- Freeradius-Users - lists.freeradius.org

AD Group based ldap auth
by Dourty, Brian R. (IATS) 10 Oct '06

10 Oct '06

I'm trying to get group based authentication working using LDAP against AD. Right now I'm getting a failure related to the group search filter. What filter should I be using? groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(&(objectClass=top)(uniq uemember=%{Ldap-UserDn})))" Looking at the howto here http://lists.cistron.nl/pipermail/freeradius-users/2005-November/048536. html got me part of the way. Anyone out there doing group based auth against AD mind sharing their config? Thanks, Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

1 0

RHEL4 and Oracle Instant Client
by Dourty, Brian R. (IATS) 10 Oct '06

10 Oct '06

Has anyone gotten the source RPM's from RHEL4 to build with the oracle module using the Oracle instant client? It keeps giving me the following error no matter what I try: checking for oci.h... yes checking for oracle_init in -loracleclient... no configure: warning: oracle libraries not found. Use --with-oracle-lib-dir=<path>. configure: warning: sql submodule 'oracle' disabled Thanks, Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

2 1

Re: disable FreeRadius checking of client certs
by devel 10 Oct '06

10 Oct '06

Thanks guys for your post. First off, I have tried using the WinXP supplicant and I have no problems authenticating with the Linksys wifi cards. I just wish the Linksys utility was like Cisco where I can tell it do provide either/or username/cert. The Cisco cards have no problem with this as where using the Linksys with its utility does not provide me with what I want. No big deal. Using the Linksys client utitliy, a username, password, and certificate must be provided (the certificate is a combo box so I can't even leave it blank). I have always preferred to use the utility that came with wifi cards for configuration. They typically provide more information and are more user friendly than the Windows supplicant. This problem does pertain to the Linksys software more than FreeRadius. I was just hoping there was a way in the FreeRadius config files to help solve the problem Travis ----- Original Message ----- From: "Artur Hecker" <artur(a)wave-storm.com> To: "devel" <devel(a)oberonwireless.com>; "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, October 10, 2006 12:42 PM Subject: Re: disable FreeRadius checking of client certs > Hi Travis > > > Excuse me for top-posting, but just as Alan I'm a bit surprised by your > post. > > If your authentication system is based on certificates, you need > certificates and you really should not say anything like "certificates > bother me" since that is the only expression of your trust, so without > that verification no authentication will ever be reasonable or complete. > > If it is not, you do not have certificates. Allowing both for the same > client (same machine) is discouraged. Personally I am not familar with a > supplicant which tries one and then another for the same username. > > Thus, per user if you are using EAP-PEAP-MSCHAPv2 (passwords), then you > are not using EAP-TLS. And vice versa. > > The good news is: the authentication method has strictly nothing to do > with the WiFi card; it is completely virtualized, in software. EAP is > only a transporter protocol, it does not say how to authenticate, it only > says how to transport data. Thus, if EAP is supported by the card, then > *every* EAP method is supported. That's magic about 802.1X and that's why > it's supported in the operating system rather than being supported by a > network card. > > Now if you are saying that you use a special Linksys 802.1X client, then > I would first suggest that you use the standard WinXP client. Sorry, but > the Linksys client is fairly unknown. > > Practically, it's difficult to guess from what you provided, but I think > that you do use the WinXP supplicant (i.e. 802.1X client - I do not know > of any linksys supplicant) and that you probably want to use > EAP-PEAP-MSCHAPv2. That involves one server certificate (obviously one > common trust anker - a self signed CA certificate) and some > username/passwords on clients. What probably happened is that in the two > cases where the Linksys card is used, you did not correctly configure > EAP-PEAP (called "Protected EAP" in WinXP or similar), but you let it be > "Smartcard or Certificate". Thus, the card tries to do TLS with some > available pub/priv key combination, but Freeradius rejects it. > > Reconfigure the WinXP supplicant to do EAP-PEAP and it will ask you for > passwords. Do not forget to deploy the server certificate on user > machines... > > >> Well, I have not issued certs to clients. Some of my clients have the >> option to log in with a username "OR" a cert. However, there are a few >> random Linksys cards (I guess I should have mentioned this was for >> Wifi/WPA) that I "MUST" provide a username and a cert. > > Strictly speaking, every EAP session will take a Username and the AAA > server will derive from it the authentication method to use. When used in > EAP-TLS, Windows XP typically fills it out with the CN from the > certificate (if available) but that is of course insufficient and it > would be more correct to give an identifier and then to start a TLS > authentication session for that id. (How exactly the username compares to > the certified information is an open question, since the username can be > altered by different means). > > >> If there are no certs on the client machine, Linksys fills the cert in >> with "Trust Any", so I assume it may be attempting with a blank? cert or >> another cert on the machine, such as VeriSign or the like.So this client >> is attempting to authenticate, I believe, with other certs on its >> machine because the radius log looks like below: > > hmmm??? you can't just use any certificate for authentication. What you > need is a pair: certificate/private key. Nobody except Verisign has their > private key. > > The only option for your Linksys 802.1X client would be to spontaneously > create a CA and to issue one user certificate for EAP authentication > signed by the latter. That can be done by XP, but there is no interest in > doing so. > > I would suggest you deploy passwords on these machines and configure EAP > PEAP. > > > regards > artur > > >> Tue Oct 10 11:16:16 2006 : Error: TLS_accept:error in SSLv3 read >> client certificate A >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap: SSL error error: >> 00000000:lib(0):func(0):reason(0) >> Tue Oct 10 11:16:16 2006 : Error: TLS Alert read:fatal:unknown CA >> Tue Oct 10 11:16:16 2006 : Error: TLS_accept:failed in SSLv3 read >> client certificate A >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap: SSL error error: >> 14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap_tls: SSL_read failed inside >> of TLS (-1), TLS session fails. >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap: SSL error error: >> 140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap_tls: BIO_read failed in a >> system call (-1), TLS session fails. >> >> I am not a FreeRadius expert so I may be misinterpreting the logs. >> Thanks. >> >> >> Travis >> ----- Original Message ----- From: "Alan DeKok" >> <aland(a)deployingradius.com> >> To: "devel" <devel(a)oberonwireless.com>; "FreeRadius users mailing list" >> <freeradius-users(a)lists.freeradius.org> >> Sent: Tuesday, October 10, 2006 10:27 AM >> Subject: Re: disable FreeRadius checking of client certs >> >> >>> "devel" <devel(a)oberonwireless.com> wrote: >>>> Is it possible to disable FreeRadius's checking of client certificates >>>> using EAP-TLS-PEAP? Certs can be quick a bother and a huge maintenance >>>> over-head. Thanks. >>> >>> Huh? Client certs are used for PEAP only when you deploy client >>> certs to the end-user machines. Once they're deployed, they should >>> really be checked. >>> >>> Perhasp you can explain why you've deployed client certs, but now >>> don't want to use them. >>> >>> Alan DeKok. >>> -- >>> http://deployingradius.com - The web site of the book >>> http://deployingradius.com/blog/ - The blog >>> >> >> - List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html > >

1 0

cisco-accounting do not work. what i miss?
by Paloma Munoz 10 Oct '06

10 Oct '06

Hello to all! I have a problem with the accounting. I have FreeRADIUS Version 1.0.1 I think i have all I need to make the accounting but do not work. When I use the: "Radius Test Client", all is OK, i can see the log in mysql table(radacct)and in detail log file, but in the NAS don´t work. The authentication and authorization work ok. The Ip is assigned from the Radius. Also the "postauth logs" in mysql, works ok. ---------My cisco configuration---------------- aaa group server radius pal server A.B.C.D auth-port 1645 acct-port 1646 ! aaa authentication ppp default group pal aaa authorization network default group pal aaa accounting delay-start aaa accounting update newinfo aaa accounting network default start-stop group pal interface Virtual-Template2 ip unnumbered ATM2/0 ppp authentication pap radius-server configure-nas radius-server host A.B.C.D auth-port 1645 acct-port 1646 radius-server retransmit 2 radius-server timeout 20 radius-server key -------------------------------- ----my RADIUS configuration---- radiusd.conf: accounting { detail radutmp pool sql} ------------------------------- Any idea, where is the problem? I do not know, what is it happens Thanks for all

1 0

disable FreeRadius checking of client certs
by devel 10 Oct '06

10 Oct '06

Is it possible to disable FreeRadius's checking of client certificates using EAP-TLS-PEAP? Certs can be quick a bother and a huge maintenance over-head. Thanks. FreeRadius 1.1.3 Travis J. Weaver Software Engineer Oberon, Inc. 1315 S. Allen St. Suite 405 State College, PA 16801 phone: (814)867-2312 ext. 210 fax: (814)867-2314 http://www.oberonwireless.com tjw(a)oberonwireless.com

2 3

One connection per username
by Ali Jawad 10 Oct '06

10 Oct '06

Hi How can I limit one connection per username..I.e. I do not want to allow multiple users to login using the same username password combination. -- With Regards Ali Jawad

2 1

Reversibly encrypted passwords in SQL
by Stefan Winter 09 Oct '06

09 Oct '06

Hello, is there any way of using reversibly encrypted passwords together with a mySQL backend? Currently, our passwords are stored as User-Password in clear text. I'd like to move on to using something like Crypt-Password := {algo-prefix}blablabla with an algorithm that encrypts reversibly. I failed to see a list of supported algorithms in the docs, a pointer would be nice... Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 4

RE: EAP-TLS Certificate problems.
by Jason-Wittlin-Cohen 09 Oct '06

09 Oct '06

> Message: 7 > Date: Mon, 9 Oct 2006 11:26:51 -0400 > From: "Brian vb" <nova5radius(a)gmail.com> > Subject: RE: EAP-TLS Certificate problems. > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <000f01c6ebb7$59118220$be01010a@lightwave> > Content-Type: text/plain; charset="us-ascii" > > Recreated certs, same issue came with the Issuer field. XPExtensions are > used. Password is the same in this file an what Freeradius has just changed > to protect it. > > > Here is the batch file I'm using to create the certs. I don't see anything > amiss between it and the page you sent.. any ideas? > > > PATH=C:\openssl\bin;C:\ssl1;%path% > export LD_LIBRARY_PATH=C:\openssl\lib > > > CD\SSL1 > > REM CA Creation > C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -export -in newreq.pem -out root.p12 -cacerts > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in root.p12 -out root.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in root.pem -out > root.der I'm not sure what you're doing here. First, "> C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved" You're outputting the private key and public key to the same file. I'm not sure if this will include both in the same file, or only create one. Regardless, it's not what you want to do. Give the files unique names. The clients and server need the public key and only the certificate signing machine needs the private key. You don't want to combine the keys. To create a CA: openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf Also, why are you creating a p12 file for the CA? You certainly don't want to hand out the private key to clients, and for certificate signing, you only need the private key which can be stored in cakey.pem for example. Clients should be given cacert.pem or cacert.der depending on the format you use. The p12 format should only be used for client certs because those need to combine private key + certificate (at least for the MS supplicant). > > REM Client cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, -keyout is used to creaate the private key, and -out to create the certificate signing request which is then passed on to the CA later. You're using the same filename, so I have no idea what's happening. Either you have a certificate signing request and no key, or a key without a signing request. Either way, it won't work. You need to do something like this: openssl req -new -keyout client_key.pem \ -out client_req.pem -days 730 -config ./openssl.cnf Notice that the key and the signing request are given different names. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpclient_ext -extfile > xpexts -infiles newreq.pem > > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-clt.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-clt.p12 -out cert-clt.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-clt.pem -out > cert-clt.der So, you convert from a PEM certificate and PEM key, to a P12 cert+key, to a PEM cert+key to DER cert+key. Why? The P12 cert+key will work fine. > > REM Server Cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, the key and certificate signing request must be given different names or else your setup will fail. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpserver_ext -extfile > xpexts -infiles newreq.pem > Do you need these steps? Freeradius will use a seperate certificate and key in PEM format. It works fine for me. It seems like your setup is overly complex. Keep it simple, and see if it works. Then you can change file formats- etc. For now, just make the changes I recommended and see if it gives you a working CA and client/server certificates. > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-srv.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-srv.pem -out > cert-srv.der > Jason Wittlin-Cohen

1 0

Huntgroups, Realms, MySQL
by Brad McAllister 09 Oct '06

09 Oct '06

Sorry if this has already been addressed. I has been searching all day and haven't found the solution to my problem. I am attempting to setup multiple huntgroups to limit the types of connections that clients can make. Along with this I have a list of realms that are authenticated locally and others that are directed to remote radius servers. All of the user and group information is stored in a mysql db. I am having problems authenticating users with realms that are not passed to a remote server. Below is an example of a test without a realm: radtest test blah123 127.0.0.1 0 testing123Sending Access-Request of id 215 to 127.0.0.1:1812 User-Name = "test" User-Password = "blah123" NAS-IP-Address = localhost.localdomain NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=215, length=272 Framed-Protocol = PPP Framed-Routing = Broadcast Framed-Compression = None Framed-MTU = 1500 Idle-Timeout = 0 Cisco-AVPair = "lcp:interface-config=rate-limit input 256000 32000 32000 conform-action transmit exceed-action drop" Cisco-AVPair = "lcp:interface-config=rate-limit output 4500000 32000 32000 conform-action transmit exceed-action drop" Service-Type = Framed-User With a realm: radtest test(a)dls.net blah123 127.0.0.1 0 testing123 Sending Access-Request of id 223 to 127.0.0.1:1812 User-Name = "test(a)dls.net" User-Password = "blah123" NAS-IP-Address = localhost.localdomain NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=223, length=20 Output from the server: rad_recv: Access-Request packet from host 127.0.0.1:32770, id=223, length=77 User-Name = "test(a)dls.net" User-Password = "blah123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_sql (sql): - sql_groupcmp radius_xlat: 'test(a)dls.net' rlm_sql (sql): sql_set_user escaped user --> 'test(a)dls.net' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='test(a)dls.net'' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 rlm_sql (sql): - sql_groupcmp finished: User does not belong in group 3072BY256 No huntgroup access: [test(a)dls.net] (from client localhost port 0) modcall[authorize]: module "preprocess" returns reject for request 2 modcall: group authorize returns reject for request 2 If I removed the huntgroups out of the picture, is works fine. The problem seems to be that the realm is not being stripped off of the username when it checks it against the usergroup table. If more information is needed, please let me know. I would really like to get this working. Thanks! - Brad

2 5

Debian stableFreeradius 1.0.2 + IOdbc + FreeTDS + MSSQL Segmentation fault.
by Angelo Compagnucci 09 Oct '06

09 Oct '06

Hi to all! I've a GREAT problem ... Freeradius exits abnormally with a segmentation fault error when user logoff ... This is the log: ... Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 45,Client-IP-Address = 192.168.0.2,NAS-IP-Address = 192.168.0.2,Acct-Session-Id = "81700000",User-Name = "tester6"' rlm_acct_unique: Acct-Unique-Session-ID = "14ec0af158f89db2". modcall[preacct]: module "acct_unique" returns ok for request 2 modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'tester6' modcall[accounting]: module "radutmp" returns ok for request 2 radius_xlat: 'tester6' rlm_sql (sql): sql_set_user escaped user --> 'tester6' radius_xlat: 'UPDATE radacct SET AcctStopTime = '2006-10-09 16:28:21', AcctSessionTime = '5', AcctInputOctets = '96', AcctOutputOctets = '200', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '81700000' AND UserName = 'tester6' AND NASIPAddress = '192.168.0.2' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 1 Segmentation fault --------------- This is the strace: time(NULL) = 1160408543 getsockname(4, {sa_family=AF_INET, sin_port=htons(1813), sin_addr=inet_addr("0.0.0.0")}, [23053941335916560]) = 0 recvmsg(4, {msg_name(16)={sa_family=AF_INET, sin_port=htons(1035), sin_addr=inet_addr("192.168.0.2")}, msg_iov(1)=[{"\4 [\0\302\362n\337zq`9\211\335\320@^\n\307\360\214\6\6"..., 4096}], msg_controllen=32, {cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=, ...}, msg_flags=0}, 0) = 194 write(1, "rad_recv: Accounting-Request pac"..., 82rad_recv: Accounting-Request packet from host 192.168.0.2:1035, id=91, length=194 ) = 82 time(NULL) = 1160408543 write(1, "\tService-Type = Framed-User\n", 28 Service-Type = Framed-User ) = 28 write(1, "\tFramed-Protocol = PPP\n", 23 Framed-Protocol = PPP ) = 23 write(1, "\tNAS-Port = 47\n", 15 NAS-Port = 47 ) = 15 write(1, "\tNAS-Port-Type = Ethernet\n", 26 NAS-Port-Type = Ethernet ) = 26 write(1, "\tUser-Name = \"tester6\"\n", 23 User-Name = "tester6" ) = 23 write(1, "\tCalling-Station-Id = \"00:02:3F:"..., 42 Calling-Station-Id = "00:02:3F:17:65:34" ) = 42 write(1, "\tCalled-Station-Id = \"service1\"\n", 32 Called-Station-Id = "service1" ) = 32 write(1, "\tNAS-Port-Id = \"ether1\"\n", 24 NAS-Port-Id = "ether1" ) = 24 write(1, "\tAcct-Session-Id = \"81800001\"\n", 30 Acct-Session-Id = "81800001" ) = 30 write(1, "\tFramed-IP-Address = 10.0.102.17"..., 34 Framed-IP-Address = 10.0.102.175 ) = 34 write(1, "\tFramed-IP-Netmask = 255.255.255"..., 35 Framed-IP-Netmask = 255.255.255.0 ) = 35 write(1, "\tAcct-Authentic = RADIUS\n", 25 Acct-Authentic = RADIUS ) = 25 write(1, "\tAcct-Session-Time = 5\n", 23 Acct-Session-Time = 5 ) = 23 write(1, "\tAcct-Input-Octets = 96\n", 24 Acct-Input-Octets = 96 ) = 24 write(1, "\tAcct-Input-Gigawords = 0\n", 26 Acct-Input-Gigawords = 0 ) = 26 write(1, "\tAcct-Input-Packets = 9\n", 24 Acct-Input-Packets = 9 ) = 24 write(1, "\tAcct-Output-Octets = 200\n", 26 Acct-Output-Octets = 200 ) = 26 write(1, "\tAcct-Output-Gigawords = 0\n", 27 Acct-Output-Gigawords = 0 ) = 27 write(1, "\tAcct-Output-Packets = 11\n", 26 Acct-Output-Packets = 11 ) = 26 write(1, "\tAcct-Status-Type = Stop\n", 25 Acct-Status-Type = Stop ) = 25 write(1, "\tAcct-Terminate-Cause = User-Req"..., 37 Acct-Terminate-Cause = User-Request ) = 37 write(1, "\tNAS-Identifier = \"MikroTik\"\n", 29 NAS-Identifier = "MikroTik" ) = 29 write(1, "\tNAS-IP-Address = 192.168.0.2\n", 30 NAS-IP-Address = 192.168.0.2 ) = 30 write(1, "\tAcct-Delay-Time = 0\n", 21 Acct-Delay-Time = 0 ) = 21 time(NULL) = 1160408543 write(1, " Processing the preacct section"..., 49 Processing the preacct section of radiusd.conf ) = 49 time(NULL) = 1160408543 write(1, "modcall: entering group preacct "..., 46modcall: entering group preacct for request 2 ) = 46 time(NULL) = 1160408543 write(1, " modcall[preacct]: module \"prep"..., 67 modcall[preacct]: module "preprocess" returns noop for request 2 ) = 67 time(NULL) = 1160408543 write(1, "rlm_acct_unique: Hashing \'NAS-Po"..., 153rlm_acct_unique: Hashing 'NAS-Port = 47,Client-IP-Address = 192.168.0.2,NAS-IP-Address = 192.168.0.2,Acct-Session-Id = "81800001",User-Name = "tester6"' ) = 153 time(NULL) = 1160408543 write(1, "rlm_acct_unique: Acct-Unique-Ses"..., 62rlm_acct_unique: Acct-Unique-Session-ID = "8132fc6445e0c224". ) = 62 time(NULL) = 1160408543 write(1, " modcall[preacct]: module \"acct"..., 66 modcall[preacct]: module "acct_unique" returns ok for request 2 ) = 66 time(NULL) = 1160408543 write(1, "modcall: leaving group preacct ("..., 58modcall: leaving group preacct (returns ok) for request 2 ) = 58 time(NULL) = 1160408543 write(1, " Processing the accounting sect"..., 52 Processing the accounting section of radiusd.conf ) = 52 time(NULL) = 1160408543 write(1, "modcall: entering group accounti"..., 49modcall: entering group accounting for request 2 ) = 49 time([1160408543]) = 1160408543 time(NULL) = 1160408543 write(1, "radius_xlat: \'/var/log/radius/r"..., 40radius_xlat: '/var/log/radius/radutmp' ) = 40 time(NULL) = 1160408543 write(1, "radius_xlat: \'tester6\'\n", 24radius_xlat: 'tester6' ) = 24 open("/var/log/radius/radutmp", O_RDWR|O_CREAT, 0600) = 11 fcntl(11, F_SETLKW, {type=F_WRLCK, whence=SEEK_CUR, start=0, len=112}) = 0 lseek(11, 6944, SEEK_SET) = 6944 read(11, "tester6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 112) = 112 lseek(11, -112, SEEK_CUR) = 6944 write(11, "tester6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 112) = 112 close(11) = 0 time(NULL) = 1160408543 write(1, " modcall[accounting]: module \"r"..., 65 modcall[accounting]: module "radutmp" returns ok for request 2 ) = 65 time(NULL) = 1160408543 write(1, "radius_xlat: \'tester6\'\n", 24radius_xlat: 'tester6' ) = 24 time(NULL) = 1160408543 write(1, "rlm_sql (sql): sql_set_user esca"..., 55rlm_sql (sql): sql_set_user escaped user --> 'tester6' ) = 55 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=951, ...}) = 0 time(NULL) = 1160408543 write(1, "radius_xlat: \'UPDATE radacct SE"..., 338radius_xlat: 'UPDATE radacct SET AcctStopTime = '2006-10-09 17:42:23', AcctSessionTime = '5', AcctInputOctets = '96', AcctOutputOctets = '200', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '81800001' AND UserName = 'tester6' AND NASIPAddress = '192.168.0.2' AND AcctStopTime = 0' ) = 338 time(NULL) = 1160408543 write(1, "rlm_sql (sql): Reserving sql soc"..., 42rlm_sql (sql): Reserving sql socket id: 1 ) = 42 time(NULL) = 1160408543 select(7, NULL, [6], NULL, NULL) = 1 (out [6]) sendto(6, "\1\1\1I\0\0\0\0UPDATE radacct SET AcctS"..., 329, MSG_NOSIGNAL, NULL, 0) = 329 time(NULL) = 1160408543 select(7, [6], NULL, NULL, NULL) = 1 (in [6]) recvfrom(6, "\4\1\0\21\0007\1\0", 8, MSG_NOSIGNAL, NULL, NULL) = 8 time(NULL) = 1160408543 time(NULL) = 1160408543 select(7, [6], NULL, NULL, NULL) = 1 (in [6]) recvfrom(6, "\375\20\0\305\0\1\0\0\0", 9, MSG_NOSIGNAL, NULL, NULL) = 9 time(NULL) = 1160408543 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 3981 detached

1 0