- Freeradius-Users - lists.freeradius.org

FR 3.0.13 "swallowing" Requests when acting as a home server?
by Martin Pauly 30 Mar '17

30 Mar '17

Hi, apart from the Debian package issues reported earlier, I ran into another problem which I'm pretty sure can be attributed to some change between 3.0.12 and 3.0.13. After I had worked around the Debian package issues (on Jessie) and installed 3.0.13, I found proxied requests from my "border server" to NOT show up in the home server -- but only every now and then. Due to the intermittent nature of that problem and because we have two servers of each kind for redundancy, it took me some time to realize what was going on. So after more than a week of intermittent, short-lived failures, I first migrated the home servers back to 3.0.12. That moment, the problem was gone. Meanwhile the border servers are back to 3.0.12, too, and things have remained well. The _only_ thing I changed during the 3.0.13 period was a Samba/winbind security update which had no visible effect. Sorry for this pretty superficial report, but right now I do not have the time to set up a test environment where I could test the current development versions from git. Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 1

rlm_perl returning attributes
by Ryan De Kock 30 Mar '17

30 Mar '17

Hi. I'm trying to return an attribute using the rlm_rest module. Authentication works fine but when a response is sent, an Access-Reject is generated. I'm hoping someone can point me in the right direction. *Working auth *(with no attributes in the response) (8) Cleaning up request packet ID 178 with timestamp +606 Ready to process requests (9) Received Access-Request Id 17 from 127.0.0.1:45433 to 127.0.0.1:1812 length 77 (9) User-Name = "585c208457bf8c3820c9e431(a)test.com" (9) User-Password = "password" (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) authorize { rlm_rest (rest): Reserved connection (16) (9) rest: Expanding URI components (9) rest: EXPAND http://127.0.0.1:1337 (9) rest: --> http://127.0.0.1:1337 (9) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (9) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (9) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (9) rest: Processing response header (9) rest: Status : 201 (Created) (9) rest: Type : json (application/json) rlm_rest (rest): Released connection (16) rlm_rest (rest): Need 1 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (17), 1 of 30 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" (9) [rest] = ok (9) if (ok || updated) { (9) if (ok || updated) -> TRUE (9) if (ok || updated) { (9) update control { (9) Auth-Type := Rest (9) } # update control = noop (9) } # if (ok || updated) = noop (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = ok (9) } # policy filter_username = ok (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: Looking up realm "test.com" for User-Name = " 585c208457bf8c3820c9e431(a)test.com" (9) suffix: No such realm "test.com" (9) [suffix] = noop (9) eap: No EAP-Message, not doing EAP (9) [eap] = noop (9) [files] = noop (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (9) pap: WARNING: Authentication will fail unless a "known good" password is available (9) [pap] = noop (9) } # authorize = ok (9) Found Auth-Type = Rest (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) Auth-Type Rest { rlm_rest (rest): Reserved connection (15) (9) rest: Expanding URI components (9) rest: EXPAND http://127.0.0.1:1337 (9) rest: --> http://127.0.0.1:1337 (9) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (9) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (9) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (9) rest: Processing response header (9) rest: Status : 201 (Created) (9) rest: Type : json (application/json) rlm_rest (rest): Released connection (15) (9) [rest] = ok (9) } # Auth-Type Rest = ok (9) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (9) post-auth { (9) update { (9) No attributes updated (9) } # update = noop (9) [exec] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # post-auth = noop (9) Sent Access-Accept Id 17 from 127.0.0.1:1812 to 127.0.0.1:45433 length 0 (9) Finished request Waking up in 4.9 seconds. *exactly the same auth*, except I try return some values (8) Received Access-Request Id 178 from 127.0.0.1:41930 to 127.0.0.1:1812 length 77 (8) User-Name = "585c208457bf8c3820c9e431(a)test.com" (8) User-Password = "password" (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) authorize { rlm_rest (rest): Closing connection (13): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (14): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): Closing connection (12): Hit idle_timeout, was idle for 239 seconds rlm_rest (rest): You probably need to lower "min" rlm_rest (rest): 0 of 0 connections in use. You may need to increase "spare" rlm_rest (rest): Opening additional connection (15), 1 of 32 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" rlm_rest (rest): Reserved connection (15) (8) rest: Expanding URI components (8) rest: EXPAND http://127.0.0.1:1337 (8) rest: --> http://127.0.0.1:1337 (8) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (8) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (8) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (8) rest: Processing response header (8) rest: Status : 201 (Created) (8) rest: Type : json (application/json) (8) rest: Parsing attribute "Mikrotik-Address-List" (8) rest: EXPAND myList (8) rest: --> myList (8) rest: Mikrotik-Address-List := "myList" rlm_rest (rest): Released connection (15) rlm_rest (rest): Need 2 more connections to reach 10 spares rlm_rest (rest): Opening additional connection (16), 1 of 31 pending slots used rlm_rest (rest): Connecting to "http://127.0.0.1:1337" (8) [rest] = updated (8) if (ok || updated) { (8) if (ok || updated) -> TRUE (8) if (ok || updated) { (8) update control { (8) Auth-Type := Rest (8) } # update control = noop (8) } # if (ok || updated) = noop (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = updated (8) } # policy filter_username = updated (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "test.com" for User-Name = " 585c208457bf8c3820c9e431(a)test.com" (8) suffix: No such realm "test.com" (8) [suffix] = noop (8) eap: No EAP-Message, not doing EAP (8) [eap] = noop (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = Rest (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Auth-Type Rest { rlm_rest (rest): Reserved connection (15) (8) rest: Expanding URI components (8) rest: EXPAND http://127.0.0.1:1337 (8) rest: --> http://127.0.0.1:1337 (8) rest: EXPAND /Radius/auth?username=%{User-Name}&password=%{User-Password} (8) rest: --> /Radius/auth?username=585c208457bf8c3820c9e431%40test.com &password=password (8) rest: Sending HTTP GET to " http://127.0.0.1:1337/Radius/auth?username=585c208457bf8c3820c9e431%40test.… " (8) rest: Processing response header (8) rest: Status : 201 (Created) (8) rest: Type : json (application/json) (8) rest: Parsing attribute "Mikrotik-Address-List" (8) rest: EXPAND myList (8) rest: --> myList (8) rest: Mikrotik-Address-List := "myList" rlm_rest (rest): Released connection (15) (8) [rest] = updated (8) } # Auth-Type Rest = updated (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> 585c208457bf8c3820c9e431(a)test.com (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.7 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 178 from 127.0.0.1:1812 to 127.0.0.1:41930 length 20 Waking up in 3.9 seconds. It seems that because rest updated the user that it now fails for some reason (8) [rest] = updated (8) } # Auth-Type Rest = updated (8) Failed to authenticate the user What do I need to change to allow this process to go through? I would appreciate any light shedding.

2 3

Newly added user dont get authentication in free radius
by Rauf Khan 30 Mar '17

30 Mar '17

Hi there! I have recently configured free radius. The users i created first time works well but when i added new users to the user file i got error while trying radtest for new users. Rauf Khan IT Manager KUST, Kohat Phone: 92-922-554434 Cell: 0334-8343004

3 2

Problem In Freeradius 3.0.11
by تعلم البرمجة 30 Mar '17

30 Mar '17

Hello , Iam using Freeradius 3.0.11 And I am using this code in /etc/raddb/default authorize { .... update control { Auth-Type := `/usr/bin/php /var/www/html/set_auth_type.php %{User-Name} %{User-Password} %{Client-IP-Address} 3` } } } in v2.1.x iam using this code in php if ($username == "Name"){ echo "Reject"; }else{ echo "Ok"; } I am Using Ok To Skip But in v3.0.11 Not Skip But Get Error And When Using Accept user Login Without Check Attributes Sorry For My English

2 1

Loading new clients without a restart
by Clayton Knorr 30 Mar '17

30 Mar '17

Suppose you're loading your clients in from LDAP or SQL, and you need adding new clients to be relatively dynamic. Reloads don't pull in the clients, just restarts. I assume other people have run into this issue and didn’t want to restart Freeradius once a day or more just to load a new client. Are there some clever solutions out there anybody has come up with? Or a super secret feature I don't know about?

3 4

Logging off MS Chapp error messages
by Arnab Roy 29 Mar '17

29 Mar '17

Hi All, I am just trying to figure out if its possible to log the following MS-Chap error messages via linelog mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' (8) mschap: External script failed (8) mschap: ERROR: External script says: Logon failure (0xc000006d) (8) mschap: ERROR: MS-CHAP2-Response is incorrect By using %{reply:MS-CHAP-Error}, I get something like this E=691 R=1 C=3c30753bced696c552fc3c78aeb953b0 V=3 M=Authentication failed But that is not as descriptive of the issue as above. Any suggestions would be great. Many Thanks Arnab

2 2

FreeRadius and multiotp
by Alex Sharaz 29 Mar '17

29 Mar '17

Hi, Anyone using multiotp with freeradius to implement two-factor auth? Their test VM has freeradius 2.x installed, which is fine for testing. I've set this up and have successfully "checked" my userid using an OTP and prefix. However can't find any reference to what to do when trying to pass credentials into multiotp via freeradius. Am I just concatenating normal password with prefix and OTP value? A

2 1

Unstructured Attr-26 in unlang
by Brian Candler 29 Mar '17

29 Mar '17

(FreeRADIUS 3.0.13 under CentOS) I am trying to deal with a broken device (Aten) which requires an unstructured attribute 26 [^1]. Using the 'files' module this works [^2]: bob Cleartext-Password := "hello" # Vendor-Specific = "su/administrator" Attr-26 = 0x73752f61646d696e6973747261746f72 But in unlang, this is not accepted: update reply { # Vendor-Specific = "su/administrator" &Attr-26 = 0x73752f61646d696e6973747261746f72 } Tue Mar 28 14:01:27 2017 : Error: /etc/raddb/policy.d/localpolicy[155]: Invalid vendor name in attribute name "0x73752f61646d696e6973747261746f72" Here's the only bit of source I can find which generates that error message: if (strncasecmp(p, "Attr-", 5) != 0) { if (strncasecmp(p, "Vendor-", 7) == 0) { ... /* must be vendor name */ } else { char buffer[256]; q = strchr(p, '-'); if (!q) { fr_strerror_printf("Invalid vendor name in attribute name \"%s\"", name); return -1; } I don't understand why it thinks the attribute *name* is "0x73752f61"... rather than "Attr-26" And if I try this: update reply { &Attr-26 = "su/administrator" } Tue Mar 28 14:25:56 2017 : Error: /etc/raddb/policy.d/localpolicy[154]: Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...' That's an even stranger error: I *am* using Attr-26 like it says!! Any suggestions how I can get this to work, other than switching from unlang to files module? Thanks, Brian. [^1] It is so broken that it doesn't even use a vendor ID in the first four bytes. But I am happy to define a fake vendor which has the correct four bytes. And RFC 2865 *does* permit unstructured data after the 4 bytes of vendor ID. [^2] tcpdump confirms it's as expected: 0x0050: .... 1a12 7375 2f61 646d 696e 6973 7472 ....su/administr 0x0060: 6174 6f72 ator

3 4

3.0.13 crash
by Stefan Winter 28 Mar '17

28 Mar '17

Hi, updating from 3.0.12 to 3.0.13, I see that the servers starts up fine, starts processing packets for a few seconds, and then: Wed Mar 15 09:27:55 2017 : ERROR: (579) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xecf67dfde9f1649a Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value CAUGHT SIGNAL: Aborted Backtrace of last 23 frames: /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f63d355e461] /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(+0xd79c)[0x7f63d355e79c] /lib64/libtalloc.so.2(_talloc_get_type_abort+0xea)[0x7f63d2ae214a] /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(fr_pair_verify+0x85)[0x7f63d356f84b] /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(fr_cursor_init+0x6f)[0x7f63d355d028] /usr/local/freeradius/3.0.13/lib/libfreeradius-eap.so(eaptls_process+0x4c3)[0x7f63d334a1ca] /usr/local/freeradius/3.0.13/lib/rlm_eap_peap.so(+0x1f9c)[0x7f63cd089f9c] /usr/local/freeradius/3.0.13/lib/rlm_eap.so(+0x40f5)[0x7f63cdec00f5] /usr/local/freeradius/3.0.13/lib/rlm_eap.so(eap_method_select+0x431)[0x7f63cdec0add] /usr/local/freeradius/3.0.13/lib/rlm_eap.so(+0x2d01)[0x7f63cdebed01] /usr/local/freeradius/current/sbin/radiusd[0x428c82] /usr/local/freeradius/current/sbin/radiusd[0x42932f] /usr/local/freeradius/current/sbin/radiusd[0x428e43] /usr/local/freeradius/current/sbin/radiusd[0x429d63] /usr/local/freeradius/current/sbin/radiusd(modcall+0xa2)[0x42aaa8] /usr/local/freeradius/current/sbin/radiusd(indexed_modcall+0x363)[0x4262ba] /usr/local/freeradius/current/sbin/radiusd(process_authenticate+0x22)[0x42857f] /usr/local/freeradius/current/sbin/radiusd[0x40f74d] /usr/local/freeradius/current/sbin/radiusd(rad_authenticate+0x51e)[0x410078] /usr/local/freeradius/current/sbin/radiusd[0x43d692] /usr/local/freeradius/current/sbin/radiusd[0x4392c8] /lib64/libpthread.so.0(+0x7dc5)[0x7f63d1e28dc5] /lib64/libc.so.6(clone+0x6d)[0x7f63d192073d] Calling: gdb -silent -x /usr/local/freeradius/config/raddb/panic.gdb /usr/local/freeradius/current/sbin/radiusd 11265 2>&1 | tee /var/log/radius/gdb-radiusd-11265.log Panic action exited with 0 _EXIT(0) CALLED src/lib/debug.c[743] The initial error is fine; it was restarted and lost state on its EAP sessions, so it's confused when half a session comes in. Its reaction to crash on that is not quite so fine :-/ Anyone with ideas? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 2

shared secret (general question)
by Janis Heller 28 Mar '17

28 Mar '17

Because I prepare a small presentation about freeradius, how exactly is the process of sending passwords from a station to the radius server itself? All I know is the shared secret is used and md5 algo, but how exactly is this kind of sensitive data obfuscated? For my example /presentation I use default radius setup (no radsec). All the best;

4 4