- Freeradius-Users - lists.freeradius.org

Segmentation Fault
by Joel Lindsay 11 Jun '06

11 Jun '06

Hi, I have been using free radius for months for testing. Today, if just started giving me segmentation faults. Nothing has changed on the NAS or in the configs for freeradius so I have no idea why it suddenly is crashing. Is there some way to track down whats causing the segmentation fault? My log follows: or at least part of it [root@localhost raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "testing123" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. users: Matched joel at 100 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 12 to 192.168.1.20:1026 EAP-Message = 0x0105003119001403010001011603010020e6000004531e574308c8d1 62bbdb2e2d17873d1dd2f4c7f2db72ba16e98ab3a1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe44feceeea4d009ddd562d92d30ef3da Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.20:1026, id=13, length=291 Attr-1 = 0x6a6f656c NAS-Identifier = "00-0b-6b-35-b4-4d:2_slimtest" NAS-IP-Address = 192.168.10.1 NAS-Port = 10 NAS-Port-Id = "ath0" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Framed-MTU = 1400 Called-Station-Id = "00-0B-6B-35-B4-4D:2_slimtest" Calling-Station-Id = "00-C0-49-DD-38-5E" Event-Timestamp = "Dec 31 1969 16:03:20 PST" WISPr-Location-ID = "isocc=(null),cc=(null),ac=(null),network=(null)" WISPr-Location-Name = "(null),(null)" Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500061900 State = 0xe44feceeea4d009ddd562d92d30ef3da Message-Authenticator = 0xd60a5eb6fefb934983df741cbc97f918 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "joel", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched joel at 100 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 13 to 192.168.1.20:1026 EAP-Message = 0x0106002019001703010015286774bcd384202cb08795f318c1a8d09f 9bbc5630 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe7ad12776ec2df387a2d37ff50563861 Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 8 with timestamp 44871f25 Cleaning up request 1 ID 9 with timestamp 44871f25 Cleaning up request 2 ID 10 with timestamp 44871f25 Cleaning up request 3 ID 11 with timestamp 44871f25 Cleaning up request 4 ID 12 with timestamp 44871f25 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 13 with timestamp 44871f26 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.1.20:1026, id=14, length=317 Attr-1 = 0x6a6f656c NAS-Identifier = "00-0b-6b-35-b4-4d:2_slimtest" NAS-IP-Address = 192.168.10.1 NAS-Port = 10 NAS-Port-Id = "ath0" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Framed-MTU = 1400 Called-Station-Id = "00-0B-6B-35-B4-4D:2_slimtest" Calling-Station-Id = "00-C0-49-DD-38-5E" Event-Timestamp = "Dec 31 1969 16:03:50 PST" WISPr-Location-ID = "isocc=(null),cc=(null),ac=(null),network=(null)" WISPr-Location-Name = "(null),(null)" Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02060020190017030100154f081afb2009c468364080c391ce67884e 8ba24f5d State = 0xe7ad12776ec2df387a2d37ff50563861 Message-Authenticator = 0xf7b1be3d97c3f0d9d0f3bc42636be68b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "joel", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 32 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched joel at 100 modcall[authorize]: module "files" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - joel rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x02060009016a6f656c PEAP: Got tunneled identity of joel PEAP: Setting default EAP type for tunneled EAP session. Segmentation fault

5 5

RE: freeradius + edirectory + special caracters
by David 11 Jun '06

11 Jun '06

Hello, We are trying to use freeradius 1.1.2 to authentication our users on our wired network (802.1X). Our architecture is the following: Client switch Windows Xp -----> Enterasys -----> freeradius 1.1.2 -----> edirectory Aegis ldaps LUM Once the user gets the authorisation access, it gets its vlan too and begins the system logon to the NT server account and to the novell edirectory account (fire sharing) The users connect through Aegis client on XP SP2 operating system. The NAS are ours switches (Enterasys V2 and C2) The authentication schema is PEAP MSCHAPV2 The users base is edirectory which is accessed by freradius thanks to ldaps. We have configured edirectoty with Universal password and extend its schema in order to add radius attributes. (as indicate in documentation given by novell) Its works except when the users password contains special characters. By example, If the user password is ale00000 the log is: rlm_ldap: bind as uid=david ,ou=XXX,dc= XXX/ale00000. The authentication works. If the user password is alé00000 the log is: rlm_ldap: bind as uid=david ,ou=XXX,dc= XXX/blé00000. The authentication fails. I have tried with others passwords and it gives alé00000 --> blé00000 blé00000 --> alé00000 clé00000 --> alé00000 dlé00000 --> alé00000 rlé00000 --> alé00000 d&é »(-è --> a&é »(-è any help will be welcome for any clue to solve this problem; (witch is a real problem because a lot of our users come to see us when they change theirs passwords) By the way, excuse me for my approximate english.

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 48
by Gilbert Lo 11 Jun '06

11 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 47
by Gilbert Lo 11 Jun '06

11 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Regarding VLAN attributes
by radhika putty 10 Jun '06

10 Jun '06

Hi.. When we use VLAN tunneled attributes how do we send the VLAN id value. For ex if i give a vlan group 10 when configuring the switch how do i pass that attribute in my program.In the value field I need to set it as 10 or VLAN10 --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.

2 1

multiple Autz-Type
by wekz 10 Jun '06

10 Jun '06

Hello everybody. I'll tell you what i wanna do and the problem i get so you could either fix my configuration or give me some new ideas. First, I´m using freeradius 1.1.1 + ldap. What I have is this: I have three radius working in different placement of one organization, these radius authorize against three subtrees of the ldap. When a user is not found they do proxy to another radius. This work quite well. What I want: I want to have another radius ( only one ) to acct as a backup of these servers ( for configuring my ciscos with two servers ). This radius has the complete tree but it must look in each subtree depending on the NAS-IP, not in the whole ldap. If the user is not found in the corresponding subtree it must do proxy to the central radius. I don't know if I have explain it correctly, if I haven't just tell me ( I'm not an english speaker ) For this configuration I've defined three ldaps in radiusd.conf: module{ ldap ldap1{ } ldap ldap2{ } ldap ldap3{ } } ... authorize{ ... autztype customer1{ redundant { group { ldap1 { notfound = return fail = return } files mschap eap notfound = 1 fail = 1 } files } } Autz-Type customer2{ [ similar configuration as above ] } Autz-Type customer3{ [ similar configuration as above ] } } My hints file: DEFAULT NAS-IP-Address == "192.168.51.220" Autz-Type := customer1 DEFAULT NAS-IP-Address == "192.168.51.221" Autz-Type := customer2 DEFAULT NAS-IP-Address == "192.168.51.222" Autz-Type := customer3 Users: DEFAULT Proxy-to-realm := wickwar_central The problem is that it doesn't execute any of Autz-Type sections. The logs: rad_recv: Access-Request packet from host 192.168.51.221:1645, id=200, length=160 User-Name = "cadiz" Framed-MTU = 1400 Called-Station-Id = "0011.9215.c490" Calling-Station-Id = "0004.238d.4b0e" Cisco-AVPair = "ssid=perfil_tipo_a" Service-Type = Login-User Message-Authenticator = 0x27c966f01f1de90c836066e2a019c553 EAP-Message = 0x0202000a01636164697a NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "395" NAS-Port = 395 NAS-IP-Address = 192.168.51.221 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 hints: Matched DEFAULT at 59 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '/' in User-Name = "cadiz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 1 radius_xlat: '/opt/radius_LOCAL/var/log/radius/radacct/192.168.51.221/auth-detail-20060605' rlm_detail: /opt/radius_LOCAL/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/radius_LOCAL/var/log/radius/radacct/192.168.51.221/auth-detail-20060605 modcall[authorize]: module "auth_log" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [cadiz/<no User-Password attribute>] (from client ap port 395 cli 0004.238d.4b0e) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 200 to 192.168.51.221 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 200 with timestamp 44840b82 Nothing to do. Sleeping until we see a request. If anyone could give my a hand. I would be grateful. Thanks.

2 4

Re: Freeradius-Users Digest, Vol 14, Issue 45
by Gilbert Lo 10 Jun '06

10 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 44
by Gilbert Lo 10 Jun '06

10 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Multiple attributes for single user in radreply and mysql
by Majid El-Hoss 09 Jun '06

09 Jun '06

Hi, I am using freeradius behind a provisioning platform which inserts the users into a mysql database from which the radius server reads the info. I am assigning static (actual IP) and dynamic ip (255.255.255.254) addresses to the end-users by using the Framed-IP attribute in the radreply table. I also suspend/unsuspend users by using an "Auth-Type := Reject" entry, or by deleting it in an automated fashion and depending on whether the customer has paid or not his invoices. The problem that I am facing is that freeradius is not recognizing the Auth-Type entry in radreply in the presence of other attributes. Therefore, even if Auth-Type := Reject is in the radreply table, the system does not send back an Access-Reject packet, but rather an Access-Accept packet with the corresponding IP address. How can I address this so that when an Auth-Type := Reject parameter is in the database, it is automatically recognised and the user account is suspended? Thanks for your help Majid El-Hoss CONFIDENTIALITY NOTICE: This e-mail message including attachments, if any,is (are) for the intended recipient only (person or entity)and may contain confidential or proprietary information some or all of which may be legally privileged. Any unauthorised review, use, copy, print, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message and do not in any way rely on this e-mail. If you are the intended recipient but do not wish to receive communications through this medium, please so advise the sender immediately. -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.8.3/359 - Release Date: 6/8/2006

2 1

Re: Freeradius-Users Digest, Vol 14, Issue 43
by Gilbert Lo 09 Jun '06

09 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0