March 2013 - Freeradius-Users - lists.freeradius.org

Freeradius 2.2.0 memory leak issue.
by kao quadrantx 08 Mar '13

08 Mar '13

Hi, i got the same issue in freeradius memory issue http://freeradius.1045715.n5.nabble.com/Memory-leak-in-FR-2-1-10-and-2-2-0-… My test ENV: eapol_test with md5 to do AUTH (client) ---------> freeradius 2.2.0 to proxy the client request (proxy) -----------------------------> freeradius 2.2.0 More request more memory (VmRSS) consumed by radiusd (proxy), and the daemon performance will also down. And i use valgrind to log this: ==14786== ==14786== HEAP SUMMARY: ==14786== in use at exit: 172,724 bytes in 2,819 blocks ==14786== total heap usage: 43,388 allocs, 40,569 frees, 5,148,356 bytes allocated ==14786== ==14786== 4 bytes in 1 blocks are definitely lost in loss record 1 of 527 ==14786== at 0x4C23224: malloc (vg_replace_malloc.c:270) ==14786== by 0x633A061: strdup (in /lib/libc-2.9.so) ==14786== by 0x40E641: cf_item_parse (conffile.c:953) ==14786== by 0x41BF4A: listen_parse (listen.c:1953) ==14786== by 0x41C5CA: listen_init (listen.c:2174) ==14786== by 0x438A36: radius_event_init (event.c:3648) ==14786== by 0x425971: main (radiusd.c:332) ==14786== ==14786== 5 bytes in 1 blocks are definitely lost in loss record 3 of 527 ==14786== at 0x4C23224: malloc (vg_replace_malloc.c:270) ==14786== by 0x633A061: strdup (in /lib/libc-2.9.so) ==14786== by 0x40E641: cf_item_parse (conffile.c:953) ==14786== by 0x40EE5C: cf_section_parse (conffile.c:1173) ==14786== by 0x41DE96: switch_users (mainconfig.c:614) ==14786== by 0x41E6B9: read_mainconfig (mainconfig.c:874) ==14786== by 0x4257CD: main (radiusd.c:263) ==14786== ==14786== 368 (136 direct, 232 indirect) bytes in 1 blocks are definitely lost in loss record 477 of 527 ==14786== at 0x4C23224: malloc (vg_replace_malloc.c:270) ==14786== by 0x42B8AF: rad_malloc (util.c:347) ==14786== by 0x41B9BF: listen_alloc (listen.c:1735) ==14786== by 0x41BC83: proxy_new_listener (listen.c:1838) ==14786== by 0x43D514: home_server_create_callback (realms.c:2254) ==14786== by 0x4E45CFA: WalkNodeInOrder (rbtree.c:551) ==14786== by 0x4E45E78: rbtree_walk (rbtree.c:603) ==14786== by 0x43D564: home_server_create_listeners (realms.c:2280) ==14786== by 0x41CA15: listen_init (listen.c:2323) ==14786== by 0x438A36: radius_event_init (event.c:3648) ==14786== by 0x425971: main (radiusd.c:332) ==14786== ==14786== 6,800 bytes in 25 blocks are possibly lost in loss record 522 of 527 ==14786== at 0x4C252BE: calloc (vg_replace_malloc.c:593) ==14786== by 0x40104BE: _dl_allocate_tls (in /lib/ld-2.9.so) ==14786== by 0x5491C14: pthread_create (in /lib/libpthread-2.9.so) ==14786== by 0x42A611: spawn_thread (threads.c:663) ==14786== by 0x42AB1B: thread_pool_init (threads.c:862) ==14786== by 0x438803: radius_event_init (event.c:3575) ==14786== by 0x425971: main (radiusd.c:332) ==14786== ==14786== 37,440 (18,720 direct, 18,720 indirect) bytes in 60 blocks are definitely lost in loss record 526 of 527 ==14786== at 0x4C23224: malloc (vg_replace_malloc.c:270) ==14786== by 0x4E488C8: pairalloc (valuepair.c:72) ==14786== by 0x4E4AFFC: pairmake (valuepair.c:1526) ==14786== by 0x4E4B553: pairread (valuepair.c:1736) ==14786== by 0x4E4B8C4: userparse (valuepair.c:1850) ==14786== by 0x412A7F: radius_exec_program (exec.c:583) ==14786== by 0x6C1A5F5: ??? ==14786== by 0x6C1A71B: ??? ==14786== by 0x421CAB: call_modsingle (modcall.c:304) ==14786== by 0x422AD5: modcall (modcall.c:686) ==14786== by 0x41FCB8: indexed_modcall (modules.c:740) ==14786== by 0x4216FC: module_post_auth (modules.c:1662) ==14786== ==14786== 37,440 bytes in 120 blocks are definitely lost in loss record 527 of 527 ==14786== at 0x4C23224: malloc (vg_replace_malloc.c:270) ==14786== by 0x4E488C8: pairalloc (valuepair.c:72) ==14786== by 0x4E4AFFC: pairmake (valuepair.c:1526) ==14786== by 0x4E4B553: pairread (valuepair.c:1736) ==14786== by 0x4E4B8C4: userparse (valuepair.c:1850) ==14786== by 0x412A7F: radius_exec_program (exec.c:583) ==14786== by 0x6C1A5F5: ??? ==14786== by 0x421CAB: call_modsingle (modcall.c:304) ==14786== by 0x422AD5: modcall (modcall.c:686) ==14786== by 0x41FCB8: indexed_modcall (modules.c:740) ==14786== by 0x4216B4: module_pre_proxy (modules.c:1645) ==14786== by 0x435F6E: successfully_proxied_request (event.c:2230) ==14786== ==14786== LEAK SUMMARY: ==14786== definitely lost: 56,305 bytes in 183 blocks ==14786== indirectly lost: 18,952 bytes in 63 blocks ==14786== possibly lost: 6,800 bytes in 25 blocks ==14786== still reachable: 90,667 bytes in 2,548 blocks ==14786== suppressed: 0 bytes in 0 blocks ==14786== Reachable blocks (those to which a pointer was found) are not shown. ==14786== To see them, rerun with: --leak-check=full --show-reachable=yes ==14786== ==14786== For counts of detected and suppressed errors, rerun with: -v ==14786== Use --track-origins=yes to see where uninitialised values come from ==14786== ERROR SUMMARY: 715158 errors from 470 contexts (suppressed: 201 from 43)

3 10

Re: Failed to load module "jradius" freeradius server
by Alan Buxey 08 Mar '13

08 Mar '13

"This is the freeradius list, not the jradius list. If you want help and advice then use the appropriate list" Which bit wasn't clear?

1 0

Re: Failed to load module "jradius" freeradius server
by Alan Buxey 08 Mar '13

08 Mar '13

This is the freeradius list, not the jradius list. If you want help and advice then use the appropriate list Many thanks alan

2 1

Re: Freeradius with either LDAP or Mysql Error lib not found
by Alan Buxey 08 Mar '13

08 Mar '13

As Fajar says, some distros split up the functions into separate packages (so you don't need to install loads of things just to have a basic server) use your package manager to find/install the sub packages alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

2 1

Packet-Original-Timestamp
by Бен Томпсон 08 Mar '13

08 Mar '13

Hello Everyone I have a NAS which is not sending Event-Timestamp in accounting messages. I wondered if I could create it in unlang by subtracting Acct-Delay-Time from Packet-Original-Timestamp. However, when I put a reference to Packet-Original-Timestamp in the acconting setion I get the following error :- Reference "${Packet-Original-Timestamp}" not found Am I doing something wrong?

3 12

Freeradius with either LDAP or Mysql Error lib not found
by Iftakhul Anwar 08 Mar '13

08 Mar '13

Hi All I just try to config freeradius using either Mysql or LDAP. But i get same error like bellow : [errror Mysq] Fri Mar 8 13:44:46 2013 : Error: Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Fri Mar 8 13:44:46 2013 : Error: Make sure it (and all its dependent libraries!) are in the search path of your system's ld. Fri Mar 8 13:44:46 2013 : Error: /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" Fri Mar 8 13:44:46 2013 : Error: /usr/local/etc/raddb/sites-enabled/default[177]: Failed to find "sql" in the "modules" section. Fri Mar 8 13:44:46 2013 : Error: /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. i've read in some article that it's solved by installed mysql-devel package. In this case i've installed libmysqlclient-dev on my ubuntu 12.04 But still get same error. It's also happen on my freeradius ldap? [error LDAP] /usr/local/etc/raddb/modules/ldap[29]: Failed to link to module 'rlm_ldap': rlm_ldap.so: cannot open shared object file: No such file or directory /usr/local/etc/raddb/sites-enabled/default[305]: Failed to find "ldap" in the "modules" section. /usr/local/etc/raddb/sites-enabled/default[305]: Failed to parse "ldap" How i can solve this issue ? Thanks -- *M.Iftakhul Anwar* Meruvian Integrator High Performance Computing / Cloud Computing (HPC/CC) Office Phone : 021-93586577 Mobile Phone : 085215331477 Blog : http://blog.mervpolis.com/roller/anwar FB : http://www.facebook.com/troya.adromeda Website : www.meruvian.org

3 4

SQL changes
by Arran Cudbard-Bell 07 Mar '13

07 Mar '13

Hi All, A few changes to the SQL drivers. * Biggest change is there are now no longer any socket close/free functions in the driver API these are now all handled by talloc destructors. If you suspect sockets aren't being closed properly, run with the extra -x and it'll print out a message when the destructor is called. * All the drivers now (optionally) can provide an instantiate method to do their own config parsing. This method gets passed in the config sub section (if it exists) matching the driver name. So for sqlite it'd be sql { sqlite { <this section> } } This will let us do driver specific configuration. If there are any client side options for MySQL / PostgreSQL that are useful for tuning/debugging feel free to submit patches. * Sqlite code has been pretty much rewritten so it works for everything (not just clients), and a new set of schemas created for sqlite. Yes the S is for simple not standardised *sigh*. * The 'filename' config item in the main sql config (which specified where the sqlite db was) has been moved into the sqlite {} section (where it should have always been). * There's a new bootstrap config item for sqlite. If bootstrap is set, and the specified sqlite database doesn't exist, it'll be created, then the sql file specified by bootstrap will be split on ;\n and each statement executed in turn to create the schema for the boostrapped database. The idea is to ship with a working configuration for sqlipool, so the DHCP just works after you've configured the ranges. If you're writing example configurations/modules that depend on SQL for persistent storage, it'd probably be a good idea to use the sqlite driver and bootstrap the database/schema that's required, then the examples work out of the box, so long as you have sqlite available. -Arran

1 0

Failed to load module "jradius" freeradius server
by Iftakhul Anwar 07 Mar '13

07 Mar '13

HI All, I just installed free radius server using apt-get on my ubuntu machine. Now i want to configure jradius on my freeradius server. I follow step by step from http://coova.org/JRadius/FreeRADIUS. Firstly my freeradius server running well, whereas i've configure it with mysql and coovachilli. Then i configure with jradius, i inserted module on radius.conf file on module section like bellow : # configure the rlm_jradius module jradius { name = "radius" # The "Requester" name (a single # JRadius server can have # multiple "applications") primary = "localhost" # Uses default port 1814 secondary = "192.168.2.3" # Fail-over server tertiary = "192.168.2.3:8002" # Fail-over server on port 8002 timeout = 1 # Connect Timeout onfail = NOOP # What to do if no JRadius # Server is found. Options are: # FAIL (default), OK, REJECT, NOOP keepalive = yes # Keep connections to JRadius pooled connections = 8 # Number of pooled JRadius connections } Then i add some authorization on /etc/freeradius/site-avalaible/default like bellow authorize { ... jradius } post-auth { ... jradius Post-Auth-Type REJECT { jradius } } preacct { ... jradius } accounting { ... jradius } Finally i try to running on foreground to know that my configuration has been success, but i get error message like bellow : Thu Mar 7 13:56:15 2013 : Debug: } # modules Thu Mar 7 13:56:15 2013 : Debug: } # server Thu Mar 7 13:56:15 2013 : Debug: server { # from file /etc/freeradius/radiusd.conf Thu Mar 7 13:56:15 2013 : Debug: modules { Thu Mar 7 13:56:15 2013 : Debug: Module: Checking authenticate {...} for more modules to load Thu Mar 7 13:56:15 2013 : Debug: (Loaded rlm_digest, checking if it's valid) Thu Mar 7 13:56:15 2013 : Debug: Module: Linked to module rlm_digest Thu Mar 7 13:56:15 2013 : Debug: Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Thu Mar 7 13:56:15 2013 : Debug: Module: Checking authorize {...} for more modules to load Thu Mar 7 13:56:15 2013 : Debug: (Loaded rlm_preprocess, checking if it's valid) Thu Mar 7 13:56:15 2013 : Debug: Module: Linked to module rlm_preprocess Thu Mar 7 13:56:15 2013 : Debug: Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess Thu Mar 7 13:56:15 2013 : Debug: preprocess { Thu Mar 7 13:56:15 2013 : Debug: huntgroups = "/etc/freeradius/huntgroups" Thu Mar 7 13:56:15 2013 : Debug: hints = "/etc/freeradius/hints" Thu Mar 7 13:56:15 2013 : Debug: with_ascend_hack = no Thu Mar 7 13:56:15 2013 : Debug: ascend_channels_per_line = 23 Thu Mar 7 13:56:15 2013 : Debug: with_ntdomain_hack = no Thu Mar 7 13:56:15 2013 : Debug: with_specialix_jetstream_hack = no Thu Mar 7 13:56:15 2013 : Debug: with_cisco_vsa_hack = no Thu Mar 7 13:56:15 2013 : Debug: with_alvarion_vsa_hack = no Thu Mar 7 13:56:15 2013 : Debug: } Thu Mar 7 13:56:15 2013 : Error: /etc/freeradius/radiusd.conf[644]: Failed to link to module 'rlm_jradius': file not found Thu Mar 7 13:56:15 2013 : Error: /etc/freeradius/sites-enabled/default[71]: Failed to load module "jradius". Thu Mar 7 13:56:15 2013 : Error: /etc/freeradius/sites-enabled/default[62]: Errors parsing authorize section. What this error ? How i can solve this issue ? Thanks -- *M.Iftakhul Anwar* Meruvian Integrator High Performance Computing / Cloud Computing (HPC/CC) Office Phone : 021-93586577 Mobile Phone : 085215331477 Blog : http://blog.mervpolis.com/roller/anwar FB : http://www.facebook.com/troya.adromeda Website : www.meruvian.org

4 14

Re: Freeradius-Users Digest, Vol 95, Issue 30
by David Bird 07 Mar '13

07 Mar '13

The most recent (which hasn't changed in some time now) can be found: http://dev.coova.org/svn/cjradius/trunk/freeradius/rlm_jradius/rlm_jradius.c Cheers, David > Date: Thu, 7 Mar 2013 11:02:17 -0500 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Failed to load module "jradius" freeradius server > Message-ID: <C9EB7AE3-492A-4D59-BE04-1645044DC3E8(a)freeradius.org> > Content-Type: text/plain; charset=iso-8859-1 > > > On 7 Mar 2013, at 10:55, Iftakhul Anwar <anwar(a)meruvian.org> wrote: > > > Actually i install freeradius from apt-get , > > Right, so jradius won't have been built. > > jradius support is going away, it will *NOT* be in Version 3 unless someone contributes a new version of the module which works with the updated jradius protocol. > > -Arran > > >

2 1

LDAP authorization
by Matthew Ceroni 07 Mar '13

07 Mar '13

I am using LDAP authorization. What I am looking to accomplish is to reject/deny (so not even attempt authentication) for disabled users. I am authentication against AD (use LDAP for authorize and ntlm for authentication). If I were to search for all none disabled users using ldapsearch, the filter query for this would be: !(userAccountControl:1.2.840.113556.1.4.803:=2) That is the part that limits the results to only enabled users. Wondering how I would do this in FreeRadius? Even on a more general level how I would reject based off certain returned attributes. Thanks

3 5