- Freeradius-Users - lists.freeradius.org

how to install debugging symbols
by Hachmer, Tobias 16 Dec '13

16 Dec '13

Hello, I build radiusd RPM packages from the 3.0.x branch using the provided spec file. While debugging I recognized that are no debugging symbols installed by default and no package which contains them. What do I have to do in order to install the debugging symbols? Kind regards, Tobias Hachmer

6 15

SQL MAC Authentication
by Christopher Kuhn 16 Dec '13

16 Dec '13

Hello, I have a FreeRADIUS 2.1.10 server which is currently working as an authentication server on our wireless network. It is able to successfully use PEAP-MSCHAP and LDAP queries to an Active Directory database for authentication. We have now been trying to implement MAC address authentication on the wired network, using a Cisco switch and this same FreeRADIUS server. The goal is to use a MySQL database of MACs to check against. However, testing so far has failed to auth the test machines. The radius.radcheck table: +----+--------------+--------------------+----+--------------+ | id | username | attribute | op | value | +----+--------------+--------------------+----+--------------+ | 1 | 28d2441b77c9 | Cleartext-Password | := | 28d2441b77c9 | | 2 | aabbcc112233 | Cleartext-Password | := | aabbcc112233 | +----+--------------+--------------------+----+--------------+ The debug output: Ready to process requests. rad_recv: Access-Request packet from host 10.25.22.31 port 49181, id=0, length=118 NAS-IP-Address = 10.25.22.31 NAS-Port-Type = Ethernet NAS-Port = 76 User-Name = "28d2441b77c9" Acct-Session-Id = "050004EE" Calling-Station-Id = "28-D2-44-1B-77-C9" EAP-Message = 0x0200001101323864323434316237376339 Message-Authenticator = 0x0c1c468757ad8814bb6dae782e1ac927 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "28d2441b77c9", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 189 ++[files] returns ok [sql] expand: %{User-Name} -> 28d2441b77c9 [sql] sql_set_user escaped user --> '28d2441b77c9' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '28d2441b77c9' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '28d2441b77c9' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '28d2441b77c9' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [ldap] performing user authorization for 28d2441b77c9 [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=28d2441b77c9) [ldap] expand: DC=company,DC=tld -> DC=company,DC=tld [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to server.company.tld:636, authentication 0 [ldap] setting TLS mode to 1 [ldap] bind as [redacted] [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in DC=company,DC=tld, with filter (sAMAccountName=28d2441b77c9) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.25.22.31 port 49181 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8246357d82472c193c76c7709d2aae65 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.25.22.31 port 49181, id=0, length=153 Cleaning up request 1 ID 0 with timestamp +37 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x8246357d82472c19 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! NAS-IP-Address = 10.25.22.31 NAS-Port-Type = Ethernet NAS-Port = 76 User-Name = "28d2441b77c9" Acct-Session-Id = "050004EE" State = 0x8246357d82472c193c76c7709d2aae65 Calling-Station-Id = "28-D2-44-1B-77-C9" EAP-Message = 0x020100220410ab090564f0a81fef7cc5fa4ad743a959323864323434316237376339 Message-Authenticator = 0xb33f92e3651c00e500fe3b5722276082 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "28d2441b77c9", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 34 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 189 ++[files] returns ok [sql] expand: %{User-Name} -> 28d2441b77c9 [sql] sql_set_user escaped user --> '28d2441b77c9' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '28d2441b77c9' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '28d2441b77c9' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '28d2441b77c9' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [ldap] performing user authorization for 28d2441b77c9 [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=28d2441b77c9) [ldap] expand: DC=company,DC=tld -> DC=company,DC=tld [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=company,DC=tld, with filter (sAMAccountName=28d2441b77c9) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] Response appears to match, but EAP type is wrong. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect ( [ldap] User not found): [28d2441b77c9] (from client test-switch port 76 cli 28-D2-44-1B-77-C9) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 28d2441b77c9 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.8 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 0 to 10.25.22.31 port 49181 What I do not understand: 1) Why does finding the user in SQL not seem to count for authentication (is it supposed to return updated)? 2) Why does FreeRADIUS continue on to try LDAP, even showing it as the exclusive reason for failure? 3) What am I missing that will cause an Access-Accept if a user is found in SQL? I hope you can forgive a first-timer for any relevant information I have left out.Any feedback you can give is greatly appreciated.

2 1

Freeradius+LDAP+MYSQL Simultaneous-Use
by ultaman khoo 16 Dec '13

16 Dec '13

Hi All, Appreciate someone can help on how to get Simultaneous-Use function working with Freeradius+MYSQL+LDAP, any link or website will be helpful. Regards, Alex

3 3

Unable to locate mysql-devel package on Ubuntu 11.04
by brijesh shingadiya 16 Dec '13

16 Dec '13

Hi Everyone, I am trying to make my freeradius server as a DHCP server. I am trying to install mysql-devel package as mentioned in the document but I keep getting error "Unable to locate mysql-devel package". Any inputs on this would be highle appreciated. Thanks, Brijesh

4 5

LDAP + Active Directory Authentication Issue
by Luke Ramsden 16 Dec '13

16 Dec '13

Hi, I am trying to authenticate users against Active Directory using LDAP. I can perform the initial bind using an ldap bind account. I can then successfully find the Distinguished Name in Active Directory given a domain user's username. I would now like to re-bind using that Distinguished Name in order to authenticate the password they supplied as described in point 4 here: http://thecarlhall.wordpress.com/2011/01/04/ldap-authentication-authorizati… The problem I am having is my server errors out with 'No Auth-Type found' come authentication time. I added 'set_auth_type = yes' to mods-available/ldap but it seems to have had no effect. I am very new to this so am still finding my feet - can anyone help? Subset of output from terminal (redacted some personal info): (0) ldap : Performing search in 'ou=Users,dc=example,dc=domain,dc=com' with filter '(uid=example-user)' (0) ldap : Waiting for search result... (0) ldap : User object found at DN "CN=Name,OU=Users,DC=example,DC=domain,DC=com" rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): Closing connection (0): Too many free connections (5 > 3) (0) [ldap] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = 'example-user', looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (0) WARNING: pap : Authentication will fail unless a "known good" password is available. (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post Auth-Type = Reject (0) Failed to authenticate the user. (0) Using Post-Auth-Type Reject Many thanks

4 5

redundant ldap configuration
by Polish 16 Dec '13

16 Dec '13

Hello, I tried setup redundant ldap on latest git version of FR3. ldaps are defined in module ldap: ldap ldap1 { ... } ldap ldap3 { ... } sites default and inner-tunnel are changed from ldap to redundant { ldap1 ldap3 } If connections to ldap is established, fr returns "Login OK" and eapol_test SUCCESS. If someone ldap connection is down, fr returns "Login OK", but eapol_test trying resending requests (in freeradius log I see "Discarding duplicate request from client test port 36732 - ID: 11 due to unfinished request") In debug "freeradius -fxx -l stdout" returns Login incorect, and eapol_test failed immediatly: (9) redundant redundant { (9) ERROR: ldap1 : All ldap connections are in use (9) [ldap1] = fail (9) ERROR: ldap3 : All ldap connections are in use (9) [ldap3] = fail (9) } # redundant redundant = fail (9) } # authorize = fail LDAP server is eDirectory. Thank you for tips Pavel Polacek

5 11

Request ID ATTRIBUTE
by Mehdi Ravanbakhsh 14 Dec '13

14 Dec '13

Hi All what is the ATTRIBUTE of request ID ? Best regards.

2 4

received signal SIGSEGV, Segmentation fault. malloc_consolidate (av=0x7ffff5e2de80) at malloc.c:5196
by Hachmer, Tobias 13 Dec '13

13 Dec '13

Hello, I'm testing kerberos authentication with the workaround from yesterday (https://github.com/FreeRADIUS/freeradius-server/commit/ea887a2ab7308a6f612d…) After 2-3 authentication tests radiusd get a SIGSEGV. OS: CentOS 6.5 x86_64 FR built today from v3.0.x branch BT: rad_recv: Access-Request packet from host 127.0.0.1 port 55082, id=14, length=103 User-Name = 'hachmer' User-Password = 'pw' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x64454c20cfa4534882ca622de7e32c0e (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) filter_username filter_username { (2) ? if (User-Name != "%{tolower:%{User-Name}}") Program received signal SIGSEGV, Segmentation fault. malloc_consolidate (av=0x7ffff5e2de80) at malloc.c:5196 5196 nextsize = chunksize(nextchunk); Missing separate debuginfos, use: debuginfo-install ncurses-libs-5.7-3.20090208.el6.x86_64 pcre-7.8-6.el6.x86_64 sqlite-3.6.20-1.el6.x86_64 (gdb) bt #0 malloc_consolidate (av=0x7ffff5e2de80) at malloc.c:5196 #1 0x00007ffff5b17405 in _int_malloc (av=0x7ffff5e2de80, bytes=<value optimized out>) at malloc.c:4406 #2 0x00007ffff5b18991 in __libc_malloc (bytes=1104) at malloc.c:3664 #3 0x00007ffff715063f in __talloc (ctx=<value optimized out>, el_size=<value optimized out>, count=<value optimized out>, name=<value optimized out>) at ../talloc.c:560 #4 _talloc_named_const (ctx=<value optimized out>, el_size=<value optimized out>, count=<value optimized out>, name=<value optimized out>) at ../talloc.c:669 #5 _talloc_array (ctx=<value optimized out>, el_size=<value optimized out>, count=<value optimized out>, name=<value optimized out>) at ../talloc.c:2217 #6 0x00007ffff7bcf0f4 in xlat_aprint (ctx=0xa16a40, request=0xa16a40, node=0x913af0, escape=0, escape_ctx=0x0, lvl=0) at src/main/xlat.c:1895 #7 0x00007ffff7bcfcd1 in xlat_process (out=0x7fffffffc1b8, request=0xa16a40, head=<value optimized out>, escape=0, escape_ctx=0x0) at src/main/xlat.c:1976 #8 0x00007ffff7bcff8c in xlat_expand (out=0x7fffffffc2c0, outlen=0, request=0xa16a40, fmt=0x81c0c0 "%{tolower:%{User-Name}}", escape=0, escape_ctx=0x0) at src/main/xlat.c:2068 #9 0x00007ffff7bcb7e8 in radius_expand_tmpl (out=0x7fffffffc2c0, request=0xa16a40, vpt=<value optimized out>) at src/main/evaluate.c:108 #10 0x00007ffff7bcbfd8 in radius_evaluate_map (request=0xa16a40, modreturn=<value optimized out>, depth=<value optimized out>, c=0x81bd30) at src/main/evaluate.c:424 #11 0x00007ffff7bcc5b1 in radius_evaluate_cond (request=0xa16a40, modreturn=10, depth=0, c=<value optimized out>) at src/main/evaluate.c:597 #12 0x000000000041ed3b in modcall_recurse (request=0xa16a40, component=RLM_COMPONENT_AUTZ, depth=2, entry=0x7fffffffd3d0) at src/main/modcall.c:480 #13 0x00000000004201d4 in modcall_child (request=<value optimized out>, component=RLM_COMPONENT_AUTZ, depth=2, entry=0x7fffffffd3b8, c=0xa026a0, result=0x7fffffffc9ec) at src/main/modcall.c:414 #14 0x000000000041eb5f in modcall_recurse (request=0xa16a40, component=RLM_COMPONENT_AUTZ, depth=1, entry=0x7fffffffd3b8) at src/main/modcall.c:780 #15 0x00000000004201d4 in modcall_child (request=<value optimized out>, component=RLM_COMPONENT_AUTZ, depth=1, entry=0x7fffffffd3a0, c=0xa02620, result=0x7fffffffcf4c) at src/main/modcall.c:414 #16 0x000000000041eb5f in modcall_recurse (request=0xa16a40, component=RLM_COMPONENT_AUTZ, depth=0, entry=0x7fffffffd3a0) at src/main/modcall.c:780 #17 0x00000000004200fd in modcall (component=<value optimized out>, c=<value optimized out>, request=<value optimized out>) at src/main/modcall.c:1036 #18 0x000000000041af93 in indexed_modcall (comp=RLM_COMPONENT_AUTZ, idx=0, request=0xa16a40) at src/main/modules.c:747 #19 0x000000000040cc42 in rad_authenticate (request=0xa16a40) at src/main/auth.c:409 #20 0x000000000042b41c in request_running (request=0xa16a40, action=1) at src/main/process.c:1210 #21 0x000000000042af4d in request_queue_or_run (request=0xa16a40, process=0x42b2e0 <request_running>) at src/main/process.c:850 #22 0x000000000042d2b0 in request_receive (listener=0xa131f0, packet=0x8fe710, client=0x8110a0, fun=0x40c9b0 <rad_authenticate>) at src/main/process.c:1409 #23 0x00000000004158b3 in auth_socket_recv (listener=0xa131f0) at src/main/listen.c:1509 #24 0x000000000042777b in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0xa131f0) at src/main/process.c:3494 #25 0x00007ffff79abcbb in fr_event_loop (el=0xa05770) at src/lib/event.c:417 #26 0x0000000000420b14 in main (argc=<value optimized out>, argv=<value optimized out>) at src/main/radiusd.c:479 Thanks in advance, Tobias Hachmer

2 10

Stale sessions and mac auth problem
by Peter 13 Dec '13

13 Dec '13

Hi I'm using Coova and Freeradius and I have the entry below to clear stale sessions when a user logs in. I'm using freeradius version 2.1.10 and I got the code below from a previous email in this list. if(User-Name){ if("%{sql:UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale Session' WHERE UserName='%{User-Name}' and CallingStationId='%{Calling-Station-Id}' and AcctStopTime is NULL}"){ reject } } The code above works perfectly for normal users signing in by clearing the stale session on the first attempt and the user tries again and can log in. My problem is when it's a mac auth request Coova sends the request at least twice. This causes the device to log in on the first request and then out on the second request. So how could I change the empty if statement "if(User-Name)" to only run this if the the username is not a mac address "if(User-Name != macaddress)"

2 1

LDAP no group
by Jean Carlos Coelho 13 Dec '13

13 Dec '13

Hi! Simple question, my client has configured the ldap database with no ou=groups, only with ou=people and all the users have some different object classes, some “students” and some “teachers”, the ldap database does not have the posixgroup or memberUid… my ldap configuration for search “group” is: groupname_attribute = ou groupmembership_filter = "(&(dc=domain,dc=org)(uid=%u))” I have tried many other options above.. :( This is some user example: Group? dn: ou=students,dc=domain,dc=org ou: students objectClass: organizationalUnit objectClass: top dn: ou=teachers,dc=domain,dc=org ou: teachers objectClass: organizationalUnit objectClass: top dn: ou=employees,dc=domain,dc=org ou: employees objectClass: organizationalUnit objectClass: top ——— User dn: uid=19221422470,ou=student,dc=ufsm,dc=br userPassword:: DDDDDDDDDDDDDDDDDD mail: fab(a)cpd.domain.org eduPersonPrincipalName: OJLADOIA-CXQLBAAA(a)domain.org uid: 19221422470 objectClass: person objectClass: inetOrgPerson objectClass: eduPerson objectClass: sambaSamAccount objectClass: brPerson sambaNTPassword: DDDDDDDDDDDDDDDDDD sambaLMPassword: DDDDDDDDDDDDDDDDDD cn: Student Name sn: Student Last Name sambaSID: 19221422470 dn: brEduAffiliation=1,uid=19221422470,ou=students,dc=domain,dc=org objectClass: brEduPerson brEduAffiliation: 1 brEntranceDate: 20120503 brEduAffiliationType: student ————————— Radius debug output (USER OK.. But can’t search “groups”)… radtest 42833582820 teste2013 200.132.39.49:1812 100 123456789 Sending Access-Request of id 124 to 200.132.39.49 port 1812 User-Name = "42833582820" User-Password = "teste2013" NAS-IP-Address = 200.132.39.49 NAS-Port = 100 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 200.132.39.49 port 1812, id=124, length=20 # Executing section post-auth from file /etc/freeradius/sites-enabled/domain-ldap +- entering group post-auth {...} ++? if (LDAP-Group == “teachers") [ldap] Entering ldap_groupcmp() expand: dc=domain,dc=org -> dc=domain,dc=org expand: (&(dc=domain,dc=org)(uid=%u)) -> (&(dc=domain,dc=org)(uid=42833582820)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=domain,dc=org, with filter (&(ou=teachers)(&(dc=domain,dc=org)(uid=42833582820))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group teachers not found or user is not a member. ? Evaluating (LDAP-Group == “teachers") -> FALSE ++? if (LDAP-Group == “teachers") -> FALSE } # server ldap So.. I don’t have a group, I have different object classes for separate users, is there some way to collect these informations from brEduAffiliationType with rlm_ldap group options? Or I will have to create groups and add users to these groups and populate the memberUid object for (I know) it work.. Thanks Atenciosamente, Jean Carlos Coelho Analista de Soluções Teltec Solutions Fone: 48 3031.3450 | DDR: 467 | Cel: 48 9179.6013 [http://suporte.teltecnetworks.com.br/images/Assinaturas/figura.jpg]<http://www.teltecsolutions.com.br/site2009/downloads/sign.html>

2 1