April 2007 - Freeradius-Users - lists.freeradius.org

server crashes with eap/tls after crl update
by Fiederling, Daniel 20 Apr '07

20 Apr '07

Hello, this week I updated to freeradius 1.1.6. We use eap/tls with a crl from a Microsoft CA, which is downloaded and converted by a shell script every hour or has to be updated manually. If it changes, I have to reload the server config, right? Since the update the server crashes with a seg fault about a minute after the config reload - but only if the crl changed. For now I changed the reload (SIGHUP) to a complete restart as a work around. Before we used freeradius 1.1.4. --- debug info --- # ./radiusd -X ... --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Reloading configuration files. reread_config: reading radiusd.conf Config: including file: /opt/freeradius/etc/raddb/proxy.conf Config: including file: /opt/freeradius/etc/raddb/clients.conf Config: including file: /opt/freeradius/etc/raddb/snmp.conf Config: including file: /opt/freeradius/etc/raddb/eap.conf Config: including file: /opt/freeradius/etc/raddb/sql.conf main: prefix = "/opt/freeradius" main: localstatedir = "/opt/freeradius/var" main: logdir = "/opt/freeradius/var/log/radius" main: libdir = "/opt/freeradius/lib" main: radacctdir = "/opt/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/freeradius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Thu Apr 19 19:07:23 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Apr 19 19:07:23 2007 : Error: radiusd.conf[1683] Auth-Type PAP already configured - skipping Thu Apr 19 19:07:23 2007 : Error: radiusd.conf[1692] Auth-Type CHAP already configured - skipping Thu Apr 19 19:07:23 2007 : Error: radiusd.conf[1698] Auth-Type MS-CHAP already configured - skipping Thu Apr 19 19:07:23 2007 : Info: radiusd.conf Auth-Type System already configured - skipping Thu Apr 19 19:07:23 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Thu Apr 19 19:07:24 2007 : Info: radiusd.conf Auth-Type eap already configured - skipping Thu Apr 19 19:07:24 2007 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Thu Apr 19 19:07:24 2007 : Info: rlm_sql (sql): Attempting to connect to XXXremovedXXX Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Thu Apr 19 19:07:24 2007 : Info: Ready to process requests. Segmentation fault --- debug info --- Does anyone have the same problem? Thanks! bye Daniel

3 3

SQL Accounting problem with 1.0.3 - The maximum number of threads (32) are active
by Rick Macdougall 19 Apr '07

19 Apr '07

Hi, We seem to be having the "The maximum number of threads (32) are active" with Freeradius 1.0.3. Version 1.0.1 works just fine. I tried to do a valgrind with -xxxx but when radiusd displays that message, you can no longer kill it. I have the debug output from the -xxxx and it shows the accounting processes running, adding info and completing but the thread doesn't seem to release. Example Tue Apr 17 09:49:57 2007 : Debug: rlm_sql (sql1): Reserving sql socket id: 6 Tue Apr 17 09:49:57 2007 : Debug: rlm_sql (sql1): Released sql socket id: 6 Tue Apr 17 09:49:57 2007 : Debug: modsingle[accounting]: returned from sql1 (rlm_sql) for request 48 Tue Apr 17 09:49:57 2007 : Debug: modcall[accounting]: module "sql1" returns ok for request 48 So it appears to be a problem with the mysql driver rather than a problem with a slow database query. Anything else I can provide ? Centos 4.3 Linux version 2.6.9-42.0.10.ELsmp 512 meg of ram Conntecting to a remote DB server over a dedicated gig network running MySQL 5.x Intel(R) Pentium(R) 4 CPU 3.20GHz with hyperthreading enabled. Regards, Rick

3 16

Radclient , -c flag = radclient.c:492: failed assertion `radclient->reply == NULL'
by Arran Cudbard-Bell 19 Apr '07

19 Apr '07

Hi, Radclient works fine with almost every except when you use the -c flag to specify that multiple copies of the same packet are sent. --- ./radclient -c 10 -x -f user radius1.susx.ac.uk auth xxxxxxx Sending Access-Request of id 205 to 139.184.14.180 port 1812 User-Name = "ac221" User-Password = "xxxx" rad_recv: Access-Accept packet from host 139.184.14.180 port 1812, id=205, length=20 radclient.c:492: failed assertion `radclient->reply == NULL' Was looking forward to doing some crude benchmarking :( Apart from that all seems well and good. Haven't noticed radiusd dieing at random intervals or any other weirdness. Back ticks work for sql xlat like you said, and there is indeed a reference in the attributes documentation. :) Just acquired a copy of THE C PROGRAMMING LANGUAGE Second edition, which I am assured is the best book for learning C. So you might actually see bug fixes some time soon instead of just bug reports ;) -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

2 1

Grouping after Kerberos 5 authentication accepted?
by Jason Chan 19 Apr '07

19 Apr '07

Hello, Is it possible for FreeRadius to perform grouping after Kerberos authentication accepted? My company has many switches and servers and we use kerberos 5 for RADIUS authentication. Once the user is authenticated, RADIUS will check and decide if this user can access the switches or particular servers (i.e. Allow telnet to the switch if the user belongs to the 'switch administrator' group). I've looked in the huntgroup file but it seems to require a lot of works for a very large company (5000+ users), and the problem is we can't touch the Kerberos server. Any help would be appreciated. Thank you Regards, Jason

3 4

Crypt passwords doesn't work
by Sebastian Firpo 19 Apr '07

19 Apr '07

Hi, I migrated a freeradius server from version 0.6 to 1.5. I'm using a users file for authorize. The server don't authorize and when a do a debug (radiusd -X) I saw the User-password in clear text. If I modify the User-password in the users file by the clear text one it works. Here are the debug and an entry of the users file: Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.12.4.2:1645, id=91, length=75 NAS-IP-Address = 10.12.4.2 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "sebas" Calling-Station-Id = "10.11.1.25" User-Password = "hello" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry sebas at line 50 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Delaying request 0 for 1 seconds users file sebas Auth-Type := Local, Crypt-Password == "(!lGOOlHaBWoQ" Service-Type = Administrative-User, Cisco-AVPair = "shell:priv-lvl=15" Thanks very much!!

4 8

Motorola Authenitcation
by Matthew Neumark 19 Apr '07

19 Apr '07

FreeRADIUS Users/Developers, Does anyone use RADIUS to authenticate Motorola SM's? If so, I'm needing some information on how to accomplish this. Thank You In Advanced!, Matt Neumark

1 0

snmp accounting/statistic queries
by Milan Holub 19 Apr '07

19 Apr '07

Hi Alan, snmp querying works great now. Thanks for that! However I've tried also to query some MIBS from RADIUS-ACC-SERVER-MIB.txt or RADIUS-STAT-MIB.txt files and it looks like freeradius does not react on it at all(no DEBUG activity with -X). (cvs head) Working query (using MIBs from RADIUS-AUTH-SERVER-MIB.txt) example: `snmpwalk -Cc -v 1 -m /devel/freeradius/cvs/work/mibs/RADIUS-AUTH-SERVER-MIB.txt -c verysecret localhost radiusAuthServUpTime` Not working queries(examples) `snmpwalk -Cc -v 1 -m /devel/freeradius/cvs/work/mibs/RADIUS-ACC-SERVER-MIB.txt -c verysecret localhost radiusAccServUpTime` `snmpwalk -Cc -v 1 -m /devel/freeradius/cvs/work/mibs/RADIUS-STAT-MIB.txt -c verysecret localhost radiusStatUpTime` I remember all MIBs worked a week before or so... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 3

how to configure
by parfait nda 19 Apr '07

19 Apr '07

i need to configure my freeradius server in proxy server to use it with windows IAS! i want the configuration of the files of freeradius which can permit me to do that! my last coonfiguration of these files is: radiusd.conf proxy_request = yes proxy.conf realm gie.local { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = araignee.gie.local:1812 accthost = araignee.gie.local:1813 secret = parfait nostrip } Clients.conf client 192.168.0.2 { secret = parfait shortname = araignee.gie.local } thanks for your help! _________________________________________________________________ Windows Live Spaces : créez votre blog à votre image ! http://www.windowslive.fr/spaces

3 3

Fedora 1.1.6 rpm build BROKEN
by Jacob Jarick 19 Apr '07

19 Apr '07

The deps have incorrect names, ie requests apache2-devel but fedora calls it httpd2-devel and so on. So atm, rpm building completely broken, any comments / suggestions are welcome. I will be going back to compiling from source until the bins are resolved. I suppose I could use some "random rpm" for 1.1.6 or compile the source but for now I will go back to using 1.1.3 that is provided with fedora (it installs without dep errors). ---------- Forwarded message ---------- From: Jacob Jarick <mem.namefix(a)gmail.com> Date: Apr 19, 2007 10:18 AM Subject: 1.1.6 rpm build errors To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Notes: * The wiki glosses over a little and gives u an incorrect dir * the spec file expects 1.1.5 tar.gz # cd /usr/src # tar zxvf /root/Desktop/freeradius-1.1.6.tar.gz # cp /root/Desktop/freeradius-1.1.6.tar.gz /usr/src/redhat/SOURCES/freeradius-1.1.5.tar.gz # cp freeradius-1.1.6/suse/freeradius.spec /usr/src/redhat/SPECS/ # rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec ^ that gets me to this point here: [root@localhost src]# rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found error: Failed build dependencies: apache2-devel is needed by freeradius-1.1.5-0.generic.i386 db-devel is needed by freeradius-1.1.5-0.generic.i386 gettext-devel is needed by freeradius-1.1.5-0.generic.i386 mysql-devel is needed by freeradius-1.1.5-0.generic.i386 net-snmp-devel is needed by freeradius-1.1.5-0.generic.i386 openldap2-devel is needed by freeradius-1.1.5-0.generic.i386 postgresql-devel is needed by freeradius-1.1.5-0.generic.i386 unixODBC-devel is needed by freeradius-1.1.5-0.generic.i386 now checking yum and smart --gui I do not see apache2-devel for starters. So for the mean time I am back to compiling as rpm's are causing the issues they are famous for. If some1 has some tips on resolving dependancies I will be intrested. But I do not see what it needs apache2 headers anyway.

4 8

rlm_sql: readclients segmentation fault
by Milan Holub 19 Apr '07

19 Apr '07

Hi Alan, with the latest cvs head I've experienced following serious bug: radiusd.conf: ... listen { ipaddr = * port = 0 type = auth } listen { ipaddr = * port = 0 type = acct } ... clients.conf: client 127.0.0.1 { secret = testing123 shortname = localhost } sql.conf: ... readclients = yes ... When starting rlm_sql says it's adding nases from DB: freeradius -X: >>>BEGIN DEBUG ... rlm_sql (sql): Read entry nasname=a.b.c.d,shortname=wlan-gw33,secret=secret rlm_sql (sql): Adding client a.b.c.d (wlan-gw33) to clients list rlm_sql (sql): Released sql socket id: 4 ... >>>END DEBUG When testing freeradius with radclient from localhost it works OK. However when sending some request from eg. nas a.b.c.d(wlan-gw33) we ends up with segmentation fault: >>>BEGIN DEBUG Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host a.b.c.d port 42926, id=82, length=46 (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1024 (LWP 16225)] 0x08052987 in client_listener_find () (gdb) (gdb) (gdb) bt #0 0x08052987 in client_listener_find () #1 0x080590df in main () #2 0x4024714f in __libc_start_main () from /lib/libc.so.6 >>>END DEBUG I can confirm that at least cvs build from 6.4. 2007 did not have such a bug. Thus obviously there must be something rotten in latest cvs commits... Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

3 12