November 2005 - Freeradius-Users - lists.freeradius.org

memory leaks with rlm_perl? (FreeRADIUS bug #221)
by Bjørn Mork 14 Nov '05

14 Nov '05

Hello, I wonder if you were able to resolve this bug? ref http://bugs.freeradius.org/show_bug.cgi?id=221 The reason I ask is that I've just experienced a serious memory leak after upgrading from 1.0.1 to 1.0.5, and we do use rlm_perl so that is one module to suspect. It seems that a colleague of mine has had the same experience previously too, trying to upgrade to 1.0.4. We don't really _know_ that rlm_perl is the cause, though... I will attempt to track the bug down further and provide a test configuration that will demonstrate the problem. Just wondered if you had some ideas we might test first. FWIW, we've been running 1.0.5 on a test server for a couple of months without trouble at all. The problems first showed up when upgrading the heavily loaded production servers. Our configuration was not changed at all on upgrade. I will eventually provide it to aid recreating the bug, but I need som time first to remove all private data from it. Sorry about that. Feel free to ignore me until I've been able to do this work. Just wanted to give an early warning in case someone has the magic solution at hand. Bjørn

3 3

RE: Solaris 10 (SPARC 64bit) - problems installing freeradius 1.0.5
by Reiko U. 14 Nov '05

14 Nov '05

Garrett's hint : https://list.xs4all.nl/pipermail/freeradius-users/2005-November/048278.html solved this problem ... I've used: CLFAGS="-I../include -I/usr/sfw/include/openssl" ./configure --prefix=/usr/local/freeradius --localstatedir=/var/ --sysconfdir=/etc and "make && make install" finished successfully. great thanks reiko

1 0

Re: Ldap truncating output
by Nicolas Baradakis 14 Nov '05

14 Nov '05

Pedro Marcolino wrote: > Hi Nicolas, > > I'm sorry to bother you again, but even after apllying the patch i > get the same problem. Are you sure this patch will resolve this > problem? Next time please send messages to freeradius-users(a)lists.freeradius.org and not my personal e-mail address. The patch I previously sent fixes a bug in the ldap query string, which isn't the bug you actually hit. Sorry, I've mistaken the problem. After reading your debug output a second time (with more attention) I think you have the same problem as bug #261. http://bugs.freeradius.org/show_bug.cgi?id=261 The short answer is to try adding double quotes to the values inside the LDAP directory. -- Nicolas Baradakis

1 0

Re: radiusd error AFTER ok
by Drew S. Dupont 14 Nov '05

14 Nov '05

Well, it seems to have been an issue with the setuid part of the helper app. I changed it from: if (!(initsetuid(1))) exit(1); to if (!(initsetuid(0))) exit(1); and it now seems to work. Strange that it worked before switching hardware, but at least it is working now. Thanks, Drew S. Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

1 0

Re: radiusd error AFTER ok
by Drew S. Dupont 14 Nov '05

14 Nov '05

>Date: Mon, 14 Nov 2005 01:31:24 -0500 >From: "Alan DeKok" <aland(a)ox.org> >Subject: Re: radiusd error AFTER ok >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <20051114063124.AC9EE16CC1(a)mail.nitros9.org> > >"Drew S. Dupont" <dsdupont(a)alumni.indiana.edu> wrote: >> This app used to work just fine before my recent HD and MoBo crashes >> today. I had to restore the system from a backup and the app. will no >> longer work. > > Uh... make sure it works on a machine that *doesn't* have hardware problems. Yes, it is running on different hardware. But, again, when it is run from the command line it runs fine. When it runs from within the helper app. it throws the errors. Drew Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

1 0

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 14 Nov '05

14 Nov '05

Yohoo! >LDAP advantage is that you can get more information out of >the AD...which is what io believe is the desire in this case Gotcha! :) My google-searches hat driven me into the direction to use _only_ ntlm_auth for authentication vs. AD. Meanwhile I had also triggered out the needed groups-settings. Just for completeness the settings for the groups: ----snip------- /etc/raddb/radiusd.conf [...] groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(& (objectClass=top)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf [...] ----snip------- /etc/raddb/users DEFAULT Ldap-Group == "Cisco-RW" Auth-Type := LDAP DEFAULT Ldap-Group == "Cisco-RO" Auth-Type := LDAP DEFAULT Auth-Type := Reject Reply-Message = "No access." ----snip------- Works fine here. Is there the need of a short howto for the doc/ ? Greets Christian

2 1

RE: Failed attempts log
by Thierry Hoferlin 14 Nov '05

14 Nov '05

Thanks Nicolas, It works fine. Just for info, the attributes to use in the mssql.conf file are "postauth_table" and "postauth_query" With the following radius configuration : post-auth { Post-Auth-Type REJECT { sql } } Regards, Thierry. >Thierry Hoferlin wrote: > >> I've configured a freeradius 1.0.5 with MSSQL authentification. >> It works fine. >> >> Is there a way to log failed authentification records to SQL ? > >Please don't post HTML on the list. > >Search the archives for detailed instructions, but the general idea is to use the module "sql" in section "post-auth". > >http://freeradius.org/radiusd/doc/Post-Auth-Type > >-- >Nicolas Baradakis > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 14 Nov '05

14 Nov '05

Yohoo! > What about the password? Which password? The User-Password? Or the shared secret? The Password for the Proxy-User is written down in the radiusd.conf. > I thought this was a kerberos one and didn't reside into the ldap itself? Kerberos ist installed, but I don't use it (I think so! ;-)) Greets Christian

1 0

RE: Freeradius vs. ActiveDirectory
by Jonathan De Graeve 14 Nov '05

14 Nov '05

What about the password? I thought this was a kerberos one and didn't reside into the ldap itself? -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- ________________________________ Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Völker, Christian Verzonden: maandag 14 november 2005 11:22 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Freeradius vs. ActiveDirectory Yohoo! Yes! I did it! ;) My freeradius (1.0.1-1.RHEL3) authenticates again our ActiveDirectory (on 2003 Server). Without ntlm_auth! Below I have added a short summary how I realized it here. But now I have a question and I can't solve it for myself. I want to retreive some group informations from AD. In an users account I find several values "memberOf" and the DN of the group, where the user belong to. Now I want to give access via freeradius only to some special groups. I have figuered out, that there are these parameters: groupname_attribute, groupmembership_filter and groupmembership_attribute combined with some entries in the users-file. I've read the doc/rlm_ldap, but I didn't find any deeper hints or explanation. Questions: 1. Where can I find some docs about the %{...} Values in groupmebership_filter? Which one should I use in combination with my AD? 2. Which value should I use then in the users-file? 3. Is there anyone who can give a little help in further authenticating with group? -------------short summary how to authenticate vs. ActiveDirectory ----------------------- /etc/raddb/radiusd.conf [...] ldap { #servername with an AD-Server running Win2003Srv server = "adsrv.qsc.de" #The Useraccount for querying AD (anonymous query is disabled) identity = "cn=man,ou=ServiceAdmins,dc=qsc,dc=de" #The password for the Query-User password = 'xxxxxx' #base DN for user search; all our Users are in ou=employees. Without this "ou=...", no user will be found. \ #I don't understand why basedn = "ou=employees,dc=qsc,dc=de" # I've copied the below string, because I didn't understand the meanings of the %{...} filter = "(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})" # I had to increase the timeouts timeout = 40 timelimit = 30 net_timeout = 10 } The users-file left on default, no changes. I hope, I could help some people trying to use AD for radius. And, I hope, someone will help me with my user-problem. Greets Christian

1 0

RE: assigning a vlan-id after successful authentication
by Jeff Reilly 14 Nov '05

14 Nov '05

3 2