- Freeradius-Users - lists.freeradius.org

Freeradius the right tool as Windows Authentication Proxy?
by Thomas Stieglitz 08 Nov '05

08 Nov '05

Hello all, I'm new on this list - and a little bit with the subject "free radius" and radius technology, too. So sry in advance, if I'm off topic ;-) or if the question was already asked, I didn't find it within the mailing list's archive. I've got a conceptional problem, and I'm woundering whether freeradius might be the aporopiate tool to solve it. We're running an apache 1.X webserver, which is located at an external provider. My problem is, that we need to authenticate webusers against our Windows 2000 Active Directory, which is located in our companies' local network. My idea is, to locate an Freeradius Server in the DMZ. This server would have the job, to accept calls from the webserver (over an IP-Tunnel), ask the AD whether username and password are o.k. and return this information to the webserver. Here are my questions in particular: 1) Is this idea a possible solution ... the right use of an radius-server? And, if yes: is freeradius the right tool for it? 2) If yes: Is it also possible, to gain group information about a user. (i. e. Is Fred Member of Group Foo? Which groups is Fred member of?) 3) if yes: how do I find an entry point for further information about this special subject? 4) Is someone out there running an simular configuration and give me an hand, hints, show me quirks etc.? I'm happy for any advice, thanks in advance for it! Tom ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

3 2

[OTAnn] Feedback
by shenanigans 07 Nov '05

07 Nov '05

I was interested in getting feedback from current mail group users. We have mirrored your mail list in a new application that provides a more aggregated and safe environment which utilizes the power of broadband. Roomity.com v 1.5 is a web 2.01 community webapp. Our newest version adds broadcast video and social networking such as favorite authors and an html editor. It?s free to join and any feedback would be appreciated. S. ---------------------------------------------------------------------------------------------------------------------------------------- Broadband interface (RIA) + mail box saftey = <a href="http://Free_Radius_Users_List.roomity.com">Free_Radius_Users_List.roomity.com</a> *Your* clubs, no sign up to read, ad supported; try broadband internet. ~~1131401587246~~ ----------------------------------------------------------------------------------------------------------------------------------------

1 0

perl and additional response attributes
by Emil Wilmanski 07 Nov '05

07 Nov '05

Hi, I'm testing freeradius 1.0.5. I want to add some additional attributes to Access-Accept response using rlm_perl module but when I put perl into "post-auth" block, when I start server it says: radiusd.conf: "perl" modules aren't allowed in 'post-auth' sections -- they have no such method. In freeradius 1.0.2 it is working... How to add additional parameters using some code? (without "radreply") -- Emilus.

2 2

Solaris 8 Make Problems
by Nicholas Thompson 07 Nov '05

07 Nov '05

>-xarch=v8 sounds like a Sun cc option. It's a good idea to work just with >one compiler, sun or gnu. Adjust the PATH that ./configure and make just >see on compiler. I dont have the sun compiler. I am using GCC version 3.3.2 and the gnu linker version 2.14 both of these are located in /usr/local/bin and that is the first directory in my path. > I am new to freeradius. I have a Solaris 8 machine with OpenSSL > version 0.9.8 and MySQL version 5.0.15 (max). Configure completes > without any problems however make fails. I have read many > suggestions on the list, and tries all of them. Such as setting the > LD_LIBRARY_PATH, I even tried to configure and make with just static > libraries. Could there be a problem with freeradius and MySQL5? > Here is a copy of the make output errors: > make[10]: Entering directory `/export/home/nicholas/freeradius-1.0. > 5/src/modules/rlm_sql/drivers/rlm_sql_mysql' > gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -c > sql_mysql.c -o sql_mysql.o > gcc: language arch=v8 not recognized > gcc: sql_mysql.c: linker input file unused because linking not done -xarch=v8 sounds like a Sun cc option. It's a good idea to work just with one compiler, sun or gnu. Adjust the PATH that ./configure and make just see on compiler. > /export/home/nicholas/freeradius-1.0.5/libtool --mode=link ld - > module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 sql_mysql.o > -o rlm_sql_mysql.a > (cd . && ln -s sql_mysql.lo sql_mysql.o) > ln: cannot create sql_mysql.o: File exists > make[10]: *** [rlm_sql_mysql.a] Error 2 --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 0

Solaris 8 Make Problems
by Nicholas Thompson 07 Nov '05

07 Nov '05

I am new to freeradius. I have a Solaris 8 machine with OpenSSL version 0.9.8 and MySQL version 5.0.15 (max). Configure completes without any problems however make fails. I have read many suggestions on the list, and tries all of them. Such as setting the LD_LIBRARY_PATH, I even tried to configure and make with just static libraries. Could there be a problem with freeradius and MySQL5? Here is a copy of the make output errors: make[10]: Entering directory `/export/home/nicholas/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -c sql_mysql.c -o sql_mysql.o gcc: language arch=v8 not recognized gcc: sql_mysql.c: linker input file unused because linking not done /export/home/nicholas/freeradius-1.0.5/libtool --mode=link ld -module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 sql_mysql.o -o rlm_sql_mysql.a (cd . && ln -s sql_mysql.lo sql_mysql.o) ln: cannot create sql_mysql.o: File exists make[10]: *** [rlm_sql_mysql.a] Error 2 --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

2 2

SV: Re: Freeradius stops authenticating
by Svein Hansen 07 Nov '05

07 Nov '05

I recompiled freeradius with the patch, but the problem didn't go away.. I have 2 new outputs from valgrind and a stacktrace from gbd, but I don't want to send attachments to the list. Here's some lines from the output's.. Run 1: Valgrind # valgrind --tool=memcheck --verbose --log-file=/root/val071105 radiusd -yf --- ==32260== Thread 8: ==32260== Invalid write of size 4 ==32260== at 0x7D64E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==32260== by 0xFC53: modcall (modcall.c:219) ==32260== by 0xFEE0: modcall (modcall.c:252) ==32260== Address 0x1BB57078 is 0 bytes inside a block of size 352 free'd ==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==32260== by 0x1BB78C12: ??? (rlm_passwd.c:545) ==32260== ==32260== Thread 8: ==32260== Invalid free() / delete / delete[] ==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==32260== by 0xFC53: modcall (modcall.c:219) ==32260== Address 0x1BB57078 is 0 bytes inside a block of size 352 free'd ==32260== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==32260== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==32260== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==32260== by 0x1BB78C12: ??? (rlm_passwd.c:545) Run 2: Valgrind # valgrind --tool=memcheck --verbose --log-file=/root/val071105 radiusd -yf ----- ==9390== Thread 8: ==9390== Invalid write of size 4 ==9390== at 0x7D64E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==9390== by 0xFC53: modcall (modcall.c:219) ==9390== by 0xFEE0: modcall (modcall.c:252) ==9390== Address 0x1BB371C8 is 0 bytes inside a block of size 352 free'd ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==9390== by 0x1BB78CA3: ??? (rlm_passwd.c:309) ==9390== ==9390== Thread 8: ==9390== Invalid free() / delete / delete[] ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==9390== by 0xFC53: modcall (modcall.c:219) ==9390== Address 0x1BB371C8 is 0 bytes inside a block of size 352 free'd ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB77DFA: ??? (rlm_passwd.c:285) ==9390== by 0x1BB78CA3: ??? (rlm_passwd.c:309) ==9390== ==9390== Thread 9: ==9390== Invalid read of size 1 ==9390== at 0x7D6BFA: _IO_fgets (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB77DA0: ??? (rlm_passwd.c:275) ==9390== by 0x1BB78C12: ??? (rlm_passwd.c:545) ==9390== by 0xFC53: modcall (modcall.c:219) ==9390== Address 0x1BB68F31 is 1 bytes inside a block of size 352 free'd ==9390== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==9390== by 0x7D64F5: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==9390== by 0x1BB78CB2: ??? (rlm_passwd.c:308) ==9390== by 0xFC53: modcall (modcall.c:219) Run 3: gdb # radiusd -yf Mon Nov 7 13:02:31 2005 : Info: Starting - reading configuration files ... *** glibc detected *** malloc(): memory corruption: 0xae8012dd *** Aborted (core dumped) # date man nov 7 14:19:20 CET 2005 # gdb radiusd core.19991 (gdb) bt #0 0x00bbb7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x003127d5 in raise () from /lib/tls/libc.so.6 #2 0x00314149 in abort () from /lib/tls/libc.so.6 #3 0x0034640a in __libc_message () from /lib/tls/libc.so.6 #4 0x0034d51c in _int_malloc () from /lib/tls/libc.so.6 #5 0x0034ef81 in malloc () from /lib/tls/libc.so.6 #6 0x0011915b in pairmake (attribute=0x947af33 "LM-Password", value=0x947ab03 "", operator=11) at valuepair.c:1041 #7 0x00e09981 in addresult (inst=0x947a9e8, vp=0x947d954, pw=0x947aac8, when=0 '\0', listname=0xe09e76 "config_items") at rlm_passwd.c:504 #8 0x00e09bbc in passwd_authorize (instance=0x947a9e8, request=0x947d940) at rlm_passwd.c:542 #9 0x001f2c54 in modcall (component=1, c=0x9479b18, request=0x947d940) at modcall.c:219 #10 0x001f2ee1 in modcall (component=1, c=0x93fb260, request=0x947d940) at modcall.c:252 #11 0x001f2126 in indexed_modcall (comp=1, idx=6, request=0x0) at modules.c:473 #12 0x001eeef3 in rad_authenticate (request=0x947d940) at auth.c:592 #13 0x001e804c in rad_respond (request=0x947d940, fun=0x1eee57 <rad_authenticate>) at radiusd.c:1642 #14 0x001f5481 in request_handler_thread (arg=0x947d378) at threads.c:517 #15 0x006c5341 in start_thread () from /lib/tls/libpthread.so.0 #16 0x003b26fe in clone () from /lib/tls/libc.so.6 (gdb) My rlm_passwd.c (after applying patch): Line: 279 - 289 if(!strcmp(list, name)) return passwd; } } } } fclose(ht->fp); ht->fp = NULL; return NULL; #undef passwd } Line:301 - 311 if (!strcmp(hashentry->field[ht->keyfield], name)){ /* save address of next item to check into buffer */ ht->last_found=hashentry->next; return hashentry; } return NULL; } if (ht->fp) fclose(ht->fp); if (!(ht->fp=fopen(ht->filename, "r"))) return NULL; return get_next(name, ht); } Line: 540 - 550 } do { addresult(inst, &request->config_items, pw, 0, "config_items"); addresult(inst, &request->reply->vps, pw, 1, "reply_items"); addresult(inst, &request->packet->vps, pw, 2, "request_items"); } while ( (pw = get_next(name, inst->ht)) ); found++; if (!inst->allowmultiple) break; } if(!found) { return RLM_MODULE_NOTFOUND; Please send me an email if you can help me, and I will send the complete outputs. Svein Hansen >>> nbk(a)sitadelle.com 27.10.2005 12:34:41 >>> Svein Hansen wrote: > I suspected that there had to be a module in freeradius that makes > glibc fault, so I tried to run freeradius in Valgrind: Thanks, the output of Valgrind is very useful. > I'm not a programmer, but can it be that radius tries a double-close > or a double-free? Indeed, it looks like a file stream is closed more than once. Please try to apply these changes to src/modules/rlm_passwd/rlm_passwd.c then recompile FreeRADIUS and test again. Index: src/modules/rlm_passwd/rlm_passwd.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_passwd/rlm_passwd.c,v retrieving revision 1.13.2.3 diff -u -r1.13.2.3 rlm_passwd.c --- src/modules/rlm_passwd/rlm_passwd.c 19 Dec 2004 20:06:30 -0000 1.13.2.3 +++ src/modules/rlm_passwd/rlm_passwd.c 27 Oct 2005 10:23:00 -0000 @@ -136,8 +136,15 @@ for (i=0; i<ht->tablesize; i++) if (ht->table[i]) destroy_password(ht->table[i]); - if (ht->table) free(ht->table); - if (ht->fp) fclose(ht->fp); + if (ht->table) { + free(ht->table); + ht->table = NULL: + } + if (ht->fp) { + fclose(ht->fp); + ht->fp = NULL; + } + ht->tablesize = 0; } static void release_ht(struct hashtable * ht){ @@ -194,7 +201,6 @@ if(*buffer && *buffer!='\n' && (!ignorenis || (*buffer != '+' && *buffer != '-')) ){ if(!(hashentry = mypasswd_malloc(buffer, nfields, &len))){ release_hash_table(ht); - ht->tablesize = 0; return ht; } len = string_to_entry(buffer, nfields, *ht->delimiter, hashentry, len); @@ -219,7 +225,6 @@ else nextlist = 0; if(!(hashentry1 = mypasswd_malloc("", nfields, &len))){ release_hash_table(ht); - ht->tablesize = 0; return ht; } for (i=0; i<nfields; i++) hashentry1->field[i] = hashentry->field[i]; -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: freeradius and machine account authentication
by Norbert Wegener 06 Nov '05

06 Nov '05

>>Norbert Wegener <nw at sbs.de <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >>/ FreeRADIUS at this time cannot perform machine account authentications, />>/ but it supports proxying them off to another RADIUS server (for example, />>/ IAS, or FUNK) /> > After recent changes to both FreeRADIUS and Samba, this is now > supported. See the list archives for details. > > Alan DeKok. I searched the archives and found this or that discussion about that topic in general. Nevertheless I did not find any hint on how to configure freeradius to perform machine account authentication. Maybe someone has a pointer for me, as even in freeradius-snapshot-20051104 a grep for machine account was not successfull. Another question comes up in that context: What job has samba to solve here? Must the server, that runs freeradius, be member of the active diretory domain and samba is used for this? Which version of samba must at least be used? Thanks Norbert Wegener

2 1

FW: Attribute Value length using SQL
by Gunther 06 Nov '05

06 Nov '05

Alan DeKok wrote: >"Gunther" <freeradius(a)caribsms.com> wrote: >> Thanks! Yes, I see it in rfc2138 (0-253 octets) ... But isn't the >> feature I am talking about more part of the expression module and >> enhanced functionality of FreeRadius? > > Yes, but the data structures used by the code are still based on > RADIUS ones. > > If you want to use longer strings, rlm_policy in the CVS snapshot may help. > > Alan DeKok. Will try that one! I was actually successful with changing MAX_STRING_LEN and changing one fixed [256] value in main/xlat.c (char attrname[256];). The long SQL strings were recognised and functioning. My remaining trouble was the conditional expression %{expr: SQL1}:-%{expr:SQL2}. Whenever SQL1 does not return anything, SQL2 will not be executed ... I guess I am not using the right syntax or I am running into a limit ... I presume that I have to use a complete CVS snapshot in order to use rlm_policy? Thanks, Gunther

2 2

assert request_list:1524 after running for some hours
by Joe Maimon 06 Nov '05

06 Nov '05

cvs 10/29 rad_assert(request->proxy->dst_ipaddr.af == AF_INET) Haven't done much troubleshooting on this one yet. (still getting assert in util.c:189 on sever shutdown)

2 1

Adding Attributes to a post proxy request
by Holger Steppke 06 Nov '05

06 Nov '05

Hi, i have read a couple of msg on this list about the same problem i actualy have but could not really find a nice solution for it. I have a case where I use Freeradius for proxy auth/acct to home servers. Lets assume I will be more then 20-40 different realms. Before the answer goes back to the Nas I need to add some attributes and now looking for the best way of doing this. In the past with Cistron or today with the switch in proxy.conf it is easy. I think this is maybe not the right way of doing it parsing the users files and everything else in authentication section twice. My Setup NAS ----- 1 -------> PROXY ------ 2 ---------> Home Radius <---- 4 -------- <----- 3 --------- So in 4 there should be e.g. different DNS servers for each realm. What is your view on this ? What's the best way doing this. Don't know if there is a way to add those Attributes to the Request Reply) attributes so that there still there when the Home Radius sends an answer ? Of course in a scalable way 20-40 realms. I´am already that far that I thought I need to patch the files module to have function for post-proxy which then I could use to parse another users file adding those Attributes Because that was easy Just defaults for each Realm and then adding them. BTW I found some parameter in the modules which do read the realm/proxy stuff which seams to be not used somewhere. It is trusted and hints. Or do you just allow them to be compatible with Cistron. ?? Bye Holger

3 2