November 2009 - Freeradius-Users - lists.freeradius.org

Crash due to fr_packet_cmp
by fabiana marvani 15 Nov '09

15 Nov '09

Hello , I have a big problem with my freeradius ... After some time with load the freeradius crashes We first noticed this crash with our plugins activated, but then we deactivated all plugins and used "default" configuration: /usr/local/etc/raddb/users: DEFAULT Auth-Type := Accept Reply-Message = "test freeradius" /usr/local/etc/raddb/sites-enabled/default authorize { files } accounting { ok } and crashes still occured. This crash has been observed while load testing, so there is no debug logs. Crash time appears to be dependant on load: 1400 req/s >> 4h - 6h 700 req/s >> 8h - 10h An analyse of core files shows the same error in accounting or authentication: core.8555 Program terminated with signal 11, Segmentation fault. (gdb) bt #0 fr_packet_cmp (a=0xb4897cd8, b=0x0) at packet.c:139 #1 0x00c80d98 in packet_entry_cmp (one=0xbf89cf94, two=0x8e21a80) at packet.c:400 #2 0x00c71b39 in list_find (ht=0x8d49520, head=<value optimized out>, reversed=285904539, data=0xbf89cf94) at hash.c:191 #3 0x00c71c43 in fr_hash_table_find (ht=0x8d49520, data=0xbf89cf94) at hash.c:461 #4 0x00c71c71 in fr_hash_table_finddata (ht=0x8d49520, data=0xbf89cf94) at hash.c:491 #5 0x00c80a29 in fr_packet_list_find (pl=0xc80d70, request=0xb4897cd8) at packet.c:536 #6 0x0806cf83 in received_request (listener=0x8d4f608, packet=0xb4897cd8, prequest=0xbf89d0dc, client=0x8d2fc80) at event.c:2723 #7 0x0805ab24 in acct_socket_recv (listener=0x8d4f608, pfun=0xbf89d0e0, prequest=0xbf89d0dc) at listen.c:889 #8 0x08068e00 in event_socket_handler (xel=0x8d49d70, fd=6, ctx=0xc80d70) at event.c:3288 #9 0x00c81b05 in fr_event_loop (el=0x8d49d70) at event.c:400 #10 0x080698c6 in radius_event_process () at event.c:3632 #11 0x080620ca in main (argc=1, argv=0xbf89d334) at radiusd.c:398 === core.21300 (gdb) bt #0 fr_packet_cmp (a=0xb2d7a858, b=0x0) at packet.c:139 #1 0x00457d98 in packet_entry_cmp (one=0xbf8e0fe4, two=0xb2f316e8) at packet.c:400 #2 0x00448b39 in list_find (ht=0x8e3d590, head=<value optimized out>, reversed=640351498, data=0xbf8e0fe4) at hash.c:191 #3 0x00448c43 in fr_hash_table_find (ht=0x8e3d590, data=0xbf8e0fe4) at hash.c:461 #4 0x00448c71 in fr_hash_table_finddata (ht=0x8e3d590, data=0xbf8e0fe4) at hash.c:491 #5 0x00457a29 in fr_packet_list_find (pl=0x457d70, request=0xb2d7a858) at packet.c:536 #6 0x0806cf83 in received_request (listener=0x89819a0, packet=0xb2d7a858, prequest=0xbf8e112c, client=0x896ac98) at event.c:2723 #7 0x0805af38 in auth_socket_recv (listener=0x89819a0, pfun=0xbf8e1130, prequest=0xbf8e112c) at listen.c:801 #8 0x08068e00 in event_socket_handler (xel=0x8e3b920, fd=9, ctx=0x457d70) at event.c:3288 #9 0x00458b05 in fr_event_loop (el=0x8e3b920) at event.c:400 #10 0x080698c6 in radius_event_process () at event.c:3632 #11 0x080620ca in main (argc=1, argv=0xbf8e1384) at radiusd.c:398 I need help :( have a fun Fabiana

2 1

Re: usergroup and radgroupcheck problem!
by Hamid Reza Hasani 15 Nov '09

15 Nov '09

Hi,(salaam) Thanks for your help, But I solved the problem and I changed the radgroupcheck query so it get groupname from usergroup table and then compare it! I think I have a better solution, isn't it? BTW thank for your help, please inform me if you know why this problem exist? is it a bug? Ya Ali Hamid Reza Hasani

1 0

Re: Freeradius-Users Digest, Vol 55, Issue 63
by Gilbert Lo 15 Nov '09

15 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Re: Freeradius-Users Digest, Vol 55, Issue 62
by Gilbert Lo 14 Nov '09

14 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

usergroup and radgroupcheck problem!
by Hamid Reza Hasani 14 Nov '09

14 Nov '09

Hi, (Salam) I'm using last version of freeradius. when my users are going to connect, I see this message: [sql] expand: %{User-Name} -> myuser [sql] sql_set_user escaped user --> 'myuser' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'myuser' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM usergroup WHERE username = 'myuser' ORDER BY priority [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'myuser' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'myuser' ORDER BY id [sql] User found in group test [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop ++[expiration] returns noop ++[logintime] returns noop if you look at them carefully, you can see there is a bit problem! my freeradius is read radgroupcheck before usergroup table, so it can't recognize user's group name for radgroupcheck query! so it can't read radgroupcheck attributes! where is my fault? can I change it priority? thanks Ya Ali Hamid Reza Hasani

2 3

How to store multiple Cisco-AVPair to sql database
by Mark Jones 14 Nov '09

14 Nov '09

As you can see in the below accounting packet there are multiple cisco-avpsir entries. how can i referecne the second and seccussive entries when trying to store them in and sql database. Fri Nov 13 10:56:23 2009 Acct-Session-Id = "004D8A64" Cisco-AVPair = "client-mac-address=0024.016f.3054" Framed-Protocol = PPP Framed-IP-Address = User-Name = "downs(a)mnsi.net" Acct-Authentic = RADIUS Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=37500000" Cisco-AVPair = "nas-rx-speed=37500000" Acct-Session-Time = 300 Acct-Input-Octets = 666 Acct-Output-Octets = 708 Acct-Input-Packets = 52 Acct-Output-Packets = 53 Acct-Terminate-Cause = User-Request Cisco-AVPair = "disc-cause-ext=PPP Receive Term" Acct-Status-Type = Stop NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "1/0/0/3.33" Service-Type = Framed-User NAS-IP-Address = Acct-Delay-Time = 1 Client-IP-Address = Hint = "" Acct-Unique-Session-Id = "f60485a6cb583511" Stripped-User-Name = "dow" Realm = "" Timestamp = 1258127783 Mark Jones London Operations Managed Network Systems Desk 519-679-5207

2 1

WiMAX-Capabilty proxy issue
by Ramon J. Castillo 13 Nov '09

13 Nov '09

Dear all; I'm having an issue when proxying an access-request message between two WiMAX networks. I recently downloaded FR 2.1.8 and I'm in the middle of the messaging path. The home network is using EAP-TLS but it should be transparent for the proxy right? The issue is with the AVP WiMAX-Capability(1) please see below the packets captured (shown as in WireShark) Sending network AVP before FR proxy as arrived: AVP: l=17 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=11 t=WiMAX-Capability(1) C=0x00: 2 TLV(s) inside TLV: l=5 t=WiMAX-Release(1): 1.4 WiMAX-Release: 1.4 TLV: l=3 t=WiMAX-Accounting-Capabilities(2): No-Accounting(0) WiMAX-Accounting-Capabilities: No-Accounting (0) After proxy from FR to the Home network AVP: l=17 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=11 t=WiMAX-Capability(1) C=0x00: TLV: l=7 t=WiMAX-Release(1): 1.4\002\005 WiMAX-Release: 1.4\002\005 [Not enough room in packet for TLV header] The home network AAA complains with the error message that can not decode the AVP WiMAX-Capabilty. Any ideas why and what can I do to fix it are very much appreciated Merci Thanks a lot Vielen Dank! Gracias Ramon

2 2

Compiling freeradius server with static libraries
by kachin Agarwal 13 Nov '09

13 Nov '09

Hi, How to compile the freeradius server using static library function?? Thanx & Regards, kachin Add whatever you love to the Yahoo! India homepage. Try now! http://in.yahoo.com/trynew

2 1

Microsoft: SmardCard or Certificate Auth
by swatzy 13 Nov '09

13 Nov '09

Hi: I'm trying to configure a FreeRadius server to perform a certification authentication from a Windows Laptop. I have follow the steps at http://wiki.freeradius.org/WPA_HOWTO#HOWTO_Do_It:_An_Outline But when I try to do the connection, it never ends... and I get peridical messeges at the FreeRadius server ouput in this way... rad_recv: Access-Request packet from host 160.103.180.252:32769, id=0, length=176 User-Name = "radiusserv" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x0202000f0172616469757373657276 Message-Authenticator = 0x978d232412c863306539d3ad92c9d6b8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "radiusserv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 179 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 160.103.180.252 port 32769 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc321c12ede0c59624273d465195058be Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 160.103.180.252:32769, id=1, length=300 User-Name = "radiusserv" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x020300790d800000006f160301006a0100006603014af93134b45308b2252422bb395d6ce641bfdc48695e46696178ab4d4b407442000018002f00350005000ac009c00ac013c0140032003800130004010000250000000f000d00000a72616469757373657276000a00080006001700180019000b00020100 State = 0xc321c12ede0c59624273d465195058be Message-Authenticator = 0x209186e1eb149efd3ce2e8796100a977 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "radiusserv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 users: Matched entry DEFAULT at line 179 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 006a], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0283], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0085], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 160.103.180.252 port 32769 EAP-Message = 0x0104036b0d8000000361160301004a0200004603014af93134a0ad2fc9103447a6a53e1bd7b8e1a2581b8e10093af80ed2eb04a3b420561e9f8d80da1f899a98dce9e25e4ee70e780ba01becdc9ba1deb915f60224a4002f0016030102830b00027f00027c00027930820275308201dea003020102020100300d06092a864886f70d01010505003074310b3009060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a130445535246311330110603550403130a72616469757373657276311e301c06092a864886f70d010901160f6e6574776f726b40657372662e6672 EAP-Message = 0x301e170d3039313130333136353833315a170d3130313130333136353833315a3074310b3009060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a130445535246311330110603550403130a72616469757373657276311e301c06092a864886f70d010901160f6e6574776f726b40657372662e667230819f300d06092a864886f70d010101050003818d0030818902818100b8fd3330a5f8ed59944b0ab8f162332223f749059609e5dd68c5efeced0434e500b7178aa3d9ffe32679034200952f14c64f321c851ee7254e78210ad1b8b0420980fb43fa1adf2f89b8 EAP-Message = 0x56fadc8092ef42b1f507a02fc81ab60ed258c3fb079f8d709d8821164011516b7d4d4589ff86306ce61f98130a360ebb3182983900c30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810091d8dca090d57b08a7731dd90db757ed0da0e534cfda5565b6220528e37edadf12944d2fc1c6398e418a99b636904e2b1c4152f614bc5f0b3c4309cf264f27b794e28242ee02bb6ea48d0e3b1440b69ad926bb080ccebc20c3f1ef3b23a9e7868b2a86303b82ee891e9829dd1d6750837c8d533df59899ddaf9c2350b46992ae16030100850d00007d020102007800763074310b3009 EAP-Message = 0x060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a130445535246311330110603550403130a72616469757373657276311e301c06092a864886f70d010901160f6e6574776f726b40657372662e66720e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa8f213a60ac152b2e7e42048e94461f9 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 160.103.180.252:32769, id=2, length=185 User-Name = "radiusserv" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x020400060d00 State = 0xa8f213a60ac152b2e7e42048e94461f9 Message-Authenticator = 0xe9f04c151b954deb2b5e5c1ca7032f53 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "radiusserv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 179 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 160.103.180.252 port 32769 EAP-Message = 0x0105000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x09770a67d71842c41d63756db81b29fc Finished request 2 Going to the next request Waking up in 6 seconds... ------------------------------------- Any ideas what i'm doing wrong? -- View this message in context: http://old.nabble.com/Microsoft%3A-SmardCard-or-Certificate-Auth-tp26280525… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Proxy to multiple servers in FR 2.1.7
by Patric 13 Nov '09

13 Nov '09

Hi again all :) I am attempting to proxy all accounting packets to 2 servers. In my proxy.conf I am using a default realm. realm DEFAULT { acct_pool = my_acct_failover nostrip } I create a home_server entry for each server, and add them to the home_server_pool for that realm: home_server copy-acct-to-home-server { } home_server copy-acct-to-home-server2 { } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server home_server = copy-acct-to-home-server2 } If I have site-enable/copy-acct-to-home-server it then appears to work in a fail-over method, where it will send to the first server until it is not reachable, then it sends to the second server. Is there a way I can configure this to send to both at once? Do I need a second site-enable/copy-acct-to-home-server1 file that reads from a different detail file? I am using the default realm so I dont know how to setup a second home_server_pool either... Any help is much appreciated, Im going in circles :) Many thanks Patric

3 6