- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 125, Issue 34
by Neil Morris 11 Sep '15

11 Sep '15

Alan, Firstly thanks for you responses to date! I do appreciate it.. Apologies for the lack of detail… here is more info FreeRADIUS Version 2.1.12 I have deployed using just the local users file with x3 test accounts including the information that the provider has requested I respond with to complete the auth between our LNS and their BRAS. I had x1 connection up and stable for 3weeks. I shipped out x2 more routers and I start to see some strange behaviour. FR authenticates the session fine but on the router console the interface is reset straight away and so the loop of authentication continues. Running FR in debug/verbose I can see the sessions being authenticated as I would expect with all of the relevant user attributes being passed. The below is what the SP has requested I return to their BRAS; mydom.net.uk Cleartext-Password := “password" Service-Type = Outbound-User, Tunnel-Type = L2TP, Tunnel-Medium-Type = IP, Tunnel-Password = password, Tunnel-Server-Endpoint = 89.x.y.134, Tunnel-Client-Auth-ID = “MY-LNS" The following is an example of a user account and the Cisco AVP that I am sending; test(a)mydom.net.uk Cleartext-Password := “test" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1440, Framed-IP-Address = 10.31.253.253, Framed-IP-Netmask = 255.255.255.255, Framed-Route = "0.0.0.0 0.0.0.0 89.x.y.134", Cisco-AVPair = "ip:vrf-id=VRF_417858", Cisco-Avpair += "ip:route#1=vrf VRF_417858 10.31.249.0 255.255.255.0 10.31.253.253 tag 417858", Cisco-AVPair += "ip:ip-unnumbered=Loopback417858" The SP is advising me that from their debugs I am sending them everything after the username & password as listed above.. They mention that I should have 2 instances for RADIUS or that I change the radius system I use.. Regards Neil Message: 5 Date: Fri, 11 Sep 2015 08:19:56 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius with LNS & Provider BRAS Message-ID: <D70545FB-75A6-41F2-8E25-4E3FE3E06CC0(a)deployingradius.com> Content-Type: text/plain; charset=iso-8859-1 On Sep 11, 2015, at 7:09 AM, Neil Morris <nmorris(a)tibus.com> wrote: > I am looking for some guidance. I am using the users file which contains x3 > user accounts aswell as the domain suffix & the necessary authentication > details for the providers RADIUS server. Under the user accounts I have a > number of cisco avp with VRF & static address etc for the LNS That's a bit vague, but OK. > Whoever The provider is telling me that I am passing all the LNS relate > info to their RADIUS which is causing the tunnel build to fail. That's even more vague. > Is there > something major that I am missing here in relation to my config? A good description of the problem? Alan DeKok. ------------------------------

2 1

sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

Sure, here you go: # Loading post-auth {...} Program received signal SIGSEGV, Segmentation fault. 0x0000000000422471 in do_compile_modgroup (parent=0xabf680, component=MOD_POST_AUTH, cs=0x8acd70, grouptype=0, parentgrouptype=0, mod_type=<value optimized out>) at src/main/modcall.c:2827 2827 if (f->cond->type == COND_TYPE_TRUE) goto skip_true; Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.166.el6_7.1.x86_64 keyutils-libs-1.4-5.el6.x86_64 krb5-libs-1.10.3-42.el6.x86_64 libcom_err-1.41.12-22.el6.x86_64 libselinux-2.0.94-5.8.el6.x86_64 nss-softokn-freebl-3.14.3-23.el6_7.x86_64 openssl-1.0.1e-42.el6.x86_64 zlib-1.2.3-29.el6.x86_64 (gdb) bt #0 0x0000000000422471 in do_compile_modgroup (parent=0xabf680, component=MOD_POST_AUTH, cs=0x8acd70, grouptype=0, parentgrouptype=0, mod_type=<value optimized out>) at src/main/modcall.c:2827 #1 0x000000000042271e in do_compile_modsingle (parent=0xabf680, component=MOD_POST_AUTH, ci=0x8acd70, grouptype=0, modname=0x7fffffffe1d8) at src/main/modcall.c:2193 #2 0x00000000004222ca in do_compile_modgroup (parent=0xabefc0, component=MOD_POST_AUTH, cs=0x8ab7b0, grouptype=0, parentgrouptype=0, mod_type=<value optimized out>) at src/main/modcall.c:2852 #3 0x00000000004227b4 in do_compile_modsingle (parent=0xabefc0, component=MOD_POST_AUTH, ci=0x8ab7b0, grouptype=0, modname=0x7fffffffe408) at src/main/modcall.c:2227 #4 0x000000000041e76a in load_component_section (cs=0x8aad80, components=0xab8b30, comp=MOD_POST_AUTH) at src/main/modules.c:1131 #5 0x000000000041eace in load_byserver (cs=0x8a1e40) at src/main/modules.c:1260 #6 0x000000000041f037 in virtual_servers_load (config=0x685620) at src/main/modules.c:1447 #7 0x0000000000420858 in modules_init (config=0x685620) at src/main/modules.c:2031 #8 0x0000000000425e07 in main (argc=2, argv=<value optimized out>) at src/main/radiusd.c:463 Regards, Mohamed -----Original Message----- From: Mohamed Imran (NBI) Sent: 11 September 2015 13:58 To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Subject: FW: sql query in post-auth - segmentation fault Thanks Arran but Alan's just pointed out the issue. Thanks again for you're your time. Regards, Mohamed -----Original Message----- From: Mohamed Imran (NBI) Sent: 11 September 2015 13:41 To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Subject: sql query in post-auth - segmentation fault Hi Arran, # gdb --args /usr/local/sbin/radiusd -X GNU gdb (GDB) Red Hat Enterprise Linux (7.2-83.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/sbin/radiusd...done. (gdb) bt No stack. (gdb) backtrace full No stack. Regards, Mohamed

1 0

FW: sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

Thanks Arran but Alan's just pointed out the issue. Thanks again for you're your time. Regards, Mohamed -----Original Message----- From: Mohamed Imran (NBI) Sent: 11 September 2015 13:41 To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Subject: sql query in post-auth - segmentation fault Hi Arran, # gdb --args /usr/local/sbin/radiusd -X GNU gdb (GDB) Red Hat Enterprise Linux (7.2-83.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/sbin/radiusd...done. (gdb) bt No stack. (gdb) backtrace full No stack. Regards, Mohamed

2 1

RE: sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

DOH! Thanks Alan....works now (facepalm!) Regards, Mohamed

1 0

sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

Hi Arran, # gdb --args /usr/local/sbin/radiusd -X GNU gdb (GDB) Red Hat Enterprise Linux (7.2-83.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/sbin/radiusd...done. (gdb) bt No stack. (gdb) backtrace full No stack. Regards, Mohamed

2 1

sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

Hi, Having configured FR to talk to our MS SQL server which appears to work fine now (radius -X doesn't complain anymore), I've tried a quick test, a very basic condition to lookup a mac and update reply with a particular VLAN tag if its exists.. and added the following in the post-auth section of the default site. - - - - - - post-auth { - - - - - - - - - - # sql if("%{sql:SELECT COUNT(*) FROM tblwindows WHERE MacAddress ='%{Calling-Station-ID}'}" ==1){ update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = 100 } else { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = 101 } } } radiusd -X reports a segmentation fault: # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql rlm_sql (sql): Attempting to connect to database "Computing" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} Segmentation fault This same sql statement worked fine when I was initially playing around with this and it worked ok against a MySql DB (FR version 2.2.x). Ive also tried the same query against our MSSql server using isql on the same server and that works fine. What am I missing/doing wroing? Regards, Mohamed

3 2

sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

.... just to add to this, im using FR Version 3.0.9 Regards, Mohamed

1 0

Freeradius with LNS & Provider BRAS
by Neil Morris 11 Sep '15

11 Sep '15

Folks, I am looking for some guidance. I am using the users file which contains x3 user accounts aswell as the domain suffix & the necessary authentication details for the providers RADIUS server. Under the user accounts I have a number of cisco avp with VRF & static address etc for the LNS Whoever The provider is telling me that I am passing all the LNS relate info to their RADIUS which is causing the tunnel build to fail. Is there something major that I am missing here in relation to my config? Kind Regards, Neil

2 1

Identity does not match User-Name, setting from EAP Identity. (Freeradius + EAP + MSCHAPv2 + NTLM + AD)
by aquilinux 10 Sep '15

10 Sep '15

Hi all, i'm configuring RADIUS authentication against MS Active Directory. So far i've successfully joined the server to the domain and ntlm_auth works flawlessly: */usr/bin/ntlm_auth --request-nt-key --domain=EA-MILANO --username=srv_backup2 --password=xxxxxxxx* *NT_STATUS_OK: Success (0x0)* but i'm going nuts with freeradius. I've read lots of posts in mailing list and howtos about my error: Thu Sep 10 15:05:46 2015 : Debug: (0) eap : *Identity does not match User-Name, setting from EAP Identity.* Thu Sep 10 15:05:46 2015 : Debug: (0) eap : *Failed to get handler, probably already removed, not inserting EAP-Failure* but still i can't get it working. so here i am, asking myself the mailing-list. here is my debug output: http://pastebin.com/cvsfxNUA and here is the radeapclient request: http://pastebin.com/v4Kwzj66 thanks in advance! -- "Madness, like small fish, runs in hosts, in vast numbers of instances." Nessuno mi pettina bene come il vento.

3 2

Freeradius and Kerberos
by Jürgen Obermeyer 10 Sep '15

10 Sep '15

Good afternoon! I'm a german teacher and responsible for the computer network at my school. I would like to authenticate users intending to connect with our WLAN by using their credentials stored in a Kerberos database. I read a lot of documentation, but due to the fact that I'm a teacher and not a professional system adminstrator, I'm not able to get things work and I hope for some help! What I have: - an Ubuntu box (14.04 server) with a running MIT-Kerberos infrastructure - freeradius 2.1.12 on this box - an AP with "WPA enterprise" (WPA-EAP) I've done a lot of configuration and if I try to connect to the WLAN via the AP, freeradius is presenting his certificate and prompts me for user credentials. The packet freeradius-krb5 is installed and configured properly (I hope). But the authentication doesn't work. There a so much config details that I don't know exactly what kind of information may be useful to solve my problem. Maybe there is a tutorial describing step by step what I have to do? And: I hope that it is possible to an authentication against Kerberos? Thanks a lot for your hints! Jürgen -- Ökumenisches Gymnasium Bremen Oberneulander Landstr. 143a 28355 Bremen Fon: +49 421 22312913 Fax: +49 421 22312910 Web: http://www.oegym.de/

2 1