- Freeradius-Users - lists.freeradius.org

Freeradius several segfaults at heavy load and startup ?
by Alexander Silveröhrt 29 Nov '12

29 Nov '12

Hello, Wondered if anyone have any idea about below. If started with flag -X everything starts up ok but without -X then it crashes with these messages in the log.(atleast most of the time if one is persistent then it may well start up properly sometimes without the -X flag) As soon as it starts ok then there seems to be no problem whatsoever. It runs perfectly with the same config and perl hooks at a lab machine where there are no traffic. Searching through the web doesn't give much info? Any ideas would be appreciated. Thank you. Alex root@itop0-db0:/scripts# LD_PRELOAD=/usr/lib/libperl.so.5.10 /usr/sbin/freeradius root@itop0-db0:/scripts# ps -ef | grep freeradius root 30086 29914 0 08:10 pts/1 00:00:00 grep freeradius root@itop0-db0:/scripts#dmesg . .. ... [2233283.445884] freeradius[617]: segfault at 212 ip 00000000f72238d4 sp 00000000ffb85050 error 4 in rlm_perl-2.1.10.so[f7221000+5000] [2233430.045210] freeradius[2673]: segfault at 212 ip 00000000f72328d4 sp 00000000ffff4e50 error 4 in rlm_perl-2.1.10.so[f7230000+5000] [2233671.048040] freeradius[2730]: segfault at 212 ip 00000000f72928d4 sp 00000000fffe4370 error 4 in rlm_perl-2.1.10.so[f7290000+5000] [2233840.528299] freeradius[2776]: segfault at 212 ip 00000000f72248d4 sp 00000000ffb06020 error 4 in rlm_perl-2.1.10.so[f7222000+5000] [5223187.548213] freeradius[2380]: segfault at 1002 ip 00000000f71e88d4 sp 00000000ffe0dfc0 error 4 in rlm_perl-2.1.10.so[f71e6000+5000] [5887868.065533] freeradius[31931]: segfault at 1002 ip 00000000f71bb8d4 sp 00000000ffb46d50 error 4 in rlm_perl-2.1.10.so[f71b9000+5000] [5946015.698283] freeradius[1746]: segfault at 88 ip 00000000f6ed29d1 sp 00000000e2df5810 error 4 in libmysqlclient_r.so.16.0.0[f6e53000+1af000] [5951643.541290] freeradius[11237]: segfault at 15 ip 00000000f76aac1a sp 00000000f56287a0 error 4 in libperl.so.5.10.1[f7610000+14a000] [5951657.770507] freeradius[11386]: segfault at c ip 00000000f76d3a17 sp 00000000f66a98d0 error 4 in libperl.so.5.10.1[f768f000+14a000] [6026380.012188] freeradius[11693]: segfault at 4 ip 00000000f6f1252e sp 00000000f0ff77d0 error 6 in libmysqlclient_r.so.16.0.0[f6e94000+1af000] [6026442.934483] freeradius[5466]: segfault at 8 ip 00000000f767a611 sp 00000000f5e4c930 error 4 in libperl.so.5.10.1[f7633000+14a000] [6026462.851031] freeradius[5547]: segfault at 8 ip 00000000f75ec611 sp 00000000f5dbe930 error 4 in libperl.so.5.10.1[f75a5000+14a000] [6544711.773094] freeradius[29963]: segfault at 8 ip 00000000f7616611 sp 00000000f6e0e930 error 4 in libperl.so.5.10.1[f75cf000+14a000] [6544722.667507] freeradius[29984]: segfault at 8 ip 00000000f75e1611 sp 00000000f4db1930 error 4 in libperl.so.5.10.1[f759a000+14a000] [6544822.799431] freeradius[30080]: segfault at 8d160fc ip 00000000f76a81b1 sp 00000000f32fc540 error 4 in libperl.so.5.10.1[f75e6000+14a000] [6544885.122348] freeradius[30118]: segfault at 8 ip 00000000f75f7611 sp 00000000f5dc9930 error 4 in libperl.so.5.10.1[f75b0000+14a000] [6544895.128894] freeradius[30137]: segfault at 8 ip 00000000f76bc611 sp 00000000f6eb4930 error 4 in libperl.so.5.10.1[f7675000+14a000] [6544905.352401] freeradius[30152]: segfault at 8 ip 00000000f766d611 sp 00000000f6640930 error 4 in libperl.so.5.10.1[f7626000+14a000] [6544946.136776] freeradius[30196]: segfault at 8 ip 00000000f76a5611 sp 00000000f4e75930 error 4 in libperl.so.5.10.1[f765e000+14a000] [6544966.088368] freeradius[30212]: segfault at c ip 00000000f764aa17 sp 00000000f66208d0 error 4 in libperl.so.5.10.1[f7606000+14a000] ********* DISCLAIMER ********* This message and any attachment are confidential and may be privileged or otherwise protected from disclosure and may include proprietary information. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person

6 8

Re: Freeradius several segfaults at heavy load and startup ?
by Alan Buxey 29 Nov '12

29 Nov '12

-X runs as a single thread Is your perl multi-threaded? Does your PERL code deal with threads? alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 3

Re: External HTTPS authentication
by Alan Buxey 28 Nov '12

28 Nov '12

Why not just using EAP-TLS as the auth as-is, since you control the horizontal and vertical if the certs and CA (CA can sign your RADIUS server cert). Then just use some post-auth to pass request to your backend to work out what VLAN to return? alan

1 0

External HTTPS authentication
by Thiago A. V. Lima 28 Nov '12

28 Nov '12

Hello mailing list. What I'm actually trying to accomplish is this: I already have a modified version of an OpenID server, that doesn't require any user/password. The whole authentication is based on EAP-TLS between the browser and the Apache server, using the certificate email to identify the current user. (I control the whole CA chain, so I can trust the certificate embedded emails). I'd like to make FreeRADIUS "forward" the user certificate (client side, WPA2-Enterprise scheme certificate, I mean) to my OpenID (Apache server with EAP-TLS) and, if the connection is correctly established, authenticate the user and move him to the correct VLAN. This way, I could have an integrated network and services (single sign-on) authentication process, "completely" transparent to the end-user (except for the network So, if there was any already available module that could, for example, authenticate the RADIUS user using a "foreign" webservice or something like that, I think I could modify/adapt it to my EAP-TLS scenario. Any suggestions? Thanks in advance and congratulations for the nice community, -- Thiago Lima

2 1

Detail file
by BALSIANOK, Peter 28 Nov '12

28 Nov '12

Hi, I want to store accounting packet(s) for future processing. [radiusd@tdrad1 freeradius-server-2.2.0]$ cat /app_log/radius/ggsn-acct/radacct/127.0.0.1/pre-proxy-detail-20121127 Tue Nov 27 15:03:35 2012 Packet-Type = Accounting-Request NAS-Port-Type = Virtual X-Ascend-Dial-Number = "<U+0557>\331\025" Acct-Session-Id = "d597d91572f51ab3" Is there any way to change / simulate functionality of the detail module like this ? Timestamp=" Tue Nov 27 15:03:35 2012"[delimiter]Packet-Type = Accounting-Request[delimiter]NAS-Port-Type = Virtual[delimiter] NAS-Port-Type = Virtual[delimiter] .... [end of line] Thx Peter Balšianok

4 7

Regarding Proxy sockets
by ramakrishna 28 Nov '12

28 Nov '12

Hi, I have been using freeradius 2.2 for a while now. When i start the radius server in debug mode, I observed server creating proxy sockets. please find the log below. * ... adding new socket proxy address * port 61412 ... adding new socket proxy address * port 61413 ... adding new socket proxy address * port 61414 *Listening on authentication address * port 1812 Listening on accounting address * port 1813 What i observed is every time i restart the server, i see the port numbers increasing instead of same port numbers being used. My question is does that mean that the previously used port numbers(61409, 61410, 61411) are not freed properly? Please lemme know if any other information is required. -- Best Regards, M.Rama Krishna Prasad,

2 2

Configure Huntgroups
by Arshad Khan 28 Nov '12

28 Nov '12

Hi, I have configure multiple hunt groups for different purposes like VPN (VPN Server IP), Netflow Services (Netflow Server IP) and hence define their respective group in Window Active directory platform. Now, i need to provide time base VPN access to some users so i made a group in active directory and configure its respective file ntlm_auth4 so now onwards one huntgroup and two ntlm_auth group, one for normal vpn access and one for timebase. But this configuration is not working and every time its going to check in ntlm_auth2 condition. Kindly advice. DEFAULT Auth-Type := ntlm_auth4,Huntgroup-Name == "vpn", Login-Time := "Sa-Su0800-1300" Fall-Through = Yes DEFAULT Auth-Type := ntlm_auth3,Huntgroup-Name == "netflow" Fall-Through = Yes DEFAULT Auth-Type := ntlm_auth2,Huntgroup-Name == "vpn" Fall-Through = Yes DEFAULT Auth-Type = ntlm_auth Regards, Arshad Ahmed Network Engineer

1 1

preproxy_users
by BALSIANOK, Peter 28 Nov '12

28 Nov '12

Hi I use this line many years in the preacct_users file ( freeradius 2.1.X ) DEFAULT Called-Station-Id == "orangewap" Called-Station-Id := "%{Called-Station-Id}.%{3GPP-SGSN-Address}" It`s not work in freeradius-2.2.0, i got error message [files] preproxy_users: Matched entry DEFAULT at line 39 [files] WARNING: Unknown module "3GPP-SGSN-Address" in string expansion "%" ++[files] returns ok Peter Balšianok

1 0

failed to find eap in the modules section
by David Aldwinckle 27 Nov '12

27 Nov '12

Hello, I have just installed 2.2.1 from git on RHEL6. Without making any changes to the configuration, the server fails to start because "eap" is missing in /etc/raddb/modules. radiusd: FreeRADIUS Version 2.2.1, for host x86_64-unknown-linux-gnu, built on Nov 26 2012 at 15:22:43 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) rlm_eap_tls: Error loading randomness rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[310]: Failed to find "eap" in the "modules" section. /etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Dave

2 1

Configuration check
by James Devine 27 Nov '12

27 Nov '12

I ran into an issue where proxy.conf was globally readable for some reason, freeradius wouldn't start because of this and this wasn't picked up by radiusd -C. Can this check be added?

2 4