- Freeradius-Users - lists.freeradius.org

double free or corruption errors with 2.0.0-pre0
by matthew zeier 11 Apr '07

11 Apr '07

Grabbed 2.0.0-pre0 from CVS (the latest, I presume) on a RHEL4 system with perl 5.8.8. Running /usr/local/sbin/radiusd -X gives: radiusd: entering modules setup Module: Library search path is /usr/lib modules: Not loading pre-proxy{} section modules: Not loading post-proxy{} section *** glibc detected *** double free or corruption (fasttop): 0x08c47478 *** Aborted I found some mention of upgrading perl (default RHEL is 5.8.2, I upgraded to 5.8.8) but still get those errors after a clean compile. I'm configuring with the following: ./configure \ --enable-shared --disable-static \ --with-gnu-ld \ --with-threads \ --with-thread-pool \ --disable-ltdl-install \ --sysconfdir=/etc/ Any fix for this? -- matthew zeier | Network Engineer | Mozilla Corp. | (650)903-0800 x219

4 15

RadiusExpert Wiki
by Mike McCauley 11 Apr '07

11 Apr '07

Hi all, Open System Consultants (OSC) has established a free resource for the RADIUS user community to collect and share information about configuring and implementing RADIUS protocol devices and software. RadiusExpert:Community Portal at http://www.open.com.au/wiki/index.php/Main_Page will become the repository for all the information that often resides only in the heads of system administrators who manage and maintain the security access and authentication requirements of their networks. We welcome contributions about such topics as configuring various RADIUS devices, load balancing with RADIUS servers and wireless authentication tips from our very active user community. If you can contribute any information on any RADIUS topic to the benefit of the entire community, please feel free. This is not a trawl for customers by OSC, but a genuine attempt to assist everyone in the RADIUS community. The wiki is vendor-neutral and covers all free and commercial RADIUS servers and compatible devices. This message was posted with the assent of Alan DeKok Cheers. -- Mike McCauley mikem(a)open.com.au Open System Consultants Pty. Ltd Unix, Perl, Motif, C++, WWW 9 Bulbul Place Currumbin Waters QLD 4223 Australia http://www.open.com.au Phone +61 7 5598-7474 Fax +61 7 5598-7070

2 2

Radius to Diameter Gateway
by Ashraf Al-Basti 11 Apr '07

11 Apr '07

Dear, Is there any way to make Freeradius to work as Radius/Diameter gateway? If not is there any recommended software that can do that?

2 1

MAC authorisation (but not authentication) via LDAP
by Martin Whinnery 11 Apr '07

11 Apr '07

Hi. Probly just me not understanding... What I want is for our switches to only allow access to MAC addresses in our LDAP database. I don't want to store passwords on our LDAP host entries. I'm set up to check LDAP during authorisation, and it correctly returns authorised / not authorised depending on whether the appropriate attribute contains the right value. The trouble comes with authentication - either I set Auth-Type := Accept, in which case and failed authorisation is overridden, or I allow authentication to carry on against LDAP ( or System, or whatever ), in which case it fails always and access is denied, even for authorised MACs. Is there a way to make the Authorisation part final and authoritative? As I say, probly just being stoopid. Mart -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 12

Problem with mschap, ntlm_auth and a conditional syntax
by latin＠icis.pcz.pl 11 Apr '07

11 Apr '07

Hello, I use ntlm_auth in mschapv2 (freeradius 20070409) by the following line in radiusd.conf: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" A corresponding part of debug from radiusd -X is: rlm_mschap: Told to do MS-CHAPv2 for uzyszkodnik(a)latin.pcz.pl with NT-Password radius_xlat: '--username=uzyszkodnik' radius_xlat: Running registered xlat function of module mschap for string 'Challenge:-00' rlm_mschap: Unknown expansion string "Challenge:-00" radius_xlat: '--challenge=' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response:-00' rlm_mschap: Unknown expansion string "NT-Response:-00" radius_xlat: '--nt-response=' Exec-Program output: Specify all required command line parameters! Exec-Program-Wait: plaintext: Specify all required command line parameters! Exec-Program: returned: 1 When I remove conditional syntax: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" an athentication operates correctly: rlm_mschap: Told to do MS-CHAPv2 for uzyszkodnik(a)latin.pcz.pl with NT-Password radius_xlat: '--username=uzyszkodnik' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: ca radius_xlat: '--challenge=1d6796d06b4bab53' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=69bbd30b6a06d6be5cc2fb88c658c1582da5a8a91ebcbee8' Exec-Program output: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program-Wait: plaintext: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program: returned: 0 I tested freeradius 1.1.4 with conditional syntax: ntlm_auth = "/usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" It's OK: rlm_mschap: Told to do MS-CHAPv2 for uzyszkodnik(a)latin.pcz.pl with NT-Password radius_xlat: '--username=uzyszkodnik' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: af radius_xlat: '--challenge=eebe17185aaa4366' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=f668c0b7b4e32deeb49529c2f3295699561589836d73f474' Exec-Program output: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program-Wait: plaintext: NT_KEY: 9d1f2ebc255b18c110a446e5de42389e NT_KEY: 9D1F2EBC255B18C110A446E5DE42389E Exec-Program: returned: 0 Lukasz Lacinski

3 4

1.1.5 double free or corruption
by Thor Spruyt 10 Apr '07

10 Apr '07

Hi, I have built freeradius-1.1.5 with mysql, ldap and openssl on CentOS 4.4 Everything looks ok (configure, make, make install), but when running the server, it dies. [thor@byze freeradius-1.1.5]$ sudo /opt/freeradius-1.1.5-1/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/proxy.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/clients.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/snmp.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/eap.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/sql.conf main: prefix = "/opt/freeradius-1.1.5-1" main: localstatedir = "/opt/freeradius-1.1.5-1/var" main: logdir = "/opt/freeradius-1.1.5-1/var/log/radius" main: libdir = "/opt/freeradius-1.1.5-1/lib" main: radacctdir = "/opt/freeradius-1.1.5-1/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/freeradius-1.1.5-1/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/freeradius-1.1.5-1/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius-1.1.5-1/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/freeradius-1.1.5-1/lib *** glibc detected *** double free or corruption (fasttop): 0x098a55d8 *** Aborted If it helps, here's the end of an strace: open("/opt/freeradius-1.1.5-1/etc/raddb/realms", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0640, st_size=187, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f76000 read(3, "#\n#\tTHIS FILE IS DEPRECATED.\n#\n#"..., 4096) = 187 read(3, "", 4096) = 0 close(3) = 0 munmap(0xb7f76000, 4096) = 0 getrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0 stat64("/opt/freeradius-1.1.5-1/var/log/radius", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getgid32() = 0 open("/etc/services", O_RDONLY) = 3 fcntl64(3, F_GETFD) = 0 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=20373, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f76000 read(3, "# /etc/services:\n# $Id: services"..., 4096) = 4096 read(3, "123/tcp\nntp\t\t123/udp\t\t\t\t# Networ"..., 4096) = 4096 read(3, "\t\t873/tcp\t\t\t\t# rsync\nrsync\t\t873/"..., 4096) = 4096 close(3) = 0 munmap(0xb7f76000, 4096) = 0 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 bind(3, {sa_family=AF_INET, sin_port=htons(1812), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 bind(4, {sa_family=AF_INET, sin_port=htons(1813), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 time(NULL) = 1173470425 write(1, "radiusd: entering modules setup"..., 33radiusd: entering modules setup ) = 33 time(NULL) = 1173470425 write(1, "Module: Library search path is /"..., 59Module: Library search path is /opt/freeradius-1.1.5-1/lib ) = 59 open("/opt/freeradius-1.1.5-1/lib/rlm_exec.la", O_RDONLY) = 5 fstat64(5, {st_mode=S_IFREG|0755, st_size=895, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f76000 read(5, "# rlm_exec.la - a libtool librar"..., 4096) = 895 read(5, "", 4096) = 0 close(5) = 0 munmap(0xb7f76000, 4096) = 0 futex(0xa98060, FUTEX_WAKE, 2147483647) = 0 open("/opt/freeradius-1.1.5-1/lib/rlm_exec.a", O_RDONLY) = 5 read(5, "!<arch>\n/ 11734703"..., 512) = 512 close(5) = 0 open("/opt/freeradius-1.1.5-1/lib/rlm_exec-1.1.5.so", O_RDONLY) = 5 read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\270\10"..., 512) = 512 fstat64(5, {st_mode=S_IFREG|0755, st_size=17018, ...}) = 0 old_mmap(NULL, 9308, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0xf7a000 old_mmap(0xf7c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1000) = 0xf7c000 close(5) = 0 open("/dev/tty", O_RDWR|O_NONBLOCK|O_NOCTTY) = 5 writev(5, [{"*** glibc detected *** ", 23}, {"double free or corruption (fastt"..., 35}, {": 0x", 4}, {"080f95d8", 8}, {" ***\n", 5}], 5*** glibc detected *** double free or corruption (fasttop): 0x080f95d8 *** ) = 75 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(26392, 26392, SIGABRT) = 0 --- SIGABRT (Aborted) @ 0 (0) --- +++ killed by SIGABRT +++ Process 26392 detached -- Thor Spruyt M: +32 475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com

3 3

Re: freeradius with samba domain and port-access (Christian)
by Christian Hohmann 10 Apr '07

10 Apr '07

Christian Hohmann wrote: >> Now the Problem: Some workstations are added to a samba managed domain and can only login on the samba service. >> It seems to me, that the winxpsp2 supplicant first wants to authenticate at the samba server. But the switch doesn?t allow the connection, because the port is closed until the eap-authentication is handled. >The machines also need to log in using EAP. >Alan DeKok. Thanks for help. I think so too, but I have no idea how or even if it is possible. The WXPSP2 Client with user authentication is not able to authanticate against the freeradius. There is not even a request arriving on the freeradius. If I toggle to "Identify with ComputerInformation if possible" there is at least a request arriving at the radiusserver. It takes some time, but it works. After the Authentication with computer Information, its not possible to authenticate a second time with the user information. How do i have to configure the client correctly to realize userauthentication? Or do I need to reconfigure the server? Regards - Christian _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

3 2

two database
by Nirmal 10 Apr '07

10 Apr '07

Hi i m using freeradius 0.9 is it possible to select two sql databases in sql.conf ? how ? Thanks In Advance Regards Nirmal Patel 9323704733 --------------------------------- TV dinner still cooling? Check out "Tonight's Picks" on Yahoo! TV.

4 9

JRS - Proxying v2
by Arran Cudbard-Bell 10 Apr '07

10 Apr '07

Hi Alan, Just to make sure i've got the right idea about v2 realms. Here is an example config for the Janet Roaming Service, which allows users at any academic institution in the UK to authenticate at any other . The version 1 realm JRS realm jrs { type = RADIUS authhost = roaming1.ja.net:1812 accthost = roaming2.ja.net:1813 secret = theirsecret nostrip ldflag = round_robin } realm jrs { type = RADIUS authhost = roaming2.ja.net:1812 accthost = roaming2.ja.net:1813 secret = theirsecret nostrip ldflag = round_robin } The version 2 realm JRS ############## # Server Pools # realm jrs { auth_pool = jrs_auth_balance acct_pool = jrs_acct_balance nostrip } ############## # Server Pools # server_pool jrs_auth_balance { home_server = jrs1_auth home_server = jrs2_auth type = load-balance } server_pool jrs_acct_balance { home_server = jrs1_auth home_server = jrs2_auth type = load-balance } ############## # Home Servers home_server jrs1_auth { type = auth hostname = roaming1.ja.net port = 1812 secret = theirsecret response_window = 20 zombie_period = 40 revive_interval = 120 ping_check = request ping_interval = 30 num_pings_to_alive = 3 } home_server jrs1_acct { type = acct hostname = roaming1.ja.net port = 1813 secret = theirsecret response_window = 20 zombie_period = 40 revive_interval = 120 ping_check = request ping_interval = 30 num_pings_to_alive = 3 } home_server jrs2_auth { type = auth hostname = roaming2.ja.net port = 1812 secret = theirsecret response_window = 20 zombie_period = 40 revive_interval = 120 ping_check = request ping_interval = 30 num_pings_to_alive = 3 } home_server jrs2_acct { type = acct hostname = roaming1.ja.net port = 1813 secret = theirsecret response_window = 20 zombie_period = 40 revive_interval = 120 ping_check = request ping_interval = 30 num_pings_to_alive = 3 } Very long, but I can see the advantages :) Thanks, Arran

3 19

freeradius mssql problem
by satish patel 10 Apr '07

10 Apr '07

Dear I have many time posted question about freeradius mssql but i didnt get any satisfied ans i am again going to explain my problem i have freeradius version 1.1.0 with runing mssql windows and problem is acct-stop packet i have cisco NAS vpdn configuration users login and start recored is updated but some time when everything runing and my radius goes down due to power failure but my sql on UPS now when i restart my radius and i run radutmp there is list of users but in cisco router there is no one users now user try to login they got error max 1 login i got it this is the error of radutmp now i delete this file and users again able to login but some users stop account not updated so i got this error Mon Mar 12 14:55:43 2007 : Error: rlm_sql (sql): Couldn't insert SQL accounting STOP record - 00000 Mon Mar 12 14:55:48 2007 : Error: rlm_sql_unixodbc: '22007 [unixODBC][FreeTDS][SQL Server]Syntax error converting datetime from character string.i?' Mon Mar 12 14:55:48 2007 : Error: rlm_sql (sql): Couldn't insert SQL accounting STOP record - 00000 Mon Mar 12 14:55:53 2007 : Error: rlm_sql_unixodbc: '22007 [unixODBC][FreeTDS][SQL Server]Syntax error converting datetime from character string.' Mon Mar 12 14:55:53 2007 : Error: rlm_sql (sql): Couldn't insert SQL accounting STOP record - 00000 is there any solution about this type of error $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Check out what you're missing if you're not on Yahoo! Messenger

1 0