- Freeradius-Users - lists.freeradius.org

Re: FreeRADIUS + Postgresql dies unexpectedly
by Duarte Fonseca 16 Nov '09

16 Nov '09

Hi Alan, Thanks for the advice, I've tried the same test with radiusd -f and here are the results Some runs just produce this: # radiusd -f Segmentation fault Others produce a more verbose output, hope it helps: # radiusd -f *** glibc detected *** radiusd: double free or corruption (fasttop): 0x09143220 *** ======= Backtrace: ========= /lib/libc.so.6[0x3c50f1] /lib/libc.so.6(cfree+0x90)[0x3c8bc0] /lib/libcrypto.so.6(CRYPTO_free+0x3a)[0x2a7a5a] /lib/libcrypto.so.6(X509_VERIFY_PARAM_free+0x29)[0x26c029] /lib/libssl.so.6(SSL_free+0x64)[0x13b8b4] /usr/lib/libpq.so.4[0xfdc4e9] /usr/lib/libpq.so.4(pqReadData+0x1da)[0xfd46ba] /usr/lib/libpq.so.4(PQgetResult+0xa0)[0xfd3180] /usr/lib/libpq.so.4[0xfd3348] /usr/lib/libpq.so.4(PQexec+0x27)[0xfd35e7] /usr/lib/freeradius/rlm_sql_postgresql.so[0x18e7bf] /usr/lib/freeradius/rlm_sql.so(rlm_sql_query+0x52)[0xa6b2e2] /usr/lib/freeradius/rlm_sql.so[0xa68a96] radiusd(modcall+0x94e)[0x8062dfe] radiusd(indexed_modcall+0xa5)[0x805fa65] radiusd(module_accounting+0x2c)[0x805fd4c] radiusd(rad_accounting+0xab)[0x804df9b] radiusd(radius_handle_request+0x65)[0x806e4d5] radiusd[0x8066065] /lib/libpthread.so.0[0xd1949b] /lib/libc.so.6(clone+0x5e)[0x42d42e] ======= Memory map: ======== 00110000-00153000 r-xp 00000000 08:02 6291673 /lib/libssl.so.0.9.8e 00153000-00157000 rwxp 00042000 08:02 6291673 /lib/libssl.so.0.9.8e 00157000-00183000 r-xp 00000000 08:02 8986736 /usr/lib/libgssapi_krb5.so.2.2 00183000-00184000 rwxp 0002c000 08:02 8986736 /usr/lib/libgssapi_krb5.so.2.2 00184000-00186000 r-xp 00000000 08:02 6291658 /lib/libcom_err.so.2.1 00186000-00187000 rwxp 00001000 08:02 6291658 /lib/libcom_err.so.2.1 00187000-00189000 r-xp 00000000 08:02 6291546 /lib/libkeyutils-1.2.so 00189000-0018a000 rwxp 00001000 08:02 6291546 /lib/libkeyutils-1.2.so 0018a000-0018c000 r-xp 00000000 08:02 9085015 /usr/lib/freeradius/rlm_acct_unique-2.1.7.so 0018c000-0018d000 rwxp 00001000 08:02 9085015 /usr/lib/freeradius/rlm_acct_unique-2.1.7.so 0018d000-00191000 r-xp 00000000 08:02 9085105 /usr/lib/freeradius/rlm_sql_postgresql-2.1.7.so 00191000-00192000 rwxp 00004000 08:02 9085105 /usr/lib/freeradius/rlm_sql_postgresql-2.1.7.so 00194000-0019d000 r-xp 00000000 08:02 6291484 /lib/libcrypt-2.5.so 0019d000-0019e000 r-xp 00008000 08:02 6291484 /lib/libcrypt-2.5.so 0019e000-0019f000 rwxp 00009000 08:02 6291484 /lib/libcrypt-2.5.so 0019f000-001c6000 rwxp 0019f000 00:00 0 001d4000-001d5000 r-xp 001d4000 00:00 0 [vdso] 001d5000-002ff000 r-xp 00000000 08:02 6291671 /lib/libcrypto.so.0.9.8e 002ff000-00312000 rwxp 00129000 08:02 6291671 /lib/libcrypto.so.0.9.8e 00312000-00316000 rwxp 00312000 00:00 0 00316000-00328000 r-xp 00000000 08:02 8984623 /usr/lib/libz.so.1.2.3 00328000-00329000 rwxp 00011000 08:02 8984623 /usr/lib/libz.so.1.2.3 00345000-00358000 r-xp 00000000 08:02 6291490 /lib/libnsl-2.5.so 00358000-00359000 r-xp 00012000 08:02 6291490 /lib/libnsl-2.5.so 00359000-0035a000 rwxp 00013000 08:02 6291490 /lib/libnsl-2.5.so 0035a000-0035c000 rwxp 0035a000 00:00 0 0035c000-0049a000 r-xp 00000000 08:02 6291480 /lib/libc-2.5.so 0049a000-0049c000 r-xp 0013e000 08:02 6291480 /lib/libc-2.5.so 0049c000-0049d000 rwxp 00140000 08:02 6291480 /lib/libc-2.5.so 0049d000-004a0000 rwxp 0049d000 00:00 0 004a0000-00533000 r-xp 00000000 08:02 8986750 /usr/lib/libkrb5.so.3.3 00533000-00536000 rwxp 00092000 08:02 8986750 /usr/lib/libkrb5.so.3.3 00640000-0065a000 r-xp 00000000 08:02 6291473 /lib/ld-2.5.so 0065a000-0065b000 r-xp 00019000 08:02 6291473 /lib/ld-2.5.so 0065b000-0065c000 rwxp 0001a000 08:02 6291473 /lib/ld-2.5.so 006b9000-006c8000 r-xp 00000000 08:02 6291506 /lib/libresolv-2.5.so 006c8000-006c9000 r-xp 0000e000 08:02 6291506 /lib/libresolv-2.5.so 006c9000-006ca000 rwxp 0000f000 08:02 6291506 /lib/libresolv-2.5.so 006ca000-006cc000 rwxp 006ca000 00:00 0 006f4000-006f6000 r-xp 00000000 08:02 9085067 /usr/lib/freeradius/rlm_files-2.1.7.so 006f6000-006f7000 rwxp 00001000 08:02 9085067 /usr/lib/freeradius/rlm_files-2.1.7.so 00753000-00769000 r-xp 00000000 08:02 6291646 /lib/libselinux.so.1 00769000-0076b000 rwxp 00015000 08:02 6291646 /lib/libselinux.so.1 00787000-00792000 r-xp 00000000 08:02 6291458 Aborted # radiusd -f *** glibc detected *** radiusd: double free or corruption (fasttop): 0x0993eeb0 *** ======= Backtrace: ========= /lib/libc.so.6[0x1790f1] /lib/libc.so.6(cfree+0x90)[0x17cbc0] /lib/libcrypto.so.6(CRYPTO_free+0x3a)[0x483a5a] /lib/libcrypto.so.6(X509_VERIFY_PARAM_free+0x29)[0x448029] /lib/libssl.so.6(SSL_free+0x64)[0xede8b4] /usr/lib/libpq.so.4[0x3a14e9] /usr/lib/libpq.so.4(pqReadData+0x1da)[0x3996ba] /usr/lib/libpq.so.4(PQgetResult+0xa0)[0x398180] /usr/lib/libpq.so.4[0x39828c] /usr/lib/freeradius/rlm_sql_postgresql.so[0x3887bf] /usr/lib/freeradius/rlm_sql.so(rlm_sql_query+0x52)[0x9e82e2] /usr/lib/freeradius/rlm_sql.so[0x9e5c3b] radiusd(modcall+0x94e)[0x8062dfe] radiusd(indexed_modcall+0xa5)[0x805fa65] radiusd(module_accounting+0x2c)[0x805fd4c] radiusd(rad_accounting+0xab)[0x804df9b] radiusd(radius_handle_request+0x65)[0x806e4d5] radiusd[0x8066065] /lib/libpthread.so.0[0xdc449b] /lib/libc.so.6(clone+0x5e)[0x1e142e] ======= Memory map: ======== 00110000-0024e000 r-xp 00000000 08:02 6291480 /lib/libc-2.5.so 0024e000-00250000 r-xp 0013e000 08:02 6291480 /lib/libc-2.5.so 00250000-00251000 rwxp 00140000 08:02 6291480 /lib/libc-2.5.so 00251000-00254000 rwxp 00251000 00:00 0 00254000-00279000 r-xp 00000000 08:02 8986740 /usr/lib/libk5crypto.so.3.1 00279000-0027a000 rwxp 00025000 08:02 8986740 /usr/lib/libk5crypto.so.3.1 0027a000-00290000 r-xp 00000000 08:02 6291646 /lib/libselinux.so.1 00290000-00292000 rwxp 00015000 08:02 6291646 /lib/libselinux.so.1 00292000-00294000 r-xp 00000000 08:02 9085067 /usr/lib/freeradius/rlm_files-2.1.7.so 00294000-00295000 rwxp 00001000 08:02 9085067 /usr/lib/freeradius/rlm_files-2.1.7.so 00298000-002a7000 r-xp 00000000 08:02 6291506 /lib/libresolv-2.5.so 002a7000-002a8000 r-xp 0000e000 08:02 6291506 /lib/libresolv-2.5.so 002a8000-002a9000 rwxp 0000f000 08:02 6291506 /lib/libresolv-2.5.so 002a9000-002ab000 rwxp 002a9000 00:00 0 002ab000-0033e000 r-xp 00000000 08:02 8986750 /usr/lib/libkrb5.so.3.3 0033e000-00341000 rwxp 00092000 08:02 8986750 /usr/lib/libkrb5.so.3.3 00341000-0037c000 r-xp 00000000 08:02 6291555 /lib/libsepol.so.1 0037c000-0037d000 rwxp 0003a000 08:02 6291555 /lib/libsepol.so.1 0037d000-00387000 rwxp 0037d000 00:00 0 00387000-0038b000 r-xp 00000000 08:02 9085105 /usr/lib/freeradius/rlm_sql_postgresql-2.1.7.so 0038b000-0038c000 rwxp 00004000 08:02 9085105 /usr/lib/freeradius/rlm_sql_postgresql-2.1.7.so 0038c000-003ab000 r-xp 00000000 08:02 8986821 /usr/lib/libpq.so.4.1 003ab000-003ac000 rwxp 0001f000 08:02 8986821 /usr/lib/libpq.so.4.1 003b1000-004db000 r-xp 00000000 08:02 6291671 /lib/libcrypto.so.0.9.8e 004db000-004ee000 rwxp 00129000 08:02 6291671 /lib/libcrypto.so.0.9.8e 004ee000-004f2000 rwxp 004ee000 00:00 0 004f2000-004fd000 r-xp 00000000 08:02 6291458 /lib/libgcc_s-4.1.2-20080825.so.1 004fd000-004fe000 rwxp 0000a000 08:02 6291458 /lib/libgcc_s-4.1.2-20080825.so.1 0050a000-00510000 r-xp 00000000 08:02 8985722 /usr/lib/libltdl.so.3.1.4 00510000-00511000 rwxp 00005000 08:02 8985722 /usr/lib/libltdl.so.3.1.4 00527000-00539000 r-xp 00000000 08:02 8984623 /usr/lib/libz.so.1.2.3 00539000-0053a000 rwxp 00011000 08:02 8984623 /usr/lib/libz.so.1.2.3 005bd000-005c5000 r-xp 00000000 08:02 8986752 /usr/lib/libkrb5support.so.0.1 005c5000-005c6000 rwxp 00007000 08:02 8986752 /usr/lib/libkrb5support.so.0.1 00769000-00772000 r-xp 00000000 08:02 6291484 /lib/libcrypt-2.5.so 00772000-00773000 r-xp 00008000 08:02 6291484 /lib/libcrypt-2.5.so 00773000-00774000 rwxp 00009000 08:02 6291484 /lib/libcrypt-2.5.so 00774000-0079b000 rwxp 00774000 00:00 0 0081d000-0081f000 r-xp 00000000 08:02 9085095 /usr/lib/freeradius/rlm_sql_log-2.1.7.so 0081f000-00820000 rwxp 00001000 08:02 9085095 /usr/lib/freeradius/rlm_sql_log-2.1.7.so 0083c000-0083d000 r-xp 0083c000 00:00 0 [vdso] 00868000-00894000 r-xp 00000000 08:02 8986736 /usr/lib/libgssapi_krb5.so.2.2 00894000-00895000 rwxp 0002c000 08:02 8986736 /usr/lib/libgssapi_krb5.so.2.2 009c2000-009d5000 r-xp 00000000 08:02 6291490 /lib/libnsl-2.5.so 009d5000-009d6000 r-xp 00012000 08:02 6291490 /lib/libnsl-2.5.so 009d6000-009d7000 rwxp 00013000 08:02 6291490 /lib/libnsl-2.5.so 009d7000-009d9000 rwxp 009d7000 00:00 0 009e3000-009eb000 r-xp 00000000 08:02 9085093 /usr/lib/freeradius/rlm_sql-2.1.7.so 009eb000-009ec000 rwxp 00007000 08:02 9085093 /usr/lib/freeradius/rlm_sql-2.1.7.so 00b28000-00b2a000 r-xp 00000000 08:02 6291546 /lib/libkeyutils-1.2.so 00b2a000-00b2b000 rwxp 00001000 08:02 6291546 /lib/libkeyutils-1.2.so 00c42000-00c44000 r-xp 00000000 08:02 9085059 /usr/lib/freeradius/rlm_exec-2.1.7.so 00c44000-00c45000 rwxp 00001000 08:02 9085059 /usr/lib/freeradius/rlm_exec-2.1.7.so 00c89000-00c8b000 r-xp 00000000 08:02 6291486 /lib/libdl-2.5.so 00c8b000-00c8c000 r-xp 00001000 08:02 6291486 /lib/libdl-2.5.so 00c8c000-00c8d000 rwxp 00002000 08:02 6291486 /lib/libdl-2.5.so 00caf000-00cc9000 r-xp 00000000 08:02 6291473 /lib/ld-2.5.so 00cc9000-00cca000 r-xp 00019000 08:02 6291473 /lib/ld-2.5.so 00cca000-00ccb000 rwxp 0001a000 08:02 6291473 /lib/ld-2.5.so 00cfd000-00cff000 r-xp 00000000 08:02 9085015 /usr/lib/freeradius/rlm_acct_unique-2.1.7.so 00cff000-00d00000 rwxp 00001000 08:02 9085015 /usr/lib/freeradius/rlm_acct_unique-2.1.7.so 00d5a000-00d63000 r-xp 00000000 08:02 6291496 /lib/libnss_files-2.5.so 00d63000-00d64000 r-xp 00008000 08:02 6291496 /lib/libnss_files-2.5.so 00d64000-00d65000 rwxp 00009000 08:02 6291496 /lib/libnss_files-2.5.so 00dbf000-00dd2000 r-xp 00000000 08:02 6291504 /lib/libpthread-2.5.so 00dd2000-00dd3000 r-xp 00012000 08:02 6291504 /lib/libpthread-2.5.so 00dd3000-00dd4000 rwxp 00013000 08:02 6291504 /lib/libpthread-2.5.so 00dd4000-00dd6000 rwxp 00dd4000 00:00 0 00e6d000-00e8d000 r-xp 00000000 08:02 9080245 /usr/lib/freeradius/libfreeradius-radius-2.1.7.so 00e8d000-00e8e000 rwxp 00020000 08:02 9080245 /usr/lib/freeradius/libfreeradius-radius-2.1.7.so 00e8e000-00e8f000 rwxp 00e8e000 00:00 0 00eb3000-00ef6000 r-xp 00000000 08:02 6291673 /lib/libssl.so.0.9.8e 00ef6000-00efa000 rwxp 00042000 08:02 6291673 /lib/libssl.so.0.9.8e 00f94000-00f96000 r-xp 00000000 08:02 6291658 /lib/libcom_err.so.2.1 00f96000-00f97000 rwxp 00001000 08:02 6291658 /lib/libcom_err.so.2.1 08048000-08085000 r-xp 00000000 08:02 8988421 /usr/sbin/radiusd 08085000-08087000 rw-p 0003d000 08:02 8988421 /usr/sbin/radiusd 08087000-08088000 rw-p 08087000 00:00 0 0978e000-0a07d000 rw-p 0978e000 00:00 0 [heap] b19fb000-b19fc000 ---p b19fb000 00:00 0 b19fc000-b23fc000 rw-p b19fc000 00:00 0 b23fc000-b23fd000 ---p b23fc000 00:00 0 b23fd000-b2dfd000 rw-p b23fd000 00:00 0 b2dfd000-b2dfe000 ---p b2dfd000 00:00 0 b2dfe000-b37fe000 rw-p b2dfe000 00:00 0 b37fe000-b37ff000 ---p b37fe000 00:00 0 b37ff000-b41ff000 rw-p b37ff000 00:00 0 b41ff000-b4200000 ---p b41ff000 00:00 0 b4200000-b4c22000 rw-p b4200000 00:00 0 b4c22000-b4d00000 ---p b4c22000 00:00 0 b4dd9000-b4dda000 ---p b4dd9000 00:00 0 b4dda000-b57da000 rw-p b4dda000 00:00 0 b57da000-b57db000 ---p b57da000 00:00 0 b57db000-b61db000 rw-p b57db000 00:00 0 b61db000-b61dc000 ---p b61db000 00:00 0 b61dc000-b6bdc000 rw-p b61dc000 00:00 0 b6bdc000-b6bdd000 ---p b6bdc000 00:00 0 b6bdd000-b75dd000 rw-p b6bdd000 00:00 0 b75dd000-b75de000 ---p b75dd000 00:00 0 b75de000-b7fe3000 rw-p b75de000 00:00 0 b7fe7000-b7fe8000 rw-p b7fe7000 00:00 0 bf842000-bf858000 rw-p bffe9000 00:00 0 [stack] Aborted Also in my postgresql log i see the following when radiusd dies <2009-10-23 11:01:40.167 BST> LOG: SSL error: wrong version number <2009-10-23 11:01:40.167 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.167 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.169 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.169 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.169 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.169 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.170 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.170 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.170 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.170 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.175 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.175 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.175 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.175 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.176 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.176 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.176 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.176 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.175 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.177 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.177 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.177 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.178 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.178 BST> LOG: unexpected EOF on client connection The message regarding SSL seems to alternate between the follwoing: LOG: SSL error: wrong version number LOG: could not accept SSL connection: EOF detected LOG: SSL error: decryption failed or bad record mac LOG: SSL error: block cipher pad is wrong In my radius.log i've noticed a couple of times there are some postgresql errors Fri Oct 23 11:18:08 2009 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Fri Oct 23 11:18:08 2009 : Info: rlm_sql (sql): Attempting to connect to postgres@localhost:/gapdb Fri Oct 23 11:18:08 2009 : Info: Loaded virtual server <default> Fri Oct 23 11:18:08 2009 : Info: Ready to process requests. Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'JoePublic7', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: rlm_sql_postgresql: PostgreSQL Query failed Error: Fri Oct 23 11:18:16 2009 : Error: rlm_sql_postgresql: Socket not connected Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:02 2009 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Fri Oct 23 11:19:02 2009 : Info: rlm_sql (sql): Attempting to connect to postgres@localhost:/gapdb Fri Oct 23 11:19:02 2009 : Info: Loaded virtual server <default> Fri Oct 23 11:19:02 2009 : Info: Ready to process requests. Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'JoePublic7', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user '001f3b887d19', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user '001f3b887d19', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: rlm_sql_postgresql: PostgreSQL Query failed Error: SSL SYSCALL error: Resource temporarily unavailable I've also setup a sql_log module to capture the sql queries being performed and later ran that sql succesfully with the command: # psql -h 127.0.0.1 -U postgres gapdb < /var/log/radius/radacct/sql-relay Again thank you for the help, hope this helps. Cheers, Duarte On 22/10/2009 18:17, "Alan DeKok" <aland(a)deployingradius.com> wrote: > Duarte Fonseca wrote: >> I've got a freeRadius (v2.1.7) install running on CentOs using >> postgresql to store accounting data and have noticed that occasionally >> freeRadius seems to die unexpectedly. > > See doc/bugs. You can run the server in foreground mode (radiusd -f), > too. > > If it dies after a few packets, the problem should be pretty simple to > find && fix. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

4 18

Re: FR2.1.3+LDAP+802.1x+PEAP
by Caius 16 Nov '09

16 Nov '09

Hi Alan, thank you for your answer, that page/table was awesome regarding your tips: a) i dont wanna do, maybe if i have no other choice, ill have 2 password attributes SSHA+NTLM, but its a clear no to clear-text, and a maybe to NT hash b) need it, so not gonna happen so, as i need to proceed further with my investigation, what are my options really? :D i was thinking at the following: to do the normal user authentication in LDAP, based on the provided realm, and if no realm present authenticate the users in users file. Users which use 802.1x will be saved in clear-text in users file and users used for authentication for other stuff, will be checked in LDAP (@mydomain.com) or can i switch this around? a user: myuser(a)dot1x.com will be based on the real authenticated in users file for 802.1x and a user with no realm will be authenticated in LDAP? please tell me your opinion on this, is it possible? Thanks & Best Regards, Caius Pargar

4 13

Problems to do an SSID based authentication
by Peter Carlstedt 16 Nov '09

16 Nov '09

Hello everyone! I am trying to do an SSID based authentication per user. What I mean is that i try in the users.conf file to check for which SSID the users is trying to use to login and if it is wrong it shall do an reject for that user. The problem is that i dont succeed with this so I thought it does not hurt to ask the ones who knows. My users.conf file looks like this: #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # #steve Cleartext-Password := "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP Peter Cleartext-Password := "kaffe" , Called-Station-Id == "04-0B-6B-33-62-35:raket" # Tunnel-Type = VLAN, # Tunnel-Medium-Type = IEEE-802, # Tunnel-Private-Group-Id = 2 Jens Cleartext-Password := "kaffe" , Called-Station-Id == "02-0B-6B-33-62-35:3" # Tunnel-Type = VLAN, # Tunnel-Medium-Type = IEEE-802, # Tunnel-Private-Group-Id = 3 # NAS-Port-Id == "wlan1" Mattias user-password := "kaffe" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 1 # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # #"John Doe" Cleartext-Password := "hello" # Reply-Message = "Hello, %{User-Name}" # # Dial user back and telnet to the default host for that port # #Deg Cleartext-Password := "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Cleartext-Password := "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # using the default method, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell" # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Sample defaults for all framed connections. # #DEFAULT Service-Type == Framed-User # Framed-IP-Address = 255.255.255.254, # Framed-MTU = 576, # Service-Type = Framed-User, # Fall-Through = Yes # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Administrative-User # On no match, the user is denied access. DEFAULT Auth-Type := Reject Is there any wrong with my users file? What happens when I try to authenticate with an Windows machine? i get rejected and it dont matter which SSID im logging into. What happens when I try to authenticate with an Mac OSX machine? I get rejected but succeed anyway in getting into the network. Best regards/ Peter > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 55, Issue 65 > To: freeradius-users(a)lists.freeradius.org > Date: Mon, 16 Nov 2009 09:40:46 +0100 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: usergroup and radgroupcheck problem! (Hamid Reza Hasani) > 2. Re: DHCP in FR (Alan DeKok) > 3. Re: DHCP in FR (Kassai Istvan) > 4. Re: DHCP in FR (Alan DeKok) > 5. Re: Crash due to fr_packet_cmp (Alan DeKok) > 6. Re: DHCP in FR (Kassai Istvan) > 7. Co-existing of tls and ttls configuration (Koichi Yagishita) > 8. Re: Co-existing of tls and ttls configuration (Alan DeKok) > 9. Re: Problem with template.conf in proxy.conf (Ana Gallardo) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 15 Nov 2009 16:14:45 +0330 > From: Hamid Reza Hasani <hr.hasani(a)gmail.com> > Subject: Re: usergroup and radgroupcheck problem! > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <33b9c8d70911150444vd250018h6c51b5cbe8e58617(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi,(salaam) > Thanks for your help, But I solved the problem and I changed the > radgroupcheck query so it get groupname from usergroup table and then > compare it! I think I have a better solution, isn't it? > > BTW thank for your help, please inform me if you know why this problem > exist? is it a bug? > > Ya Ali > Hamid Reza Hasani >

2 1

Re: Freeradius-Users Digest, Vol 55, Issue 65
by Gilbert Lo 16 Nov '09

16 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Problem with template.conf in proxy.conf
by Ana Gallardo 16 Nov '09

16 Nov '09

Hello I'm using Freeradius 2.04-3 in Debian. I'm using a home-server template defined in template.conf: ### /etc/freeradius/templates.conf templates { home_server { response_window = 20 zombie_period = 40 revive_interval = 120 } home_server tld-rediris { type = auth+acct port = 1812 secret = XXX response_window = 20 zombie_period = 40 revive_interval = 60 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } } ### /etc/freeradius/proxy.conf home_server tld-rediris1 { template = tld-rediris ipaddr = ZZZ } home_server tld-rediris2 { template = tld-rediris ipaddr = YYY } But Freeradius doesn't run: /etc/freeradius# freeradius -X Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/templates.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/ldap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary ... home_server tld-rediris1 { ipaddr = ZZZ port = 0 response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } /etc/freeradius/proxy.conf[27]: No port, or invalid port defined for home server tld-rediris1. Thank you very much. -- ____________________ Ana Gallardo Gómez ____________________

2 4

Co-existing of tls and ttls configuration
by Koichi Yagishita 16 Nov '09

16 Nov '09

Dear All, Can I coexist eap tls and ttls configuration in a freeradius? If yes, please let me know of the configuration. Regards, Yagishita

2 1

Crash due to fr_packet_cmp
by fabiana marvani 15 Nov '09

15 Nov '09

Hello , I have a big problem with my freeradius ... After some time with load the freeradius crashes We first noticed this crash with our plugins activated, but then we deactivated all plugins and used "default" configuration: /usr/local/etc/raddb/users: DEFAULT Auth-Type := Accept Reply-Message = "test freeradius" /usr/local/etc/raddb/sites-enabled/default authorize { files } accounting { ok } and crashes still occured. This crash has been observed while load testing, so there is no debug logs. Crash time appears to be dependant on load: 1400 req/s >> 4h - 6h 700 req/s >> 8h - 10h An analyse of core files shows the same error in accounting or authentication: core.8555 Program terminated with signal 11, Segmentation fault. (gdb) bt #0 fr_packet_cmp (a=0xb4897cd8, b=0x0) at packet.c:139 #1 0x00c80d98 in packet_entry_cmp (one=0xbf89cf94, two=0x8e21a80) at packet.c:400 #2 0x00c71b39 in list_find (ht=0x8d49520, head=<value optimized out>, reversed=285904539, data=0xbf89cf94) at hash.c:191 #3 0x00c71c43 in fr_hash_table_find (ht=0x8d49520, data=0xbf89cf94) at hash.c:461 #4 0x00c71c71 in fr_hash_table_finddata (ht=0x8d49520, data=0xbf89cf94) at hash.c:491 #5 0x00c80a29 in fr_packet_list_find (pl=0xc80d70, request=0xb4897cd8) at packet.c:536 #6 0x0806cf83 in received_request (listener=0x8d4f608, packet=0xb4897cd8, prequest=0xbf89d0dc, client=0x8d2fc80) at event.c:2723 #7 0x0805ab24 in acct_socket_recv (listener=0x8d4f608, pfun=0xbf89d0e0, prequest=0xbf89d0dc) at listen.c:889 #8 0x08068e00 in event_socket_handler (xel=0x8d49d70, fd=6, ctx=0xc80d70) at event.c:3288 #9 0x00c81b05 in fr_event_loop (el=0x8d49d70) at event.c:400 #10 0x080698c6 in radius_event_process () at event.c:3632 #11 0x080620ca in main (argc=1, argv=0xbf89d334) at radiusd.c:398 === core.21300 (gdb) bt #0 fr_packet_cmp (a=0xb2d7a858, b=0x0) at packet.c:139 #1 0x00457d98 in packet_entry_cmp (one=0xbf8e0fe4, two=0xb2f316e8) at packet.c:400 #2 0x00448b39 in list_find (ht=0x8e3d590, head=<value optimized out>, reversed=640351498, data=0xbf8e0fe4) at hash.c:191 #3 0x00448c43 in fr_hash_table_find (ht=0x8e3d590, data=0xbf8e0fe4) at hash.c:461 #4 0x00448c71 in fr_hash_table_finddata (ht=0x8e3d590, data=0xbf8e0fe4) at hash.c:491 #5 0x00457a29 in fr_packet_list_find (pl=0x457d70, request=0xb2d7a858) at packet.c:536 #6 0x0806cf83 in received_request (listener=0x89819a0, packet=0xb2d7a858, prequest=0xbf8e112c, client=0x896ac98) at event.c:2723 #7 0x0805af38 in auth_socket_recv (listener=0x89819a0, pfun=0xbf8e1130, prequest=0xbf8e112c) at listen.c:801 #8 0x08068e00 in event_socket_handler (xel=0x8e3b920, fd=9, ctx=0x457d70) at event.c:3288 #9 0x00458b05 in fr_event_loop (el=0x8e3b920) at event.c:400 #10 0x080698c6 in radius_event_process () at event.c:3632 #11 0x080620ca in main (argc=1, argv=0xbf8e1384) at radiusd.c:398 I need help :( have a fun Fabiana

2 1

Re: usergroup and radgroupcheck problem!
by Hamid Reza Hasani 15 Nov '09

15 Nov '09

Hi,(salaam) Thanks for your help, But I solved the problem and I changed the radgroupcheck query so it get groupname from usergroup table and then compare it! I think I have a better solution, isn't it? BTW thank for your help, please inform me if you know why this problem exist? is it a bug? Ya Ali Hamid Reza Hasani

1 0

Re: Freeradius-Users Digest, Vol 55, Issue 63
by Gilbert Lo 15 Nov '09

15 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Re: Freeradius-Users Digest, Vol 55, Issue 62
by Gilbert Lo 14 Nov '09

14 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0