- Freeradius-Users - lists.freeradius.org

smbpasswd or etc_smbpasswd?
by Bill McGonigle 08 May '13

08 May '13

Hi, everybody, I was setting up freeradius to authenticate against an smbpasswd file, and got tripped up by the sample config. I have: modules/smbpasswd with: passwd smbpasswd { filename = and: sites-available/default (and inner-tunnel) with: # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. etc_smbpasswd under 'authorize'. From what I can tell, these all need to match, with either "etc_smbpasswd" or "smbpasswd" in all each location. If they differ, I get a startup error, something like: radiusd.conf[862]: etc_smbpasswd: Module instantiation failed. radiusd.conf[1866] Unknown module "etc_smbpasswd". radiusd.conf[1789] Failed to parse authorize section. If they match, it works great. I'm seeing the same sample configuration on el5, el6, and on git head, so maybe I'm doing something wrong? Thanks, -Bill -- Bill McGonigle, Owner BFC Computing, LLC http://bfccomputing.com/ Telephone: +1.855.SW.LIBRE Email, IM, VOIP: bill(a)bfccomputing.com VCard: http://bfccomputing.com/vcard/bill.vcf Social networks: bill_mcgonigle/bill.mcgonigle

2 1

AAA Accounting Relay
by Raithatha, Divyesh 08 May '13

08 May '13

Newbie question for the group. Has anyone successfully set up a Radius Relay for Accounting as this older article for LDAP lists? http://freeradius.org/radiusd/doc/ldap_howto.txt What we would like to do is to send both Auth and Accounting requests to a AAA server and then forward just the accounting records to another AAA server that is back-ended to MySQL. Thanks.

3 2

Config for 802.1x use on network switches
by Nikolaos Milas 08 May '13

08 May '13

Hello, We would like to enforce authentication for all clients connecting to our network (wired or wireless), so that when a client connects, the client will not be able to use the network unless it successfully authenticates (e.g. via web) with a valid account (LDAP-based). We have a network based mainly on Cisco 2950/2960 switches. We are running a central LDAP Server (openldap) where we hold user accounts, which are used for mail, ftp, web, Shibboleth access. I guess we can enable 802.1x on switches and require authentication of clients over freeradius. Is there a suggested sample freeradius configuration for such use? Can you please provide one or point me to a URL for it? Can you share your experience and any pitfalls we should consider? Any experiences on such use? Does this scale well (for about 20-30 switches)? Should we consider a central management solution? (Which?) Thanks in advance, Nick

2 3

multiply Cisco-AVPair request attribute process by regular expression
by Mehdi Ravanbakhsh 08 May '13

08 May '13

Hi All I have one Cisco 10000 NAS inmy network and this is the authenticate request : Packet-Type = Access-Request Cisco-AVPair = "client-mac-address=f43e.6166.dba0" Framed-Protocol = PPP User-Name = "7727221873" NAS-Port-Type = Ethernet NAS-Port = 71468299 NAS-Port-Id = "0/0/0/0" Cisco-AVPair = "circuit-id-tag=Kangan-1 atm 7/42:218:0.35" Service-Type = Framed-User NAS-IP-Address = 10.150.21.218 Acct-Session-Id = "0442850B" Calling-Station-Id = "f4:3e:61:66:db:a0" Called-Station-Id = "" SQL-User-Name = "7727221873" i have tow Cisco-AVPair attribute in request and i need to process one of them that being started by 'circuit-id-tag=' so i use this : if (Cisco-AVpair =~ /^circuit-id-tag=(.*)$/) { update request { Connect-Info := "%{1}" } } but it is not working ! in similar case that i use regular expression for updating request it work well for example : if (Cisco-AVpair =~ /^client-mac-address=([a-f0-9][a-f0-9])([a-f0-9][a-f0-9]).([a-f0-9][a-f0-9])([a-f0-9][a-f0-9]).([a-f0-9][a-f0-9])([a-f0-9][a-f0-9])$/) { if (!Calling-Station-Id) { update request { Calling-Station-Id := "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" Called-Station-Id := "%{NAS-Identifier}" } } } in last i think in this case because of multiply Cisco-AVPair attribute in request regular expression should be different but i can not find any source that can enplane this problem . Best regards.

4 11

using unlang to rewrite framed-ip-address sent from LDAP
by sebastien boucher 07 May '13

07 May '13

hello, i am trying to rewrite the framed-ip-address information that are given to radius via ldap to a null value currently many of our users have a fixed framed-ip-address value of 255.255.255.254 , since we will now be using radius and mysql to distribute IP i would like to change this value to nothing upon connection. i have tried this but was unsuccessful post-auth { reply_log sql-accounting exec Post-Auth-Type REJECT { attr_filter.access_reject } if (Framed-IP-Address =="255.255.255.254") { update control { Framed-IP-Address :="%{1.1.1.1}" } } sqlippool } debug tells me: ++? if (Framed-IP-Address =="255.255.255.254") (Attribute Framed-IP-Address was not found) ? Evaluating (Framed-IP-Address =="255.255.255.254") -> FALSE ++? if (Framed-IP-Address =="255.255.255.254") -> FALSE so of course i am wrong somewhere and i wondering if some of you guys could give me input or help or directions :) thanks seb.

3 2

Unlang comparing variable correctly
by Tyller D 07 May '13

07 May '13

Hi, I am trying to compare a variable in freeradius using unlang but it seems to not be working correctly, more than likely i've made a mistake but let me show you. ? Evaluating (control:IMS-ActiveDirectory == 0) -> FALSE ++? if (control:IMS-ActiveDirectory == 0) -> FALSE ++? if (control:IMS-Timeout < 0) ? Evaluating (control:IMS-Timeout < 0) -> FALSE ++? if (control:IMS-Timeout < 0) -> FALSE ++? elsif (control:IMS-Timeout > 0) ? Evaluating (control:IMS-Timeout > 0) -> FALSE ++? elsif (control:IMS-Timeout > 0) -> FALSE ++? if (control:IMS-Data < 0) ? Evaluating (control:IMS-Data < 0) -> TRUE ++? if (control:IMS-Data < 0) -> TRUE ++- entering if (control:IMS-Data < 0) {...} expand: %{control:IMS-Data} Voucher Depleated -> 3221197824 Voucher Depleated +++[reply] returns noop +++[reject] returns reject So as you can see it enters entering if (control:IMS-Data < 0) {...}, as it says that IMS-Data is < 0. Its not, so I echoed out the variable in the next line and its value is 3221197824... The strange thing is if the variable is equal to 2147465216 then it does not enter that function. Why?

3 4

redundant-load-balance for AD ntlmauth
by FreeRadius List 07 May '13

07 May '13

Hello I use redundant-load-balance for ldap user auth to authenticate users to a pool of active directory servers for one service. That seems to work well. I'm trying to think why I don't do that for ntlmauth (used inside mschap inner-tunnel) for another other service. I've knocked that up to test it with mschap modules like (with N being 1,2,3,4,5) mschap mschapadN { with_ntdomain_hack = yes ntlm_auth = "/usr/local/bin/mschap-ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --configfile=/etc/samba/smb-adN.conf" } where /etc/samba/smb-adN.conf is the same as the others except for "password server = adN.domain" and then in the inner-tunnel site I have authenticate { Auth-Type MS-CHAP { redundant-load-balance { mschapad1 mschapad2 .. mschapadN } } } Is this along the lines that others follow? if not how does ntlmauth handle the AD server being down. Does ntlmauth/winbind handle AD being down so freeradius does not have to? Thanks, Neil

4 7

RE: segfault error
by Chris Taylor 06 May '13

06 May '13

I forgot to include my OS and kernel type. Linux on-radius01.eastlink.ca 2.6.18-308.16.1.el5 CentOS release 5.9 (Final) -----Original Message----- From: Chris Taylor Sent: Thursday, May 02, 2013 1:31 PM To: 'FreeRadius users mailing list' Subject: RE: segfault error I think I have what you are looking for now. I have copied the whole dump from when I start using gdb. Chris [root@on-radius01 raddb]# gdb /usr/sbin/radiusd /tmp/core-radiusd-11-95-95-11609-1367435209 GNU gdb (GDB) CentOS (7.0.1-45.el5.centos) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/radiusd...done. [New Thread 11611] [New Thread 11614] [New Thread 11613] [New Thread 11612] [New Thread 11610] [New Thread 11609] Reading symbols from /usr/local/lib/libfreeradius-radius-2.2.0.so...done. Loaded symbols for /usr/local/lib/libfreeradius-radius-2.2.0.so Reading symbols from /lib64/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libnsl.so.1 Reading symbols from /lib64/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libresolv.so.2 Reading symbols from /lib64/libpthread.so.0...(no debugging symbols found)...done. [Thread debugging using libthread_db enabled] Loaded symbols for /lib64/libpthread.so.0 Reading symbols from /lib64/libcrypt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libcrypt.so.1 Reading symbols from /usr/local/lib/libltdl.so.3...done. Loaded symbols for /usr/local/lib/libltdl.so.3 Reading symbols from /lib64/libssl.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libssl.so.6 Reading symbols from /lib64/libcrypto.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libcrypto.so.6 Reading symbols from /lib64/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libdl.so.2 Reading symbols from /lib64/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /usr/lib64/libgssapi_krb5.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libgssapi_krb5.so.2 Reading symbols from /usr/lib64/libkrb5.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libkrb5.so.3 Reading symbols from /lib64/libcom_err.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libcom_err.so.2 Reading symbols from /usr/lib64/libk5crypto.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libk5crypto.so.3 Reading symbols from /lib64/libz.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libz.so.1 Reading symbols from /usr/lib64/libkrb5support.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libkrb5support.so.0 Reading symbols from /lib64/libkeyutils.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libkeyutils.so.1 Reading symbols from /lib64/libselinux.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libselinux.so.1 Reading symbols from /lib64/libsepol.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libsepol.so.1 Reading symbols from /lib64/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libnss_files.so.2 Reading symbols from /lib64/libnss_ldap.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libnss_ldap.so.2 Reading symbols from /usr/local/lib/rlm_exec-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_exec-2.2.0.so Reading symbols from /usr/local/lib/rlm_expr-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_expr-2.2.0.so Reading symbols from /usr/local/lib/rlm_expiration-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_expiration-2.2.0.so Reading symbols from /usr/local/lib/rlm_logintime-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_logintime-2.2.0.so Reading symbols from /usr/local/lib/rlm_pap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_pap-2.2.0.so Reading symbols from /usr/local/lib/rlm_chap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_chap-2.2.0.so Reading symbols from /usr/local/lib/rlm_preprocess-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_preprocess-2.2.0.so Reading symbols from /usr/local/lib/rlm_digest-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_digest-2.2.0.so Reading symbols from /usr/local/lib/rlm_realm-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_realm-2.2.0.so Reading symbols from /usr/local/lib/rlm_acct_unique-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_acct_unique-2.2.0.so Reading symbols from /usr/local/lib/rlm_files-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_files-2.2.0.so Reading symbols from /usr/local/lib/rlm_detail-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_detail-2.2.0.so Reading symbols from /usr/local/lib/rlm_unix-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_unix-2.2.0.so Reading symbols from /usr/local/lib/rlm_radutmp-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_radutmp-2.2.0.so Reading symbols from /usr/local/lib/rlm_attr_filter-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_attr_filter-2.2.0.so Reading symbols from /usr/local/lib/rlm_ldap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_ldap-2.2.0.so Reading symbols from /usr/lib64/libldap_r-2.3.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libldap_r-2.3.so.0 Reading symbols from /usr/lib64/liblber-2.3.so.0...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/liblber-2.3.so.0 Reading symbols from /usr/lib64/libsasl2.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libsasl2.so.2 Reading symbols from /usr/local/lib/rlm_sql-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_sql-2.2.0.so Reading symbols from /usr/local/lib/rlm_sql_mysql-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_sql_mysql-2.2.0.so Reading symbols from /usr/lib64/mysql/libmysqlclient_r.so.15...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/mysql/libmysqlclient_r.so.15 Reading symbols from /lib64/libm.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libm.so.6 Reading symbols from /lib64/libgcc_s.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libgcc_s.so.1 Reading symbols from /lib64/libnss_dns.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libnss_dns.so.2 Reading symbols from /usr/local/lib/rlm_eap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap-2.2.0.so Reading symbols from /usr/local/lib/libfreeradius-eap-2.2.0.so...done. Loaded symbols for /usr/local/lib/libfreeradius-eap-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_md5-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_md5-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_leap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_leap-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_gtc-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_gtc-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_tls-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_tls-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_ttls-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_ttls-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_peap-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_peap-2.2.0.so Reading symbols from /usr/local/lib/rlm_eap_mschapv2-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_eap_mschapv2-2.2.0.so Reading symbols from /usr/local/lib/rlm_always-2.2.0.so...done. Loaded symbols for /usr/local/lib/rlm_always-2.2.0.so warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fffdaffd000 Core was generated by `/usr/sbin/radiusd -d /etc/raddb'. Program terminated with signal 11, Segmentation fault. #0 0x0000003c6c07b5bb in memcpy () from /lib64/libc.so.6 (gdb) set logging file /etc/raddb/gdb-radiusd.log (gdb) set logging on Copying output to /etc/raddb/gdb-radiusd.log. (gdb) info threads 6 Thread 0x2b70ff350f60 (LWP 11609) 0x0000003c6c0ce1a2 in select () from /lib64/libc.so.6 5 Thread 11610 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 4 Thread 11612 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 3 Thread 11613 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 2 Thread 11614 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 * 1 Thread 0x2b7104c7f940 (LWP 11611) 0x0000003c6c07b5bb in memcpy () from /lib64/libc.so.6 (gdb) thread apply all bt full Thread 6 (Thread 0x2b70ff350f60 (LWP 11609)): #0 0x0000003c6c0ce1a2 in select () from /lib64/libc.so.6 No symbol table info available. #1 0x00002b70fef24cf7 in fr_event_loop (el=0x12739500) at event.c:391 i = <value optimized out> rcode = 1 maxfd = 39 when = {tv_sec = 0, tv_usec = 427000} wake = 0x7fffdafcdb30 read_fds = {fds_bits = {1047972020224, 0 <repeats 15 times>}} master_fds = {fds_bits = {1047972020224, 0 <repeats 15 times>}} #2 0x000000000041cc3a in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:408 rcode = 309599712 argval = <value optimized out> spawn_flag = 1 dont_fork = 0 flag = 0 act = {__sigaction_handler = {sa_handler = 0x41cf20 <sig_fatal>, sa_sigaction = 0x41cf20 <sig_fatal>}, sa_mask = { __val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0} Thread 5 (Thread 11610): #0 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000041ff83 in request_handler_thread (arg=<value optimized out>) at threads.c:498 fun = 0x408910 <rad_authenticate> self = 0x12740a50 #2 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #3 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 No symbol table info available. Thread 4 (Thread 11612): #0 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000041ff83 in request_handler_thread (arg=<value optimized out>) at threads.c:498 fun = 0x408910 <rad_authenticate> self = 0x12740c10 #2 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #3 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 ---Type <return> to continue, or q <return> to quit--- No symbol table info available. Thread 3 (Thread 11613): #0 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000041ff83 in request_handler_thread (arg=<value optimized out>) at threads.c:498 fun = 0x408300 <rad_accounting> self = 0x12740d90 #2 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #3 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 No symbol table info available. Thread 2 (Thread 11614): #0 0x0000003c6d00ce51 in sem_wait () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000041ff83 in request_handler_thread (arg=<value optimized out>) at threads.c:498 fun = 0x408300 <rad_accounting> self = 0x12740f10 #2 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #3 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 No symbol table info available. Thread 1 (Thread 0x2b7104c7f940 (LWP 11611)): #0 0x0000003c6c07b5bb in memcpy () from /lib64/libc.so.6 No symbol table info available. #1 0x00002b710027f3e9 in normify (request=0x12756bb0, vp=0x12778160, min_length=20) at rlm_pap.c:273 decoded = 18446744073709551615 buffer = "\311-\307\004q+\000\000j\b\362\376p+\000\000+ \260\333\307\004q+\000\000p\334\307\004q+\000\000@\330\307\00 4q+\000\000\210\301v\022\000\000\000\000P\301v\022\000\000\000" #2 0x00002b710027fb57 in pap_authenticate (instance=0x12618990, request=0x12756bb0) at rlm_pap.c:707 vp = <value optimized out> module_fmsg_vp = <value optimized out> module_fmsg = '\000' <repeats 32 times>, "H\200w\022\001\000\000\000 \tb\022", '\000' <repeats 12 times>, "t\000\000\000\00 0\000\000\000\253\200\362\376p+", '\000' <repeats 18 times>"\253, \200\362\376p+\000\000\253\200\362\376\000\000\000\000v\203\361\3 76p+\000\000\024\000\000\000\000\000\000\000\274\362'\000q+\000\000\375\000\000\022\000\000\000\000\024\000\000\000\000\000\000\000 \024\000\000\000\000\000\000\000`\201w\022", '\000' <repeats 12 times>"\260, ku\022\000\000\000\000\230\201w\022\000\000\000\000\35 1\363'\000q+\000\000\321=\253\365H.f\001\360~\243v\230\001\021L\257j\024\342QDn\246\344]\354\375<\000\000\000F\004\000\000\000\000\ 000\000^\032\362\376p+\000\000HJ5l<\000\000\000\001\000\000\000\000" md5_context = {state = {0, 0, 309685208, 0}, count = {1213420411, 1862303041}, ---Type <return> to continue, or q <return> to quit--- buffer = "-Realm\000\000\340\341K\022\000\000\000\000\340I5l<", '\000' <repeats 11 times>"\340, I5l<", '\000' <repeats 11 times>, "8\001\000\000\000\000\000\000\035\367\350\000q+\000"} sha1_context = {state = {309685208, 0, 1, 0, 309821792}, count = {0, 309728429}, buffer = "\000\000\000\000\373\377\377\377\377\377\377\377\260ku\022\000\000\000\000\251\024v\022\000\000\000\000\022\365 '\000q+\000\000 \334\307\004q+\000\000 \334\307\004q+\000\000\220\211a\022\000\000\000\000\203\070\361\376"} digest = "d>u\022", '\000' <repeats 35 times> buff = "\001\000\000\000\000\000\000\000\360\335v\022\000\000\000\000\200<t\022\000\000\000\000\260ku\022\000\000\000\000\a \004\000\000\000\000\000\000A\001\000\000\000\000\000\000\070\001\000\000\000\000\000\000\005", '\000' <repeats 39 times>, "\020.w\ 022\000\000\000\000\020Xu\022", '\000' <repeats 12 times>"\262, \022B\000\000\000\000\000\000\000\000\000\001\000\000\000`\001\000\ 000(\000\000\000HJ5l<\000\000\000\300\332\307\004q+\000\000\000\000\000\000\000\000\000\000A\001\000\000\000\000\000\000\070\001\00 0\000\000\000\000\000\340I5l<\000\000\000 \004b\022\000\000\000\000`\001\000\000\000\000\000\000HJ5l<\000\000\000\000\333\307\004q+ \000\000\035\367\350\000q+\000\000A\001\000\000\000\000\000\000\070\001\000\000\000\000\000\000"... buff2 = "\001\000\000\000\000\000\000\000rTh\000q+\000\000\260ku\022\000\000\000\000\060\227a\022\000\000\000\000\001\000\0 00\000\000\000\000\000\001\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\071Xh\000q+\000\000\200\246a\022\000\000\000 \000\340(v\022\000\000\000\000\004\000\000\000\000\000\000\000`\001\000\000\000\000\000\000HJ5l<\000\000\000`\331\307\004q+\000\000 'UsA\001\000\000\000\000\000\000\070\001\000\000\000\000\000\000\005", '\000' <repeats 39 times>, "from cli\237Oh\000q+\000\00 0-bras1 port 0 vifrom client (\000\000\000-bras1 port 0"... #3 0x000000000041c0e6 in call_modsingle (component=0, c=<value optimized out>, request=0x12756bb0) at modcall.c:304 No locals. #4 modcall (component=0, c=<value optimized out>, request=0x12756bb0) at modcall.c:686 myresult = 1 stack = {pointer = 1634165107, priority = {0, 0, 0, 0, 0, 0, 0, 1634165107, 829124461, 13106, 0 <repeats 22 times>}, result = {0, 0, 2, 0 <repeats 16 times>, 24, 48, 80209248, 11121, 80209056, 11121, 0, 0, 0, 0, 0, 0, 0}, children = { 0x12706950, 0x127069c0, 0x0 <repeats 16 times>, 0x2b7104c7e320, 0x0, 0x2b7104c7ea80, 0x2b7104c7e970, 0x2b7104c7e970, 0x4c7e480, 0x4, 0x110, 0x12774b50, 0x2b7104c7e320, 0x3c6c068b5a, 0xfbad8001, 0x2b7104c7e970, 0x2b7104c7e970}, start = {0x0, 0x127069c0, 0x1270c340, 0x2b7104c7ea80, 0x2b7104c7e970, 0x2b7104c7ea80, 0x0, 0x600000000, 0x8, 0x0 <repeats 12 times>, 0xffffffff, 0x0, 0x0, 0x12619fe0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000}} parent = 0x12706950 child = 0x127069c0 if_taken = 0 was_if = 0 #5 0x0000000000419415 in indexed_modcall (comp=0, idx=1024, request=0x12756bb0) at modules.c:740 rcode = <value optimized out> list = 0x12706950 server = 0x0 #6 0x0000000000409147 in rad_check_password (request=0x12756bb0) at auth.c:382 No locals. #7 rad_authenticate (request=0x12756bb0) at auth.c:667 namepair = 0x12743dc0 check_item = <value optimized out> auth_item = 0x12743f00 ---Type <return> to continue, or q <return> to quit--- module_msg = <value optimized out> tmp = <value optimized out> result = <value optimized out> autz_retry = <value optimized out> autz_type = <value optimized out> #8 0x0000000000427751 in radius_handle_request (request=0x12756bb0, fun=0x408910 <rad_authenticate>) at event.c:3784 No locals. #9 0x00000000004278d4 in proxy_to_virtual_server (request=0x12755810) at event.c:1980 fake = 0x12756bb0 fun = 0x408910 <rad_authenticate> #10 0x000000000042763a in successfully_proxied_request (request=0x12755810) at event.c:2265 No locals. #11 request_post_handler (request=0x12755810) at event.c:2329 rcode = <value optimized out> child_state = <value optimized out> vp = <value optimized out> #12 0x000000000042778d in radius_handle_request (request=0x12755810, fun=0x408910 <rad_authenticate>) at event.c:3790 No locals. #13 0x0000000000420320 in request_handler_thread (arg=<value optimized out>) at threads.c:537 fun = 0x408910 <rad_authenticate> self = 0x12740a90 #14 0x0000003c6d00683d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #15 0x0000003c6c0d500d in clone () from /lib64/libc.so.6 No symbol table info available. (gdb) Chris Taylor System Administrator Network Operations Eastlink Chris.Taylor(a)corp.eastlink.ca T: 519.773.1287 -----Original Message----- From: freeradius-users-bounces+chris.taylor=corp.eastlink.ca(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.taylor=corp.eastlink.ca@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, May 02, 2013 11:58 AM To: FreeRadius users mailing list Subject: Re: segfault error Chris Taylor wrote: > Sorry miscommunication on my part. Below is an example of a request that causes the segfault. I was also able to get a core dump as well which I pasted at the bottom. Which is *not* what we asked for. Please follow the instructions in doc/bugs. It gives DETAILED instructions on what to post. You are NOT posting the information we need to be able to help you. You're just showing that you can run gdb. This isn't useful. You need to run the gdb commands in doc/bugs, which tell us WHERE the problem occurred. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Support for EAP-AKA' [EAP-AKA Prime]
by K Rajesh 06 May '13

06 May '13

Hi all, I am looking to augment my freeradius AAA server with EAP-AKA' implementation [demo purposes only]. Can anyone help me with relevant key generation code? Thanks and regards, Rajesh

1 0

Question on ldap module's base_filter
by Mathieu Simon 06 May '13

06 May '13

G'day list I've come across an issue with the ldap module parameter base_filter, and I'm not yet sure whether I'm hitting a bug (I guess: less likely) than I'm missing / missunderstanding its correct use. I'm running a Debian Squeeze derivative (Univention Corporate Server), FR 2.1.10 and OpenLDAP. On squeeze base_filter come preconfigured as disabled (#base_filter = "(objectclass=radiusprofile)" Now my idea was to set base_filter = "(sambaAcctFlags=[U ])" to only let user objects (that are not disabled) get authorized. This field is present on user object so it would be great to have it used somehow. The curious thing was that radtest I always get Access-Accept even when a user has a the disabled flag (sambaAcctFlags=[UD ]). This led me to check whether I can just set base_filter="(notExisting=thisDoesntExist)" And the result also was: Access-Accept, so I guess base_filter isn't read as I'd have expected it at first sigh :-\ When I launch freeradius in debug mode I can see a message base_filter = "(sambaAcctFlags=[U ])" passing on the screen so I guess the value at least is getting read. Can you give me a clever hint where/what to look for? Best regards Mathieu

1 0