- Freeradius-Users - lists.freeradius.org

RE: The first RFC from FreeRADIUS is available
by Eric Stewart 18 Dec '07

18 Dec '07

Alan, this is a big deal. Congratulations! I've been using FreeRADIUS on my modest little network to do simple authentication and EAP-TLS with my wireless for just over a year now and have been well pleased with both the $$$ I'm saving over commercial products which are probably inferior anyway. Now I know that I am using *THE* standards compliant version of RADIUS! ;-) /Eric Said Alan: <begin quote> FreeRADIUS is not only the #1 RADIUS server in the world, it's now also leading the technical side of defining RADIUS. This document has been in progress for over 3 years, and I know I'm happy that it has finally been released. Everyone implementing RADIUS from now on *must* read this document. It is *strongly* suggested that they implement things the FreeRADIUS way. :) Alan DeKok. <snippage> <end quote>

1 0

ERROR:avp:add_avp: no more shm mem
by Marc LEURENT 18 Dec '07

18 Dec '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Good Morning Dan and Good Morning everybody, I've got Freeradius 1.1.7 + (python module enable + rlm_digest patches) OpenSER 1.2.2 + (Radius ACC enable) CDRTool 5.3.2 and I don't understand these outputs... OpenSER is crashing after receiving Authorization from Freeradius... Any idea?? Freeradius sent AVP to OpenSER: SIP-AVP = "callMaxDur:2957" SIP-AVP = "credit:10.0000" SIP-AVP = "authentic#1" And openser is trying to parse it but the there is a problem... 2(30175) DEBUG:auth_radius:generate_avps: getting SIP AVPs from avpair 225 2(30175) DEBUG:auth_radius:extract_avp: string is <ur:2957> 2(30175) DEBUG:auth_radius:extract_avp: AVP name is <ur> 2(30175) DEBUG:auth_radius:extract_avp: AVP val is <2957> 2(30175) ERROR:avp:add_avp: no more shm mem 2(30175) ERROR:auth_radius:generate_avps: Unable to create a new AVP 10(30190) ERROR: receive_fd: EOF on 6 Thanks ### Small Freeradius output ### A2 = INVITE:sip:0677832974@sip.wifirst.net H(A1) = b82eaab7b4eaab2db812d3a2695f0e22 H(A2) = 83134a8c6b9ea1a20de012abf16e87f5 KD = b82eaab7b4eaab2db812d3a2695f0e22:47679476280e04ea50ded04b24f7d3f75068eea7:83134a8c6b9ea1a20de012abf16e87f5 EXPECTED 40ed14d07aa16035e67c21886a802379 RECEIVED 40ed14d07aa16035e67c21886a802379 modcall[authenticate]: module "digest" returns ok for request 71 modcall: leaving group authenticate (returns ok) for request 71 Login OK: [mleurent(a)sip.wifirst.net/<no User-Password attribute>] (from client private port 5060) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 71 rlm_sql (sql): Processing sql_postauth radius_xlat: 'mleurent(a)sip.wifirst.net' rlm_sql (sql): sql_set_user escaped user --> 'mleurent(a)sip.wifirst.net' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'mleurent(a)sip.wifirst.net', 'Chap-Password', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'mleurent(a)sip.wifirst.net', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 71 modcall: leaving group post-auth (returns ok) for request 71 Sending Access-Accept of id 180 to 172.24.0.8 port 47861 SIP-AVP = "callMaxDur:2957" SIP-AVP = "credit:10.0000" SIP-AVP = "authentic#1" Finished request 71 Going to the next request - --- Walking the entire request list --- Waking up in 6 seconds... ### Full OpenSER output ### 2(30175) SIP Request: 2(30175) method: <INVITE> 2(30175) uri: <sip:0677832974@sip.wifirst.net> 2(30175) version: <SIP/2.0> 2(30175) parse_headers: flags=2 2(30175) get_hdr_field: cseq <CSeq>: <2> <INVITE> 2(30175) Found param type 232, <branch> = <z9hG4bK3c2eaf3d-baab-dc11-90b2-ed571fe4ba74>; state=6 2(30175) Found param type 235, <rport> = <n/a>; state=17 2(30175) end of header reached, state=5 2(30175) parse_headers: Via found, flags=2 2(30175) parse_headers: this is the first via 2(30175) After parse_msg... 2(30175) preparing to run routing scripts... 2(30175) parse_headers: flags=100 2(30175) DEBUG:parse_to:end of header reached, state=10 2(30175) DBUG:parse_to: display={}, ruri={sip:0677832974@sip.wifirst.net} 2(30175) DEBUG: get_hdr_field: <To> [34]; uri=[sip:0677832974@sip.wifirst.net] 2(30175) DEBUG: to body [<sip:0677832974@sip.wifirst.net> ] 2(30175) DEBUG: get_hdr_body : content_length=235 2(30175) DEBUG:maxfwd:is_maxfwd_present: value = 70 2(30175) DBG:maxfwd:process_maxfwd_header: value 70 decreased to 50 2(30175) !!!! STARTING ROUTE 2: TEST NAT 2(30175) !!!!!!!!! YAHH NAT DETECTED - FIXING CONTACT!!!!!!!!!!!!! 2(30175) parse_headers: flags=80 2(30175) DEBUG: add_param: tag=2eb08b3d-baab-dc11-90b2-ed571fe4ba74 2(30175) DEBUG:parse_to:end of header reached, state=29 2(30175) DBUG:parse_to: display={"Marc LEURENT"}, ruri={sip:mleurent@sip.wifirst.net} 2(30175) parse_headers: flags=200 2(30175) found end of header 2(30175) find_first_route: No Route headers found 2(30175) loose_route: There is no Route HF 2(30175) grep_sock_info - checking if host==us: 15==12 && [sip.wifirst.net] == [213.91.4.219] 2(30175) grep_sock_info - checking if port 5060 matches port 5060 2(30175) JUSTE BEFORE SETTING FLAGS FOR RADIUS 2(30175) DEBUG: has_totag: no totag 2(30175) I AM SETTING THE FLAGS FOR RADIUS 2(30175) SETTING FLAGS 1 FOR RADIUS 2(30175) SETTING FLAGS 2 FOR RADIUS 2(30175) grep_sock_info - checking if host==us: 15==12 && [sip.wifirst.net] == [213.91.4.219] 2(30175) grep_sock_info - checking if port 5060 matches port 5060 2(30175) grep_sock_info - checking if host==us: 15==12 && [sip.wifirst.net] == [213.91.4.219] 2(30175) grep_sock_info - checking if port 5060 matches port 5060 2(30175) check_nonce(): comparing [47679476280e04ea50ded04b24f7d3f75068eea7] and [47679476280e04ea50ded04b24f7d3f75068eea7] 2(30175) DEBUG:auth_radius:radius_authorize_sterman: Success 2(30175) DEBUG:auth_radius:generate_avps: getting SIP AVPs from avpair 225 2(30175) DEBUG:auth_radius:extract_avp: string is <ur:2957> 2(30175) DEBUG:auth_radius:extract_avp: AVP name is <ur> 2(30175) DEBUG:auth_radius:extract_avp: AVP val is <2957> 2(30175) ERROR:avp:add_avp: no more shm mem 2(30175) ERROR:auth_radius:generate_avps: Unable to create a new AVP 10(30190) ERROR: receive_fd: EOF on 6 10(30190) DBG: handle_ser_child: dead child 2, pid 30175 (shutting down?) 10(30190) DBG: io_watch_del (0x5b5c20, 6, -1, 0x0) fd_no=13 called 0(30173) child process 30175 exited by a signal 11 0(30173) core was generated 0(30173) INFO: terminating due to SIGCHLD 4(30177) INFO: signal 15 received 4(30177) Memory status (pkg): 4(30177) fm_status (0x5f6d80): 4(30177) heap size= 1048576 4(30177) used= 77952, used+overhead=122432, free=926144 4(30177) max used (+overhead)= 129560 4(30177) dumping free list: 4(30177) hash = 1 fragments no.: 4, unused: 0 bucket size: 8 - 8 (first 8) 4(30177) hash = 2 fragments no.: 6, unused: 0 bucket size: 16 - 16 (first 16) 4(30177) hash = 3 fragments no.: 4, unused: 0 bucket size: 24 - 24 (first 24) 4(30177) hash = 4 fragments no.: 1, unused: 0 bucket size: 32 - 32 (first 32) 4(30177) hash = 5 fragments no.: 1, unused: 0 bucket size: 40 - 40 (first 40) 4(30177) hash = 6 fragments no.: 4, unused: 0 bucket size: 48 - 48 (first 48) 4(30177) hash = 7 fragments no.: 25, unused: 0 bucket size: 56 - 56 (first 56) 4(30177) hash = 8 fragments no.: 6, unused: 0 bucket size: 64 - 64 (first 64) 4(30177) hash = 9 fragments no.: 14, unused: 0 bucket size: 72 - 72 (first 72) 4(30177) hash = 10 fragments no.: 2, unused: 0 bucket size: 80 - 80 (first 80) 4(30177) hash = 11 fragments no.: 1, unused: 0 bucket size: 88 - 88 (first 88) 4(30177) hash = 15 fragments no.: 1, unused: 0 bucket size: 120 - 120 (first 120) 4(30177) hash = 28 fragments no.: 1, unused: 0 bucket size: 224 - 224 (first 224) 4(30177) hash = 29 fragments no.: 1, unused: 0 bucket size: 232 - 232 (first 232) 4(30177) hash = 52 fragments no.: 2, unused: 0 bucket size: 416 - 416 (first 416) 4(30177) hash = 62 fragments no.: 1, unused: 0 bucket size: 496 - 496 (first 496) 4(30177) hash = 64 fragments no.: 1, unused: 0 bucket size: 512 - 512 (first 512) 4(30177) hash = 65 fragments no.: 1, unused: 0 bucket size: 520 - 520 (first 520) 4(30177) hash = 146 fragments no.: 1, unused: 0 bucket size: 1168 - 1168 (first 1168) 4(30177) hash = 176 fragments no.: 1, unused: 0 bucket size: 1408 - 1408 (first 1408) 4(30177) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 917296) 4(30177) TOTAL: 79 free fragments = 926336 free bytes 4(30177) ----------------------------- 5(30178) INFO: signal 15 received 5(30178) Memory status (pkg): 5(30178) fm_status (0x5f6d80): 5(30178) heap size= 1048576 5(30178) used= 77776, used+overhead=121040, free=927536 5(30178) max used (+overhead)= 121504 5(30178) dumping free list: 5(30178) hash = 2 fragments no.: 1, unused: 0 bucket size: 16 - 16 (first 16) 5(30178) hash = 41 fragments no.: 1, unused: 0 bucket size: 328 - 328 (first 328) 5(30178) hash = 55 fragments no.: 1, unused: 0 bucket size: 440 - 440 (first 440) 5(30178) hash = 56 fragments no.: 1, unused: 0 bucket size: 448 - 448 (first 448) 5(30178) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 926496) 5(30178) TOTAL: 5 free fragments = 927728 free bytes 5(30178) ----------------------------- 1(30174) INFO: signal 15 received 1(30174) Memory status (pkg): 1(30174) fm_status (0x5f6d80): 1(30174) heap size= 1048576 3(30176) INFO: signal 15 received 3(30176) Memory status (pkg): 3(30176) fm_status (0x5f6d80): 3(30176) heap size= 1048576 3(30176) used= 77936, used+overhead=122400, free=926176 3(30176) max used (+overhead)= 129576 3(30176) dumping free list: 3(30176) hash = 1 fragments no.: 6, unused: 0 bucket size: 8 - 8 (first 8) 3(30176) hash = 2 fragments no.: 4, unused: 0 bucket size: 16 - 16 (first 16) 3(30176) hash = 3 fragments no.: 1, unused: 0 bucket size: 24 - 24 (first 24) 3(30176) hash = 4 fragments no.: 2, unused: 0 bucket size: 32 - 32 (first 32) 3(30176) hash = 6 fragments no.: 3, unused: 0 bucket size: 48 - 48 (first 48) 3(30176) hash = 7 fragments no.: 24, unused: 0 bucket size: 56 - 56 (first 56) 3(30176) hash = 8 fragments no.: 3, unused: 0 bucket size: 64 - 64 (first 64) 3(30176) hash = 9 fragments no.: 16, unused: 0 bucket size: 72 - 72 (first 72) 3(30176) hash = 10 fragments no.: 4, unused: 0 bucket size: 80 - 80 (first 80) 1(30174) used= 77992, used+overhead=122472, free=926104 1(30174) max used (+overhead)= 129696 1(30174) dumping free list: 1(30174) hash = 1 fragments no.: 6, unused: 0 bucket size: 8 - 8 (first 8) 1(30174) hash = 2 fragments no.: 5, unused: 0 bucket size: 16 - 16 (first 16) 1(30174) hash = 3 fragments no.: 3, unused: 0 bucket size: 24 - 24 (first 24) 1(30174) hash = 6 fragments no.: 6, unused: 0 bucket size: 48 - 48 (first 48) 1(30174) hash = 7 fragments no.: 29, unused: 0 bucket size: 56 - 56 (first 56) 1(30174) hash = 8 fragments no.: 3, unused: 0 bucket size: 64 - 64 (first 64) 1(30174) hash = 9 fragments no.: 16, unused: 0 bucket size: 72 - 72 (first 72) 1(30174) hash = 11 fragments no.: 2, unused: 0 bucket size: 88 - 88 (first 88) 1(30174) hash = 19 fragments no.: 1, unused: 0 bucket size: 152 - 152 (first 152) 1(30174) hash = 28 fragments no.: 1, unused: 0 bucket size: 224 - 224 (first 224) 1(30174) hash = 29 fragments no.: 1, unused: 0 bucket size: 232 - 232 (first 232) 1(30174) hash = 52 fragments no.: 2, unused: 0 bucket size: 416 - 416 (first 416) 1(30174) hash = 96 fragments no.: 1, unused: 0 bucket size: 768 - 768 (first 768) 1(30174) hash = 150 fragments no.: 1, unused: 0 bucket size: 1200 - 1200 (first 1200) 1(30174) hash = 176 fragments no.: 1, unused: 0 bucket size: 1408 - 1408 (first 1408) 1(30174) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 917848) 1(30174) TOTAL: 79 free fragments = 926296 free bytes 1(30174) ----------------------------- 3(30176) hash = 13 fragments no.: 1, unused: 0 bucket size: 104 - 104 (first 104) 3(30176) hash = 14 fragments no.: 1, unused: 0 bucket size: 112 - 112 (first 112) 3(30176) hash = 15 fragments no.: 1, unused: 0 bucket size: 120 - 120 (first 120) 3(30176) hash = 28 fragments no.: 2, unused: 0 bucket size: 224 - 224 (first 224) 3(30176) hash = 29 fragments no.: 1, unused: 0 bucket size: 232 - 232 (first 232) 3(30176) hash = 52 fragments no.: 2, unused: 0 bucket size: 416 - 416 (first 416) 3(30176) hash = 58 fragments no.: 1, unused: 0 bucket size: 464 - 464 (first 464) 3(30176) hash = 59 fragments no.: 1, unused: 0 bucket size: 472 - 472 (first 472) 3(30176) hash = 102 fragments no.: 1, unused: 0 bucket size: 816 - 816 (first 816) 3(30176) hash = 122 fragments no.: 1, unused: 0 bucket size: 976 - 976 (first 976) 3(30176) hash = 128 fragments no.: 1, unused: 0 bucket size: 1024 - 1024 (first 1024) 3(30176) hash = 176 fragments no.: 1, unused: 0 bucket size: 1408 - 1408 (first 1408) 3(30176) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 916008) 3(30176) TOTAL: 78 free fragments = 926368 free bytes 3(30176) ----------------------------- 10(30190) INFO: signal 15 received 10(30190) Memory status (pkg): 10(30190) fm_status (0x5f6d80): 10(30190) heap size= 1048576 10(30190) used= 127600, used+overhead=170816, free=877760 10(30190) max used (+overhead)= 170816 10(30190) dumping free list: 10(30190) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 877952) 10(30190) TOTAL: 1 free fragments = 877952 free bytes 10(30190) ----------------------------- 9(30188) INFO: signal 15 received 9(30188) Memory status (pkg): 9(30188) fm_status (0x5f6d80): 9(30188) heap size= 1048576 9(30188) used= 135792, used+overhead=179024, free=869552 9(30188) max used (+overhead)= 179024 9(30188) dumping free list: 9(30188) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 869744) 9(30188) TOTAL: 1 free fragments = 869744 free bytes 9(30188) ----------------------------- 6(30181) INFO: signal 15 received 6(30181) Memory status (pkg): 6(30181) fm_status (0x5f6d80): 6(30181) heap size= 1048576 6(30181) used= 135792, used+overhead=179024, free=869552 6(30181) max used (+overhead)= 179024 6(30181) dumping free list: 6(30181) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 869744) 6(30181) TOTAL: 1 free fragments = 869744 free bytes 6(30181) 8(30185) INFO: signal 15 received 8(30185) Memory status (pkg): 8(30185) fm_status (0x5f6d80): 8(30185) heap size= 1048576 8(30185) used= 135792, used+overhead=179024, free=869552 8(30185) max used (+overhead)= 179024 8(30185) dumping free list: 8(30185) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 869744) 8(30185) TOTAL: 1 free fragments = 869744 free bytes 8(30185) ----------------------------- - ----------------------------- 7(30182) INFO: signal 15 received 7(30182) Memory status (pkg): 7(30182) fm_status (0x5f6d80): 7(30182) heap size= 1048576 7(30182) used= 135792, used+overhead=179024, free=869552 7(30182) max used (+overhead)= 179024 7(30182) dumping free list: 7(30182) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 869744) 7(30182) TOTAL: 1 free fragments = 869744 free bytes 7(30182) ----------------------------- 1(30174) INFO: signal 15 received 1(30174) Memory status (pkg): 1(30174) fm_status (0x5f6d80): 1(30174) heap size= 1048576 1(30174) used= 85664, used+overhead=128704, free=919872 1(30174) max used (+overhead)= 128704 1(30174) dumping free list: 1(30174) hash = 11 fragments no.: 1, unused: 0 bucket size: 88 - 88 (first 88) 1(30174) hash = 42 fragments no.: 1, unused: 0 bucket size: 336 - 336 (first 336) 1(30174) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 919640) 1(30174) TOTAL: 3 free fragments = 920064 free bytes 1(30174) ----------------------------- 0(30173) pool_remove: Connection still kept in the pool 0(30173) pool_remove: Connection still kept in the pool 0(30173) XLOG: destroy module ... 0(30173) pool_remove: Removing connection from the pool 0(30173) pool_remove: Connection still kept in the pool 0(30173) INFO:mi_fifo:mi_destroy: seems that fifo child is already dead! 0(30173) pool_remove: Removing connection from the pool 0(30173) DEBUG: tm_shutdown : start 0(30173) DEBUG: unlink_timer_lists : emptying DELETE list 0(30173) DEBUG: tm_shutdown : emptying hash table 0(30173) DEBUG: tm_shutdown : releasing timers 0(30173) DEBUG: tm_shutdown : removing semaphores 0(30173) DEBUG: tm_shutdown : destroying tmcb lists 0(30173) DEBUG: tm_shutdown : done 0(30173) Memory status (pkg): 0(30173) fm_status (0x5f6d80): 0(30173) heap size= 1048576 0(30173) used= 56464, used+overhead=99648, free=948928 0(30173) max used (+overhead)= 112768 0(30173) dumping free list: 0(30173) hash = 1 fragments no.: 7, unused: 0 bucket size: 8 - 8 (first 8) 0(30173) hash = 2 fragments no.: 3, unused: 0 bucket size: 16 - 16 (first 16) 0(30173) hash = 3 fragments no.: 7, unused: 0 bucket size: 24 - 24 (first 24) 0(30173) hash = 4 fragments no.: 33, unused: 0 bucket size: 32 - 32 (first 32) 0(30173) hash = 6 fragments no.: 9, unused: 0 bucket size: 48 - 48 (first 48) 0(30173) hash = 7 fragments no.: 5, unused: 0 bucket size: 56 - 56 (first 56) 0(30173) hash = 8 fragments no.: 1, unused: 0 bucket size: 64 - 64 (first 64) 0(30173) hash = 9 fragments no.: 2, unused: 0 bucket size: 72 - 72 (first 72) 0(30173) hash = 12 fragments no.: 9, unused: 0 bucket size: 96 - 96 (first 96) 0(30173) hash = 13 fragments no.: 1, unused: 0 bucket size: 104 - 104 (first 104) 0(30173) hash = 14 fragments no.: 3, unused: 0 bucket size: 112 - 112 (first 112) 0(30173) hash = 21 fragments no.: 2, unused: 0 bucket size: 168 - 168 (first 168) 0(30173) hash = 156 fragments no.: 2, unused: 0 bucket size: 1248 - 1248 (first 1248) 0(30173) hash = 842 fragments no.: 1, unused: 0 bucket size: 6736 - 6736 (first 6736) 0(30173) hash = 2054 fragments no.: 1, unused: 0 bucket size: 524288 - 1048576 (first 936000) 0(30173) TOTAL: 86 free fragments = 949120 free bytes 0(30173) ----------------------------- 0(30173) Memory status (shm): 0(30173) fm_status (0x2ab19f9d0000): 0(30173) heap size= 33554432 0(30173) used= 144, used+overhead=36720, free=33517712 0(30173) max used (+overhead)= 2746832 0(30173) dumping free list: 0(30173) hash = 1 fragments no.: 56, unused: 0 bucket size: 8 - 8 (first 8) 0(30173) hash = 2 fragments no.: 12, unused: 0 bucket size: 16 - 16 (first 16) 0(30173) hash = 3 fragments no.: 9, unused: 0 bucket size: 24 - 24 (first 24) 0(30173) hash = 4 fragments no.: 10, unused: 0 bucket size: 32 - 32 (first 32) 0(30173) hash = 5 fragments no.: 3, unused: 0 bucket size: 40 - 40 (first 40) 0(30173) hash = 6 fragments no.: 4, unused: 0 bucket size: 48 - 48 (first 48) 0(30173) hash = 7 fragments no.: 47, unused: 0 bucket size: 56 - 56 (first 56) 0(30173) hash = 8 fragments no.: 3, unused: 0 bucket size: 64 - 64 (first 64) 0(30173) hash = 9 fragments no.: 6, unused: 0 bucket size: 72 - 72 (first 72) 0(30173) hash = 10 fragments no.: 2, unused: 0 bucket size: 80 - 80 (first 80) 0(30173) hash = 12 fragments no.: 1, unused: 0 bucket size: 96 - 96 (first 96) 0(30173) hash = 15 fragments no.: 1, unused: 0 bucket size: 120 - 120 (first 120) 0(30173) hash = 17 fragments no.: 1, unused: 0 bucket size: 136 - 136 (first 136) 0(30173) hash = 21 fragments no.: 5, unused: 0 bucket size: 168 - 168 (first 168) 0(30173) hash = 22 fragments no.: 1, unused: 0 bucket size: 176 - 176 (first 176) 0(30173) hash = 35 fragments no.: 1, unused: 0 bucket size: 280 - 280 (first 280) 0(30173) hash = 76 fragments no.: 1, unused: 0 bucket size: 608 - 608 (first 608) 0(30173) hash = 104 fragments no.: 1, unused: 0 bucket size: 832 - 832 (first 832) 0(30173) hash = 110 fragments no.: 1, unused: 0 bucket size: 880 - 880 (first 880) 0(30173) hash = 112 fragments no.: 1, unused: 0 bucket size: 896 - 896 (first 896) 0(30173) hash = 128 fragments no.: 2, unused: 0 bucket size: 1024 - 1024 (first 1024) 0(30173) hash = 150 fragments no.: 1, unused: 0 bucket size: 1200 - 1200 (first 1200) 0(30173) hash = 193 fragments no.: 1, unused: 0 bucket size: 1544 - 1544 (first 1544) 0(30173) hash = 224 fragments no.: 1, unused: 0 bucket size: 1792 - 1792 (first 1792) 0(30173) hash = 258 fragments no.: 2, unused: 0 bucket size: 2064 - 2064 (first 2064) 0(30173) hash = 727 fragments no.: 1, unused: 0 bucket size: 5816 - 5816 (first 5816) 0(30173) hash = 831 fragments no.: 1, unused: 0 bucket size: 6648 - 6648 (first 6648) 0(30173) hash = 1024 fragments no.: 2, unused: 0 bucket size: 8192 - 8192 (first 8192) 0(30173) hash = 2049 fragments no.: 2, unused: 0 bucket size: 16384 - 32768 (first 20480) 0(30173) hash = 2056 fragments no.: 1, unused: 0 bucket size: 2097152 - 4194304 (first 2621440) 0(30173) hash = 2059 fragments no.: 1, unused: 0 bucket size: 16777216 - 33554432 (first 30805984) 0(30173) TOTAL: 181 free fragments = 33517712 free bytes 0(30173) ----------------------------- 0(30173) shm_mem_destroy 0(30173) destroying the shared memory lock 0(30173) terminating due to SIGCHLD -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFHZ5doN4+o+2LtdFwRAknyAKCXJHhyHZlAooGoyONmFphFcZE3BgCfbJOO aN4wxnGPjLgxqVvx5YTgGac= =pkmq -----END PGP SIGNATURE-----

1 0

Configuring RADIUS for EAP-PEAP-MSCHAPv2, EAP-GTC and EAP-TLS
by Gaurav Bandekar 18 Dec '07

18 Dec '07

Hi, I need to configure RADIUS for EAP-PEAP-MSCHAPv2, EAP-GTC and EAP-TLS. How can I produce the certificate for them. How do I specify what certificate to use for EAP-PEAP-MSCHAPv2 and EAP-GTC. Thanks & Regards Gaurav

3 6

How to configure freeradius to support, EAP-TTLS, CHAP/PAP
by Raghavendra. S 18 Dec '07

18 Dec '07

Hi All, I was able to get authenticated using radius server for EAP-TTLS/EAP-MD5, by having following configuration Modified eap.conf --------------------------------------------- eap { default_eap_type=ttls ..... ttls { default_eap_type=md5 ..... } } Modified users file as below -------------------------------------------------------------------- raghu User-Password == "whatever" Modified clients.conf as ------------------------------------------------ 10.89.49.1 { secret=raghu123456 shortname=3Com } Can anybody tell me how to support, EAP-TTLS, CHAP/PAP... I mean second level protocol inside TTLS should be chap/pap/mschap/mschapv2. -- Regards & Thanks Raghavendra. S

2 1

The first RFC from FreeRADIUS is available
by Alan DeKok 18 Dec '07

18 Dec '07

FreeRADIUS is not only the #1 RADIUS server in the world, it's now also leading the technical side of defining RADIUS. This document has been in progress for over 3 years, and I know I'm happy that it has finally been released. Everyone implementing RADIUS from now on *must* read this document. It is *strongly* suggested that they implement things the FreeRADIUS way. :) Alan DeKok. ---------------- A new Request for Comments is now available in online RFC libraries. RFC 5080 Title: Common Remote Authentication Dial In User Service (RADIUS) Implementation Issues and Suggested Fixes Author: D. Nelson, A. DeKok Status: Standards Track Date: December 2007 Mailbox: dnelson(a)elbrysnetworks.com, aland(a)freeradius.org Pages: 28 Characters: 64138 Updates: RFC2865, RFC2866, RFC2869, RFC3579 See-Also: I-D Tag: draft-ietf-radext-fixes-08.txt URL: http://www.rfc-editor.org/rfc/rfc5080.txt This document describes common issues seen in Remote Authentication Dial In User Service (RADIUS) implementations and suggests some fixes. Where applicable, ambiguities and errors in previous RADIUS specifications are clarified. [STANDARDS TRACK] This document is a product of the RADIUS EXTensions Working Group of the IETF. This is now a Proposed Standard Protocol.

1 0

Problem using Freeradius with Oracle
by Mother 17 Dec '07

17 Dec '07

Hi all, My setup is FreeBSD 6.2, with Freeradius 1.1.7 installed using Ports (I had to hack the configure so it would be built with Oracle, as there is no option in the Ports make, but I digress...). I have everything working now, but when the accounting stop message is received, the SQL call causes Oracle to balk. The call (with non-relevant portions removed) is: UPDATE radacct SET ... AcctInputOctets = '0' << 32 | '0', AcctOutputOctets = '0' << 32 | '0', ... WHERE ... Now, Acc[input/output]Octets as I see in oraclesql.conf is derived like this: AcctInputOctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}' So it seems (AFAIK) that it's attempting to bit-shift the Gigawords and Octets received from the NAS. My problem is that if this syntax is used, Oracle complains with 'ORA-00933: SQL command not properly ended'. If I remove the <<, and add an extra pipe (|| is concatenate in Oracle), it seems to work, but not as it should. Has anyone got this working in their setup? Cheers, Mike

5 7

unlinked OIDs in MIBs
by Stuart Kendrick 17 Dec '07

17 Dec '07

hi, fyi: i think there are syntax errors in the new FREERADIUS MIBS. regrettably, i'm not smart enough to know how fix these myself ... guru> snmptranslate Did not find 'gnomeProducts' in module FREERADIUS-SMI (/opt/vdops/share/snmp/mib s/Freeradius/FREERADIUS-PRODUCT-RADIUSD-MIB.txt) Unlinked OID in FREERADIUS-PRODUCT-RADIUSD-MIB: freeradius ::= { freeradiusProdu cts 1 } Undefined identifier: freeradiusProducts near line 10 of /opt/vdops/share/snmp/m ibs/Freeradius/FREERADIUS-PRODUCT-RADIUSD-MIB.txt Cannot adopt OID in FREERADIUS-PRODUCT-RADIUSD-MIB: freeradius ::= { freeradiusP roducts 1 } Cannot adopt OID in FREERADIUS-PRODUCT-RADIUSD-MIB: freeradius ::= { freeradiusP roducts 1 } USAGE: snmptranslate [OPTIONS] OID [OID]... [...] --sk stuart kendrick fhcrc

2 1

general protection fault 1.1.6
by Joe Vieira 17 Dec '07

17 Dec '07

rhel5 x86-64 2.6.18-8.1.6.el5 freeradius 1.1.6 ntlm authentication to windows AD server. Dec 16 15:50:13 ion winbindd[18013]: rpc_api_pipe: Remote machine activedirectoryserver.clarku.edu pipe \NETLOGON fnum 0xc003returned critical error. Error was Call timed out: server did not respond after 10000 milliseconds Dec 16 18:03:58 ion kernel: radiusd[17644] general protection rip:2aaaac1666d5 rsp:7fff600f93f0 error:0 Any chance these are related, (i know the times are far apart, however our radius server is very slow on the weekends, as well as over winter break which we are currently) i could actually imagine going an hour or even two without any authentication attempts. -- Joe Vieira UNIX Systems Administrator Clark University - ITS

1 0

Help: Redback dictionary
by A.Dupont 16 Dec '07

16 Dec '07

Hello, I need the latest version of Redback dictionary plz. (Dictionary.redback). Thanks in advance _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail http://mail.yahoo.fr

2 1

authenticating a user via rlm_sql
by Stuart Kendrick 16 Dec '07

16 Dec '07

hi, i'm trying to migrate from a flat 'users' file to postgres, and i'm seeing "No 'known good' password found for the user" from rlm_pap. freeradius-2.0.0-pre2 with an empty postgres database, i see radtest/debug traffic like this: guru> ./radtest steve testing localhost 1234 testing123 [...] rad_recv: Access-Accept packet from host 127.0.0.1 port 1234, id=172, length=20 rad_recv: Access-Request packet from host 127.0.0.1 port 52838, id=56, length=57 User-Name = "steve" User-Password = "testing" NAS-IP-Address = 140.107.74.123 NAS-Port = 1234 [...] ++[files] returns ok expand: %{User-Name} -> steve rlm_sql (sql): sql_set_user escaped user --> 'steve' rlm_sql (sql): Reserving sql socket id: 4 [...] rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [...] rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): User steve not found [...] rlm_pap: login attempt with password testing rlm_pap: Using clear text password. rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [steve/testing] (from client localhost port 1234) Sending Access-Accept of id 56 to 127.0.0.1 port 52838 [...] that makes sense ... 'steve' does not exist in the postgres database, but is defined in '/etc/radbb/users' so now i go add user 'foozle' to my database: radius=> select * from radcheck; id | username | attribute | op | value ----+----------+--------------------+----+------- 1 | foozle | Cleartext-Password | == | foo (1 row) radius=> select * from radreply; id | username | attribute | op | value ----+----------+--------------+----+------- 1 | foozle | Fall-Through | = | Yes (1 row) radius=> select * from radcheck; id | username | attribute | op | value ----+----------+--------------------+----+------- 1 | foozle | Cleartext-Password | == | foo (1 row) radius=> select * from radusergroup; username | groupname | priority ----------+-----------+---------- foozle | HutchNet | 0 (1 row) radius=> select * from radgroupcheck; id | groupname | attribute | op | value ----+-----------+-----------+----+------- (0 rows) radius=> select * from radgroupreply; id | groupname | attribute | op | value ----+-----------+-------------------------+----+---------- 1 | HutchNet | Tunnel-Type | := | VLAN 2 | HutchNet | Tunnel-Medium-Type | := | 802 3 | HutchNet | Tunnel-Private-Group-ID | := | HutchNet (3 rows) radius=> and test using: vishnu> ./radtest foozle foo localhost 1234 testing123 [...] rad_recv: Access-Reject packet from host 127.0.0.1 port 1234, id=166, length=20 [...] ++[files] returns noop expand: %{User-Name} -> foozle rlm_sql (sql): sql_set_user escaped user --> 'foozle' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, Op FROM rad check WHERE Username = '%{SQL-User-Name}' ORDER BY id -> S ELECT id, UserName, Attribute, Value, Op FROM radcheck W HERE Username = 'foozle' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op F ROM radcheck WHERE Username = 'foozle' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Na me}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='foo zle' ORDER BY priority rlm_sql_postgresql: query: SELECT GroupName FROM radusergroup WHERE UserName='fo ozle' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupchec k WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'HutchNet' ORDER BY id rlm_sql_postgresql: query: SELECT id, GroupName, Attribute, Value, op FROM r adgroupcheck WHERE GroupName = 'HutchNet' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (sql): User found in group HutchNet expand: SELECT id, GroupName, Attribute, Value, op FROM radgrouprepl y WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'HutchNet' ORDER BY id rlm_sql_postgresql: query: SELECT id, GroupName, Attribute, Value, op FROM r adgroupreply WHERE GroupName = 'HutchNet' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 3 , fields = 5 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication m ay fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Re jecting the user auth: Failed to validate the user. ok, so why isn't "++[sql] returns ok" good enough? seems to me that rlm_sql is happy ... it found the user, it agrees that the associated password is correct ... but radiusd keeps on going, to rlm_pap, which does not find a match ... and radiusd returns Access-Reject looking at my /etc/raddb config files ... i've made the following changes from default: radiusd.conf: log_destination = syslog user = nobody group = nobody log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes proxy_requests = no $INCLUDE ${confdir}/sql/postgresql/counter.conf sql.conf: database = "postgres" sqltrace = yes sites-enabled/default: # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql - suggestions on how to dig a little deeper into why radiusd continues to rlm_pap? - sqltrace.sql remains stubbornly empty ... have any tips on populating it? i've tried running radiusd as 'root' (this to test file system permissions on 'sqltrace.sql' ... but even then, this file remains empty tia, --sk stuart kendrick fhcrc

2 1