- Freeradius-Users - lists.freeradius.org

segmentation fault when running radiusd -X
by Voipers Portugal 18 Sep '05

18 Sep '05

I am using Free Radius 1.0.1 and i get the following output when i try to run the server. Any ideias? ser:/usr/local/src# radiusd -sfxxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/postgresql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded DIGEST Module: Instantiated digest (digest) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Segmentation Fault Can it be anything within the confguration files? Regards, Jose Simoes

2 1

1.0.5 + rlm_sql_mysql: Segmentation fault
by Thomas Krause (Webmatic) 18 Sep '05

18 Sep '05

Hello, I want to setup a new server with FreeRadius using MySQL as backend. OS is FreeBSD 5.4, DB Mysql 4.1.13. I've compiled FreeRadius from source (not from ports). Without sql all is doing fine. With sql enabled, the daemon dies with "Segmentation fault (core dumped)": rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to freeradius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Segmentation fault (core dumped) I've followed the instructions in the bugs file, but I'm not a programmer (so the output doesn't really helps me): # gdb /usr/local/sbin/radiusd radiusd.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libcrypt.so.2...done. Loaded symbols for /lib/libcrypt.so.2 Reading symbols from /usr/local/lib/libradius-1.0.5.so...done. Loaded symbols for /usr/local/lib/libradius-1.0.5.so Reading symbols from /usr/local/lib/libltdl.so.4...done. Loaded symbols for /usr/local/lib/libltdl.so.4 Reading symbols from /usr/lib/libssl.so.3...done. Loaded symbols for /usr/lib/libssl.so.3 Reading symbols from /lib/libcrypto.so.3...done. Loaded symbols for /lib/libcrypto.so.3 Reading symbols from /usr/lib/libpthread.so.1...done. Loaded symbols for /usr/lib/libpthread.so.1 Reading symbols from /lib/libc.so.5...done. Loaded symbols for /lib/libc.so.5 Reading symbols from /usr/local/lib/rlm_exec-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_exec-1.0.5.so Reading symbols from /usr/local/lib/rlm_expr-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_expr-1.0.5.so Reading symbols from /usr/local/lib/rlm_pap-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_pap-1.0.5.so Reading symbols from /usr/local/lib/rlm_chap-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_chap-1.0.5.so Reading symbols from /usr/local/lib/rlm_mschap-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_mschap-1.0.5.so Reading symbols from /usr/local/lib/rlm_unix-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_unix-1.0.5.so Reading symbols from /usr/local/lib/rlm_preprocess-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_preprocess-1.0.5.so Reading symbols from /usr/local/lib/rlm_realm-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_realm-1.0.5.so Reading symbols from /usr/local/lib/rlm_files-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_files-1.0.5.so Reading symbols from /usr/local/lib/rlm_sql-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_sql-1.0.5.so Reading symbols from /usr/lib/libm.so...done. Loaded symbols for /usr/lib/libm.so Reading symbols from /usr/lib/libz.so...done. Loaded symbols for /usr/lib/libz.so Reading symbols from /usr/local/lib/mysql/libmysqlclient.so...done. Loaded symbols for /usr/local/lib/mysql/libmysqlclient.so Reading symbols from /usr/local/lib/rlm_sql_mysql-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_sql_mysql-1.0.5.so Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x282f8550 in memset () from /lib/libc.so.5 (gdb) bt #0 0x282f8550 in memset () from /lib/libc.so.5 #1 0x00000001 in ?? () #2 0x283d1b64 in sql_init_socket (sqlsocket=0x8080020, config=0x8067500) at sql_mysql.c:71 #3 0x28348fa8 in connect_single_socket (sqlsocket=0x8080020, inst=0x8080400) at sql.c:70 #4 0x28349110 in sql_init_socketpool (inst=0x8080400) at sql.c:131 #5 0x283474eb in rlm_sql_instantiate (conf=0x8140038, instance=0x0) at rlm_sql.c:712 #6 0x0805470d in find_module_instance (instname=0x8078610 "sql") at modules.c:358 #7 0x0805596e in do_compile_modsingle (component=1, ci=0x8079400, filename=0x805f353 "radiusd.conf", grouptype=0, modname=0xbfbfdae8) at modcall.c:814 #8 0x08054e82 in setup_modules () at modules.c:568 #9 0x0804c850 in main (argc=2, argv=0xbfbfec8c) at radiusd.c:960 (gdb) (The same happens when using ver. 1.0.4 from ports). Kind regards, Thomas -- ------------------------------------------------------------ Thomas Krause Webmatic Kommunikations GmbH Tel: +49 345 7779999 ------------------------------------------------------------

3 4

Problems with oracle
by chabral - 17 Sep '05

17 Sep '05

Hi, I'm trying to use freeradius 1.0.1 with oracle 9i. I successfully (i think) compiled freeradius with oracle support. I've the files: /usr/local/etc/raddb/oraclesql.conf /usr/local/lib/rlm_sql_oracle-1.0.1.so /usr/local/lib/rlm_sql_oracle.so /usr/local/lib/rlm_sql_oracle.la /usr/local/lib/rlm_sql_oracle.a The problem is when I start "radiusd -X" I see the lines: rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked rlm_sql (sql): Attempting to connect to TR_RADIUS@oracle:1521/(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=oracle)(PORT=1521)))(CONNECT_DATA=(SID=TESTSID)(SERVER=DEDICATED))) rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 rlm_sql_oracle: Couldn't init Oracle OCI environment (OCIEnvCreate()) rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Instantiated sql (sql) Any help? -- chabral

2 1

Re: PEAP without credentials
by Stefan.Neis＠t-online.de 17 Sep '05

17 Sep '05

Hi, > I thought the username/passwd is transfered while the shake-hand. Yes and no. I.e. it depends on the precise protocol you're using. For some of them (mostly PAP, EAP-TTLS/PAP), the password is transfered in an encrypted form. For others (CHAP, MSCHAP, EAP-MD5, PEAP), the password is only used to perform a computation on a "challenge" presented by the server and only the "reply" to the challenge is transferred. Those protocols are designed in a way to make it impossible to obtain the cleartext password from challenge and response, so an attacker doesn't get any hint about the password. > So it wouldn't be able to reuse this transfered (encrypted or not) password > for the connection? No, the problem in the case of MSCHAP is, that you _do_ need the cleartext password and can't obtain it from the data transfered. > When I look in my radius log, it shows me the clear-text > password of everyone who tries to auth. Then, you're either using a PAP based protocol for those tests where the password is shown, or it shows you the password it got from the "database" (users file, SQL, whatever) > I would use that transfer to copy username & Passwd and store it in a db, > so for the rest of the auth and autz the server would have the passwd. No such transfer is taking place in the case of PEAP; just as I already said in my first reply: > > ..., there's no > > way to extract the clear text password from the request, ... Just look at the raw RADIUS paket via e.g. ethereal, if you're unwilling to believe my words ... Regards, Stefan

1 0

RE: Howto strip off Domain Name
by Jamie Crawford 16 Sep '05

16 Sep '05

proxy.conf realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL } >>> bjohnson(a)drtel.com 9/16/2005 9:56:21 AM >>> Lookup realms in the docs. And people wonder why Alan is so cranky. ;-) - Brian J. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Sebastian Mauer > Sent: Friday, September 16, 2005 9:43 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Howto strip off Domain Name > > Hello there, > > I managed to get FreeRadius authenticating users with PEAP against a > OpenLDAP Directory containing my Samba controlled domain data > and users. > The Users are stored with der normal username (without Domain) in the > LDAP. As default the windows WLAN Client tries to > authenticate with the > entered windows logon credentials which is fine if the client > would send > the username without the Domain added. When FreeRadius looks up > DOMAIN\testuser in the LDAP there is obviously no result because the > user is stored as testuser. So what can I do to strip of any > Domain Name > by default? > > Thanks in Advance, > > Sebastian Mauer > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PAP and clear text
by Chuck Slate 16 Sep '05

16 Sep '05

Hi All. I have a few freeRADIUS newbie questions for you. I have always read and been told that PAP is insecure because it transmits passwords in clear text. However, If I sniff the communication between my NAS and server when PAP is used, the password is indeed obfuscated. It appears to be hashed. So my questions are: 1) First and foremost, am I interpreting this correctly? 2) If so, is it the shared secret defined in the clients.conf file that is used as a key for the hash? 3) If not, any clue as to what I am seeing, and in that case, what is the shared secret used for? As you can see, I am looking for some basic info about the flow of the connection. I have taken an honest shot at RTFM, but have not come across these details yet. Can someone please explain or point me to an explanation? Thanks in advance. Chuck

3 2

mssql and authenticate_query
by Duane Cox 16 Sep '05

16 Sep '05

List: There is an "authenticate_query" variable defined in the stock mssql.conf I can not get freeradius to run this query when authenticating users; and when I add the 'sql' module in the authenticate section of radius.conf, freeradius stops with the following error... Module: Instantiated sql (sql) radiusd.conf: "SQL" modules aren't allowed in 'authenticate' sections -- they have no such method. I am beginning to think this entry is defunct or never implemented. Am I right? If so, then I could remove that entry from my mssql.conf. Thanks Duane Cox

4 7

Howto strip off Domain Name
by Sebastian Mauer 16 Sep '05

16 Sep '05

Hello there, I managed to get FreeRadius authenticating users with PEAP against a OpenLDAP Directory containing my Samba controlled domain data and users. The Users are stored with der normal username (without Domain) in the LDAP. As default the windows WLAN Client tries to authenticate with the entered windows logon credentials which is fine if the client would send the username without the Domain added. When FreeRadius looks up DOMAIN\testuser in the LDAP there is obviously no result because the user is stored as testuser. So what can I do to strip of any Domain Name by default? Thanks in Advance, Sebastian Mauer

2 1

PEAP without credentials
by Sebastian Müller 16 Sep '05

16 Sep '05

Hi, is there a way, to tell the freeradius to accept an incoming peap request, without asking for user credentials, or to accept any credentials? Currently needed to use the credentials guest/guest. It would be simpler to accept any credentials, without loosing the encryption. Thanks Windows XP (SP2) as default it tries to sends the local credentials, but of course they are getting rejected. The Auth-Type := Accept accepts the Login (I also get a "Login OK" msg.) but it doesn't tunnel and Accept them fully. Cheers Sebastian Müller www.sophieneck-berlin.de

2 2

crash in 1.0.5
by Norbert Wegener 16 Sep '05

16 Sep '05

freeradius crashes in 1.0.5 with: in radius.conf: passwd nwfiles { filename = /etc/raddb/gug format = "~User-Category:*User-Name" } /etc/raddb/gug ########################################################## newgroup:*Norbert Wegener TCGID=ZZZZZ1EC ########################################################## and a users file ########################################################## "Norbert Wegener TCGID=ZZZZZ1EC" User-Category=="newgroup" Fall-Through = Yes, DEFAULT User-Category== "newgroup" Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair += "ip:addr-pool=newgroup", Fall-Through = No, DEFAULT Auth-Type == Reject ########################################################## freeradius crashes in 1.0.5, when starting a connection, the configuration files are read. When a clients start a connection, gdb shows: (gdb) bt #0 rad_mangle (data=0x812afc0, request=<value optimized out>) at rlm_preprocess.c:186 #1 0x403432c4 in preprocess_authorize (instance=0x812afc0, request=0x81320a0) at rlm_preprocess.c:497 #2 0x0805655c in modcall (component=1, c=0x812b6c0, request=0x81320a0) at modcall.c:219 #3 0x0805677f in modcall (component=1, c=0x812c938, request=0x81320a0) at modcall.c:252 #4 0x08054d30 in indexed_modcall (comp=1, idx=1, request=0x81320a0) at modules.c:469 #5 0x0805281e in rad_authenticate (request=0x81320a0) at auth.c:592 #6 0x0804c156 in rad_respond (request=0x81320a0, fun=0x8052790 <rad_authenticate>) at radiusd.c:1642 #7 0x0804db80 in main (argc=4, argv=0xbffff534) at radiusd.c:1427 We use certificates and eap tls. If you need more information, please let me know. Norbert Wegener

2 4