- Freeradius-Users - lists.freeradius.org

Few Questions
by Jarosław Kłopotek 14 Jun '12

14 Jun '12

Hi all! FreeRadius is better than I thought. Thanks to all developers! I use /etc/freeradius/users file to store userdata, I've got a few questions: 1. Is it possible to make a group of user and add a parameters to created group? 2. Is it possible to autenticate this group by a system? 3. Is it possible to write log of its operation to another specified file (good login, no good pass, other) ? 4. Does anyone got a example of php login script using radius? Where to read about it? Regards -- Jarosław 'YArii' Kłopotek mob +48 607 893 111 GG:1336231

3 2

IPv4 *and* IPv6 addresses for home_servers and failover
by Bob Franklin 14 Jun '12

14 Jun '12

Hello, I'd just just to check FreeRADIUS operates as I'm expecting (and have observed, in the limited amount of testing I've been able to do, before plugging things into the real world). I'm trying to get our FreeRADIUS 2.1.12 servers ready to handle IPv4 and IPv6 and, in particular, IPv6-accessible home_servers (e.g. the UK JANET Roaming NRPS ones). If I do: home_server ja-net-roaming0_server { ... I have to put ONE of: ipaddr = roaming0.ja.net ipv6addr = roaming0.ja.net ... which one I put will control whether IPv4 or IPv6 is used to contact that host. If so, does this mean that, if I want to allow the possibility of talking to the servers over IPv6 as well as IPv4 (and failing between one and other, if either are unavailable), I have to configure two distinct servers and set them up in the pool? e.g. home_server ja-net-roaming0_server { ipaddr = roaming0.ja.net [or the IPv4 address] ... } home_server ja-net-roaming0_server6 { ipv6addr = roaming0.ja.net [or the IPv6 address] ... } ... server_pool ja-net_pool { type = client-balance home_server = ja-net-roaming0_server home_server = ja-net-roaming0_server6 home_server = ja-net-roaming1_server home_server = ja-net-roaming1_server6 ... } This will mean that, when everything in the pool is up, some clients will always get an IPv4 home_server and some an IPv6 one. I just want to confirm there's no way to configure a single home server that can use both IPv4 and IPv6, or have ones that use IPv6 unless it's available, then fail back to IPv4, and that what I'm proposing above is the recommended way of doing this. [I realise that, if I configure them separately like this, I have to manually manage whether individual home servers have IPv4 or IPv6 registrations.] Thanks for your help, - Bob -- Bob Franklin <rcf34(a)cam.ac.uk> +44 1223 748479 Network Division, University of Cambridge Computing Service

4 4

FreeRadius OpenLDAP TTLS/PAP
by akkouche 14 Jun '12

14 Jun '12

I try to configure FreeRadius / OpenLDAP with a method of TTLS / PAP. but it does not work. how to do. thank you Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 41586, id=30, length=56 User-Name = "toto" User-Password = "\267\002n\235W\270=\207\343\327U\032\036\032w\372" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "toto", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for toto [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> toto [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=toto) [ldap] expand: dc=tem-tsp,dc=eu -> dc=tem-tsp,dc=eu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=tem-tsp,dc=eu, with filter (uid=toto) [ldap] Added User-Password = toto in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "toto" [ldap] looking for reply items in directory... [ldap] radiusTunnelPrivateGroupId -> Tunnel-Private-Group-Id:0 = "33" [ldap] radiusTunnelMediumType -> Tunnel-Medium-Type:0 = IEEE-802 [ldap] radiusTunnelType -> Tunnel-Type:0 = VLAN [ldap] user toto authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Config already contains "known good" password. Ignoring Password-With-Header ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "�?n?W�=?��U???w�" [pap] Using clear text password "toto" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> toto attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 11 Sending Access-Reject of id 30 to 127.0.0.1 port 41586 Waking up in 4.9 seconds. Cleaning up request 11 ID 30 with timestamp +1966 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 41586, id=30, length=56 User-Name = "toto" User-Password = "\267\002n\235W\270=\207\343\327U\032\036\032w\372" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "toto", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for toto [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> toto [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=toto) [ldap] expand: dc=tem-tsp,dc=eu -> dc=tem-tsp,dc=eu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=tem-tsp,dc=eu, with filter (uid=toto) [ldap] Added User-Password = toto in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "toto" [ldap] looking for reply items in directory... [ldap] radiusTunnelPrivateGroupId -> Tunnel-Private-Group-Id:0 = "33" [ldap] radiusTunnelMediumType -> Tunnel-Medium-Type:0 = IEEE-802 [ldap] radiusTunnelType -> Tunnel-Type:0 = VLAN [ldap] user toto authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Config already contains "known good" password. Ignoring Password-With-Header ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "�?n?W�=?��U???w�" [pap] Using clear text password "toto" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> toto attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 12 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 12 Sending Access-Reject of id 30 to 127.0.0.1 port 41586 Waking up in 4.9 seconds. Cleaning up request 12 ID 30 with timestamp +1974 Ready to process requests. ----- kahina akkouche -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRadius-OpenLDAP-TTLS-PAP-tp5713… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

reject reason logged in radius.log. Possible?
by Daniele Albrizio 14 Jun '12

14 Jun '12

I recently set up a banned mac address database to reject authentication from proved compromised clients. I'd like to have a significant record in freeradius logfile for connection debugging reasons. Ways I use to implement this results in ambiguous "Invalid user" or "Login incorrect" misleading messages in radius.log . Users are in effect valid and correct, but their equipment is not. Does anybody know how this scenario can be improved? ----------- Relevant lines of default virtual server authorize section are: authorize { if ( "%{Calling-Station-Id}" =~ /([a-fA-F0-9]{2}.?){6}/ && "%{sql: SELECT 1 FROM callingstidbanlist WHERE mac='%{Calling-Station-Id}'}" == 1 ) { update reply { # Select ban reason from radgroupreply Port-Message attribute related to the ban group Reply-Message := "Access forbidden from this terminal ( %{sql: SELECT value FROM radgroupreply WHERE attribute = 'Port-Message' AND groupname IN (SELECT bangroup FROM callingstidbanlist WHERE mac = '%{Calling-Station-Id}' ) ; } ) ." } #update control { # Auth-Type := Reject #} # Line in radius.log: # Auth: Login incorrect: [myusername] (from client wall1-wigate1 port 122 cli 00-1C-CC-C3-C7-1A) reject # Line in radius.log: # Auth: Invalid user: [myusername] (from client wall1-wigate1 port 122 cli 00-1C-CC-C3-C7-1A) } } -- Daniele ALBRIZIO - albrizio(a)univ.trieste.it Tel. +39-040.558.3319 UNIVERSITY OF TRIESTE - Network Services Divisione V - Infrastrutture e Servizi Informativi via Alfonso Valerio, 12 I-34127 Trieste, Italy Sezione Infrastrutture Informatiche e Telematiche

2 1

Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 14 Jun '12

14 Jun '12

Hi Phil, > src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c: > > about line 741, maybe this: > > pairmove2(&response, &handler->request->reply->vps, > PW_MSCHAP_ERROR, 0); > > ...should be: > > pairmove2(&response, &handler->request->reply->vps, > PW_MSCHAP_ERROR, VENDORSPEC_MICROSOFT); > > ? > > I don't understand though; I tested this as working, so > > Unfortunately my testbed is no longer assembled :o( your fix works perfectly. But it have to be: > PW_MSCHAP_ERROR, VENDORPEC_MICROSOFT); instead > PW_MSCHAP_ERROR, VENDORSPEC_MICROSOFT); <snip> : Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 (8) mschap : ntlm_auth says password must change (8) [mschap] = reject MSCHAP-Error: ?E=648 R=0 C=07cc36ab334ac36c8af4bc87201b552a V=3 M=Password Expired Found new challenge from MS-CHAP-Error: err=648 retry=0 challenge=07cc36ab334ac36c8af4bc87201b552a : </snip> The windows client get now the password change Window. But i still have one issue: the new passphrase will not changed. I got: MS-CHAP-NT-Enc-PW with invalid format here are the output from debug: <snip> : (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) group authenticate { (9) - entering group authenticate {...} (9) eap : Request found, released from the list (9) eap : EAP/mschapv2 (9) eap : processing type mschapv2 rlm_eap_mschapv2: password change packet received rlm_eap_mschapv2: built change password packet EAP-Message = 0x020f024f1a070f024a7979c8bf7d1f48b508f3a77a6cf40c3b323e89bcd5407e2e5cb01cc46a4b647d1e8fe79e297aa65d676f10889d59b1c80cd7a3298d0c534821973b09 0992bae04d4d23a9d5d8f07f27cb11d98d0d4826d32098afc30bf72d9144cf7eb48961880421962a26877e3a12250621d8121e26041120ce25774a0a4671d1df838f83efb44072540349c518d1679ed8c31782d104b9e8fd27da45f0b130d9b0af78ff02021ce997841fd0bbcd91aaa610575f9a6212b842563b710cb0c8410f47d51a38b3a6d1818909d2fb4735346c8b611b3ba0dde0cf6efa446c2605975e5016c24b30888d918e0b0a03352d7a51d2eee48f14b77b0d EAP-Message = 0x4a085ae945764de443cd775041a3138f227f90600ec3d8b2cc9648a5144dcb10918bc499d5c939677d1c15fadfbe9761da908e0fe8a864e8e4631b92f26d2ec3f98ba74263bac7072037c42b609f6e163176bafba7f25c5d1e9f4418a517e4d1179701510116215825d33a639a1e83fecf8835482f3f1dcd909fad60c03bd8b6bd7c557df2bcea320a1339dc01f028f0901d10e30119bf2a2b417cb69ab37d5e5223bb02bc506bbc21993f7a659000d12ec6c58153a4fa90679feb094bace85de10626834f59f5c751cf82f8854f862eb850759d4304b64490e752f6ab27b6bfcb90f9eb92559f3b584dca6fd0b77aff1220cbf491fd3c3f6d9b29ed6f EAP-Message = 0x6220d11763505a3f83f3ba6b811924ec987ba0515d6f99d4b584888d36ab9af03e3f2120bb50aa142cd1843d1b8c6975777c150000000000000000f32ed76d7f602a6fba828238448651148ebe123062e60af10000 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "TEST\\user1" State = 0x42f25dad43fd47b2696e125eaff8db99 Acct-Multi-Session-Id = "00-A1-B1-4D-D4-78-A1-23-DF-79-F0-B9-4F-D8-55-5F-00-04-FE-67" Acct-Session-Id = "b82ba75a-00000133" NAS-Port = 291 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP" NAS-IP-Address = 10.0.1.50 Framed-MTU = 1496 Calling-Station-Id = "A1-23-DF-79-F0-B9" Called-Station-Id = "00-A1-B1-4D-D4-78" Service-Type = Framed-User EAP-Type = MS-CHAP-V2 MS-CHAP-Challenge = 0x07cc36db334dc36c8af4bc87201b552a MS-CHAP2-CPW = 0x070f515d6f99d4b584888d36ab9af03a3f2120bc50aa142cd1843d1b8c6975777c150000000000000000f32ed76d7f602a6fba828238448651148ebe123062e60af10000 MS-CHAP-NT-Enc-PW += 0x060f00017979c8bf7d1f48b508f3a56a6cf40c3b323e89bcd5407e2e5fb01cc46a4b647d1e8fe79e297aa65d676f10889d59b1c80cd7a3298d0c534821973b090992a7e04d4d23a9d5d8f07f27cb11d98d0d4826d32098afc30bf72d9144cf7eb48961880421962a26877e3a12250621d8121e26041120ce25774a0a4671d1df838f83efb44072540349c518d1679ed8c31782d104b9e8fd27da45f0b130d9b0af78ff02021ce997841fd0bbcd91aaa610575f9a6212b842563b710cb0c8410f47d51a38b3a6d1818909d2fb4735346c8b611b3ba0dde0cf6efa446c2605975e5016c24b30888d918e0b0a03352d7a51d2eee48f14b77b MS-CHAP-NT-Enc-PW += 0x060f00020d4a085ae945764de443cd775041a3138f211f90600ec3d8b2cc9648a5144dcb10918bc499d5c939677d1c15fadfbe9761da908e0fe8a864e8e4631b92f26d2ec3f98ba74263bac7072037c42b609f6e163176bafba7f25c5d1e9f4418a517e4d1179701510116215825d33a639a1e83fecf8835482f3f1dcd909fad60c03bd8b6bd7c557df2bcea320a1339dc01f028f0901d10e30119bf2a2b417cb69ab37d5e5223bb02bc506bbc21993f7a659000d12ec6c58153a4fa90679feb094bace85de10626834f59f5c751cf82f8854f862eb850759d4304b64490e752f6ab27b6bfcb90f9eb92559f3b584dca6fd0b77aff1220 MS-CHAP-NT-Enc-PW += 0x060f0003cbf491ad3c3f6d9b29ed6f6220d11763505a3f83f3ba6b811924ec987ba0 (9) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) mschapv2 : group MS-CHAP { (9) mschapv2 : - entering group MS-CHAP {...} (9) mschap : MS-CHAPv2 password change request received (9) mschap : MS-CHAP-NT-Enc-PW with invalid format (9) [mschap] = invalid rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. (9) eap : Handler failed in EAP/mschapv2 (9) eap : Failed in EAP select (9) [eap] = invalid (9) Failed to authenticate the user. : </snip> thanks, C. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

2 1

WING-ASN throwing error - Mandatory HA Mode parameter
by Rathod Subhashchandra 14 Jun '12

14 Jun '12

Dear All, I am using WING-ASN and AAA(Radius server) to test EAP-TLS authentication mechanism. WING-ASN is throwing following error. 08.06.2012(12:16.50.249.739) [ASN C Plane] Mandatory HA Mode parameter (HA_RK_Lifetime, HA_RK_SPI, HA_RK_KEY, Duration Quota, MN_HA_SPI, HA_IP_ADDR, MN_HA_KEY) I did not find all above attributes in AAA. Can anybody tell me how to add above attributes and also their values? Thanks! Rathod.

5 11

Behavior on LDAP outage
by Jethro Carr 14 Jun '12

14 Jun '12

hi all, I had an issue today where an LDAP server being relied upon by FreeRadius was unreachable, however FreeRadius returned the default authentication status for the user. The problem is, the NAS authenticating the users against FreeRadius considered the default authentication response (reject) to be a sign that FreeRadius on the server was OK and didn't fail over to the secondary server. I was expecting it to return unreachable or just time out, instead of running the default auth behavior, but maybe I've missed a configuration option or have incorrect assumptions. The setup is 2x servers, each running Radius and LDAP with LDAP replication in place. If the primary server is entirely unreachable, the NASes being used have no issue failing over to the secondary. It only didn't fail over because the NAS believed that the primary was working. :-( Example of a test run when the LDAP server on the host is stopped: # radtest test test123 127.0.0.1 0 testing1234 Sending Access-Request of id 108 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test123" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=108, length=108 Reply-Message = "Authentication denied - user does not belong to any suitable groups to access this NAS" End of the users file, showing the default reject behavior defined: # tail /etc/raddb/users DEFAULT Huntgroup-Name == admins, Ldap-Group == "cn=admins,ou=Group,dc=example,dc=com", User-Profile := "cn=admins,ou=Group,dc=example,dc=com" Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Authentication denied - user does not belong to any suitable groups to access this NAS" And of course, relevant radius logs: # tail /var/log/radius/radius.log Wed Jun 13 11:33:14 2012 : Auth: Invalid user: [test] (from client localhost port 0) Wed Jun 13 11:34:48 2012 : Error: [ldap] could not start TLS Can't contact LDAP server Wed Jun 13 11:34:48 2012 : Error: [ldap] (re)connection attempt failed Wed Jun 13 11:34:48 2012 : Error: [ldap] could not start TLS Can't contact LDAP server Wed Jun 13 11:34:48 2012 : Error: [ldap] (re)connection attempt failed Aside from "make sure your LDAP server doesn't die", ;-) can anyone make any recommendations around the best approach to take, so that in event of an LDAP outage on one host, FreeRadius returns a result (or nothing at all) that causes the NAS to fail over to the secondary host? Using FreeRadius 2.1.12. many thanks, jethro -- Jethro Carr www.jethrocarr.com

3 3

Re: Behavior on LDAP outage
by Alan Buxey 14 Jun '12

14 Jun '12

Ok, here is probably a use case for silently dropping rejects. That way your NAS will behave okay....but you only want to do this if the LDAP is down...so need to base it on that condition. That's if you want to keep it all in the server, you could have an external cronjob or such that checks LDAP and stops/starts the radius daemon alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2

buffer overflow on mschap reject
by Matt Richards 13 Jun '12

13 Jun '12

Hello, I have got radius setup to authenticate wireless clients using MS-CHAP and everything works correctly if the entered user / pass is correct. If the password is wrong, however, I get a buffer overflow error and radiusd dies. I get the follow on the console when this happens ... > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/mschapv2 > [eap] processing type mschapv2 > [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel > [mschapv2] +- entering group MS-CHAP {...} > [mschap] Creating challenge hash with username: rer > [mschap] Told to do MS-CHAPv2 for rer with NT-Password > [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=rer > [mschap] No NT-Domain was found in the User-Name. > [mschap] expand: %{mschap:NT-Domain} -> > [mschap] ... expanding second conditional > [mschap] expand: --domain=%{%{mschap:NT-Domain}:-WC1} -> --domain=WC1 > [mschap] mschap2: 5f > [mschap] Creating challenge hash with username: rer > [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=a20a6c5d363dd4b6 > [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=5182a275d21751ab7007e8de241d8d516215a95d3384ccf9 > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > [mschap] External script failed. > [mschap] FAILED: MS-CHAP2-Response is incorrect > *** buffer overflow detected ***: radiusd terminated > ======= Backtrace: ========= > /lib/libc.so.6(__fortify_fail+0x37)[0x7fea6d97c427] > /lib/libc.so.6(+0xe8150)[0x7fea6d97a150] > /lib/libc.so.6(+0xe76eb)[0x7fea6d9796eb] > /lib/libc.so.6(__snprintf_chk+0x7b)[0x7fea6d9795bb] > /usr/lib64/freeradius/rlm_mschap-2.1.11.so(+0x31bb)[0x7fea6c24a1bb] > radiusd(modcall+0xb4b)[0x41c4bb] > radiusd(indexed_modcall+0xd3)[0x418b53] > /usr/lib64/freeradius/rlm_eap_mschapv2-2.1.11.so(+0x166a)[0x7fea696d366a] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(+0x2f76)[0x7fea6bc39f76] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(eaptype_select+0x176)[0x7fea6bc3a926] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(+0x2739)[0x7fea6bc39739] > radiusd(modcall+0xb4b)[0x41c4bb] > radiusd(indexed_modcall+0xd3)[0x418b53] > radiusd(rad_authenticate+0x985)[0x40a075] > /usr/lib64/freeradius/rlm_eap_peap-2.1.11.so(eappeap_process+0x976)[0x7fea698d8f26] > /usr/lib64/freeradius/rlm_eap_peap-2.1.11.so(+0x1825)[0x7fea698d7825] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(+0x2f76)[0x7fea6bc39f76] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(eaptype_select+0x176)[0x7fea6bc3a926] > /usr/lib64/freeradius/rlm_eap-2.1.11.so(+0x2739)[0x7fea6bc39739] > radiusd(modcall+0xb4b)[0x41c4bb] > radiusd(indexed_modcall+0xd3)[0x418b53] > radiusd(rad_authenticate+0x985)[0x40a075] > radiusd(radius_handle_request+0x52)[0x424d42] > radiusd(thread_pool_addrequest+0x9)[0x425039] > radiusd[0x4269e6] > /usr/lib/libfreeradius-radius-2.1.11.so(fr_event_loop+0x33b)[0x7fea6e04860b] > radiusd(main+0x55a)[0x41cd2a] > /lib/libc.so.6(__libc_start_main+0xe6)[0x7fea6d8b0ba6] > radiusd[0x408fe9] The version of freeradius i'm running is ... FreeRADIUS Version 2.1.11, for host x86_64-pc-linux-gnu, built on Jun 11 2012 at 11:10:29 I can replicate this issue with radtest. Does anybody know why this might be happening? If you require any additional info please let me know. One thing I was thinking about trying it going back a few versions of ntlm_auth and tring again. Its interesting how I don't seem to be able to find any information relating to this on the Internet. Thanks, Matt.

3 6

Split authorization / authentication
by Emmanuel BILLOT 13 Jun '12

13 Jun '12

Hi, Is it possible to split authorization step as follow : - Considering we want to authorize user using EAP and MAC adresses - http://wiki.freeradius.org/Mac-Auth works fine, but is it possible to do EAP with one radius server and MAC address auth with another one ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 4