- Freeradius-Users - lists.freeradius.org

More documentation on Auth-Type
by Alan DeKok 18 Aug '06

18 Aug '06

http://deployingradius.com/documents/configuration/auth_type.html Many web sites contain all sorts of recommendations about Auth-Type. This one is correct. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

6 17

Regarding using strcmp instead of memcmp
by Ravi S M 18 Aug '06

18 Aug '06

Hi this is where the error is occurring in UMR & ABR in the following files, While running with purify. Command-line: radiusd -X UMR: Uninitialized memory read (3 times) This is occurring while in: memcmp [rtlib.o] cf_expand_variables [conffile.c:369] p += strlen(p); ptr = end + 1; => } else if (memcmp(ptr, "$ENV{", 5) == 0) { char *env; ptr += 5; cf_section_read [conffile.c:785] /* * Handle variable substitution via ${foo} */ => value = cf_expand_variables(cf, lineno, cs, buf, buf3); if (!value) { cf_section_free(&cs); return NULL; conf_read [conffile.c:834] return NULL; } => if(parent) { cs = cf_section_read(conffile, &lineno, fp, NULL, NULL, parent); } else { cs = cf_section_read(conffile, &lineno, fp, NULL, NULL, NULL); read_radius_conf_file [mainconfig.c:1145] radlog(L_ERR|L_CONS, "radius_dir : %s",radius_dir); if ((cs = conf_read(NULL, 0, buffer, NULL)) == NULL) { => return NULL; } /* read_mainconfig [mainconfig.c:1190] /* First read radiusd.conf */ DEBUG2("reread_config: reading radiusd.conf"); if ((cs = read_radius_conf_file()) == NULL) { => if (debug_flag || (radlog_dir == NULL)) { radlog(L_ERR|L_CONS, "Errors reading radiusd.conf"); } else { Reading 5 bytes from 0xffbe51d0 on the stack (1 byte at 0xffbe51d4 uninit). Address 0xffbe51d0 is 68 bytes past start of local variable "cs" in function cf_section_read. And the ABR error as below ABR: Array bounds read This is occurring while in: memcmp [rtlib.o] rad_respond [radiusd.c:1744] pairfind(request->packet->vps, PW_PASSWORD)); reprocess = 1; } => if (strcmp(mainconfig.do_nospace_user, "after") == 0) { rad_rmspace_pair(request, request->username); reprocess = 1; } main [radiusd.c:1502] } } else #endif => rad_respond(request, fun); } /* loop over listening sockets*/ #ifdef WITH_SNMP _start [crt1.o] Reading 6 bytes from 0xc5c20 in the heap (3 bytes at 0xc5c23 illegal). Address 0xc5c20 is at the beginning of a malloc'd block of 3 bytes. This block was allocated from: malloc [rtlib.o] strdup [libc.so.1] cf_section_parse [conffile.c:527] cs->name1, variables[i].name, value ? value : "(null)"); => *q = value ? strdup(value) : NULL; break; case PW_TYPE_IPADDR: read_radius_conf_file [mainconfig.c:1153] * radiusd.conf, the other configuration files exist. */ cf_section_parse(cs, NULL, server_config); Thanks & Regards Ravi ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

Regarding memory leaks
by Ravi S M 18 Aug '06

18 Aug '06

Hi I am using free radius code in that I have changed the log file for using my own log file. So if I run ./radiusd -X it works fine i.e. -> without any memory leaks And also if I run ./radiusd -> it is not generating memory leaks. But if I run ./radiusd -l "path/log" -> it is giving memory leaks So after all these if I run again ./radiusd -> it is giving memory leaks All the above I have compiled with purifier . So what might be the problem, please give some useful comments on this. Thanks & Regards Ravi ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

user specific settings in users file overwritten by DEFAULT settings?
by Drew Weaver 18 Aug '06

18 Aug '06

I have a user specified in my users file like this: isdn Auth-Type = System Service-Type = Framed, Framed-Protocol = MPP, Framed-Routing = None, Ascend-Maximum-Time = 18000, Ascend-Idle-Limit = 900, Ascend-Assign-IP-Pool = 0, Ascend-Maximum-Channels = 2, Fall-Through = "1" Then at the bottom of the file I have: DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP, Ascend-Maximum-Time = 18000, Idle-Timeout = 900 When I authenticate as this user, I see: Thu Aug 17 13:18:26 2006 : Debug: users: Matched isdn at 21 Thu Aug 17 13:18:26 2006 : Debug: users: Matched DEFAULT at 133 Thu Aug 17 13:18:26 2006 : Debug: users: Matched DEFAULT at 135 Thu Aug 17 13:18:26 2006 : Debug: users: Matched DEFAULT at 140 Thu Aug 17 13:18:26 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall[authorize]: module "files" returns ok for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall: group authorize returns ok for request 5 Thu Aug 17 13:18:26 2006 : Debug: rad_check_password: Found Auth-Type System Thu Aug 17 13:18:26 2006 : Debug: auth: type "System" Thu Aug 17 13:18:26 2006 : Debug: Processing the authenticate section of radiusd.conf Thu Aug 17 13:18:26 2006 : Debug: modcall: entering group authenticate for request 5 Thu Aug 17 13:18:26 2006 : Debug: modsingle[authenticate]: calling unix (rlm_unix) for request 5 Thu Aug 17 13:18:26 2006 : Debug: HASH: user isdn found in hashtable bucket 59493 Thu Aug 17 13:18:26 2006 : Debug: modsingle[authenticate]: returned from unix (rlm_unix) for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall[authenticate]: module "unix" returns ok for request 5 Thu Aug 17 13:18:26 2006 : Debug: modcall: group authenticate returns ok for request 5 Thu Aug 17 13:18:26 2006 : Auth: Login OK: [isdn/8293] (from client 192.168.0.3 port 1060 cli 6143677963) Sending Access-Accept of id 2 to 192.168.0.3:7010 Service-Type = Framed-User Framed-Routing = None Ascend-Maximum-Time = 18000 Ascend-Idle-Limit = 900 Ascend-Assign-IP-Pool = 0 Ascend-Maximum-Channels = 2 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Idle-Timeout = 900 Can anyone tell me why the radius server is ignoring the isdn entry in the users file and instead returning the DEFAULT entry? Thanks, Andrew

3 5

no debugging output after reread of configs in 1.1.2
by Norbert Wegener 18 Aug '06

18 Aug '06

I am using freeradius 1.1.2. Having it run with radiusd -AX shows the expected output. A kill -1 `pidof radiusd` lets it reread its configuration ... proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 here the kill: read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms and that's it. Authentication still works, but no debugging output is displayed. Norbert Wegener

2 1

OR-type authentication
by Héctor Alberto Ortiz Barrón 18 Aug '06

18 Aug '06

My radiusd.conf file ... modules { mschap certificate_userpass { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } mschap winlogon { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{winlogon:NT-Domain} --username=%{winlogon:User-Name} --challenge=%{winlogon:Challenge:-00} --nt-response=%{winlogon:NT-Response:-00}" } $INCLUDE ${confdir}/eap.conf $INCLUDE ${confdir}/sql.conf ... instantiate { exec certificate_userpass winlogon } ... authorize { redundant { sql winlogon certificate_userpass } eap } ... authenticate { Auth-Type MS-CHAP { redundant { certificate_userpass winlogon } } eap } ... Using this configuration, I am able to connect to the network using a certificate on the client computer or providing a user name and password which are checked against the mysql database, but I can't authenticate against the AD. If I comment out the part regarding sql from the authorize section and do like this in the authenticate section (inverse order): authenticate { Auth-Type MS-CHAP { redundant { winlogon certificate } } eap } I can now authenticate against the AD and using certificates, but not using the database. Question: What changes do I require in order to be able to grant access taking into account the three methods? Thanks for your assistance Cheers Héctor

2 1

No memory
by Hasan Ovuc 18 Aug '06

18 Aug '06

Dear Members, I am trying to use freeradius-snapshot-20060817 unixODBC-2.2.11 ODBC-12_5 Radiusd successfully started, after first sql query it dies with no memory error. ///////////////////////////////////////////////////////// Waking up in 5 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 radius_xlat: 'A02165384149' rlm_sql (sql): sql_set_user escaped user --> 'A02165384149' rlm_sql (sql): Reserving sql socket id: 6 radius_xlat: 'EXEC ra_authentication_check 'A02165384149', '1'' query: EXEC ra_authentication_check 'A02165384149', '1' rlm_sql (sql): User found in radcheck table radius_xlat: 'EXEC ra_authentication_reply 'A02165384149', '1', ''' query: EXEC ra_authentication_reply 'A02165384149', '1', '' no memory ///////////////////////////////////////////////////////////// Freeradius-1.1.2 is working in the same machine. It dies with giving same error when it is overloaded. OS = 2.6.17-1.2174_FC5 smp #1 Memory = 1 GB CPU= 2XIntel(R) Xeon(TM) CPU 3.06GHz Vmstat and top results when problem occurs, root@Lara03:/home/hasano/3/freeradius-snapshot-20060817/src/main# vmstat 1 procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------ r b swpd free buff cache si so bi bo in cs us sy id wa st 0 0 0 640452 712 315188 0 0 4 6 69 32 1 0 99 0 0 0 0 0 640452 712 315188 0 0 0 0 259 34 0 0 100 0 0 0 0 0 640452 712 315188 0 0 0 8 259 29 0 0 100 0 0 0 0 0 640452 712 315188 0 0 0 0 263 46 0 0 100 0 0 root@Lara03:/home/hasano/3/freeradius-snapshot-20060817/src/main# top top - 14:29:29 up 4:32, 7 users, load average: 0.00, 0.00, 0.00 Tasks: 80 total, 1 running, 79 sleeping, 0 stopped, 0 zombie Cpu0 : 0.0% us, 0.0% sy, 0.0% ni, 100.0% id, 0.0% wa, 0.0% hi, 0.0% si, 0.0% st Cpu1 : 0.0% us, 0.0% sy, 0.0% ni, 100.0% id, 0.0% wa, 0.0% hi, 0.0% si, 0.0% st Cpu2 : 0.0% us, 0.0% sy, 0.0% ni, 100.0% id, 0.0% wa, 0.0% hi, 0.0% si, 0.0% st Cpu3 : 0.0% us, 0.2% sy, 0.0% ni, 99.8% id, 0.0% wa, 0.0% hi, 0.0% si, 0.0% st Mem: 1034832k total, 394408k used, 640424k free, 712k buffers Swap: 4192956k total, 0k used, 4192956k free, 315188k cached PID PPID TIME+ %CPU %MEM PR NI S VIRT SWAP RES UID COMMAND 31422 31359 0:00.03 0 0.1 16 0 R 2084 1204 880 0 top 31359 8523 0:00.10 0 0.1 15 0 S 4580 3060 1520 0 bash 31194 1 0:01.88 0 1.2 15 0 S 83008 68m 12m 501 radiusd Can you help me ? Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

2 1

How to send radius packet to two separated Radius server?
by biuro＠globeinphotos.com 18 Aug '06

18 Aug '06

Hi, I have special requirements that I do not know how to implement in Freeradius. We have two radius servers one is connected to Postgress and should handle all kind of radius packet and second connected to MySQL and should handle only accounting request. This configuration can look bizarre but 'accouning server' insert/delete/modify many rows in database and we had to use MySQL to avoid Postgress vacuum problem (our system is VoIP real time system and we cannot wait to make vacuum on production database). My question is it possible to somehow duplicate packet and send it to two separated Freeradius (I've found that in GNU radius probably can be achieved by Forward module)? I cannot use radius proxy because it can only split packet between several server but does not send the same message to different host. Can you have any proposition how to solve it? Michal Szymanski http://blog.szymanskich.net

1 0

How to configure the Radius in SSH (22)
by raviprakash sunkara 18 Aug '06

18 Aug '06

Hi Users, I Want to create the radius (AAA) for remote accessing By using the putty in "SSH" Can anyone Give the clues to me on That........................ or any url or documentation .................. plz for me in English....... ...... -- Thanks and Regards with cheers Sunkara Ravi Prakash (LAMP programming) Hyperion Technology Kondapur, Hi-tech city, Hyderabad. www.hyperion-tech.com +91-9985077535

1 0

Query to know radius disconnect request and Ack is supported in freeradius
by Shankar Ganesh C 18 Aug '06

18 Aug '06

Hi All, Could some body help me to know whether Radius disconnect and Ack messages are supported in free radius as defined in RFC 2822 ? The message ID are diconnet 40 adn Ack 41. Thanks and regards Shankar ganesh

2 2