- Freeradius-Users - lists.freeradius.org

FR2.0.5 and glibc
by Hubert Kupper 29 Oct '08

29 Oct '08

Hello, FR2.0.5 aborted with the following error. I have searched the list archive, but found nothing. Boert *** glibc detected *** radiusd: corrupted double-linked list: 0xb94f0120 *** ======= Backtrace: ========= /lib/libc.so.6[0xb7bebfc4] /lib/libc.so.6[0xb7bed753] /lib/libc.so.6(cfree+0x9c)[0xb7bed95c] /usr/lib/freeradius/libfreeradius-radius-2.0.5.so(pairbasicfree+0x2d)[0xb7fb5d9d] /usr/lib/freeradius/libfreeradius-radius-2.0.5.so(pairfree+0x33)[0xb7fb60d3] radiusd[0xb8004c50] radiusd(radius_handle_request+0x96)[0xb8005396] radiusd(thread_pool_addrequest+0x10f)[0xb7ffd9cf] radiusd[0xb80033fa] /usr/lib/freeradius/libfreeradius-radius-2.0.5.so(fr_event_loop+0x302)[0xb7fb9f92] radiusd(radius_event_process+0x30)[0xb8003460] radiusd(main+0x64e)[0xb7ff958e] /lib/libc.so.6(__libc_start_main+0xe5)[0xb7b965f5] radiusd[0xb7fe9c91] ======= Memory map: ======== b7800000-b7821000 rw-p b7800000 00:00 0 b7821000-b7900000 ---p b7821000 00:00 0 b79c1000-b79cd000 r-xp 00000000 09:01 97970 /lib/libgcc_s.so.1 b79cd000-b79ce000 r--p 0000b000 09:01 97970 /lib/libgcc_s.so.1 b79ce000-b79cf000 rw-p 0000c000 09:01 97970 /lib/libgcc_s.so.1 b79e2000-b7a17000 r--s 00000000 09:01 1600238 /var/run/nscd/dbbzNtkH (deleted) b7a17000-b7a18000 rw-p b7a17000 00:00 0 b7a18000-b7a4d000 r--s 00000000 09:01 1600239 /var/run/nscd/services b7a4d000-b7a75000 rw-p b7a4d000 00:00 0 b7a75000-b7a7a000 r-xp 00000000 09:01 1771579 /usr/lib/libgdbm.so.3.0.0 b7a7a000-b7a7b000 r--p 00004000 09:01 1771579 /usr/lib/libgdbm.so.3.0.0 b7a7b000-b7a7c000 rw-p 00005000 09:01 1771579 /usr/lib/libgdbm.so.3.0.0 b7a8a000-b7a8d000 r-xp 00000000 09:01 1879062 /usr/lib/freeradius/rlm_radutmp-2.0.5.so b7a8d000-b7a8e000 r--p 00002000 09:01 1879062 /usr/lib/freeradius/rlm_radutmp-2.0.5.so b7a8e000-b7a8f000 rw-p 00003000 09:01 1879062 /usr/lib/freeradius/rlm_radutmp-2.0.5.so b7a8f000-b7a93000 r-xp 00000000 09:01 1878945 /usr/lib/freeradius/rlm_counter-2.0.5.so b7a93000-b7a94000 r--p 00003000 09:01 1878945 /usr/lib/freeradius/rlm_counter-2.0.5.so b7a94000-b7a95000 rw-p 00004000 09:01 1878945 /usr/lib/freeradius/rlm_counter-2.0.5.so b7a95000-b7a97000 r-xp 00000000 09:01 1878929 /usr/lib/freeradius/rlm_acct_unique-2.0.5.so b7a97000-b7a98000 r--p 00001000 09:01 1878929 /usr/lib/freeradius/rlm_acct_unique-2.0.5.so b7a98000-b7a99000 rw-p 00002000 09:01 1878929 /usr/lib/freeradius/rlm_acct_unique-2.0.5.so b7a99000-b7a9b000 r-xp 00000000 09:01 1879006 /usr/lib/freeradius/rlm_files-2.0.5.so b7a9b000-b7a9c000 r--p 00001000 09:01 1879006 /usr/lib/freeradius/rlm_files-2.0.5.so b7a9c000-b7a9d000 rw-p 00002000 09:01 1879006 /usr/lib/freeradius/rlm_files-2.0.5.so b7a9d000-b7a9f000 r-xp 00000000 09:01 1879064 /usr/lib/freeradius/rlm_realm-2.0.5.so b7a9f000-b7aa0000 r--p 00001000 09:01 1879064 /usr/lib/freeradius/rlm_realm-2.0.5.so b7aa0000-b7aa1000 rw-p 00002000 09:01 1879064 /usr/lib/freeradius/rlm_realm-2.0.5.so b7aa1000-b7aa4000 r-xp 00000000 09:01 1878952 /usr/lib/freeradius/rlm_detail-2.0.5.so b7aa4000-b7aa5000 r--p 00002000 09:01 1878952 /usr/lib/freeradius/rlm_detail-2.0.5.so b7aa5000-b7aa6000 rw-p 00003000 09:01 1878952 /usr/lib/freeradius/rlm_detail-2.0.5.so b7aa6000-b7aa8000 r-xp 00000000 09:01 1879056 /usr/lib/freeradius/rlm_preprocess-2.0.5.so b7aa8000-b7aa9000 r--p 00001000 09:01 1879056 /usr/lib/freeradius/rlm_preprocess-2.0.5.so b7aa9000-b7aaa000 rw-p 00002000 09:01 1879056 /usr/lib/freeradius/rlm_preprocess-2.0.5.so b7aaa000-b7aac000 r-xp 00000000 09:01 1878964 /usr/lib/freeradius/rlm_eap_mschapv2-2.0.5.so b7aac000-b7aad000 r--p 00001000 09:01 1878964 /usr/lib/freeradius/rlm_eap_mschapv2-2.0.5.so b7aad000-b7aae000 rw-p 00002000 09:01 1878964 /usr/lib/freeradius/rlm_eap_mschapv2-2.0.5.so b7aae000-b7ab2000 r-xp 00000000 09:01 1878988 /usr/lib/freeradius/rlm_eap_peap-2.0.5.so b7ab2000-b7ab3000 r--p 00003000 09:01 1878988 /usr/lib/freeradius/rlm_eap_peap-2.0.5.so b7ab3000-b7ab4000 rw-p 00004000 09:01 1878988 /usr/lib/freeradius/rlm_eap_peap-2.0.5.so b7ab4000-b7ab9000 r-xp 00000000 09:01 1878994 /usr/lib/freeradius/rlm_eap_ttls-2.0.5.so b7ab9000-b7aba000 r--p 00004000 09:01 1878994 /usr/lib/freeradius/rlm_eap_ttls-2.0.5.so b7aba000-b7abb000 rw-p 00005000 09:01 1878994 /usr/lib/freeradius/rlm_eap_ttls-2.0.5.so b7abb000-b7abf000 r-xp 00000000 09:01 1878992 /usr/lib/freeradius/rlm_eap_tls-2.0.5.so b7abf000-b7ac0000 r--p 00003000 09:01 1878992 /usr/lib/freeradius/rlm_eap_tls-2.0.5.so b7ac0000-b7ac1000 rw-p 00004000 09:01 1878992 /usr/lib/freeradius/rlm_eap_tls-2.0.5.so b7ac1000-b7ac3000 r-xp 00000000 09:01 1878958 /usr/lib/freeradius/rlm_eap_gtc-2.0.5.so b7ac3000-b7ac4000 r--p 00001000 09:01 1878958 /usr/lib/freeradius/rlm_eap_gtc-2.0.5.so b7ac4000-b7ac5000 rw-p 00002000 09:01 1878958 /usr/lib/freeradius/rlm_eap_gtc-2.0.5.so b7ac5000-b7ac9000 r-xp 00000000 09:01 1878960 /usr/lib/freeradius/rlm_eap_leap-2.0.5.so b7ac9000-b7aca000 r--p 00003000 09:01 1878960 /usr/lib/freeradius/rlm_eap_leap-2.0.5.so b7aca000-b7acb000 rw-p 00004000 09:01 1878960 /usr/lib/freeradius/rlm_eap_leap-2.0.5.so b7acb000-b7acd000 r-xp 00000000 09:01 1878962 /usr/lib/freeradius/rlm_eap_md5-2.0.5.so b7acd000-b7ace000 r--p 00001000 09:01 1878962 /usr/lib/freeradius/rlm_eap_md5-2.0.5.so b7ace000-b7acf000 rw-p 00002000 09:01 1878962 /usr/lib/freeradius/rlm_eap_md5-2.0.5.so b7acf000-b7ae6000 r-xp 00000000 09:01 1771563 /usr/lib/libsasl2.so.2.0.22 b7ae6000-b7ae7000 r--p 00016000 09:01 1771563 /usr/lib/libsasl2.so.2.0.22 b7ae7000-b7ae8000 rw-p 00017000 09:01 1771563 /usr/lib/libsasl2.so.2.0.22 b7ae8000-b7af5000 r-xp 00000000 09:01 1773421 /usr/lib/liblber-2.4.so.2.0.5 b7af5000-b7af6000 r--p 0000c000 09:01 1773421 /usr/lib/liblber-2.4.so.2.0.5 b7af6000-b7af7000 rw-p 0000d000 09:01 1773421 /usr/lib/liblber-2.4.so.2.0.5 b7af7000-b7b39000 r-xp 00000000 09:01 1773143 /usr/lib/libldap_r-2.4.so.2.0.5 b7b39000-b7b3a000 r--p 00041000 09:01 1773143 /usr/lib/libldap_r-2.4.so.2.0.5 b7b3a000-b7b3b000 rw-p 00042000 09:01 1773143 /usr/lib/libldap_r-2.4.so.2.0.5 b7b3b000-b7b3d000 rw-p b7b3b000 00:00 0 b7b3d000-b7b46000 r-xp 00000000 09:01 1878859 /usr/lib/freeradius/libfreeradius-eap-2.0.5.so b7b46000-b7b47000 r--p 00008000 09:01 1878859 /usr/lib/freeradius/libfreeradius-eap-2.0.5.so b7b47000-b7b48000 rw-p 00009000 09:01 1878859 /usr/lib/freeradius/libfreeradius-eap-2.0.5.so b7b48000-b7b4e000 r-xp 00000000 09:01 1878956 /usr/lib/freeradius/rlm_eap-2.0.5.so b7b4e000-b7b4f000 r--p 00006000 09:01 1878956 /usr/lib/freeradius/rlm_eap-2.0.5.so b7b4f000-b7b50000 rw-p 00007000 09:01 1878956 /usr/lib/freeradius/rlm_eap-2.0.5.so b7b50000-b7b5c000 r-xp 00000000 09:01 1879014 /usr/lib/freeradius/rlm_ldap-2.0.5.so b7b5c000-b7b5d000 r--p 0000b000 09:01 1879014 /usr/lib/freeradius/rlm_ldap-2.0.5.so b7b5d000-b7b5e000 rw-p 0000c000 09:01 1879Aborted

2 1

vsa and authenticate-only service-type
by ganesh subramonian 29 Oct '08

29 Oct '08

Hi The pam_radius module currently uses the service-type authenticate-only when sending an access-request. The rfc says this about "authenticate only": Only Authentication is requested, and no authorization information needs to be returned in the Access-Accept Does this mean that if I want the server to send some VSA in the reply-message i should not use this? Is it OK to not send any service-type? thanks Ganesh Connect with friends all over the world. Get Yahoo! India Messenger at http://in.messenger.yahoo.com/?wm=n/

3 2

Suse SLES 10SP2 with freeradius 2.x
by Hubert Kupper 29 Oct '08

29 Oct '08

Hello, has anyone running freeradius v. 2x running on SLES 10 against edirectory? Best regards Boert

6 18

Unable to authenticate to Open Directory
by Kerry Tobin 29 Oct '08

29 Oct '08

I'm trying to use the version of FreeRadius built into OS X for wireless single sign-on and I'm running into some issues. I believe this has come up before and I found the following thread http://lists.freeradius.org/mailman/htdig/freeradius-users/2008-September/m… . I've tried to follow what was suggested there but it doesn't seem to be working. Can someone provide some slightly more thorough instructions of what I should be attempting? Authentication works perfectly for our Macintosh systems and any Windows machine if we don't send a domain for authentication but not when the domain is included. I can authenticate if I add DOMAIN \username as a username for one of the accounts but that's not a "clean" option as far as I'm concerned. No matter what I try with proxies, nthack, etc. I can't seem to get authentication to work for Windows machines. Kerry Tobin

2 1

check_cert_cn translation
by kas mataz 29 Oct '08

29 Oct '08

We've noticed several people have posted their eap.conf for eap-tls troubleshooting, and that both the check_cert_issuer and check_cert_cn are commented out. In these configurations is freeradius just checking for the certificate in the crl list and that the proper CA root is in the CA_file on the freeradius server? What is gained by using check_cert_cn? When we have check_cert_cn enabled it seems that the User-Name is translated differently from different types of devices. When a test user with an iPhone tries to connect he receives errors, but the same certificate on a Microsoft Vista wireless client is successfully authenticated. We've seen this with both freeradius v1.1.7 and v2.1.1. Which file controls the User-Name translation? Fri Oct 24 19:46:58 2008 : Auth: rlm_eap_tls: Certificate CN (Test User (Company 1)) does not match specified value (test.user(a)company1.com) Fri Oct 24 19:46:58 2008 : Error: TLS Alert write:fatal:certificate unknown Fri Oct 24 19:46:58 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Fri Oct 24 19:46:58 2008 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Fri Oct 24 19:46:58 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Fri Oct 24 19:46:58 2008 : Auth: Login incorrect: [test.user(a)company1.com] (from client tstca-wc-c01 port 29 cli 00-23-6C-5B-1C-23) Regards, Kas _________________________________________________________________ Want to read Hotmail messages in Outlook? The Wordsmiths show you how. http://windowslive.com/connect/post/wedowindowslive.spaces.live.com-Blog-cn…

2 1

Re: vsa and authenticate-only service-type
by ganesh subramonian 29 Oct '08

29 Oct '08

Hi, I was trying to use the pam_radius module with the steel-belted-radius-server. This server does not send vsa's in the reply if i send an "authenticate only" in the access-request. is this really expected? any idea whether other radius servers be doing something like this? thanks ganesh >The pam_radius module currently uses the service-type authenticate-only when sending an access-request. > >The rfc says this about "authenticate only": >Only Authentication is requested, and no authorization information needs to be returned in the Access-Accept > >Does this mean that if I want the server to send some VSA in the reply-message i should not use this? No. "no authorization information *needs* to be returned" - not required but you *can* do it if you want. >Is it OK to not send any service-type? Yes, that or any other attribute in the reply. For services that *really* don't require any authorization attributes. Ivan Kalik Kalik Informatika ISP Add more friends to your messenger and enjoy! Go to http://messenger.yahoo.com/invite/

2 1

SSID based checking for Simultaneous-Use?
by ST Wong (ITSC) 29 Oct '08

29 Oct '08

Hi all, I'm using free radius 2.1.1. I got request from boss to enable simultaneous login checking for particular SSID. I've no idea since seems same groups of users may use different SSID's. Would anyone advise if Is it possible to do that? Thank you very much. Regards, /ST Wong

2 1

Is this possible?
by Dajka Tamás 28 Oct '08

28 Oct '08

Hi, I want to use a freeradius server for the following purposes: - grant authorizaton to Cisco switches via LDAP (group membership checking, etc). - make a WIFI with WPA+802.1x via MS IAS/RRAS (the main auth is done by the IAS, so the freeradius acts as client for IAS/RRAS, and the WIFI APs act as radclients for freeradius) - wired 802.1x via MS IAS/RRAS Is this possible in one server? Thanks, Viper

2 1

Need help for configuration - LDAP with custom files Failover
by Dajka Tamás 28 Oct '08

28 Oct '08

Dear All, I'm facing a problem with Freeradius 2.0.4. I want to make a configuration to allow our Cisco routers to auth via RADIUS. For this, we're using a password file now (let's call it ciscopwd) and another file for granting rights. I want to change the config file, so that the auth is done by LDAP (plain passwords), BUT if the LDAP is not available the ciscopwd file will do the job. How can this be done? (moreover, I want to have some LDAP group limitations on the logins) Thanks in advance, Tamas

2 14

Simultaneous-Use check not working
by DAve 28 Oct '08

28 Oct '08

Good afternoon, I have inherited an aged ICRadius install and I am in process of converting to FreeRadius 1.1.7. Currently I have a master DB on our Management server replicating to two radius servers. Each radius server has a unique sql instance to send accounting data to the master DB. Everything is working, the DB conversion from ICRadius to FreeRadius went fine. In testing the only issue I have found is I am unable to stop Simultaneous use. I read the docs carefully, checked the Wiki, and I believe I have everything configured properly. Using RadiusTest 2.4.3 and radwho I see the following. I check for a login using radwho and I see I have a session, I then attempt both a new auth and start accounting again and still radwho shows only one login. [root@radius1 /usr/local/etc/raddb]# radwho Login Name What TTY When From Location yellowhous yellowhousejake shell S1 Mon 11:35 192.168.4 192.168.0.1 --------------------10/27/2008 11:55:13 AM Test started [check newrad1]------------------------- Info:Sending Access-Request of id 0 to 10.0.241.95:1645 Password = "marlin" User-Name = "yellowhousejake" Framed-IP-Address = 192.168.0.1 Acct-Session-Id = "201" Info: Access-Accept packet from host 10.0.241.95:1645, id=0, length=89 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-Routing = None Framed-Compression = Van-Jacobson-TCP-IP Filter-Id = "std.ppp" Framed-MTU = 1500 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 Total time(secs): 0 --------------------10/27/2008 11:55:13 AM Test finished [check newrad1]------------------------- --------------------10/27/2008 11:55:40 AM Test started [start acct]------------------------- Info:Sending Accounting-Request of id 0 to 10.0.241.95:1646 User-Name = "yellowhousejake" Acct-Session-Id = "201" Acct-Status-Type = Start NAS-Port = 1 Framed-IP-Address = 192.168.0.1 Info: Accounting-Response packet from host 10.0.241.95:1646, id=0, length=20 Info:Sending Accounting-Request of id 1 to 10.0.241.95:1646 User-Name = "yellowhousejake" Acct-Session-Id = "201" Acct-Status-Type = Alive NAS-Port = 1 Framed-IP-Address = 192.168.0.1 Info: Accounting-Response packet from host 10.0.241.95:1646, id=1, length=20 Total approved auths: 2 Total denied auths: 0 Total lost auths: 0 Total time(secs): 0 --------------------10/27/2008 11:55:40 AM Test finished [start acct]------------------------- --------------------10/27/2008 11:55:40 AM Test started [start acct]------------------------- Info:Sending Accounting-Request of id 0 to 10.0.241.95:1646 User-Name = "yellowhousejake" Acct-Session-Id = "201" Acct-Status-Type = Start NAS-Port = 1 Framed-IP-Address = 192.168.0.1 Info: Accounting-Response packet from host 10.0.241.95:1646, id=0, length=20 Info:Sending Accounting-Request of id 1 to 10.0.241.95:1646 User-Name = "yellowhousejake" Acct-Session-Id = "201" Acct-Status-Type = Alive NAS-Port = 1 Framed-IP-Address = 192.168.0.1 Info: Accounting-Response packet from host 10.0.241.95:1646, id=1, length=20 Total approved auths: 2 Total denied auths: 0 Total lost auths: 0 Total time(secs): 0 --------------------10/27/2008 11:55:40 AM Test finished [start acct]------------------------- [root@radius1 /usr/local/etc/raddb]# radwho Login Name What TTY When From Location yellowhous yellowhousejake shell S1 Mon 11:55 192.168.4 192.168.0.1 Here are the parts of my conf I believe I need to check for simultaneous use. ## radiusd.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = no callerid = "yes" } accounting { radutmp ## sradutmp sql_acct } session { radutmp sql_acct } ## sql.conf # Uncomment simul_count_query to enable simultaneous use checking simul_count_query = "SELECT COUNT(*) \ FROM ${acct_table1} \ WHERE UserName='%{SQL-User-Name}' \ AND AcctStopTime = 0" Note I enabled radutmp after sql was failing to stop the second login. I am certain I have missed something simple but I am unable to find it. Any help, cluesmacks, etc are appreciated. DAve -- I am watching the debate and I am very disappointed. The rules are simple, "answer the question". I would vote right now, and I can in Indiana, for the man who answered the question directly, in less than a minute, and then sat down before the green light was out.

3 8