March 2006 - Freeradius-Users - lists.freeradius.org

freebsd module rlm_sql Segmentation fault
by Vasco Santos 17 Mar '06

17 Mar '06

Hi folks, I have freebsd 4.10-RELEASE and freeradius version 1.0.1 and radiusd -x give me this error: The Debug: Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Segmentation fault I disable the sql module its works fine. I tested this in freeradius 1.0.1 and version 1.1.0 its give me the same "Segmentation fault". Is this a bug in freeradius? if yes, give-me a old version of freeradius that dont have this bug, or ways to correct it. Tanks.

1 0

Mysql problem
by Fabiano Rodrigo Boscatto 17 Mar '06

17 Mar '06

Hi there, i have freeradius working fine with mysql authentication. The problem is that the User-Password is stored in mysql table as clear text. Is there a way to crypt that? Thanx

4 4

Assigning DNS servers
by Tony Spencer 17 Mar '06

17 Mar '06

Hi I want to be able to assign DNS servers for each user to use as part of the users radius entry. If I use: MS-Primary-DNS-Server ="<ip address>", MS-Secondary-DSN-Server="<ip address> For each users radius config will this work? These users are ADSL users using DSL modems and routers. Thanks Tony -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

5 5

Re: Freeradius & Mysql initial install
by AM 16 Mar '06

16 Mar '06

I thought shared secret was in clients.conf

1 0

Freeradius & Mysql initial install
by Atkins, Dwane P 16 Mar '06

16 Mar '06

All, I appreciate the help you have given me on this and I am pretty sure I am like one or two changes off the correct path. When I do the radtest, it always tells me that: [root@cleveland ~]# radtest atkinsd xxxxx lhost 1645 xxxx Sending Access-Request of id 168 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "xxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Re-sending Access-Request of id 168 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "xxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=168, length=20 rad_decode: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) I have checked and double checked the shared secret in Users, sql.conf, radiusd.conf. Any ideas? Thanks again

2 1

rlm_perl segfault
by Grant Zanetti 16 Mar '06

16 Mar '06

I've just tried to get the rlm_perl module working. I'm running debian 3.1 with perl 5.8.8. I've tried installing the prebuilt debian packages as well as from source with "dpkg-buildpackage -rfakeroot -uc -b" However after loading the module freeradius segfaults. Freeradius config: modules { perl ipalloc { module = /etc/freeradius/dynip.pl func_accounting = accounting func_post_auth = post_auth } } post-auth { ipalloc } When running freeradius I get traffic:/etc/freeradius# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded perl perl: module = "/etc/freeradius/dynip.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" Segmentation fault The file "/etc/freeradius/dynip.pl" exists and is readable but the segfault is the same whether it exists or not. This is the output from gdb Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1210271424 (LWP 866)] 0xb7c12ca2 in Perl_hv_clear_placeholders () from /usr/lib/libperl.so.5.8 (gdb) bt #0 0xb7c12ca2 in Perl_hv_clear_placeholders () from /usr/lib/libperl.so.5.8 #1 0xb7c13369 in Perl_hv_delayfree_ent () from /usr/lib/libperl.so.5.8 #2 0xb7c142cc in Perl_hv_fetch () from /usr/lib/libperl.so.5.8 #3 0xb7bbf7ba in Perl_gv_fetchpv () from /usr/lib/libperl.so.5.8 #4 0xb7bbc14a in Perl_my_failure_exit () from /usr/lib/libperl.so.5.8 #5 0xb7bbe97d in perl_parse () from /usr/lib/libperl.so.5.8 #6 0xb7cbcd5d in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #7 0x0812e590 in ?? () #8 0xb7cbc130 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #9 0x00000003 in ?? () #10 0xbffa29b0 in ?? () #11 0x00000000 in ?? () #12 0x0812e590 in ?? () #13 0xb7cc0060 in rlm_perl () from /usr/lib/freeradius/rlm_perl-1.1.0.so #14 0xb7cc0350 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #15 0xb7b99618 in ?? () from /usr/lib/libperl.so.5.8 #16 0xb7cc0344 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #17 0x0811a9e8 in ?? () #18 0x08119c68 in ?? () #19 0x00000000 in ?? () #20 0x0812e4c8 in ?? () #21 0xb7cbf6a0 in ?? () from /usr/lib/freeradius/rlm_perl-1.1.0.so #22 0x08050455 in log_debug () #23 0x08055332 in find_module_instance () #24 0x08056a4f in modcallable_free () #25 0x080559e4 in setup_modules () #26 0x0804cd80 in main () I have tried with perl 5.8.4 with the same result. Any help would be appreciated. I'm not sure how to get more debug out of freeradius with gdb.

6 12

problem with MD5 encrypted secret
by Guido 16 Mar '06

16 Mar '06

Another question about secret... How can I configure freeradius to work with MD5 secret ? The secret now, is coming MD5 encrypted and I see the following error: ---rad_recv: Accounting-Request packet from host 192.168.1.12:1813, id=0, length=772 ---Received Accounting-Request packet from 192.168.1.12 with invalid signature! (Shared secret is incorrect.) ---Server rejecting request 11. Regards, Guido

2 1

Vendor Specific IDs
by Eliot, Wireless and Server Administrator, Great Lakes Internet 16 Mar '06

16 Mar '06

Before I start, let me just ask if there are any already created attributes that control bandwidth rates in the Tx and Rx directions which take a string as a value? I found USR-Initial-Tx-Link-Data-Rate and USR-Initial-Rx-Link-Data-Rate, but they take enumerated values that will not allow me to set up generic service rate (like 256Kbps or 1Mbps). I found a couple of other attributes that specific just "Data-Rate", but I can't find any that do Rx and Tx data rates. So, barring the existence of already created attributes, I'd like to set up my own vendor specific attributes -- which leads me to my main question: How do I choose a number for the Vendor-Id? For instance, Bristol's vendor ID is: VENDOR Bristol 4363 Do we have to request these from somewhere? Or, can we just pick a free one? Our AS number from ARIN is free (11541); can I just use that? Also, I have a secondary question related to this. I am setting up some bandwidth limiting scripts on our router that will limit customers' bandwidth usage. The idea is to execute a script when they authenticate which receives the AVPs from the Access-Accept packet (which would include the above mentioned Rx and Tx data rates). The script would take those attributes and instate some tc and iptables rules to shape the customers' bandwidth. When the user logs off, or the AP notices the client is gone, the AP sends an Accounting-Stop record FreeRADIUS. FreeRADIUS would then execute a cleanup script which brings down the rules that the first script instated. So, my second question is: When FreeRADIUS calls that second script, can/does it send the original Access-Accept attributes to the cleanup script? Thanks for any and all help. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details.

2 1

Passing value of attribute set in acct_users
by Ben Plimpton 16 Mar '06

16 Mar '06

Can someone please tell me how I can reference a value I set in the acct_users file so that I can use it in attr_rewrite? Or can I not do so? Thanks Ben

1 0

Question about processing multiple authorization sources
by Will Saxon 16 Mar '06

16 Mar '06

Hello, I am using FreeRADIUS 1.1.0 on FreeBSD 6.0 with Cisco Aironet 1200 WAPs. I need to be able to control which VLAN my users are assigned to, and it seems like this is accomplished by setting three RADIUS user attributes which control the assigned vlan after authentication. The problem is that my authorization/authentication source is an LDAP server, which I don't have any control over, that does not contain these attributes. Is it possible to have FreeRADIUS check a separate user database to provide the additional attributes? It seems like I could write a script to take the username, perform some database queries and return the appropriate information, but beyond that I don't know how to go about implementing such a solution. If it matters, I am currently using EAP-TTLS/PAP with SecureW2 and the aforementioned LDAP server. -Will -- Will Saxon Systems Programmer - Network Services University of Florida Department of Housing

2 2