November 2005 - Freeradius-Users - lists.freeradius.org

dialup_admin problems
by Eric Tanguy 08 Nov '05

08 Nov '05

Hello I have some problems with dialup_admin1.62. i use freeradius-1.0.1 with mysql on Fermi Linux LTS Release 3.0.1 - first, I have a problem in showing the online user in dialup_admin. in fact, when i use a telnet user to connect on NAS , it appears in online user but when it 's a ppp user, there is nothing. I think the problem is the radacct table because nothing is writing into this table when it 's a ppp user and i don't know why. - Second, I have a problem with failed logins and users statistic. dialup_admin start with sql debug. the request is ok but nothing is writing into the board. cdt -- Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message etant susceptible d'alteration, l'emetteur decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ----------------------------------- This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. As e-mails are susceptible to alteration, the issuer shall not be liable for the message if altered, changed or falsified.

1 0

mysql.sock moved and cannot be found by freeradius !
by Seferovic Edvin 08 Nov '05

08 Nov '05

Hi, and a big HEEEEEEEEEEEELP ( or should I say - save our/my soul ).... I've moved my mysql database to another partition ( databases were getting big ) and Ive corrected my mysql config so that the socket file is now located at /data/mysql/mysql.sock. Restarted MySql - and it worked.. but my freeradius ( 1.0.5 ) first crashed with seg. fault ( I suppose this happened because of an Access-Request packet while restarting the server )... and when I started it for the second time - it said that it cannot find the mysql.sock file in the "usual" place ( /var/lib/mysql/mysql.sock )... is the location of mysql.sock hard-coded in freeradius ? What can I do to get my radius connect to mysql ? Thank you very much in advance... Regards, Edvin Seferovic

6 13

Freeradius the right tool as Windows Authentication Proxy?
by Thomas Stieglitz 08 Nov '05

08 Nov '05

Hello all, I'm new on this list - and a little bit with the subject "free radius" and radius technology, too. So sry in advance, if I'm off topic ;-) or if the question was already asked, I didn't find it within the mailing list's archive. I've got a conceptional problem, and I'm woundering whether freeradius might be the aporopiate tool to solve it. We're running an apache 1.X webserver, which is located at an external provider. My problem is, that we need to authenticate webusers against our Windows 2000 Active Directory, which is located in our companies' local network. My idea is, to locate an Freeradius Server in the DMZ. This server would have the job, to accept calls from the webserver (over an IP-Tunnel), ask the AD whether username and password are o.k. and return this information to the webserver. Here are my questions in particular: 1) Is this idea a possible solution ... the right use of an radius-server? And, if yes: is freeradius the right tool for it? 2) If yes: Is it also possible, to gain group information about a user. (i. e. Is Fred Member of Group Foo? Which groups is Fred member of?) 3) if yes: how do I find an entry point for further information about this special subject? 4) Is someone out there running an simular configuration and give me an hand, hints, show me quirks etc.? I'm happy for any advice, thanks in advance for it! Tom ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

3 2

[OTAnn] Feedback
by shenanigans 07 Nov '05

07 Nov '05

I was interested in getting feedback from current mail group users. We have mirrored your mail list in a new application that provides a more aggregated and safe environment which utilizes the power of broadband. Roomity.com v 1.5 is a web 2.01 community webapp. Our newest version adds broadcast video and social networking such as favorite authors and an html editor. It?s free to join and any feedback would be appreciated. S. ---------------------------------------------------------------------------------------------------------------------------------------- Broadband interface (RIA) + mail box saftey = <a href="http://Free_Radius_Users_List.roomity.com">Free_Radius_Users_List.roomity.com</a> *Your* clubs, no sign up to read, ad supported; try broadband internet. ~~1131401587246~~ ----------------------------------------------------------------------------------------------------------------------------------------

1 0

perl and additional response attributes
by Emil Wilmanski 07 Nov '05

07 Nov '05

Hi, I'm testing freeradius 1.0.5. I want to add some additional attributes to Access-Accept response using rlm_perl module but when I put perl into "post-auth" block, when I start server it says: radiusd.conf: "perl" modules aren't allowed in 'post-auth' sections -- they have no such method. In freeradius 1.0.2 it is working... How to add additional parameters using some code? (without "radreply") -- Emilus.

2 2

Solaris 8 Make Problems
by Nicholas Thompson 07 Nov '05

07 Nov '05

>-xarch=v8 sounds like a Sun cc option. It's a good idea to work just with >one compiler, sun or gnu. Adjust the PATH that ./configure and make just >see on compiler. I dont have the sun compiler. I am using GCC version 3.3.2 and the gnu linker version 2.14 both of these are located in /usr/local/bin and that is the first directory in my path. > I am new to freeradius. I have a Solaris 8 machine with OpenSSL > version 0.9.8 and MySQL version 5.0.15 (max). Configure completes > without any problems however make fails. I have read many > suggestions on the list, and tries all of them. Such as setting the > LD_LIBRARY_PATH, I even tried to configure and make with just static > libraries. Could there be a problem with freeradius and MySQL5? > Here is a copy of the make output errors: > make[10]: Entering directory `/export/home/nicholas/freeradius-1.0. > 5/src/modules/rlm_sql/drivers/rlm_sql_mysql' > gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -c > sql_mysql.c -o sql_mysql.o > gcc: language arch=v8 not recognized > gcc: sql_mysql.c: linker input file unused because linking not done -xarch=v8 sounds like a Sun cc option. It's a good idea to work just with one compiler, sun or gnu. Adjust the PATH that ./configure and make just see on compiler. > /export/home/nicholas/freeradius-1.0.5/libtool --mode=link ld - > module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 sql_mysql.o > -o rlm_sql_mysql.a > (cd . && ln -s sql_mysql.lo sql_mysql.o) > ln: cannot create sql_mysql.o: File exists > make[10]: *** [rlm_sql_mysql.a] Error 2 --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 0

Solaris 8 Make Problems
by Nicholas Thompson 07 Nov '05

07 Nov '05

I am new to freeradius. I have a Solaris 8 machine with OpenSSL version 0.9.8 and MySQL version 5.0.15 (max). Configure completes without any problems however make fails. I have read many suggestions on the list, and tries all of them. Such as setting the LD_LIBRARY_PATH, I even tried to configure and make with just static libraries. Could there be a problem with freeradius and MySQL5? Here is a copy of the make output errors: make[10]: Entering directory `/export/home/nicholas/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -c sql_mysql.c -o sql_mysql.o gcc: language arch=v8 not recognized gcc: sql_mysql.c: linker input file unused because linking not done /export/home/nicholas/freeradius-1.0.5/libtool --mode=link ld -module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 sql_mysql.o -o rlm_sql_mysql.a (cd . && ln -s sql_mysql.lo sql_mysql.o) ln: cannot create sql_mysql.o: File exists make[10]: *** [rlm_sql_mysql.a] Error 2 --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

2 2

SV: Re: Freeradius stops authenticating
by Svein Hansen 07 Nov '05

07 Nov '05

I recompiled freeradius with the patch, but the problem didn't go away.. I have 2 new outputs from valgrind and a stacktrace from gbd, but I don't want to send attachments to the list. Here's some lines from the output's.. Run 1: Valgrind # valgrind --tool=memcheck --verbose --log-file=/root/val071105 radiusd -yf --- ==32260== Thread 8: ==32260== Invalid write of size 4 ==32260== at 0x7D64E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==32260== by 0xFC53: modcall (modcall.c:219) ==32260== by 0xFEE0: modcall (modcall.c:252) ==32260== Address 0x1BB57078 is 0 bytes inside a block of size 352 free'd ==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==32260== by 0x1BB78C12: ??? (rlm_passwd.c:545) ==32260== ==32260== Thread 8: ==32260== Invalid free() / delete / delete[] ==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==32260== by 0xFC53: modcall (modcall.c:219) ==32260== Address 0x1BB57078 is 0 bytes inside a block of size 352 free'd ==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==32260== by 0x1BB78C12: ??? (rlm_passwd.c:545) Run 2: Valgrind # valgrind --tool=memcheck --verbose --log-file=/root/val071105 radiusd -yf ----- ==9390== Thread 8: ==9390== Invalid write of size 4 ==9390== at 0x7D64E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==9390== by 0xFC53: modcall (modcall.c:219) ==9390== by 0xFEE0: modcall (modcall.c:252) ==9390== Address 0x1BB371C8 is 0 bytes inside a block of size 352 free'd ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==9390== by 0x1BB78CA3: ??? (rlm_passwd.c:309) ==9390== ==9390== Thread 8: ==9390== Invalid free() / delete / delete[] ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==9390== by 0xFC53: modcall (modcall.c:219) ==9390== Address 0x1BB371C8 is 0 bytes inside a block of size 352 free'd ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==9390== by 0x1BB78CA3: ??? (rlm_passwd.c:309) ==9390== ==9390== Thread 9: ==9390== Invalid read of size 1 ==9390== at 0x7D6BFA: _IO_fgets (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB77DA0: ??? (rlm_passwd.c:275) ==9390== by 0x1BB78C12: ??? (rlm_passwd.c:545) ==9390== by 0xFC53: modcall (modcall.c:219) ==9390== Address 0x1BB68F31 is 1 bytes inside a block of size 352 free'd ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==9390== by 0xFC53: modcall (modcall.c:219) Run 3: gdb # radiusd -yf Mon Nov 7 13:02:31 2005 : Info: Starting - reading configuration files ... *** glibc detected *** malloc(): memory corruption: 0xae8012dd *** Aborted (core dumped) # date man nov 7 14:19:20 CET 2005 # gdb radiusd core.19991 (gdb) bt #0 0x00bbb7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x003127d5 in raise () from /lib/tls/libc.so.6 #2 0x00314149 in abort () from /lib/tls/libc.so.6 #3 0x0034640a in __libc_message () from /lib/tls/libc.so.6 #4 0x0034d51c in _int_malloc () from /lib/tls/libc.so.6 #5 0x0034ef81 in malloc () from /lib/tls/libc.so.6 #6 0x0011915b in pairmake (attribute=0x947af33 "LM-Password", value=0x947ab03 "", operator=11) at valuepair.c:1041 #7 0x00e09981 in addresult (inst=0x947a9e8, vp=0x947d954, pw=0x947aac8, when=0 '\0', listname=0xe09e76 "config_items") at rlm_passwd.c:504 #8 0x00e09bbc in passwd_authorize (instance=0x947a9e8, request=0x947d940) at rlm_passwd.c:542 #9 0x001f2c54 in modcall (component=1, c=0x9479b18, request=0x947d940) at modcall.c:219 #10 0x001f2ee1 in modcall (component=1, c=0x93fb260, request=0x947d940) at modcall.c:252 #11 0x001f2126 in indexed_modcall (comp=1, idx=6, request=0x0) at modules.c:473 #12 0x001eeef3 in rad_authenticate (request=0x947d940) at auth.c:592 #13 0x001e804c in rad_respond (request=0x947d940, fun=0x1eee57 <rad_authenticate>) at radiusd.c:1642 #14 0x001f5481 in request_handler_thread (arg=0x947d378) at threads.c:517 #15 0x006c5341 in start_thread () from /lib/tls/libpthread.so.0 #16 0x003b26fe in clone () from /lib/tls/libc.so.6 (gdb) My rlm_passwd.c (after applying patch): Line: 279 - 289 if(!strcmp(list, name)) return passwd; } } } } fclose(ht->fp); ht->fp = NULL; return NULL; #undef passwd } Line:301 - 311 if (!strcmp(hashentry->field[ht->keyfield], name)){ /* save address of next item to check into buffer */ ht->last_found=hashentry->next; return hashentry; } return NULL; } if (ht->fp) fclose(ht->fp); if (!(ht->fp=fopen(ht->filename, "r"))) return NULL; return get_next(name, ht); } Line: 540 - 550 } do { addresult(inst, &request->config_items, pw, 0, "config_items"); addresult(inst, &request->reply->vps, pw, 1, "reply_items"); addresult(inst, &request->packet->vps, pw, 2, "request_items"); } while ( (pw = get_next(name, inst->ht)) ); found++; if (!inst->allowmultiple) break; } if(!found) { return RLM_MODULE_NOTFOUND; Please send me an email if you can help me, and I will send the complete outputs. Svein Hansen >>> nbk(a)sitadelle.com 27.10.2005 12:34:41 >>> Svein Hansen wrote: > I suspected that there had to be a module in freeradius that makes > glibc fault, so I tried to run freeradius in Valgrind: Thanks, the output of Valgrind is very useful. > I'm not a programmer, but can it be that radius tries a double-close > or a double-free? Indeed, it looks like a file stream is closed more than once. Please try to apply these changes to src/modules/rlm_passwd/rlm_passwd.c then recompile FreeRADIUS and test again. Index: src/modules/rlm_passwd/rlm_passwd.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_passwd/rlm_passwd.c,v retrieving revision 1.13.2.3 diff -u -r1.13.2.3 rlm_passwd.c --- src/modules/rlm_passwd/rlm_passwd.c 19 Dec 2004 20:06:30 -0000 1.13.2.3 +++ src/modules/rlm_passwd/rlm_passwd.c 27 Oct 2005 10:23:00 -0000 @@ -136,8 +136,15 @@ for (i=0; i<ht->tablesize; i++) if (ht->table[i]) destroy_password(ht->table[i]); - if (ht->table) free(ht->table); - if (ht->fp) fclose(ht->fp); + if (ht->table) { + free(ht->table); + ht->table = NULL: + } + if (ht->fp) { + fclose(ht->fp); + ht->fp = NULL; + } + ht->tablesize = 0; } static void release_ht(struct hashtable * ht){ @@ -194,7 +201,6 @@ if(*buffer && *buffer!='\n' && (!ignorenis || (*buffer != '+' && *buffer != '-')) ){ if(!(hashentry = mypasswd_malloc(buffer, nfields, &len))){ release_hash_table(ht); - ht->tablesize = 0; return ht; } len = string_to_entry(buffer, nfields, *ht->delimiter, hashentry, len); @@ -219,7 +225,6 @@ else nextlist = 0; if(!(hashentry1 = mypasswd_malloc("", nfields, &len))){ release_hash_table(ht); - ht->tablesize = 0; return ht; } for (i=0; i<nfields; i++) hashentry1->field[i] = hashentry->field[i]; -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: freeradius and machine account authentication
by Norbert Wegener 06 Nov '05

06 Nov '05

>>Norbert Wegener <nw at sbs.de <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >>/ FreeRADIUS at this time cannot perform machine account authentications, />>/ but it supports proxying them off to another RADIUS server (for example, />>/ IAS, or FUNK) /> > After recent changes to both FreeRADIUS and Samba, this is now > supported. See the list archives for details. > > Alan DeKok. I searched the archives and found this or that discussion about that topic in general. Nevertheless I did not find any hint on how to configure freeradius to perform machine account authentication. Maybe someone has a pointer for me, as even in freeradius-snapshot-20051104 a grep for machine account was not successfull. Another question comes up in that context: What job has samba to solve here? Must the server, that runs freeradius, be member of the active diretory domain and samba is used for this? Which version of samba must at least be used? Thanks Norbert Wegener

2 1

FW: Attribute Value length using SQL
by Gunther 06 Nov '05

06 Nov '05

Alan DeKok wrote: >"Gunther" <freeradius(a)caribsms.com> wrote: >> Thanks! Yes, I see it in rfc2138 (0-253 octets) ... But isn't the >> feature I am talking about more part of the expression module and >> enhanced functionality of FreeRadius? > > Yes, but the data structures used by the code are still based on > RADIUS ones. > > If you want to use longer strings, rlm_policy in the CVS snapshot may help. > > Alan DeKok. Will try that one! I was actually successful with changing MAX_STRING_LEN and changing one fixed [256] value in main/xlat.c (char attrname[256];). The long SQL strings were recognised and functioning. My remaining trouble was the conditional expression %{expr: SQL1}:-%{expr:SQL2}. Whenever SQL1 does not return anything, SQL2 will not be executed ... I guess I am not using the right syntax or I am running into a limit ... I presume that I have to use a complete CVS snapshot in order to use rlm_policy? Thanks, Gunther

2 2