- Freeradius-Users - lists.freeradius.org

Please test the new DHCP options encoder
by Arran Cudbard-Bell 27 May '14

27 May '14

Just a heads up, i've backported the new DHCP options encoder from master. If anyone is using DHCP with v3.0.x they may want to try it to make sure nothing is horribly and obviously broken. The original code was a bit poor on the bounds checking, and with sufficiently large DHCP packets the outbound packet buffer could of easily overflowed. There's a new %{dhcp:&<attrref>} xlat, which was added to allow tests to be written using the unittest framework. If anyone has some free time and is using the DHCP functionality of the server it'd be really useful if they could write some basic unit tests. The framework is very simple, and there are tons of examples in src/tests/keywords. They're all written in unlang, so if you can write policies in the server you can write unit tests :). Tests help everybody, they help you by ensuring the features you need work correctly between releases, and they help us and the rest of the community by keeping the general quality of the server high. Thanks. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Free radius : Increase debug log level
by Lakshmanji Chandrasekaran 27 May '14

27 May '14

Hi All, We are running FreeRADIUS Version 2.1.11 on Red Hat Enterprise Linux Server release 5.10 (Tikanga). We are looking to increase the debug log level to identify the free radius crashing and from the man page we could see the below options. -X Turn on full debugging. -x Turn on additional debugging. (-xx gives more debugging). But the above options are not providing more details of crash error. Is there any other options to increase the logging level (any command line or configuration file change to increase logging level ) ? Thanks in Advance. Regards, Lakshmanji

4 6

IBM AIX 7.1 install pam_radius-1.3.17 error
by Sam 林立山 27 May '14

27 May '14

Hello every one, I try install pam_radius-1.3.17 into IBM AIX 7.1 server. I install Linux tool first. When I make, have error: # make cc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o pam_radius_auth.c: In function 'talk_radius': pam_radius_auth.c:886:10: warning: passing argument 6 of 'nrecvfrom' from incompatible pointer type [enabled by default] 0, &saremote, &salen)) < 0) { ^ In file included from pam_radius_auth.h:8:0, from pam_radius_auth.c:65: /usr/include/sys/socket.h:552:9: note: expected 'socklen_t *' but argument is of type 'int *' ssize_t recvfrom(int, void *__restrict__, size_t, int, struct sockaddr *__restrict__, socklen_t *__restrict__); ^ pam_radius_auth.c: In function 'rad_converse': pam_radius_auth.c:1027:3: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type [enabled by default] retval = pam_get_item(pamh, PAM_CONV, (CONST void **) &conv); ^ In file included from /usr/include/security/pam_modules.h:28:0, from pam_radius_auth.c:63: /usr/include/security/pam_appl.h:193:1: note: expected 'void **' but argument is of type 'const void **' pam_get_item( ^ pam_radius_auth.c:1030:3: warning: passing argument 2 of 'conv->conv' from incompatible pointer type [enabled by default] retval = conv->conv(1, msg, &resp,conv->appdata_ptr); ^ pam_radius_auth.c:1030:3: note: expected 'struct pam_message **' but argument is of type 'const struct pam_message **' pam_radius_auth.c: At top level: pam_radius_auth.c:1061:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1268:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c: In function 'pam_private_session': pam_radius_auth.c:1300:3: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type [enabled by default] retval = pam_get_user(pamh, &user, NULL); ^ In file included from /usr/include/security/pam_modules.h:28:0, from pam_radius_auth.c:63: /usr/include/security/pam_appl.h:219:1: note: expected 'char **' but argument is of type 'const char **' pam_get_user( ^ pam_radius_auth.c:1321:5: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type [enabled by default] retval = pam_get_item(pamh, PAM_SERVICE, (CONST void **) &config.client_id); ^ In file included from /usr/include/security/pam_modules.h:28:0, from pam_radius_auth.c:63: /usr/include/security/pam_appl.h:193:1: note: expected 'void **' but argument is of type 'const void **' pam_get_item( ^ pam_radius_auth.c:1288:7: warning: variable 'ctrl' set but not used [-Wunused-but-set-variable] int ctrl; ^ pam_radius_auth.c: At top level: pam_radius_auth.c:1369:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1376:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1387:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1616:12: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'int' PAM_EXTERN int ^ pam_radius_auth.c:1014:12: warning: 'rad_converse' defined but not used [-Wunused-function] static int rad_converse(pam_handle_t *pamh, int msg_style, char *message, char **password) ^ pam_radius_auth.c:1283:1: warning: 'pam_private_session' defined but not used [-Wunused-function] pam_private_session(pam_handle_t *pamh, int flags, ^ make: 1254-004 The error code from the last command is 1. Stop. -- Sam ============================================================== Sam Lin 林立山 Acom Networks E-MAIL : sam(a)acom-networks.com OFFICE : +886.2.2313.1416 MOBILE : +886.930.895.633 ==============================================================

4 15

Intermittent access-reject even though password is correct
by Sachin Yadav 26 May '14

26 May '14

Hi, I am getting intermittent access-reject response from free-radius even though password was correct. User have to try again and this time user is allowed. Following are the debug logs for one such transaction - rad_recv: Access-Request packet from host 122.176.209.171 port 23328, id=41, length=321 ChilliSpot-Version = "1.3.0" User-Name = "aqua" CHAP-Challenge = 0x86b6482ac2204b1801b4705ca5d43722 CHAP-Password = 0x00662b9af994945519294eb931419a5e21 Service-Type = Login-User Acct-Session-Id = "5380389300000002" Framed-IP-Address = 192.168.182.3 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 NAS-Port-Id = "00000002" Calling-Station-Id = "60-FA-CD-D1-45-CE" Called-Station-Id = "C8-D3-A3-6C-F2-53" NAS-IP-Address = 192.168.182.1 NAS-Identifier = "moka_ug" WISPr-Location-ID = "isocc=,cc=,ac=,network=xxxxxxx" WISPr-Location-Name = "xxxx" WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Message-Authenticator = 0xe8d077bea1e4565958097834c2143975 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "aqua", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> aqua [sql] sql_set_user escaped user --> 'aqua' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'aqua' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'aqua' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'aqua' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'gartino_ug' ORDER BY id [sql] User found in group gartino_ug [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'gartino_ug' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "aqua" with CHAP password [chap] Using clear text password "mango" for user aqua authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aqua attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3601 for 1 seconds Going to the next request Waking up in 0.9 seconds. Can someone please help me understand what's going wrong? I am using coovachilli as a capative portal solution which automatically send these packets to radius server for AAA.

2 1

NAS-Port always the same
by Khapare Joshi 26 May '14

26 May '14

Hi, I am trying to use simualtaneous-use with radutmp file but cisco controller is always sending the same port to all devices and logs NAS-Port=1 for all devices in accounting detail file. Here is the typical log : Mon May 26 13:54:10 2014 User-Name = "anonymous(a)mwn.de" NAS-Port = 1 NAS-IP-Address = 192.168.1.1 Framed-IP-Address = 10.1.1.1 NAS-Identifier = "mytestNAS" Airespace-Wlan-Id = 300 Acct-Session-Id = "53833d09/b8:f6:b1:d1:cc:89/3584354" NAS-Port-Type = Wireless-802.11 Cisco-AVPair = "audit-session-id=82d0a5f80004506053833d07" Acct-Authentic = RADIUS Event-Timestamp = "May 26 2014 13:54:10 GMT" Acct-Status-Type = Interim-Update Acct-Input-Octets = 274220 Acct-Input-Gigawords = 0 Acct-Output-Octets = 354276 Acct-Output-Gigawords = 0 Acct-Input-Packets = 2174 Acct-Output-Packets = 1529 Acct-Session-Time = 2681 Acct-Delay-Time = 0 Calling-Station-Id = "10.1.1.1" Called-Station-Id = "192.168.1.1" Cisco-AVPair = "nas-update=true" Acct-Unique-Session-Id = "df8c433d8fc2ee10" Realm = "DEFAULT" Timestamp = 1401112450 Request-Authenticator = Verified Can I not change that NAS-IP to actual wireless access point rather the controller IP address ? I tried changing /etc/raddb/acct_users file as : NAS-Identifier == "mytestNAS", NAS-IP-Address := "%{Framed-IP-Address:-%{NAS-IP-Address}}" but I still get the NAS-Port=1 for all the device. There must be users whose cisco wireless access points controlled by the controller - can someone point me ? Khapare

3 3

radiusd not installed in FreeRadius 3.0.3
by * 26 May '14

26 May '14

Hi, I have compiled and install the Debian package of FreeRadius 3.0.3. But radiusd is not installed. It is in my local FreeRadius 3.0.3 directory (freeradius-server-3.0.3/build/bin). Why is this? Jake He

3 2

FreeRADIUS v3.0.3 Fedora packages available
by Nikolai Kondrashov 26 May '14

26 May '14

Hi everyone, FreeRADIUS v3.0.3 packages are available for Fedora 20 [1]. Fedora users are welcome to test and leave karma feedback [2]. Apart from the changes noted in the upstream ChangeLog (installed with freeradius-doc), fixes for the following post-release issues were applied: * case-insensitive matching in compiled regular expressions not working, * upstream issue #634 "3.0.3 SIGSEGV on config parse", * upstream issue #635 "3.0.x - rlm_perl - strings are still escaped when passed to perl from FreeRADIUS", * upstream issue #639 "foreach may cause ABORT". Nick [1] https://admin.fedoraproject.org/updates/FEDORA-2014-6698/freeradius-3.0.3-1… [2] http://fedoraproject.org/wiki/How_to_test_updates

1 0

RE: Subject: Package availability question (Mike Poole)
by Rui Ribeiro 24 May '14

24 May '14

Hi, No, you arent. Wheezy here too. Build your own debs. aptitude install libssl-dev quilt libtool libltdl3-dev libpam0g-dev libmysqlclient-dev libgdbm-dev libldap2-dev libsasl2-dev libiodbc2-dev libkrb5-dev libperl-dev libpcap-dev python-dev libsnmp-dev libpq-dev debhelper git clone git://git.freeradius.org/freeradius-server.git cd freeradius-server git fetch origin v2.x.x:v2.x.x git checkout v2.x.x cd .. fakeroot dpkg-buildpackage -b -uc sudo dpkg --force-confold --force-confdef -i freeradius_2.2.*git_*.deb freeradius-common_2.2.*git_*.deb freeradius-ldap_2.2.*git_*.deb freeradius-mysql_2.2.*git_*.deb freeradius-utils_2.2.*git_*.deb libfreeradius2_2.2.*git_*.deb Rui Ribeiro https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 Message: 1 > Date: Fri, 23 May 2014 19:06:41 +0000 > From: Mike Poole <mpoole(a)pavlovmedia.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Subject: Package availability question > Message-ID: > <6712C775E82EB247807B5D7CCFBE940786B2358E(a)sula.pavlovmedia.corp> > Content-Type: text/plain; charset="us-ascii" > > Debian Wheezy would be greatly appreciated if possible. We are stuck at > 2.1.12 unless we can get an enterprise change to Ubuntu. > > > >

1 0

Minor tags behaviour change
by Arran Cudbard-Bell 23 May '14

23 May '14

Hi All, Just a heads up for anyone tags. From 3.0.4 onwards in unlang <attr>:0 will be taken to mean operate only on attributes with no tag value set. If no tag specifier is used i.e. <attr> or &<attr> it's taken to mean operate on all instances of <attr> regardless of tag value. Previous behaviour was inconsistent and in some cases <attr>:0 was treated the same as <attr>. I highly doubt anyone was using <attr>:0 to select untagged attributes previously, so this shouldn't be a disruptive change. If you weren't aware, we now also support deleting attributes by index and/or tag. update request { Tunnel-Server-Endpoint:1[1] !* ANY } Will remove the second Tunnel-Server-Endpoint attributes with a tag of 1. update request { Tunnel-Server-Endpoint:1 -= 'foo' } Will remove any Tunnel-Server-Endpoint attributes with a tag of 1 which have a value of 'foo'. With 3.0.4 radius_map2request was changed to allow it to operate on multiple values. You won't see any change in normal unlang behaviour, but it does allow some extra special magic when using LDAP. For example if you have multiple instances of the same ldap attribute: naughtyWords: foo naughtyWords: bar naughtyWords: baz and you did ldap { update { reply:Reply-Message -= 'naughtyWords' } } It would remove any Reply-Message which had a value matching any one of the LDAP naughtyWords, just as: ldap { update { reply:Chargeable-User-Identity += 'naughtyWords' } } Would add multiple Chargeable-User-Identity attributes. There's some slight weirdness with this, if you do: ldap { update { reply:Reply-Message := 'naughtyWords' } } Reply-Message will actually be set to baz. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 2

New RHEL and Fedora package maintainer
by Nikolai Kondrashov 23 May '14

23 May '14

Hi everyone, My name is Nikolai Kondrashov (Nick for short, aka spbnick) and I'm the new maintainer of FreeRADIUS packages for RHEL and Fedora, replacing John Dennis. I have actually started about mid-February, but was mostly learning and then had a string of colds, which kept me from working. John was and hopefully will be assisting me in learning further. In addition to being the package maintainer, I'll also participate in SSSD [1] development and will continue maintaining my DIGImend [2] project, when time allows. You can find my working background on LinkedIn [3]. I'd like to ask both users and the development team what you would like to see from Fedora and RHEL packaging of FreeRADIUS and from me as a maintainer. Please voice any concerns or suggestions you have and I will try to address them. Thank you. Nick [1] https://fedorahosted.org/sssd/ [2] http://digimend.sourceforge.net/ [3] https://www.linkedin.com/in/spbnick

7 16