- Freeradius-Users - lists.freeradius.org

Order of loading modules
by Francesco Maisano 07 Jan '14

07 Jan '14

Hi all, I need to known the order of loading of freeradius modules because i have two server with same configuration but when i start freeradius on server 1 charge, in order, module x (perl) and y (perl_Original) after, on server 2 viceversa. This info is needed because i have modified the perl module and first, i have saved the original perl with name perl_Original and i have modified the perl with the execution of my perl script. Best regards maframan My servers: Freeradius version 2.1.12 with perl library 5.14.2 on solaris SPARC 10 operating system

4 14

Defects - A reminder
by Arran Cudbard-Bell 07 Jan '14

07 Jan '14

The following can be found bundled with the server in doc/bugs and at https://github.com/FreeRADIUS/freeradius-server/blob/master/doc/bugs. 1.YOU FOUND A BUG Where the server terminates ungracefully due to a bus error, segmentation violation, or other memory error, you should create a new issue in the issue tracker <URL: http://bugs.freeradius.org>, including information from sections 4 and 5. For other issues, you should first discuss them on the users list, to see if anyone can reproduce them. Often there's a simple explanation of why the server behaves as it does, and it's not necessarily a bug in the code, so browse the lists' archives of the last two months, and if you don't see messages about it, ask! If the behavior is correct but confusing, we think that's a bug too, and you should file a bug against our documentation. For more information about the users list, the lists' archives and the faq, please visit http://www.freeradius.org/list/users.html Please make sure to READ and RESPECT the house-rules. You will get much better response and much faster if you do! 2.CORE DUMPS If the server, or one of the accompyaning programs core dumps, then you should rebuild the server as follows: $ ./configure --enable-developer $ make $ make install and then run the program again. You may have to to enable core dumps, via: $ ulimit -c unlimited When it core dumps, do: $ gdb /path/to/executable /path/to/core/file Enable logging in gdb via the following commands: (gdb) set logging file gdb-radiusd.log (gdb) set logging on and follow the instructions in section 4, below. 3. DEBUGGING A LIVE SERVER If you can't get a core dump, or the problem doesn't result in a core dump, you may have to run the server under gdb. To do this, ensure that you have symbols in the binaries (i.e. a non-stripped binary) by re-building the server as described in the previous section. Then, run the server under gdb as follows: $ gdb radiusd Enable logging in gdb via the following commands: (gdb) set logging file gdb-radiusd.log (gdb) set logging on Tell gdb to pass any necessary command-line arguments to the server: (gdb) set args ... Where the "..." are the command-line arguments you normally pass to radiusd. Fo debugging, you probably want to do: (gdb) set args -f Then, do: (gdb) run When something interesting happens, you can hit CTRL-C in the window, and you should be back at the gdb prompt: (gdb) And follow the instructions in section 4, below. 4. OBTAINING USEFUL INFORMATION Once you have a core dump loaded into gdb, or FreeRADIUS running under gdb, you may use the commands below to get useful information about the state of the server. If the server was built with threads, you can do: (gdb) info threads Which will give you information about the threads. If the server isn't threaded, that command-line will print a message saying so. Then, do: (gdb) thread apply all bt full If the server isn't threaded, the "thread apply" section isn't necessary The output should be printed to the screen, and also sent to the gdb-radiusd.log file. You should then submit the information from the log file, along with any server output, the output of radiusd -xv, and information about your operating system to: http://bugs.freeradius.org/ Submitting it to the bug database ensures that the bug report won't get forgotten, and that it will be dealt with in due course. You should provide the issue number in any mail sent to the user's list. 5. VALGRIND On Linux systems, "valgrind" is a useful tool that can catch certain classes of bugs. To use it, run the server via: $ valgrind --tool=memcheck --leak-check=full radiusd -Xm It will print out certain kinds of errors to the screen. There may be a number of errors related to OpenSSL, dlopen(), or libtldl. We cannot do anything about those problems. However, any errors that are inside of the FreeRADIUS source should be brought to our attention. 6. Running with "screen" If the bug is a crash of the server, and it takes a long time for the crash to happen, perform the following steps: * log in as root * open a screen session (http://blogamundo.net/code/screen/) $ screen bash * make sure FreeRADIUS is not running * make sure you have all the debug symbols about, or a debugable version of the server installed * configure screen to log to a file; 'Ctrl-A H' * type 'gdb /path/to/radius' (or /path/to/freeradius on Debian) * at the (gdb) prompt, type 'run -X' * detach from screen 'Ctrl-A D' * when you notice FreeRADIUS has died, reconnect to your screen session $ screen -D -r * at the (gdb) prompt type 'where' or for *lots* of info try 'thread apply all bt full' * tell screen to stop logging, 'Ctrl-A H' * logout from screen -- FreeRADIUS Project, copyright 2014 Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

Re: coa / proxy question
by Richard J Palmer 06 Jan '14

06 Jan '14

That sounds perfect I will give that a go - I may come back with a couple more questions but it seems simple enough. Thanks for the pointers -- Richard Palmer > --- Original message --- > Subject: Re: coa / proxy question > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Date: Monday, 06/01/2014 3:29 PM > > Richard J Palmer wrote: >> >> What I would ideally like to do (simple solution) is send the coa >> request to both LNS routers - one will obviously say 'no match' the >> other will correctly affect the session. With the pool set to failover >> I >> find that second LNS is not sent the coa as the first LNS replied >> (albeit saying no match), load balance works 50/50. > > That's a terrible solution. > >> >> Is there a simple way to configure coa to send the request to both >> here. > > No. Packets go to ONE destination, and ONLY one destination. > >> >> I'm also open to any betrter routes to do this > > Add a column to the accounting table. It should be "LNS IP > Address". > Then, update the accounting queries to store Packet-Src-IP-Address > there. > > For CoA, you just look up the session in the accounting table, and > sent the CoA packet to the LNS IP Address. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

coa / proxy question
by Richard J Palmer 06 Jan '14

06 Jan '14

We have a setup for l2tp ADSL and other connections using freeradius. All is generally working fine - I am building some coa functionality. The good news is that this in general works fine - I have however one problem and while I can see hints on the list and on the freeradius site I would appreciate some clarification. We have currently 2 LNS Servers. Sessions to us can end up on either one of our LNS Servers. However I can't easily say which of the LNS devices to send the request to - the NAS IP we hold in radact is actually the Wholesale providers NAS IP not the LNS IP address. What I would ideally like to do (simple solution) is send the coa request to both LNS routers - one will obviously say 'no match' the other will correctly affect the session. With the pool set to failover I find that second LNS is not sent the coa as the first LNS replied (albeit saying no match), load balance works 50/50. Is there a simple way to configure coa to send the request to both here. I'm also open to any betrter routes to do this coa config is currently --- listen { type = coa ipaddr = * port = 3799 server = coa } server coa { recv-coa { update control { Home-Server-Pool := firebrick_pool } ok } send-coa { ok } } --- proxy.conf is currently: --- home_server firebrick-1 { type = coa ipaddr = 2.3.4.5 port = 3799 secret = password require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server firebrick-2 { type = coa ipaddr = 1.2.3.4 port = 3799 secret = password require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool firebrick_pool { type = load-balance home_server = firebrick-1 home_server = firebrick-2 } --- Any pointers would be gratefully received -- Richard Palmer

3 2

realm and @ in username
by Jonathan KHATTIR 06 Jan '14

06 Jan '14

Hi, I try to configure my proxy freeradius. The problem is that i have a "@" caracter in my username and i think that freeradi us interpret the realm after the @ caracter. But it's not the realm because i have a @ in the username. fr.wifimetropolis.com is my realm and alexandre.lai(a)idcware.com is my username. I would like send my requet in this format for exemple : fr.wifimetropolis.com/alexandre.lai@idcware.com but i test with radtest command, it's didn't work. Regards Cordialement, Jonathan Khattir Technicien Support Nomosphere jkhattir(a)nomosphere.fr

5 4

Re: default configuration no auth-type
by Rui Ribeiro 04 Jan '14

04 Jan '14

> > Message: 7 > Date: Fri, 3 Jan 2014 23:00:06 -0600 > From: Michael Aldridge <aldridge.mac(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: default configuration no auth-type > Message-ID: > <CAL80pzRV6cSAU6H4FvnhUhFFR=VH0H5+JZ6DZAiWcqJ+j= > Le3w(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > hmm, works now. both files are mentioned in the startup of the system, but > only the one at /etc/freeradius/users is being used. well, at least all is > good now. > > > On Fri, Jan 3, 2014 at 8:13 PM, Alan DeKok <aland(a)deployingradius.com > >wrote: > > > Michael Aldridge wrote: > > > I think I am editing the correct file (/etc/raddb/users). > > > > Maybe. The debug output shows if it's reading that file. Reading it > > helps. > > > > > Here are the contents of the users file: > > > > > > testing Cleartext-Password := "password" > > > > Whatever the contents are, the server isn't reading that file. > > > > > Does the users file have to be owned by a specific user? I had to > > > manually create the raddb folder, if that signifies anything. > > > > Uh, yes. It means that the server isn't using that directory. It's > > using another one. > > > > Read the debug output to see which directory it's using. > > > > Honestly, all of this is in the debug output. Just read it. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > Hi Michael, Debian changes the default location of many utils, including freeradius. btw, if you are planning to use Debian for production, specially connecting with an AD, sooner or later you will have to compile it to the latest 2.2.x version. Regards, Rui Ribeiro

2 1

default configuration no auth-type
by Michael Aldridge 04 Jan '14

04 Jan '14

Having just completely purged and reinstalled freeradius, I cannot get the default configuration to work. Here is the output from a request in debug mode: rad_recv: Access-Request packet from host 127.0.0.1 port 59114, id=221, length=59 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 221 to 127.0.0.1 port 59114 The user and testing were performed following the guide found on the freeradius wiki here: http://wiki.freeradius.org/guide/Basic-configuration-HOWTO any help is greatly appreciated! -- the-maldridge aldridge.mac(a)gmail.com

4 7

Enable Perl module in combination with EAP/SIM module
by Shurbann Martes 04 Jan '14

04 Jan '14

Hi list, Just wondering if there is a way to enable the Perl module to work without changing the users files as described here http://wiki.freeradius.org/modules/Rlm_perl. This page describe that to enable the Perl module the users file needs to be changed by adding the following line: DEFAULT Auth-Type = Perl Fall-Through = yes In many places (http://wiki.freeradius.org/config/Auth%20Type) I'm reading that it is not a good idea to intervene by setting the Auth-Type manually, but still on the wiki page of rlm_perl this is being described as the way to enable the Perl module to work. Until now I've been using the Perl module alone to authenticate/authorize and changing the users file works great. But now I need to combine EAP/SIM module with Perl module. So when the message contains EAP/SIM attributes it needs to authenticate using EAP module, else it needs to fallback to the Perl one. With the users script changed as described on the perl_module page the EAP module won't work and if I don't change the users it will use EAP/SIM module, but Perl module will fail. So intervening here looks like is causing modules not to work properly Which strategy needs one to follow when using the Perl script in combination with EAP/SIM. Just want to be sure that I'm using the proper way to enable the Perl module, without intervening in the Auth-Type. Thanks you for your time. If you need me to add the default and the users file, just let me know. Regards, Shurbann Martes

4 11

All devices fail to connect via WIFI to my Radius server.
by Cesar SANCHO PRADEL 03 Jan '14

03 Jan '14

Hi, I am new to Radius so sorry in advance if my question has a simple obvious answer. I have a FreeRADIUS Server running on a linux box, with mySQL holding the list of users/passwords. radtest seems to work fine, but when I try to connect a laptop (Windows 7) or an iPad (iOS) via WIFI it does not work (they cannot connect). If I run freeradiusd -X, I can see all the steps taken during radtest, however when I try to connect with my laptop or iPad, there is no output from freeradius -X. My test network looks as follows: ISP | MY_ROUTER | MY_WIFI_ROUTER * Local IP: 192.168.200.1 * Model: LinksysWRT54GS * Wifi configuration shown below: - Security Mode: RADIUS - RADIUS Server Address: 198.162.200.100 - RADIUS Port: 1812 - Shared Key: 9F6A5757EF - Default Transmit Key: 1 - WEP Encryption: - Passphrase: admin | | MY_LINUX_BOX (connected by cable to MY_WIFI_ROUTER) * Fedora 12.04 * IP: 192.168.200.100 * RADIUS_SERVER in this BOX: FreeRadius v.2.1.10, for host x86_64-pc-linux-gnu, built on Sep 24 2012 at 17:58:57 I have modified the clients.conf adding: client router { ipaddr = 192.168.200.1 require_message_authenticator = no secret = 9F6A5757EF shortname = router nastype = cisco } client linuxBox { ipaddr = 192.168.200.100 require_message_authenticator = no secret = 9F6A5757EF shortname = linuxBox nastype = other } All seems to work if I run radtest usr pwd 192.168.200.100 1812 9F6A5757EF (where usr and pwd are stored in mySQL) Any other device that tries to connect fails silently (i.e. no debug info displaied), as if the radius server did not receive any request at all. My questions are: 1) Do I need a particular client application in the client machine or should I be able to connect directly from any device/OS? 2) Are the modifications to clients.conf correct based on my network? 3) The shared key I set in MY_WIFI_ROUTER (i.e. 9F6A5757EF) should match the "secret" set in the clientś.info, right? 4) Any ideas/help to be able to connect a device (e.g. my iPad or Laptop) via freeradius server would be appreciated. Thanks in advance Cesar

2 1

Triggering a Disconnect-Request
by Norman Elton 03 Jan '14

03 Jan '14

I know I can use radclient to send a disconnect message to a NAS. Is there any way to trigger the FreeRADIUS process to send a disconnect message instead? In my case, I have a FreeRADIUS server running happily, and an external script that sends disconnects. Right now, the script runs alongside FreeRADIUS on the same server. I would like to move that script elsewhere, but I would like to offload it to another server. Problem is, the NAS only honors requests from known RADIUS servers. If it receives the request from anywhere else, it is simply ignored. Ideally, my script would send some sort of message (something like a status message) that FreeRADIUS would turn around into a disconnect request. Any ideas? Thanks Norman

3 2