September 2010 - Freeradius-Devel - lists.freeradius.org

Hanging Problem in 2.1.10
by David Mitchell 10 Sep '10

10 Sep '10

Alan, I had a hang pretty quickly this time. As last time, the last output was that it the 'entering group authenticate' section. I got the bt output. I'm not sure if it's helpful or not. I just re-read doc/bugs and will try it again with gdb logging enabled. I'm not sure if that will help or not. Thu Aug 26 08:33:10 2010 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Thu Aug 26 08:33:10 2010 : Info: +- entering group authorize {...} Thu Aug 26 08:33:10 2010 : Info: ++[preprocess] returns ok Thu Aug 26 08:33:10 2010 : Info: [suffix] No '@' in User-Name = "mark", looking up realm NULL Thu Aug 26 08:33:10 2010 : Info: [suffix] Found realm "~.+$" Thu Aug 26 08:33:10 2010 : Info: [suffix] Adding Stripped-User-Name = "mark" Thu Aug 26 08:33:10 2010 : Info: [suffix] Adding Realm = "(null)" Thu Aug 26 08:33:10 2010 : Info: [suffix] Authentication realm is LOCAL. Thu Aug 26 08:33:10 2010 : Info: ++[suffix] returns ok Thu Aug 26 08:33:10 2010 : Info: [eap] EAP packet type response id 2 length 136 Thu Aug 26 08:33:10 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Aug 26 08:33:10 2010 : Info: ++[eap] returns updated Thu Aug 26 08:33:10 2010 : Info: ++[files] returns noop Thu Aug 26 08:33:10 2010 : Info: Found Auth-Type = EAP Thu Aug 26 08:33:10 2010 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Thu Aug 26 08:33:10 2010 : Info: +- entering group authenticate {...} ^C Program received signal SIGINT, Interrupt. [Switching to Thread 0xb75af8c0 (LWP 14706)] 0xb77b7424 in __kernel_vsyscall () (gdb) bt #0 0xb77b7424 in __kernel_vsyscall () #1 0xb7752c99 in __lll_lock_wait () from /lib/i686/cmov/libpthread.so.0 #2 0xb774e0c4 in _L_lock_89 () from /lib/i686/cmov/libpthread.so.0 #3 0xb774d9f2 in pthread_mutex_lock () from /lib/i686/cmov/libpthread.so.0 #4 0xb75ac26f in eap_handler_free (inst=0x827fd98, handler=0x82af1a8) at mem.c:137 #5 0xb75ac3d5 in eaplist_expire (inst=0x827fd98, timestamp=1282833190) at mem.c:315 #6 0xb75ac856 in eaplist_find (inst=0x827fd98, request=0x82cee78, eap_packet=0x82ccc40) at mem.c:502 #7 0xb75aa76f in eap_handler (inst=0x827fd98, eap_packet_p=0xbfffd118, request=0x82cee78) at eap.c:974 #8 0xb75a9d80 in eap_authenticate (instance=0x827fd98, request=0x82cee78) at rlm_eap.c:298 #9 0x08089bbc in modcall (component=0, c=0x8293f88, request=0x82cee78) at modcall.c:297 #10 0x0808651b in indexed_modcall (comp=0, idx=6, request=0x82cee78) at modules.c:728 #11 0x0808692c in module_authenticate (auth_type=6, request=0x82cee78) at modules.c:1502 #12 0x080753c4 in rad_authenticate (request=0x82cee78) at auth.c:371 #13 0x08095854 in radius_handle_request (request=0x82cee78, fun=0x8074a10 <rad_authenticate>) at event.c:3767 #14 0x0808c9bf in thread_pool_addrequest (request=0x82cee78, fun=0x8074a10 <rad_authenticate>) at threads.c:874 #15 0x08091f7a in event_socket_handler (xel=0x82980a8, fd=7, ctx=0x829bb40) at event.c:3412 #16 0xb77a808c in fr_event_loop (el=0x82980a8) at event.c:411 #17 0x08092df6 in radius_event_process () at event.c:3753 #18 0x0808a782 in main (argc=2, argv=0xbfffe5a4) at radiusd.c:406 (gdb) -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 4

Loggint ntlm authentication
by Garber, Neal 10 Sep '10

10 Sep '10

Thread continued from freeradius-users list.. As I mentioned previously, I have the PEAP changes completed to save/retrieve reply attributes on authentication failure. I've examined the TTLS code and I have a question. The code to retrieve the saved reply attributes is done in a different place in the authenticate function as compared to the PEAP code. I'm wondering if this was intentional? If not, do you see a problem moving this code from the switch on status == EAPTLS_SUCCESS to the switch on rcode == PW_AUTHENTICATION_ACK (which was changed from RLM_MODULE_OK in ttls.c:eapttls_process)? I would then add similar code to the rcode == PW_AUTHENTICATION_REJECT to retrieve the saved reply attributes. Alternatively, I could add EAPTLS_FAIL to the switch on status and retrieve the attributes in that block (and then return 0 as it does in the default block). I'm looking for some advice because I have no way of testing/debugging the TTLS code and I'm concerned about breaking it. I'm also concerned because the code in the switch on status "returns" on EAPTLS_SUCCESS in rlm_eap_ttls whereas it falls through in rlm_eap_peap to the switch on rcode (TTLS only falls through when status == EAPTLS_OK). Thanks..

2 3

Memory leak
by James Devine 10 Sep '10

10 Sep '10

I've noticed if I set a hint such as DEFAULT NAS-IP-Address := "%{Packet-Src-IP-Address}" I end up with a memory leak that valgrind shows as: ==14825== 429,936 bytes in 1,378 blocks are definitely lost in loss record 332 of 332 ==14825== at 0x4C284A8: malloc (vg_replace_malloc.c:236) ==14825== by 0x4E433C4: paircopyvp (valuepair.c:318) ==14825== by 0x4E43484: paircopy2 (valuepair.c:351) ==14825== by 0x88B5733: hints_setup (rlm_preprocess.c:350) ==14825== by 0x88B59F1: preprocess_authorize (rlm_preprocess.c:562) ==14825== by 0x41B824: modcall (modcall.c:297) ==14825== by 0x4182B5: indexed_modcall (modules.c:716) ==14825== by 0x4090D5: rad_authenticate (auth.c:565) ==14825== by 0x425F44: radius_handle_request (event.c:3735) ==14825== by 0x41DEB4: thread_pool_addrequest (threads.c:842) ==14825== by 0x4272FD: event_socket_handler (event.c:3384) ==14825== by 0x4E46EEA: fr_event_loop (event.c:411) I tested this on freeradius 2.1.9

2 1

[PATCH] Updating dictionary.erx based on Juniper documentation
by Bjørn Mork 09 Sep '10

09 Sep '10

Also adding a note about JUNOS (M/MX) usage of this dictionary. Signed-off-by: Bjørn Mork <bjorn(a)mork.no> --- share/dictionary.erx | 23 +++++++++++++++++++++++ 1 files changed, 23 insertions(+), 0 deletions(-) diff --git a/share/dictionary.erx b/share/dictionary.erx index a7c84de..93584d2 100644 --- a/share/dictionary.erx +++ b/share/dictionary.erx @@ -7,6 +7,15 @@ # # Version: $Id$ # + +# This dictionary applies to access services on Juniper JUNOS (M/MX) +# based platforms as well as JUNOSe, although some of the attributes +# have been given new names on JUNOS: +# http://www.juniper.net/techpubs/en_US/junos10.3/topics/reference/general/aa… +# +# In this file, we keep the ERX prefix and the JUNOSe attribute names +# for backwards compatibility +# # Juniper ERX dictionaries are available at: # http://www.juniper.net/techpubs/software/erx/junose71/unisphere7-1.dct # http://www.juniper.net/techpubs/software/erx/junose700/unisphere7-0.dct @@ -156,6 +165,10 @@ ATTRIBUTE ERX-IGMP-No-Tracking-V2-Grps 103 integer ATTRIBUTE ERX-MLD-Explicit-Tracking 104 integer ATTRIBUTE ERX-MLD-No-Tracking-V1-Grps 105 integer +ATTRIBUTE ERX-IPv6-Ingress-Policy-Name 106 string +ATTRIBUTE ERX-IPv6-Egress-Policy-Name 107 string +ATTRIBUTE ERX-CoS-Shaping-Pmt-Type 108 string + ATTRIBUTE ERX-Acc-Loop-Cir-Id 110 string ATTRIBUTE ERX-Acc-Aggr-Cir-Id-Bin 111 octets ATTRIBUTE ERX-Acc-Aggr-Cir-Id-Asc 112 string @@ -187,6 +200,16 @@ ATTRIBUTE ERX-Max-Clients-Per-Interface 143 integer ATTRIBUTE ERX-PPP-Monitor-Ingress-Only 144 integer +ATTRIBUTE ERX-CoS-Scheduler-Pmt-Type 146 string + +ATTRIBUTE ERX-IPv6-Acct-Input-Octets 151 integer +ATTRIBUTE ERX-IPv6-Acct-Output-Octets 152 integer +ATTRIBUTE ERX-IPv6-Acct-Input-Packets 153 integer +ATTRIBUTE ERX-IPv6-Acct-Output-Packets 154 integer +ATTRIBUTE ERX-IPv6-Acct-Input-Gigawords 155 integer +ATTRIBUTE ERX-IPv6-Acct-Output-Gigawords 156 integer +ATTRIBUTE ERX-IPv6-NdRa-Pool-Name 157 string + # # Values Attribute Name Number -- 1.7.1

2 2

Additional EAP-TLS Logging Option
by Ross, Michael 08 Sep '10

08 Sep '10

Hello, I customized a freeradius installation to include an option to log information from the client certificates (subject, issuer, serial, expiration) when doing eap-tls authentication. This is done through a new option, log_certificates, in the tls section of the eap.conf file. Is there any interest in adding this capability into the baseline freeradius? I'm happy to make any changes that would be required to do that. Below are the updated rlm_eap_tls.h and rlm_eap_tls.c. Thanks, Mike Ross /* * rlm_eap_tls.h * * Version: $Id: rlm_eap_tls.h,v 1.13 2007/04/25 14:19:26 aland Exp $ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA * * Copyright 2001 hereUare Communications, Inc. <raghud(a)hereuare.com> * Copyright 2003 Alan DeKok <aland(a)freeradius.org> * Copyright 2006 The FreeRADIUS server project * *----------------------------------------------------------------------------- * Modified by The Boeing Company, August 26, 2008 * * Added int log_certificates to the eap_tls_conf struct * * Copyright 2008 The Boeing Company <Michael.Ross2(a)boeing.com> *----------------------------------------------------------------------------- */ #ifndef _RLM_EAP_TLS_H #define _RLM_EAP_TLS_H #include <freeradius-devel/ident.h> RCSIDH(rlm_eap_tls_h, "$Id: rlm_eap_tls.h,v 1.13 2007/04/25 14:19:26 aland Exp $") #include "eap_tls.h" #include <freeradius-devel/radiusd.h> #include <freeradius-devel/modules.h> /* configured values goes right here */ typedef struct eap_tls_conf { char *private_key_password; char *private_key_file; char *certificate_file; char *random_file; char *ca_path; char *ca_file; char *dh_file; char *rsa_file; char *make_cert_command; int rsa_key; int dh_key; int rsa_key_length; int dh_key_length; int verify_depth; int file_type; int include_length; /* * Always < 4096 (due to radius limit), 0 by default = 2048 */ int fragment_size; int check_crl; char *check_cert_cn; char *cipher_list; char *check_cert_issuer; int log_certificates; /* log_certificates added by Boeing, 9/26/2008 */ } EAP_TLS_CONF; /* This structure gets stored in arg */ typedef struct _eap_tls_t { EAP_TLS_CONF *conf; SSL_CTX *ctx; } eap_tls_t; #endif /* _RLM_EAP_TLS_H */ /* * rlm_eap_tls.c contains the interfaces that are called from eap * * Version: $Id: rlm_eap_tls.c,v 1.54 2008/03/22 08:31:03 aland Exp $ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA * * Copyright 2001 hereUare Communications, Inc. <raghud(a)hereuare.com> * Copyright 2003 Alan DeKok <aland(a)freeradius.org> * Copyright 2006 The FreeRADIUS server project * *----------------------------------------------------------------------------- * Modified by The Boeing Company, August 26, 2008 * * Added log_certificates to module_config CONF_PARSER * Added additional authentication logging into cbtls_verify * Added log_full_cert function to write certificate into log file * * Copyright 2008 The Boeing Company <Michael.Ross2(a)boeing.com> *----------------------------------------------------------------------------- */ #include <freeradius-devel/ident.h> RCSID("$Id: rlm_eap_tls.c,v 1.54 2008/03/22 08:31:03 aland Exp $") #include <freeradius-devel/autoconf.h> #ifdef HAVE_OPENSSL_RAND_H #include <openssl/rand.h> #endif #include "rlm_eap_tls.h" #ifdef HAVE_SYS_STAT_H #include <sys/stat.h> #endif static CONF_PARSER module_config[] = { { "rsa_key_exchange", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, rsa_key), NULL, "no" }, { "dh_key_exchange", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, dh_key), NULL, "yes" }, { "rsa_key_length", PW_TYPE_INTEGER, offsetof(EAP_TLS_CONF, rsa_key_length), NULL, "512" }, { "dh_key_length", PW_TYPE_INTEGER, offsetof(EAP_TLS_CONF, dh_key_length), NULL, "512" }, { "verify_depth", PW_TYPE_INTEGER, offsetof(EAP_TLS_CONF, verify_depth), NULL, "0" }, { "CA_path", PW_TYPE_FILENAME, offsetof(EAP_TLS_CONF, ca_path), NULL, NULL }, { "pem_file_type", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, file_type), NULL, "yes" }, { "private_key_file", PW_TYPE_FILENAME, offsetof(EAP_TLS_CONF, private_key_file), NULL, NULL }, { "certificate_file", PW_TYPE_FILENAME, offsetof(EAP_TLS_CONF, certificate_file), NULL, NULL }, { "CA_file", PW_TYPE_FILENAME, offsetof(EAP_TLS_CONF, ca_file), NULL, NULL }, { "private_key_password", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, private_key_password), NULL, NULL }, { "dh_file", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, dh_file), NULL, NULL }, { "random_file", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, random_file), NULL, NULL }, { "fragment_size", PW_TYPE_INTEGER, offsetof(EAP_TLS_CONF, fragment_size), NULL, "1024" }, { "include_length", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, include_length), NULL, "yes" }, { "check_crl", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, check_crl), NULL, "no"}, { "check_cert_cn", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, check_cert_cn), NULL, NULL}, { "cipher_list", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, cipher_list), NULL, NULL}, { "check_cert_issuer", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, check_cert_issuer), NULL, NULL}, { "make_cert_command", PW_TYPE_STRING_PTR, offsetof(EAP_TLS_CONF, make_cert_command), NULL, NULL}, /* log_certificates added by Boeing, 9/26/2008 */ { "log_certificates", PW_TYPE_BOOLEAN, offsetof(EAP_TLS_CONF, log_certificates), NULL, "no" }, { NULL, -1, 0, NULL, NULL } /* end the list */ }; /* * log_full_cert added by Boeing, 9/26/2008 * * Write the certificate serial number, expiration * date, issuer, and subject to the log file */ static int log_full_cert(int ok, X509 *cert) { const int ub_serial = 20; const int ub_time = 15; char serialNumber[2*ub_serial+1]; char expiration[ub_time+1]; char issuer[ub_name+1]; char subject[ub_name+1]; char *pTemp = NULL; int local_ok = ok; int i = 0; ASN1_INTEGER *pSn = NULL; ASN1_TIME *pTime = NULL; /* * Get the Serial Number and format for display */ serialNumber[0] = '\0'; pSn = X509_get_serialNumber(cert); pTemp = serialNumber; if ( pSn == NULL || pSn->length > ub_serial ) { radlog(L_AUTH, "rlm_eap_tls: Malformed Certificate Serial Number"); local_ok = 0; } else { for (i = 0; i < pSn->length; i++) { sprintf(pTemp, "%02x", (int)pSn->data[i]); pTemp += 2; } } /* * Get the Expiration Date and format for display */ expiration[0] = '\0'; pTime = X509_get_notAfter(cert); if ( pTime == NULL || pTime->length > ub_time ) { radlog(L_AUTH, "rlm_eap_tls: Malformed Certificate Expiration"); local_ok = 0; } else { strncpy(expiration, pTime->data, pTime->length); expiration[pTime->length] = '\0'; } /* * Get the Issuer */ issuer[0] = '\0'; X509_NAME_oneline(X509_get_issuer_name(cert), issuer, ub_name); issuer[0] = ' '; issuer[ub_name] = '\0'; for (i = 0; i < ub_name; i++) { if (issuer[i] == '/') { issuer[i] = ','; } } /* * Get the Subject */ subject[0] = '\0'; X509_NAME_oneline(X509_get_subject_name(cert), subject, ub_name); subject[0] = ' '; subject[ub_name] = '\0'; for (i = 0; i < ub_name; i++) { if (subject[i] == '/') { subject[i] = ','; } } /* * Log required attributes */ radlog(L_AUTH, "Certificate: Serial=%s; Expiration=%s; Issuer:%s; Subject:%s", serialNumber, expiration, issuer, subject); return local_ok; } /* * TODO: Check for the type of key exchange * like conf->dh_key */ static int load_dh_params(SSL_CTX *ctx, char *file) { DH *dh = NULL; BIO *bio; if ((bio = BIO_new_file(file, "r")) == NULL) { radlog(L_ERR, "rlm_eap_tls: Unable to open DH file - %s", file); return -1; } dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); BIO_free(bio); if (!dh) { DEBUG2("WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work!"); DEBUG2("WARNING: Fix this by running the OpenSSL command listed in eap.conf"); return 0; } if (SSL_CTX_set_tmp_dh(ctx, dh) < 0) { radlog(L_ERR, "rlm_eap_tls: Unable to set DH parameters"); DH_free(dh); return -1; } DH_free(dh); return 0; } /* * Before trusting a certificate, you must make sure that the * certificate is 'valid'. There are several steps that your * application can take in determining if a certificate is * valid. Commonly used steps are: * * 1.Verifying the certificate's signature, and verifying that * the certificate has been issued by a trusted Certificate * Authority. * * 2.Verifying that the certificate is valid for the present date * (i.e. it is being presented within its validity dates). * * 3.Verifying that the certificate has not been revoked by its * issuing Certificate Authority, by checking with respect to a * Certificate Revocation List (CRL). * * 4.Verifying that the credentials presented by the certificate * fulfill additional requirements specific to the application, * such as with respect to access control lists or with respect * to OCSP (Online Certificate Status Processing). * * NOTE: This callback will be called multiple times based on the * depth of the root certificate chain */ static int cbtls_verify(int ok, X509_STORE_CTX *ctx) { char subject[1024]; /* Used for the subject name */ char issuer[1024]; /* Used for the issuer name */ char common_name[1024]; char cn_str[1024]; EAP_HANDLER *handler = NULL; X509 *client_cert; SSL *ssl; int err, depth; EAP_TLS_CONF *conf; int my_ok = ok; client_cert = X509_STORE_CTX_get_current_cert(ctx); err = X509_STORE_CTX_get_error(ctx); depth = X509_STORE_CTX_get_error_depth(ctx); /* * Moved below the conf check by Boeing, 9/26/2008 */ /* *if (!my_ok) { * radlog(L_ERR,"--> verify error:num=%d:%s\n",err, * X509_verify_cert_error_string(err)); * return my_ok; *} */ /* * Retrieve the pointer to the SSL of the connection currently treated * and the application specific data stored into the SSL object. */ ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); handler = (EAP_HANDLER *)SSL_get_ex_data(ssl, 0); conf = (EAP_TLS_CONF *)SSL_get_ex_data(ssl, 1); /* * Copied from above by Boeing, 9/26/2008 */ if (!my_ok) { radlog(L_ERR,"--> verify error:num=%d:%s\n",err, X509_verify_cert_error_string(err)); /* * Added by Boeing, 9/26/2008 * If the config file is set to log certificates * log the certificate if there has been an authentication * error */ if (conf->log_certificates) { log_full_cert(my_ok, client_cert); } return my_ok; } /* * Get the Subject & Issuer */ subject[0] = issuer[0] = '\0'; X509_NAME_oneline(X509_get_subject_name(client_cert), subject, sizeof(subject)); X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), issuer, sizeof(issuer)); subject[sizeof(subject) - 1] = '\0'; issuer[sizeof(issuer) - 1] = '\0'; /* * Get the Common Name */ X509_NAME_get_text_by_NID(X509_get_subject_name(client_cert), NID_commonName, common_name, sizeof(common_name)); common_name[sizeof(common_name) - 1] = '\0'; switch (ctx->error) { case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: radlog(L_ERR, "issuer= %s\n", issuer); break; case X509_V_ERR_CERT_NOT_YET_VALID: case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: radlog(L_ERR, "notBefore="); #if 0 ASN1_TIME_print(bio_err, X509_get_notBefore(ctx->current_cert)); #endif break; case X509_V_ERR_CERT_HAS_EXPIRED: case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: radlog(L_ERR, "notAfter="); #if 0 ASN1_TIME_print(bio_err, X509_get_notAfter(ctx->current_cert)); #endif break; } /* * If we're at the actual client cert, apply additional * checks. */ if (depth == 0) { /* * If the conf tells us to, check cert issuer * against the specified value and fail * verification if they don't match. */ if (conf->check_cert_issuer && (strcmp(issuer, conf->check_cert_issuer) != 0)) { radlog(L_AUTH, "rlm_eap_tls: Certificate issuer (%s) does not match specified value (%s)!", issuer, conf->check_cert_issuer); my_ok = 0; } /* * If the conf tells us to, check the CN in the * cert against xlat'ed value, but only if the * previous checks passed. */ if (my_ok && conf->check_cert_cn) { if (!radius_xlat(cn_str, sizeof(cn_str), conf->check_cert_cn, handler->request, NULL)) { radlog(L_ERR, "rlm_eap_tls (%s): xlat failed.", conf->check_cert_cn); /* if this fails, fail the verification */ my_ok = 0; } else { DEBUG2(" rlm_eap_tls: checking certificate CN (%s) with xlat'ed value (%s)", common_name, cn_str); if (strcmp(cn_str, common_name) != 0) { radlog(L_AUTH, "rlm_eap_tls: Certificate CN (%s) does not match specified value (%s)!", common_name, cn_str); my_ok = 0; } } } /* check_cert_cn */ /* * Added by Boeing, 9/26/2008 * If the config file is set to log certificates * log the certificate */ if (conf->log_certificates) { my_ok = log_full_cert(my_ok, client_cert); } } /* depth == 0 */ if (debug_flag > 0) { DEBUG2("chain-depth=%d, ", depth); DEBUG2("error=%d", err); DEBUG2("--> User-Name = %s", handler->identity); DEBUG2("--> BUF-Name = %s", common_name); DEBUG2("--> subject = %s", subject); DEBUG2("--> issuer = %s", issuer); DEBUG2("--> verify return:%d", my_ok); } return my_ok; } /* * Create Global context SSL and use it in every new session * * - Load the trusted CAs * - Load the Private key & the certificate * - Set the Context options & Verify options */ static SSL_CTX *init_tls_ctx(EAP_TLS_CONF *conf) { SSL_METHOD *meth; SSL_CTX *ctx; X509_STORE *certstore; int verify_mode = SSL_VERIFY_NONE; int ctx_options = 0; int type; /* * Add all the default ciphers and message digests * Create our context. */ SSL_library_init(); SSL_load_error_strings(); meth = TLSv1_method(); ctx = SSL_CTX_new(meth); /* * Identify the type of certificates that needs to be loaded */ if (conf->file_type) { type = SSL_FILETYPE_PEM; } else { type = SSL_FILETYPE_ASN1; } /* * Set the password to load private key */ if (conf->private_key_password) { SSL_CTX_set_default_passwd_cb_userdata(ctx, conf->private_key_password); SSL_CTX_set_default_passwd_cb(ctx, cbtls_password); } /* * Load our keys and certificates * * If certificates are of type PEM then we can make use * of cert chain authentication using openssl api call * SSL_CTX_use_certificate_chain_file. Please see how * the cert chain needs to be given in PEM from * openSSL.org */ if (type == SSL_FILETYPE_PEM) { if (!(SSL_CTX_use_certificate_chain_file(ctx, conf->certificate_file))) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading certificate file %s", conf->certificate_file); return NULL; } } else if (!(SSL_CTX_use_certificate_file(ctx, conf->certificate_file, type))) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading certificate file %s", conf->certificate_file); return NULL; } /* Load the CAs we trust */ if (!SSL_CTX_load_verify_locations(ctx, conf->ca_file, conf->ca_path)) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading Trusted root CA list %s",conf->ca_file ); return NULL; } if (conf->ca_file && *conf->ca_file) SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(conf->ca_file)); if (!(SSL_CTX_use_PrivateKey_file(ctx, conf->private_key_file, type))) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading private key file %s", conf->private_key_file); return NULL; } /* * Check if the loaded private key is the right one */ if (!SSL_CTX_check_private_key(ctx)) { radlog(L_ERR, "rlm_eap_tls: Private key does not match the certificate public key"); return NULL; } /* * Set ctx_options */ ctx_options |= SSL_OP_NO_SSLv2; ctx_options |= SSL_OP_NO_SSLv3; /* * SSL_OP_SINGLE_DH_USE must be used in order to prevent * small subgroup attacks and forward secrecy. Always * using * * SSL_OP_SINGLE_DH_USE has an impact on the computer * time needed during negotiation, but it is not very * large. */ ctx_options |= SSL_OP_SINGLE_DH_USE; /* * SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS to work around issues * in Windows Vista client. * http://www.openssl.org/~bodo/tls-cbc.txt * http://www.nabble.com/(RADIATOR)-Radiator-Version-3.16-released-t2600070.ht… */ ctx_options |= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; SSL_CTX_set_options(ctx, ctx_options); /* * TODO: Set the RSA & DH * SSL_CTX_set_tmp_rsa_callback(ctx, cbtls_rsa); * SSL_CTX_set_tmp_dh_callback(ctx, cbtls_dh); */ /* * set the message callback to identify the type of * message. For every new session, there can be a * different callback argument. * * SSL_CTX_set_msg_callback(ctx, cbtls_msg); */ /* Set Info callback */ SSL_CTX_set_info_callback(ctx, cbtls_info); /* * Check the certificates for revocation. */ #ifdef X509_V_FLAG_CRL_CHECK if (conf->check_crl) { certstore = SSL_CTX_get_cert_store(ctx); if (certstore == NULL) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error reading Certificate Store"); return NULL; } X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); } #endif /* * Set verify modes * Always verify the peer certificate */ verify_mode |= SSL_VERIFY_PEER; verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; verify_mode |= SSL_VERIFY_CLIENT_ONCE; SSL_CTX_set_verify(ctx, verify_mode, cbtls_verify); if (conf->verify_depth) { SSL_CTX_set_verify_depth(ctx, conf->verify_depth); } /* Load randomness */ if (!(RAND_load_file(conf->random_file, 1024*1024))) { radlog(L_ERR, "rlm_eap: SSL error %s", ERR_error_string(ERR_get_error(), NULL)); radlog(L_ERR, "rlm_eap_tls: Error loading randomness"); return NULL; } /* * Set the cipher list if we were told to */ if (conf->cipher_list) { if (!SSL_CTX_set_cipher_list(ctx, conf->cipher_list)) { radlog(L_ERR, "rlm_eap_tls: Error setting cipher list"); return NULL; } } return ctx; } /* * Detach the EAP-TLS module. */ static int eaptls_detach(void *arg) { EAP_TLS_CONF *conf; eap_tls_t *inst; inst = (eap_tls_t *) arg; conf = inst->conf; if (conf) { memset(conf, 0, sizeof(*conf)); free(inst->conf); inst->conf = NULL; } if (inst->ctx) SSL_CTX_free(inst->ctx); inst->ctx = NULL; free(inst); return 0; } /* * Attach the EAP-TLS module. */ static int eaptls_attach(CONF_SECTION *cs, void **instance) { EAP_TLS_CONF *conf; eap_tls_t *inst; /* Store all these values in the data structure for later references */ inst = (eap_tls_t *)malloc(sizeof(*inst)); if (!inst) { radlog(L_ERR, "rlm_eap_tls: out of memory"); return -1; } memset(inst, 0, sizeof(*inst)); /* * Parse the config file & get all the configured values */ conf = (EAP_TLS_CONF *)malloc(sizeof(*conf)); if (conf == NULL) { free(inst); radlog(L_ERR, "rlm_eap_tls: out of memory"); return -1; } memset(conf, 0, sizeof(*conf)); inst->conf = conf; if (cf_section_parse(cs, conf, module_config) < 0) { eaptls_detach(inst); return -1; } /* * The EAP RFC's say 1020, but we're less picky. */ if (conf->fragment_size < 100) { radlog(L_ERR, "rlm_eap_tls: Fragment size is too small."); eaptls_detach(inst); return -1; } /* * The maximum size for a RADIUS packet is 4096, * minus the header (20), Message-Authenticator (18), * and State (18), etc. results in about 4000 bytes of data * that can be devoted *solely* to EAP. */ if (conf->fragment_size > 4000) { radlog(L_ERR, "rlm_eap_tls: Fragment size is too large."); eaptls_detach(inst); return -1; } /* * Account for the EAP header (4), and the EAP-TLS header * (6), as per Section 4.2 of RFC 2716. What's left is * the maximum amount of data we read from a TLS buffer. */ conf->fragment_size -= 10; /* * This magic makes the administrators life HUGELY easier * on initial deployments. * * If the server starts up in debugging mode, AND the * bootstrap command is configured, AND it exists, AND * there is no server certificate */ if (conf->make_cert_command && (debug_flag >= 2)) { struct stat buf; if ((stat(conf->make_cert_command, &buf) == 0) && (stat(conf->certificate_file, &buf) < 0) && (errno == ENOENT) && (radius_exec_program(conf->make_cert_command, NULL, 1, NULL, 0, NULL, NULL, 0) != 0)) { eaptls_detach(inst); return -1; } } /* * Initialize TLS */ inst->ctx = init_tls_ctx(conf); if (inst->ctx == NULL) { eaptls_detach(inst); return -1; } if (load_dh_params(inst->ctx, conf->dh_file) < 0) { eaptls_detach(inst); return -1; } *instance = inst; return 0; } /* * Send an initial eap-tls request to the peer. * * Frame eap reply packet. * len = header + type + tls_typedata * tls_typedata = flags(Start (S) bit set, and no data) * * Once having received the peer's Identity, the EAP server MUST * respond with an EAP-TLS/Start packet, which is an * EAP-Request packet with EAP-Type=EAP-TLS, the Start (S) bit * set, and no data. The EAP-TLS conversation will then begin, * with the peer sending an EAP-Response packet with * EAP-Type = EAP-TLS. The data field of that packet will * be the TLS data. * * Fragment length is Framed-MTU - 4. * * http://mail.frascone.com/pipermail/public/eap/2003-July/001426.html */ static int eaptls_initiate(void *type_arg, EAP_HANDLER *handler) { int status; tls_session_t *ssn; eap_tls_t *inst; VALUE_PAIR *vp; int client_cert = TRUE; int verify_mode = 0; inst = (eap_tls_t *)type_arg; /* * If we're TTLS or PEAP, then do NOT require a client * certificate. * * FIXME: This should be more configurable. */ if (handler->eap_type != PW_EAP_TLS) { vp = pairfind(handler->request->config_items, PW_EAP_TLS_REQUIRE_CLIENT_CERT); if (!vp) { client_cert = FALSE; } else { client_cert = vp->vp_integer; } } /* * Every new session is started only from EAP-TLS-START. * Before Sending EAP-TLS-START, open a new SSL session. * Create all the required data structures & store them * in Opaque. So that we can use these data structures * when we get the response */ ssn = eaptls_new_session(inst->ctx, client_cert); if (!ssn) { return 0; } /* * Verify the peer certificate, if asked. */ if (client_cert) { DEBUG2(" rlm_eap_tls: Requiring client certificate"); verify_mode = SSL_VERIFY_PEER; verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT; verify_mode |= SSL_VERIFY_CLIENT_ONCE; } SSL_set_verify(ssn->ssl, verify_mode, cbtls_verify); /* * Create a structure for all the items required to be * verified for each client and set that as opaque data * structure. * * NOTE: If we want to set each item sepearately then * this index should be global. */ SSL_set_ex_data(ssn->ssl, 0, (void *)handler); SSL_set_ex_data(ssn->ssl, 1, (void *)inst->conf); ssn->length_flag = inst->conf->include_length; /* * We use default fragment size, unless the Framed-MTU * tells us it's too big. Note that we do NOT account * for the EAP-TLS headers if conf->fragment_size is * large, because that config item looks to be confusing. * * i.e. it should REALLY be called MTU, and the code here * should figure out what that means for TLS fragment size. * asking the administrator to know the internal details * of EAP-TLS in order to calculate fragment sizes is * just too much. */ ssn->offset = inst->conf->fragment_size; vp = pairfind(handler->request->packet->vps, PW_FRAMED_MTU); if (vp && ((vp->vp_integer - 14) < ssn->offset)) { /* * Discount the Framed-MTU by: * 4 : EAPOL header * 4 : EAP header (code + id + length) * 1 : EAP type == EAP-TLS * 1 : EAP-TLS Flags * 4 : EAP-TLS Message length * (even if conf->include_length == 0, * just to be lazy). * --- * 14 */ ssn->offset = vp->vp_integer - 14; } handler->opaque = ((void *)ssn); handler->free_opaque = session_free; DEBUG2(" rlm_eap_tls: Initiate"); /* * PEAP-specific breakage. */ if (handler->eap_type == PW_EAP_PEAP) { /* * As it is a poorly designed protocol, PEAP uses * bits in the TLS header to indicate PEAP * version numbers. For now, we only support * PEAP version 0, so it doesn't matter too much. * However, if we support later versions of PEAP, * we will need this flag to indicate which * version we're currently dealing with. */ ssn->peap_flag = 0x00; /* * PEAP version 0 requires 'include_length = no', * so rather than hoping the user figures it out, * we force it here. */ ssn->length_flag = 0; } /* * TLS session initialization is over. Now handle TLS * related handshaking or application data. */ status = eaptls_start(handler->eap_ds, ssn->peap_flag); DEBUG2(" rlm_eap_tls: Start returned %d", status); if (status == 0) return 0; /* * The next stage to process the packet. */ handler->stage = AUTHENTICATE; return 1; } /* * Do authentication, by letting EAP-TLS do most of the work. */ static int eaptls_authenticate(void *arg UNUSED, EAP_HANDLER *handler) { eaptls_status_t status; tls_session_t *tls_session = (tls_session_t *) handler->opaque; DEBUG2(" rlm_eap_tls: Authenticate"); status = eaptls_process(handler); DEBUG2(" eaptls_process returned %d\n", status); switch (status) { /* * EAP-TLS handshake was successful, return an * EAP-TLS-Success packet here. */ case EAPTLS_SUCCESS: break; /* * The TLS code is still working on the TLS * exchange, and it's a valid TLS request. * do nothing. */ case EAPTLS_HANDLED: return 1; /* * Handshake is done, proceed with decoding tunneled * data. */ case EAPTLS_OK: DEBUG2(" rlm_eap_tls: Received unexpected tunneled data after successful handshake."); #ifndef NDEBUG if ((debug_flag > 2) && fr_log_fp) { unsigned int i; unsigned int data_len; unsigned char buffer[1024]; data_len = (tls_session->record_minus)(&tls_session->dirty_in, buffer, sizeof(buffer)); log_debug(" Tunneled data (%u bytes)\n", data_len); for (i = 0; i < data_len; i++) { if ((i & 0x0f) == 0x00) fprintf(fr_log_fp, " %x: ", i); if ((i & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n"); fprintf(fr_log_fp, "%02x ", buffer[i]); } fprintf(fr_log_fp, "\n"); } #endif eaptls_fail(handler->eap_ds, 0); return 0; break; /* * Anything else: fail. */ default: return 0; } /* * Success: Return MPPE keys. */ eaptls_success(handler->eap_ds, 0); eaptls_gen_mppe_keys(&handler->request->reply->vps, tls_session->ssl, "client EAP encryption"); return 1; } /* * The module name should be the only globally exported symbol. * That is, everything else should be 'static'. */ EAP_TYPE rlm_eap_tls = { "eap_tls", eaptls_attach, /* attach */ eaptls_initiate, /* Start the initial request */ NULL, /* authorization */ eaptls_authenticate, /* authentication */ eaptls_detach /* detach */ };

3 16

radius -X segmentation fault
by Gyanendra Kumar 07 Sep '10

07 Sep '10

Hi All: I get segmentation fault on starting radius demon. This is with the latest 2.1.9 version of the radius. Look forward to resolution. Here is the details: root@gkumar-desktop:/home/gkumar/radiusproxy/freeradius-server-2.1.9/src/main# ./radiusd -X Tue Sep 7 09:00:49 2010 : Info: FreeRADIUS Version 2.1.9, for host i686-pc-linux-gnu, built on Sep 3 2010 at 17:05:53 Tue Sep 7 09:00:49 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Tue Sep 7 09:00:49 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Sep 7 09:00:49 2010 : Info: PARTICULAR PURPOSE. Tue Sep 7 09:00:49 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Sep 7 09:00:49 2010 : Info: GNU General Public License v2. Tue Sep 7 09:00:49 2010 : Info: Starting - reading configuration files ... Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Tue Sep 7 09:00:49 2010 : Debug: including files in directory /usr/local/etc/raddb/modules/ Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/files Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/always Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Tue Sep 7 09:00:49 2010 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Tue Sep 7 09:00:49 2010 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Tue Sep 7 09:00:49 2010 : Debug: main { Tue Sep 7 09:00:49 2010 : Debug: allow_core_dumps = no Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Tue Sep 7 09:00:49 2010 : Debug: main { Tue Sep 7 09:00:49 2010 : Debug: prefix = "/usr/local" Tue Sep 7 09:00:49 2010 : Debug: localstatedir = "/usr/local/var" Tue Sep 7 09:00:49 2010 : Debug: logdir = "/usr/local/var/log/radius" Tue Sep 7 09:00:49 2010 : Debug: libdir = "/usr/local/lib" Tue Sep 7 09:00:49 2010 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Tue Sep 7 09:00:49 2010 : Debug: hostname_lookups = no Tue Sep 7 09:00:49 2010 : Debug: max_request_time = 30 Tue Sep 7 09:00:49 2010 : Debug: cleanup_delay = 5 Tue Sep 7 09:00:49 2010 : Debug: max_requests = 1024 Tue Sep 7 09:00:49 2010 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Tue Sep 7 09:00:49 2010 : Debug: checkrad = "/usr/local/sbin/checkrad" Tue Sep 7 09:00:49 2010 : Debug: debug_level = 0 Tue Sep 7 09:00:49 2010 : Debug: proxy_requests = yes Tue Sep 7 09:00:49 2010 : Debug: log { Tue Sep 7 09:00:49 2010 : Debug: stripped_names = no Tue Sep 7 09:00:49 2010 : Debug: auth = no Tue Sep 7 09:00:49 2010 : Debug: auth_badpass = no Tue Sep 7 09:00:49 2010 : Debug: auth_goodpass = no Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: security { Tue Sep 7 09:00:49 2010 : Debug: max_attributes = 200 Tue Sep 7 09:00:49 2010 : Debug: reject_delay = 1 Tue Sep 7 09:00:49 2010 : Debug: status_server = yes Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Tue Sep 7 09:00:49 2010 : Debug: proxy server { Tue Sep 7 09:00:49 2010 : Debug: retry_delay = 5 Tue Sep 7 09:00:49 2010 : Debug: retry_count = 3 Tue Sep 7 09:00:49 2010 : Debug: default_fallback = no Tue Sep 7 09:00:49 2010 : Debug: dead_time = 120 Tue Sep 7 09:00:49 2010 : Debug: wake_all_if_all_dead = no Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: home_server localhost { Tue Sep 7 09:00:49 2010 : Debug: ipaddr = 127.0.0.1 Tue Sep 7 09:00:49 2010 : Debug: port = 1812 Tue Sep 7 09:00:49 2010 : Debug: type = "auth" Tue Sep 7 09:00:49 2010 : Debug: secret = "testing123" Tue Sep 7 09:00:49 2010 : Debug: response_window = 20 Tue Sep 7 09:00:49 2010 : Debug: max_outstanding = 65536 Tue Sep 7 09:00:49 2010 : Debug: require_message_authenticator = no Tue Sep 7 09:00:49 2010 : Debug: zombie_period = 40 Tue Sep 7 09:00:49 2010 : Debug: status_check = "status-server" Tue Sep 7 09:00:49 2010 : Debug: ping_interval = 30 Tue Sep 7 09:00:49 2010 : Debug: check_interval = 30 Tue Sep 7 09:00:49 2010 : Debug: num_answers_to_alive = 3 Tue Sep 7 09:00:49 2010 : Debug: num_pings_to_alive = 3 Tue Sep 7 09:00:49 2010 : Debug: revive_interval = 120 Tue Sep 7 09:00:49 2010 : Debug: status_check_timeout = 4 Tue Sep 7 09:00:49 2010 : Debug: irt = 2 Tue Sep 7 09:00:49 2010 : Debug: mrt = 16 Tue Sep 7 09:00:49 2010 : Debug: mrc = 5 Tue Sep 7 09:00:49 2010 : Debug: mrd = 30 Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: home_server_pool my_auth_failover { Tue Sep 7 09:00:49 2010 : Debug: type = fail-over Tue Sep 7 09:00:49 2010 : Debug: home_server = localhost Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: realm example.com { Tue Sep 7 09:00:49 2010 : Debug: auth_pool = my_auth_failover Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: realm LOCAL { Tue Sep 7 09:00:49 2010 : Debug: } Tue Sep 7 09:00:49 2010 : Debug: radiusd: #### Loading Clients #### Tue Sep 7 09:00:49 2010 : Debug: client localhost { Tue Sep 7 09:00:49 2010 : Debug: ipaddr = 127.0.0.1 Tue Sep 7 09:00:49 2010 : Debug: require_message_authenticator = no Tue Sep 7 09:00:49 2010 : Debug: secret = "testing123" Tue Sep 7 09:00:49 2010 : Debug: nastype = "other" Tue Sep 7 09:00:49 2010 : Debug: } Segmentation fault Best Regards -Sunnybrad

2 1

Sponsored development rlm_ldap and ocsp
by Stephan Jäger 02 Sep '10

02 Sep '10

Hello developers, for a projekt we need to keep the radius clients in LDAP. As this is not yet possible with rlm_ldap we would like to sponsor this development. Our requirements so far are: - created code should go in the official freeradius code base. - official invoice for our purchasing department. - LDAP schema oder schema enhancement for the clients with required attributes, ideally with oids from the freeradius projekt. Should be pretty easy as most of the needed code is already in rlm_sql and rlm_ldap. Please let me know what you think about this, and if someone is willing to do this please mail me your offer stating your timeframe and price. Additionally we might be interested to sponsor OCSP support for EAP-TLS, so i'd be happy to receive offers on this one too, though this one is not yet decided on internally. Kind regards, Stephan Jaeger EWE TEL GmbH

5 20