July 2010 - Freeradius-Users - lists.freeradius.org

RadSQLRelay
by Marius Pesé 08 Jul '10

08 Jul '10

Hi everyone, We are still struggling to get our FreeRadius2 servers running on CentOS5.5 to relay accounting packages to one another. Right now I have one FR2 server with a local mySQL database and one additional machine just running mysqld. The FR2 machine writes it's own database and the textfile with the queries without problems. However if we start radsqlrelay (radsqlrelay -d mysql -b freeradius -h 196.25.xxx.xxx -u root -p xxxx /var/log/radius/radacct/relay/sql-relay) it opens quite a few connections to the secondary database, but does not seem to use the text file with the queries, also it does not give any debug output, regardless of the -x option. Tried both path and path+file for the filename, hostname and IP for the the secondary database system. Without debugging output fairly hard to figure out. Anybody else know this problem? Regards Marius

3 4

radius dont work
by Aziz YÜCELEN 08 Jul '10

08 Jul '10

Hi I am using freeradius version 2.1.4 and I want to set up config to eap TTLS using users and clients file but didnt work.Please help me.Thanks. ***************OUTPUT************************************Finished request 18.Going to the next requestWaking up in 2.0 seconds.Cleaning up request 17 ID 18 with timestamp +75Waking up in 2.9 seconds.rad_recv: Access-Request packet from host 10.1.1.252 port 1206, id=20, length=183 User-Name = "deneme" NAS-IP-Address = 10.1.1.252 NAS-Port = 0 Called-Station-Id = "00-30-4F-44-3D-C1" Calling-Station-Id = "00-18-DE-88-62-77" NAS-Identifier = "WirelessAccessPoint" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0211002219001703010017a5491ed47f0de82246939132f8766cf3c1a85f8c211be5 State = 0x56c2eb4850d3f233efbb27b16d1adb57 Message-Authenticator = 0x1ea576935b901d2c1f156615504ed0da+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop[suffix] No '@' in User-Name = "deneme", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] EAP packet type response id 17 length 34[eap] Continuing tunnel setu! p.++[eap] returns okFound Auth-Type = EAP+- entering group authenticate {...}[eap] Request found, released from the list[eap] EAP/peap[eap] processing type peap[peap] processing EAP-TLS[peap] eaptls_verify returned 7 [peap] Done initial handshake[peap] eaptls_process returned 7 [peap] EAPTLS_OK[peap] Session established. Decoding tunneled attributes.[peap] Identity - deneme[peap] Got tunneled request EAP-Message = 0x0211000b0164656e656d65server { PEAP: Got tunneled identity of deneme PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to denemeSending tunneled request EAP-Message = 0x0211000b0164656e656d65 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "deneme"server inner-tunnel {No authenticate method (Auth-Type) configuration found for the request: Rejecting the userFailed to authenticate the user.} # server inner-tunnel[peap] Got tunneled reply code 3[peap] Got tunneled reply RADIUS code 3[peap] Tunneled authentication was rejected.[peap! ] FAILURE++[eap] returns handledSending Access-Challenge of id 20 to 1 0.1.1.252 port 1206 EAP-Message = 0x011200261900170301001b3f825aee84e1fd23b0089c976f25f2f4054e5c93627e072882688f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x56c2eb4851d0f233efbb27b16d1adb57Finished request 19.Going to the next requestWaking up in 1.9 seconds.Cleaning up request 18 ID 19 with timestamp +78Waking up in 2.9 seconds.rad_recv: Access-Request packet from host 10.1.1.252 port 1206, id=21, length=187 User-Name = "deneme" NAS-IP-Address = 10.1.1.252 NAS-Port = 0 Called-Station-Id = "00-30-4F-44-3D-C1" Calling-Station-Id = "00-18-DE-88-62-77" NAS-Identifier = "WirelessAccessPoint" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021200261900170301001bd0f786fe5ec27d325f117cb1c6314a2fc09664e18d31038aaa2a5f State = 0x56c2eb4851d0f233efbb27b16d1adb57 Message-Authenticator = 0xe4dd7f51a3fd9548338084267728d316+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop++[mschap] returns noop[suffix] No '@' in User! -Name = "deneme", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] EAP packet type response id 18 length 38[eap] Continuing tunnel setup.++[eap] returns okFound Auth-Type = EAP+- entering group authenticate {...}[eap] Request found, released from the list[eap] EAP/peap[eap] processing type peap[peap] processing EAP-TLS[peap] eaptls_verify returned 7 [peap] Done initial handshake[peap] eaptls_process returned 7 [peap] EAPTLS_OK[peap] Session established. Decoding tunneled attributes.[peap] Received EAP-TLV response.[peap] Had sent TLV failure. User was rejected earlier in this session.[eap] Handler failed in EAP/peap[eap] Failed in EAP select++[eap] returns invalidFailed to authenticate the user.Using Post-Auth-Type Reject+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> deneme attr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 20 for 1 secondsG! oing to the next requestWaking up in 0.9 seconds.Sending delayed rejec t for request 20Sending Access-Reject of id 21 to 10.1.1.252 port 1206 EAP-Message = 0x04120004 Message-Authenticator = 0x00000000000000000000000000000000Waking up in 0.9 seconds.Cleaning up request 19 ID 20 with timestamp +81Waking up in 3.9 seconds. ************EAP.conf********************# -*- text -*-#### eap.conf -- Configuration for EAP types (PEAP, TTLS, etc.)#### $Id$ ######################################################################## eap { # default_eap_type = ttls # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # # Help prevent DoS attacks by limiting the number of # sessions that the server is tracking. Most systems # can handle ~30 EAP sessions/s, so the default limit # of 2048 is more than enough. max_sessions = 2048 # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } # Cisco LEAP # leap { } # Generic Token Card. gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " auth_type = PAP } ## EAP-TLS # # See raddb/certs/README for additional comments # on certificates. # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { # # These is used to simplify later configurations. # certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = 123456 private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random # fragment_size = 1024 # include_length = yes # check_crl = yes # # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} # cipher_list = "DEFAULT" # make_cert_command = "${certdir}/bootstrap" cache { # # Enable it. The default is "no". # Deleting the entire "cache" subsection # Also disables caching. # # You can disallow resumption for a # particular user by adding the following # attribute to the control item list: # # Allow-Session-Resumption = No # # If "enable = no" below, you CANNOT # enable resumption for just one user # by setting the above attribute to "yes". # enable = no # # Lifetime of the cached entries, in hours. # The sessions will be deleted after this # time. # lifetime = 24 # hours # # The maximum number of entries in the # cache. Set to "0" for "infinite". # # This could be set to the number of users # who are logged in... which can be a LOT. # max_entries = 255 } } ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. default_eap_type = md5 # allowed values: {no, yes} copy_request_to_tunnel = no # allowed values: {no, yes} use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. default_eap_type = mschapv2 # the PEAP module also has these configuration # items, which are the same as for TTLS. copy_request_to_tunnel = no use_tunneled_reply = no # When the tunneled session is proxied, the # home server may not understand EAP-MSCHAP-V2. # Set this entry to "no" to proxy the tunneled # EAP-MSCHAP-V2 as normal MSCHAPv2. # proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } mschapv2 { } } ***************** inner-tunnel ***********# -*- text -*-######################################################################## This is a virtual server that handles *only* inner tunnel# requests for EAP-TTLS and PEAP types.## $Id$####################################################################### server inner-tunnel {authorize { suffix unix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files pap chap mschap# IPASS # ntdomain # See "Authorization Queries" in sql.conf# sql # # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above.# etc_smbpasswd # # The ldap module will set Auth-Type to LDAP if it has not # already been set# ldap # # Enforce daily limits on time spent logged in.# daily # # Use the checkval module# checkval expiration logintime} # Authentication.authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # Pluggable Authentication Modules.# pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # #unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password.# Auth-Type LDAP {# ldap# } # # Allow EAP authentication. eap} ######################################################################## There are no accounting requests inside of EAP-TTLS or PEAP# tunnels.####################################################################### # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this.# The rlm_sql module is *much* fastersession { radutmp # # See "Simultaneous Use Checking Queries" in sql.conf# sql} # Post-Authentication# Once we KNOW that the user has been authenticated, there are# additional steps we can take.post-auth { # Note that we do NOT assign IP addresses here. # If you try to assign IP addresses for EAP authentication types, # it WILL NOT WORK. You MUST use DHCP. # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf# sql # # Instead of sending the query to the SQL server, # write it into a log file. ## sql_log # # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. ## ldap # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { attr_filter.access_reject } } ## When the server decides to proxy a request to a home server,# the proxied request is first passed through the pre-proxy# stage. This stage can re-write the request, or decide to# cancel the proxy.## Only a few modules currently have this method.#pre-proxy {# attr_rewrite # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file.# files # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file.# attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. pre_proxy_log} ## When the server receives a reply to a request it proxied# to a home server, the request may be massaged here, in the# post-proxy stage.#post-proxy { # If you want to have a log of replies from a home server, # un-comment the following line, and the 'detail post_proxy_log' # section, above. post_proxy_log # attr_rewrite # Uncomment the following line if you want to filter replies from # remote proxies based on the rules defined in the 'attrs' file.# attr_filter.post-proxy # # If you are proxying LEAP, you MUST configure the EAP # module, and you MUST list it here, in the post-proxy # stage. # # You MUST also use the 'nostrip' option in the 'realm' # configuration. Otherwise, the User-Name attribute # in the proxied request will not match the user name # hidden inside of the EAP packet, and the end server will # reject the EAP request. # eap ## Post-Proxy-Type Fail {# detail# } } } # inner-tunnel server block _________________________________________________________________ Windows Live Hotmail: Arkadaşlarınız Facebook'taki güncellemelerinizi doğrudan Hotmail®'den alır. http://www.microsoft.com/windows/windowslive/see-it-in-action/social-networ…

2 9

Re: ntlm_auth fails for none domain
by John 08 Jul '10

08 Jul '10

Sorry. I did not set the 'xjtu' in the first time. But I set 'xjtu' after that. Pls see the second mail I wrote. I put ntlm_auth line to file 'mschap'. The attached file is my 'mschap' and the related debug info. --- 10年7月5日，周一, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> 写道：发件人: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月5日,周一,下午4:53 Hi, no...you havent added it. look, heres the debug you supplied > It is the related part in configuration file: > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" > > > It is debug info: > [mschap] Told to do MS-CHAPv2 for hhe with NT-Password > [mschap] No NT-Domain was found in the User-Name. > [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain= ^^^^^^^^^^^^^^^^^^^^^^^^^^^ where is xjtu mentioned there? is isnt. WHERE did you put the ntlm_auth line? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

freeradius 2.1.9 segfault
by Fred MAISON 07 Jul '10

07 Jul '10

Hi all, I found a segfault on radiusd in dmesg. This production server has been installed since 2010/06/03 with no problems. CentOS release 5.5 (Final) radiusd: FreeRADIUS Version 2.1.9, for host x86_64-redhat-linux-gnu, built on Jun 2 2010 at 22:11:51 radiusd[5198]: segfault at 0000000000000038 rip 000000000040fde8 rsp 00007fff3b994e50 error 4 Unfortunately, I have not been able to find the date of the issue ... Does this seems to you a known issue ? If not, what may I do to further investigate ? Best regards Fred MAISON

2 1

Restricting certain users access to certain NAS devices
by Whitmarsh Mark (Leeds Teaching Hospitals NHS Trust) 07 Jul '10

07 Jul '10

Hi All, We are using Freeradius to authenticate network administrators when they login to their switches and routers. The setup is working fine as follows: User telnets to switch and enters username and password. Switch passes authentication request to Freeradius. Freeradius authenticates user against AD. The users are all defined in the users file - the lines I've added or changed from default are below: superuser1 Auth-Type = ntlm_auth superuser2 Auth-Type = ntlm_auth loweruser1 Auth-Type = ntlm_auth loweruser2 Auth-Type = ntlm_auth DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "You are not permitted to access this system" The idea is that superusers are allowed to login to any of the 200 network devices whilst users are only allowed to login to a subset of say 50 devices. It's straightforward enough for the superusers and works fine but I'm stumped on how to handle the others. I have tested the following OK in sites-enabled/default: if ("%{User-Name}" == loweruser1) { update reply { Reply-Message := "Mark Whitmarsh not allowed here" } reject } If I login as loweruser1 it rejects me as expected. I think I need to put my users and network devices into groups so I can test for variables but I'm stuck on how to do that. After reading lots of man pages and getting nowhere I've hit one of those annoying mental blocks and need some help. Thanks, Mark Whitmarsh. ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in reliance on its contents: to do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and GSI recipients NHSmail provides an email address for your career in the NHS and can be accessed anywhere For more information and to find out how you can switch, visit www.connectingforhealth.nhs.uk/nhsmail ********************************************************************************************************************

2 8

Anonymous/Guest users and WPA with EAP-TLS/TTLS
by Erik Norgaard 07 Jul '10

07 Jul '10

Hi: I want to do a WLAN setup that allows restricted anonymous access yet offers the security of encryption with WPA. I currently use EAP-TLS. Ofcourse, I could create an Anonymous or guest account, but then I'd have to tell about it. Question, is it possible to use EAP with say TLS or TTLS and if no credentials are specified, no client certificate is sent, then anonymous access is granted rather than fail authentication? Thanks, Erik -- Erik Nørgaard Ph: +34.666334818/+34.915211157 http://www.locolomo.org

2 1

post_proxy_authorize = no
by Beat Schnyder 06 Jul '10

06 Jul '10

Dear freeradius users I'm trying to migrate our current radius infrastructure, and encountered the following question: I'm using: - FreeRADIUS Version 2.0.4 (Debian Lenny, 2.0.4+dfsg-6) - A Virtual Server "preauth", that parses the Username for some strings with the users file - Some requests get proxied to another server - On return of the proxied request, the authentication is done again, but because the users file is rather large, and the parsing slow, I would like to skip it - In previous versions we put "post_proxy_authorize = no" into proxy.conf, but this seems to have stopped working Now: How can I achieve this "skipping re-authentication after proxying"? Thanks for all replies Beat Schnyder ---------

2 1

Re: "Exiting normally" on FreeBSD -- Synopsis?
by Brian A. Seklecki 06 Jul '10

06 Jul '10

> Next step must be ktrace(8)/kdump(8) or GDB [1]. > > ~BAS > So it turns out, since April, there have been two distinctive types of crashes. The unexplained SIGHUP, which we eventually tracked down to faulty logging configurations (now using SYSLOG instead of file logging), and an ongoing Sig11. We finally got around to setting up core dump archival and here's what we found: % sudo gdb ../local/sbin/radiusd /var/core/133.radiusd.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/local/lib/freeradius-2.1.9/libfreeradius-radius-2.1.9.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/libfreeradius-radius-2.1.9.so Reading symbols from /lib/libcrypt.so.5...done. Loaded symbols for /lib/libcrypt.so.5 Reading symbols from /usr/local/lib/libltdl.so.7...done. Loaded symbols for /usr/local/lib/libltdl.so.7 Reading symbols from /usr/lib/libssl.so.6...done. Loaded symbols for /usr/lib/libssl.so.6 Reading symbols from /lib/libcrypto.so.6...done. Loaded symbols for /lib/libcrypto.so.6 Reading symbols from /lib/libthr.so.3...done. Loaded symbols for /lib/libthr.so.3 Reading symbols from /lib/libc.so.7...done. Loaded symbols for /lib/libc.so.7 Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_exec.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_exec.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_expr.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_expr.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_chap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_chap.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_mschap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_mschap.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_pap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_pap.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_realm.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_realm.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_ldap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_ldap.so Reading symbols from /usr/local/lib/libldap_r-2.4.so.7...done. Loaded symbols for /usr/local/lib/libldap_r-2.4.so.7 Reading symbols from /usr/local/lib/liblber-2.4.so.7...done. Loaded symbols for /usr/local/lib/liblber-2.4.so.7 Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_preprocess.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_preprocess.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_acct_unique.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_acct_unique.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_files.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_files.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_detail.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_detail.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_radutmp.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_radutmp.so Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x0000000000409c49 in rad_authenticate (request=0x80138ba40) at auth.c:667 667 request->reply->code = PW_AUTHENTICATION_REJECT; [New Thread 801208740 (LWP 100229)] [New Thread 801208900 (LWP 100220)] [New Thread 801208ac0 (LWP 100135)] [New Thread 801208c80 (LWP 100132)] [New Thread 801208e40 (LWP 100108)] [New Thread 8012021c0 (LWP 100395)] And: (gdb) bt #0 0x0000000000409c49 in rad_authenticate (request=0x80138ba40) at auth.c:667 #1 0x000000000043241c in radius_handle_request (request=0x80138ba40, fun=0x409700 <rad_authenticate>) at event.c:3735 #2 0x0000000000425311 in request_handler_thread (arg=0x8013799c0) at threads.c:493 #3 0x0000000800e509ed in pthread_create () from /lib/libthr.so.3 #4 0x0000000000000000 in ?? () Cannot access memory at address 0x7fffff5fc000 This is where I normally defer to Steve/Alan for a bit of GDB/C skills I'd be happy to provide a redacted radiusd.conf(5) and and run any GDB commands, we just have to keep the contents of memory under wraps to protect passwords (We use LDAP, so.) This is: [bseklecki@blackout ~]$ radiusd -v radiusd: FreeRADIUS Version 2.1.9, for host amd64-portbld-freebsd8.0, built on Jun 30 2010 at 11:46:51 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Happy holidays, all, ~BAS

2 1

Re: FreeRadius + AD + Realms
by Matthew P 05 Jul '10

05 Jul '10

> $ man unlang > > This says "put the string %{1} as the value of Stripped-User-Name". > > See the "data types' section of the manual page, and the "strings" section. Got it ;) Thanks for your help, fixed now. btw. the "unlang-way" is quite more flexible than the "legacy-module-way" Was this problem even possible to solve without using unlang? (using freeradius 1.x for an example) _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. https://signup.live.com/signup.aspx?id=60969

2 1

Who Talks to Who?
by Thomas Reeves 05 Jul '10

05 Jul '10

Greetings All, I'm new to FreeRADIUS and I still don't have a good sense of who talks to who. I've attached a small PDF-format diagram of what I'm trying to accomplish and my IDEA of who talks to who. Any links or feedback would be appreciated. Cheers! Thomas

2 2