- Freeradius-Users - lists.freeradius.org

freeradius memory leak after use detail file
by Yanrui Hu 03 Feb '15

03 Feb '15

free radius 2.2.6 it works well on production system and one day we change to not write accouting data to database directly, instead, we write it to detail disk file and sync to db latter. after this change we found the memory consumption increase day by day. with valgrind I test it in lab environment with same configuration. here is the output: anybody can help if this is leak and if newest 3.2.x already fixed it? valgrind --leak-check=full --time-stamp=yes --show-leak-kinds=all --log-file=/tmp/valgrind.log /usr/sbin/freeradius ==00:00:00:07.586 59730== LEAK SUMMARY: ==00:00:00:07.586 59730== definitely lost: 125 bytes in 3 blocks ==00:00:00:07.586 59730== indirectly lost: 480 bytes in 20 blocks ==00:00:00:07.586 59730== possibly lost: 0 bytes in 0 blocks ==00:00:00:07.586 59730== still reachable: 6,173,476 bytes in 70,774 blocks ==00:00:00:07.586 59730== suppressed: 0 bytes in 0 blocks ==00:00:00:07.586 59730== ==00:00:00:07.586 59730== For counts of detected and suppressed errors, rerun with: -v ==00:00:00:07.586 59730== Use --track-origins=yes to see where uninitialised values come from ==00:00:00:07.586 59730== ERROR SUMMARY: 41122 errors from 100 contexts (suppressed: 0 from 0) ==00:00:03:34.727 59824== Thread 6: ==00:00:00:07.569 59730== 160 bytes in 4 blocks are still reachable in loss record 891 of 1,273 ==00:00:00:07.569 59730== at 0x4C2CFA7: malloc (vg_replace_malloc.c:296) ==00:00:00:07.569 59730== by 0x4E48CA5: rbtree_insertnode (rbtree.c:270) ==00:00:00:07.569 59730== by 0x4E48EB8: rbtree_insert (rbtree.c:299) ==00:00:00:07.569 59730== by 0x40D829: cf_item_add (conffile.c:531) ==00:00:00:07.569 59730== by 0x40D829: cf_item_add (conffile.c:507) ==00:00:00:07.569 59730== by 0x4104AA: cf_item_parse (conffile.c:1085) ==00:00:00:07.569 59730== by 0x410890: cf_section_parse (conffile.c:1197) ==00:00:00:07.569 59730== by 0xF1DE5DE: detail_instantiate (rlm_detail.c:132) ==00:00:00:07.569 59730== by 0x41D38B: find_module_instance (modules.c:620) ==00:00:00:07.569 59730== by 0x41FC63: do_compile_modsingle (modcall.c:1966) ==00:00:00:07.569 59730== by 0x41C69F: load_component_section (modules.c:908) ==00:00:00:07.569 59730== by 0x41CBE1: load_byserver (modules.c:1109) ==00:00:00:07.569 59730== by 0x41DA6C: virtual_servers_load (modules.c:1273) ==00:00:00:07.564 59730== 56 bytes in 1 blocks are still reachable in loss record 792 of 1,273 ==00:00:00:07.564 59730== at 0x4C2CFA7: malloc (vg_replace_malloc.c:296) ==00:00:00:07.564 59730== by 0x424B18: rad_malloc (util.c:347) ==00:00:00:07.564 59730== by 0xF1DE577: detail_instantiate (rlm_detail.c:126) ==00:00:00:07.564 59730== by 0x41D38B: find_module_instance (modules.c:620) ==00:00:00:07.564 59730== by 0x41FC63: do_compile_modsingle (modcall.c:1966) ==00:00:00:07.564 59730== by 0x41C69F: load_component_section (modules.c:908) ==00:00:00:07.564 59730== by 0x41CBE1: load_byserver (modules.c:1109) ==00:00:00:07.564 59730== by 0x41DB14: virtual_servers_load (modules.c:1244) ==00:00:00:07.564 59730== by 0x41E0B7: setup_modules (modules.c:1568) ==00:00:00:07.564 59730== by 0x4097C2: main (radiusd.c:289) -- Best Regards, Yanrui Hu -- *This email may contain or reference confidential information and is intended only for the individual to whom it is addressed. Please refrain from distributing, disclosing or copying this email and the information contained within unless you are the intended recipient. If you received this email in error, please notify us at legal(a)appannie.com <legal(a)appannie.com>** immediately and remove it from your system.*

3 2

Is it possible to have different TLS configurations per EAP type?
by Louis Munro 02 Feb '15

02 Feb '15

Hello, I have a set of FR 2.2.5 servers which are currently handling PEAP connections. We now want to add EAP-TLS authentication, which is pretty straightforward. The only stumbling block I have is that the EAP-TLS client certs are signed by a root CA different from the one that signed the server certificate currently used for PEAP authentication. While that is not a problem in itself it makes client devices configuration more troublesome than I would like because it forces the user to install two root CA certs. So I am trying to write a configuration that would support two eap configurations. Instantiating two modules is not the problem, it’s more a matter of finding how to select a configuration to be used while maintaining backwards compatibility for the existing PEAP clients. Assuming the following modules: eap { […] tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file =${certdir}/server.key certificate_file = ${certdir}/server.crt CA_file = ${certdir}/ca_PEAP.crt dh_file = ${certdir}/dh random_file = /dev/urandom cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap” […] } eap eap-tls { [..] tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/ca.key private_key_password = whatever certificate_file = ${certdir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" CA_file = ${certdir}/ca.pem […] } This does not seem to work: authorize { # assuming an instance called eap-tls eap-tls { updated = return } # else eap { ok = return } […] } And since things like EAP-Type are detected by the eap module itself I also can’t seem to do if (EAP-Type && (EAP-Type == EAP-TLS)) { eap-tls { ok = return } } else { eap { ok = return } } Which leaves me with a chicken and egg type of situation. Is this doable in FR 2? Am I just missing the obvious? Thank you for your help. -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

3 3

[ANN] Release 3.0.7 rc0
by Arran Cudbard-Bell 02 Feb '15

02 Feb '15

A preview release of 3.0.7 is available here: https://github.com/FreeRADIUS/freeradius-server/archive/release_3_0_7_rc0.t… We're creating a release candidate for 3.0.7 as there have been many modifications to error reporting, and error categorisation in rlm_sql. One major change is in the logging API used by SQL drivers to report errors. Instead of using static buffers, they now use talloc pools, which are as efficient, but avoid thread safety issues. They can now log errors with different priorities, and log multiple error messages. This is used by the rlm_sql_mysql driver to output the result of SHOW WARNINGs if additional warnings are available on the server. Another big change is how the the drivers report failures. For rlm_sql_mysql and rlm_sql_sqlite, the drivers now distinguish between constraints violations, server errors and malformed queries. For those drivers rlm_sql.accounting will now return noop (if no more alternative queries), fail, and invalid respectively. Previously it would just return noop. More work is needed to bring this functionality to other drivers. Please send patches if you think this will be useful for you. These changes could not be tested fully as we don't have access to the various databases. If a particular driver is important for your deployment, please test 3.0.7 before it's released. Here's the changelog so far: Feature improvements * Allow coa home_servers to be derived from client sections if a coa_server section is provided. * Automatically determine the correct port if no port is provided for a home server. * Allow foreach to operate over lists. * Add compile time features to ${feature.*} and versions of core libraries to ${version.*}. Feature and version names match output of radiud -xv. %v is now deprecated. * Add support for PATCH method in rlm_rest. * Validate more module xlats on startup, and warn if an xlat expansion is found in a double quoted config item which will not be expanded. * Add support for sub-second timeouts in rlm_rest. * Add support for connection timeouts in rlm_rest. * Add %{jsonquote:<str>} xlat to escape strings for insertion into json documents. * Add %{ldapquote:<str>} xlat to escape strings for insertion into json documents. * Add %{explode:&ref <char>}, splits value of &ref on <char> and creates new &ref type attributes with the fragments. * Allow rlm_ldap to use attribute references for base_dn and filter config items. The attribute references are not escaped, allowing DNs and filters to be created dynamically. * Add %{nexttime:[<int>]h|d|w|y} to calculate the number of seconds before the next <int> hour(s), day(s), week(s), or year(s). * Allow the left side of update sections to be xlat expansions. The result of the expansion is then used to reference the attribute to be modified. * Added %{lpad:&Attribute-Name 7 x} and rpad. These produce fixed-width output strings, with padding to the left (lpad) or the right (rpad). * For some SQL drivers (MySQL, sqlite) distinguish between constraints violations (on insert), invalid queries, and server errors, and return noop, invalid, and error respectively. * Call SHOW WARNINGS in the MySQL driver and write them to the request log, if libmysqlclient indicates warnings are available on the server. * Provide mechanism to create non-standard VSAs. * Make dhcpclient work with raw sockets and various other improvements - Contributed by nchaigne * Add support for SSHA2 - Contributed by PDD. * Add perle dictionary - Contributed by Hachmer * Modernise init scripts for RHEL, SUSE and Debian. Bug fixes * Fix issues parsing LDAP hostnames with non-standard ports. * Fix issues with realms containing regular expressions. * Allow unary negation before parantheses in rlm_expr. * Fix infinite loop in kevent event loop code. Issue only presented on FreeBSD. * Be more careful to define Auth-Types before loading modules. * Link libfreeradius-radius against OpenSSL too, to avoid multi-version symbols in SSL libraries. * When rlm_ldap rebinds a connection, it should use bind credentials from the module that created the connection pool, not credentials from the module referencing it. * Empty server config pairs should be allowed in rlm_ldap instances that reference another module's connection pool. * Don't try and change the permissions of unix sockets used for the control socket on non-linux systems. Instead inform the user that permissions need to be changed on parent directory. Unix socket permissions are a Linux extension. * Mark rlm_always as huppable, so its rcode can be changed via radmin (allows policy toggles). * Emit warnings when ignoring user configured pool values. * Fix issue that would cause radclient to complain intermittently about differing numbers of filters and requests. * Fix cosmetic issues in connection pool logging, that made it appear as if the same connection was being opened multiple times. * Fix threadsafety issues in SQL drivers, where a static buffer was used to store error messages. * Log RERROR, RWARN, RINFO to the global log if request logging is not enabled. * Link to libldap instead of libldap_r. Linking to libldap_r is not supported for use by projects outside of OpenLDAP. * Set connection timeout correctly in rlm_sql_mysql. * Build with older versions of libcurl, and use CFLAGS from curl-config. * Honour Packet-Src-Port and Packet-Src-IP-address in radclient. * Initialise ldapai_info_version field, so libldap will report its vendor and version. * Fix log rotation scripts by using the copyrotate option. * Fix issue that caused opening control sockets to always fail on non-Linux systems, if a user or group was set. * Save Session-State after proxying. * Additional fixes for reading CoA/DM requests from flat files. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

AW: Re: using external script in virtual server config
by the2nd 01 Feb '15

01 Feb '15

I already have implemented mschap authentication im OTPme and use it from within the mschap module as a ntlm_auth replacement. But it would be great if i could also handle this in rlm_python. If if i could get challenge and response from authData just like its done with username and password i could verify it and return the nt_key on success. regards the2nd <div>-------- Ursprüngliche Nachricht --------</div><div>Von: Alan DeKok <aland(a)deployingradius.com> </div><div>Datum:01.25.2015 21:32 (GMT+01:00) </div><div>An: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> </div><div>Betreff: Re: using external script in virtual server config </div><div> </div>On Jan 25, 2015, at 1:15 PM, the2nd(a)otpme.org wrote: > today i've written an python module for use with rlm_python and it works great for clear-text requests. but i dont know how to handle ntlm/mschap requests. You don’t. FreeRADIUS implements MS-CHAP. You don’t want to re-implement that in python. What do you want to do with the OTP and MS-CHAP? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 14

freeradius will not start when SELINUX is enabled
by Jorge Valdes 30 Jan '15

30 Jan '15

Hi, I use daemontool's supervise to manage the RADIUS service, and have been doing it for years. Now that I am migrating freeradius to another server, I am using Centos6 RPM to install the software versus compiling from source, and I am getting the following: 2015-01-30 10:52:42.518 server backbone { # from file etc/sites-enabled/backbone 2015-01-30 10:52:42.518 modules { 2015-01-30 10:52:42.518 Module: Creating Auth-Type = digest 2015-01-30 10:52:42.518 Module: Checking authenticate {...} for more modules to load 2015-01-30 10:52:42.518 Module: Linked to module rlm_digest 2015-01-30 10:52:42.518 Module: Instantiating module "digest" from file etc/modules/digest 2015-01-30 10:52:42.518 Module: Checking authorize {...} for more modules to load 2015-01-30 10:52:42.518 Module: Instantiating module "files_backbone" from file etc/radiusd.conf 2015-01-30 10:52:42.518 files files_backbone { 2015-01-30 10:52:42.518 usersfile = "etc/backbone/users" 2015-01-30 10:52:42.518 acctusersfile = "etc/backbone/acct_users" 2015-01-30 10:52:42.518 preproxy_usersfile = "etc/backbone/preproxy_users" 2015-01-30 10:52:42.518 compat = "no" 2015-01-30 10:52:42.518 } 2015-01-30 10:52:42.518 etc/backbone/users[171]: Could not open included file /home/crm/local-users/monitor: Permission denied 2015-01-30 10:52:42.519 Errors reading etc/backbone/users 2015-01-30 10:52:42.519 etc/radiusd.conf[681]: Instantiation failed for module "files_backbone" 2015-01-30 10:52:42.519 etc/sites-enabled/backbone[177]: Failed to load module "files_backbone". 2015-01-30 10:52:42.519 etc/sites-enabled/backbone[87]: Errors parsing authorize section. After this, the program stops, and supervise tries again and again to restart, always failing here. I have double-checked permissions, and do not see where I could be denying [root@dhcp1 radius]# ls -ld /home drwxr-xr-x. 6 root root 4096 Jan 30 09:49 /home [root@dhcp1 radius]# ls -ld /home/crm/ drwxr-xr-x. 7 crm crm 4096 Jan 30 10:22 /home/crm/ [root@dhcp1 radius]# ls -ld /home/crm/local-users/ drwxr-xr-x. 2 crm crm 4096 Nov 17 2010 /home/crm/local-users/ [root@dhcp1 radius]# ls -l /home/crm/local-users/ total 28 -rw-r--r--. 1 crm crm 253 Oct 8 15:25 admin -rw-r--r--. 1 crm crm 252 Jan 21 2011 monitor -rw-r--r--. 1 crm crm 943 Oct 8 15:25 noc -rw-r--r--. 1 crm crm 131 Oct 8 15:25 ps -rw-r--r--. 1 crm crm 668 Oct 8 15:25 super_tech -rw-r--r--. 1 crm crm 436 Oct 8 15:25 vpn Now, when I execute the server from the command-line manually, the server starts out without problems: ... server backbone { # from file etc/sites-enabled/backbone modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file etc/modules/digest Module: Checking authorize {...} for more modules to load Module: Instantiating module "files_backbone" from file etc/radiusd.conf files files_backbone { usersfile = "etc/backbone/users" acctusersfile = "etc/backbone/acct_users" preproxy_usersfile = "etc/backbone/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server ... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address * port 1645 Listening on accounting address * port 1646 Ready to process requests. The only issue is that SELINUX is enabled. After I disabled SELINUX, and restarted the server, and now the service starts without issues. After looking at the audit log, I see that: type=AVC msg=audit(1422637776.619:4172): avc: denied { search } for pid=9101 comm="radiusd" name="home" dev=dm-0 ino=261125 scontext=system_u:system_r:radiusd_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir type=SYSCALL msg=audit(1422637776.619:4172): arch=c000003e syscall=2 success=no exit=-13 a0=7fffedebf240 a1=0 a2=1b6 a3=0 items=0 ppid=31859 pid=9101 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="radiusd" exe="/usr/sbin/radiusd" subj=system_u:system_r:radiusd_t:s0 key=(null) So, access is being denied to /home. Since my SELINUX knowledge is limited, I will run with SELINUX disabled, but I still do not understand why it would block access only on non-interactive executions. Maybe there should be mention in the FAQ regarding configuration files residing inside /home, or that SELINUX can make the deamon fail to start due to targeted policies using non standard configuration settings. -- Jorge Valdes

2 1

Radius Engineer / Wireless Network Engineer position (Pune)
by Sanju 30 Jan '15

30 Jan '15

We are a Pune, India based company looking for Radius Engineer on contract basis. Interrested candidates can forward their resume to simplemail9 at gmail.com Role & Responsibility: - Join a multidiscipline technical team that is developing an innovative product for users who use high level of roaming data on their mobile phones. The product will help users to connect to WIFI hotspots. - The primary responsibility is to build the connection of AAA/RADIUS servers (freeRadius) of large telecom aggregators and the company. - Develop the system architecture to manage end-to-end process including AAA/Radius server configuration for various EAP methods, manage user authentication and accounting, PKI/CA certificates generation, integrate Radius with the existing NAS servers. Required Skills: - A Network Specialist/System Administrator working at Architect level having experience in AAA/RADIUS, NAS and certificates management. - Enterprise level experience designing, implementing, and operating RADIUS server. - Expertise in Linux OS administration. - Depth of knowledge and experience administering wireless networks. - Detailed understanding of wireless protocols and network security standards. - Strong hands on experience using and troubleshooting mobile devices running on all popular OS platforms (iOS, Android, Windows & Linux) - Ensure network access control systems meet compliance and auditing requirements. Preferred Skills: - Experience in building or maintaining the connection manager. - Analytical problem-solver, able to anticipate issues and create new systems that streamline operations, resolves concerns and improves efficiency. - User Acceptance Test Plan to verify that the hardware and software has been configured according to Network System Design document. - Execute functional tests as per UAT Plan.

1 0

successful authentication (peap and TTLS), but internet access that for 5 seconds
by Sautron Nick 30 Jan '15

30 Jan '15

Hello everyone, I have a problem with my freeradius server (or maybe switch), the problem is that : I connected a customer on a switch port (Cisco 2940) configured 802.1X Authentication is successful, but I have access to the internet that for 5 seconds and after nothing. I wonder if there is no configuration to avoid this kind of problem. Best regards S.Nick

4 4

authenticating against a remote SAMBA
by Rui Ribeiro 30 Jan '15

30 Jan '15

Hi, Out of curiosity, has anyone managed to authenticate remotely with MS-CHAPv2 against a remote SAMBA? Or only PAP will do? I am doing it fine against an a MS AD, however with the SAMBA one, I only managed to put ntlm_auth working, but not the actual mschap module. -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 2

Member De-Registration
by George Innocent 30 Jan '15

30 Jan '15

Hello Members; How does one De-Register from the User group email lists -- Regards: George Innocent.

2 1

Re: authenticating a guest domain/ntlm_auth in a different AD
by Rui Ribeiro 29 Jan '15

29 Jan '15

Thanks Mathew, my missing piece was exactly I was no getting I could call the module/mschap as domain2 in unlang. Stupid, because I am doing things like that with linelog. Thanks a million. Regards, Rui > > Message: 6 > Date: Thu, 29 Jan 2015 17:34:53 +0000 > From: Matthew Newton <mcn4(a)leicester.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: authenticating a guest domain/ntlm_auth in a different AD > Message-ID: <20150129173453.GB24929(a)rootmail.cc.le.ac.uk> > Content-Type: text/plain; charset=us-ascii > > On Thu, Jan 29, 2015 at 03:54:52PM +0000, Rui Ribeiro wrote: > > I would like to authenticate a guest domain in a different AD in FR3. I > ... > > The ideia of having to mschap configurations is for calling ntlm_auth > with > > a different Windows DOMAIN. > > OK. > > > most specifically, this not works. Is it wiser to build a new FR to the > > guest domain. > > You can do it all in one copy of FreeRADIUS. No need to run it > twice. There are many ways to do this. You will need to make sure > that the AD domains trust each other as your RADIUS server will > (normally) only be joined to one domain, so will send all auth > requests to that one. > > You could add something like > > --domain=%{Realm} > > to your existing ntlm_auth command line, but you probably want to > do some sanity checks on the realm first in unlang. > > > Another method similar to how we've done here in the past would be > to define two instances of the mschap module. So in > mods-available/mschap, copy the > > mschap { > ... > } > > section, and call it e.g. > > mschap domain2 { > ... > } > > Update the domain2 ntlm_auth one with your new domain. > > > Then you need to use work out which one to use - either code this > with if() in unlang, or use the call 'suffix' in authorize{} > (which is enabled by default). > > Then you should be able to update your authenticate{} section from > > Auth-Type MS-CHAP { > mschap > } > > to something like > > Auth-Type MS-CHAP { > if (Realm =~ /(a)my.second.realm$/) { > domain2 > } > else { > mschap > } > } > > If you can't get it working, post the full FreeRADIUS debug output > (radiusd -X) to the list, otherwise nobody can tell what's going > wrong. > > Matthew > > > -- > Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> > > Systems Specialist, Infrastructure Services, > I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom > > For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> > > > >

1 0