October 2005 - Freeradius-Users - lists.freeradius.org

Crashes with 1.0.4/1.0.5, perhaps connected with slow LDAP backend?
by Martin Pauly 05 Oct '05

05 Oct '05

Hi, we seem to have a stability issue with freeradius 1.0.4/1.0.5: 1.0.4 crashed in short sequence on both of my redundant servers during my vacation -- not much of a trace in the logfiles. On Monday, I upgraded to 1.0.5 with everything looking fine for almost 2 days. Yesterday, we started polling the servers regularly from a NAGIOS system, using the check_rad NAGIOS plugin. On server (the one processing the highest number of requests) crashed twice yesterday; this time it complained about "Unresponsive child" processes in close temporal correlation. We do have perfomance problems with our LDAP backend, so this sound reasonable, but could this cause the server to crash? During testing, I also encountered a situation where the freeradius process lived on, but became comletely unresponsive; I had to to kill -9 What should I do to track down these issues? Does running in full debug mode for days make sense? Thanks, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 6

PID variable
by Abdul Lateef 05 Oct '05

05 Oct '05

Hi all, How i can retrive the current pid value of freeradius in Shell script. I wanted to create one shell script to run in linux corn commond. because our database is very slow and always radius is going to crashed when it receives more than 1000 request. so my script will check if the radius is crashed it will start automatically using cron. Is anyone have good logic to auto restart radius when it will be crashed? -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1

RE: Tru64 again
by Adharsh P 05 Oct '05

05 Oct '05

Hello Tim Winders, When you run configure in Tru64, configure sets GETHOSTBYADDRRSTYLE and GETHOSTBYNAMERSTYLE to GNUSTYLE in src/include/autoconf.h Modify the two lines in src/include/autoconf.h -#define GETHOSTBYADDRRSTYLE GNUTYPE -#define GETHOSTBYNAMERSTYLE GNUTYPE to +#undef GETHOSTBYADDRRSTYLE +#undef GETHOSTBYNAMERSTYLE Also undef OSFC2 if you haven't already done this. do a make and make install. Run radiusd. It should be work. ---adharsh RE: Tru64 again Tim Winders Thu, 15 Sep 2005 08:17:25 -0700 responding to my own post. I saw a message about looking at the core dump in another thread. So, I followed those instructions. Here is the output from gdb: This GDB was configured as "alphaev67-dec-osf5.1"... BFD: Unhandled OSF/1 core file section type 4464 BFD: Unhandled OSF/1 core file section type 528 BFD: Unhandled OSF/1 core file section type 0 BFD: Unhandled OSF/1 core file section type 7 BFD: Unhandled OSF/1 core file section type 16384 BFD: Unhandled OSF/1 core file section type 8192 BFD: Unhandled OSF/1 core file section type 0 BFD: Unhandled OSF/1 core file section type 32768 BFD: Unhandled OSF/1 core file section type 49152 BFD: Unhandled OSF/1 core file section type 49152 BFD: Unhandled OSF/1 core file section type 7 BFD: Unhandled OSF/1 core file section type 57344 BFD: Unhandled OSF/1 core file section type 49152 warning: big endian file does not match little endian target. Core was generated by ` '. Program terminated with signal 1, Hangup. warning: Couldn't find general-purpose registers in core file. warning: Couldn't find general-purpose registers in core file. #0 0x00000000 in ?? () when I did bt in gdb I got the same "#0 0x00000000 in ?? ()" response and nothing else. But, in reading the above, it seems a big endian v. little endian problem. Does this help in getting freeradius to work on Tru64? --- Tim Winders Associate Dean of Information Technology South Plains College Levelland, TX 79336 Problem replying to my email? Click the "Sign" button in the OE toolbar or, better yet, get your own FREE Personal E-Mail Digital ID: http://www.thawte.com/email/index.html > -----Original Message----- > From: Tim Winders [mailto:[EMAIL PROTECTED] > Sent: Wednesday, September 14, 2005 11:35 AM > To: 'freeradius-users(a)lists.freeradius.org' > Subject: Tru64 again > > I'm back at trying to get freeradius working under Tru64. > This time using 1.0.5. > > I have an older cvs version working, but I can't remember > what I did to make it work. :-( The working version I have > is marked 1.1.0-pre0 built on Feb 17, 2005. > > First, in src/main/radiusd.c I have commented out the OSFC2 > define. I do this because I'm not running C2, but it is > always found and enabled, which kills the make. Then, I run > configure with these options: > > CFLAGS="-I/usr/local/ssl/include -I/usr/local/include" > LDFLAGS="-L/usr/local/ssl/lib -L/usr/local/lib" LIBS="-lssl > -lcrypto -lsecurity" ./configure \ > --disable-shared \ > --enable-ltdl-install=no \ > --with-openssl-includes=/usr/local/ssl/include \ > --with-openssl-libraries=/usr/local/ssl/lib \ > --without-mysql --disable-mysql > > radiusd seems to compile, but with many warnings. However, > when I run it, it immediately seg faults and dumps core. > Unfortunately, I am not a programmer, so I don't know how to > begin troubleshooting this and try to help get freeradius > working under Tru64. > > I remember being told that none of the development team uses > Tru64. So, it's possible this will never work "right". But, > I'm willing to help out in whatever limited capacity I can, > including CPU/shell account. > > Any useful suggestions are welcome.

1 0

Cannot start Cisctron radius server
by Nagaraja Gundurao 05 Oct '05

05 Oct '05

Hi everyone, I have installed cistron 1.6.7. When I tried to run it,t it gives me an error saying [root@naga init.d]# ./radiusd start Starting RADIUS server: radiusd: dict_init: Couldn't open dictionary: /etc/raddb/dictionary.compat [FAILED] can someone tell me what this error message means. Cheers, Nagaraja Gundurao www.inchara.com -----------------------------------------------------------------------------------------------------------------------

2 1

RE: MSCHAPv2, MySQL, Freeradius
by Dan Russell 04 Oct '05

04 Oct '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok > Sent: Wednesday, 5 October 2005 1:48 AM > To: FreeRadius users mailing list > Subject: Re: MSCHAPv2, MySQL, Freeradius > > "Dan Russell" <dan(a)in-house.com.au> wrote: > > Hey, I'm not having a go at you, I believe it does work, I'm just having > > issue getting it working.. > > Yes, but too many people post messages saying "Stuff went > wrong... how do I fix it?". Without any context, the only possible > answer is "No idea..." > > > Tue Oct 4 15:10:39 2005 : Info: rlm_sql (sql): No matching entry in the > > database for request from user [wolfer] > > Well, that would appear to be useful. > > > Here is a snippet of the radcheck table : > > > > ID UserName Attribute op Value > > 25 wolfer SMB-Account-CTRL == 16 > > 27 wolfer NT-Password == > > 0x47C8F8E50C470E37AAD3B435B51404EE > > See the docs for rlm_sql. '==' is a *comparison* operator. There > is no NT-Password in the packet, so of course it never matches. > > Change both '==' to ':='. > > Alan DeKok. > That's fixed it.. All works well now.. Thanks for your help. Daniel Russell > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

No updates with radiusd log
by john＠jetcityorange.com 04 Oct '05

04 Oct '05

Hello, I've tried multiple sources and websites to no avail. I've set up FreeRadius 1.0.4 successfully. I've generated local certs also. We've tested accessing the FreeRadius server with Windows XP SP2 locally over the local access point. When we attempt to access the FreeRadius server via a remote AP, the radiusd log shows nothing. No attempt, nothing. Yet the XP client shows a 'validating identity' message. However, I see nothing in the logs to debug. Accounts are set to local authentication via EAP-TLS. Any ideas? I'd be happy to send a conf file if anyone would like. Thanks much!! John

2 1

expr in SQL no working
by Gunther 04 Oct '05

04 Oct '05

I am running Fedora FC4 with FR 1.0.4 (yum updated) with MySQL 4.1.12. I am trying to use in rad_reply table for Session-Timeout with the following value: `%{expr: %{sql:SELECT IF(NOW() <= user_stoptime, (TIME_TO_SEC(TIMEDIFF(user_stoptime, IF(NOW() >= user_starttime, now(), DATE_SUB(user_stoptime, INTERVAL 1 SECOND))))), 1) FROM phs_user WHERE user_username='%{User-Name}'}}` This doesn't work as the Session-Timeout value is not assigned. The sql statement alone works fine and returns the correct value. I then tried to get a simple expression up and running in rad_reply: Attr Op Value Session-Timeout = `%{expr:3600 - 300}` No success. In debug mode I can see that the expr module is loaded: Module: Loaded expr Module: Instantiated expr (expr) I then compiled and installed 1.0.5 ... with the same result. Then I created a user in the ./raddb/users file and assigned the Session-Timeout with above SQL statement and it works fine. What is wrong getting the Session-Timeout from the rad_reply table? When I assign a fixed value, e.g. 3500 in the sql row, it works fine. Anything with MySQL collation maybe? I changed it to different languages ... no success. This is the debug output when I use the users file, when using sql, I do not get this. Debug: rlm_sql (sql): - sql_xlat Debug: radius_xlat: 'gunther' Debug: rlm_sql (sql): sql_set_user escaped user --> 'gunther' Debug: radius_xlat: 'SELECT IF(NOW() <= user_stoptime, TIME_TO_SEC(TIMEDIFF(user_stoptime, IF(NOW() >= user_starttime, now(), DATE_SUB(user_stoptime, INTERVAL 1 SECOND)))), 1) FROM phs_user WHERE user_username='gunther4'' Debug: radius_xlat: '/var/log/radius/sqltrace.sql' Debug: rlm_sql (sql): Reserving sql socket id: 2 Debug: rlm_sql_mysql: query: SELECT IF(NOW() <= user_stoptime, TIME_TO_SEC(TIMEDIFF(user_stoptime, IF(NOW() >= user_starttime, now(), DATE_SUB(user_stoptime, INTERVAL 1 SECOND)))), 1) FROM phs_user WHERE user_username='gunther4' Debug: rlm_sql (sql): - sql_xlat finished Debug: rlm_sql (sql): Released sql socket id: 2 Debug: radius_xlat: ' 1' Debug: radius_xlat: '1' When I use the sql table, sql_xlat is not in the debug output. Gunther

3 6

What's Up Gold and Freeradius
by Linda Pagillo 04 Oct '05

04 Oct '05

Hi everyone: I'm using Ipswitch's What's Up Gold to monitor my network. I have it set to notify me when certain things in my network go down etc... I have it set to monitor Freeradius. I put an entry into my clients.conf file to give the What's Up Gold computer access to send a request to Freeradius. Here is what's happening... my What's Up Gold keeps telling me that my Freeradius is down when indeed it's not. I'm guessing that when a request gets sent from What's Up Gold to Freeradius, it is not getting there or something. I checked my radius logs and here is an example of an entry i get when What's Up Gold sends a request to Freeradius... Mon Oct 3 10:22:44 2005 : Auth: Login incorrect: [TEST/L\200\212\3101\215\277&\320\350\345\373\351\201\031\215] (from client old port 0) I don't know if the above will help any, but i thought i should include it in this post. Also, this problem does not always happen. It's kind of sporradic. There are lots of times when What's Up Gold sends a request to Freeradius and i get no errors. My worry is this... are my customers having to dial up several times before getting connected? Since Freeradius won't accept all requests from What's Up Gold, who's to say that it is accepting dial in requests from all of my customers all of the time? Any help or insight would be very much appreciated. Thanks! Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

4 7

pam_radius_auth threading issues
by Rich Graves 04 Oct '05

04 Oct '05

I've inherited a setup with authentication information on a local freeradius 1.0.5 server and OpenLDAP (with pthreads) configured to authenticate to SASL (v1 interface), which in turn uses PAM, which in turn is configured to check passwords with pam_radius_auth 1.3.16. All of this is on Linux RHEL3. This setup regularly fails under any sort of concurrency. Threading issues seem one likely reason. pam_radius_auth.c hasn't been touched in a while and hasn't had the same attention to thread safety as the core freeradius code. Has anyone else been down the road of cleaning up the calls to gethostbyname, variable scoping, etc? I know enough to recognize the problem, but don't really trust myself to fix it. Obvious workarounds for me include switching from SASL1/PAM to SASL2 and saslauthd; de-threading OpenLDAP (ick); or migrating the authoritative password store out of Radius entirely. But all of these have performance or operational issues here. I'd really like to get pam_radius_auth working as my predecessors (wrongly) thought it would.

2 3

Radius server configuration for challenge messages
by Nagaraj Venkatapuram 04 Oct '05

04 Oct '05

Hi, Does any body has any idea how to configure radius server to generate challenge messages per user per radius client ? I could not find any documentation on freeradius website regarding the same. Please let me know. Regards, N

2 1