April 2007 - Freeradius-Users - lists.freeradius.org

configurable failover & segmentation fault when reloaded
by Milan Holub 19 Apr '07

19 Apr '07

Hi all, here is another bug report(but don't worry; I'm running out of my bugreports): I used to have following attr_rewrite in modules section: attr_rewrite fix_sqlcounter_reply { attribute = Reply-Message searchin = reply searchfor = "Your maximum never usage time has been reached" replacewith = "LoginNoCredit" ignore_case = no new_attribute = no max_matches = 1 append = no } and following "configurable failover" section under authorize: group { noresetcounter { reject = 1 ok = return noop = return } fix_sqlcounter_reply { ok = reject } } group { noresetcounterflat { reject = 1 ok = return noop = return } fix_sqlcounter_reply { ok = reject } } ...using cvs head I'm not using this config anymore since it was a silly workaround for an issue which was fixed differently. BUT it's the valid config and I want to point out that there is a bug when re-reading configuration containing "failover sections" after HUP. This bug causes segmentation fault: Program received signal SIGSEGV, Segmentation fault. 0x4029bc1b in free () from /lib/libc.so.6 (gdb) bt #0 0x4029bc1b in free () from /lib/libc.so.6 #1 0x4029baa3 in free () from /lib/libc.so.6 #2 0x0804ee49 in cf_data_free (cd=0xbfffe470) at conffile.c:187 #3 0x0804f194 in cf_section_free (cs=0xbfffe4a4) at conffile.c:343 #4 0x0804f1b3 in cf_section_free (cs=0xbfffe4d4) at conffile.c:337 #5 0x0804f1b3 in cf_section_free (cs=0x8079e50) at conffile.c:337 #6 0x0805570c in read_mainconfig (reload=1) at mainconfig.c:836 #7 0x08058d2a in main (argc=2, argv=0xbffffb94) at radiusd.c:540 (gdb) up #1 0x4029baa3 in free () from /lib/libc.so.6 (gdb) up #2 0x0804ee49 in cf_data_free (cd=0xbfffe470) at conffile.c:187 187 free((*cd)->name); (gdb) list 182 183 static void cf_data_free(CONF_DATA **cd) 184 { 185 if (!cd || !*cd) return; 186 187 free((*cd)->name); 188 if (!(*cd)->free) { 189 free((*cd)->data); 190 } else { 191 ((*cd)->free)((*cd)->data); (gdb) print (*cd)->name $1 = 0x81fda70 "instance`" (gdb) print (*cd)->item $2 = {next = 0x0, parent = 0x807d800, lineno = 0, type = CONF_ITEM_DATA} (gdb) print (*cd)->item->parent $3 = (struct conf_part *) 0x807d800 (gdb) print (*cd)->item->parent->name1 $4 = 0x807d840 "attr_rewrite" (gdb) print (*cd)->item->parent->name2 $5 = 0x807d858 "fix_sqlcounter_reply" (gdb) ==> I wonder especially where the $1 = 0x81fda70 "instance`" comes from... This should be probably fixed before 2.0 released... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

rlm_ldap: ldap_search() failed: Operations error - advice please
by Jacob Jarick 19 Apr '07

19 Apr '07

Freeradius 1.1.3 installed via YUM on Fedora (not suse :P) radiusd.conf: http://pastebin.ca/447690 radiusd -X -A output: http://pastebin.ca/447693 domain: tfxschool.internal ADS: tfxschoolfs01.tfxschool.internal Hi again people, I have been pouring through the oreillys LDAP book (quite informative so far to btw). I got the example of using freeradius against the linux passwd file working fine. I tried their Freeradius and OpenLDAP (now I know ADS isnt OpenLDAP btw) and it fails with the following message: rlm_ldap: ldap_search() failed: Operations error Oriellys one reccomended for OpenLDAP (errors, possibly due to incorrect syntax ?): filter = "(&(objectclass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" Default filter (Fails with same search error): filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" Im wondering if it is perhaps my basedn ?, Im still getting used to the idea of them, the user jacob (me) resides in the ou people FYI. basedn = "ou=people,dc=tfxschool,dc=internal" Thats all my info atm, Im currently compiling a 1.1.6 rpm (after Alan resolving my silly little mistake) and will test then report back as I feel its more likely a config error than a bug :) If some1 else has a working radius setup that auths againts AD using LDAP would they mind sending me the ldap { } section, would be very handy to compare my config to a working one. Thanks all, keep up the good work.

2 2

Re: PAM Radius Authentication
by daniel 19 Apr '07

19 Apr '07

Ok, I have gotten pam_radius_auth.so to work and it is working well, however, is there any way to get it to create a UID when it receives an auth accept? At the moment I have to run adduser every time I want a user to be able to log in, this would be ok if the users were fairly static, I could run a script every night to add new users to the system, unfortunately I have a lot of users and they need to be available immediately. Thanks for all your help so far. -Daniel Davis

3 4

SNMP with 1.1.6 and Net-SNMP 5.3
by Stefan Winter 19 Apr '07

19 Apr '07

Hi, trying for the first time to get SNMP working, and I have come to a point where I'm really startled why stuff doesn't work. I've configured FreeRADIUS 1.1.6 with SNMP, and it's printing out that it is starting up the SMUX connection. Then the snmpd refuses the SMUX connection. This would usually mean I screwed up the shared secret, but I'm very sure I haven't. I even verified with tcpdump that FR sends the correct secret on the loopback "wire". So the problem would appear to be that Net-SNMP is confused wrt the secret. But I configured it with the line smuxpeer .1.3.6.1.4.1.3317.1.3.1 verysecret (also without the leading dot, in my desperation, didn't help). The password *is* verysecret on the FR side. Debug output says: ... Module: Instantiated detail (nas_reply_log) main: smux_password = "verysecret" main: snmp_write_access = no SMUX connect try 1 SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: verysecret SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register message send failed: Broken pipe Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. The broken pipe is because Net-SNMP closes the connection, it's log says: [smux_accept] accepted fd 9 from 127.0.0.1:4580 refused smux peer: oid SNMPv2-SMI::enterprises.3317.1.3.1, descr radiusd and tcpdump reveals that the reason for refusing is authenticationFailure. Anyone else running a similar config? It's the version of Net-SNMP that came as RPM on SUSE 10.1. FR compiled freshly. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 4

1.1.6 rpm build errors
by Jacob Jarick 19 Apr '07

19 Apr '07

Notes: * The wiki glosses over a little and gives u an incorrect dir * the spec file expects 1.1.5 tar.gz # cd /usr/src # tar zxvf /root/Desktop/freeradius-1.1.6.tar.gz # cp /root/Desktop/freeradius-1.1.6.tar.gz /usr/src/redhat/SOURCES/freeradius-1.1.5.tar.gz # cp freeradius-1.1.6/suse/freeradius.spec /usr/src/redhat/SPECS/ # rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec ^ that gets me to this point here: [root@localhost src]# rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found error: Failed build dependencies: apache2-devel is needed by freeradius-1.1.5-0.generic.i386 db-devel is needed by freeradius-1.1.5-0.generic.i386 gettext-devel is needed by freeradius-1.1.5-0.generic.i386 mysql-devel is needed by freeradius-1.1.5-0.generic.i386 net-snmp-devel is needed by freeradius-1.1.5-0.generic.i386 openldap2-devel is needed by freeradius-1.1.5-0.generic.i386 postgresql-devel is needed by freeradius-1.1.5-0.generic.i386 unixODBC-devel is needed by freeradius-1.1.5-0.generic.i386 now checking yum and smart --gui I do not see apache2-devel for starters. So for the mean time I am back to compiling as rpm's are causing the issues they are famous for. If some1 has some tips on resolving dependancies I will be intrested. But I do not see what it needs apache2 headers anyway.

2 2

Howto compile 1.1.6 on Fedora 6
by Jacob Jarick 18 Apr '07

18 Apr '07

Thanks to the people who helped me figure this out (big thanks to Alan), this works perfectly on a fresh Fedora system. Download, compile and install openssl download freeradius 1.1.6 unpack in usr/src cd freeradius-1.1.6 ./configure --prefix=/usr --with-openssl-includes=/usr/local/ssl/include --with-openssl-libraries=/usr/local/ssl/lib/ --disable-libtool-lock --with-system-libtool --sysconfdir=/etc (^all one line) make make install That should also put everything where the rpm normally does (yuck) so should u upgrade later you wont have lib conflicts. All the best.

5 9

active directory host authentication
by Joe Vieira 18 Apr '07

18 Apr '07

Hi, Using freeradius 1.1.5 samba 3.0.24...i have an interesting problem, and was curious what methods other people would take to solve it. I am setting up radius for our new wpa2 wireless network, which means that windows machine auth should work so that people can LOGIN to their laptops. i have it working (with a slight hack). when a windows xp machine sends its machine auth to radius it sends host/machinename.activedirectorydomain.domain.domain. so freeradius takes the activedirectorydomain part of that and assumes that the domain's actual name (what you use for authentication) in our case....blame the windows people, that is NOT the case. example computer.ad.clarku.edu is the dns name...however that computer is actually joined to the CLARKU domain..so the authentication needs to be against the CLARKU domain as the AD domain doesn't exist. does that make sense? any ideas? the hack i have in place is a hardcoded domain of CLARKU in the NTLM_AUTH check(this can't stay as we have multiple domains). thanks in advance for any insight. Joe

2 5

Technical support
by Jacob Jarick 18 Apr '07

18 Apr '07

Hello, Im looking for a company that can provide professional level of technical support. If any one here can reccomend one I would appreciate it. I am after technical support, due to lack of good documentation on the freeradius project. Most the stuff I need done has only incomplete docs.

2 5

Radius 2.0.0-pre Making all in main compilation error
by tzieleniewski 18 Apr '07

18 Apr '07

Hi, I have just downloaded the CVS trunk sources. When I compile them I get the following errors: Please point me what do I miss. Making all in main... make[4]: Entering the directory `/home/radius/src/radiusd/src/main' /home/radius/src/radiusd/libtool --mode=link gcc -export-dynamic -dlopen self \ -pie -o radiusd acct.lo auth.lo client.lo conffile.lo crypt.lo exec.lo files.lo listen.lo log.lo mainconfig.lo modules.lo modcall.lo radiusd.lo radius_snmp.lo session.lo smux.lo threads.lo util.lo valuepair.lo version.lo xlat.lo event.lo realms.lo \ ../lib/libradius.la -lnsl -lresolv -lpthread -lsnmp \ -lcrypt -lltdl -lcrypto -lssl -lcrypto rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT creating .libs/radiusdS.c (cd .libs && gcc -g -O2 -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -pie -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/radius_snmp.o .libs/session.o .libs/smux.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o -Wl,--export-dynamic ../lib/.libs/libradius.so -lnsl -lresolv -lpthread /usr/lib/libsnmp.so -lcrypt /usr/lib/libltdl.so -ldl -lssl -lcrypto -Wl,--rpath -Wl,/home/radius/freeradius/lib collect2: ld returned 1 exit status make[4]: *** [radiusd] Błąd 1 make[4]: Leaving the directory `/home/radius/src/radiusd/src/main' make[3]: *** [common] Błąd 2 make[3]: Leaving the directory `/home/radius/src/radiusd/src' make[2]: *** [all] Błąd 2 make[2]: Leaving the directory `/home/radius/src/radiusd/src' make[1]: *** [common] Błąd 2 make[1]: Leaving the directory `/home/radius/src/radiusd' make: *** [all] Błąd 2 Thanks in advance Cheers Tomasz

2 1

How to force the group processing?
by tzieleniewski 18 Apr '07

18 Apr '07

Hi, How can I force the group processing after the positive authentication with the radcheck table. I want to achieve the following: after I authenticate the user I would like to add a reply attribute if the user belongs to the particular group. Thank you in advance. Tomasz

2 1