Bug 58132 - After upgrade to 5.2 radius authentication of a wireless device fails
Summary: After upgrade to 5.2 radius authentication of a wireless device fails
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Radius
Version: UCS 5.2
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.2-2-errata
Assignee: Sönke Schwardt-Krummrich
QA Contact: Carlos García-Mauriño
URL: https://help.univention.com/t/problem...
Keywords:
Depends on:
Blocks:
 
Reported: 2025-03-31 09:34 CEST by Christina Scheinig
Modified: 2025-06-26 14:56 CEST (History)
4 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 7: Crash: Bug causes crash or data loss
Who will be affected by this bug?: 4: Will affect most installed domains
How will those affected feel about the bug?: 5: Blocking further progress on the daily work
User Pain: 0.800
Enterprise Customer affected?: Yes
School Customer affected?: Yes
ISV affected?:
Waiting Support: Yes
Flags outvoted (downgraded) after PO Review:
Ticket number: 2025032621000128, 2025042821000113, 2025051921000245, 2025060321000077
Bug group (optional): Regression, Workaround is available
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christina Scheinig univentionstaff 2025-03-31 09:34:39 CEST
*Sun Feb 23 17:24:53 2025 : ERROR: (33) mschap: ERROR: Program returned code (1) and output ''*
*Sun Feb 23 17:24:53 2025 : Auth: (33)   Login incorrect (mschap: Program returned code (1) and output ''): [username/<via Auth-Type = eap>] (from client AP_name port 0 via TLS tunnel)*
*Sun Feb 23 17:24:53 2025 : Auth: (34) Login incorrect (eap_peap: The users session was previously rejected: returning reject (again.)): [username/<via Auth-Type = eap>] (from client AP_name port 1 cli 80-86-D9-4B-F8-16)*
(username and AP_name are vars for the obfuscated original values)


When I stop freeradius (via systemd) and start it manually by freeradius -f,
everything works like a charm and all my clients are authenticated.

Seems to be a systemd issue.
Workaround:

    systemctl edit freeradius

### Anything between here and the comment below will become the new contents of the file"
[Service]
AmbientCapabilities=CAP_DAC_OVERRIDE


Needs to be set, to solve the issue.

radtest is always working.
Comment 1 Mirac Erdemiroglu univentionstaff 2025-04-28 11:27:27 CEST
Another customer affected 2025042821000113

Another end customer who ran into this error after upgrading to UCS 5.2-x.
Due to this error, it is no longer possible to log on to the Radius server, all clients are therefore unusable and this increases the criticality of this bug.

Article for the workaround.

https://help.univention.com/t/problem-radius-since-upgrading-to-5-2-x-login-to-radius-fails-mschap-program-returned-code-1/24133
Comment 3 Mirac Erdemiroglu univentionstaff 2025-05-20 14:48:40 CEST
Another customer affected 2025051921000245
Comment 6 Sönke Schwardt-Krummrich univentionstaff 2025-06-23 14:39:16 CEST
The problem is now reproducible. The logroate UCR variable "logrotate/radius_ntlm_auth/create" is set to "644 root freerad" as of UCS 5.2-0 but the freeradius service is no longer running as "root" but as user "freerad". After the installation (and maybe even also after updating), the permissions of /var/log/univention/radius_ntlm_auth.log were correct but when logrotate did its work, the helper univention-radius-ntlm-auth started to fail.

The fix is
# ucr set logrotate/radius_ntlm_auth/create="644 freerad freerad"
# chown freerad:freerad /var/log/univention/radius_ntlm_auth.log
# chmod 644  /var/log/univention/radius_ntlm_auth.log

So this is a regression in 5.2-0.

In https://help.univention.com/t/problems-with-freeradius-auth-after-upgrading-to-5-2-0/23926/19 customers have verified, that the proposed fix is working.

https://help.univention.com/t/problem-radius-since-upgrading-to-5-2-x-login-to-radius-fails-mschap-program-returned-code-1/24133 has been updated accordingly.

Merged id 174413 into scope 719 of release 5.2-0-0
No Source Revision has been replaced
New Source Revision: 174413

Package: univention-radius
Version: 9.2.1
Branch: ucs_5.2-0-errata5.2-2
Scope: errata5.2-2
Comment 7 Sönke Schwardt-Krummrich univentionstaff 2025-06-26 12:24:13 CEST
fix: restrict permissions of /var/log/univention/radius_ntlm_auth.log to 0660

Merged id 174431 into scope 719 of release 5.2-0-0
Old Source Revision has been replaced: 174413
New Source Revision: 174431

Package: univention-radius
Version: 9.2.2
Branch: ucs_5.2-0-errata5.2-2
Scope: errata5.2-2
Comment 8 Iván.Delgado univentionstaff 2025-06-26 14:56:11 CEST
<https://errata.software-univention.de/#/?erratum=5.2x127>