- Freeradius-Users - lists.freeradius.org

No memory
by Hasan Ovuc 18 Aug '06

18 Aug '06

Dear Members, I am trying to use freeradius-snapshot-20060817 unixODBC-2.2.11 ODBC-12_5 Radiusd successfully started, after first sql query it dies with no memory error. ///////////////////////////////////////////////////////// Waking up in 5 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 radius_xlat: 'A02165384149' rlm_sql (sql): sql_set_user escaped user --> 'A02165384149' rlm_sql (sql): Reserving sql socket id: 6 radius_xlat: 'EXEC ra_authentication_check 'A02165384149', '1'' query: EXEC ra_authentication_check 'A02165384149', '1' rlm_sql (sql): User found in radcheck table radius_xlat: 'EXEC ra_authentication_reply 'A02165384149', '1', ''' query: EXEC ra_authentication_reply 'A02165384149', '1', '' no memory ///////////////////////////////////////////////////////////// Freeradius-1.1.2 is working in the same machine. It dies with giving same error when it is overloaded. OS = 2.6.17-1.2174_FC5 smp #1 Memory = 1 GB CPU= 2XIntel(R) Xeon(TM) CPU 3.06GHz Vmstat and top results when problem occurs, root@Lara03:/home/hasano/3/freeradius-snapshot-20060817/src/main# vmstat 1 procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------ r b swpd free buff cache si so bi bo in cs us sy id wa st 0 0 0 640452 712 315188 0 0 4 6 69 32 1 0 99 0 0 0 0 0 640452 712 315188 0 0 0 0 259 34 0 0 100 0 0 0 0 0 640452 712 315188 0 0 0 8 259 29 0 0 100 0 0 0 0 0 640452 712 315188 0 0 0 0 263 46 0 0 100 0 0 root@Lara03:/home/hasano/3/freeradius-snapshot-20060817/src/main# top top - 14:29:29 up 4:32, 7 users, load average: 0.00, 0.00, 0.00 Tasks: 80 total, 1 running, 79 sleeping, 0 stopped, 0 zombie Cpu0 : 0.0% us, 0.0% sy, 0.0% ni, 100.0% id, 0.0% wa, 0.0% hi, 0.0% si, 0.0% st Cpu1 : 0.0% us, 0.0% sy, 0.0% ni, 100.0% id, 0.0% wa, 0.0% hi, 0.0% si, 0.0% st Cpu2 : 0.0% us, 0.0% sy, 0.0% ni, 100.0% id, 0.0% wa, 0.0% hi, 0.0% si, 0.0% st Cpu3 : 0.0% us, 0.2% sy, 0.0% ni, 99.8% id, 0.0% wa, 0.0% hi, 0.0% si, 0.0% st Mem: 1034832k total, 394408k used, 640424k free, 712k buffers Swap: 4192956k total, 0k used, 4192956k free, 315188k cached PID PPID TIME+ %CPU %MEM PR NI S VIRT SWAP RES UID COMMAND 31422 31359 0:00.03 0 0.1 16 0 R 2084 1204 880 0 top 31359 8523 0:00.10 0 0.1 15 0 S 4580 3060 1520 0 bash 31194 1 0:01.88 0 1.2 15 0 S 83008 68m 12m 501 radiusd Can you help me ? Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

2 1

How to send radius packet to two separated Radius server?
by biuro＠globeinphotos.com 18 Aug '06

18 Aug '06

Hi, I have special requirements that I do not know how to implement in Freeradius. We have two radius servers one is connected to Postgress and should handle all kind of radius packet and second connected to MySQL and should handle only accounting request. This configuration can look bizarre but 'accouning server' insert/delete/modify many rows in database and we had to use MySQL to avoid Postgress vacuum problem (our system is VoIP real time system and we cannot wait to make vacuum on production database). My question is it possible to somehow duplicate packet and send it to two separated Freeradius (I've found that in GNU radius probably can be achieved by Forward module)? I cannot use radius proxy because it can only split packet between several server but does not send the same message to different host. Can you have any proposition how to solve it? Michal Szymanski http://blog.szymanskich.net

1 0

How to configure the Radius in SSH (22)
by raviprakash sunkara 18 Aug '06

18 Aug '06

Hi Users, I Want to create the radius (AAA) for remote accessing By using the putty in "SSH" Can anyone Give the clues to me on That........................ or any url or documentation .................. plz for me in English....... ...... -- Thanks and Regards with cheers Sunkara Ravi Prakash (LAMP programming) Hyperion Technology Kondapur, Hi-tech city, Hyderabad. www.hyperion-tech.com +91-9985077535

1 0

Query to know radius disconnect request and Ack is supported in freeradius
by Shankar Ganesh C 18 Aug '06

18 Aug '06

Hi All, Could some body help me to know whether Radius disconnect and Ack messages are supported in free radius as defined in RFC 2822 ? The message ID are diconnet 40 adn Ack 41. Thanks and regards Shankar ganesh

2 2

PAP/mysql/crypt stuff
by Keith Woodworth 18 Aug '06

18 Aug '06

After working on this off and on for the last few days I believe I have gotten authentication working using a Crypt'd password stored in mysql but want to run this by to make sure I did it right. I setup a user in radcheck: tester | Crypt-Password | == | gmxwp4dfOcHAI In radgroupreply: admin | Service-Type | := | Administrative-User In radgroupcheck: admin | Auth-Type | := | PAP Then when I telnet to the NAS, I can login using tester with the right password and get a NAS prompt. I have to move one of our T1's to this test NAS to test PPP, but it seems to for now, be working using PAP authentication with the encrypted password stored in mysql. Is this the correct way to do this? Thanks for any info. Keith

1 0

Active Directory Users
by Mohammad Abohelal 17 Aug '06

17 Aug '06

Hi all I need help with simple configuration to authenticate windows active directory users via free radius. I have a domain controller, Cisco vpdn router , and free radius UNIX environment ( FreeBSD ) Active directory group: VPDN, user name's have allow dialin on user option Radiusd.conf ldap configuration: ldap { server = "ad.xxx.yyy" identity = "CN=radiusd,OU=External_Object,DC=xxxl,DC=yyy" password = radiusd111 basedn = "OU=VPDN_USERS,OU=External_Object,DC=xxx,DC=yyy" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" When I try to connect via l2tp dialer I get error: (auth: Failed to validate the user ( modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "vpdn1" with password "xxxx" radius_xlat: '(uid=vpdn1)' radius_xlat: 'OU=VPDN_USERS,OU=External_Object,DC=xxxl,DC=yyy' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ad.xxx.yyy:389, authentication 0 rlm_ldap: bind as CN=radiusd,OU=External_Object,DC=xxx,DC=yyy/radiusd111 to ad.xxx.yyy:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in OU=VPDN_USERS,OU=External_Object,DC=xxx,DC=yyy, with filter (uid=vpdn1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [vpdn1/xxxx (from client wan-gw1 port 25) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 194.90.143.73:1645, id=20, length=102 Sending Access-Reject of id 20 to 194.90.143.73 port 1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 20 with timestamp 44e4c472 Nothing to do. Sleeping until we see a request. Thank you Mohammad

3 4

Garbled class attribute?
by Geoff Silver 17 Aug '06

17 Aug '06

I have a bunch of users which should have a class attribute returned upon successful authentication. Their entries look something like: bob NAS-IP-Address == 172.31.33.66, Hint==HasSlash Auth-Type:=Accept Class = "OU=MY_CORP", Filter-Id = "SPCCOLO_O", Split-Tunneling-Policy = 1, Split-Tunnel-List = "SPCCOLO_ST" What they're actually getting back is: Packet-Type = Access-Accept User-Name = "bob" Class = 0x3739774831423272375053516a71424143444358434979507544493d Filter-Id = "SPCCOLO_O" Split-Tunneling-Policy = 1 Split-Tunnel-List = "SPCCOLO_ST"

3 7

Pretty easy question, I think? :D
by Drew Weaver 17 Aug '06

17 Aug '06

I'm setting up a new AAA server here using freeradius. I am just attempting to get it to authenticate using /etc/passwd (unix style) and I am getting this error: Thu Aug 17 11:06:51 2006 : Debug: rad_check_password: Found Auth-Type System Thu Aug 17 11:06:51 2006 : Debug: auth: type "System" Thu Aug 17 11:06:51 2006 : Debug: ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. Thu Aug 17 11:06:51 2006 : Debug: auth: Failed to validate the user. This is my module configuration: unix { cache = no cache_reload = 600 passwd = /etc/passwd group = /etc/group shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } Anyone have any advice for me? Thanks, Andrew

2 1

Regarding using strcmp instead of memcmp
by Ravi S M 17 Aug '06

17 Aug '06

Hi I am trying to run free radius code with purify , it is giving errors as UMR: Uninitialized memory read (13 times) in memcmp Reading 5 bytes from 0xffbdd108 on the stack (1 byte at 0xffbdd10c uninit). Address 0xffbdd108 is 4 bytes past start of local variable "cs" in function So can I use strcmp instead of memcmp . because if I use strcmp instead of memcmp the error is not coming Please I would be grateful if u can provide some useful information regarding this Thanks & regards Ravi ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

RE: question about an output
by John Mylchreest 17 Aug '06

17 Aug '06

Agreed, it is clear and it does make sense, but did it warrant such a tactless reply? Anyways, I'm feeding the troll so I'll not be reading anymore of the thread. -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Stefan Winter Sent: 17 August 2006 15:33 To: FreeRadius users mailing list Subject: Re: question about an output > /etc/raddb/users[154]: Syntax error: Previous line is missing a trailing > comma for entry DEFAULT > > Basically, it is something in the config file, but is there a way to locate > the error in this configuration file? How could this message be any more clear? What do you *think* you have to chack, after reading this output, word by word? Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473 Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0