May 2005 - Freeradius-Users - lists.freeradius.org

Freeradius 1.0.2 crashes in startup due tls
by Mikko Saarinen 31 May '05

31 May '05

Hey, Not sure if this would belong to devel list, but still. I'm trying to test the PEAP support, but Freeradius 1.0.2 dies when it loads and configures the tls module. In older version 0.9.3 the tls works a-ok, but it has no peap support. Anyone have idea if this is a known problem and if there is version in which the peap runs. OpenSSL version: OpenSSL 0.9.7e 25 Oct 2004 Here is the log and stack from running radiusd -X under gdb: (gdb) run -X Starting program: /usr/local/sbin/radiusd -X (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread 16384 (LWP 5377)] Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.1.50 IP address [192.168.1.50] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/foocerts/privkey.pem" tls: certificate_file = "/usr/local/etc/raddb/foocerts/cacert.pem" tls: CA_file = "/usr/local/etc/raddb/foocerts/cacert.pem" tls: private_key_password = "SecretKeyPass77" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes rlm_eap_tls: conf N ctx stored rlm_eap: Loaded and initialized type tls Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 5377)] 0x400630df in lt_dlsym (handle=0x815e3f0, symbol=0xbfffe970 "rlm_eap_peap") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) (gdb) bt #0 0x400630df in lt_dlsym (handle=0x815e3f0, symbol=0xbfffe970 "rlm_eap_peap") at ltdl.c:3330 #1 0x402324c7 in eaptype_load (type=0xc, eap_type=12, cs=0xc) at eap.c:114 #2 0x40231aea in eap_instantiate (cs=0x80a7410, instance=0xc) at rlm_eap.c:134 #3 0x080558f3 in find_module_instance () #4 0x08056cd5 in modcall () #5 0x08056e32 in compile_modsingle () #6 0x08055dad in find_module_instance () #7 0x08056144 in setup_modules () #8 0x0804cea0 in main () (gdb) -- Mikko Saarinen mikko.saarinen(a)radionet.com

2 1

dynamic ip, shared secret
by glanzel＠gmx.de 31 May '05

31 May '05

Hello i want to allow nas's behind a flatrate to talk with my freeradius server. these nas's has dynamis ip's. has anybody an idea how i could deal with that. at the moment i have a client named 0.0.0.0/0 in the clients.conf file - but that means that every nas have the same shared secret. better ideas ? and could someone tell me if my suggestions about the shared secret are right. -> if using pap or chap shared secred is used to encrypt password when sending. -> if using peap or ttls shared secret is not used in the authentication process but for the sending of encryption key for further encryption of the connection between supplicant and radius at the end of the authentification session is that right ? greetings grischan -- 5 GB Mailbox, 50 FreeSMS http://www.gmx.net/de/go/promail +++ GMX - die erste Adresse f�r Mail, Message, More +++

2 1

RE: upgrading freeRADIUS
by DELORT Stephane 31 May '05

31 May '05

Hello Vicky, Haven't you try to copy your config files and do the upgrade on a test system ? (create an exact replica on another machine and upgrade it) I think it would be useful to post an "howto to upgrade from xxx to yyy" once you've done it. regards, Stéphane -----Message d'origine----- De : freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]De la part de vicky Envoyé : mardi 31 mai 2005 11:31 À : FreeRadius users mailing list Objet : upgrading freeRADIUS Hi list subscribers, hi list admins, (again) I'm running a freeRADIUS server version 0.8.1 (I know it is ancient) and I want to upgrade it to the latest version available. I have been trying to find some kind of procedure to upgrading but with no success. Does anyone know how to (in a fairly simple way) safely upgrade? The safetyness is very crucial, I cant risk overwriting my old configuration. The old server is built with #configure --prefix=/opt/freeradius #make #su #make install Thanks to you all in advance and please notice that I'm not that of an expert on RADIUS... Keep up the good work! -- Vicky - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 5

No detail logs # 2
by Radius 31 May '05

31 May '05

Everything was working fine until we switched back haul providers. We changed all the ip address's that we could fine under the raddb/etc directory. I'm sure I missed a setting or something. We changed providers as well as our IP address's 4 days ago. Ever Since we did, no detail logs are being created by FreeRadius 9.3 Everyone can get logged in and realms are working fine, just no detail log. Any Ideas? Thanks Bob Ross

4 6

Please resend this message to Kim Jones'
by Kim 31 May '05

31 May '05

Please resend this message to Kim Jones' new email address. Thank You. kim(a)omegatechinc.com

1 0

controlling the auth by CallingStationId
by Ernesto Freyre Ramírez 31 May '05

31 May '05

Dear Sirs, please , I hope someone here could to help me, I wish to control the authentication process by including a check of the CallingStationId parameter, being some generic features of it, or also all the value of the same, please some hint aboout where I must to configure this task? Thank you Ernesto Freyre Ramírez

2 1

Authenticate against Mac OS X Open Directory
by Ekkehard Burkon 31 May '05

31 May '05

Hi, did anyone successfully authenticate against a Mac OS X servers Open Directory? I need it for 802.1x/WPA. Are there any docs on the web? Thank you for any help. Ekkehard --

2 1

time request
by Thiago Felipe de Andrade 31 May '05

31 May '05

2 1

Filter
by José Berenguer 31 May '05

31 May '05

Hello, Anyone can tell me where can I find some instructions about how to configure the "filter=" option in the "module ldap" subsection of radiusd.conf? Thanks a lot! -- ********************************************************************** José Berenguer Giménez Área de Comunicaciones-Servicio de Informática UNIVERSIDAD DE ALMERÍA Crta. de Sacramento s/n, 04120 - Almería Tlf.: 950014014 E-mail: jose(a)ual.es **********************************************************************

2 1

Please resend this message to Kim Jones'
by Kim 31 May '05

31 May '05

Please resend this message to Kim Jones' new email address. Thank You. kim(a)omegatechinc.com

1 0