- Freeradius-Users - lists.freeradius.org

Segmentation Fault while connecting users to the radius Server
by prajakta choudhari 24 May '07

24 May '07

Hi all: I have configured the radius server . I have a linksys router with wireless security as RADIUS enabled and laptop that connects to the linksys router. whenever i try connecting to the router, i get a segmentation fault. I am pasting the output ./radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/root/cer/cert-srv.pem" tls: certificate_file = "/root/cer/cert-srv.pem" tls: CA_file = "/root/cer/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=129 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d01636572742d636c74 Message-Authenticator = 0xbceb70d19b2cc1c0dc9322fed00b080b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry cert-clt at line 147 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.6.15 port 2050 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc74d3df792dfa42ce1d7641977a986be Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=214 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0xc74d3df792dfa42ce1d7641977a986be NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100500d800000004616030100410100003d03014655e5839870f7090875f2d03b01a78dfc08d4ff29504c0d955feed1f10d22e400001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xb260838022a8d6cef007c044dfa525e1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry cert-clt at line 147 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0615], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0093], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.6.15 port 2050 EAP-Message = 0x0102040a0dc000000701160301004a0200004603014655358ff1959233436e77369c581d28e3c2fb848153ae6bde2d1ff533a4bc0a20ef2ef232ab36c20b2f50da0044c8a39c22c669dc1a2f0ac3d3fcca41470d5ddd00040016030106150b00061100060e00029830820294308201fda003020102020102300d06092a864886f70d0101050500308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d0109011611707261 EAP-Message = 0x6a616b74616340636461632e696e301e170d3037303532333131343432345a170d3038303532323131343432345a308184310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e4953473111300f06035504031308636572742d7372763120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100b029e54f9c5b0446b441bbc278888d395ed5698804fc447076f2495fbfd46904b18e2a80c9343b16f49b4e EAP-Message = 0xc15dc980a1522a40f493c0f039686de2170597ef8c8ad201fa94d678e437151a18a3629e93e52f228baad4f2aa3fbf34b3401a33c596b3b060148f368802978f49b55c8ec5bc44a4cf30f35d0a5bab51e80ec4d5dd0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100a5550a63cfb66f97d6f4d10d1cb572e0a0afd9d5efe92bb6f725651932333fc1bfa4631917ec15d92f68c73e95f09bf98f1832bd7c0766a3cac4d23aecf496c77cac9dd1ef68af34bd0621e954c914e4f6defebe16f413c348a3364cd724d4f663bc8b0797bbc3b7de39ef86d6a3f315104db7450643d6 EAP-Message = 0xaa03d794a71ff17ef80003703082036c308202d5a003020102020900d6bff812d049419a300d06092a864886f70d0101050500308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e301e170d3037303532333131343333365a170d3039303532323131343333365a308181310b300906035504061302494e311430120603550408130b4d61686172617368747261 EAP-Message = 0x310d300b060355040a130443444143310c300a060355 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64f32e25c5aaf8ab88d7a8e3848c6bc1 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x64f32e25c5aaf8ab88d7a8e3848c6bc1 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060d00 Message-Authenticator = 0x4e5b8e387844bf4783e884f01df16133 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry cert-clt at line 147 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.6.15 port 2050 EAP-Message = 0x0103030b0d8000000701040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100bdfe4112c5041e54060423446b4f5bee0b6bb2d4699d825e9227e60574e27526aa1177fdc5e63dbf6d341f635b681e184231abb90993e97449f584eb88cd59a3514e6cc869891e71c703cf5939fd218ec8db0f0243860e4307a853b7ab6edd4c14b04bd6091b354d7a62150dda4b42c0e9957dadb10b205b2c745d35b155891f0203010001a381e93081e6301d06 EAP-Message = 0x03551d0e0416041495b0e7c6e725388bd31920c5587965c16ec8f8e43081b60603551d230481ae3081ab801495b0e7c6e725388bd31920c5587965c16ec8f8e4a18187a48184308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e820900d6bff812d049419a300c0603551d13040530030101ff300d06092a864886f70d01010505000381810030b37815ac668d EAP-Message = 0x0f6b68bbf734eaa9de304ef85416c0c7ca567dadd2f19b9313e21f8ffb40a1276b47b928ef9c28c74b4a3cd252cef6879e941f2dd3c3822888ec259ce5d3a59a130baa0320ff513ede689b6c5cd856a428edb1f9ed622586b74819cd4b12e0fcd2c1261ddf576af64371bda1c61427c0029f291838b49e5d4d16030100930d00008b02010200860084308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d010901161170 EAP-Message = 0x72616a616b74616340636461632e696e0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4542b69e6b6fe472b3d3967cc1157fde Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=1140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x4542b69e6b6fe472b3d3967cc1157fde NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020303e80d80000003de16030103ae0b00029e00029b00029830820294308201fda003020102020101300d06092a864886f70d0101050500308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e301e170d3037303532333131343335375a170d3038303532323131343335375a308184310b300906035504061302494e311430120603550408130b4d6168617261 EAP-Message = 0x7368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e4953473111300f06035504031308636572742d636c743120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100bca99f739541ff5508930cdac4b928611acf16bbc153a5fd10ddd735468d3f8a633566a1c059b807aacfbf5d112d1abfaa5e4834245f04cc818e20442306909c3f16b0b4ae404493281ed2509083a6465704eec6036e6566270dffea047e9207ac7681f2ca70164aa0a2a014d96a439112b3f7877cfa1297a306 EAP-Message = 0x262e3f6ced850203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010105050003818100b87aad1c3e9ccbc82a753b013bf5f4e76328950b473b8bc42f6826b19af18a4d9a2352498d613fc64155f828a3d94999c3903a305a55f46198b6ecc49b4c3f9b80c9da6af5e052da06fd47803b95d9d9c39adeed6d5a85d7d6aa2c3a284d58e99dc977eafa40a511f27938a4618262dc5f9816eefc1b9c4173f1094ec0011a131000008200806fdfdfe127fe8fc94e04a802ef1b2927d1ec0658dda9447b538cbdea8fa1cc6bc60a0802d96f8381412c875f21bb9d95b852d746dc87187fcfad61ce609e45e4 EAP-Message = 0x7986d161dcc789f90d05c6658bebcede0478701a9087b51f6caccffa970d358176534234c00472e5a9b24815972b7237d166d01d9b31cba5ab108398ce75d6730f00008200805b3c0af06040fc3b45ec57da589accc861eb1107a14a06e6d7b4e82676ac0529d4abf0c1894acd49e93406a5bde637a1eb5645e0faae07c60ff356cbd82ccdae1d967bd71885bed3231152adcf34f9d615e0b4bd07d076ae1e8b35be79ac768b02f5808f9268141921b4508e24f6b88252b9a63cbafa02845d796cef1e353f7e140301000101160301002035cb33f611aece26c4acad92877fd3d1d7e95621cc6a3855fb20b3f527ed4e51 Message-Authenticator = 0xdb211f26cce1b1207536c932978decea Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry cert-clt at line 147 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 02a2], Certificate chain-depth=1, error=0 --> User-Name = cert-clt --> BUF-Name = praju --> subject = /C=IN/ST=Maharashtra/O=CDAC/O=SMU/OU=NISG/CN=praju/emailAddress=prajaktac(a)cdac.in --> issuer = /C=IN/ST=Maharashtra/O=CDAC/O=SMU/OU=NISG/CN=praju/emailAddress=prajaktac(a)cdac.in --> verify return:1 chain-depth=0, error=0 --> User-Name = cert-clt --> BUF-Name = cert-clt --> subject = /C=IN/ST=Maharashtra/O=CDAC/O=SMU/OU=NISG/CN=cert-clt/emailAddress=prajaktac(a)cdac.in --> issuer = /C=IN/ST=Maharashtra/O=CDAC/O=SMU/OU=NISG/CN=praju/emailAddress=prajaktac(a)cdac.in --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange Segmentation fault I just cannot figure out where exactly its getting stuck. Thank you Prajakta Choudhari __________________________________________________________ Yahoo! India Answers: Share what you know. Learn something new http://in.answers.yahoo.com/

1 0

Re:Problem with logging detail-log to syslog
by Tom Whitehouse 23 May '07

23 May '07

> I want to log all the freeradius (v 1.1.3) logs to syslog (syslog-ng). > I 've already added this to my syslog-ng.conf : > > filter f_radiusd { match ("radiusd"); }; > destination radiuslogs { file("var/log/radiusd.log"); }; > log { source (src); filter(f_daemon); filter(f_radiusd); > destination(radiuslogs);}; > > And I changed/added this in my radiusd.conf : > > logdir = syslog > log_destination = syslog > > So far so good: when I restart syslog-ng and radiusd, radiusd is logging > to /var/log/radiusd.log via syslog. But I also want to have the > detail-logs, which are normaly in the raddact directory, working in > syslog... Now I see this error in /var/log/radiusd.log : > > rlm_detail: Failed to create directory syslog/radacct: No such file or > directory > > So the rlm_detail part doesn't understands the 'logdir = syslog' option > in radiusd.conf I guess? How can I fix this? We created a pipe/FIFO: mkfifo /var/logfifo -m 600 chown radius /var/logfifo Included the pipe/FIFO in the syslog-ng configuration: source src { ...; pipe('/var/logfifo'); ... } Changed the radiusd.conf detail section: detailfile = /var/logfifo Changed all the occurrances of ${logdir} in radiusd.conf for radwtmp/radutmp/sradutmp if being used: from SOMETHING = ${logdir}/SOMETHING to SOMETHING = ${localstatedir}/log/radius/SOMETHING HTH, Tom -- Tom Whitehouse Department of Computer Science, University of York Heslington, York YO10 5DD, United Kingdom email: tomw(a)cs.york.ac.uk | Fax: +44 1904 432767 http://www.cs.york.ac.uk | Voice: +44 1904 434725

1 0

strange thing happening with rlm_perl
by Pedro Figueiredo 23 May '07

23 May '07

hi, i'm using fr 1.1.2 and perl 5.8.4, and wrote a simple perl script to return 2 random lns's for a given huntgroup. $ uname -a Linux radius1_staging 2.6.8-x4100-1 #1 SMP Wed Jun 7 08:58:42 BST 2006 x86_64 GNU/Linux this is what i have in "users", right at the top: # testuser@domain Huntgroup-Name == testhuntgroup Framed-Protocol = PPP, Service-Type = "Dialout-Framed-User" DEFAULT Auth-Type = Perl Fall-Through = 1 DEFAULT Huntgroup-Name == othergroup, Suffix == "@foo" ... # i have radiusd.conf setup as per http://wiki.freeradius.org/Rlm_perl and the following group in authorize: group { ldap { fail = return notfound = return } files { ok = 1 } perl { ok =1 } auth_log ok = return } my perl simply slurps a file with the several lns parameters and returns 2 randomly chosen ones through %RAD_REPLY: sub authorize { # boring file reading and random op... my ( $ip1, $password1, $pref1 ) = @{ $lns[$lns1] }; $RAD_REPLY{'Tunnel-Server-Endpoint:1'} = $ip1; $RAD_REPLY{'Tunnel-Type:1'} = "L2TP"; $RAD_REPLY{'Tunnel-Medium-Type:1'} = "IP"; $RAD_REPLY{'Tunnel-Password:1'} = "$password1"; $RAD_REPLY{'Tunnel-Assignment-Id:1'} = "1"; $RAD_REPLY{'Tunnel-Preference:1'} = "$pref1"; my ( $ip2, $password2, $pref2 ) = @{ $lns[$lns2] }; $RAD_REPLY{'Tunnel-Server-Endpoint:2'} = $ip2; $RAD_REPLY{'Tunnel-Type:2'} = "L2TP"; $RAD_REPLY{'Tunnel-Medium-Type:2'} = "IP"; $RAD_REPLY{'Tunnel-Password:2'} = "$password2"; $RAD_REPLY{'Tunnel-Assignment-Id:2'} = "2"; $RAD_REPLY{'Tunnel-Preference:2'} = "$pref2"; return RLM_MODULE_UPDATED; } what i'm seeing in the respose are mixed av pairs, and the connection fails (i assume because the data for each tunnel is incomplete). here is what i see in the logs and the response sent: rlm_perl: Added pair Tunnel-Assignment-Id = 2 rlm_perl: Added pair Tunnel-Medium-Type = IP rlm_perl: Added pair Tunnel-Type = L2TP rlm_perl: Added pair Tunnel-Server-Endpoint = x.x.x.x rlm_perl: Added pair Tunnel-Password = foo rlm_perl: Added pair Tunnel-Assignment-Id = 1 rlm_perl: Added pair Service-Type = Dialout-Framed-User rlm_perl: Added pair Tunnel-Medium-Type = IP rlm_perl: Added pair Tunnel-Server-Endpoint = y.y.y.y rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Tunnel-Type = L2TP rlm_perl: Added pair Tunnel-Preference = 1 rlm_perl: Added pair Tunnel-Password = bar rlm_perl: Added pair Tunnel-Preference = 50 here it seems to be ignoring the :1 and :2 for each tunnel. this then results in the following reply, with values from borh tunnels mixed: Sending Access-Accept of id 234 to t.t.t.t port 9208 Framed-Protocol = PPP Service-Type = Dialout-Framed-User Tunnel-Assignment-Id:2 = "2" Tunnel-Medium-Type:1 = IP Tunnel-Type:1 = L2TP Tunnel-Server-Endpoint:2 = "x.x.x.x" Tunnel-Password:2 = "foo" Tunnel-Preference:2 = 1 am i doing something wrong, and if so, what? any help much appreciated. thanks in advance, pedro -- This email and any attachments may be confidential and/or legally privileged. If you have received this e-mail and you are not a named addressee, please inform the sender of this email by sending a return email to the address above and then delete the e-mail and your response from your system. If you are not a named addressee you must not use, disclose, distribute, copy, print or rely on this e-mail. Any views or opinions presented are solely those of the author. Any statements made, or intentions expressed in this communication may not necessarily reflect the view of Easynet. No content herein will bind Easynet or any associated company unless confirmed by the execution of a formal contract by Easynet. Any figures or amounts given in this email are quotations only and are subject to change. Although Easynet routinely screens for viruses, addressees should scan this e-mail and any attachments for viruses. Easynet makes no representation or warranty as to the absence of viruses in this e-mail or any attachments. Please note that to ensure regulatory compliance and for the protection of our customers and business, we may monitor and read e-mails sent to and from our server(s). Easynet Limited a company incorporated and existing under the laws of England and Wales, with company number 2954343 and having its registered office at 44-46 Whitfield Street London, W1T 2RJ.

1 0

Problem with logging detail-log to syslog
by Mark van Herpen 23 May '07

23 May '07

Hello, I want to log all the freeradius (v 1.1.3) logs to syslog (syslog-ng). I 've already added this to my syslog-ng.conf : filter f_radiusd { match ("radiusd"); }; destination radiuslogs { file("var/log/radiusd.log"); }; log { source (src); filter(f_daemon); filter(f_radiusd); destination(radiuslogs);}; And I changed/added this in my radiusd.conf : logdir = syslog log_destination = syslog So far so good: when I restart syslog-ng and radiusd, radiusd is logging to /var/log/radiusd.log via syslog. But I also want to have the detail-logs, which are normaly in the raddact directory, working in syslog... Now I see this error in /var/log/radiusd.log : rlm_detail: Failed to create directory syslog/radacct: No such file or directory So the rlm_detail part doesn't understands the 'logdir = syslog' option in radiusd.conf I guess? How can I fix this? Thanks in advance Mark van Herpen

2 4

Problem connecting to a router via RADIUS Server authentication
by prajakta choudhari 23 May '07

23 May '07

Hi all: I have configured the radius server . I have a linksys router with wireless security as RADIUS enabled and laptop that connects to the linksys router. whenever i try connecting to the router i get the folloing message on the machine wiht the radius server. the clients.conf has the secret key as testing123 . In which other file do i have to put the same key. Cleaning up request 4 ID 0 with timestamp 46543306 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=129 Received packet from 192.168.6.15 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Cud someone throw light on this issue Thank you Prajakta Choudhari __________________________________________________________ Yahoo! India Answers: Share what you know. Learn something new http://in.answers.yahoo.com/

3 2

FreeRadius on openSuse Error
by Siqhamo Sifo 23 May '07

23 May '07

I am currently running freeradius on openSuse 10.2 and when I do a tail -f on my log file I c the ff error messsage : Error: Exec-Program: FAILED to execute /usr/local/bin/mtacnt: No such file or directory What i find strange is that it seems like mtacnt is not installed on my system which I find strange because when I took a look at my other radius box which is running fc5 the cmd mtacnt is available. Can any1 help REgards Sq

2 1

LDAP access configuration
by Manuel Sánchez Cuenca 23 May '07

23 May '07

Hello all, I have a scenario where a first radius server (R1) proxies the authentication request to another radius server (R2). Later, when the user is authenticated, R1 must access to a LDAP server to recover some network parameters, such as session-timeout or framed-ip-address, and enforce them in the Access Point (AP). Currently, R1 is configured to access to the LDAP server using the user name as filter (filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" in radiusd.conf). My question is, it is possible to configure this filter to use a radius attribute received in the response from R2? I mean, R2 returns in the response an attribute called attr1=val1, and then R1 must use this attribute to search in the LDAP server (¿filter="(uid=%{attr1})" or something similar?) Internet / User -------- AP ---------- R1 -------- R2 \ LDAP User AP R1 LDAP R2 (authn req.) ------------------------------>---------------------------------------> (authn response + attr1=val1) <---------------------------------------- (search uid=attr1) ------------------> (network params) <------------------ (params) <---------------- (Success) <------------<---------------- Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

1 0

Re: Freeradius-Users Digest, Vol 25, Issue 106
by anoop_c＠sifycorp.com 23 May '07

23 May '07

Hi all I am doing eap-tls with fr 1.1.6 I am not getting anything in the log file.I am able to authenticate and connect. Wat are the config to be done for getting log Regards Anoop

1 0

NAS ignoring Access-Accept
by Wolfgang Rosenauer 23 May '07

23 May '07

Hi, I'm not sure if I run into a Cisco or Freeradius issue here. I try to migrate from icradius to freeradius and everything worked in the new configuration when I tried with NTRadPing and so I'm switched the Cisco NAS to the new server. Unfortunately the NAS is ignoring the Access-Accept replies and always denies login attempts. That worked correctly with icradius and the NAS config changed only the ip address of the radius server. My first guess was an ip source issue but my server only has one ip address (and IPv6 ones but radiusd is only listening on 0.0.0.0) and freeradius is compiled with --with-udpfromto. Here are parts of my Cisco config: aaa authentication ppp default if-needed radius local aaa authorization network default radius local aaa accounting update newinfo aaa accounting exec default start-stop radius aaa accounting network default start-stop radius aaa accounting connection default start-stop radius radius-server configure-nas radius-server host a.b.c.d auth-port 1812 acct-port 1813 non-standard radius-server timeout 3 radius-server vsa send accounting I ran radiusd -X and saw that freeradius sent an Access-Accept reply to the NAS' ip address and source port. Any ideas? Thanks, Wolfgang

2 6

How to add a prefix to User-Name before proxying to another RADIUS server?
by Clark J. Wang 23 May '07

23 May '07

I have two RADIUS servers rad_1 and rad_2. For some users rad_1 needs to forward the requests to rad_2 and I want to add some prefix like `QA/' to User-Name before forwarding to rad_2. Does FreeRADIUS support that? And how to configure? Thanks.

3 2