- Freeradius-Users - lists.freeradius.org

SQL Accounting problem with 1.0.3 - The maximum number of threads (32) are active
by Rick Macdougall 20 Apr '07

20 Apr '07

Hi, We seem to be having the "The maximum number of threads (32) are active" with Freeradius 1.0.3. Version 1.0.1 works just fine. I tried to do a valgrind with -xxxx but when radiusd displays that message, you can no longer kill it. I have the debug output from the -xxxx and it shows the accounting processes running, adding info and completing but the thread doesn't seem to release. Example Tue Apr 17 09:49:57 2007 : Debug: rlm_sql (sql1): Reserving sql socket id: 6 Tue Apr 17 09:49:57 2007 : Debug: rlm_sql (sql1): Released sql socket id: 6 Tue Apr 17 09:49:57 2007 : Debug: modsingle[accounting]: returned from sql1 (rlm_sql) for request 48 Tue Apr 17 09:49:57 2007 : Debug: modcall[accounting]: module "sql1" returns ok for request 48 So it appears to be a problem with the mysql driver rather than a problem with a slow database query. Anything else I can provide ? Centos 4.3 Linux version 2.6.9-42.0.10.ELsmp 512 meg of ram Conntecting to a remote DB server over a dedicated gig network running MySQL 5.x Intel(R) Pentium(R) 4 CPU 3.20GHz with hyperthreading enabled. Regards, Rick

3 16

Radclient , -c flag = radclient.c:492: failed assertion `radclient->reply == NULL'
by Arran Cudbard-Bell 20 Apr '07

20 Apr '07

Hi, Radclient works fine with almost every except when you use the -c flag to specify that multiple copies of the same packet are sent. --- ./radclient -c 10 -x -f user radius1.susx.ac.uk auth xxxxxxx Sending Access-Request of id 205 to 139.184.14.180 port 1812 User-Name = "ac221" User-Password = "xxxx" rad_recv: Access-Accept packet from host 139.184.14.180 port 1812, id=205, length=20 radclient.c:492: failed assertion `radclient->reply == NULL' Was looking forward to doing some crude benchmarking :( Apart from that all seems well and good. Haven't noticed radiusd dieing at random intervals or any other weirdness. Back ticks work for sql xlat like you said, and there is indeed a reference in the attributes documentation. :) Just acquired a copy of THE C PROGRAMMING LANGUAGE Second edition, which I am assured is the best book for learning C. So you might actually see bug fixes some time soon instead of just bug reports ;) -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

2 1

Grouping after Kerberos 5 authentication accepted?
by Jason Chan 19 Apr '07

19 Apr '07

Hello, Is it possible for FreeRadius to perform grouping after Kerberos authentication accepted? My company has many switches and servers and we use kerberos 5 for RADIUS authentication. Once the user is authenticated, RADIUS will check and decide if this user can access the switches or particular servers (i.e. Allow telnet to the switch if the user belongs to the 'switch administrator' group). I've looked in the huntgroup file but it seems to require a lot of works for a very large company (5000+ users), and the problem is we can't touch the Kerberos server. Any help would be appreciated. Thank you Regards, Jason

3 4

Crypt passwords doesn't work
by Sebastian Firpo 19 Apr '07

19 Apr '07

Hi, I migrated a freeradius server from version 0.6 to 1.5. I'm using a users file for authorize. The server don't authorize and when a do a debug (radiusd -X) I saw the User-password in clear text. If I modify the User-password in the users file by the clear text one it works. Here are the debug and an entry of the users file: Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.12.4.2:1645, id=91, length=75 NAS-IP-Address = 10.12.4.2 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "sebas" Calling-Station-Id = "10.11.1.25" User-Password = "hello" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry sebas at line 50 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Delaying request 0 for 1 seconds users file sebas Auth-Type := Local, Crypt-Password == "(!lGOOlHaBWoQ" Service-Type = Administrative-User, Cisco-AVPair = "shell:priv-lvl=15" Thanks very much!!

4 8

Motorola Authenitcation
by Matthew Neumark 19 Apr '07

19 Apr '07

FreeRADIUS Users/Developers, Does anyone use RADIUS to authenticate Motorola SM's? If so, I'm needing some information on how to accomplish this. Thank You In Advanced!, Matt Neumark

1 0

snmp accounting/statistic queries
by Milan Holub 19 Apr '07

19 Apr '07

Hi Alan, snmp querying works great now. Thanks for that! However I've tried also to query some MIBS from RADIUS-ACC-SERVER-MIB.txt or RADIUS-STAT-MIB.txt files and it looks like freeradius does not react on it at all(no DEBUG activity with -X). (cvs head) Working query (using MIBs from RADIUS-AUTH-SERVER-MIB.txt) example: `snmpwalk -Cc -v 1 -m /devel/freeradius/cvs/work/mibs/RADIUS-AUTH-SERVER-MIB.txt -c verysecret localhost radiusAuthServUpTime` Not working queries(examples) `snmpwalk -Cc -v 1 -m /devel/freeradius/cvs/work/mibs/RADIUS-ACC-SERVER-MIB.txt -c verysecret localhost radiusAccServUpTime` `snmpwalk -Cc -v 1 -m /devel/freeradius/cvs/work/mibs/RADIUS-STAT-MIB.txt -c verysecret localhost radiusStatUpTime` I remember all MIBs worked a week before or so... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 3

how to configure
by parfait nda 19 Apr '07

19 Apr '07

i need to configure my freeradius server in proxy server to use it with windows IAS! i want the configuration of the files of freeradius which can permit me to do that! my last coonfiguration of these files is: radiusd.conf proxy_request = yes proxy.conf realm gie.local { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = araignee.gie.local:1812 accthost = araignee.gie.local:1813 secret = parfait nostrip } Clients.conf client 192.168.0.2 { secret = parfait shortname = araignee.gie.local } thanks for your help! _________________________________________________________________ Windows Live Spaces : créez votre blog à votre image ! http://www.windowslive.fr/spaces

3 3

Fedora 1.1.6 rpm build BROKEN
by Jacob Jarick 19 Apr '07

19 Apr '07

The deps have incorrect names, ie requests apache2-devel but fedora calls it httpd2-devel and so on. So atm, rpm building completely broken, any comments / suggestions are welcome. I will be going back to compiling from source until the bins are resolved. I suppose I could use some "random rpm" for 1.1.6 or compile the source but for now I will go back to using 1.1.3 that is provided with fedora (it installs without dep errors). ---------- Forwarded message ---------- From: Jacob Jarick <mem.namefix(a)gmail.com> Date: Apr 19, 2007 10:18 AM Subject: 1.1.6 rpm build errors To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Notes: * The wiki glosses over a little and gives u an incorrect dir * the spec file expects 1.1.5 tar.gz # cd /usr/src # tar zxvf /root/Desktop/freeradius-1.1.6.tar.gz # cp /root/Desktop/freeradius-1.1.6.tar.gz /usr/src/redhat/SOURCES/freeradius-1.1.5.tar.gz # cp freeradius-1.1.6/suse/freeradius.spec /usr/src/redhat/SPECS/ # rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec ^ that gets me to this point here: [root@localhost src]# rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found error: Failed build dependencies: apache2-devel is needed by freeradius-1.1.5-0.generic.i386 db-devel is needed by freeradius-1.1.5-0.generic.i386 gettext-devel is needed by freeradius-1.1.5-0.generic.i386 mysql-devel is needed by freeradius-1.1.5-0.generic.i386 net-snmp-devel is needed by freeradius-1.1.5-0.generic.i386 openldap2-devel is needed by freeradius-1.1.5-0.generic.i386 postgresql-devel is needed by freeradius-1.1.5-0.generic.i386 unixODBC-devel is needed by freeradius-1.1.5-0.generic.i386 now checking yum and smart --gui I do not see apache2-devel for starters. So for the mean time I am back to compiling as rpm's are causing the issues they are famous for. If some1 has some tips on resolving dependancies I will be intrested. But I do not see what it needs apache2 headers anyway.

4 8

rlm_sql: readclients segmentation fault
by Milan Holub 19 Apr '07

19 Apr '07

Hi Alan, with the latest cvs head I've experienced following serious bug: radiusd.conf: ... listen { ipaddr = * port = 0 type = auth } listen { ipaddr = * port = 0 type = acct } ... clients.conf: client 127.0.0.1 { secret = testing123 shortname = localhost } sql.conf: ... readclients = yes ... When starting rlm_sql says it's adding nases from DB: freeradius -X: >>>BEGIN DEBUG ... rlm_sql (sql): Read entry nasname=a.b.c.d,shortname=wlan-gw33,secret=secret rlm_sql (sql): Adding client a.b.c.d (wlan-gw33) to clients list rlm_sql (sql): Released sql socket id: 4 ... >>>END DEBUG When testing freeradius with radclient from localhost it works OK. However when sending some request from eg. nas a.b.c.d(wlan-gw33) we ends up with segmentation fault: >>>BEGIN DEBUG Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host a.b.c.d port 42926, id=82, length=46 (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1024 (LWP 16225)] 0x08052987 in client_listener_find () (gdb) (gdb) (gdb) bt #0 0x08052987 in client_listener_find () #1 0x080590df in main () #2 0x4024714f in __libc_start_main () from /lib/libc.so.6 >>>END DEBUG I can confirm that at least cvs build from 6.4. 2007 did not have such a bug. Thus obviously there must be something rotten in latest cvs commits... Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

3 12

configurable failover & segmentation fault when reloaded
by Milan Holub 19 Apr '07

19 Apr '07

Hi all, here is another bug report(but don't worry; I'm running out of my bugreports): I used to have following attr_rewrite in modules section: attr_rewrite fix_sqlcounter_reply { attribute = Reply-Message searchin = reply searchfor = "Your maximum never usage time has been reached" replacewith = "LoginNoCredit" ignore_case = no new_attribute = no max_matches = 1 append = no } and following "configurable failover" section under authorize: group { noresetcounter { reject = 1 ok = return noop = return } fix_sqlcounter_reply { ok = reject } } group { noresetcounterflat { reject = 1 ok = return noop = return } fix_sqlcounter_reply { ok = reject } } ...using cvs head I'm not using this config anymore since it was a silly workaround for an issue which was fixed differently. BUT it's the valid config and I want to point out that there is a bug when re-reading configuration containing "failover sections" after HUP. This bug causes segmentation fault: Program received signal SIGSEGV, Segmentation fault. 0x4029bc1b in free () from /lib/libc.so.6 (gdb) bt #0 0x4029bc1b in free () from /lib/libc.so.6 #1 0x4029baa3 in free () from /lib/libc.so.6 #2 0x0804ee49 in cf_data_free (cd=0xbfffe470) at conffile.c:187 #3 0x0804f194 in cf_section_free (cs=0xbfffe4a4) at conffile.c:343 #4 0x0804f1b3 in cf_section_free (cs=0xbfffe4d4) at conffile.c:337 #5 0x0804f1b3 in cf_section_free (cs=0x8079e50) at conffile.c:337 #6 0x0805570c in read_mainconfig (reload=1) at mainconfig.c:836 #7 0x08058d2a in main (argc=2, argv=0xbffffb94) at radiusd.c:540 (gdb) up #1 0x4029baa3 in free () from /lib/libc.so.6 (gdb) up #2 0x0804ee49 in cf_data_free (cd=0xbfffe470) at conffile.c:187 187 free((*cd)->name); (gdb) list 182 183 static void cf_data_free(CONF_DATA **cd) 184 { 185 if (!cd || !*cd) return; 186 187 free((*cd)->name); 188 if (!(*cd)->free) { 189 free((*cd)->data); 190 } else { 191 ((*cd)->free)((*cd)->data); (gdb) print (*cd)->name $1 = 0x81fda70 "instance`" (gdb) print (*cd)->item $2 = {next = 0x0, parent = 0x807d800, lineno = 0, type = CONF_ITEM_DATA} (gdb) print (*cd)->item->parent $3 = (struct conf_part *) 0x807d800 (gdb) print (*cd)->item->parent->name1 $4 = 0x807d840 "attr_rewrite" (gdb) print (*cd)->item->parent->name2 $5 = 0x807d858 "fix_sqlcounter_reply" (gdb) ==> I wonder especially where the $1 = 0x81fda70 "instance`" comes from... This should be probably fixed before 2.0 released... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2