- Freeradius-Users - lists.freeradius.org

FreeRADIUS 3.0.7 Segmentation Fault
by Donald Sherker 12 Jun '15

12 Jun '15

We are running FreeRADIUS 3.0.7. FreeRADIUS has been crashing every couple days due to segmentation faults. I enabled core dumps and got a core dump from the seg fault this morning. Using the core dump, what is the best way to determine what is causing the segmentation fault? Thanks, Don

2 3

OpenSSL problems
by Alan DeKok 12 Jun '15

12 Jun '15

A sad note from the HostAP mailing list. OpenSSL has broken the most recent release. The good news is that we've put changes into v3 to detect this kind of nonsense. It refuses to start with a broken OpenSSL. But, this means that if your system auto-upgrades OpenSSL, FreeRADIUS will refuse to start. If you upgrade OpenSSL, you MUST REBUILD FreeRADIUS. This requirement is made because the OpenSSL people hate their end users, and break binary compatibility. --- Please note that the OpenSSL versions released yesterday are not binary compatible with the prior releases due to a quite undesired ABI change (HMAC_CTX size changes). This affects multiple programs using OpenSSL shared libraries, including wpa_supplicant. If you are using wpa_supplicant with OpenSSL as a shared library and update the OpenSSL shared library without rebuilding the wpa_supplicant binary against the new header files from the new OpenSSL version, you may hit memory corruption issues at runtime. Rebuilding wpa_supplicant against the matching OpenSSL version will fix those. Based on a quick test, this issue did not show up in practice for me on 64-bit Ubuntu 14.04 with gcc build due to the HMAC_CTX struct padding done by the compiler. However, on 32-bit Ubuntu 14.04, this did result in memory corruption and process termination due to malloc() memory corruption and/or stack smashing detection. This is an OpenSSL issue and I hope that the previous ABI will be restored in a new release shortly. There is not really anything that wpa_supplicant can do about this apart from doing that rebuild with new OpenSSL header files.

3 3

duplicate acctuniqueid problem
by d tbsky 12 Jun '15

12 Jun '15

Hi: I am testing 802.1x accounting under fr 3.0.8. steps below: 1. use my notebook to login AP. accounting begin. 2. poweroff/poweron the AP. AP send "Accounting on". and previous accounting log closed with "NAS-Reboot".that's good. 3. use my notebook to login AP. fr can not create a new accounting entry, it seems "Acct-Session-Id" will be reused and cause "acctuniqueid" duplicate. error message like below: (11) sql: rlm_sql_mysql: ERROR 1062 (Duplicate entry 'e8db0ea9accf3a44b835ff8a0e5b62c0' for key 'acctuniqueid'): 23000 (11) sql: SQL query returned: need alt query (11) sql: Trying next query... (11) sql: EXPAND UPDATE radacct SET acctstarttime = FROM_UNIXTIME(%{integer:Event-Timestamp})................... then fr will try to update an existing entry instead of log a new entry. is the behavior expected? how can I setup to prevent it? thanks a lot for help! Regards, tbskyd

3 16

freeradius 2.2 / radsecproxy integration
by Alex Sharaz 12 Jun '15

12 Jun '15

Hi, Can anyone point me at a working config showing FR 2.2.x / radsecproxy integration. Thx A

2 3

Writing custom policies
by Randeep 12 Jun '15

12 Jun '15

Hi, I have installled FreeRADIUS Version 2.1.12. I want to give a particular user maximum usage of 30GB in a month. I have enabled the counter.conf. And the NAS is sending the interim updates to the radacct. But where I can give this condition? to compare and respond with a disconnect message? I have to give this in policy.conf? Or in pre-auth session? The thing is in the default radiusd.conf, I'm not able to see this authorize,authentiate, accounting, pre-auth etc. Is this some version specific? Regards, Randeep

1 0

We have plans to 3.0.9?
by Jorge Pereira 11 Jun '15

11 Jun '15

Alan, I would like to know if have plans and date to 3.0.9. -- Jorge Pereira

2 1

ippool configuration
by Randeep 11 Jun '15

11 Jun '15

Hi, I've installed a freeradius server. Now I am trying to configure the ip pool. I have done the following. In /etc/raddb/radiusd.conf I have uncommented $INCLUDE sqlippool.conf In /etc/raddb/sqlippool.conf I have uncommented $INCLUDE sql/mysql/ippool.conf in /etc/raddb/sql/mysql/ippool.conf I haven't made any changes. in /etc/raddb/modules/ippool, I have set the range, netmask etc. But I couldn't understand what exactly is session-db = ${db_dir}/db.ippool and no ip is allocating for the client. I tested it with the debug mode. Couldnt find any logs related to this though. is it possible to see the ip address given to the request in the radtest command line client? Also, This ip pool is for the local ips right? Where we can configure the public IP to private IP mapping? This has to be done on the NAS side? Please help -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore]

1 0

Authentication methods
by Randeep 11 Jun '15

11 Jun '15

Hi, We are implementing a solution with FreeRadius+Mysql+Mikrotik. We need two types of authentication methods. 1. PPPoE 2. Via HTTP. For eg: When a user connects from the laptop, the browser should redirect to a website on which we can enter username & password and authenticate. It would be better if we can do this with an api so that we can use the same api to login to the network from the devices which doesn't support PPPoE. is this possible with FreeRadius. Which protocols I need to enable for this? I need to specify this in radgroupreply? with Framed-Protocol? But two protocol is possible at the same time? Please advice. -- Randeep Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr

2 4

doubts about the functions in the unlang
by Jorge Pereira 11 Jun '15

11 Jun '15

Hi, someone know if have some way to do something like. int-require.by { if (!$1) { update { reply:Reply-Message:= "The $1 is required" } reject } else { noop } } and calling like int-require.by "Acct-Session-Id" -- Jorge Pereira

6 13

eap instantiation errors
by Paul Manyika 11 Jun '15

11 Jun '15

Hi I am trying co configure free radius on a freebsd10 server When i try to run "radiusd -X" I get radiusd: FreeRADIUS Version 2.2.7, for host i386-portbld-freebsd10.0, built on Jun 10 2015 at 12:35:41 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/cache including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radrelay including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { user = "freeradius" group = "freeradius" allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib/freeradius-2.2.7" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ?Ø¿âââ?( Ø¿âA modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_pam Module: Instantiating module "pam" from file /usr/local/etc/raddb/modules/pam pam { pam_auth = "radiusd" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } rlm_eap: No such sub-type for default EAP type ttls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[312]: Failed to find "eap" in the "modules" section. /usr/local/etc/raddb/sites-enabled/default[254]: Errors parsing authenticate section. Can someone pliz show me what i did wrong? __________________________________________________________________ Find a local lawyer and free legal information at FindLaw.com.

2 1