- Freeradius-Users - lists.freeradius.org

SEVERE! radiusd 2.0 and 1.1.4 dying! Segmentation fault
by Guilherme Franco 28 Jan '07

28 Jan '07

Hi, Freeradius 2.0 alpha was working correctly since November 1st. Then, this month, suddenly the server started to die, complaining of "Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0". The server runs threaded with max_servers = 32 and num_sql_socks = 32 (there are 5 reqs per seconds, no more than that). Ok so I've tried to run it single threaded (-X), but then, it's slow and it missess some access requests, due to processing the accounting. I've uninstalled it and installed 1.1.4, but the same occurs! Restarting radiusd when it fails gives another 15 minutes before it dies again. Also, disabling accounting helps prolong the server lifetime. Any clue on that? Thanks. Sat Jan 27 19:13:16 2007 : Debug: modsingle[accounting]: returned from detail (rlm_detail) for request 108 Sat Jan 27 19:13:16 2007 : Debug: modcall[accounting]: module "detail" returns ok for request 108 Sat Jan 27 19:13:16 2007 : Debug: modsingle[accounting]: calling ippool (rlm_sqlippool) for request 108 Sat Jan 27 19:13:16 2007 : Debug: rlm_sql (sql_postgresql): Reserving sql socket id: 11 Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'BEGIN' ********** Internal heap ERROR 17177 addr=(nil) ********* ****************************************************** HEAP DUMP heap name="Alloc statemen" desc=0x77e2b8 extent sz=0x1040 alt=32767 het=32767 rec=0 flg=2 opc=3 parent=0x77adb0 owner=(nil) nex=(nil) xsz=0x1040 EXTENT 0 addr=0x788818 Chunk 000788828 sz= 3752 free " " Chunk 0007896d0 sz= 312 freeable assoc with mark prv=(nil) nxt=(nil) Chunk 000789808 sz= 80 freeable assoc with mark prv=(nil) nxt=(nil) EXTENT 1 addr=0x77d3e8 Chunk 00077d3f8 sz= 2448 perm "perm " alo=32 Total heap size = 6592 FREE LISTS: Bucket 0 size=160 Bucket 1 size=288 Bucket 2 size=544 Bucket 3 size=1056 Bucket 4 size=2080 Chunk 000788828 sz= 3752 free " " Bucket 5 size=4128 Bucket 6 size=16416 Bucket 7 size=32800 Total free space = 3752 UNPINNED RECREATABLE CHUNKS (lru first): PERMANENT CHUNKS: Chunk 00077d3f8 sz= 2448 perm "perm " alo=32 Permanent space = 2448 ****************************************************** Hla: 255 ORA-21500: internal error code, arguments: [17177], [0x000000000], [], [], [], [], [], [] Errors in file : ORA-21500: internal error code, arguments: [17177], [0x000000000], [], [], [], [], [], [] ----- Call Stack Trace ----- calling call entry argument values in hex location type point (? means dubious value) -------------------- -------- -------------------- ---------------------------- Cannot seek to string table section header in /proc/11022/exe. Cannot seek to string table section header in /proc/11022/exe. 9688CDEF CALL 9660C588 0 ? 0 ? 774EC8 ? 0 ? 1 ? 0 ? 96DA64D8 CALLr 00000000 0 ? 0 ? 655680 ? 0 ? 4FA13060 ? 0 ? 96DA6CD4 CALL 965ED0E8 Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'alfbericoz(a)foo.com' ORDER BY id' 0 ? 0 ? FF ? 0 ? 0 ? 0 ? 96DA6898 CALL 96605AC8 4FA13090 ? 0 ? 655680 ? 0 ? FF ? 0 ? 96D75B7F CALL 965FF0C8 0 ? 0 ? 0 ? 0 ? 788ED0 ? 0 ? 96D9135D CALL 96D757AA 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 966CA4FA CALL 96607898 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 966DF8CE CALL 966070F8 77DDA8 ? 0 ? 781BF0 ? 0 ? 4FA15E50 ? 0 ? 966DF582 CALL 965F7D68 0 ? 0 ? B0D0A8C0 ? 3E ? B0D0AE20 ? 3E ? 966DBF1E CALL 965FEC88 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 9678A292 CALL 9660F088 0 ? 0 ? 4FA161D0 ? 0 ? 772E10 ?Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'john(a)foo.com' ORDER BY id' 0 ? 962BB4F6 CALL 962BAD60 4FA160C0 ? 0 ? 6536A4 ? 0 ? 4FA162E2 ? 0 ? 0077C450 CALLs 00000000 ----- Argument/Register Address Dump ----- Argument/Register addr=774ec8. Dump of memory from 0x000774E88 to 0x000774FC8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 FFFFFFFF 00000000 007773F0 00000000 0077AB38 00000000 0077AEE0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 007748D0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001 00000000 973DC7A0 0000002A 00001000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00FA865A 000000FF 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Argument/Register addr=655680. Dump of memory from 0x000655640 to 0x000655780 00000000 00000000 00000000 00000001 00000000 7273752F 636F6C2F 6C2F6C61 722F6269 00000000 735F6D6C 6F5F6C71 6C636172 2E312D65 2E342E31 00006F73 00000481 00000000 00000000 963BD000 0000002A 00654CC0 00000000 97657028 0000002A 00655B00 00000000 00000000 006551F0 00000000 00655680 00000000 00000000 00000000 00655AC8 00000000 00000000 00000000 00000000 97657078 0000002A 97657128 0000002A 97657118 0000002A 00000000 976570C8 0000002A 976570D8 0000002A 976570E8 0000002A 97657158 0000002A 00000000 97657168 0000002A 97657178 0000002A 976570F8 0000002A 97657108 0000002A 00000000 976570A8 0000002A 976570B8 0000002A 97657088 0000002A 97657098 0000002A 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 97657138 0000002A 00000000 00000000 97657188 0000002A 97657148 0000002A Argument/Register addr=4fa13060. Dump of memory from 0x04FA13020 to 0x04FA13160 00000000 4FA13060 00000000 96DA6CD9 0000002A 00774EC8 00000000 9688CBFE 0000002A 00000000 00000000 00000000 000000FF 00000000 00000000 00000000 00655680 00000000 00000000 4FA13140 00000000 96DA689D 0000002A 00000028 00000030 4FA13150 00000000 00000000 4FA13090 00000000 00655680 00000000 000000FF 00000000 97663E70 0000002A 00000000 000000FF 00000000 00000002 00000000 00000000 00000000 B0E2D800 0000003E 00000000 4FA131C0 00000000 B0A0A68A 0000003E 00000001 00000000 00000000 00000000 00000000 00774EC8 00000000 96411030 0000002A 00000000 00000000 B0A0A552 0000003E 00000000 00000000 00000000 00000002 00000000 00004319 00000000 00000000 00000000 00000000 00774EC8 00000000 00000000 00000000 B0E2D800 0000003E 00655680 00000000 00000000 4FA131C0 00000000 96D75B84 0000002A 00000000 0000003E 4FA13198 00000000 Argument/Register addr=788ed0. Dump of memory from 0x000788E90 to 0x000788FD0 00000000 00000000 00000000 00040000 00000000 00000000 00050001 00000029 009B51C0 00000000 009F97A6 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000105 00000029 00000000 00000000 00000000 00000000 00000000 00000000 00010001 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000029 00000000 00000002 00000002 00000002 00000000 00000000 00000000 00788E38 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00788B28 00000000 00000000 00000000 00000029 00000191 20B38F00 00788E18 00000000 00000000 00000000 00000000 00000000 00000000 F8E9DACB 00000604 Argument/Register addr=77dda8. Dump of memory from 0x00077DD68 to 0x00077DEA8 00000000 00000000 00000000 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000661 30B38F00 0077D3B8 00000000 00000000 00000000 00000000 00000000 00000000 F8E9DACB 00000401 007748D0 00000000 007748D0 00000000 00000000 40000400 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0077E2B8 00000000 00000000 00000000 00000000 00000000 0000007C 00000BFF 00000000 00000000 00000000 00000002 00000060 00000000 00000002 00000000 007896F0 00000000 00000112 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Argument/Register addr=781bf0. Dump of memory from 0x000781BB0 to 0x000781CF0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 007846C0 00000000 00000000 00000007 00000000 00000000 00000000 00028000 00000002 00000000 00000000 00000000 00000000 00000000 007834E4 00000000 0000000D 00000000 00000000 00000000 00000000 00783518 00000000 00000000 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0078351A 00000000 0077DDA8 00000000 00000000 00000000 00000000 00000000 00000000 00783530 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Repeat 1 times 00000000 00000000 00000000 00000000 00000000 Argument/Register addr=4fa15e50. Dump of memory from 0x04FA15E10 to 0x04FA15F50 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00783530 00000000 00781BF0 00000000 007834C8 00000000 00000000 00781BE8 00000000 9734DE24 0000002A 4FA15F90 00000000 966DBF23 0000002A 00000000 0077DDA8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00774960 00000000 00000000 00000000 00000000 00000001 00000000 00000000 00000000 0077DDA8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0077C450 00000000 0077D128 00000000 00000000 00000000 00000000 4FA161D0 00000000 00772DB0 00000000 00653200 00000000 00772DB0 00000000 00000000 00000001 00000000 4FA15FE0 00000000 00000000 00000000 00000000 00000000 00000000 0077DDA8 00000000 0077EFB8 00000000 0077DE28 00000000 0077E178 00000000 00000000 0077E180 00000000 0077C8E8 00000000 Argument/Register addr=4fa161d0. Dump of memory from 0x04FA16190 to 0x04FA162D0 00000000 00000000 00000000 4FA16840 00000000 00000000 955729B2 0000002A 00000000 00000000 00000000 00000000 00000000 00000001 00000000 00000020 00000000 00000000 0000000A 454C4553 72205443 72676461 7270756F 00000000 796C7065 2C64692E 67646172 70756F72 6C706572 72472E79 4E70756F 2C656D61 00000000 67646172 70756F72 6C706572 74412E79 62697274 2C657475 67646172 70756F72 00000000 6C706572 61562E79 2C65756C 67646172 70756F72 6C706572 706F2E79 52462020 00000000 72204D4F 72676461 7270756F 796C7065 6573752C 6F726772 57207075 45524548 Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'alfbericoz(a)foo.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: Status: PGRES_COMMAND_OK Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: affected rows = Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '100.125.1.1' AND pool_key = '2952792152' AND username = 'manoel(a)foo.com' AND callingstationid = '#BRAS-01#E110#2136'' Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: Status: PGRES_COMMAND_OK Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: Status: PGRES_COMMAND_OK Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: Status: PGRES_COMMAND_OK 00000000 65737520 6F726772 552E7075 6E726573 20656D61 6D27203D 656C6C75 72616D72 Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: affected rows = 0 Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: affected rows = Sat Jan 27 19:13:16 2007 : Debug: rlm_sql_postgresql: affected rows = 00000000 736E6974 72657340 746D6F63 632E6C65 622E6D6F 41202772 7520444E 67726573 Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '100.125.1.1' AND pool_key = '2147485784' AND username = 'manoel(a)foo.com' AND callingstationid = '#BRAS-01#E80#2136'' Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval WHERE nasipaddress = '100.125.1.1' AND pool_key = '2147485849' AND username = 'cezar(a)foo.com' AND callingstationid = '#BRAS-01#E80#2201'' Sat Jan 27 19:13:16 2007 : Debug: radius_xlat: 'COMMIT' 00000000 70756F72 6F72472E 614E7075 3D20656D 64617220 756F7267 70657270 472E796C 00000000 70756F72 656D614E 44524F20 42205245 Argument/Register addr=772e10. Dump of memory from 0x000772DD0 to 0x000772F10 00000000 00000000 00000000 00000000 00000000 00000000 00748250 00000000 00000000 00000000 00772E10 00000000 00000000 00000000 00000000 00000000 00000000 00000051 00000000 007748D0 00000000 0077C450 00000000 00000000 0077D128 00000000 0077DDA8 00000000 009CB560 00000000 009E1E80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000071 00000000 00000000 00656480 00000000 00000000 00000000 B0E306B8 0000003E 0076D7A0 00000000 00000000 0076D370 00000000 00000000 00000000 0076D480 00000000 00000008 00000040 00000000 00772ED0 00000000 00000000 00000000 0076D690 00000000 00000007 00000020 00000000 00000000 00000000 00000091 00000000 B0E30828 0000003E B0E30828 0000003E 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Argument/Register addr=4fa160c0. Dump of memory from 0x04FA16080 to 0x04FA161C0 00000000 006528B0 00000000 984025B0 0000002A 0091DFA0 00000000 00772DB0 00000000 00000000 4FA161D0 00000000 961B5744 0000002A 00000000 00000000 4FA160D0 00000000 00000000 00000000 00000000 00A02350 00000000 6C6C756D 616D7265 6E697472 65734073 00000000 6D6F6372 2E6C6574 2E6D6F63 00007262 955728DF 0000002A 4FA167B0 00000000 00000000 4FA16776 00000000 00000002 73000000 00000320 00000000 00000000 00000000 00000000 00000000 00000000 4FA16360 00000000 FFFFFFFF 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000002 4FA16698 00000000 955729B2 0000002A 00000000 00000020 0000000E FFFFFFFF FFFFFFFF 00000000 00000000 4FA16840 00000000 00000000 955729B2 0000002A 00000000 00000000 00000000 00000000 00000000 00000001 Argument/Register addr=6536a4. Dump of memory from 0x000653664 to 0x0006537A4 00000000 472E7075 70756F72 656D614E 72203D20 72676461 7270756F 796C7065 00000000 6F72472E 614E7075 4F20656D 52454452 20594220 67646172 70756F72 6C706572 00000000 64692E79 00000000 000002D1 00000000 41445055 72204554 63616461 53207463 00000000 41205445 53746363 54706F74 3D656D69 445F4F54 28455441 27532527 7979272C 00000000 6D2D7979 64642D6D 32686820 696D3A34 2773733A 41202C29 53746363 69737365 00000000 69546E6F 283D656D 74786528 74636172 63657328 20646E6F 6D6F7266 75632820 00000000 6E657272 69745F74 7473656D 20706D61 5428202D 41445F4F 27284554 2C275325 00000000 79797927 6D6D2D79 2064642D 34326868 3A696D3A 29277373 20292929 7865202B 00000000 63617274 696D2874 6574756E 6F726620 6328206D 65727275 745F746E 73656D69 00000000 706D6174 28202D20 445F4F54 28455441 27532527 7979272C 6D2D7979 64642D6D 00000000 32686820 Argument/Register addr=4fa162e2. Dump of memory from 0x04FA162A2 to 0x04FA163E2 00000000 70756F72 6F72472E 614E7075 3D20656D 64617220 756F7267 70657270 472E796C 00000000 70756F72 656D614E 44524F20 42205245 61722059 6F726764 65727075 2E796C70 00000000 00006469 00000000 009F7BBC 00000000 4FA16440 00000000 955728D4 0000002A 00000000 00000006 00000000 984025B0 0000002A 009F7BBC 00000000 B0C5CFB9 0000003E 00000000 FBAD8001 00000000 009F7BBC 00000000 009F7BBC 00000000 009F7BBC 00000000 00000000 009F7BBC 00000000 009F7BC7 00000000 FFFFFFFF FFFFFFFF 009F7BBC 00000000 00000000 FFFFFFFF FFFFFFFF 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 4FA164F0 00000000 009CCBB0 00000000 00000000 4FA10000 00000000 00000000 00000000 000003F2 00000000 B0C48276 0000003E 00000000 00000018 00000030 00000000 00000000 4FA163E0 00000000 00521080 00000000 00000000 FFFFFFFF ----- End of Call Stack Trace ----- Segmentation fault

3 3

Change of Authorization
by Jeffrey Sewell 27 Jan '07

27 Jan '07

Apologies if this has been addressed before, but I can't find any references in the Wiki or the archives for the use of rfc 3576 Change of Authorization messages. Does FreeRADIUS have any built in way to trigger and/or send a CoA? How have others dealt with users who have exceeded certain limits but have not yet reached session-timout? --Jeffrey

3 3

Log notfound users
by Guilherme Franco 27 Jan '07

27 Jan '07

Hello, In authorize section I have the following: sql { notfound = reject } In post-auth: Post-Auth-Type REJECT { sql attr_filter.access_reject } Both works correctly but I would like to log notfound users into radpostauth table as well, just like in post-auth. How may I do this, please? Thank you.

1 1

Ldap + EAP
by Rafał Kamiński 26 Jan '07

26 Jan '07

Hi, I set my freeradius with linksys and EAP, and when i use cert. that work fine. But when i want to use ldap without cert. in logs i see: rad_recv: Access-Request packet from host 192.168.1.245:3072, id=0, length=119 User-Name = "rka" NAS-IP-Address = 192.168.1.245 Called-Station-Id = "001217694588" Calling-Station-Id = "0014a41e7112" NAS-Identifier = "001217694588" NAS-Port = 61 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000801726b61 Message-Authenticator = 0x935d96fb44fccc41767e4667570ff8f2 All is oki, but my ldap need User-password, and next i see: Auth: Login incorrect: [rka/<no User-Password attribute>] (from client linksys port 61 cli 0014a41e7112) What i must change in ldap or ever to auth. users from wifi in ldap without User-password or with Password? BR, -- Rafal Kaminski http://blstream.com email: rafal.kaminski(a)blstream.com jid: rka(a)im.blstream.com

3 8

CA Chain
by Jeffrey Sewell 26 Jan '07

26 Jan '07

In the eap.conf, tls section, the comments say to use the 'CA_path' variable in the radiusd.conf file to indicate where the trusted CA chain will reside. However, this variable isn't in the tls section of the radiusd.conf file (it is in the LDAP section, but I'm pretty sure that won't help me) or the eap.conf file (where I thought it might have moved). As an experiment, I added it to eap.conf and it loaded ok with the following output: tls: CA_path = "/usr/local/etc/raddb/certs/rootCA" ... tls: CA_file = "(null)" Unfortunately the CA_file is the imporant one as I discovered when I tested the link: Fri Jan 19 09:51:05 2007 : Error: TLS Alert write:fatal:unknown CA So where is the appropriate place for the root chain? JS

2 5

rlm_perl DEBUG log with garbage output
by Rohaizam Abu Bakar 26 Jan '07

26 Jan '07

Hi,.. running xlat within rlm_perl.. giving correct result.. but what concern me is that.. in debug log.. there are garbage output as below:- radius_xlat: '.*' radius_xlat: Running registered xlat function of module y5perl for string '%{User-Name}:%{NAS-Identifier}' radius_xlat: 'bacang:JARINGWiF' rlm_perl: Len is 4 , out is NULL?8???Ù¿¿?49(hÕ¿¿?? freespace is 254 radius_xlat: 'NULL' calling from :- attr_rewrite wifi { ##some code replacewith = %{y5perl:%{User-Name}:%{NAS-Identifier}} } preacct { y5perl wifi files } sub xlat { # some code # return NULL or "somevalue" return ($value); }

3 3

MS-Primary-DNS
by Umar Draz 26 Jan '07

26 Jan '07

hi ... I have installed Freeradius on FreeBSD 6.2 running fine also PPPoE server ruuning on this machine. I want to assign manual dns for my user so I insert a query in radgroupreply table . +----+-----------+-----------------------+----+-------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------------------+----+-------------+ | 2 | tears | MS-Primary-DNS-Server | := | 192.168.1.1 | +----+-----------+-----------------------+----+-------------+ here is the out of radiux -X modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 112 to 127.0.0.1 port 57460 MS-Primary-DNS-Server := 192.168.1.1 Session-Timeout = 37000 Framed-IP-Address = 192.168.1.171 Framed-IP-Netmask = 255.255.255.0 but its did't working and aasign the dns 202.158.26.40 which is set in my FreeBSD /etc/resolv.conf On client side I am using windows XP. Please help me what should do ? Regards, Umar Draz _________________________________________________________________ Get in the mood for Valentine's Day. View photos, recipes and more on your Live.com page. http://www.live.com/?addTemplate=ValentinesDay&ocid=T001MSN30A0701

2 1

How to get Log files
by Abdul Qadir 26 Jan '07

26 Jan '07

Hi All, I have an instace of freeradius 1.1.2 running. I started the radius with -X switch. Is there any way to get a log of requests/response coming to/from radius. I tried to capture on udp port 1812 but no use. Best Regards, Abdul Qadir ____________________________________________________________________________________ Now that's room service! Choose from over 150,000 hotels in 45,000 destinations on Yahoo! Travel to find your fit. http://farechase.yahoo.com/promo-generic-14795097

2 1

Problems with running freeradius
by Jacek Burszta 26 Jan '07

26 Jan '07

Hi ! > I've a problem with my new version FreeRADIUS 1.1.0_2 on FreeBSD 7.0 CURRENT > > vol2% # /usr/local/sbin/radiusd -X > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/eap.conf > main: prefix = "/usr/local" > main: localstatedir = "/var" > main: logdir = "/var/log" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radiusd" > main: log_auth = yes > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "clear" > pap: auto_header = no > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded eap > eap: default_eap_type = "peap" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/usr/local/etc/raddb/certs/volt.key.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/volt.crt" > tls: CA_file = "/usr/local/etc/raddb/certs/ca.crt" > tls: private_key_password = "(null)" > tls: dh_file = "/usr/local/etc/raddb/certs/dh" > tls: random_file = "/usr/local/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > tls: cipher_list = "(null)" > tls: check_cert_issuer = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > ttls: default_eap_type = "md5" > ttls: copy_request_to_tunnel = no > ttls: use_tunneled_reply = yes > rlm_eap: Loaded and initialized type ttls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded LDAP > ldap: server = "ldap2.iem.pw.edu.pl"ol2% # /usr/local/sbin/radiusd -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/eap.conf > main: prefix = "/usr/local" > main: localstatedir = "/var" > main: logdir = "/var/log" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radiusd" > main: log_auth = yes > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "clear" > pap: auto_header = no > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded eap > eap: default_eap_type = "peap" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/usr/local/etc/raddb/certs/volt.key.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/volt.crt" > tls: CA_file = "/usr/local/etc/raddb/certs/ca.crt" > tls: private_key_password = "(null)" > tls: dh_file = "/usr/local/etc/raddb/certs/dh" > tls: random_file = "/usr/local/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > tls: cipher_list = "(null)" > tls: check_cert_issuer = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > ttls: default_eap_type = "md5" > ttls: copy_request_to_tunnel = no > ttls: use_tunneled_reply = yes > rlm_eap: Loaded and initialized type ttls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded LDAP > ldap: server = "ldap2.iem.pw.edu.pl" > ldap: port = 389 > ldap: net_timeout = 1 > ldap: timeout = 4 > ldap: timelimit = 3 > ldap: identity = "cn=radius,ou=admin,dc=iem,dc=pw,dc=edu,dc=pl" > ldap: tls_mode = no > ldap: start_tls = no > ldap: tls_cacertfile = "(null)" > ldap: tls_cacertdir = "(null)" > ldap: tls_certfile = "(null)" > ldap: tls_keyfile = "(null)" > ldap: tls_randfile = "(null)" > ldap: tls_require_cert = "allow" > ldap: password = "znpk22kd" > ldap: basedn = "ou=User,dc=ee,dc=pw,dc=edu,dc=pl" > ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > ldap: base_filter = "(objectclass=sambaSamAccount)" > ldap: default_profile = "(null)" > ldap: profile_attribute = "(null)" > ldap: password_header = "(null)" > ldap: password_attribute = "(null)" > ldap: access_attr = "uid" > ldap: groupname_attribute = "cn" > ldap: groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > ldap: groupmembership_attribute = "(null)" > ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" > ldap: ldap_debug = 0 > ldap: ldap_connections_number = 5 > ldap: compare_check_items = no > ldap: access_attr_used_for_allow = yes > ldap: do_xlat = yes > ldap: set_auth_type = yes > rlm_ldap: Registering ldap_groupcmp for Ldap-Group > rlm_ldap: Registering ldap_xlat with xlat_name ldap > rlm_ldap: Over-riding set_auth_type, as we're not listed in the > "authenticate" section. > rlm_ldap: reading ldap<->radius mappings from file > /usr/local/etc/raddb/ldap.attrmap > rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password > conns: 0x8011e0b00 > Module: Instantiated ldap (ldap) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > > > rad_recv: Access-Request packet from host 194.29.146.140:2067, id=221, > length=96 > User-Name = "ato" > Calling-Station-Id = "00-13-ce-eb-f1-18" > EAP-Message = 0x020100080161746f > Framed-MTU = 1287 > NAS-IP-Address = 194.29.146.140 > NAS-Port = 0 > NAS-Port-Type = Wireless-802.11 > Message-Authenticator = 0xe2ef296f42d9a00f6a6ecc0363ca0f41 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "ato", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 1 length 8 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for ato > radius_xlat: '(uid=ato)' > radius_xlat: 'ou=User,dc=ee,dc=pw,dc=edu,dc=pl' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to ldap2.iem.pw.edu.pl:389, authentication 0 > zsh: segmentation fault sudo /usr/local/sbin/radiusd -X > ldap: port = 389 > ldap: net_timeout = 1 > ldap: timeout = 4 > ldap: timelimit = 3 > ldap: identity = "cn=radius,ou=admin,dc=iem,dc=pw,dc=edu,dc=pl" > ldap: tls_mode = no > ldap: start_tls = no > ldap: tls_cacertfile = "(null)" > ldap: tls_cacertdir = "(null)" > ldap: tls_certfile = "(null)" > ldap: tls_keyfile = "(null)" > ldap: tls_randfile = "(null)" > ldap: tls_require_cert = "allow" > ldap: password = "znpk22kd" > ldap: basedn = "ou=User,dc=ee,dc=pw,dc=edu,dc=pl" > ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > ldap: base_filter = "(objectclass=sambaSamAccount)" > ldap: default_profile = "(null)" > ldap: profile_attribute = "(null)" > ldap: password_header = "(null)" > ldap: password_attribute = "(null)" > ldap: access_attr = "uid" > ldap: groupname_attribute = "cn" > ldap: groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > ldap: groupmembership_attribute = "(null)" > ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" > ldap: ldap_debug = 0 > ldap: ldap_connections_number = 5 > ldap: compare_check_items = no > ldap: access_attr_used_for_allow = yes > ldap: do_xlat = yes > ldap: set_auth_type = yes > rlm_ldap: Registering ldap_groupcmp for Ldap-Group > rlm_ldap: Registering ldap_xlat with xlat_name ldap > rlm_ldap: Over-riding set_auth_type, as we're not listed in the > "authenticate" section. > rlm_ldap: reading ldap<->radius mappings from file > /usr/local/etc/raddb/ldap.attrmap > rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password > conns: 0x8011e0b00 > Module: Instantiated ldap (ldap) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > > rad_recv: Access-Request packet from host 194.29.146.140:2067, id=221, > length=96 > User-Name = "ato" > Calling-Station-Id = "00-13-ce-eb-f1-18" > EAP-Message = 0x020100080161746f > Framed-MTU = 1287 > NAS-IP-Address = 194.29.146.140 > NAS-Port = 0 > NAS-Port-Type = Wireless-802.11 > Message-Authenticator = 0xe2ef296f42d9a00f6a6ecc0363ca0f41 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "ato", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 1 length 8 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for ato > radius_xlat: '(uid=ato)' > radius_xlat: 'ou=User,dc=ee,dc=pw,dc=edu,dc=pl' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to ldap2.iem.pw.edu.pl:389, authentication 0 > zsh: segmentation fault sudo /usr/local/sbin/radiusd -X > > What should I do , because when I started RADIUS it started, and when I > want to connect my laptop to server I see segmentation fault > Thans for all > > Jacek Burszta > > > > >

3 2

a freeradious/wireless solution for a school
by gkalinec 25 Jan '07

25 Jan '07

Hello, I work for a mid-size private school (about 700-800 people on campus), and I'm trying to set up a way to limit the use of our wireless to our students/staff. The main problem that I'm encountering is finding a solution that will fit our needs. A little background first... When I first started (about a year ago, and I'm still the only IT person managing the whole school network) we had crappy wireless at different places on campus for students and staff to access our network. The person who set these up (my current boss) simply did a MAC access control list on each AP and made the students and staff come to him to register their computers. This was a major pain since each of our APs (7 of them) had to have the new MAC address manually added to each AP every time we had a new laptop. The problem with this solution (aside from having to enter the MACs 7 times) was that we eventually run out of room in the MAC table. After some negotiating we got new wireless, but still not top of the line (I wanted CISCOs, we got Netgear WPN802s instead), and I found that we still run out space in the table (it now help 50, we now have about 100+ laptops being used by students). I know that the solution is to implement a radius authentication with the APs that we have. The APs support radius servers using either WAP or legacy 802.1X (with WEP keys). I did tons of research on WAP (being the preferred method), but I could not get around the fact that certificates MUST be installed in the client computer in order for the protocol to work. This is simply impossible since most of our students (and staff for that matter) are unable to install certificates (or unwilling) and having to install certificates manualy myself is just too time consuming. So my first questions is what methods would you suggest for this kind of set up? My original idea was to implement the legacy 802.1x option. i managed to set up the AP correctly and the radius server to authenticate based on MAC addresses, but I could not find a way to get the WEP key back to the client laptop. I'm not even sure it is possible, really, and I'm hesitant to try to have our students and staff enter a WEP key into their laptops themselves (since when they fail they will come for me to set it up, and if I wanted to change the WEP key, I would have to re-change it on every laptop). Is tehre any way for the radius server to send back the WEP key to the client? I know it must seem horribly insecure (and it is), but I have to show my boss a solution that is better than simply leaving our network open. Can some one help or suggest a better way of resolving this? -- View this message in context: http://www.nabble.com/a-freeradious-wireless-solution-for-a-school-tf303622… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 13