- Freeradius-Users - lists.freeradius.org

Windows 8.1 Wi-Fi client handshake failure
by Martin Rowe 07 Oct '14

07 Oct '14

Hello, I'm having trouble getting a Windows 8.1 laptop to connect to my Wi-Fi which is using only EAP-TLS managed by FreeRADIUS. Before you ask, yes I have included serverAuth/clientAuth in the certificates and the configuration is tested to work with Linux and Android clients, so I don't think there is a problem on the server side. That is as far as Google has been able to help me, so I'm hoping someone here has had the same problem and might know a solution. The specific issue as far as I can troubleshoot is that the client and server can't agree on a shared TLS cipher. I'm seeing these lines in my logs every time I attempt a connection: Info: [tls] TLS_accept: before/accept initialization Info: [tls] <<< TLS 1.0 Handshake [length 0067], ClientHello Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure Error: TLS Alert write:fatal:handshake failure Error: TLS_accept: error in SSLv3 read client hello C Error: rlm_eap: SSL error error:1408A0C1:lib(20):func(138):reason(193) Error: SSL: SSL_read failed in a system call (-1), TLS session fails. >From [1] it looks like the SSL errors mean: lib(20) = ERR_LIB_SSL func(138) = SSL_F_SSL3_GET_CLIENT_HELLO reason(193) = SSL_R_NO_SHARED_CIPHER [1] http://comments.gmane.org/gmane.comp.encryption.openssl.user/9654 But that is as far as I can get. I've tried disabling every option I can in the configs and many variations on the Windows side, but they all stop at the same point. There is no limit I have set on which TLS ciphers can be used (cipher_list in eap{tls{}} is not used, and gave the same error when set to DEFAULT). My only other guess is there is something wrong with the certificates, but I'm not sure what might be wrong. I have copied both my root and my radius intermediate CA certificates onto the Windows client along with the client certificate and key. They are installed and the chain is valid according to the Windows Credential Manager. The server ca.pem has both the root and intermediate certificates concatenated together and that works fine with my other clients. So all I can think of is that Windows is being extra picky about something. Below is the sanitized text certificate for the server and client in the hope that the error is obvious to someone else: openssl x509 -text -in server.crt Certificate: Data: Version: 3 (0x2) Serial Number: * Signature Algorithm: ecdsa-with-SHA512 Issuer: O=CA, OU=radius Validity Not Before: Oct 6 17:01:03 2014 GMT Not After : Oct 6 17:01:03 2015 GMT Subject: O=CA, OU=radius, CN=my.server.fqdn Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (521 bit) pub: * ASN1 OID: secp521r1 X509v3 extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Subject Key Identifier: * X509v3 Authority Key Identifier: keyid:* DirName:/O=CA/OU=root serial:* X509v3 CRL Distribution Points: Full Name: URI:http://my.crl.fqdn/radius.crl Authority Information Access: CA Issuers - URI:http://my.crl.fqdn/radius.pem OCSP - URI:http://my.ocsp.fqdn X509v3 Key Usage: Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 Issuer Alternative Name: <EMPTY> X509v3 Subject Alternative Name: DNS:my.server.fqdn Signature Algorithm: ecdsa-with-SHA512 * -----BEGIN CERTIFICATE----- * -----END CERTIFICATE----- openssl x509 -text -in client.crt Certificate: Data: Version: 3 (0x2) Serial Number: * Signature Algorithm: ecdsa-with-SHA512 Issuer: O=CA, OU=radius Validity Not Before: Oct 1 21:49:00 2014 GMT Not After : Oct 1 21:49:00 2015 GMT Subject: O=CA, OU=radius, CN=username Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (521 bit) pub: * ASN1 OID: secp521r1 X509v3 extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Subject Key Identifier: * X509v3 Authority Key Identifier: keyid:* DirName:/O=CA/OU=root serial:* X509v3 CRL Distribution Points: Full Name: URI:http://my.crl.fqdn/radius.crl Authority Information Access: CA Issuers - URI:http://my.crl.fqdn/radius.pem OCSP - URI:http://my.ocsp.fqdn X509v3 Key Usage: Digital Signature X509v3 Extended Key Usage: TLS Web Client Authentication X509v3 Issuer Alternative Name: <EMPTY> Signature Algorithm: ecdsa-with-SHA512 * -----BEGIN CERTIFICATE----- * -----END CERTIFICATE----- And my logs for good measure radiusd -XX Info: radiusd: FreeRADIUS Version 2.2.5, for host mips-openwrt-linux-gnu, built on Sep 28 2014 at 19:17:25 Debug: Server was built with: Debug: accounting Debug: authentication Debug: WITH_DHCP Debug: WITH_VMPS Debug: Server core libs: Debug: ssl: OpenSSL 1.0.1i 6 Aug 2014 Info: Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info: PARTICULAR PURPOSE. Info: You may redistribute copies of FreeRADIUS under the terms of the Info: GNU General Public License. Info: For more information about these matters, see the file named COPYRIGHT. Info: Starting - reading configuration files ... Debug: including configuration file /etc/freeradius2/radiusd.conf Debug: including configuration file /etc/freeradius2/clients.conf Debug: including configuration file /etc/freeradius2/eap.conf Debug: including files in directory /etc/freeradius2/sites/ Debug: including configuration file /etc/freeradius2/sites/default Debug: main { Debug: allow_core_dumps = no Debug: } Debug: including dictionary file /etc/freeradius2/dictionary Debug: main { Debug: name = "radiusd" Debug: prefix = "/usr" Debug: localstatedir = "/var" Debug: sbindir = "/usr/sbin" Debug: logdir = "/var/log" Debug: run_dir = "/var/run" Debug: libdir = "/usr/lib/freeradius2" Debug: radacctdir = "/var/db/radacct" Debug: hostname_lookups = no Debug: max_request_time = 30 Debug: cleanup_delay = 5 Debug: max_requests = 2048 Debug: pidfile = "/var/run/radiusd.pid" Debug: checkrad = "/usr/sbin/checkrad" Debug: debug_level = 0 Debug: proxy_requests = yes Debug: log { Debug: stripped_names = no Debug: auth = no Debug: auth_badpass = no Debug: auth_goodpass = no Debug: } Debug: } Debug: radiusd: #### Loading Realms and Home Servers #### Debug: radiusd: #### Loading Clients #### Debug: client localhost { Debug: ipaddr = 127.0.0.1 Debug: require_message_authenticator = yes Debug: secret = "*removed1*" Debug: nastype = "other" Debug: } Debug: radiusd: #### Instantiating modules #### Debug: radiusd: #### Loading Virtual Servers #### Debug: server { # from file ?4?wXj Debug: modules { Debug: Module: Checking authenticate {...} for more modules to load Debug: (Loaded rlm_eap, checking if it's valid) Debug: Module: Linked to module rlm_eap Debug: Module: Instantiating module "eap" from file /etc/freeradius2/eap.conf Debug: eap { Debug: default_eap_type = "tls" Debug: timer_expire = 60 Debug: ignore_unknown_eap_types = no Debug: cisco_accounting_username_bug = no Debug: max_sessions = 2048 Debug: } Debug: Module: Linked to sub-module rlm_eap_tls Debug: Module: Instantiating eap-tls Debug: tls { Debug: rsa_key_exchange = no Debug: dh_key_exchange = yes Debug: rsa_key_length = 512 Debug: dh_key_length = 512 Debug: verify_depth = 0 Debug: pem_file_type = yes Debug: private_key_file = "/etc/freeradius2/certs/server.key" Debug: certificate_file = "/etc/freeradius2/certs/server.crt" Debug: CA_file = "/etc/freeradius2/certs/ca.pem" Debug: dh_file = "/etc/freeradius2/certs/dh" Debug: fragment_size = 1024 Debug: include_length = yes Debug: check_crl = no Debug: ecdh_curve = "prime256v1" Debug: } Debug: Module: Checking authorize {...} for more modules to load Debug: } # modules Debug: } # server Debug: radiusd: #### Opening IP addresses and Ports #### Debug: listen { Debug: type = "auth" Debug: ipaddr = 127.0.0.1 Debug: port = 0 Debug: } Debug: Listening on authentication address 127.0.0.1 port 1812 Debug: Listening on proxy address * port 1104 Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 51343, id=22, length=205 User-Name = "*removed2*" Called-Station-Id = "*removed3*" NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Calling-Station-Id = "*removed4*" Connect-Info = "CONNECT 54Mbps 802.11a" Acct-Session-Id = "542D9EF5-0000004F" Framed-MTU = 1400 EAP-Message = 0x024700110162726f6e7468696e6b706164 Message-Authenticator = 0x7e8c00ff349e844a25b649a660222938 Info: # Executing section authorize from file /etc/freeradius2/sites/default Info: +group authorize { Info: [eap] EAP packet type response id 71 length 17 Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Info: ++[eap] = updated Info: +} # group authorize = updated Info: Found Auth-Type = EAP Info: # Executing group from file /etc/freeradius2/sites/default Info: +group authenticate { Info: [eap] EAP Identity Info: [eap] processing type tls Info: [tls] Requiring client certificate Info: [tls] Initiate Info: [tls] Start returned 1 Info: ++[eap] = handled Info: +} # group authenticate = handled Sending Access-Challenge of id 22 to 127.0.0.1 port 51343 EAP-Message = 0x014800060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xafea1117afa21cb71a84ea873cb44d4b Info: Finished request 0. Debug: Going to the next request Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 51343, id=23, length=324 User-Name = "*removed2*" Called-Station-Id = "*removed3*" NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Calling-Station-Id = "*removed4*" Connect-Info = "CONNECT 54Mbps 802.11a" Acct-Session-Id = "542D9EF5-0000004F" Framed-MTU = 1400 EAP-Message = 0x024800760d800000006c16030100670100006303015432d337768f888dfe17dc33835f35dd997aa21e12f03cacec5381488ea003f3000018c014c0130035002fc00ac00900380032000a00130005000401000022ff01000100000500050100000000000a0006000400170018000b0002010000230000 State = 0xafea1117afa21cb71a84ea873cb44d4b Message-Authenticator = 0xa8307e6d117840db9b85cd0c44938b91 Info: # Executing section authorize from file /etc/freeradius2/sites/default Info: +group authorize { Info: [eap] EAP packet type response id 72 length 118 Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Info: ++[eap] = updated Info: +} # group authorize = updated Info: Found Auth-Type = EAP Info: # Executing group from file /etc/freeradius2/sites/default Info: +group authenticate { Info: [eap] Request found, released from the list Info: [eap] EAP/tls Info: [eap] processing type tls Info: [tls] Authenticate Info: [tls] processing EAP-TLS Debug: TLS Length 108 Info: [tls] Length Included Info: [tls] eaptls_verify returned 11 Info: [tls] (other): before/accept initialization Info: [tls] TLS_accept: before/accept initialization Info: [tls] <<< TLS 1.0 Handshake [length 0067], ClientHello Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure Error: TLS Alert write:fatal:handshake failure Error: TLS_accept: error in SSLv3 read client hello C Error: rlm_eap: SSL error error:1408A0C1:lib(20):func(138):reason(193) Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Debug: TLS receive handshake failed during operation Info: [tls] eaptls_process returned 4 Info: [eap] Handler failed in EAP/tls Info: [eap] Failed in EAP select Info: ++[eap] = invalid Info: +} # group authenticate = invalid Info: Failed to authenticate the user. Sending Access-Reject of id 23 to 127.0.0.1 port 51343 EAP-Message = 0x04480004 Message-Authenticator = 0x00000000000000000000000000000000 Info: Finished request 1. Debug: Going to the next request Debug: Waking up in 4.9 seconds. Info: Cleaning up request 0 ID 22 with timestamp +40 Info: Cleaning up request 1 ID 23 with timestamp +40 Info: Ready to process requests.

4 8

Problem with Proxy server testing
by Himanshu Pandey 07 Oct '14

07 Oct '14

Hi, I was trying to test the proxy server concept of freeradius so I did this: /* proxy.conf */ I added two proxy servers home_server safeword1 { type = auth+acct ipaddr = 192.168.178.25 port = 1812 secret = letmesafeword require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server google1 { type = auth+acct ipaddr = 172.16.1.27 port = 1812 secret = letmegoogle require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server_pool my_safeword_radius_servers { type = fail-over home_server = safeword1 } home_server_pool my_googleotp_radius_servers { type = fail-over home_server = google1 } realm "SAFEWORD" { auth_pool = my_safeword_radius_servers acct_pool = my_safeword_radius_servers } realm "GOOGLE" { auth_pool = my_googleotp_radius_servers acct_pool = my_googleotp_radius_servers } realm "GOOGLE" { # do nothing # this means use the local server } In /*hint*/ I added # GOOGLE #Detect gA at start of username and if so add realm GOOGLE at the end # see http://wiki.freeradius.org/Hints DEFAULT User-Name =~ "^(gA.*)" User-Name := "%{1}@GOOGLE" # SAFEWORD # Detect lowercase "v", 1 or 2 captial letters followed by 6 numbers # at start of username to identify a SAFEWORD token # and if so add realm SAFEWORD at the end # see http://wiki.freeradius.org/Hints DEFAULT User-Name =~ "^(v[A-Z]{1,2}[0-9]{6})" User-Name := "%{1}@SAFEWORD" Now I used radtest with the following command /opt/freeradius/bin/radtest gA123443 592455 192.168.178.25 1812 letmegoogle But it is giving an error. Please help me to resolve the same. Debug log: Listening on command file /opt/freeradius/var/run/radiusd/radiusd.sock Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address :: port 1812 as server default Listening on acct address :: port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 48013 Ready to process requests Received Access-Request Id 69 from 127.0.0.1:42855 to 127.0.0.1:1812 length 78 (0) Received Access-Request packet from host 127.0.0.1 port 42855, id=69, length=78 (0) Dropping packet without response because of error: Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Waking up in 0.3 seconds. (0) Cleaning up request packet ID 69 with timestamp +12 Ready to process requests Received Access-Request Id 69 from 127.0.0.1:42855 to 127.0.0.1:1812 length 78 (1) Received Access-Request packet from host 127.0.0.1 port 42855, id=69, length=78 (1) Dropping packet without response because of error: Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Waking up in 0.3 seconds. (1) Cleaning up request packet ID 69 with timestamp +17 Ready to process requests Received Access-Request Id 69 from 127.0.0.1:42855 to 127.0.0.1:1812 length 78 (2) Received Access-Request packet from host 127.0.0.1 port 42855, id=69, length=78 (2) Dropping packet without response because of error: Received packet from 127.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) Waking up in 0.3 seconds. (2) Cleaning up request packet ID 69 with timestamp +22 Ready to process requests Regards, Sonu

1 0

Re: Beginner help (Alan DeKok)
by KAVYA PRABHAKAR 07 Oct '14

07 Oct '14

Hi, I am running freeradius version 3 in debug mode. When I send radius request usign following command: radtest test 456 localhost 1812 testing123 I encountered following error: (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (0) WARNING: pap : Authentication will fail unless a "known good" password is available. (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user. (0) Using Post-Auth-Type Reject I have added test Cleartext-Password := "456" in users file. I have not deleted any localhost related data from clients.conf afaik no more changes is required for this request to get accept message from server. I have been looking at this issue and reconfirmed that password which I have given in radius server matches with users file also. Could anybody please tell me where am I going wrong. Thanks, Kavya

2 1

Radmin Provides Per Proxy Server Statistics
by Himanshu Pandey 07 Oct '14

07 Oct '14

Hi friends, Using Radmin you can view the following statistics of a proxy server. The command for this is: radmin> stats home_server [auth/acct] OR <ipaddr> <port> e.g. stats home_server 127.0.0.1 1812 requests 0 responses 0 accepts 0 rejects 0 challenges 0 dup 0 invalid 0 malformed 0 bad_authenticator 0 dropped 0 unknown_types 0 timeouts 0 last_packet 0 elapsed.1us 0 elapsed.10us 0 elapsed.100us 0 elapsed.1ms 0 elapsed.10ms 0 elapsed.100ms 0 elapsed.1s 0 elapsed.10s 0 outstanding 0 Regards, Sonu From: "Himanshu Pandey" <pandey_himanshu80(a)rediffmail.com> Sent: Mon, 06 Oct 2014 10:56:53 To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Re: Per Proxy Server Statistics Hi, I want to track proxy server statistics like minimum response time, maximum response time, Average response time, Mean response time. I don't think the freeradius currently provides these statistics. Now, since I want these statistics, can somebody guide & help me to achieve these statistics using freeradius. Regards, Sonu From: Alan DeKok <aland(a)deployingradius.com> Sent: Tue, 30 Sep 2014 18:36:31 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Per Proxy Server Statistics Himanshu Pandey wrote: > Do radius server support Per Proxy Server Statistics like minimum > response time, maximum response time, Average response time, Mean > response time?  All of the statistics the server tracks can be queried with the "radmin" command.  If a statistics is missing, it's not tracked.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Get your own FREE website, FREE domain & FREE mobile app with Company email.  Know More > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Beginner help (Alan DeKok)
by KAVYA PRABHAKAR 07 Oct '14

07 Oct '14

> > > I have installed Freeradius version 3 and get openssl error as my > openssl version was in range 1.0.1 - 1.0.1f*. * > Now I removed my older openssl version and installed* *openssl 1.0.1g. > Edited radiusd.conf file as well. > > |allow_vulnerable_openssl = 'CVE-2014-0160'| > > When I start freeradius server ( ./radiusd -X for debug mode), it will > refuse to start with libssl version which is currently installed on your > server. Root cause for this is ?Security advisory CVE-2014-0160 > (Heartbleed)? > > > Then you're not editing the file which the server is reading. > > > Alan DeKok. > > > Thanks Alan. I corrected my mistake. Thanks, Kavya > >

1 0

Re:Re: Beginner help (Alan DeKok)
by KAVYA PRABHAKAR 07 Oct '14

07 Oct '14

> > > > Message: 1 > Date: Mon, 06 Oct 2014 07:58:34 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Beginner help > Message-ID: <543283EA.1060900(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > KAVYA PRABHAKAR wrote: > > I have installed Freeradius version 3 and get openssl error as my > > openssl version was in range 1.0.1 - 1.0.1f*. * > > Now I removed my older openssl version and installed* *openssl 1.0.1g. > > Edited radiusd.conf file as well. > > > > |allow_vulnerable_openssl = 'CVE-2014-0160'| > > > > When I start freeradius server ( ./radiusd -X for debug mode), it will > > refuse to start with libssl version which is currently installed on your > > server. Root cause for this is ?Security advisory CVE-2014-0160 > > (Heartbleed)? > > Then you're not editing the file which the server is reading. > > > Ok. I will check it out. But I have only one freeradius 3.0.3 directory and I am editing raddb\radiusd.config file in the respective directory. Let me know if the path where I am editing the file is wrong. Thanks, Kavya

1 0

Re:Windows 8.1 Wi-Fi client handshake failure (Martin Rowe)
by Rui Ribeiro 07 Oct '14

07 Oct '14

Hi, I am not seeing the XP X.509 OIDs specific for Windows on your certificate. Dont you need them? Have a look at certs/xpentensions. Regards, Rui -- Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > > Message: 2 > Date: Mon, 6 Oct 2014 11:28:14 -0700 > From: Martin Rowe <martin.p.rowe(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Windows 8.1 Wi-Fi client handshake failure > Message-ID: > < > CAOAjy5SRi8VDv1FYunFDfJ-UgOW7+jmnWNZxDxycA1jA2bXKvg(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hello, > > I'm having trouble getting a Windows 8.1 laptop to connect to my Wi-Fi > which is using only EAP-TLS managed by FreeRADIUS. Before you ask, yes > I have included serverAuth/clientAuth in the certificates and the > configuration is tested to work with Linux and Android clients, so I > don't think there is a problem on the server side. That is as far as > Google has been able to help me, so I'm hoping someone here has had > the same problem and might know a solution. > > The specific issue as far as I can troubleshoot is that the client and > server can't agree on a shared TLS cipher. I'm seeing these lines in > my logs every time I attempt a connection: > > Info: [tls] TLS_accept: before/accept initialization > Info: [tls] <<< TLS 1.0 Handshake [length 0067], ClientHello > Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal handshake_failure > Error: TLS Alert write:fatal:handshake failure > Error: TLS_accept: error in SSLv3 read client hello C > Error: rlm_eap: SSL error error:1408A0C1:lib(20):func(138):reason(193) > Error: SSL: SSL_read failed in a system call (-1), TLS session fails. > > >From [1] it looks like the SSL errors mean: > > lib(20) = ERR_LIB_SSL > func(138) = SSL_F_SSL3_GET_CLIENT_HELLO > reason(193) = SSL_R_NO_SHARED_CIPHER > > [1] http://comments.gmane.org/gmane.comp.encryption.openssl.user/9654 > > But that is as far as I can get. I've tried disabling every option I > can in the configs and many variations on the Windows side, but they > all stop at the same point. There is no limit I have set on which TLS > ciphers can be used (cipher_list in eap{tls{}} is not used, and gave > the same error when set to DEFAULT). > > My only other guess is there is something wrong with the certificates, > but I'm not sure what might be wrong. I have copied both my root and > my radius intermediate CA certificates onto the Windows client along > with the client certificate and key. They are installed and the chain > is valid according to the Windows Credential Manager. The server > ca.pem has both the root and intermediate certificates concatenated > together and that works fine with my other clients. So all I can think > of is that Windows is being extra picky about something. Below is the > sanitized text certificate for the server and client in the hope that > the error is obvious to someone else: > > ...... > >

2 1

rlm_perl: parse perl configuration
by BALSIANOK, Peter 06 Oct '14

06 Oct '14

hi, Is it correct, that perl configuration sub-section is parsed after perl_run ? RAD_PERLCONF is unavailable during calling perl_run function. Sent from my iPhone

3 5

rlm_perl: segmentation fault
by Peter Balsianok 06 Oct '14

06 Oct '14

radiusd: FreeRADIUS Version 3.0.5 (git #b662cfa), for host i686-pc-linux-gnu, built on Oct 6 2014 at 17:54:32 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /mnt/sdcard/software/freeradius-server-3.0.x/share/freeradius/dictionary including dictionary file /mnt/sdcard/software/freeradius-server-3.0.x/share/freeradius/dictionary.dhcp including dictionary file /mnt/sdcard/software/freeradius-server-3.0.x/share/freeradius/dictionary.vqp including dictionary file ./dictionary including configuration file ./radiusd.conf including configuration file ./proxy.conf including configuration file ./clients.conf including files in directory ./mods-enabled/ including configuration file ./mods-enabled/digest including configuration file ./mods-enabled/pap including configuration file ./mods-enabled/detail including configuration file ./mods-enabled/dynamic_clients including configuration file ./mods-enabled/cache_eap including configuration file ./mods-enabled/ntlm_auth including configuration file ./mods-enabled/eap including configuration file ./mods-enabled/expiration including configuration file ./mods-enabled/radutmp including configuration file ./mods-enabled/sradutmp including configuration file ./mods-enabled/detail.log including configuration file ./mods-enabled/logintime including configuration file ./mods-enabled/attr_filter including configuration file ./mods-enabled/chap including configuration file ./mods-enabled/linelog including configuration file ./mods-enabled/replicate including configuration file ./mods-enabled/echo including configuration file ./mods-enabled/exec including configuration file ./mods-enabled/unix including configuration file ./mods-enabled/expr including configuration file ./mods-enabled/utf8 including configuration file ./mods-enabled/preprocess including configuration file ./mods-enabled/realm including configuration file ./mods-enabled/passwd including configuration file ./mods-enabled/dhcp including configuration file ./mods-enabled/perl including configuration file ./mods-enabled/unpack including configuration file ./mods-enabled/files including configuration file ./mods-enabled/soh including configuration file ./mods-enabled/always including configuration file ./mods-enabled/mschap including files in directory ./policy.d/ including configuration file ./policy.d/abfab-tr including configuration file ./policy.d/cui including configuration file ./policy.d/control including configuration file ./policy.d/filter including configuration file ./policy.d/debug including configuration file ./policy.d/eap including configuration file ./policy.d/accounting including configuration file ./policy.d/dhcp including configuration file ./policy.d/operator-name including configuration file ./policy.d/canonicalization including files in directory ./sites-enabled/ including configuration file ./sites-enabled/default including configuration file ./sites-enabled/inner-tunnel main { name = "radiusd" prefix = "/mnt/sdcard/software/freeradius-server-3.0.x" localstatedir = "/mnt/sdcard/software/freeradius-server-3.0.x/var" sbindir = "/mnt/sdcard/software/freeradius-server-3.0.x/sbin" logdir = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius" run_dir = "/mnt/sdcard/software/freeradius-server-3.0.x/var/run/radiusd" libdir = "/mnt/sdcard/software/freeradius-server-3.0.x/lib" radacctdir = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/mnt/sdcard/software/freeradius-server-3.0.x/var/run/radiusd/radiusd.pid" checkrad = "/mnt/sdcard/software/freeradius-server-3.0.x/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_digest # Instantiating module "digest" from file ./mods-enabled/digest # Loaded module rlm_pap # Instantiating module "pap" from file ./mods-enabled/pap pap { normalise = yes } # Loaded module rlm_detail # Instantiating module "detail" from file ./mods-enabled/detail detail { filename = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file ./mods-enabled/dynamic_clients # Loaded module rlm_cache # Instantiating module "cache_eap" from file ./mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_exec # Instantiating module "ntlm_auth" from file ./mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_eap # Instantiating module "eap" from file ./mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "./certs" pem_file_type = yes private_key_file = "./certs/server.pem" certificate_file = "./certs/server.pem" ca_file = "./certs/ca.pem" private_key_password = <<< secret >>> dh_file = "./certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_expiration # Instantiating module "expiration" from file ./mods-enabled/expiration # Loaded module rlm_radutmp # Instantiating module "radutmp" from file ./mods-enabled/radutmp radutmp { filename = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Instantiating module "sradutmp" from file ./mods-enabled/sradutmp radutmp sradutmp { filename = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Instantiating module "auth_log" from file ./mods-enabled/detail.log detail auth_log { filename = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file ./mods-enabled/detail.log detail reply_log { filename = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file ./mods-enabled/detail.log detail pre_proxy_log { filename = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file ./mods-enabled/detail.log detail post_proxy_log { filename = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_logintime # Instantiating module "logintime" from file ./mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file ./mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "./mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ./mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file ./mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "./mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file ./mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file ./mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "./mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file ./mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "./mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file ./mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "./mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file ./mods-config/attr_filter/accounting_response # Loaded module rlm_chap # Instantiating module "chap" from file ./mods-enabled/chap # Loaded module rlm_linelog # Instantiating module "linelog" from file ./mods-enabled/linelog linelog { filename = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file ./mods-enabled/linelog linelog log_accounting { filename = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_replicate # Instantiating module "replicate" from file ./mods-enabled/replicate # Instantiating module "echo" from file ./mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "exec" from file ./mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unix # Instantiating module "unix" from file ./mods-enabled/unix unix { radwtmp = "/mnt/sdcard/software/freeradius-server-3.0.x/var/log/radius/radwtmp" } # Loaded module rlm_expr # Instantiating module "expr" from file ./mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_utf8 # Instantiating module "utf8" from file ./mods-enabled/utf8 # Loaded module rlm_preprocess # Instantiating module "preprocess" from file ./mods-enabled/preprocess preprocess { huntgroups = "./mods-config/preprocess/huntgroups" hints = "./mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file ./mods-config/preprocess/huntgroups reading pairlist file ./mods-config/preprocess/hints # Loaded module rlm_realm # Instantiating module "IPASS" from file ./mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file ./mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file ./mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file ./mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file ./mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_dhcp # Instantiating module "dhcp" from file ./mods-enabled/dhcp # Loaded module rlm_perl # Instantiating module "perl" from file ./mods-enabled/perl perl { filename = "./mods-config/perl/example.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_post_auth = "post_auth" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } rlm_perl (perl): parsing 'config' section... Segmentation fault (core dumped)

1 0

Fwd: Issue on receiving searchResEntry message from AD server
by Adarsha S 06 Oct '14

06 Oct '14

Hi All, I'm using freeradius-server-2.1.12.[ though its bit old version]. I've made a setup with my linux machine to work as radius server[ free radius is installed here]. For user LDAP authentication I'm using Windows 2003 server. My LDAP search works fine on receiving searchResDone from AD server.User authentication works fine. But on receiving searchResEntry message from AD server, My radius clients doesn't do anything and after few seconds the unbindRequest is Sent from radius client. I've attached the packet capture. Please guide me to fix this issue other than upgrading the free radius server as its no feasible for me at this moment. Thanks, Adarsha

2 1