- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 24, Issue 10
by Arran Cudbard-Bell 02 Apr '07

02 Apr '07

> Message: 2 > Date: Mon, 02 Apr 2007 20:20:47 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: HUP in freeradius-1.1.5 + CVS results in process death. > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4611497F.3000500(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Arran Cudbard-Bell wrote: > >> I know theres a bug report for this already, >> but when I HUP the process freeradius doesn't die in the same place. >> > > If it's an issue due to incorrectly free'd memory, the crashes will be > random. > > There may be a fix in 1.1.6, but I'm not sure. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > Looks more like a bug in rlm_tls . Dies every time on HUP, deffinatly not random... Just wondered if anyone else had this error, to check it's not something weird in how i've set up the eap-tls module. Incidently whats the best route into contributing to freeRADIUS . I've never contributed to an opensource project before but as contributing to freeRADIUS and my day to day job seem to mesh together quite well , seems like a useful thing to do :) I've got pretty extensive knowledge of PHP & MySQL and am currently learning C (I'm basically a web programmer leaning towards the less fluffy languages :) ). Oh also had subversion experience but not CVS (which is the other way round to most people) . Thanks, Arran

1 0

error on start up
by Jackson Jerry-NPC637 02 Apr '07

02 Apr '07

Hello - I hope I haven't missed something obvious, but am having trouble getting radius to start after installing/configure/make...running Fedora core 5. Note - I'm not an Linux expert, so bear with me. This is the error - [root@LinuxServer freeradius-1.1.5]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib *** glibc detected *** radiusd: double free or corruption (fasttop): 0x08b30140 *** ======= Backtrace: ========= /lib/libc.so.6[0x8d6f18] /lib/libc.so.6(__libc_free+0x79)[0x8da41d] /usr/local/lib/libltdl.so.3[0x5736bb] /usr/local/lib/libltdl.so.3(lt_dlopenext+0xbe)[0x57404e] radiusd(find_module_instance+0x317)[0xf571a7] radiusd(setup_modules+0x1d8)[0xf57758] radiusd(main+0x45c)[0xf5ad8c] /lib/libc.so.6(__libc_start_main+0xdc)[0x8887e4] radiusd[0xf4ecd1] ======= Memory map: ======== 00111000-00123000 r-xp 00000000 fd:00 976235 /usr/lib/libz.so.1.2.3 00123000-00124000 rwxp 00011000 fd:00 976235 /usr/lib/libz.so.1.2.3 00124000-00127000 r-xp 00000000 fd:00 976261 /usr/lib/libkrb5support.so.0.0 00127000-00128000 rwxp 00002000 fd:00 976261 /usr/lib/libkrb5support.so.0.0 0016d000-0017e000 r-xp 00000000 fd:00 18515580 /lib/libnsl-2.4.so 0017e000-0017f000 r-xp 00010000 fd:00 18515580 /lib/libnsl-2.4.so 0017f000-00180000 rwxp 00011000 fd:00 18515580 /lib/libnsl-2.4.so 00180000-00182000 rwxp 00180000 00:00 0 001d3000-001d4000 r-xp 001d3000 00:00 0 [vdso] 002e1000-002f6000 r-xp 00000000 fd:00 959556 /usr/local/lib/libradius-1.1.5.so 002f6000-002f7000 rwxp 00014000 fd:00 959556 /usr/local/lib/libradius-1.1.5.so 002f7000-002f8000 rwxp 002f7000 00:00 0 00345000-00347000 r-xp 00000000 fd:00 18515584 /lib/libcom_err.so.2.1 00347000-00348000 rwxp 00001000 fd:00 18515584 /lib/libcom_err.so.2.1 0037a000-0037c000 r-xp 00000000 fd:00 976373 /usr/local/lib/rlm_exec-1.1.5.so 0037c000-0037d000 rwxp 00001000 fd:00 976373 /usr/local/lib/rlm_exec-1.1.5.so 003fe000-00400000 r-xp 00000000 fd:00 18515576 /lib/libdl-2.4.so 00400000-00401000 r-xp 00001000 fd:00 18515576 /lib/libdl-2.4.so 00401000-00402000 rwxp 00002000 fd:00 18515576 /lib/libdl-2.4.so 00455000-0046d000 r-xp 00000000 fd:00 976264 /usr/lib/libgssapi_krb5.so.2.2 0046d000-0046e000 rwxp 00017000 fd:00 976264 /usr/lib/libgssapi_krb5.so.2.2 004d6000-004db000 r-xp 00000000 fd:00 18515589 /lib/libcrypt-2.4.so 004db000-004dc000 r-xp 00004000 fd:00 18515589 /lib/libcrypt-2.4.so 004dc000-004dd000 rwxp 00005000 fd:00 18515589 /lib/libcrypt-2.4.so 004dd000-00504000 rwxp 004dd000 00:00 0 00570000-00575000 r-xp 00000000 fd:00 955078 /usr/local/lib/libltdl.so.3.1.4 00575000-00576000 rwxp 00004000 fd:00 955078 /usr/local/lib/libltdl.so.3.1.4 005c9000-005e2000 r-xp 00000000 fd:00 18515573 /lib/ld-2.4.so 005e2000-005e3000 r-xp 00018000 fd:00 18515573 /lib/ld-2.4.so 005e3000-005e4000 rwxp 00019000 fd:00 18515573 /lib/ld-2.4.so 006f9000-0073a000 r-xp 00000000 fd:00 18515586 /lib/libssl.so.0.9.8a 0073a000-0073e000 rwxp 00040000 fd:00 18515586 /lib/libssl.so.0.9.8a 0073e000-0085d000 r-xp 00000000 fd:00 18515585 /lib/libcrypto.so.0.9.8a 0085d000-00870000 rwxp 0011e000 fd:00 18515585 /lib/libcrypto.so.0.9.8a 00870000-00873000 rwxp 00870000 00:00 0 00873000-0099f000 r-xp 00000000 fd:00 18515574 /lib/libc-2.4.so 0099f000-009a2000 r-xp 0012b000 fd:00 18515574 /lib/libc-2.4.so 009a2000-009a3000 rwxp 0012e000 fd:00 18515574 /lib/libc-2.4.so 009a3000-009a6000 rwxp 009a3000 00:00 0 009e2000-009eb000 r-xp 00000000 fd:00 18513961 /lib/libnss_files-2.4.so 009eb000-009ec000 r-xp 00008000 fd:00 18513961 /lib/libnss_files-2.4.so 009ec000-009ed000 rwxp 00009000 fd:00 18513961 /lib/libnss_files-2.4.so 00aaf000-00aba000 r-xp 00000000 fd:00 18515578 /lib/libgcc_s-4.1.0-20060304.so.1 00aba000-00abb000 rwxp 0000a000 fd:00 18515578 /lib/libgcc_s-4.1.0-20060304.so.1 00d0d000-00d31000 r-xp 00000000 fd:00 976262 /usr/lib/libk5crypto.so.3.0 00d31000-00d32000 rwxp 00024000 fd:00 976262 /usr/lib/libk5crypto.so.3.0 00d45000-00db8000 r-xp 00000000 fd:00 976263 /usr/lib/libkrb5.so.3.2 00db8000-00dba000 rwxp 00073000 fd:00 976263 /usr/lib/libkrb5.so.3.2 00ed5000-00ee4000 r-xp 00000000 fd:00 18515583 /lib/libresolv-2.4.so 00ee4000-00ee5000 r-xp 0000e000 fd:00 18515583 /lib/libresolv-2.4.so 00ee5000-00ee6000 rwxp 0000f000 fd:00 18515583 /lib/libresolv-2.4.so 00ee6000-00ee8000 rwxp 00ee6000 00:00 0 00f4a000-00f68000 r-xp 00000000 fd:00 976487 /usr/local/sbin/radiusd 00f68000-00f69000 rwxp 0001d000 fd:00 976487 /usr/local/sbin/radiusd 00f69000-00f6a000 rwxp 00f69000 00:00 0 00f8e000-00f9e000 r-xp 00000000 fd:00 18515575 /lib/libpthread-2.4.so 00f9e000-00f9f000 r-xp 0000f000 fd:00 18515575 /lib/libpthread-2.4.so 00f9f000-00fa0000 rwxp 00010000 fd:00 18515575 /lib/libpthread-2.4.so 00fa0000-00fa2000 rwxp 00fa0000 00:00 0 08ac0000-08ba7000 rw-p 08ac0000 00:00 0 [heap] b7e00000-b7e21000 rw-p b7e00000 00:00 0 b7e21000-b7f00000 ---p b7e21000 00:00 0 b7f2a000-b7f2f000 rw-p b7f2a000 00:00 0 b7f3f000-b7f40000 rw-p b7f3f000 00:00 0 bfb0e000-bfb40000 rw-p bfb0e000 00:00 0 [stack] Aborted Thanks for your help. Jerry J.

1 0

OS X 10.4 server install
by Glen Page 02 Apr '07

02 Apr '07

I am new to FreeRadius. I have downloaded and installed FreeRadius on my 10.4 server machine and now need some pointers on getting it working. I downloaded the Radius installer (FreeRadius for OS X) from StellarRADIUS and ran the installer. Now I need pointers for where to go next. The machine that I have installed FreeRadius on is my OpenDirectory (LDAP) master. My hope is to be able to get FreeRadius to authenticate users against the LDAP so that I can control who uses our wireless network. TIA for the help, Glen Page Technology Systems Administrator ThetNet Well It looks like an ID10T Error

2 1

HUP in freeradius-1.1.5 + CVS results in process death.
by Arran Cudbard-Bell 02 Apr '07

02 Apr '07

I know theres a bug report for this already, but when I HUP the process freeradius doesn't die in the same place. I get.. Mon Apr 2 18:10:16 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Apr 2 18:10:16 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Apr 2 18:10:16 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon Apr 2 18:10:16 2007 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Mon Apr 2 18:10:16 2007 : Error: rlm_eap_tls: Error reading certificate file Mon Apr 2 18:10:16 2007 : Error: rlm_eap: Failed to initialize type tls Mon Apr 2 18:10:16 2007 : Error: radiusd.conf[10]: eap: Module instantiation failed. Mon Apr 2 18:10:16 2007 : Error: radiusd.conf[1925] Unknown module "eap". Mon Apr 2 18:10:16 2007 : Error: radiusd.conf[1873] Failed to parse authenticate section. TLS configured: tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/freeradius-1.1.5_nas/etc/raddb/certs/radius.sussex.ac.uk.key" tls: certificate_file = "/usr/local/freeradius-1.1.5_nas/etc/raddb/certs/radius.sussex.ac.uk.crt" tls: CA_file = "/usr/local/freeradius-1.1.5_nas/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "(null)" tls: dh_file = "/usr/local/freeradius-1.1.5_nas/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain Doesn't look like the same bug, anyone else had this ? -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

2 1

Badusers?
by Internet-Wifi Operador 02 Apr '07

02 Apr '07

Hi, 2 simple question. Freeradius, know or do something with badusers file? What is the idea of badusers file? Thanks. Fabián _________________________________________________________________ Mortgage refinance is hot 1) Rates near 30-yr lows 2) Good credit get intro-rate 4.625%* https://www2.nextag.com/goto.jsp?product=100000035&url=%2fst.jsp&tm=y&searc…

2 3

modules' instantiation failing (files)
by Pedro Figueiredo 02 Apr '07

02 Apr '07

hi all, i need to send different lns configuration in a round-robin fashion. in order to do this, i added the following to modules: files rra { userfile = ${confdir}/users.rr1 acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } files rrb { userfile = ${confdir}/users.rr2 acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } and then in authorize: redundant-load-balance { rra rrb ok = 1 } freeradius is picking the right module, alternating between them on each request. the problem is in the instantiation of the modules, where i'm getting the following: Module: Instantiated files (rra) files: usersfile = "/etc/freeradius-dev/users" files: acctusersfile = "/etc/freeradius-dev/acct_users" files: preproxy_usersfile = "/etc/freeradius-dev/preproxy_users" files: compat = "no" Module: Instantiated files (rrb) files: usersfile = "/etc/freeradius-dev/users" files: acctusersfile = "/etc/freeradius-dev/acct_users" files: preproxy_usersfile = "/etc/freeradius-dev/preproxy_users" files: compat = "no" as you can see, it's not reading the files i told it to read. confirmed with strace, just to be on the safe side: write(1, "Module: Instantiated files (rra)"..., 34Module: Instantiated files (rra)) = 34 write(1, " files: usersfile = \"/etc/freera"..., 48 files: usersfile = "/etc/freeradius-dev/users") = 48 write(1, " files: acctusersfile = \"/etc/fr"..., 57 files: acctusersfile = "/etc/freeradius-dev/acct_users") = 57 write(1, " files: preproxy_usersfile = \"/e"..., 66 files: preproxy_usersfile = "/etc/freeradius-dev/preproxy_users") = 66 write(1, " files: compat = \"no\"\n", 22 files: compat = "no") = 22 open("/etc/freeradius-dev/users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=1880, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "# Simplify the Tunneling rules t"..., 4096) = 1880 read(6, "", 4096) = 0 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 open("/etc/freeradius-dev/acct_users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=532, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "#\n#\t$Id: acct_users,v 1.4 2003/0"..., 4096) = 532 read(6, "", 4096) = 0 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 open("/etc/freeradius-dev/preproxy_users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=1039, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "#\n# Configuration file for the "..., 4096) = 1039 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 write(1, "Module: Instantiated files (rrb)"..., 34Module: Instantiated files (rrb)) = 34 write(1, " files: usersfile = \"/etc/freera"..., 48 files: usersfile = "/etc/freeradius-dev/users") = 48 write(1, " files: acctusersfile = \"/etc/fr"..., 57 files: acctusersfile = "/etc/freeradius-dev/acct_users") = 57 write(1, " files: preproxy_usersfile = \"/e"..., 66 files: preproxy_usersfile = "/etc/freeradius-dev/preproxy_users") = 66 write(1, " files: compat = \"no\"\n", 22 files: compat = "no") = 22 open("/etc/freeradius-dev/users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=1880, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "# Simplify the Tunneling rules t"..., 4096) = 1880 read(6, "", 4096) = 0 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 open("/etc/freeradius-dev/acct_users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=532, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "#\n#\t$Id: acct_users,v 1.4 2003/0"..., 4096) = 532 read(6, "", 4096) = 0 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 open("/etc/freeradius-dev/preproxy_users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=1039, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "#\n# Configuration file for the "..., 4096) = 1039 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 i couldn't find any references to this problem. this is freeradius 1.1.5 running on a debian box with 2.6.8-x4100-1. has anyone else noticed this? is there a workaround? thanks in advance, pedro -- This email and any attachments may be confidential and/or legally privileged. If you have received this e-mail and you are not a named addressee, please inform the sender of this email by sending a return email to the address above and then delete the e-mail and your response from your system. If you are not a named addressee you must not use, disclose, distribute, copy, print or rely on this e-mail. Any views or opinions presented are solely those of the author. Any statements made, or intentions expressed in this communication may not necessarily reflect the view of Easynet. No content herein will bind Easynet or any associated company unless confirmed by the execution of a formal contract by Easynet. Any figures or amounts given in this email are quotations only and are subject to change. Although Easynet routinely screens for viruses, addressees should scan this e-mail and any attachments for viruses. Easynet makes no representation or warranty as to the absence of viruses in this e-mail or any attachments. Please note that to ensure regulatory compliance and for the protection of our customers and business, we may monitor and read e-mails sent to and from our server(s). Easynet Limited a company incorporated and existing under the laws of England and Wales, with company number 2954343 and having its registered office at 44-46 Whitfield Street London, W1T 2RJ.

2 5

radutmp file problem with simultanous problem
by satish patel 02 Apr '07

02 Apr '07

Dear guys I have very strange problem i am useing freeradius with mssql database and it is working fine since 1 month without error but last week my radius server power switch off or due to any power reson my radius machine would shutdown now when it come back i run radwtmp there is list of users and when i goes or telnet on cisco NAS there is no one users and after it i check radius log i saw the max 1 login error means multiple users login problem so what is the problem i know the problem but this is not a way caz it caz happend any time then i delete /var/log/radius/radutmp file then again users able to login this is the simultaneous login problem i know caz checkrad first check radutmp and then check in to NAS i know logic behind this but this is not a proper solution then how can i resolve it is there any method to adovide this problem.. $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 1

packet of disconnect
by satish patel 02 Apr '07

02 Apr '07

I have problem of disconnecting user from radius or NAS so i am useind radclient command to disconnect users i have cisco NAS 3600 VPDN configuration it is supported packet of disconnect but problem is when i send disconnect request from my NAS i got error session not mached [root@radius tmp]# cat packet.txt User-Name=mlpm322 Acct-Session-Id=0000F034 [root@radius tmp]# cat packet.txt | radclient -x 192.168.1.1:1700 disconnect tulip786 Sending Disconnect-Request of id 161 to 192.168.1.1 port 1700 User-Name = "mlpm322" Acct-Session-Id = "0000F034" rad_recv: Disconnect-NAK packet from host 192.168.1.1:1700, id=161, length=41 Reply-Message = "No Matching Session" i got this error ??? so what is this why i got this error session not mached ??? i am find users session id from radwho -i command can you explain me why this happend ??? $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

more than one AVP from LDAP with same name is it possible ?
by Bodin Bruno 02 Apr '07

02 Apr '07

Hello, My problem is about Radius reply. With user file it's possible to reply some AVPs with same name like that : My-AVP += "name:robert", My-AVP += "age:38", My-AVP += "country:fr" most important it's possible to do that : Sip-AVP+= "username:%{User-Name}" But how it's possible to do something like that with ldap attribute ? because I use this : replyItem My-AVP username_radius but that work only one time, because when I do : replyItem My-AVP username_radius replyItem My-AVP age_radius it's only return the last attribute content ( 38, the age of Robert ). And when I type this : replyItem My-AVP username_radius,age_radius that return nothing ... Too bad, return 2 AVPs should be better :( there is any method to do this ? could it be a new feature ? thank for help

2 2

add realm to user based on NAS-IP
by Alexander Papenburg 02 Apr '07

02 Apr '07

Hi all, i wonder if it is possible to add a realm to a username based on the NAS-IP the request come from. For instance: - user "abc" logs on router 10.0.0.1 - router 10.0.0.1 asks a freeradius proxy for user "abc" - freeradius-proxy recognize the ip and add "@realm" to the username and proxy the request to another freeradius-server based on "realm"-entry in proxy.conf Unfortunatly I found many "solutions" in the past 2 hours (like proxy-to-realm, attr_rewrite, hints...), I cant't decide which is the right one for me. %) So help would be much appreciated. Thanks in advance Alexander

2 1