December 2006 - Freeradius-Users - lists.freeradius.org

FreeRadius 1.1.3 Memory Leak
by Abdul Qadir 06 Dec '06

06 Dec '06

Hi, I just configured radius 1.1.3 and found that there are some memory leaks in it. Here is the output of Valgrind ==30841== ERROR SUMMARY: 4365 errors from 82 contexts (suppressed: 44 from 2) ==30841== malloc/free: in use at exit: 1,354,452 bytes in 25,976 blocks. ==30841== malloc/free: 35,826 allocs, 9,850 frees, 3,185,516 bytes allocated. ==30841== For counts of detected errors, rerun with: -v ==30841== searching for pointers to 25,976 not-freed blocks. ==30841== checked 75,458,816 bytes. ==30841== ==30841== ==30841== 11 bytes in 1 blocks are possibly lost in loss record 12 of 93 ==30841== at 0x43BF53F: malloc (m_replacemalloc/vg_replace_malloc.c:149) ==30841== by 0x441F567: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x44200B1: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x4420CB7: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x4421881: lt_dlopenext (in /usr/lib/libltdl.so.3.1.0) ==30841== by 0x8052C5A: (within /usr/local/sbin/radiusd) ==30841== by 0x8052F66: find_module_instance (in /usr/local/sbin/radiusd) ==30841== by 0x8054564: (within /usr/local/sbin/radiusd) ==30841== by 0x805475B: compile_modsingle (in /usr/local/sbin/radiusd) ==30841== by 0x8053422: (within /usr/local/sbin/radiusd) ==30841== by 0x8053958: setup_modules (in /usr/local/sbin/radiusd) ==30841== by 0x805683D: main (in /usr/local/sbin/radiusd) ==30841== ==30841== ==30841== 97 bytes in 6 blocks are definitely lost in loss record 43 of 93 ==30841== at 0x43BF53F: malloc (m_replacemalloc/vg_replace_malloc.c:149) ==30841== by 0x441F567: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x44200B1: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x4420CB7: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x4421881: lt_dlopenext (in /usr/lib/libltdl.so.3.1.0) ==30841== by 0x8052C5A: (within /usr/local/sbin/radiusd) ==30841== by 0x8052F66: find_module_instance (in /usr/local/sbin/radiusd) ==30841== by 0x8054564: (within /usr/local/sbin/radiusd) ==30841== by 0x805475B: compile_modsingle (in /usr/local/sbin/radiusd) ==30841== by 0x8053422: (within /usr/local/sbin/radiusd) ==30841== by 0x8053958: setup_modules (in /usr/local/sbin/radiusd) ==30841== by 0x805683D: main (in /usr/local/sbin/radiusd) ==30841== ==30841== ==30841== 476 bytes in 7 blocks are possibly lost in loss record 68 of 93 ==30841== at 0x43C0C58: calloc (m_replacemalloc/vg_replace_malloc.c:279) ==30841== by 0x8464EA: _dl_allocate_tls (in /lib/ld-2.3.3.so) ==30841== by 0xAB978D: pthread_create@@GLIBC_2.1 (in /lib/tls/libpthread-2.3.3.so) ==30841== by 0x8059A3E: (within /usr/local/sbin/radiusd) ==30841== by 0x8059D20: thread_pool_init (in /usr/local/sbin/radiusd) ==30841== by 0x8056A8B: main (in /usr/local/sbin/radiusd) ==30841== ==30841== LEAK SUMMARY: ==30841== definitely lost: 97 bytes in 6 blocks. ==30841== possibly lost: 487 bytes in 8 blocks. ==30841== still reachable: 1,353,868 bytes in 25,962 blocks. ==30841== suppressed: 0 bytes in 0 blocks. ==30841== Reachable blocks (those to which a pointer was found) are not shown. ==30841== To see them, rerun with: --show-reachable=yes Can any one help me how to fix this.? Best Regards, Abdul Qadir --------------------------------- Need a quick answer? Get one in minutes from people who know. Ask your question on Yahoo! Answers.

1 0

RSA SecurID + FreeRADIUS
by Jeremy M. Guthrie 06 Dec '06

06 Dec '06

I have a system with Suse 10.0 and FreeRADIUS V1.0.4. What I am trying to do is this: 1. ssh to Host-A running FreeRADIUS and PAM talks with pam_securid.so to authenticate to SecurID. This works like a champ. 2. Telnet/ssh into network equipment, said equipment RADIUS authenticates to the Host-A. I'd like to get FreeRADIUS to push the request to resolve the username/password combo via PAM towards pam_securid.so. So far, no go. Why would there be a /etc/pam.d/radiusd if it does not use it? Is the PAM reference in the radiusd.conf only used if Host-A was acting as a client? modules { pap { encryption_scheme = crypt } ... pam { pam_auth = radiusd } .. -- -------------------------------------------------- Jeremy M. Guthrie jeremy.guthrie(a)berbee.com Senior Network Engineer Phone: 608-298-1061 Berbee - A CDW Company Fax: 608-288-3007 5520 Research Park Drive NOC: 608-298-1102 Madison, WI 53711

1 0

FreeRADIUS 1.1.3 configuration issues on Solaris 9 with OpenSSL
by Bob Jones 06 Dec '06

06 Dec '06

Hey all, I apologize if this has been covered before, but I've searched the archives and haven't found anything to seemed to speak to this specific issue. I have a Solaris 9 system with Sun Studio 11. When running the configure script, I'm encoutering an issue I haven't been able to come up with a solution to as of yet, so I was hoping some of you might be able to help. There really seems to be 2 issues. First, we use a third party to provide many of our opensource tools (TheWrittenWord) and these apps and libraries are installed in /opt/TWWfsw instead of your typical /usr/local. So, I set some environment variables: CC=/opt/SUNWspro/bin/cc CXX=/opt/SUNWspro/bin/CC F77=/opt/SUNWspro/bin/f77 CFLAGS=-L/opt/TWWfsw/libgdbm182/lib -R/opt/TWWfsw/libgdbm182/lib And then run configure thusly: ./configure\ --without-rlm_ldap\ --without-rlm_krb5\ --without-rlm_sql\ --with-openssl-includes=/opt/TWWfsw/libopenssl097/include\ --with-openssl-libraries=/opt/TWWfsw/libopenssl097/lib Those are the correct paths to the openssl libraries and includes (the includes are in the openssl subdirectory of /opt/TWWfsw/libopenssl097/include. However, the configure script doesn't seem to locate them... I get the following pertinent openssl messages from configure: configure: WARNING: skipping test for openssl/ssl.h And later with the modules messages like: configure: WARNING: silently not building rlm_eap_tls. configure: WARNING: FAILURE: rlm_eap_tls requires: OpenSSL. configure: WARNING: silently not building rlm_eap_ttls. configure: WARNING: FAILURE: rlm_eap_ttls requires: OpenSSL. configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-includes openssl-includes openssl-includes openssl-includes openssl-includes. All normal considering it failed it's openssl check. But why did it fail the check when I used the --with-openssl-libraries flag to configure? Now, even more confusing is if I set the library locations in CFLAGS thusly: CFLAGS=-L/opt/TWWfsw/libopenssl097/lib -R/opt/TWWfsw/libopenssl097/lib -L/opt/TWWfsw/libgdbm182/lib -R/opt/TWWfsw/libgdm182/lib And run the configure exactly as above, things change. Now it finds the openssl pieces: checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking openssl/crypto.h usability... yes checking openssl/crypto.h presence... yes checking for openssl/crypto.h... yes checking openssl/err.h usability... yes checking openssl/err.h presence... yes checking for openssl/err.h... yes checking openssl/engine.h usability... yes checking openssl/engine.h presence... yes checking for openssl/engine.h... yes checking for OpenSSL version >= 0.9.7... yes And the configure output for rlm_eap_tls and others that require OpenSSL are fine, *except* for rlm_otp which still looks like: configure: configuring in src/modules/rlm_otp configure: running /bin/bash './configure' --prefix=/usr/local '--without-rlm_ldap' '--without-rlm_krb5' '--without-rlm_sql' '--without-snmp' '--with-openssl-includes=/opt/TWWfsw/libopenssl097/include' '--with-openssl-libraries=/opt/TWWfsw/libopenssl097/lib' '--with-rlm-perl-includes-dir=/opt/TWWfsw/perl586/lib/5.8.6/sun4-solaris-thread-multi/CORE' 'CC=/opt/SUNWspro/bin/cc' 'CFLAGS=-L/opt/TWWfsw/libopenssl097/lib -R/opt/TWWfsw/libopenssl097/lib -L/opt/TWWfsw/libgdbm182/lib -R/opt/TWWfsw/libgdm182/lib' 'CXX=/opt/SUNWspro/bin/CC' 'F77=/opt/SUNWspro/bin/f77' 'LDFLAGS=' --enable-ltdl-install --cache-file=/dev/null --srcdir=. checking for gcc... /opt/SUNWspro/bin/cc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether /opt/SUNWspro/bin/cc accepts -g... yes checking for /opt/SUNWspro/bin/cc option to accept ANSI C... none needed checking how to run the C preprocessor... /opt/SUNWspro/bin/cc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking for inttypes.h... (cached) yes checking for SSL_new in -lssl... yes checking openssl/des.h usability... no checking openssl/des.h presence... no checking for openssl/des.h... no checking openssl/hmac.h usability... no checking openssl/hmac.h presence... no checking for openssl/hmac.h... no checking openssl/md4.h usability... no checking openssl/md4.h presence... no checking for openssl/md4.h... no checking openssl/md5.h usability... no checking openssl/md5.h presence... no checking for openssl/md5.h... no checking openssl/sha.h usability... no checking openssl/sha.h presence... no checking for openssl/sha.h... no configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-includes openssl-includes openssl-includes openssl-includes openssl-includes. configure: creating ./config.status config.status: creating Makefile I've checked though and all those .h files are there with the same permissions as the others, so I would expect it to find the presence even if it didn't find them usable (which I wouldn't know why that would be true either). Any ideas? I'm at a real loss here. -- Thanks in advance, Bob Jones bob.jones(a)usg.edu

2 4

redefine radius attribute set
by pc286＠bk.ru 06 Dec '06

06 Dec '06

Hello, all! i want redefine DEFAULT set of Simultaneous-use DEFAULT NAS-Port-Type == Virtual, Simultaneous-Use := 1 Fall-Through = 1 that for all users, but for someone need "Simultaneous-Use := 2" if add "Simultaneous-Use := 2" to specific user entry, this not work. i found for gnu radius manual: = Additivity = Replace ^(*) dictionary file: ATTRIBUTE Service-Type 6 integer - [LR-RLR]=P ^(*) -- pc286 mailto:pc286@bk.ru

2 1

Sending Access-Challenge Fail
by Daniel Romero 06 Dec '06

06 Dec '06

I'm stucked... i don't know what to do... rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.100.185 port 1167 Framed-IP-Address := 192.168.100.210 Framed-IP-Netmask := 255.255.255.255 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP EAP-Message = 0x010400061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0108be98f023e591df74f0eaf7670e9d Finished request 3 Going to the next request Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 457619d2 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 1 with timestamp 457619d3 Cleaning up request 2 ID 2 with timestamp 457619d3 Cleaning up request 3 ID 3 with timestamp 457619d3 Nothing to do. Sleeping until we see a request.

2 1

EAP
by Daniel Romero 06 Dec '06

06 Dec '06

Any ideas? ... Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "radiusUDP" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[1]: eap: Module instantiation failed. radiusd.conf[399] Unknown module "eap". radiusd.conf[382] Failed to parse authenticate section.

4 3

EAP
by Daniel Romero 05 Dec '06

05 Dec '06

rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[1]: eap: Module instantiation failed. radiusd.conf[399] Unknown module "eap". radiusd.conf[382] Failed to parse authenticate section. Cause: certificate's password and password on eap.conf where different. Solution: make them equals!!!

1 0

SQL reconnect
by Guido 05 Dec '06

05 Dec '06

Hi list, I'm using freeradius with Ms-SQL. Freeradius can open connections as many as are configured in mssql (num_sql_socks = 3). It is ok, but when SQL go down, or when connection with SQL go down freeradius can't connect to SQL until freeradius is restarted. So, I need a way to rstart freeradius when any problem with SQL happens. Regards, Guido

2 1

FreeRadius core dump on FreeBSD
by Lisa Besko 05 Dec '06

05 Dec '06

I'm getting a core dump with freeradius when I try to use Kerberos authentication on a FreeBSD box running 6.1-Stable with an AMD64 platform. I can run FreeRadius with Kerberos authentication on FreeBSD 6.1 Stable with the i386 platform with no problems. If you can point me in a direction to help fix the problem please do. Here's some more info.: FreeRADIUS Version 1.1.3, for host amd64-portbld-freebsd6.1 Kerberos5 Version 1.5 Sunfire 2100 Dual Core AMD Opteron(tm) Processor 180 Please let me know if I can provide any more info. Here's the debugging messages from starting radiusd -X (slightly sanitized to protect the innocent : Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Kerberos krb5: keytab = "(null)" krb5: service_principal = "(null)" rlm_krb5: krb5_init ok Module: Instantiated krb5 (krb5) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host xx.x.x.xx:50724, id=200, length=65 User-Name = "userid(a)realm.realm" User-Password = "thisisnothepasswordyouarelookingfor" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "realm.realm" for User-Name = "userid(a)realm.realm" rlm_realm: No such realm "realm.realm" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Kerberos auth: type "Kerberos" Processing the authenticate section of radiusd.conf modcall: entering group Kerberos for request 0 Bus error (core dumped) Thanks for any pointers or help you can provide. I've been searching all over the web and beating my head against the wall for 3 days now. LB

1 1

client log
by Santiago Balaguer García 05 Dec '06

05 Dec '06

Hi people, I have installed freeradius 1.0.4 in my AAA servers. I work several years with this service and funcion very well. I am develeping a PHP platform for my people who install hotspots. Well, I want to log if a nas can not authenticate with my RADIUS server because of any reason. I wish only to log failed NAS request such as: -------------------------------------------------- rad_recv: Access-Request packet from host 192.168.1.247:1027, id=4, length=245Ignoring request from unknown client 192.168.1.247:1027--- Walking the entire request list --- -------------------------------------------------- Any suggestion?? Santiago _________________________________________________________________ Llama a tus amigos de PC a PC: ¡Es GRATIS! http://get.live.com/messenger/overview

3 2