- Freeradius-Users - lists.freeradius.org

Invalid Operator on 64bit Systems (amd64)
by Bernd Strehhuber 18 Jul '09

18 Jul '09

Hi, just found a weird behavior on 64bit Systems (Ubuntu 8.04 LTS amd64) with freeradius 1.1.7 (Dist Package 1.1.7-1build4). I created a setup with Validity Ranges for usernames and/or realms (Data is stored in a mysql Database): - for the realm - | id | Realm | Attribute | op | Value | Type | | 178 | test | group-validity | <= | 1388534400 | RadiusCheck | | 177 | test | group-validity | >= | 1143849600 | RadiusCheck | - for the user - | id | User | Realm | Attribute | op | Value | Type | | 201 | user | test | account-validity | >= | 1226448000 | RadiusCheck | | 202 | user | test | account-validity | <= | 1860105600 | RadiusCheck | freeradius on amd64 refuses to accept my access request to the user user@test: Sat Jul 18 12:19:55 2009 : Error: Invalid operator for item account-validity: reverting to '==' Sat Jul 18 12:19:55 2009 : Auth: Login incorrect: [user@test] (from client local port 0) If I delete the validity for the username, a access request is still refused: Sat Jul 18 12:23:03 2009 : Error: Invalid operator for item group-validity: reverting to '==' Sat Jul 18 12:23:03 2009 : Auth: Login incorrect: [user@test] (from client local port 0) If I delete the validity for the realm too, everything is ok: Sat Jul 18 12:25:28 2009 : Auth: Login OK: [user@test] (from client local port 0) I found a question about Expiration/rlm_sql bug in 64-bit architecture here on the List dated two years ago. But no solution for the problem. So it might be a problem on 64bit Systems. I checked that with a fresh install of Ubuntu 8.04 LTS i386 (32bit) and freeradius also in Version 1.1.7 (same Dist Package Version 1.1.7-1build4), but as i386 Package of course. Config is the same as on the 64bit System (also with mysql as storage for the user credentials). The result is, that on 32bit Ubuntu, a access request is accepted, and account/group validity is checked correctly: Sat Jul 18 12:36:29 2009 : Auth: Login OK: [user@test] (from client local port 0) The question is now, what can be done to get the Operators "<=" and ">=" working with freeradius 1.1.7 on amd64 Systems? TIA Bernd

2 1

RADIUS accounting
by Mohammed Hagag 18 Jul '09

18 Jul '09

what's the meaning of accounting in radius aaa ? is it means measuring of consumed resources only or users' activities like executed commands for example on an ssh service is being logged ? -- Mohamed M. Hagag محمد محمود حجاج http://www.linkedin.com/in/mohamedhagag http://bintoo.sf.net/drpl/ http://mohamedhagag.wordpress.com

2 2

Robust Authentication Proxying
by Philip Molter 18 Jul '09

18 Jul '09

Hi, I'm trying to setup a robust RADIUS authentication proxy. All this radius will do is proxy all auth requests to a set of four backend RADIUS handlers. I have a 2.1.6 server that I've configured with four home_server entries and one home_server_pool that load-balances across the four. It works when all four backends are up, but if any 1 of the backend goes down, then requests that get directed to that backend result in an Access-Reject packet being returned to the NAS. Is there a way to configure freeradius so that instead of returning an Access- Reject packet, the server will instead switch to the next configured server and retry the request there? It may mean that it takes a little longer for the request to be handled, but that's better than it being rejected. Thanks for any advice or assistance. Philip

3 27

radius.log permissions issue
by Philip Molter 17 Jul '09

17 Jul '09

With freeradius 2.1.6, I have a configuration such as this in my radiusd.conf file: user = radiusd group = radiusd When I start up radiusd for the first time, the radius.log file gets created with 0640 permissions, owned by root:radiusd, instead of radiusd:radiusd. This doesn't prevent the RADIUS process from working, but it does prevent any useful information from being logged. Is this a known bug? Is there a workaround other than creating the file by hand and setting its ownership before starting freeradius? Philip

4 8

chase_referrals and rebind in 2.1.6
by Wegener, Norbert 17 Jul '09

17 Jul '09

I am having some problems with an AD and FreeRADIUS. rlm_ldap debug lets me assume that there might be a relation to chase_referrals and rebind. According to the Changelog there have been changes regarding this in 2.1.6: Added "chase_referrals" and "rebind" configuration to rlm_ldap. This helps with Active Directory. See raddb/modules/ldap Unfortunately I do not find anything about it in that file. ~/freeradius-server-2.1.6$ grep -r -l -i chase_ref * debian/changelog doc/ChangeLog src/modules/rlm_ldap/rlm_ldap.c Similar result for rebind. What options might be configured for chase_referrals and rebind? Norbert Wegener

2 1

radiusd -f flag - how it affects custom freeradius module
by George Chelidze 17 Jul '09

17 Jul '09

Hello, Recently I have developed a custom module for freeradius 2.1.6 following http://wiki.freeradius.org/Modules2 document. The purpose of this module is to translate authorization requests to Tibco Rendezvous messages (Commercial software - Message Bus), send them to some external application, get the reply back and accept or reject based on this reply. I use client libraries to communicate with tibco rendezvous daemon (rvd) through some IPC mechanism (I think it's tcp sockets). The problem is that when I start freeradius with -f flag client application can send and receive data without any problem. When I start freeradius without any arguments, it can send data but can't receive it, while sniffing the network indicates that response is actually delivered back from rvd. So what's so specific with -f? How can fork()/setsid() break something? Below is a piece of problematic code: rv_status = tibrvTransport_SendRequest(transport, tibrv_msg, &tibrv_msg_reply, request_timeout * 1.0 / 1000); if (rv_status != TIBRV_OK && rv_status != TIBRV_TIMEOUT) { radlog(L_ERR, "rlm_custom_auth: tibrvTransport_SendRequest() failed. Error = \"%s\"", tibrvStatus_GetText(rv_status)); tibrvMsg_destroy(tibrv_msg); return RLM_MODULE_REJECT; } if (rv_status == TIBRV_TIMEOUT) { radlog(L_ERR, "rlm_custom_auth: tibrvTransport_SendRequest() timed out"); tibrvMsg_destroy(tibrv_msg); return RLM_MODULE_REJECT; } so, every time I start freeradius without -f I get: rlm_custom_auth: tibrvTransport_SendRequest() timed out I understand that this problem is very specific to tibco rendezvous which isn't the open source. It will be great if you can share your ideas about the issue. Thanks in advance, George Chelidze

1 0

radiusd -X problem
by shivashankar 17 Jul '09

17 Jul '09

hi, when i run freeradius in solaris10 i am facing below problem miboss3# /usr/local/sbin/radiusd -x ld.so.1: radiusd: fatal: libgcc_s.so.1: open failed: No such file or directory Killed -- View this message in context: http://www.nabble.com/radiusd--X-problem-tp24532174p24532174.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Maximum number of instances of a package already met message while using pkgadd
by shivashankar 17 Jul '09

17 Jul '09

hi, while i am running pkgadd -d gcc-3.2************* showing Maximum number of instances of a package already met message while using pkgadd thax for advance -- View this message in context: http://www.nabble.com/Maximum-number-of-instances-of-a-package-already-met-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

how to get connection with server
by shivashankar 17 Jul '09

17 Jul '09

i installed freeradius 2.1.6 on solaris10. i am unable to start the server.when ever i type the radiusd -X it is saying command not found. plz help me -- View this message in context: http://www.nabble.com/how-to-get-connection-with-server-tp24528569p24528569… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Error: Thread 1 failed waiting for semaphore: Invalid argument: Exiting
by Tim Gustafson 17 Jul '09

17 Jul '09

Hi, I've had a FreeRADIUS 2.1.3 server running on FreeBSD 7.1 for a few months now. I logged in today to add a new group to my users file, and then re-started the RADIUS daemon. After re-starting, I'm getting this in my error log: Info: Ready to process requests. Error: Thread 1 failed waiting for semaphore: Invalid argument: Exiting Error: Thread 2 failed waiting for semaphore: Invalid argument: Exiting Error: Thread 3 failed waiting for semaphore: Invalid argument: Exiting Error: Thread 4 failed waiting for semaphore: Invalid argument: Exiting Error: Thread 5 failed waiting for semaphore: Invalid argument: Exiting When a user tries to log in, the first packet seems to go nowhere, and then the second and subsequent packets emit the following error in the log: Error: Discarding duplicate request from client foo port 65259 - ID: 111 due to unfinished request 0 I rebooted the server, but am still getting the same errors. Any idea what might be causing this? I'm doing a ports rebuild on the FreeBSD box just in case, but I figured I'd ask around a bit. Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 1