- Freeradius-Users - lists.freeradius.org

Re: MySQL Segmentation Fault
by Bryan Dobson 28 Sep '12

28 Sep '12

Thank you for the reply, I thought this as well, but, checking the system all I only see a single set of client libraries installed: [root@radiusdev ~]# rpm -qa | grep mysql mysql-5.1.61-4.el6.x86_64 mysql-devel-5.1.61-4.el6.x86_64 mysql-libs-5.1.61-4.el6.x86_64 mysql-server-5.1.61-4.el6.x86_64 Do I need all of those or is one causing me the issue still with the faults? Bryan Dobson wrote: >> I have a new installation and configuration that I am working on for >> FreeRadius on CentOS 6.3 the versions are: >> >> freeradius-2.1.12-3.el6.x86_64 >> >> Testing authentication, which goes to a remote MySQL database which >> was pre-existing with all user data. It executes the query and then >> immediately gives me a segmentation fault. Of note I have also >> compiled version 2.2 from source and receive the exact same error. I >> would prefer, if a tall possible to stick to using the RPM's from the >> distribution. > > You have two versions of the MySQL client libraries and/or headers > installed. Go fix that. > > Alan DeKok.

3 2

Load-Balance-Key usage
by lscrlstld 28 Sep '12

28 Sep '12

Hi, Can I use the Load-Balance-Key to choose a specific home_server? For sample: home_server_pool pool { type = keyed-balance home_server = server1 home_server = server2 } realm test { auth_pool = pool acct_pool = pool } authorize { ... if ( ... ) { update control { Load-Balance-Key := 1} #sends to server1 } else { update control { Load-Balance-Key := 2} #sends to server2 } ... } Thanks! JJP

3 2

MySQL Segmentation Fault
by Bryan Dobson 28 Sep '12

28 Sep '12

I have a new installation and configuration that I am working on for FreeRadius on CentOS 6.3 the versions are: freeradius-2.1.12-3.el6.x86_64 Testing authentication, which goes to a remote MySQL database which was pre-existing with all user data. It executes the query and then immediately gives me a segmentation fault. Of note I have also compiled version 2.2 from source and receive the exact same error. I would prefer, if a tall possible to stick to using the RPM's from the distribution. Including relevant output from "radiusd -X" below: rlm_sql Creating new attribute sql_acctlocal-SQL-Group rlm_sql (sql_acctlocal): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_acctlocal): Attempting to connect to radius@localhost:/radiusdb rlm_sql (sql_acctlocal): starting 0 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_acctlocal): Connected new DB handle, #0 rlm_sql (sql_acctlocal): starting 1 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_acctlocal): Connected new DB handle, #1 rlm_sql (sql_acctlocal): starting 2 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_acctlocal): Connected new DB handle, #2 rlm_sql (sql_acctlocal): starting 3 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_acctlocal): Connected new DB handle, #3 rlm_sql (sql_acctlocal): starting 4 rlm_sql (sql_acctlocal): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_acctlocal): Connected new DB handle, #4 Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 39929 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38243, id=224, length=91 User-Name = "mci-test(a)znidomain.com" User-Password = "e9d9d2jc23o330k" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0xcf05723e13f3a4e69256bb129551e1ef # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++- entering policy filter_username {...} +++? if (User-Name =~ /^ /) ? Evaluating (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ / $$/) ? Evaluating (User-Name =~ / $$/) -> FALSE +++? if (User-Name =~ / $$/) -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") expand: %{User-Name} -> mci-test(a)znidomain.com expand: %{tolower:%{User-Name}} -> mci-test(a)znidomain.com ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE ++- policy filter_username returns notfound ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "uniserve.com" for User-Name = "mci-test(a)uniserve.com" [suffix] Found realm "uniserve.com" [suffix] Adding Stripped-User-Name = "mci-test" [suffix] Adding Realm = "uniserve.com" [suffix] Proxying request from user mci-test to realm uniserve.com [suffix] Preparing to proxy authentication request to realm "uniserve.com" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql_authremote] expand: %{Stripped-User-Name} -> mci-test [sql_authremote] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> mci-test [sql_authremote] sql_set_user escaped user --> 'mci-test' rlm_sql (sql_authremote): Reserving sql socket id: 4 [sql_authremote] expand: SELECT id, u.username, u.password as value FROM users u, classes c WHERE u.username = '%{SQL-User-Name}' AND u.class = c.classid AND c.dial = 'Y' AND u.realm = (select realmid from realms where domainname = '%{Realm}') ORDER BY id -> SELECT id, u.username, u.password as value FROM users u, classes c WHERE u.username = 'mci-test' AND u.class = c.classid AND c.dial = 'Y' AND u.realm = (select realmid from realms where domainname = 'znidomain.com') ORDER BY id Segmentation fault

2 1

read ldap groups for a user not specified in User-Name
by David Aldwinckle 27 Sep '12

27 Sep '12

Hi list, I've been given a set of requirements and I am having a hard time wrapping my head around what needs to happen in order to make things work. Here is the scenario: 1. External to FreeRadius, a user can sponsor the creation of a guest account. The sponsor and guest accounts are in separate LDAP databases. 2. Normally, I just need to handle authentication for the guest accounts. That part is easy, I have PEAP configured with LDAP and NT hashes. 3. the special requirement is that IF the sponsor account gets locked (deleted, expired, etc), then the guest account can no longer login either. So, what I was thinking I could do was an LDAP group check on the sponsor userid (which would be put into a new attribute stored in the guest LDAP db), and then check the sponsors group memberships. The problem with that is that I don't know how to get FreeRadius to read the groups for an arbitrary user that is not %User-Name. Can I copy another variable into the User-Name attribute in Post-Auth, and then do the group check there? Any suggestions? Thanks, Dave

2 1

rlm_cache
by Franks Andy (RLZ) IT Systems Engineer 27 Sep '12

27 Sep '12

Hi All, I've looked around the internet a bit and obviously looked at the wiki page and configuration page for rlm_cache and can't quite understand how it works. Does anyone have any practical examples of simply storing an attribute/value pair or pairs and then check the value later in the processing? Thanks

2 1

suffix not work for me
by Tony Peña 27 Sep '12

27 Sep '12

hi again... i try to get suffix work but i guess missing something... here some debugs and confs rad_recv: Access-Request packet from host 10.10.64.67 port 16829, id=53, length=208 Framed-Protocol = PPP User-Name = "*usertest(a)my.domain.cu*" User-Password = "*secret*" NAS-Port-Type = Async Calling-Station-Id = "123456789" Called-Station-Id = "987654321" Connect-Info = "44000/28800 V90/V44/LAPM" Cisco-AVPair = "v92-info=V.92 QC/QC Short Train Success/0/0" NAS-Port = 443 NAS-Port-Id = "Async3/11*E1 7/0:7" Service-Type = Framed-User NAS-IP-Address = 10.10.64.67 # Executing section authorize from file /etc/freeradius/sites-available/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok ++- entering policy filter_username {...} +++? if (User-Name =~ /^ /) ? Evaluating (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ / $$/) ? Evaluating (User-Name =~ / $$/) -> FALSE +++? if (User-Name =~ / $$/) -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") expand: %{User-Name} -> *usertest(a)my.domain.cu* expand: %{tolower:%{User-Name}} -> *usertest(a)my.domain.cu* ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE ++- policy filter_username returns ok *[suffix] No '@' in User-Name = "usertest", looking up realm NULL <---why not found '@' if is coming in radius packet and check in the conf???* [suffix] No such realm "NULL" ++[suffix] returns noop [ldap] performing user authorization for *usertest* [ldap] expand: %{Stripped-User-Name} -> *usertest* [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=* usertest*) *<---------- this works stripped-user-name OK* [ldap] expand: ou=group,ou=my,dc=domain,dc=cu -> ou=group,ou=my,dc=domain,dc=cu . *checking user/pass works fine... now check monthlycounter to compare hours..* . [monthlycounter1] sql_xlat [monthlycounter1] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [monthlycounter1] expand: %{Stripped-User-Name:-%{User-Name:-DEFAULT}} -> *usertest* [monthlycounter1] sql_set_user escaped user --> '*usertest*' *IF stripped-user-name works here at monthlycounter why the query not use it! and use user with realm??/* [monthlycounter1] expand: SELECT SUM(acctsessiontime - GREATEST((1346472000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='*usertest(a)my.domain.cu*' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1346472000' -> SELECT SUM(acctsessiontime - GREATEST((1346472000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='*usertest(a)my.domain.cu*' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1346472000' rlm_sql (sql1): Reserving sql socket id: 4 [monthlycounter1] row[0] returned NULL rlm_sql (sql1): Released sql socket id: 4 [monthlycounter1] expand: %{sql1:SELECT SUM(acctsessiontime - GREATEST((1346472000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='*usertest(a)my.domain.cu*' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1346472000'} -> *rlm_sqlcounter: No integer found in string "" <------------- must be found integer to compare with max-monthly-session, in database i have only usernames, not with realms* +++[monthlycounter1] returns noop hints confs *DEFAULT Suffix == "@my.domain.cu", Strip-User-Name = Yes* Hint = "userdefault", Service-Type = Framed-User, Framed-Protocol = PPP, site-available/default # cat sites-available/default | egrep -v '\#|^$' authorize { preprocess filter_username *suffix* ldap redundant-load-balance { monthlycounter1 monthlycounter2 } checkval1 checkval2 checkval3 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } } preacct { preprocess acct_unique *suffix* } accounting { redundant-load-balance { sql1 sql2 } } session { load-balance { sql1 sql2 } } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { } thanxs for any help. -- Antonio Peña Secure email with PGP 0x8B021001 available at http://pgp.mit.edu Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001

4 10

Cloud Radius Server
by Michael Geary 27 Sep '12

27 Sep '12

Good Evening, We have several separate networks. Our main network runs PPPoE while all of the others run over DHCP. I would like to migrate the DHCP networks to use PPPoE. Currently, our Radius server resides at the head end of our PPPoE network. I would like to remove the chance that if the Internet failed there, that no one on the separate networks would be able to authenticate. Has anyone had any experience with using a Radius server in the cloud to authenticate users? Thank you very much, -- Michael Geary GAW High-Speed Internet 72 Shaker Rd. Enfield, CT 06082 www.GAW.com <http://www.gaw.com/> Office: 877.543.8429 Direct: 413.203.4911 Cell: 413.218.1446 Fax: 877.816.7068 netops(a)gaw.com -- “The information contained in this email message may be confidential. If you are not the intended recipient any use, distribution, disclosure or copying of this information is prohibited. If you receive this email in error, please tell us by return email and destroy this communication and any attachments from your system."

3 4

EAP-PSK : 16 bytes Pre shared key not configured
by Tatiana DIBANDA 27 Sep '12

27 Sep '12

Hi, I implemented the module eap2 to make freeradius with the eap_psk . After started the freeradius server (radius_output file attached to this mail), i launched my client openpana, the authentication failed and i have this error message "EAP-PSK : 16 bytes Preshared key not configured" (refer to openpana_client_output file attached to this mail) I would like to know how to configure the pre-shared key in my server? Thanks.

5 5

handling win domain name in username
by Crne We 27 Sep '12

27 Sep '12

Environmnet: Freeradius with PAP on Windows Username: domain\user1 password: ******* Looks like the Freeradius doesn't seem to like the windows domain name as part of username? Just plain username without a backslash works fine.

3 5

How to force users file parsing when returning proxied reply to add per-user AV-Pairs
by Gianni Costanzi 26 Sep '12

26 Sep '12

Hi, I've configured a freeradius server A (version 1.1.3) to proxy request for a specifix realm XYZ to another radius server B. Then, from the online docs, I understood that when A receives the reply from B it should go through its users file and if it finds a match it should add the specified AV-Pairs, like Service-Type (which is the one I need), to the reply it returns to the client that wants to authenticate a user: http://www.gnu.org/software/radius/manual/html_node/Proxy-Service.html#SEC16 Should it do this automatically or do I need to specify something in the realm definition? Second question: I've specified in the realm definition on radius A to remove the @XYZ suffix (strip) when it passes the request to radius B.. Then, when radius A looks into its own users file to append AV-Pairs to the answer, does it look for the stripped user or the user+realm? Thank you in advance for any help. PS: I know that this version may be old, but I can not easily update it at present time. -- -------------------------------------------------------------------------------------------------------------- | Gianni Costanzi (gianni.costanzi(a)gmail.com) | http://it.linkedin.com/in/giannicostanzi | http://utenti.multimania.it/giannicostanzi/my-projects.html | | My Fotoblog: | http://giannicostanzi.fotoblog.it --------------------------------------------------------------------------------------------------------------

2 3