- Freeradius-Users - lists.freeradius.org

Authorize section not getting called
by Michael Sartain 02 Feb '18

02 Feb '18

Apologies if this is a FAQ type question, but I've spent quite a bit of time googling / debugging and haven't been able to track down how a user is getting rejected before the "group authorize" section executes. I'm running FreeRADIUS v2.2.10 on a Synology DS1515 and have two users on the system: $ users admin mikesart My final goal is to add Google two factor authentication, most likely with the perl module. When I run radclient with a username not on the Synology (A), I immediately get a "login incorrect" error message before my authorize section executes. When authorizing "mikesart" (case B), it starts executing the "group authorize" section immediately. If anyone has any tips / suggestions on where this could be configured, I'd really appreciate the help. Thanks much. -Mike ----------------------------- (A) ----------------------------- PC: echo "User-Name=alice,User-Password=passme" | ./radclient -s 10.10.10.61 auth supersecret ----------------------------- Synology: rad_recv: Access-Request packet from host 10.10.10.10 port 34683, id=29, length=45 User-Name = "alice" User-Password = "passme" Login incorrect: Incorrect user name (input name [alice], full name [alice]) There was no response configured: rejecting request 2 Using Post-Auth-Type Reject # Executing group from file /usr/local/synoradius/rad_site_def_local +group REJECT { ... ----------------------------- (B) ----------------------------- PC: echo "User-Name=mikesart,User-Password=password" | ./radclient -s 10.10.10.61 auth supersecret ----------------------------- Synology: rad_recv: Access-Request packet from host 10.10.10.10 port 33230, id=16, length=48 User-Name = "mikesart" User-Password = "password" # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +group authorize { ++[preprocess] = ok ... ----------------------------- radiusd -X ----------------------------- radiusd: FreeRADIUS Version 2.2.10 (git #e5f6b50), for host arm-unknown-linux-gnueabi, built on Jul 19 2017 at 15:44:01 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /var/packages/RadiusServer/target/etc/raddb/radiusd.conf including configuration file /usr/local/synoradius/rad_listen including configuration file /usr/local/synoradius/rad_port_auth including configuration file /usr/local/synoradius/rad_port_auth including configuration file /usr/local/synoradius/rad_port_auth including configuration file /usr/local/synoradius/rad_port_auth including configuration file /usr/local/synoradius/rad_port_auth including configuration file /var/packages/RadiusServer/target/etc/raddb/clients.conf including configuration file /usr/local/synoradius/rad_clients including files in directory /var/packages/RadiusServer/target/etc/raddb/modules/ including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/soh including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/cache including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/preprocess including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/policy including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/ippool including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/attr_rewrite including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/realm including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/always including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/sql_log including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/pam including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/checkval including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/expiration including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/cui including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/smbpasswd including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/radrelay including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/ldap including configuration file /usr/local/synoradius/rad_ldap including configuration file /usr/local/synoradius/rad_ldap_starttls including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/chap including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/replicate including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/passwd including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/ntlm_auth including configuration file /usr/local/synoradius/rad_ntlm_auth including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/krb5 including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/exec including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/detail.log including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/unix including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/detail including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/attr_filter including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/detail.example.com including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/perl including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/digest including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/radutmp including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/synorad including configuration file /usr/local/synoradius/synoconf ;;; back_end_type="local" including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/pap including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/echo including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/dynamic_clients including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/acct_unique including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/redis including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/logintime including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/mschap_ad including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/counter including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/mschap including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/smsotp including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/files including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/inner-eap including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/sradutmp including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/mac2ip including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/expr including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/etc_group including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/dhcp_sqlippool including configuration file /var/packages/RadiusServer/target/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/opendirectory including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/rediswho including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/otp including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/linelog including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/mac2vlan including configuration file /var/packages/RadiusServer/target/etc/raddb/modules/wimax including configuration file /var/packages/RadiusServer/target/etc/raddb/eap.conf including configuration file /usr/local/synoradius/rad_ca_cert including configuration file /var/packages/RadiusServer/target/etc/raddb/policy.conf including files in directory /var/packages/RadiusServer/target/etc/raddb/sites-enabled/ including configuration file /var/packages/RadiusServer/target/etc/raddb/sites-enabled/default including configuration file /usr/local/synoradius/rad_site_def including configuration file /usr/local/synoradius/rad_site_def_local including configuration file /var/packages/RadiusServer/target/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/synoradius/rad_site_inn including configuration file /usr/local/synoradius/rad_site_inn_local including configuration file /usr/local/synoradius/rad_port_inner including configuration file /var/packages/RadiusServer/target/etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /var/packages/RadiusServer/target/etc/raddb/dictionary main { name = "radiusd" prefix = "/var/packages/RadiusServer/target/" localstatedir = "/var/packages/RadiusServer/target//var" sbindir = "/var/packages/RadiusServer/target//sbin" logdir = "/var/packages/RadiusServer/target//var/log/radius" run_dir = "/var/packages/RadiusServer/target//var/run/radiusd" libdir = "/var/packages/RadiusServer/target//lib" radacctdir = "/var/packages/RadiusServer/target//var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/packages/RadiusServer/target//var/run/radiusd/radiusd.pid" checkrad = "/var/packages/RadiusServer/target//sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client 10.10.10.0/24 { require_message_authenticator = no secret = "supersecret" shortname = "radiusclient" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /var/packages/RadiusServer/target/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /var/packages/RadiusServer/target/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /var/packages/RadiusServer/target/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /var/packages/RadiusServer/target/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /var/packages/RadiusServer/target/etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /var/packages/RadiusServer/target/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /var/packages/RadiusServer/target/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /var/packages/RadiusServer/target/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /var/packages/RadiusServer/target/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /var/packages/RadiusServer/target/etc/raddb/modules/unix unix { radwtmp = "/var/packages/RadiusServer/target//var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /var/packages/RadiusServer/target/etc/raddb/eap.conf eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/certificate/RadiusServer/radiusd/privkey.pem" certificate_file = "/usr/local/etc/certificate/RadiusServer/radiusd/fullchain.pem" CA_file = "/usr/local/etc/certificate/RadiusServer/radiusd/syno-ca-cert.pem" private_key_password = "12345" dh_file = "/var/packages/RadiusServer/target/etc/raddb/certs/dh" random_file = "/var/packages/RadiusServer/target/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS" ecdh_curve = "prime256v1" verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /var/packages/RadiusServer/target/etc/raddb/modules/preprocess preprocess { huntgroups = "/var/packages/RadiusServer/target/etc/raddb/huntgroups" hints = "/var/packages/RadiusServer/target/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /var/packages/RadiusServer/target/etc/raddb/huntgroups reading pairlist file /var/packages/RadiusServer/target/etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /var/packages/RadiusServer/target/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /var/packages/RadiusServer/target/etc/raddb/modules/files files { usersfile = "/var/packages/RadiusServer/target/etc/raddb/users" acctusersfile = "/var/packages/RadiusServer/target/etc/raddb/acct_users" preproxy_usersfile = "/var/packages/RadiusServer/target/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /var/packages/RadiusServer/target/etc/raddb/users reading pairlist file /usr/local/synoradius/rad_users reading pairlist file /var/packages/RadiusServer/target/etc/raddb/acct_users reading pairlist file /var/packages/RadiusServer/target/etc/raddb/preproxy_users Module: Linked to module rlm_passwd Module: Instantiating module "smbpasswd" from file /var/packages/RadiusServer/target/etc/raddb/modules/smbpasswd passwd smbpasswd { filename = "/etc/samba/private/smbpasswd" format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" delimiter = ":" ignorenislike = no ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /var/packages/RadiusServer/target/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /var/packages/RadiusServer/target/etc/raddb/modules/detail detail { detailfile = "/var/packages/RadiusServer/target//var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /var/packages/RadiusServer/target/etc/raddb/modules/radutmp radutmp { filename = "/var/packages/RadiusServer/target//var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /var/packages/RadiusServer/target/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/var/packages/RadiusServer/target/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /var/packages/RadiusServer/target/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /var/packages/RadiusServer/target/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/var/packages/RadiusServer/target/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /var/packages/RadiusServer/target/etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /usr/local/synoradius/rad_site_inn_local modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 10.10.10.61 port = 1812 } listen { type = "auth" ipaddr = 127.0.0.1 port = 1812 } listen { type = "auth" ipaddr = 169.254.143.57 port = 1812 } listen { type = "auth" ipaddr = 169.254.159.191 port = 1812 } listen { type = "auth" ipaddr = 169.254.82.235 port = 1812 } listen { type = "control" listen { socket = "/var/packages/RadiusServer/target//var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address 10.10.10.61 port 1812 Listening on authentication address 127.0.0.1 port 1812 Listening on authentication address 169.254.143.57 port 1812 Listening on authentication address 169.254.159.191 port 1812 Listening on authentication address 169.254.82.235 port 1812 Listening on command file /var/packages/RadiusServer/target//var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests.

3 5

groupname value
by J E H A N Z A I B 02 Feb '18

02 Feb '18

Hi folks, I think this has been talked about a couple of times in the past but i can not see the reply with the best way to achieve it so pardon me if i am duplicating the issue/concerns. radacct.groupname is empty obviously there is no default query for it. It's not coming in the radaccouting so i don't think we can do in the accounting query either. have someone already done it ? can you please guide us how to do it? I think writing down step by step will be helpful for the community. Our system information: FreeRADIUS Version 3.0.13 5.5.56-MariaDB MariaDB Server CentOS Linux release 7.4 Thanks --- Regards, Jehanzaib

2 5

TLS client and server certificates
by wouldsmina 02 Feb '18

02 Feb '18

Hi, I am currently testing FreeRadius 3.0.12 (debian package). When I'm using the certificates declared in mods-enabled/eap on a TLS client, I get an Access-Accept! This is not dramatic, because these certificates should not be disclosed under any circumstances, but I would still like to know if it's a normal behavior and how to prevent it? Thanks.

3 5

API capabilities
by Tunc Gunergun 01 Feb '18

01 Feb '18

Hi Guys, Hope you are well. I never installed/used free radius before however I'm tasked to assess its Rest API capabilities and see whether following 802.1.x use case is workable. - Controller asks FreeRadius to block a specific IP address via API; - FreeRadius finds who owns that IP from authenticated user list; - FreeRadius sends Radius CoA to 802.1x authenticator (Switch) a. to reset user session (reject user authentication at next attempt or put user into default vlan) b. to reset user session and put user into a quarantine vlan X - Controller ask FreeRadius to unblock (release) a specific IP address via API. a. same as above but in reverse order b. same as above but in reverse order. Many thanks for your support in advance. Cheers Matt

3 2

BYOD and base on MAC
by Luc Paulin 01 Feb '18

01 Feb '18

Hi, I know that we can do a BYOD wireless setup with freeradius base on if the client setup was setup with certificate(EAP-TLS) or not by checking the EAP-Type field. But I was wondering would it be possible to do it base on MAC adresse. The idea here is that we would like to move user to the appropriate vlan base on his device mac. If MAC address is within that list, device is granted to the corp vlan, else it'll default to the BYOD vlan. In the post-auth section I did add some lines in order to try do the check base on mac addresse ======== # We rewrite calling_station_id in order to do mac checkup rewrite_calling_station_id # Check against the authorized_macs file authorized_macs if (!ok) { update reply { Tunnel-Type := 13 Tunnel-Medium-Type := 6 Tunnel-Private-Group-Id := 155 } } else { update reply { Tunnel-Type := 13 Tunnel-Medium-Type := 6 Tunnel-Private-Group-Id := 157 } } ======== However look like the authorized_macs always return noop. Am I doing something wrong or something not supported? Thanx !! -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

3 11

Problem authentication Windows 10
by Arnaud Forster 01 Feb '18

01 Feb '18

Hello, Since a few weeks now, several users using Windows 10 cannot authenticate anymore. It seems that an update from Windows 10 (Update 1703) could be the source of this problem. Does anyone has informations about that or a way to solve this possible issue ? Thanks to all for your help Arnaud

3 3

Can't use winbind in 3.0.16
by Jonathan Gazeley 01 Feb '18

01 Feb '18

I have just started upgraded from 3.0.15 to 3.0.16 (the latter being installed directly from http://packages.networkradius.com/centos/7/repo/) I now cannot start up the daemon and in debug mode it fails : radiusd -X ... # Instantiating module "eduroammschap" from file /etc/raddb/mods-enabled/eduroammschap /etc/raddb/mods-enabled/eduroammschap[10]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/eduroammschap[10]: Instantiation failed for module "eduroammschap" My eduroammschap module is configured to use a winbind handle rather than a call to ntlm_auth, as recommend by Matthew Newton a while ago. [jg4461@radius-dev ~]$ cat /etc/raddb/mods-enabled/eduroammschap | grep -v '#' mschap eduroammschap { winbind_username = "%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}}" winbind_domain = "%{eduroammschap:NT-Domain}" pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } passchange { } allow_retry = no retry_msg = "Verify username and re-enter your password" } I've been building the RPM myself from the official tarball + spec file up until now, but is the official RPM built differently? Thanks, Jonathan

5 8

freeRadius leaking memory
by Nicolas Reich 01 Feb '18

01 Feb '18

Hi, I'm running some tests on the freeRadius server I'm working on (which uses only EAP-TLS) to see what sort of load it can handle, and to tune the configuration accordingly. Doing this, I've noticed that the memory used by the radiusd process continually increases, until the system is out of memory, a clear sign of memory leaking. So I kept experimenting and I got quite sure there is some memory leaking. So I tried with Valgrind, and here's what I got after 1 minute (approximately 75 access requests): LEAK SUMMARY: definitely lost: 46,978 bytes in 327 blocks indirectly lost: 893,915 bytes in 5,922 blocks possibly lost: 2,228,808 bytes in 4,792 blocks still reachable: 1,599,763 bytes in 32,997 blocks suppressed: 0 bytes in 0 blocks Reachable blocks (those to which a pointer was found) are not shown. To see them, rerun with: --leak-check=full --show-leak-kinds=all Those are the biggest for "definitely lost": 214,180 (7,676 direct, 206,504 indirect) bytes in 76 blocks are definitely lost in loss record 1,696 of 1,700 at 0x4C2DB9D: malloc (vg_replace_malloc.c:299) by 0x5B9697F: _talloc_array (in /usr/lib64/libtalloc.so.2.1.9) by 0x50814BF: talloc_bstrndup (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x509121F: value_data_from_str (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x5082207: fr_pair_value_from_str (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x50826A7: fr_pair_make (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x148961: cbtls_verify (in /usr/sbin/radiusd) by 0x561AE84: ??? (in /usr/lib64/libcrypto.so.1.0.2m) by 0x561CE5F: X509_verify_cert (in /usr/lib64/libcrypto.so.1.0.2m) by 0x5964137: ssl_verify_cert_chain (in /usr/lib64/libssl.so.1.0.2m) by 0x593AF78: ssl3_get_client_certificate (in /usr/lib64/libssl.so.1.0.2m) by 0x593C7D7: ssl3_accept (in /usr/lib64/libssl.so.1.0.2m) 509,668 (26,928 direct, 482,740 indirect) bytes in 153 blocks are definitely lost in loss record 1,698 of 1,700 at 0x4C2DB9D: malloc (vg_replace_malloc.c:299) by 0x5B95DFA: _talloc_zero (in /usr/lib64/libtalloc.so.2.1.9) by 0x5081901: ??? (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x5081A12: fr_pair_afrom_da (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x5082598: fr_pair_make (in /usr/lib64/freeradius/libfreeradius-radius.so) by 0x148961: cbtls_verify (in /usr/sbin/radiusd) by 0x561AE84: ??? (in /usr/lib64/libcrypto.so.1.0.2m) by 0x561CE5F: X509_verify_cert (in /usr/lib64/libcrypto.so.1.0.2m) by 0x5964137: ssl_verify_cert_chain (in /usr/lib64/libssl.so.1.0.2m) by 0x593AF78: ssl3_get_client_certificate (in /usr/lib64/libssl.so.1.0.2m) by 0x593C7D7: ssl3_accept (in /usr/lib64/libssl.so.1.0.2m) by 0x5948801: ssl3_read_bytes (in /usr/lib64/libssl.so.1.0.2m) And those for "possibly lost": 567,552 bytes in 32 blocks are possibly lost in loss record 1,700 of 1,700 at 0x4C2DB9D: malloc (vg_replace_malloc.c:299) by 0x55277E7: CRYPTO_malloc (in /usr/lib64/libcrypto.so.1.0.2m) by 0x5949CD2: ssl3_setup_read_buffer (in /usr/lib64/libssl.so.1.0.2m) by 0x5949E28: ssl3_setup_buffers (in /usr/lib64/libssl.so.1.0.2m) by 0x594B484: ssl23_get_client_hello (in /usr/lib64/libssl.so.1.0.2m) by 0x594BC5B: ssl23_accept (in /usr/lib64/libssl.so.1.0.2m) by 0x594CDC1: ssl23_read (in /usr/lib64/libssl.so.1.0.2m) by 0x14BE29: tls_handshake_recv (in /usr/sbin/radiusd) by 0x52B115E: eaptls_process (in /usr/lib64/freeradius/libfreeradius-eap.so) by 0xBBCCD0D: ??? (in /usr/lib64/freeradius/rlm_eap_tls.so) by 0xAFAB571: ??? (in /usr/lib64/freeradius/rlm_eap.so) by 0xAFABA99: eap_method_select (in /usr/lib64/freeradius/rlm_eap.so) 559,872 bytes in 32 blocks are possibly lost in loss record 1,699 of 1,700 at 0x4C2DB9D: malloc (vg_replace_malloc.c:299) by 0x55277E7: CRYPTO_malloc (in /usr/lib64/libcrypto.so.1.0.2m) by 0x5949DCC: ssl3_setup_write_buffer (in /usr/lib64/libssl.so.1.0.2m) by 0x5949E37: ssl3_setup_buffers (in /usr/lib64/libssl.so.1.0.2m) by 0x594B484: ssl23_get_client_hello (in /usr/lib64/libssl.so.1.0.2m) by 0x594BC5B: ssl23_accept (in /usr/lib64/libssl.so.1.0.2m) by 0x594CDC1: ssl23_read (in /usr/lib64/libssl.so.1.0.2m) by 0x14BE29: tls_handshake_recv (in /usr/sbin/radiusd) by 0x52B115E: eaptls_process (in /usr/lib64/freeradius/libfreeradius-eap.so) by 0xBBCCD0D: ??? (in /usr/lib64/freeradius/rlm_eap_tls.so) by 0xAFAB571: ??? (in /usr/lib64/freeradius/rlm_eap.so) by 0xAFABA99: eap_method_select (in /usr/lib64/freeradius/rlm_eap.so) I am unsure on how to proceed next though. Any advice? Could it be a misconfiguration? Could it be a problem in OpenSSL? I have freeRadius 3.0.15 and OpenSSL 1.0.2m on Fedora 25. Thanks in advance, and regards, Nicolas

2 1

Huntgroup-Name
by Carsten Schulze 01 Feb '18

01 Feb '18

Hi, I use the huntgroup text file for my NAS myshare NAS-IP-Address == 192.168.102.43 and now I would like to do a check in sites-enabled/default post-auth { (0) if ("%{Huntgroup-Name}" == "myshare") { (0) ERROR: Failed retrieving values required to evaluate condition (0) else { How could I access/or is there a variable with the name of the huntgroup? There are only examples using sql :(. Thanks + Regards Carsten

3 5

minor bug on Redhat/Centos init/starup script
by Stefano Mason 01 Feb '18

01 Feb '18

Dear Alan, I just cloned the https://github.com/FreeRADIUS/freeradius-server.git and cd freeradius-server git checkout -b v3.0.x origin/v3.0.x cd redhat [smason@betty redhat]$ grep RuntimeDirectory radiusd.service RuntimeDirectory=/var/run/radiusd RuntimeDirectoryMode=0775 [smason@betty redhat]$ Please substitute RuntimeDirectory=/var/run/radiusd with RuntimeDirectory=radiusd because, this parameter RuntimeDirectory should be filled with relative path, as from "man" reported (man systemd.exec): RuntimeDirectory= Takes a list of directory names. If set, one or more directories by the specified names will be created below /run (for system services) or below $XDG_RUNTIME_DIR (for user services) when the unit is started, and removed when the unit is stopped. The directories will have the access mode specified in RuntimeDirectoryMode=, and will be owned by the user and group specified in User= and Group=. Use this to manage one or more runtime directories of the unit and bind their lifetime to the daemon runtime. The specified directory names must be relative, and may not include a "/", i.e. must refer to simple directories to create or remove. This is particularly useful for unprivileged daemons that cannot create runtime directories in /run due to lack of privileges, and to make sure the runtime directory is cleaned up automatically after use. For runtime directories that require more complex or different configuration or lifetime guarantees, please consider using tmpfiles.d(5). To replicate the bug is necessary to reboot the system, because the /var/run will be empty during the first phases of a booting system. The /var/run/radiusd will be created only in case the content of RuntimeDirectory variable will be radiusd. Best regards. Stefano

2 1