- Freeradius-Users - lists.freeradius.org

Using old certificates
by Khalid Tawfik Kasem 28 Jan '14

28 Jan '14

Hi, we are replacing Diameter which use eap/tls and has its server and client certificates. Is there any way to use the old certificates inside freeRADIUS without forcing the clients to replace it with freeRADIUS certificates? We don't need to change the customer behavior. Your cooperation and support are highly appreciated. Best Regards, Khaled Qasem.

3 4

FreeRADIUS & sqlite?
by Mark DeCheser 28 Jan '14

28 Jan '14

Hey everyone, I'm interested to get FreeRADIUS working with a sqlite backend. My searches around the internet show there is support for sqlite in both 2.x and 3.x versions of FreeRADIUS. I am using 2.1.12 as packaged in CentOS 6. To start, can someone direct me to some documentation online which provides direction to getting this working? I must be looking in the wrong places, because I don't see much documentation for FreeRADIUS when using a sqlite datastore. The first issue I encountered was that there is no schema packaged for FreeRADIUS on CentOS. I worked around this issue by using the schema provided for PostgreSQL. Aside from the commands required to get the DB created, I was only required to remove one or two lines from the PostgreSQL schema: CREATE INDEX radacct_active_user_idx ON radacct (UserName, NASIPAddress, AcctSessionId) WHERE AcctStopTime IS NULL; CREATE INDEX radacct_start_user_idx ON radacct (AcctStartTime, UserName); At some point, I will revisit why these lines threw an error in sqlite, but accounting is a secondary concern right now. The primary concern is authentication, which is failing for pptpd/VPN users. I did manage to get authentication working for Squid users. I only have one record inserted into the radcheck table: [root@host ~]# sqlite3 /tmp/radius SQLite version 3.6.20 Enter ".help" for instructions Enter SQL statements terminated with a ";" sqlite> select * from radcheck; |radtestguy|Cleartext-Password|:=|radtestpw Auth, for Squid, is working beautifully here. Auth for VPN is not working, and I'm not sure why. Here's the full output of radiusd -X: [root@host ~]# radiusd -X FreeRADIUS Version 2.1.12, for host i386-redhat-linux-gnu, built on Oct 3 2012 at 01:20:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/sqlite/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no msg_badpass = "Door is locked." msg_goodpass = "Door is unlocked. C'mon in." } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "datsecret" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm NULL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "datsecret" nastype = "other" } client PUB.IP.OF.SERVER { require_message_authenticator = no secret = "datsecret" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_unixodbc" server = "" port = "" login = "" password = "" radius_db = "radius-datasource" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{Stripped-User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = (EXTRACT(EPOCH FROM ('%S'::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{%{Acct-Delay-Time}:-0}'::interval)))::BIGINT, AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0 WHERE AcctStopTime IS NULL AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'::timestamp" accounting_update_query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_update_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), '%{Acct-Session-Time}', '%{Acct-Authentic}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctStartDelay = 0, ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query = "UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), AcctSessionTime = CASE WHEN '%{Acct-Session-Time}' = '' THEN (EXTRACT(EPOCH FROM ('%S'::TIMESTAMP WITH TIME ZONE - AcctStartTime::TIMESTAMP WITH TIME ZONE - '%{%{Acct-Delay-Time}:-0}'::INTERVAL)))::BIGINT ELSE NULLIF('%{Acct-Session-Time}','')::BIGINT END, AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0, FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_stop_query_alt = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval - '%{%{Acct-Session-Time}:-0}'::interval), ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), NULLIF('%{Acct-Session-Time}', '')::bigint, '%{Acct-Authentic}', '%{Connect-Info}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0)" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to @:/radius-datasource rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 36456 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ===== Note the section "Module: Instantiating module "sql" from file /etc/raddb/sql.conf" where server, port, username and password are all blanked out as they are in the config. The answer involve specifying details to connect radius to the file by path, but I'm a bit lost here. I've tried turning on debug logging in rsyslog, but it doesn't provide much more in /var/log/messages than the following: Jan 27 22:37:17 host pppd[17041]: No CHAP secret found for authenticating radtestguy Jan 27 22:37:17 host pppd[17041]: Peer radtestguy failed CHAP authentication Jan 27 22:37:17 host pppd[17041]: sent [CHAP Failure id=0xae ""] Jan 27 22:37:17 host pppd[17041]: sent [LCP TermReq id=0x2 "Authentication failed"] Jan 27 22:37:17 host pppd[17041]: rcvd [LCP TermReq id=0x2 "Failed to authenticate ourselves to peer"] What other configs or sections of configs can I provide that would be helpful? Thanks in advance, Mark DeCheser

3 2

FreeRadius 2.2.3 segfault
by adrian.p.smith＠bt.com 27 Jan '14

27 Jan '14

I'm getting a crash. /var/log/messages says: Jan 27 14:24:05 localhost kernel: radiusd[14162]: segfault at 0000000000000070 rip 00002b17454280fc rsp 00007fff7b42b640 error 4 Output from radius -X radiusd: FreeRADIUS Version 2.2.3, for host x86_64-redhat-linux-gnu, built on Jan 27 2014 at 10:39:07 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/detail-store.btngh.openzone.com including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sql_log_store including configuration file /etc/raddb/modules/detail.iptracker including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/sql_log.dist including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/detail.btngh.openzone.com including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/detail.consulate including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/consulate-server including configuration file /etc/raddb/sites-enabled/acct_iptracker including configuration file /etc/raddb/sites-enabled/status including configuration file /etc/raddb/sites-enabled/acct_consulate including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/vf-server including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/acct_aggregator including configuration file /etc/raddb/sites-enabled/802.1x-server main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server skyport-car { ipaddr = 192.168.24.22 port = 1645 type = "auth+acct" secret = "XXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "request" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 username = "test_user_please_reject_me" password = "this is meaningless" } home_server eldon-car { ipaddr = 192.168.149.22 port = 1645 type = "auth+acct" secret = "XXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "request" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 username = "test_user_please_reject_me" password = "this is meaningless" } home_server 802.1x-auth-server-1 { ipaddr = 193.113.44.19 port = 1645 type = "auth" secret = "XXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "request" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 username = "server(a)test.alive.com" password = "this is meaningless" } home_server 802.1x-auth-server-2 { ipaddr = 193.113.44.20 port = 1645 type = "auth" secret = "XXXXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "request" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 username = "server(a)test.alive.com" password = "this is meaningless" } home_server 802.1x-auth-server-3 { ipaddr = 193.113.44.21 port = 1645 type = "auth" secret = "XXXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "request" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 username = "server(a)test.alive.com" password = "this is meaningless" } home_server 802.1x-auth-server-4 { ipaddr = 193.113.44.22 port = 1645 type = "auth" secret = "XXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "request" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 username = "server(a)test.alive.com" password = "this is meaningless" } home_server IPTracker { ipaddr = 193.113.44.16 port = 1813 type = "acct" secret = "XXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server testing-802.1x-auth-server { ipaddr = 192.168.49.99 port = 1812 type = "auth+acct" secret = "XXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server 802.1x-acct-relay-server-1 { ipaddr = 192.168.160.16 port = 1813 type = "acct" secret = "XXXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server 802.1x-acct-relay-server-2 { ipaddr = 192.168.160.17 port = 1813 type = "acct" secret = "XXXXXXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server 802.1x-acct-spool-server { virtual_server = "802.1x-server-acct" port = 0 type = "acct" response_window = 30 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server eldon-eap-server { ipaddr = 192.168.149.97 port = 1812 type = "auth+acct" secret = "XXXXXXXXXXXX" response_window = 30 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server consulate-server-1 { ipaddr = 193.113.24.74 port = 1645 type = "auth+acct" secret = "XXXXXXXXXXX" response_window = 30 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server consulate-acct { virtual_server = "consulate-server-acct" port = 0 response_window = 30 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool IPTracker_pool { home_server = IPTracker } realm iptracker { acct_pool = IPTracker_pool } home_server_pool testing-802.1x-auth-pool { virtual_server = 802.1x-server-auth home_server = testing-802.1x-auth-server } home_server_pool 802.1x-acct-pool { home_server = 802.1x-acct-spool-server } realm 1xTesting { auth_pool = testing-802.1x-auth-pool acct_pool = 802.1x-acct-pool nostrip } home_server_pool 802.1x-auth-pool { type = fail-over virtual_server = 802.1x-server-auth home_server = 802.1x-auth-server-1 home_server = 802.1x-auth-server-2 home_server = 802.1x-auth-server-3 home_server = 802.1x-auth-server-4 } realm 8021x:BTRCon { auth_pool = 802.1x-auth-pool acct_pool = 802.1x-acct-pool nostrip } home_server_pool 802.1x-acct-relay-pool { type = fail-over home_server = 802.1x-acct-relay-server-1 home_server = 802.1x-acct-relay-server-2 } realm acct_8021x:BTRCon { acct_pool = 802.1x-acct-relay-pool } home_server_pool vf_auth_failover { type = fail-over virtual_server = vf-server-auth home_server = skyport-car home_server = eldon-car } realm wlan.mnc015.mcc234.3gppnetwork.org { auth_pool = vf_auth_failover nostrip } home_server_pool eap-pool { home_server = eldon-eap-server } realm thistle8021x.btwifi.com { pool = eap-pool nostrip } home_server_pool consulate-auth-pool { virtual_server = consulate-server-auth home_server = consulate-server-1 } home_server_pool consulate-acct-pool { home_server = consulate-acct } realm wlan.mnc008.mcc234.3gppnetwork.org { auth_pool = consulate-auth-pool acct_pool = consulate-acct-pool nostrip } home_server_pool consulate-acct-relay-pool { home_server = consulate-server-1 } realm acct_consulate { acct_pool = consulate-acct-relay-pool nostrip } realm LOCAL { } home_server_pool testing-802.1x-acct-pool { home_server = testing-802.1x-auth-server } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "XXXXXXXXXXX" shortname = "localhost" nastype = "other" } client 192.168.70.0/24 { require_message_authenticator = no secret = "XXXXXXXXXXX" shortname = "isg-ssg-net-1" nastype = "cisco" } client 192.168.170.0/24 { require_message_authenticator = no secret = "XXXXXXXXXXX" shortname = "isg-ssg-net-2" nastype = "cisco" } client 192.168.14.0/24 { require_message_authenticator = no secret = "XXXXXXXXXX" shortname = "isg-ssg-net-3" nastype = "cisco" } client 192.168.100.31 { require_message_authenticator = no secret = "XXXXXXXXXXX" shortname = "monitor-1" } client 192.168.160.31 { require_message_authenticator = no secret = "XXXXXXXXXX" shortname = "monitor-2" } client 192.168.24.22 { require_message_authenticator = no secret = "XXXXXXXXXXXX" shortname = "test-car" nastype = "cisco" } client 192.168.79.2 { require_message_authenticator = no secret = "XXXXXXXXXXX" shortname = "ACE-Probe" nastype = "cisco" } client 192.168.79.3 { require_message_authenticator = no secret = "XXXXXXXXXXXXX" shortname = "ACE-Probe" nastype = "cisco" } client 192.168.179.2 { require_message_authenticator = no secret = "XXXXXXXXXX" shortname = "ACE-Probe" nastype = "cisco" } client 192.168.179.3 { require_message_authenticator = no secret = "XXXXXXXXXX" shortname = "ACE-Probe" nastype = "cisco" } client 192.168.18.2 { require_message_authenticator = no secret = "XXXXXXXXXXX" shortname = "ACE-Probe" nastype = "cisco" } client 192.168.18.3 { require_message_authenticator = no secret = "XXXXXXXXXX" shortname = "ACE-Probe" nastype = "cisco" } client 192.168.49.96 { require_message_authenticator = no secret = "XXXXXXXXX" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_realm Module: Instantiating module "IPASS" from file /etc/raddb/modules/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Framed-IP-Address, NAS-Port-Id" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_sql_log Module: Instantiating module "sql_log" from file /etc/raddb/modules/sql_log sql_log { path = "/var/log/radius/radacct/relay-acct/reject-%Y%m%d:%H" Post-Auth = "%t Acct-Status-Type = Interim-Update User-Name = "%{User-Name}" Acct-Session-Id = "REJECT" BTOpenzone-Reject-Message = "8021xReject:%{reply:Reply-Message}" NAS-IP-Address = %{NAS-IP-Address} Framed-IP-Address = %{Framed-IP-Address} Called-Station-Id = %{Called-Station-Id} Calling-Station-Id = %{Calling-Station-Id} Acct-Delay-Time = 0 Timestamp = %l " sql_user_name = "%{%{User-Name}:-DEFAULT}" utf8 = yes safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Instantiating module "sql_log_store" from file /etc/raddb/modules/sql_log_store sql_log sql_log_store { path = "/var/log/radius/radacct/store-acct/reject-%Y%m%d:%H" Post-Auth = "%t Acct-Status-Type = Interim-Update User-Name = "%{User-Name}" Acct-Session-Id = "REJECT" BTOpenzone-Reject-Message = "8021xReject:%{reply:Reply-Message}" NAS-IP-Address = %{NAS-IP-Address} Framed-IP-Address = %{Framed-IP-Address} Called-Station-Id = %{Called-Station-Id} Calling-Station-Id = %{Calling-Station-Id} Acct-Delay-Time = 0 Timestamp = %l " sql_user_name = "%{%{User-Name}:-DEFAULT}" utf8 = yes safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server consulate-server-auth { # from file /etc/raddb/sites-enabled/consulate-server modules { Module: Checking post-proxy {...} for more modules to load } # modules } # server server consulate-server-acct { # from file /etc/raddb/sites-enabled/consulate-server modules { Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail.btngh.openzone.com" from file /etc/raddb/modules/detail.btngh.openzone.com detail detail.btngh.openzone.com { detailfile = "/var/log/radius/radacct/relay-acct/detail-%Y%m%d:%H" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "detail-store.btngh.openzone.com" from file /etc/raddb/modules/detail-store.btngh.openzone.com detail detail-store.btngh.openzone.com { detailfile = "/var/log/radius/radacct/store-acct/detail-%Y%m%d:%H" header = "%t" detailperm = 416 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "detail.consulate" from file /etc/raddb/modules/detail.consulate detail detail.consulate { detailfile = "/var/log/radius/radacct/consulate/detail-%Y%m%d:%H" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } # modules } # server server acct_iptracker { # from file /etc/raddb/sites-enabled/acct_iptracker modules { Module: Checking accounting {...} for more modules to load } # modules } # server server status { # from file /etc/raddb/sites-enabled/status modules { Module: Creating Autz-Type = Status-Server Module: Checking authorize {...} for more modules to load } # modules } # server server acct_consulate { # from file /etc/raddb/sites-enabled/acct_consulate modules { Module: Checking accounting {...} for more modules to load } # modules } # server server vf-server-auth { # from file /etc/raddb/sites-enabled/vf-server modules { Module: Checking pre-proxy {...} for more modules to load Module: Instantiating module "reject" from file /etc/raddb/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } } # modules } # server server acct_aggregator { # from file /etc/raddb/sites-enabled/acct_aggregator modules { Module: Checking accounting {...} for more modules to load } # modules } # server server 802.1x-server-auth { # from file /etc/raddb/sites-enabled/802.1x-server modules { Module: Checking post-proxy {...} for more modules to load Module: Instantiating module "noop" from file /etc/raddb/modules/always always noop { rcode = "noop" simulcount = 0 mpp = no } } # modules } # server server 802.1x-server-acct { # from file /etc/raddb/sites-enabled/802.1x-server modules { Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail.iptracker" from file /etc/raddb/modules/detail.iptracker detail detail.iptracker { detailfile = "/var/log/radius/radacct/iptracker/detail-%Y%m%d:%H" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" mode = "rw" } } listen { type = "detail" listen { filename = "/var/log/radius/radacct/iptracker/*" load_factor = 10 poll_interval = 1 retry_interval = 30 } } listen { type = "status" ipaddr = 127.0.0.1 port = 18120 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "adminsecret" } } listen { type = "detail" listen { filename = "/var/log/radius/radacct/consulate/*" load_factor = 10 poll_interval = 1 retry_interval = 30 } } listen { type = "detail" listen { filename = "/var/log/radius/radacct/relay-acct/*" load_factor = 10 poll_interval = 1 retry_interval = 30 } } ... adding new socket proxy address * port 40182 ... adding new socket proxy address * port 54630 ... adding new socket proxy address * port 41460 ... adding new socket proxy address * port 46468 ... adding new socket proxy address * port 55955 ... adding new socket proxy address * port 40148 ... adding new socket proxy address * port 55333 ... adding new socket proxy address * port 58120 ... adding new socket proxy address * port 42133 ... adding new socket proxy address * port 52148 ... adding new socket proxy address * port 33849 ... adding new socket proxy address * port 58632 ... adding new socket proxy address * port 36516 ... adding new socket proxy address * port 60425 ... adding new socket proxy address * port 43158 ... adding new socket proxy address * port 47771 ... adding new socket proxy address * port 48703 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on detail file /var/log/radius/radacct/iptracker/* as server acct_iptracker Detail listener /var/log/radius/radacct/iptracker/* state unopened signalled 0 waiting 1.000000 sec Listening on status address 127.0.0.1 port 18120 as server status Listening on detail file /var/log/radius/radacct/consulate/* as server acct_consulate Detail listener /var/log/radius/radacct/consulate/* state unopened signalled 0 waiting 1.000000 sec Listening on detail file /var/log/radius/radacct/relay-acct/* as server acct_aggregator Detail listener /var/log/radius/radacct/relay-acct/* state unopened signalled 0 waiting 1.000000 sec Listening on proxy address * port 1814 Waking up in 0.9 seconds. Polling for detail file /var/log/radius/radacct/iptracker/* Detail listener /var/log/radius/radacct/iptracker/* state unopened signalled 0 waiting 1.173734 sec Polling for detail file /var/log/radius/radacct/consulate/* Detail listener /var/log/radius/radacct/consulate/* state unopened signalled 0 waiting 0.928983 sec Polling for detail file /var/log/radius/radacct/relay-acct/* Detail listener /var/log/radius/radacct/relay-acct/* state unopened signalled 0 waiting 0.835711 sec Waking up in 0.8 seconds. Polling for detail file /var/log/radius/radacct/relay-acct/* Detail listener /var/log/radius/radacct/relay-acct/* state unopened signalled 0 waiting 1.036269 sec Polling for detail file /var/log/radius/radacct/consulate/* Detail listener /var/log/radius/radacct/consulate/* state unopened signalled 0 waiting 0.882089 sec Waking up in 0.2 seconds. Polling for detail file /var/log/radius/radacct/iptracker/* Detail listener /var/log/radius/radacct/iptracker/* state unopened signalled 0 waiting 1.019558 sec Waking up in 0.6 seconds. Polling for detail file /var/log/radius/radacct/consulate/* Detail listener /var/log/radius/radacct/consulate/* state unopened signalled 0 waiting 1.197507 sec Polling for detail file /var/log/radius/radacct/relay-acct/* Detail listener /var/log/radius/radacct/relay-acct/* state unopened signalled 0 waiting 0.850833 sec Waking up in 0.3 seconds. Polling for detail file /var/log/radius/radacct/iptracker/* Detail listener /var/log/radius/radacct/iptracker/* state unopened signalled 0 waiting 1.078351 sec Waking up in 0.5 seconds. Polling for detail file /var/log/radius/radacct/relay-acct/* Detail listener /var/log/radius/radacct/relay-acct/* state unopened signalled 0 waiting 0.931512 sec Waking up in 0.2 seconds. Polling for detail file /var/log/radius/radacct/consulate/* Detail listener /var/log/radius/radacct/consulate/* state unopened signalled 0 waiting 1.203859 sec Waking up in 0.2 seconds. Polling for detail file /var/log/radius/radacct/iptracker/* Detail listener /var/log/radius/radacct/iptracker/* state unopened signalled 0 waiting 1.085231 sec Waking up in 0.3 seconds. Polling for detail file /var/log/radius/radacct/relay-acct/* Detail listener /var/log/radius/radacct/relay-acct/* state unopened signalled 0 waiting 1.212170 sec Waking up in 0.5 seconds. Polling for detail file /var/log/radius/radacct/consulate/* Detail listener /var/log/radius/radacct/consulate/* state unopened signalled 0 waiting 0.975271 sec Waking up in 0.1 seconds. Polling for detail file /var/log/radius/radacct/iptracker/* Detail listener /var/log/radius/radacct/iptracker/* state unopened signalled 0 waiting 0.823461 sec Waking up in 0.5 seconds. Polling for detail file /var/log/radius/radacct/relay-acct/* Detail listener /var/log/radius/radacct/relay-acct/* state unopened signalled 0 waiting 1.150286 sec Waking up in 0.3 seconds. Polling for detail file /var/log/radius/radacct/iptracker/* Detail listener /var/log/radius/radacct/iptracker/* state unopened signalled 0 waiting 1.219787 sec Polling for detail file /var/log/radius/radacct/consulate/* Detail listener /var/log/radius/radacct/consulate/* state unopened signalled 0 waiting 0.916838 sec Waking up in 0.8 seconds. Polling for detail file /var/log/radius/radacct/relay-acct/* Detail listener /var/log/radius/radacct/relay-acct/* state unopened signalled 0 waiting 0.938346 sec Polling for detail file /var/log/radius/radacct/consulate/* Detail listener /var/log/radius/radacct/consulate/* state unopened signalled 0 waiting 1.059003 sec Waking up in 0.2 seconds. Polling for detail file /var/log/radius/radacct/iptracker/* Detail listener /var/log/radius/radacct/iptracker/* state unopened signalled 0 waiting 0.888133 sec Waking up in 0.5 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 53787, id=242, length=375 Acct-Session-Id = "00000838" Framed-Protocol = PPP Cisco-SSG-Service-Info = "NConsulate_8021X_Roaming" Cisco-AVPair = "parent-session-id=00000837" Framed-IP-Address = 10.50.49.11 User-Name = "1234081219000082(a)wlan.mnc008.mcc234.3gppnetwork.org" Cisco-SSG-Control-Info = "I0;443495" Cisco-SSG-Control-Info = "O0;141604" Acct-Input-Packets = 851 Acct-Output-Packets = 1035 Acct-Input-Octets = 141604 Acct-Output-Octets = 443495 Acct-Session-Time = 10069 Acct-Status-Type = Interim-Update Cisco-AVPair = "portbundle=enable" Cisco-SSG-Account-Info = "S192.168.89.94:22" Calling-Station-Id = "bc20.a4cd.dfaa" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/0/4/0" Service-Type = Framed-User NAS-IP-Address = 192.168.70.11 Event-Timestamp = "Jan 24 2014 13:42:55 GMT" NAS-Identifier = "bay-isg1-asr1004.btopenzone.com" Acct-Delay-Time = 0 # Executing section preacct from file /etc/raddb/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port-Id = "0/0/4/0",Framed-IP-Address = 10.50.49.11,NAS-IP-Address = 192.168.70.11,Acct-Session-Id = "00000838",User-Name = "1234081219000082(a)wlan.mnc008.mcc234.3gppnetwork.org"' [acct_unique] Acct-Unique-Session-ID = "6740450b0490a636". ++[acct_unique] = ok [IPASS] No '/' in User-Name = "1234081219000082(a)wlan.mnc008.mcc234.3gppnetwork.org", looking up realm NULL [IPASS] No such realm "NULL" ++[IPASS] = noop [suffix] Looking up realm "wlan.mnc008.mcc234.3gppnetwork.org" for User-Name = "1234081219000082(a)wlan.mnc008.mcc234.3gppnetwork.org" [suffix] Found realm "wlan.mnc008.mcc234.3gppnetwork.org" [suffix] Adding Realm = "wlan.mnc008.mcc234.3gppnetwork.org" [suffix] Proxying request from user 1234081219000082 to realm wlan.mnc008.mcc234.3gppnetwork.org [suffix] Preparing to proxy accounting request to realm "wlan.mnc008.mcc234.3gppnetwork.org" ++[suffix] = updated +} # group preacct = updated # Executing section accounting from file /etc/raddb/sites-enabled/default +group accounting { ++? if (noop) ? Evaluating (noop) -> FALSE ++? if (noop) -> FALSE ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> 1234081219000082(a)wlan.mnc008.mcc234.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated WARNING: Empty pre-proxy section. Using default return values. >>> Sending proxied request internally to virtual server. server consulate-server-acct { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/raddb/sites-enabled/consulate-server +group accounting { ++? if (! (Cisco-SSG-Service-Info) && ( "%{Acct-Status-Type}" == "Stop" ) && ( "%{Tunnel-Type}" != "VLAN") ) ?? Evaluating (Cisco-SSG-Service-Info) -> TRUE ? Converting !TRUE -> FALSE ?? Skipping ("%{Acct-Status-Type}" == "Stop" ) ?? Skipping ("%{Tunnel-Type}" != "VLAN") ++? if (! (Cisco-SSG-Service-Info) && ( "%{Acct-Status-Type}" == "Stop" ) && ( "%{Tunnel-Type}" != "VLAN") ) -> FALSE ++? if (! (Cisco-SSG-Service-Info) ) ?? Evaluating (Cisco-SSG-Service-Info) -> TRUE ? Converting !TRUE -> FALSE ++? if (! (Cisco-SSG-Service-Info) ) -> FALSE +} # group accounting = noop } # server consulate-server-acct Going to the next request <<< Received proxied response code 0 from internal virtual server. # Executing section post-proxy from file /etc/raddb/sites-enabled/default +group post-proxy { [eap] No pre-existing handler found I can re-create at will by sending in the packet using radclient. All help appreciated. Adrian Smith

2 5

3.0.x won't load dictionaries
by Adam Bishop 27 Jan '14

27 Jan '14

I've just built 3.0.x from git using the spec file provided, however it doesn't want to load any dictionaries. I had a quick poke around with GDB: mainconfig.dictionary_dir is unset - however, if I inspect server_config[7]: (gdb) print server_config[7] $10 = {name = 0x43ee52 "dict_dir", type = 8292, offset = 0, data = 0x6577d0, dflt = 0x43ee5b} (gdb) x/s 0x43ee5b 0x43ee5b: "${prefix}/share" The branch at mainconfig.c:777 goes the wrong way, so the dictionaries systemwide dictionaries aren't touched. Setting dict_dir in radiusd.conf doesn't change this. Debug log follows for completeness, but is sadly not very interesting, other than showing 'dict_dir = "/etc/raddb"'. Thanks, Adam Bishop gpg: 0x6609D460 Janet, the UK's research and education network. ----------- # radiusd -X radiusd: FreeRADIUS Version 3.0.2, for host x86_64-redhat-linux-gnu, built on Jan 27 2014 at 14:23:52 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/radutmp including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" dict_dir = "/etc/raddb" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_exec # Instantiating module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_soh # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy /etc/raddb/mods-config/attr_filter/post-proxy[104]: Parse error (reply) for entry DEFAULT: Unknown vendor name in attribute name "Service-Type" Errors reading /etc/raddb/mods-config/attr_filter/post-proxy /etc/raddb/mods-enabled/attr_filter[12]: Instantiation failed for module "attr_filter.post-proxy" Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1

trouble building RPM
by adrian.p.smith＠bt.com 27 Jan '14

27 Jan '14

Trying to upgrade from 2.1.12 on our antiquated OS and cannot build the RPM. /usr/bin/libtool --mode=link gcc -release 020203 \ -pie -Wl,-znow -export-dynamic -o libfreeradius-radius.la -rpath /usr/lib64/freeradius dict.lo filters.lo hash.lo hmac.lo hmacsha1.lo isaac.lo log.lo misc.lo missing.lo md4.lo md5.lo print.lo radius.lo rbtree.lo sha1.lo snprintf.lo strlcat.lo strlcpy.lo token.lo udpfromto.lo valuepair.lo fifo.lo packet.lo event.lo getaddrinfo.lo vqp.lo heap.lo dhcp.lo base64.lo gcc -shared .libs/dict.o .libs/filters.o .libs/hash.o .libs/hmac.o .libs/hmacsha1.o .libs/isaac.o .libs/log.o .libs/misc.o .libs/missing.o .libs/md4.o .libs/md5.o .libs/print.o .libs/radius.o .libs/rbtree.o .libs/sha1.o .libs/snprintf.o .libs/strlcat.o .libs/strlcpy.o .libs/token.o .libs/udpfromto.o .libs/valuepair.o .libs/fifo.o .libs/packet.o .libs/event.o .libs/getaddrinfo.o .libs/vqp.o .libs/heap.o .libs/dhcp.o .libs/base64.o -Wl,-znow -Wl,-soname -Wl,libfreeradius-radius-020203.so -o .libs/libfreeradius-radius-020203.so /usr/bin/ld: .libs/dict.o: relocation R_X86_64_PC32 against `dict_attr_types' can not be used when making a shared object; recompile with -fPIC /usr/bin/ld: final link failed: Bad value collect2: ld returned 1 exit status gmake[4]: *** [libfreeradius-radius.la] Error 1 gmake[4]: Leaving directory `/usr/src/redhat/BUILD/freeradius-server-2.2.3/src/lib' gmake[3]: *** [lib] Error 2 gmake[3]: Leaving directory `/usr/src/redhat/BUILD/freeradius-server-2.2.3/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/src/redhat/BUILD/freeradius-server-2.2.3/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/usr/src/redhat/BUILD/freeradius-server-2.2.3' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.56364 (%build) It does appear to be compiling with -fPIC Any ideas appreciated Regards, Adrian Smith

3 5

Authenticating wifi users via mysqldb
by Winston McDowell 27 Jan '14

27 Jan '14

I tried setting up freeradius with mysql based on the information from the wiki site. I can run radtest from the command line and authenticate a user in the database. Every attempt via wifi generates the error "Ignoring requests to authentication address * port 1812 from unknown client 192.168.226.248 port 58245" I have the following tables in mysql : nas, radacct, radcheck, radgroupcheck, radgroupreply, radposauth,radreply, radusergroup. I only have 2 test users in table radcheck, if that is the issue, what table fields should I populate to get one of my test users to authenticate via wifi? My objective is to only authenticate my wifi users via a central db, any recommendations for the basic way to achieve that is appreciated.

2 2

Errors with bootstrap creating certificate after modifying server.cnf and client.cnf
by Winston McDowell 26 Jan '14

26 Jan '14

Seems like the defaults work until I change country code, organization or any other field. Just wondering if there is another file to check besides server.cnf and client.cnf ?

2 2

permission problem testing PAP auth
by Darrel 24 Jan '14

24 Jan '14

Hello, On FreeBSD 10, I deleted the file dhcp from /usr/local/etc/raddb/mods-enabled and commented out dhcp.dictionary in the file /usr/local/share/freeradius/dictionary, since the dhcp module does not compile on FreeBSD. When doing a simple PAP test, root connected and my user did not. All the directories under and including /usr/local/etc/raddb belong to user and group freeradius. When I begin to have external clients then obviously I can not add them all to the group freeradius. I am not eager to sweepingly ease permissions on all the directories, either. What is the best way to solve this? Darrel

2 1

Debian 7 sendfromto()
by r00tk1d＠km.pl.ua 24 Jan '14

24 Jan '14

Hi! I'm using Debian 7 (Linux bill0 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64 GNU/Linux) and got the problem with Freeradius DHCP from current git. It's doesn't sent DHCP response back to user, and, while debugging it, i found that by default Freeradius sets a WITH_UDPFROMTO and thus uses udpfromto() function, but it always returns errno 22 (Invalid argument). But when use --with-udpfromto=no for configure, there's no any problem. Is it expected behavior? I'm using these parameters ./configure --with-static-modules=perl --with-dhcp --with-system-libtool --with-system-libpcre for

3 9

(Ruckus AP + CHAP + 802.1x EAP) + (FreeRadius + OpenLDAP) is possible? or need some magic?
by Jorge Pereira 24 Jan '14

24 Jan '14

hi folks! I've in my labs the "Ruckus AP" with SSID setted with authentication "802.1x EAP" and encryption method "WPA2" / algorithm AES. but, my only option for "Auth Method" is CHAP (not ms-chap) or PAP! of course that in this case, my only way out is use "CHAP" (again, i don't have ms-chap in my AP) my question is: could be possible authorize in my FreeRadius+OpenLdap? because i'm looking by many weeks about some solutions and didn't found anything that can solve my problem.... I heard something that need to add/create a new field in my openldap for store the "chap-password"... something like that! by the way: in my lab, i've winbind authorizing perfectly in my AD (that use OpenLDAP) eg: [root@lab samba]# ntlm_auth --request-nt-key --domain=domainlab --username="jpereiran" password: NT_STATUS_OK: Success (0x0) [root@lab samba]# obs: if someone available to try clarify my ideas, and give some way... I'll be very grateful!! :) Att, Jorge Pereira

2 1