- Freeradius-Users - lists.freeradius.org

Moving to 3.0.x series and crashes
by Miika Räisänen 14 Dec '15

14 Dec '15

Hi, I've been trying to upgrade our eduroam radius server 2.1.12 to 3.0.10 or newer. Our wifi is configured to authenticate 802.1X PEAP/mschapv2 -> freeradius -> Microsoft ad. In test environment freeradius works ok but in production it randomly crashes. With 3.0.10 I got some crash but did not catch any info about it and I just decided to try directly git version without any crash investigation. So last night (2nd dec) I pulled 3.0.x from git, compiled and put it on production. It survide about 12 hours and crashed with messages below Thu Dec 3 08:16:21 2015 : Auth: (22577) Login OK: [host/tatk032054.univ.yo.oulu.fi] (from client cisco_aps port 13 cli f8-16-54-f1-5d-33) Thu Dec 3 08:16:25 2015 : ERROR: (22589) mschap: ERROR: Program returned code (1) and output 'Password expired (0xc0000071)' Thu Dec 3 08:16:25 2015 : ERROR: (22589) mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' Thu Dec 3 08:16:25 2015 : Error: ASSERT FAILED src/modules/rlm_mschap/rlm_mschap.c[1751]: nt_password CAUGHT SIGNAL: Aborted Backtrace of last 42 frames: /usr/local/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7faabee6c4c2] /usr/local/lib/libfreeradius-server.so(rad_assert_fail+0x46)[0x7faabf0cbe39] /usr/local/lib/rlm_mschap.so(+0x5624)[0x7faab9905624] /usr/local/sbin/radiusd[0x4283e4] /usr/local/sbin/radiusd[0x428aa4] /usr/local/sbin/radiusd[0x4285ba] /usr/local/sbin/radiusd[0x4294d8] /usr/local/sbin/radiusd(modcall+0xa2)[0x42a21d] /usr/local/sbin/radiusd(indexed_modcall+0x363)[0x425c2f] /usr/local/sbin/radiusd(process_authenticate+0x22)[0x427cd6] /usr/local/lib/rlm_eap_mschapv2.so(+0x25ff)[0x7faab62215ff] /usr/local/lib/rlm_eap.so(+0x3f55)[0x7faaba72bf55] /usr/local/lib/rlm_eap.so(eap_method_select+0x421)[0x7faaba72c888] /usr/local/lib/rlm_eap.so(+0x2c07)[0x7faaba72ac07] /usr/local/sbin/radiusd[0x4283e4] /usr/local/sbin/radiusd[0x428aa4] /usr/local/sbin/radiusd[0x4285ba] /usr/local/sbin/radiusd[0x4294d8] /usr/local/sbin/radiusd(modcall+0xa2)[0x42a21d] /usr/local/sbin/radiusd(indexed_modcall+0x363)[0x425c2f] /usr/local/sbin/radiusd(process_authenticate+0x22)[0x427cd6] /usr/local/sbin/radiusd[0x40f583] /usr/local/sbin/radiusd(rad_authenticate+0x51e)[0x40fe9c] /usr/local/sbin/radiusd(rad_virtual_server+0x110)[0x4104b9] /usr/local/lib/rlm_eap_peap.so(eappeap_process+0xe68)[0x7faab6428a12] /usr/local/lib/rlm_eap_peap.so(+0x1fd3)[0x7faab6425fd3] /usr/local/lib/rlm_eap.so(+0x3f55)[0x7faaba72bf55] /usr/local/lib/rlm_eap.so(eap_method_select+0x421)[0x7faaba72c888] /usr/local/lib/rlm_eap.so(+0x2c07)[0x7faaba72ac07] /usr/local/sbin/radiusd[0x4283e4] /usr/local/sbin/radiusd[0x428aa4] /usr/local/sbin/radiusd[0x4285ba] /usr/local/sbin/radiusd[0x4294d8] /usr/local/sbin/radiusd(modcall+0xa2)[0x42a21d] /usr/local/sbin/radiusd(indexed_modcall+0x363)[0x425c2f] /usr/local/sbin/radiusd(process_authenticate+0x22)[0x427cd6] /usr/local/sbin/radiusd[0x40f583] /usr/local/sbin/radiusd(rad_authenticate+0x51e)[0x40fe9c] /usr/local/sbin/radiusd[0x43cca9] /usr/local/sbin/radiusd[0x438939] /lib64/libpthread.so.0(+0x7df5)[0x7faabd943df5] /lib64/libc.so.6(clone+0x6d)[0x7faabd43a1ad] No panic action set _EXIT(1) CALLED src/lib/debug.c[745]. Last error was: Internal sanity check 3352 [root@pc184005 ~]# I know I may should provide more info, but should I set panic action or compile fr with debug etc? Looks like it has something to do with mschapv password change so heres my mschap.conf http://cc.oulu.fi/~mtr/radius/mschap

4 8

Re: Pairing a network user to an SIP ID
by fred diziel 14 Dec '15

14 Dec '15

Hello all, Thank you for the respones mr. Anirudh, >Yes alan is correct in saying that freeradius cannot send anything to the NAS >other that access-accept or reject. >But what you can actually do is rewrite the username and password >when user authenticates for the second time(see policy.conf) to opensip. >it should be given in the section of authorize but before the auth module >whichever you are using. So if this helps you cannot send the username >to the user which should to be used but you can rewrite. >Just have to design a policy :) I see, this does provide another option, I will try to configure the policy design Thank you for the advice mr. Anirudh

1 0

Getting User Group in Default file
by Muhammad Usman 13 Dec '15

13 Dec '15

Hi, I want to get the user group attribute from database for a comparison in default file, but currently I have {user-name} variable, how can I find the user group (saved in radusergroup table) in the default file. I want to compare the an attribute using unlang for decision making. e.g. If("*mysql query get attribute for user*" == daily) { Dailyresetcounter } If("*mysql query get attribute for user*" == never) { Neverresetcounter } Thanks

2 2

rlm_sqlcounter reset value
by Muhammad Usman 13 Dec '15

13 Dec '15

Hi, I have configured successfully the rlm_sqlcounter module and set the "reset" attribute to daily and its working properly, but I was wondering if it is possible to have this attribute dynamic for each user, based on SQL query, meaning rather than defining a static value in configuration file, is it possible to define a SQL query that runs each time and gets the value from database. Thanks

3 8

Re: Pairing a network user to an SIP ID
by fred diziel 13 Dec '15

13 Dec '15

Hello all, Thank you for the response again mr. Alan, > After Alice is connected to the network, Alice then tries to connect to the SIP server with user A ID. > Why? Because I want to try to pair two user, mainly in my case a network user and an SIP ID, so user A is paired with user B, if it's possible, then when went on like I explained. > RADIUS can't do that. > It can accept or reject users. That's it. It can't tell users to try a different username. > No. RADIUS doesn't do it. OpenSIP doesn't do it. > Get the users to log in with the correct credentials. I see, so it's not possible with either one of it, thank you for the explanation and your time, I believe this has answered my question.

2 1

Re: Pairing a network user to an SIP ID‏
by fred diziel 12 Dec '15

12 Dec '15

Hello all, Thanks for the response mr. Alan, > I'm not sure what you mean by that. The server authenticates users. It doesn't care where the user comes from. > So, yes... the server will authenticate anyone who's using a known name and password. I apologize if it's a bit confusing, what I mean is like this, I have two user IDs, user A is used for the network, and user B is for the SIP ID. Let's say the user is Alice, first, Alice will be authenticated and authorized to use the network with user A ID. After Alice is connected to the network, Alice then tries to connect to the SIP server with user A ID. The sip server, in this case opensips who uses freeradius as its AAA server, will contact freeradius with the information of user A. Then, freeradius recognize that user A is assigned to user B as its SIP ID, and freeradius proceed to reply with user B info to be used by Alice. After Alice got the info of user B ID, then she changes its ID to user B, and retry to connect to opensips again. Then freeradius authenticate and authorize as usual, finally Alice can use the SIP service. is it possible to do this in freeradius? Also, I apologize again for forgetting the server version, here is the server version freeradius-server-2.2.9 opensips-2.1.1 ubuntu 12.04 lts thank you for the responses

2 1

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 11 Dec '15

11 Dec '15

Thanks for that Arran. I'll check it a bit later. Weird that it worked on 2 field tables then failed when i moved to 4. Thanks again Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 11 December 2015 16:37 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > On Dec 11, 2015, at 11:09 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Hi. Maybe spoke too soon.. > Any chance this crash is not something I have done? Pushed fix... Looks like this is an old bug. Maybe MySQL have messed up the version macro :/ -Arran

1 0

RE: Reverse string concatenation for multiple attributes
by Franks Andy (IT Technical Architecture Manager) 11 Dec '15

11 Dec '15

Hi. Maybe spoke too soon.. Any chance this crash is not something I have done? thanks Andy (0) EXPAND call get_active_sessions_for_switchport ('%{NAS-IP-Address}', '%{NAS-Port}', 864000) (0) --> call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000) (0) Tmp-String-0 := "call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000)" (0) } # update control = noop (0) map sql_SP_rsh-radius-lant &control:Tmp-String-0 { rlm_sql (sql_SP_rsh-radius-lant): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql_SP_rsh-radius-lant): Opening additional connection (0), 1 of 10 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on rsh-radius-sql via TCP/IP, server version 5.5.31-0ubuntu0.13.04.1, protocol version 10 rlm_sql (sql_SP_rsh-radius-lant): Reserved connection (0) (0) Executing select query: call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000) Program received signal SIGSEGV, Segmentation fault. (gdb) bt #0 0x00007ffff08fcce0 in mysql_num_fields () from /usr/lib/x86_64-linux-gnu/libmysqlclient.so.18 #1 0x00007ffff0dfdf0c in sql_fields (out=0x7fffffffc3c0, handle=0xd48e20, config=0xb3d1c0) at src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c:444 #2 0x00007ffff10046bc in mod_map_proc (mod_inst=0xb3d1c0, proc_inst=0x0, request=0xd03880, query=0xd537d0 "call get_active_sessions_for_switchport ('192.168.105.86', '2', 864000)", maps=0xcc19b0) at src/modules/rlm_sql/rlm_sql.c:332 #3 0x00007ffff7bac416 in map_proc (request=0xd03880, inst=0xcc2310) at src/main/map_proc.c:234 #4 0x000000000042b1d7 in modcall_recurse (request=0xd03880, component=MOD_AUTHORIZE, depth=2, entry=0x7fffffffd870, do_next_sibling=true) at src/main/modcall.c:649 #5 0x000000000042a86c in modcall_child (request=0xd03880, component=MOD_AUTHORIZE, depth=2, entry=0x7fffffffd858, c=0xcc1770, result=0x7fffffffcc40, do_next_sibling=true) at src/main/modcall.c:434 #6 0x000000000042ba7a in modcall_recurse (request=0xd03880, component=MOD_AUTHORIZE, depth=1, entry=0x7fffffffd858, do_next_sibling=true) at src/main/modcall.c:834 #7 0x000000000042a86c in modcall_child (request=0xd03880, component=MOD_AUTHORIZE, depth=1, entry=0x7fffffffd840, c=0xca31a0, result=0x7fffffffd280, do_next_sibling=true) at src/main/modcall.c:434 #8 0x000000000042ba7a in modcall_recurse (request=0xd03880, component=MOD_AUTHORIZE, depth=0, entry=0x7fffffffd840, do_next_sibling=true) at src/main/modcall.c:834 #9 0x000000000042c8e2 in modcall (component=MOD_AUTHORIZE, c=0xca30b0, request=0xd03880) at src/main/modcall.c:1179 #10 0x0000000000427be8 in indexed_modcall (comp=MOD_AUTHORIZE, idx=0, request=0xd03880) at src/main/modules.c:956 #11 0x0000000000429f86 in process_authorize (autz_type=0, request=0xd03880) at src/main/modules.c:2091 #12 0x000000000040fbd7 in rad_authenticate (request=0xd03880) at src/main/auth.c:435 #13 0x000000000043bf64 in request_running (request=0xd03880, action=1) at src/main/process.c:1482 #14 0x000000000043ac6a in request_queue_or_run (request=0xd03880, process=0x43be02 <request_running>) at src/main/process.c:953 #15 0x000000000043c86c in request_receive (ctx=0xd03590, listener=0xae72f0, packet=0xd035f0, client=0xacb540, fun=0x40f934 <rad_authenticate>) at src/main/process.c:1740 #16 0x0000000000419bd7 in auth_socket_recv (listener=0xae72f0) at src/main/listen.c:1901 #17 0x0000000000443a50 in event_socket_handler (xel=0xcf55f0, fd=12, ctx=0xae72f0) at src/main/process.c:4544 #18 0x00007ffff7974d6e in fr_event_loop (el=0xcf55f0) at src/lib/event.c:637 #19 0x0000000000445925 in radius_event_process () at src/main/process.c:5587 #20 0x00000000004339a6 in main (argc=2, argv=0x7fffffffe6d8) at src/main/radiusd.c:578 -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 10 December 2015 22:15 To: FreeRadius users mailing list Subject: Re: Reverse string concatenation for multiple attributes > On 10 Dec 2015, at 16:47, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Awesome, it works! Thanks devs. Everytime I play with FR I learn something new! No problem :) and it's more, every time you come back to FreeRADIUS we've added something new ;) Both those features were added this year. One of the benefits of building from the v3.1.x branch. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Pairing a network user to an SIP ID
by fred diziel 11 Dec '15

11 Dec '15

Hello all, I have successfully implemented opensips with freeradius as AAA server, what I'd like to know is whether it's possible to assign a network user of freeradius to an SIP ID which can be used for opensips. The network is using freeradius as authenticator, after the user have been authenticated and authorized to use the network, then said user will be assigned an SIP ID to use for VoIP calls via opensips. The authentication and authorization of the SIP ID also done in freeradius too. Is it possible to do it in freeradius? Thank you for the answers.

2 1

freeradius Failed to authenticate (mysql)
by Let'sgo 11 Dec '15

11 Dec '15

hi everyone , i config freeradius 3.0,when i execute radtest ,reponse error , "ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject" , i try my best to find answer , but i can't resolve this problem ,please , i would be appreciated ,thanks! Received Access-Request Id 135 from 127.0.0.1:45824 to 127.0.0.1:1812 length 74 User-Name = 'test' User-Password = 'test' NAS-IP-Address = 10.117.14.105 NAS-Port = 1812 Message-Authenticator = 0x6795d9c62f8c6b82dd3e6e6a0ad0c275 (0) Received Access-Request packet from host 127.0.0.1 port 45824, id=135, length=74 (0) User-Name = 'test' (0) User-Password = 'test' (0) NAS-IP-Address = 10.117.14.105 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x6795d9c62f8c6b82dd3e6e6a0ad0c275 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "test", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) sql : EXPAND %{User-Name} (0) sql : --> test (0) sql : SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id' (0) sql : User found in radcheck table Found User-Password == "..." Are you sure you don't mean Cleartext-Password? See "man rlm_pap" for more information (0) sql : Check items matched (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id' (0) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority' (0) sql : User found in the group table (0) sql : EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql : --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'user' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'user' ORDER BY id' (0) sql : Group "user" check items matched (0) sql : EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql : --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'user' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'user' ORDER BY id' (0) sql : Group "user" reply items processed rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (0) WARNING: pap : Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql : EXPAND .query (0) sql : --> .query (0) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND %{User-Name} (0) sql : --> test (0) sql : SQL-User-Name set to 'test' (0) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', ' %S') (0) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test', 'Access-Reject', '2015-12-09 23:33:01') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'test', 'Access-Reject', '2015-12-09 23:33:01')' rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> test (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sending Access-Reject packet to host 127.0.0.1 port 45824, id=135, length=0 Sending Access-Reject Id 135 from 127.0.0.1:1812 to 127.0.0.1:45824 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 135 with timestamp +6 Ready to process requests

4 4