- Freeradius-Users - lists.freeradius.org

pam_radius_auth.c memory leaks?
by Cesare Placanica 01 Oct '09

01 Oct '09

Hi, I've written a little test application for pam_radius_auth. Although in the following article: http://developers.sun.com/solaris/articles/user_auth_solaris3.html is written that *pam service modules are in charge of freeing pam_response messages*, I suspect that this is not happening. Here is my test application and the memory debug using libumem: gerace:1> ldd check_user libpam.so.1 => /usr/dt/lib/libpam.so.1 libumem.so.1 => /lib/libumem.so.1 libc.so.1 => /lib/libc.so.1 libcmd.so.1 => /lib/libcmd.so.1 libm.so.2 => /lib/libm.so.2 /platform/SUNW,A70/lib/libc_psr.so.1 gerace:2> uname -a SunOS gerace 5.10 Generic_118833-03 sun4u sparc SUNW,A70 gerace:3> gerace:3> cat check_user.c #include <sys/types.h> #include <unistd.h> #include <pwd.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <security/pam_appl.h> #include "dprint.h" /* pam conversation function */ extern int check_conv(int num_msg, struct pam_message **msg, struct pam_response **resp, void *app_data); int main(int argc, char *argv[]) { struct pam_conv conv = { check_conv, NULL }; pam_handle_t *ph; int error; if (argc == 1) { printf("pam_radius_auth testing utility\n\n"); printf("Usage: %s user [trace_flag (0|1)]\n", argv[0]); exit(0); } if (argc == 3) { if (0 == strncmp(argv[2], "1", 2)) { trace_flag = 1; } } if ((error = pam_start("ctms", argv[1], &conv, &ph)) != PAM_SUCCESS) { fprintf(stderr, "Call to pam_start failed: %s\n", pam_strerror(ph, error)); exit(1); } for (;;) { error = pam_authenticate(ph, 0); if (error == PAM_SUCCESS) { printf("Password match.\n"); break; } else { if (error == PAM_AUTHINFO_UNAVAIL) { printf("Server down\n"); break; } else { printf("Password don't match.\n"); } } } pam_end(ph, 0); return (0); } gerace:4> gerace:4> cat check_user_conv.c #include <sys/types.h> #include <unistd.h> #include <pwd.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <security/pam_appl.h> #include "dprint.h" int check_conv(int num_msg, struct pam_message **msg, struct pam_response **resp, void *app_data) { struct pam_message *m = *msg; struct pam_response *r; int i; char *ct_passwd = NULL; char *ct_pin = NULL; DPRINT("DEBUG: entering conversation function\n"); if ((num_msg <= 0) || (num_msg >= PAM_MAX_NUM_MSG)) { fprintf(stderr, "Invalid number of messages\n"); *resp = NULL; return (PAM_CONV_ERR); } if ((*resp = r = calloc(num_msg, sizeof(struct pam_response))) == NULL) return (PAM_BUF_ERR); for (i = 0; i < num_msg; i++) { switch (m->msg_style) { case PAM_PROMPT_ECHO_OFF: if (m->msg) { DPRINT("DEBUG: PAM_PROMPT_ECHO_OFF server says %s\n", m->msg); } else { DPRINT("DEBUG: PAM_PROMPT_ECHO_OFF\n"); } ct_passwd = getpassphrase("Enter password: "); r->resp = strdup(ct_passwd); m++; r++; break; case PAM_PROMPT_ECHO_ON: DPRINT("DEBUG: PAM_PROMPT_ECHO_ON\n"); if (m->msg) { ct_pin = getpassphrase(m->msg); r->resp = strdup(ct_pin); } else { r->resp = NULL; } m++; r++; break; case PAM_ERROR_MSG: DPRINT("DEBUG: PAM_ERROR_MSG\n"); if (m->msg) fprintf(stderr, "%s\n", m->msg); m++; r++; break; case PAM_TEXT_INFO: DPRINT("DEBUG: PAM_TEXT_INFO\n"); if (m->msg) printf("%s\n", m->msg); m++; r++; break; } } return (PAM_SUCCESS); } gerace:6> gerace:6> gerace:6> setenv LD_PRELOAD libumem.so.1 gerace:7> setenv UMEM_DEBUG default gerace:8> sudo mdb ./check_user > ::sysbp _exit > ::run SuperUser Enter password: Password match. mdb: stop on entry to _exit mdb: target stopped at: libc.so.1`exit+0x14: ta 8 mdb: You've got symbols! Loading modules: [ ld.so.1 libumem.so.1 libc.so.1 ] > ::load libumem > ::findleaks CACHE LEAKED BUFCTL CALLER 00033b88 1 0003d518 libc.so.1`_nss_XbyY_buf_alloc+8 0002d188 1 00072000 libpam.so.1`run_stack+0xc8 ---------------------------------------------------------------------- Total 2 buffers, 1216 bytes > > 0003d518::bufctl_audit ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 3d518 41480 13e5187aea2a 1 33b88 0 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libc.so.1`_nss_XbyY_buf_alloc+8 0xff1aa688 0xff1a6af4 0xff1a6750 0xff1a2e88 0xff1d0ce8 libpam.so.1`run_stack+0xc8 libpam.so.1`pam_authenticate+0x30 main+0x13c _start+0x5c > 00072000::bufctl_audit ADDR BUFADDR TIMESTAMP THREAD CACHE LASTLOG CONTENTS 72000 75f80 13e5187ace6e 1 2d188 0 0 libumem.so.1`umem_cache_alloc+0x210 libumem.so.1`umem_alloc+0x60 libumem.so.1`malloc+0x28 libumem.so.1`calloc+0x58 0xff1a6acc 0xff1a6750 0xff1a2e88 0xff1d0ce8 libpam.so.1`run_stack+0xc8 libpam.so.1`pam_authenticate+0x30 main+0x13c _start+0x5c > ::quit I suspect that the first leak is due the strdup function in the conversation function (check_conv), because memory allocation is in libc. The second leak is the calloc in check_conv function. There is a guideline to handle this memory issues for pam_response messages? Regards, Cesare

1 0

rlm
by José Johnny RANDRIAMAMPIONONA 01 Oct '09

01 Oct '09

Dear all, I posted this problem a week ago after searching in posted and solved emails like here ( http://www.mail-archive.com/search?q=rlm_ldap&l=freeradius-users@lists.cist… ). I have already asked but the answers were not effective... Anyway, I d like to express my gratitude to those who have tried to read and respond to my problems ! So I m asking myself if : Using LDAP with freeradius is it something new or something? My problem is about the ldap library for freeradius (libldap which is needed by rlm_ldap) ... What should I do to install and configure it 'cause it's not in the freeradius-server package(I rebuilt it 5 times and I paid attention to the output? If I ll receive the same answers I received before then maybe the problem is in my operating system(CentOsV5.3) Thanks to all ... Best regards ... NB: I am fed up of this buuuuuuuuuuuuug! Neeed help! -- JJohnny RANDRIAMAMPIONONA Phone: +212663682554, +212533158575 National School of Applied Sciences ZIP 1818 TANGIER 90000 ---------Morocco ---------------

7 10

Rlm_ldap not found
by Leighton Man 01 Oct '09

01 Oct '09

Hi all, Hope this is an easy one: Freeradius 2.1.6 on arch linux installed from a package. All is well until I uncomment ldap in the authorise section of sites-enabled/inner-tunnel then I get: /etc/raddb/modules/ldap[29]: Failed to link to module 'rlm_ldap': file not found followed by Failed to find module "ldap" ...... rlm_ldap.so is a symlink to rlm_ldap-2.1.6.so which has the same permissions and is in the same directory as the other modules which load OK (they are also symlinks in the same directory). I've checked for typos until I'm beginning to see them even when they are not there! Radiusd -X shows no errors or warnings and after the ***Loading Virtual Servers**** message continues linking and instantiating modules up to and including "files" then the error above. Not easy to post the whole output as I haven't got ftp running yet. Where should I look next? Regards, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 7

Re: Stripping windows domain with dot1x and peap
by Gary Gatten 01 Oct '09

01 Oct '09

It would break EAP? If I enter my own creds and leave the Domain null it works great.... ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thu Oct 01 03:39:34 2009 Subject: Re: Stripping windows domain with dot1x and peap > I'm back on this issue again. 2.1.6 on FBSD and RHEL. When doing 8021x > auth using winblows xp supplicant (wired) and the setting "use my windows > username and password", I can't seem to get FR to strip the domain name. Good. Because that would break EAP. > I have the nt hack enabled in a couple places. Also read about using > "realms" modules instead of enabling nt hack. Tried both as well as a > couple different "--username" tweaks to no avail. > > Can someone point me in the right direction? I tried playing eap, mschap, > default, innertunnel, etc. Use ntdomain. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

(no subject)
by jon jon 01 Oct '09

01 Oct '09

Hi, I was wondering where to look in free radius, for something that is kicking the wireless clients off at a certain time. I have a backend mysql database that allows the clients certain times to login from. Where would the file be located that is telling the free radius server that there time is up and boot them off? thanks

2 2

EAPTLS Stress test: 2.1.7
by leopold 01 Oct '09

01 Oct '09

Hi, We tried to stress test (EAPTLS) FreeRADIUS 2.1.7 which sits behind Load Balancer We had 2 FreeRADIUS servers behind load balancer (R1,R2) Some requests got rejected (Access-Reject was sent) and the log showed Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Now we understand that if EAPTLS session started (we have 10 Access-Challenge messages because of our certificate chain) against Radius_1 and then continued to Radius_2 because load balancer reverted it there then EAPTLS handshake cannot succeed, but we expected that FreeRADIUS should drop packets and NOT RESPOND instead of sending Access-Reject when it cannot find STATE variable By looking at the code we think eap_tls module returns RLM_MODULE_INVALID or RLM_MODULE_FAIL when it cannot find EAP session in the tree. What is proper configuration that we can do? Is something like this recommended? authorize { .. eap { ok = return updated = return handled = return } if (invalid) { do_not_respond } # if we reach here then Auth-Type != EAP .. } Thanks you for your response -- View this message in context: http://www.nabble.com/EAPTLS-Stress-test%3A-2.1.7-tp25686662p25686662.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

FreeRADIUS with 2 certs/CAs etc
by Alan Buxey 01 Oct '09

01 Oct '09

hi, in the UK I deal with various questions regarding FreeRADIUS configuration and abilities - occasionally a question pops up that I'm very unfamilar with or havent got a direct clue to answer.. today one of those reemerged and as this might affect anyone at any point I was looking for best practice or a methodology. Say you have a nice FR setup...all is going well and everything is fine but then you have an issue with the certificate - eg its going to expire , or its been revoked...then you are going to have to have a new certificate for your FR server - but your clients will have the old certificate and CA - and your new clients will have the new cert and CA..and you might not be able to sort out all your clients for some time - hopefully before the final day of cert validity! anyway, in summary, your RADIUS server has to answer to the old clients and the new clients. What is the best practice way or configuration to ensure that your RADIUS server can be both people...old servercert+old_CA and new servertcert+new_CA so that it can deal with both types of clients. I'm thinking 2 virtual servers....one with old eap.conf and the other with neweap.conf with each virtual server ready to deal with each type of client - but then how to direct the incoming EAP to the right way. I cant see the normal fall-through group working --because the client has to create the EAP tunnel... or would a normal fallthrough system work... we send it to eap1 and if it fails send it to eap2 (which should be okay if client config okay!) ? I can envisage fronting it with a.n.other RADIUS solution which will proxy the request through a remote server list UNTIL it doesnt get a REJECT back.. but i dont want additional software in the mix thanks alan

4 6

Re: Stripping windows domain with dot1x and peap
by Ivan Kalik 01 Oct '09

01 Oct '09

> I'm back on this issue again. 2.1.6 on FBSD and RHEL. When doing 8021x > auth using winblows xp supplicant (wired) and the setting "use my windows > username and password", I can't seem to get FR to strip the domain name. Good. Because that would break EAP. > I have the nt hack enabled in a couple places. Also read about using > "realms" modules instead of enabling nt hack. Tried both as well as a > couple different "--username" tweaks to no avail. > > Can someone point me in the right direction? I tried playing eap, mschap, > default, innertunnel, etc. Use ntdomain. Ivan Kalik Kalik Informatika ISP

1 0

Stripping windows domain with dot1x and peap
by Gary Gatten 01 Oct '09

01 Oct '09

Hello, I'm back on this issue again. 2.1.6 on FBSD and RHEL. When doing 8021x auth using winblows xp supplicant (wired) and the setting "use my windows username and password", I can't seem to get FR to strip the domain name. I have the nt hack enabled in a couple places. Also read about using "realms" modules instead of enabling nt hack. Tried both as well as a couple different "--username" tweaks to no avail. Can someone point me in the right direction? I tried playing eap, mschap, default, innertunnel, etc. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 1

Problem with radzap
by Pierre-henri Baraffe 01 Oct '09

01 Oct '09

Hello, I have a mistake with my freeradius. On server with 1.1.7 the command : "radzap -u username -P port-nas 127.0.0.1 secret" work with no problem On a new server with FR 2.0.5, with the same command i have this error radclient:: failed to get value I have no more message with the "-x" option and nothing in the log. I have the same things if i replace "127.0.0.1" by "localhost" my client.conf client localhost { ipaddr = 127.0.0.1 secret = secret require_message_authenticator = no shortname = localhost nastype = other # localhost isn't usually a NAS... } I don't understand. Thanks for your help. ph

3 3