- Freeradius-Users - lists.freeradius.org

Solaris 8 Make Problems
by Nicholas Thompson 07 Nov '05

07 Nov '05

I am new to freeradius. I have a Solaris 8 machine with OpenSSL version 0.9.8 and MySQL version 5.0.15 (max). Configure completes without any problems however make fails. I have read many suggestions on the list, and tries all of them. Such as setting the LD_LIBRARY_PATH, I even tried to configure and make with just static libraries. Could there be a problem with freeradius and MySQL5? Here is a copy of the make output errors: make[10]: Entering directory `/export/home/nicholas/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -c sql_mysql.c -o sql_mysql.o gcc: language arch=v8 not recognized gcc: sql_mysql.c: linker input file unused because linking not done /export/home/nicholas/freeradius-1.0.5/libtool --mode=link ld -module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 sql_mysql.o -o rlm_sql_mysql.a (cd . && ln -s sql_mysql.lo sql_mysql.o) ln: cannot create sql_mysql.o: File exists make[10]: *** [rlm_sql_mysql.a] Error 2 --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

2 2

SV: Re: Freeradius stops authenticating
by Svein Hansen 07 Nov '05

07 Nov '05

I recompiled freeradius with the patch, but the problem didn't go away.. I have 2 new outputs from valgrind and a stacktrace from gbd, but I don't want to send attachments to the list. Here's some lines from the output's.. Run 1: Valgrind # valgrind --tool=memcheck --verbose --log-file=/root/val071105 radiusd -yf --- ==32260== Thread 8: ==32260== Invalid write of size 4 ==32260== at 0x7D64E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==32260== by 0xFC53: modcall (modcall.c:219) ==32260== by 0xFEE0: modcall (modcall.c:252) ==32260== Address 0x1BB57078 is 0 bytes inside a block of size 352 free'd ==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==32260== by 0x1BB78C12: ??? (rlm_passwd.c:545) ==32260== ==32260== Thread 8: ==32260== Invalid free() / delete / delete[] ==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==32260== by 0xFC53: modcall (modcall.c:219) ==32260== Address 0x1BB57078 is 0 bytes inside a block of size 352 free'd ==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==32260== by 0x1BB78C12: ??? (rlm_passwd.c:545) Run 2: Valgrind # valgrind --tool=memcheck --verbose --log-file=/root/val071105 radiusd -yf ----- ==9390== Thread 8: ==9390== Invalid write of size 4 ==9390== at 0x7D64E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==9390== by 0xFC53: modcall (modcall.c:219) ==9390== by 0xFEE0: modcall (modcall.c:252) ==9390== Address 0x1BB371C8 is 0 bytes inside a block of size 352 free'd ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==9390== by 0x1BB78CA3: ??? (rlm_passwd.c:309) ==9390== ==9390== Thread 8: ==9390== Invalid free() / delete / delete[] ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==9390== by 0xFC53: modcall (modcall.c:219) ==9390== Address 0x1BB371C8 is 0 bytes inside a block of size 352 free'd ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==9390== by 0x1BB78CA3: ??? (rlm_passwd.c:309) ==9390== ==9390== Thread 9: ==9390== Invalid read of size 1 ==9390== at 0x7D6BFA: _IO_fgets (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB77DA0: ??? (rlm_passwd.c:275) ==9390== by 0x1BB78C12: ??? (rlm_passwd.c:545) ==9390== by 0xFC53: modcall (modcall.c:219) ==9390== Address 0x1BB68F31 is 1 bytes inside a block of size 352 free'd ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==9390== by 0xFC53: modcall (modcall.c:219) Run 3: gdb # radiusd -yf Mon Nov 7 13:02:31 2005 : Info: Starting - reading configuration files ... *** glibc detected *** malloc(): memory corruption: 0xae8012dd *** Aborted (core dumped) # date man nov 7 14:19:20 CET 2005 # gdb radiusd core.19991 (gdb) bt #0 0x00bbb7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x003127d5 in raise () from /lib/tls/libc.so.6 #2 0x00314149 in abort () from /lib/tls/libc.so.6 #3 0x0034640a in __libc_message () from /lib/tls/libc.so.6 #4 0x0034d51c in _int_malloc () from /lib/tls/libc.so.6 #5 0x0034ef81 in malloc () from /lib/tls/libc.so.6 #6 0x0011915b in pairmake (attribute=0x947af33 "LM-Password", value=0x947ab03 "", operator=11) at valuepair.c:1041 #7 0x00e09981 in addresult (inst=0x947a9e8, vp=0x947d954, pw=0x947aac8, when=0 '\0', listname=0xe09e76 "config_items") at rlm_passwd.c:504 #8 0x00e09bbc in passwd_authorize (instance=0x947a9e8, request=0x947d940) at rlm_passwd.c:542 #9 0x001f2c54 in modcall (component=1, c=0x9479b18, request=0x947d940) at modcall.c:219 #10 0x001f2ee1 in modcall (component=1, c=0x93fb260, request=0x947d940) at modcall.c:252 #11 0x001f2126 in indexed_modcall (comp=1, idx=6, request=0x0) at modules.c:473 #12 0x001eeef3 in rad_authenticate (request=0x947d940) at auth.c:592 #13 0x001e804c in rad_respond (request=0x947d940, fun=0x1eee57 <rad_authenticate>) at radiusd.c:1642 #14 0x001f5481 in request_handler_thread (arg=0x947d378) at threads.c:517 #15 0x006c5341 in start_thread () from /lib/tls/libpthread.so.0 #16 0x003b26fe in clone () from /lib/tls/libc.so.6 (gdb) My rlm_passwd.c (after applying patch): Line: 279 - 289 if(!strcmp(list, name)) return passwd; } } } } fclose(ht->fp); ht->fp = NULL; return NULL; #undef passwd } Line:301 - 311 if (!strcmp(hashentry->field[ht->keyfield], name)){ /* save address of next item to check into buffer */ ht->last_found=hashentry->next; return hashentry; } return NULL; } if (ht->fp) fclose(ht->fp); if (!(ht->fp=fopen(ht->filename, "r"))) return NULL; return get_next(name, ht); } Line: 540 - 550 } do { addresult(inst, &request->config_items, pw, 0, "config_items"); addresult(inst, &request->reply->vps, pw, 1, "reply_items"); addresult(inst, &request->packet->vps, pw, 2, "request_items"); } while ( (pw = get_next(name, inst->ht)) ); found++; if (!inst->allowmultiple) break; } if(!found) { return RLM_MODULE_NOTFOUND; Please send me an email if you can help me, and I will send the complete outputs. Svein Hansen >>> nbk(a)sitadelle.com 27.10.2005 12:34:41 >>> Svein Hansen wrote: > I suspected that there had to be a module in freeradius that makes > glibc fault, so I tried to run freeradius in Valgrind: Thanks, the output of Valgrind is very useful. > I'm not a programmer, but can it be that radius tries a double-close > or a double-free? Indeed, it looks like a file stream is closed more than once. Please try to apply these changes to src/modules/rlm_passwd/rlm_passwd.c then recompile FreeRADIUS and test again. Index: src/modules/rlm_passwd/rlm_passwd.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_passwd/rlm_passwd.c,v retrieving revision 1.13.2.3 diff -u -r1.13.2.3 rlm_passwd.c --- src/modules/rlm_passwd/rlm_passwd.c 19 Dec 2004 20:06:30 -0000 1.13.2.3 +++ src/modules/rlm_passwd/rlm_passwd.c 27 Oct 2005 10:23:00 -0000 @@ -136,8 +136,15 @@ for (i=0; i<ht->tablesize; i++) if (ht->table[i]) destroy_password(ht->table[i]); - if (ht->table) free(ht->table); - if (ht->fp) fclose(ht->fp); + if (ht->table) { + free(ht->table); + ht->table = NULL: + } + if (ht->fp) { + fclose(ht->fp); + ht->fp = NULL; + } + ht->tablesize = 0; } static void release_ht(struct hashtable * ht){ @@ -194,7 +201,6 @@ if(*buffer && *buffer!='\n' && (!ignorenis || (*buffer != '+' && *buffer != '-')) ){ if(!(hashentry = mypasswd_malloc(buffer, nfields, &len))){ release_hash_table(ht); - ht->tablesize = 0; return ht; } len = string_to_entry(buffer, nfields, *ht->delimiter, hashentry, len); @@ -219,7 +225,6 @@ else nextlist = 0; if(!(hashentry1 = mypasswd_malloc("", nfields, &len))){ release_hash_table(ht); - ht->tablesize = 0; return ht; } for (i=0; i<nfields; i++) hashentry1->field[i] = hashentry->field[i]; -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: freeradius and machine account authentication
by Norbert Wegener 06 Nov '05

06 Nov '05

>>Norbert Wegener <nw at sbs.de <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >>/ FreeRADIUS at this time cannot perform machine account authentications, />>/ but it supports proxying them off to another RADIUS server (for example, />>/ IAS, or FUNK) /> > After recent changes to both FreeRADIUS and Samba, this is now > supported. See the list archives for details. > > Alan DeKok. I searched the archives and found this or that discussion about that topic in general. Nevertheless I did not find any hint on how to configure freeradius to perform machine account authentication. Maybe someone has a pointer for me, as even in freeradius-snapshot-20051104 a grep for machine account was not successfull. Another question comes up in that context: What job has samba to solve here? Must the server, that runs freeradius, be member of the active diretory domain and samba is used for this? Which version of samba must at least be used? Thanks Norbert Wegener

2 1

FW: Attribute Value length using SQL
by Gunther 06 Nov '05

06 Nov '05

Alan DeKok wrote: >"Gunther" <freeradius(a)caribsms.com> wrote: >> Thanks! Yes, I see it in rfc2138 (0-253 octets) ... But isn't the >> feature I am talking about more part of the expression module and >> enhanced functionality of FreeRadius? > > Yes, but the data structures used by the code are still based on > RADIUS ones. > > If you want to use longer strings, rlm_policy in the CVS snapshot may help. > > Alan DeKok. Will try that one! I was actually successful with changing MAX_STRING_LEN and changing one fixed [256] value in main/xlat.c (char attrname[256];). The long SQL strings were recognised and functioning. My remaining trouble was the conditional expression %{expr: SQL1}:-%{expr:SQL2}. Whenever SQL1 does not return anything, SQL2 will not be executed ... I guess I am not using the right syntax or I am running into a limit ... I presume that I have to use a complete CVS snapshot in order to use rlm_policy? Thanks, Gunther

2 2

assert request_list:1524 after running for some hours
by Joe Maimon 06 Nov '05

06 Nov '05

cvs 10/29 rad_assert(request->proxy->dst_ipaddr.af == AF_INET) Haven't done much troubleshooting on this one yet. (still getting assert in util.c:189 on sever shutdown)

2 1

Adding Attributes to a post proxy request
by Holger Steppke 06 Nov '05

06 Nov '05

Hi, i have read a couple of msg on this list about the same problem i actualy have but could not really find a nice solution for it. I have a case where I use Freeradius for proxy auth/acct to home servers. Lets assume I will be more then 20-40 different realms. Before the answer goes back to the Nas I need to add some attributes and now looking for the best way of doing this. In the past with Cistron or today with the switch in proxy.conf it is easy. I think this is maybe not the right way of doing it parsing the users files and everything else in authentication section twice. My Setup NAS ----- 1 -------> PROXY ------ 2 ---------> Home Radius <---- 4 -------- <----- 3 --------- So in 4 there should be e.g. different DNS servers for each realm. What is your view on this ? What's the best way doing this. Don't know if there is a way to add those Attributes to the Request Reply) attributes so that there still there when the Home Radius sends an answer ? Of course in a scalable way 20-40 realms. I´am already that far that I thought I need to patch the files module to have function for post-proxy which then I could use to parse another users file adding those Attributes Because that was easy Just defaults for each Realm and then adding them. BTW I found some parameter in the modules which do read the realm/proxy stuff which seams to be not used somewhere. It is trusted and hints. Or do you just allow them to be compatible with Cistron. ?? Bye Holger

3 2

Proxying based on AVPair (multiple SSIDs)
by Jason Carr 05 Nov '05

05 Nov '05

I'm running multiple access points with multiple SSIDs on each access point. We have some groups that want to run their own RADIUS authentication, and we need to proxy their requests. Cisco access points have radius servers configured only by device not by SSID, so I need another way to figure out which SSID the client connected with. Our certificates don't include an @ sign in the username, nor do I know what authentication method the other groups will use. The only other method I can think of to proxy off of other than realms would be a Cisco AVPair, which is already being sent to the radius server. There is one called SSID, which contains exactly the information I'd like the proxy to forward based on. Anybody know if this is possible with freeradius or another software? If so, any configuration file contents I would need to set this up. Thanks, Jason

3 4

Attribute Value length using SQL
by Gunther 05 Nov '05

05 Nov '05

I am running FR 1.0.5 with MySQL 4.1.12. All data is stored in MySQL. My radgroupreply attribute values are SQL statements. It works very well. But it seems I have reached the limit for the Value column. My SQL output is setting the Session-Timeout. The length of Attribute Value can be found in the src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql CREATE TABLE radgroupreply ( id int(11) unsigned NOT NULL auto_increment, GroupName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '=', Value varchar(253) NOT NULL default '', <== prio int unsigned NOT NULL default '0', PRIMARY KEY (id), KEY GroupName (GroupName(32)) ) ; I am trying to use a combination of the conditional syntax (e.g. %{Foo:-%{Bar}}) in connection with SQL statements. One sql statement is doing that and if false another sql statement is doing something else. e.g `%{expr: %{sql:SELECT IF(NOW() > user_starttime, IF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE) > NOW(), ... and so on I was trying to change the AV lenght from 253 to 1024, but radius is simply cutting off after the limit, resulting in an error in the log file (MYSQL check_error: 1054). Log: radius_xlat: Running registered xlat function of module expr for string '%{sql:SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='%{User-Name}' AND radac' radius_xlat: Running registered xlat function of module sql for string 'SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='%{User-Name}' AND radac' rlm_sql (sql): - sql_xlat radius_xlat: 'gunther@demo' rlm_sql (sql): sql_set_user escaped user --> 'gunther@demo' radius_xlat: 'SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='gunther@demo' AND radac' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT IF(NOW()>user_starttime,IF(DATE_ADD(radacct_starttime,INTERVAL 30 MINUTE)>NOW(),TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE),NOW())),1),1) FROM phs_user,phs_radacct WHERE user_username='gunther@demo' AND radac rlm_sql_mysql: MYSQL check_error: 1054 received I then tried to shorten tablenames etc., but even with that I still have about 500+ bytes left. Is there any reason the limit must be at 253? Can the limit be changed ... in an easy way? My complete Sessiont-Timeout Value: `%{expr: %{sql:SELECT IF(NOW() > user_starttime, IF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE) > NOW(), TIME_TO_SEC(TIMEDIFF(DATE_ADD(radacct_starttime, INTERVAL 30 MINUTE), NOW())), 1), 1) FROM phs_user, phs_radacct WHERE user_username='%{User-Name}' AND radacct_username=user_username AND radacct_starttime >= user_starttime} :-%{expr: %{sql:SELECT IF(NOW() > user_starttime, IF(DATE_ADD(user_starttime, INTERVAL 24 HOUR) > NOW(), TIME_TO_SEC(TIMEDIFF(DATE_ADD(NOW(), INTERVAL 30 MINUTE), NOW())), 1), 1) FROM phs_user WHERE user_username='%{User-Name}'}}` Thanks! Gunther

2 3

RE: Attribute Value length using SQL
by Gunther 05 Nov '05

05 Nov '05

>I actually changed the MAX_STRING_LEN size from 254 to 762 in include/libradius.h and it seems to work. No, it doesn't work ...

1 0

RE: Newbie question re. dictionary files.
by Bohannan, Chad W 05 Nov '05

05 Nov '05

>I'm using FreeRADIUS 1.0.5. to authenticate admin logins to a >NetScreen5. I'm able to authenticate accounts just fine. Now I'd >like to begin pulling administrative privileges from the Radius >server, but I haven't figured out how to do that. I've referenced the >dictionary.netscreen file in my clients.conf file, nastype = >netscreen, but I'm embarrassed to say I can't figure out the format >for including the dictionary attributes for a user in my users file. > >I've tried various permutations like: > >markt Auth-Type := Local, User=Password == "testing" > NS-Admin-Privilege = "Read-Only-Admin" > >and: > >markt Auth-Type := Local, User=Password == "testing" > Netscreen-NS-Admin-Privilege = "Read-Only-Admin" > >Nothing's working. Can some one show me the correct syntax? > >Thank you, > >Mark >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html Mark, I am having the same problems. I can authenticate fine, however, when I try and authorize via radius all logins fail (although RADIUS shows them to succeed. If I find the solution I will forward it along. Cheers, Chad

4 3