Radius dies, on certificate verification
I'm wondering if anyone else has seen this. My setup is as follows, Seimens controller doing .1x auth, EAP-TLS Both requests are from different users, and what I have now, is set max_requests_per_server to 300 Doesn't seem to have helped, as radwatch is reporting that another radiusd died.... Could this simply be an error with the specific certificates? I haven't looked at it long enough to determine if the same two or three requests are killing radiusd... I got the following when running radiusd -X with openssl .0.9.7c on gentoo, radius 1.1.1-r1 modcall[authorize]: module "sql" returns notfound for request 14091 modcall: leaving group authorize (returns updated) for request 14091 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14091 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler *** glibc detected *** free(): invalid pointer: 0x0b415350 *** Aborted I had thought that perhaps this was an error with openssl , so I recompiled, with 0.9.8 openssl on gentoo, radiusd 1.1.1-r1 and now I get this. modcall[authorize]: module "sql" returns notfound for request 13856 modcall: leaving group authorize (returns updated) for request 13856 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13856 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0297], Certificate Segmentation fault
Robert Myers <ccrider@whiterose.net> wrote:
I got the following when running radiusd -X with openssl .0.9.7c on gentoo, radius 1.1.1-r1
1.1.3 was released a few weeks go. Try it. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan, Thanks, I will do that. Do you think this is just a quirk in 1.1.1? -Bob Alan DeKok wrote:
Robert Myers <ccrider@whiterose.net> wrote:
I got the following when running radiusd -X with openssl .0.9.7c on gentoo, radius 1.1.1-r1
1.1.3 was released a few weeks go. Try it.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Does anyone know of any documentation on how to setup EAP-MSChapv2 authentication? I have tried deployradius.com and viki but have not found anything. Any insight would be greatly appreciated. Thanks, Paul. This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient(s) please contact the sender by reply e-mail and destroy all copies of the original message. Thank you -----Original Message----- From: freeradius-users-bounces+paul.christopher=xerox.com@lists.freeradius.org [mailto:freeradius-users-bounces+paul.christopher=xerox.com@lists.freera dius.org] On Behalf Of Robert Myers Sent: Saturday, September 16, 2006 8:27 PM To: FreeRadius users mailing list Subject: Re: Radius dies, on certificate verification Alan, Thanks, I will do that. Do you think this is just a quirk in 1.1.1? -Bob Alan DeKok wrote:
Robert Myers <ccrider@whiterose.net> wrote:
I got the following when running radiusd -X with openssl .0.9.7c on gentoo, radius 1.1.1-r1
1.1.3 was released a few weeks go. Try it.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
"Christopher, Paul" <Paul.Christopher@xerox.com> wrote:
Does anyone know of any documentation on how to setup EAP-MSChapv2 authentication? I have tried deployradius.com and viki but have not found anything. Any insight would be greatly appreciated.
You configure a password, and it works. I just tried it with eapol_test (from wpa_supplicant), and it works. What tool are you using to test it? What's going wrong? Right now, your question is "stuff doesn't work... why?" It's difficult to respond to that, other than with "it works for me". Please expand on what you're doing, what you're seeing, what you expect, and why you expetct behavior other than what you're seeing. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Just as a follow up, this has solved my issue. Alan DeKok wrote:
Robert Myers <ccrider@whiterose.net> wrote:
I got the following when running radiusd -X with openssl .0.9.7c on gentoo, radius 1.1.1-r1
1.1.3 was released a few weeks go. Try it.
Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Christopher, Paul -
Robert Myers