Arch Linux

syrzan

Member

Registered: 2013-11-13

Posts: 2

freeRADIUS rlm_krb5 seg fault

I'm having a few problems setting up freeRadius with a kerberos backend on arch and would really appreciate a little help.

Kernal: Linux 3.11.6-1-ARCH i686
freeradius 3.0.0-1

All the configuration changes I have made to the default configs are listed below:

/etc/raddb/users

Added the following line at the top of the file:

DEFAULT Auth-Type = Kerberos

/etc/raddb/sites-enabled/default and /etc/raddb/sites-enabled/inner-tunnel

Added the following in the Authenticate section directly after the pap entry

Auth-Type Kerberos {
	krb5
}

I have also copied the file /etc/raddb/mods-available/krb5 to /etc/raddb/mods-enabled/krb5 and edited the entries to point to the keytab and principle im using for radius. The keytab contains two entries one for radius/hostname.domain and one for host/hostname.domain.

I have verified the keytab is ok by using it with kinit to get a valid ticket for both principles. Additionally im sure my kerberos setup is ok as it works fine with ldap, nslcd and ssh.

The problem is when I run radiusd -X and then attempt a radtest I get the following:

...
(0) files : users: Matched entry DEFAULT at line 1
(0)	[files] = ok
(0)	[expiration] = noop
(0)	[logintime] = noop
(0) WARNING: pap: No “known good” password found for the user. Not setting Auth-Type.
(0) WARNING: pap: Authentication will fail unless a “known good” password is available.
(0)	[pap] = noop
(0)   } # authorize = ok
(0) Found Auth-Type = Kerberos
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0)  Auth-Type Kerberos {

at which point the server dies with no further output. Running the server using systemctl start freeradius and then looking at the status after its died shows its failed with Main PID: 21835 (code=dumped, signal=SEGV)

I have looked all over the internet but the only place I have found someone with the same problem is here:

http://www.mail-archive.com/freeradius- … 77744.html

I have also enabled core dumps in the radiusd.conf however I have no idea how to actually view the dump or where it is (and yes I did google it, but all the responses made no sence to me)

I have also tried the freeradius-git package on the AUR however that throws errors when building, something to do with undefined symbols while making radattr.

...
CC src/main/radattr.c
LINK build/bin/radattr
UNIT-TEST rfc.txt
./build/bin/radattr: symbol lookup error: ./build/bin/radattr: undefined symbol: _fr_cursor_init
src/tests/unit/all.mk:23: recipe for target 'build/tests/unit/rfc.txt' failed
make: *** [build/tests/unit/frc.txt] Error 127
=> ERROR: A failure occurred in build().
       Aborting...
=> ERROR: Makepkg was unable to build freeradius-git.
=> Restart building freeradius-git ? [y/N]
=> -----------------------------------------------
=>

I don't usually post here as every problem i've had using arch so far, I've solved after reading the wiki/forums or random googling. However i'm at a complete loss this time, i have literally no idea how to solve this...

Thanks

syrzan

Member

Registered: 2013-11-13

Posts: 2

Re: freeRADIUS rlm_krb5 seg fault

Just as a quick update, the rlm_krb module still seems to be causing seg faults, however it is possible to get it working by configuring freeRadius to use PAM and then telling PAM to authenticate with kerberos.