_postrejectattr_filter.access_rejecteapremove_reply_message_if_eap}Post-Auth-Type ACCEPT {log_postauth}Post-Auth-Type Challenge {}}* Problem is, when linelog sends log message with warning or higher severity, log message sending twice.There is no problem with info or lower severity level, they sending once. What could be the problem, do you have any idea? Thanks in advance Yigit

4 7

I need help or some guide!
by Ariel García Reyes 07 Sep '20

07 Sep '20

Hi I am implementing a Freeradius server to authenticate Wifi connections. I want to configure the authentication to be EAP-TLS and to be able to filter that the MAC of the device matches the authorized one stored somewhere, domain controller, database, file, etc., taking into account that a user could be authorized to use several teams. Thank you very much! -- ________________________________________________ Lic. Ariel García Reyes. GNU/Linux Registered User #357058

2 2

Proxying PAP to PEAP-MSCHAP-V2
by Xand Meaden 04 Sep '20

04 Sep '20

Hi, We have the following setup: 1. Linux servers using pam_radius module (which only supports PAP) for user authentication 2. NPS RADIUS servers which are configured to only support PEAP-MSCHAP-V2 Before I potentially waste too much time on something impossible - can FreeRADIUS be configured to accept incoming PAP requests, and then proxy them to NPS using PEAP-MSCHAP-V2? Thanks, Xand -- Xand Meaden | Senior Linux Engineer Faculty of Natural & Mathematical Sciences King's College London

3 3

Preventing proxy loops
by Arnaud LAURIOU 03 Sep '20

03 Sep '20

Hello, We have freeRADIUS proxies dedicated to eduroam, version 3.0.21. Some of our clients are sending us Access-Request ... with their realm. We forward them to their home_server (the same as the client) and they send them back to us again. This sometimes creates loops. How can we prevent our proxies from these loops ? Knowing that : - We don't have access to the clients/home server organizations RADIUS configs. - We tried a filter in the pre-proxy section : if (Realm && ("%{home_server:ipaddr}" == "%{client:ipaddr}")) { update request { &Module-Failure-Message += 'Rejected: loop prevent' } reject } But this rule is too strict for the monitoring requests used by some organizations. - Another way ? Regards, Arnaud Lauriou

3 4

3.0.21 consistency check failed
by adrian.p.smith＠bt.com 02 Sep '20

02 Sep '20

We have recently attempted to upgrade from 3.0.15 to 3.0.21 but are seeing very frequent crashes. Config unchanged from 3.0.15. Any ideas appreciated. Regards, Adrian Smith Examples from the radius.log: CONSISTENCY CHECK FAILED src/lib/cursor.c[219]: VALUE_PAIR "BTOpenzone-Roaming-Direction" length 42696464 is greater than char buffer length 7 SOFT ASSERT FAILED src/lib/pair.c[2341]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 15 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7fab75ae7490] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_assert_cond+0x4c)[0x7fab75ae7f50] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_pair_verify+0x3af)[0x7fab75af8c52] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_cursor_next+0x58)[0x7fab75ae641f] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_pair_list_verify+0x151)[0x7fab75af9169] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x25482)[0x7fab75d4c482] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(verify_request+0x16c)[0x7fab75d4c5f8] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d3f0] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d1f6] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_run+0x144)[0x7fab75b0f7d4] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_loop+0x509)[0x7fab75b10117] /opt/freeradius-server-3.0.21/sbin/radiusd(radius_event_process+0x26)[0x4492d5] /opt/freeradius-server-3.0.21/sbin/radiusd(main+0xcbb)[0x43274b] /lib64/libc.so.6(__libc_start_main+0xfd)[0x3a0081ed1d] /opt/freeradius-server-3.0.21/sbin/radiusd[0x40f489] No panic action set and Mon Aug 24 01:20:40 2020 : Error: CONSISTENCY CHECK FAILED src/main/process.c[639]: Expected RADIUS_PACKET request to be parented by 0xd1f5d0 (REQUEST), but parented by 0xd04680 (null_context) Talloc chunk lineage: 0xd1f230 (RADIUS_PACKET) < 0xd04680 (null_context) Talloc context level 0: full talloc report on 'null_context' (total 466556 bytes in 3189 blocks) session-state contains 14 bytes in 2 blocks (ref 0) 0xd8c690 .name contains 14 bytes in 1 blocks (ref 0) 0xd79b20 acct_listener_pool contains 15485 bytes in 101 blocks (ref 0) 0xd77ab0 REQUEST contains 7277 bytes in 100 blocks (ref 0) 0xd77e30 RADIUS_PACKET contains 3340 bytes in 48 blocks (ref 0) 0x7f090001f090 uint8_t contains 481 bytes in 1 blocks (ref 0) 0x7f090000fd40 <snip> Mon Aug 24 01:20:40 2020 : Error: ASSERT FAILED src/main/util.c[1095]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 12 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f092d5aa490] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(rad_assert_fail+0x46)[0x7f092d80e438] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x25437)[0x7f092d80f437] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(verify_request+0x10a)[0x7f092d80f596] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d3f0] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d1f6] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_run+0x144)[0x7f092d5d27d4] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_loop+0x509)[0x7f092d5d3117] /opt/freeradius-server-3.0.21/sbin/radiusd(radius_event_process+0x26)[0x4492d5] /opt/freeradius-server-3.0.21/sbin/radiusd(main+0xcbb)[0x43274b] /lib64/libc.so.6(__libc_start_main+0xfd)[0x3a0081ed1d] /opt/freeradius-server-3.0.21/sbin/radiusd[0x40f489] No panic action set and CONSISTENCY CHECK FAILED src/lib/cursor.c[219]: VALUE_PAIR "NAS-Identifier" char buffer is not parented by VALUE_PAIR 0x7fc3f0014480, instead parented by 0x231dee0 (null_context) SOFT ASSERT FAILED src/lib/pair.c[2358]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 15 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7fc46fbd8490] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_assert_cond+0x4c)[0x7fc46fbd8f50] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_pair_verify+0x4cc)[0x7fc46fbe9d6f] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_cursor_next+0x58)[0x7fc46fbd741f] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_pair_list_verify+0x151)[0x7fc46fbea169] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x25482)[0x7fc46fe3d482] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(verify_request+0x16c)[0x7fc46fe3d5f8] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d3f0] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d1f6] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_run+0x144)[0x7fc46fc007d4] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_loop+0x509)[0x7fc46fc01117] /opt/freeradius-server-3.0.21/sbin/radiusd(radius_event_process+0x26)[0x4492d5] /opt/freeradius-server-3.0.21/sbin/radiusd(main+0xcbb)[0x43274b] /lib64/libc.so.6(__libc_start_main+0xfd)[0x33d121ed1d] /opt/freeradius-server-3.0.21/sbin/radiusd[0x40f489] No panic action set and Mon Aug 24 01:20:49 2020 : Error: CONSISTENCY CHECK FAILED src/main/process.c[2919]: Expected RADIUS_PACKET request to be parented by 0x1878490 (REQUEST), but parented by 0x184bee0 (null_context) Talloc chunk lineage: 0x1878170 (RADIUS_PACKET) < 0x184bee0 (null_context) Talloc context level 0: full talloc report on 'null_context' (total 64956 bytes in 465 blocks) session-state contains 14 bytes in 2 blocks (ref 0) 0x1873070 .name contains 14 bytes in 1 blocks (ref 0) 0x187e190 acct_listener_pool contains 15323 bytes in 94 blocks (ref 0) 0x196f200 <snip> Mon Aug 24 01:20:49 2020 : Error: ASSERT FAILED src/main/util.c[1095]: 0 CAUGHT SIGNAL: Aborted Backtrace of last 9 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f74c5e88490] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(rad_assert_fail+0x46)[0x7f74c60ec438] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x25437)[0x7f74c60ed437] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(verify_request+0x10a)[0x7f74c60ed596] /opt/freeradius-server-3.0.21/sbin/radiusd[0x44221c] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43f5a3] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43af5c] /lib64/libpthread.so.0(+0x33d1607aa1)[0x7f74c5840aa1] /lib64/libc.so.6(clone+0x6d)[0x33d12e8bcd] No panic action set And Mon Aug 24 01:22:08 2020 : Error: CONSISTENCY CHECK FAILED src/main/process.c[1159]: Expected RADIUS_PACKET request to be parented by 0xe77dc0 (REQUEST), but parented by 0xd94ee0 (null_context) Talloc chunk lineage: 0xe77ab0 (RADIUS_PACKET) < 0xd94ee0 (null_context) Talloc context level 0: full talloc report on 'null_context' (total 594675 bytes in 3880 blocks) session-state contains 14 bytes in 2 blocks (ref 0) 0xe21380 .name contains 14 bytes in 1 blocks (ref 0) 0xda9720 acct_listener_pool contains 16303 bytes in 114 blocks (ref 0) 0xda3b10 REQUEST contains 8095 bytes in 113 blocks (ref 0) 0xda3ed0 RADIUS_PACKET contains 258 bytes in 4 blocks (ref 0) 0xe18100 VALUE_PAIR contains 82 bytes in 2 blocks (ref 0) 0x7f55f00076f0 uint8_t contains 2 bytes in 1 blocks (ref 0) 0x7f55f0006170 src/lib/radius.c:495 contains 24 bytes in 1 blocks (ref 0) 0xda9370 RADIUS_PACKET contains 3610 bytes in 52 blocks (ref 0) 0x7f5610028b50n and Mon Aug 24 01:22:11 2020 : Error: ASSERT FAILED src/main/util.c[566]: !request->in_request_hash CAUGHT SIGNAL: Aborted Backtrace of last 17 frames: /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f31e3310490] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(rad_assert_fail+0x46)[0x7f31e3574438] /opt/freeradius-server-3.0.21/lib/libfreeradius-server.so(+0x24481)[0x7f31e3574481] /usr/lib64/libtalloc.so.2(+0x2dbe)[0x7f31e2ee2dbe] /usr/lib64/libtalloc.so.2(+0x2c4b)[0x7f31e2ee2c4b] /usr/lib64/libtalloc.so.2(+0x2c4b)[0x7f31e2ee2c4b] /usr/lib64/libtalloc.so.2(+0x2c4b)[0x7f31e2ee2c4b] /usr/lib64/libtalloc.so.2(_talloc_free+0xfb)[0x7f31e2ee32db] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d2e2] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43db8c] /opt/freeradius-server-3.0.21/sbin/radiusd[0x43d1f6] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_run+0x144)[0x7f31e33387d4] /opt/freeradius-server-3.0.21/lib/libfreeradius-radius.so(fr_event_loop+0x509)[0x7f31e3339117] /opt/freeradius-server-3.0.21/sbin/radiusd(radius_event_process+0x26)[0x4492d5] /opt/freeradius-server-3.0.21/sbin/radiusd(main+0xcbb)[0x43274b] /lib64/libc.so.6(__libc_start_main+0xfd)[0x33d121ed1d] /opt/freeradius-server-3.0.21/sbin/radiusd[0x40f489] No panic action set

3 5

Errors reading /etc/raddb/mods-config/attr_filter/post-proxy
by lingctam 02 Sep '20

02 Sep '20

Hi, I am in the initial debugging process and came across this error I cannot resolve: /etc/raddb/mods-config/attr_filter/post-proxy[127]: Entry does not begin with a user name Errors reading /etc/raddb/mods-config/attr_filter/post-proxy /etc/raddb/mods-enabled/attr_filter[12]: Instantiation failed for module "attr_filter.post-proxy" I have done some edits on the "post-proxy" file and "/mods-enabled/attr_filter" to no avail. Can anyone please point me to the right direction? Thanks.

1 1