- Freeradius-Users - lists.freeradius.org

rlm_dbm segfault debug
by Patrick Medina 21 Jan '08

21 Jan '08

Hello list, Newbie and non-programmer here, though I've been a user of this very useful program for a year now (currently on v.2.0.0, CentOS 4.6, x86_64). I'm trying to get a MAC and SSID -based system to work with rlm_dbm. The system already works with the "users" file as follows: 00:12:ab:34:cd:56 Called-Station-Id =~ ".*:WLAN0", Auth-Type := Accept Unfortunately, after converting the above to the prescribed dbm format, a segfault results whenever a user is matched (no problem with a reject). Here's the output of radiusd -X: ... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.1.234 port 25939, id=66, length=214 User-Name = "00:12:ab:34:cd:56" Called-Station-Id = "00-AB-12-CD-34-EF:WLAN0" Calling-Station-Id = "00-12-AB-34-CD-56" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1400 Service-Type = Framed-User NAS-IP-Address = 10.0.1.234 NAS-Identifier = "WS5100" Vendor-388-Attr-2 = 0x4c53574c414e30 Vendor-388-Attr-4 = 0x31 NAS-Port-Id = "WLAN0" Connect-Info = "CONNECT 54Mbps 802.11g" User-Password = "00:12:ab:34:cd:56" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "00:12:ab:34:cd:56", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rlm_dbm: try open database file: /usr/local/etc/raddb/wlan0-users rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add 00:12:ab:34:cd:56 to user list sm_parse_user: start parsing: user: 00:12:ab:34:cd:56 parse buffer: <<Called-Station-Id =~ ".*:WLAN0", Auth-Type := Accept>> rlm_dbm: recod parsed process pattern Program received signal SIGSEGV, Segmentation fault. -------- I've run gdb and here's the content of the log file: Starting program: /usr/local/sbin/radiusd -X [Thread debugging using libthread_db enabled] [New Thread 182915782400 (LWP 23734)] Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 182915782400 (LWP 23734)] 0x000000000041d3c7 in request_data_get (request=0x0, unique_ptr=0x0, unique_int=-1379995904) at util.c:145 145 for (last = &(request->data); *last != NULL; last = &((*last)->next)) { -------- I've been scouring the documentation and list, trying various running and compiling configuration options, all to no avail. Moreover, the same segfault happens with v.1.1.7, though I haven't run gdb on that. Any help or push in the right direction would be much appreciated. Thank you. Chris ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

2 2

freeradius authenticate over ldap database
by Renato Gregio de Souza Filho 21 Jan '08

21 Jan '08

I'm trying to install and configure my freeradius at rhel 5 to authenticate in ldapdatabase. i read the rml_ldap and configure then according i understand. I start my server with no problem, but i'm not sure if its working good or bad. I create a test user at ldap database with username and passowrd are "teste" and try to test it from radtest, but it won't work. The password at ldap database are crypt. [root@poseidon raddb]# radtest teste teste localhost:1812 testing123 Usage: radtest user passwd radius-server[:port] nas-port-number secret [ppphint] [nasname] [root@poseidon raddb]# When i start my radiusd, they start without problens. What i need to do to put it working fine over ldap database? [root@poseidon raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib64 Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=admin,dc=radius,dc=com,dc=br" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "pcistl00" ldap: basedn = "dc=radius,dc=com,dc=br" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x555574851690 Module: Instantiated ldap (ldap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. att Renato Gregio

2 1

NAS list with MySQL
by Pawel Cieplinski 20 Jan '08

20 Jan '08

Hi there... i am new to free radius. I already successfully installed freeradius 1.1.7 with mysql5.1. The point is NAS's IPs and secrets are configured in clients.conf. I cannot find anything how to put those data to SQL database. Sql.conf doesn't describe any table or value for clients, can anyone give any clue how to store those data in SQL database Pawel Cieplinski

4 5

dialup-admin sql table creation error
by rgreiner 20 Jan '08

20 Jan '08

I was making some tests with the freeradius 2 install, and found that the creation schema for the "badusers" table for dialupadmin (in the /dialup_admin/sql/mysql folder) has 2 problems: # # Table structure for table 'badusers' # CREATE TABLE badusers ( id int(10) DEFAULT '0' NOT NULL auto_increment, UserName varchar(30), IncidentDate datetime DEFAULT '0000-00-00 00:00:00' NOT NULL, Reason varchar(200), Admin varchar(30) DEFAULT '-', PRIMARY KEY (id), KEY UserName (UserName), KEY Date (Date) ); The first is in the 'id' creation line. Starting with version 4.11 (I think its this version), MySQL does not accept having a default value when you use auto_increment. So, "id int(10) NOT NULL auto_increment" would be the correct entry. The second problem is in the last line. There is a reference to 'Date' beeing used as key, but the 'Date' was not created. There is no reference creating it. Checking version 1.1.7, the line was " Date datetime DEFAULT '0000-00-00 00:00:00' NOT NULL,". Now, was it removed because it's no longer used, or was it removed by accident, ir should it be renamed to the "IncidentDate" field? I guess it would be the last option.... Thanks, Roberto -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

3 2

rlm_perl build on mac osx
by Info 19 Jan '08

19 Jan '08

Greetings, Quick disclaimer: Though I've been working on my unix chops for the last year (intermittently), I still consider myself a bit of a newbie, so I apologize for any questions that might have obvious answers. That said: I'm working on a port of FR 2.0 for macports.org and had a couple questions about what appears to be the main stumbling block when building it on the mac (both ppc and intel, in this case under osx 10.4.11). The problem, as those familiar with installing this on the mac, has to do with linking to the apple build of perl under /System/ Library... Bug #471 shows this, and an example of my initial attempts showed much the same: ... (cd .libs && rm -f rlm_perl.so && ln -s rlm_perl-2.0.0.so rlm_perl.so) ar cru .libs/rlm_perl.a /System/Library/Perl/5.8.6/darwin-thread- multi-2level/auto/DynaLoader/DynaLoader.a rlm_perl.o /System/Library/ Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a ranlib: archive member: .libs/rlm_perl.a(DynaLoader.a) fat file for cputype (7) cpusubtype (3) is not an object file (bad magic number) ar: internal ranlib command failed gmake[6]: *** [rlm_perl.la] Error 1 ... Mind you, I've found a way to get past this by simply installing my own build of perl (5.8.8). Regardless, I have these questions: 1] Is it at all possible for rlm_perl to build against apple's install of perl? 2] Is perl only a build dependency for rlm_perl, or does the module make runtime calls to external perl libs? 3] I've discovered with an install of perl 5.10 that, during configure (of freeradius 2), the linker chooses the /System/Library/ 5.8.6... over the new perl ( at {prefix}/lib/perl/5.10.0 ). The only thing I can guess is that when searching for perl libs/includes, the linker only expands to seek version n.n.n and does not recognize a two digit subversion n.nn.n. If that's what's happening, is that patchable? Cheers, Jim ___________________________________________________ James H. Graham II, Creative Director • Spark Media Group 6511 Allegheny Avenue • Takoma Park, MD 20912-4737 Tel: 301.270.4810 • Fax: 301.270.4812 • www.sparkmediagroup.com

4 4

Rlm_sql in freeradius-1.1.7
by Dashamir Hoxha 19 Jan '08

19 Jan '08

Hi, I have installed freeradius-1.1.7 in fedora8. However I find that the module rlm_sql does not work as described in this page: http://wiki.freeradius.org/Rlm_sql For example, I have inserted such data in the database: radcheck: +------+----------+------------------+----+-------+ | id | UserName | Attribute | op | Value | +------+----------+------------------+----+-------+ | 5272 | test | User-Password | := | test | | 5262 | test | Simultaneous-Use | := | 5 | +------+----------+------------------+----+-------+ radreply: +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 42 | test | Reply-Message | := | Wellcome | +----+----------+---------------+----+----------+ usergroup: +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | test | group2 | 2 | | test | group1 | 1 | +----------+-----------+----------+ radgroupcheck: +----+-----------+----------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+----------------+----+-------+ | 42 | group1 | NAS-Identifier | != | 123 | | 52 | group2 | NAS-Identifier | == | 123 | +----+-----------+----------------+----+-------+ radgroupreply: +----+-----------+---------------+----+--------+ | id | GroupName | Attribute | op | Value | +----+-----------+---------------+----+--------+ | 52 | group1 | Reply-Message | += | group1 | | 62 | group2 | Reply-Message | += | group2 | +----+-----------+---------------+----+--------+ When I try to login with username 'test' and password 'test' I get debug messages like these: Sending Access-Accept of id 30 to 192.168.252.47 port 2053 Reply-Message := "Wellcome" Reply-Message += "group1" Reply-Message += "group2" It seems to me that this is not according to the behavior described in the documentation above. Am I right or I am missing something? Regards, Dashamir

5 9

Re: Administering with MySQL DB
by Andy Smith 19 Jan '08

19 Jan '08

Erm, thanks. But Im trying to work out how I Administer the data in MySQL. Are there no utilities for entering data? If I have to enter data manually with SQL insert etc can anyone point me at some docs explaining the format the information should be in?? Andy Smith wrote: > Im completely new to freeradius, I have installed the server with > MySQL and also got the dialup web GUI up and running. > However its still not clear to me how I add new NAS devices, you dont > appear to be able to do that in the GUI. I just want > to add a system by IP address with a secret. Do I need to manually do an > insert into mysql? If so can someone give me > a pointer to how the data should be entered? Or any other help!! Edit the configuration files with a text editor. Alan DeKok.

4 3

EAP-TLS Machine Authentication problems
by Michael Olson 19 Jan '08

19 Jan '08

I'm attempting to use FreeRADIUS to do EAP-TLS with Windows XP using machine authentication. I set up FreeRADIUS following the guide at http://wiki.freeradius.org/WPA_HOWTO#Step_2:_Configure_FreeRADIUS and I'm using OpenSSL to generate the cetificates. I can authenticate using user certificates fine, so I'm pretty sure all the Certificates & CA setup is right on the RADIUS server certificate, User certificate, and the Root Certificate. That leaves the Computer Certificate. I generated the computer certificate to have the common name be the machine name (I've tried it plain and FQDN) and I've put the FQDN is the altSubjectName field as well. It has the same usage extensions as the User certificates. (TLS Client Auth: 1.3.6.1.5.5.7.3.2) I set the AuthMode registry key to Computer Only (2), and it trys to authenticate which suggests that the workstation is okay with the certificate. Computer Certificate details: http://www.cs.odu.edu/~olson/eap/computer.crt.txt Other than that I can't think of where to look for a problem. Comparing logs between user and computer authentication I can see where it starts differing but I can't find anything I can interpret as to why. Nothing seems to fail for the computer, it just cycles endlessly. Successful User Authentication Log: http://www.cs.odu.edu/~olson/eap/eap-tls_user_auth.log Failed Computer Authentication Log: http://www.cs.odu.edu/~olson/eap/eap-tls_computer_auth.log I also tossed out the windows tracing logs for both user and computer auth and anything else that seemed useful in http://www.cs.odu.edu/~olson/eap/ Can anybody give me a pointer on where to look for problems? Thanks -- Mike Olson

2 6

Problem with Max-Daily-Session
by Gabriele Giuliani 18 Jan '08

18 Jan '08

As entitled, with my office we have installed at a library town a server with Ubuntu 7.10, Freeradius and Chilispot to ensure wireless navigation to users with their notebooks from the local library; The access point is configured without any authentication, anyone can connect, authentication is performed by the server radius, which are stored registered users who are entitled to navigation (etc / freeradius / users), for simplicity we have not used SQL; Everything works great: Users come, authentify and happy surfing, what we fail to do is set the maximum daily navigation (which in our case should be 2 hours), the Daily-Session-Time works, after 2 hours of connection users are disconnected, only they can safely again for another 2 hours, which we would like to avoid (a maximum of 2 hours of daily connection); this is our configuration file (etc/freeradius/radiusd.conf ) of the "counter module": counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } Do we need to set some other parameter somewhere else? Any advice is welcome Thanks for the answers :) -- Gabriele Giuliani STUDIO 16 64 S.r.l. Via degli Abeti, 52 61100 PESARO Tel. 0721 0130897 Fax. 06 452215814 Cell. 329 9503621

2 1

Administering with MySQL DB
by Andy Smith 18 Jan '08

18 Jan '08

Hi list, Im completely new to freeradius, I have installed the server with MySQL and also got the dialup web GUI up and running. However its still not clear to me how I add new NAS devices, you dont appear to be able to do that in the GUI. I just want to add a system by IP address with a secret. Do I need to manually do an insert into mysql? If so can someone give me a pointer to how the data should be entered? Or any other help!! thanks! Andy.

2 1