Hello everyone, I've configured a freeradius 1.1.1 + LDAP for eap-tls authentication with domains. authorize { preprocess ntdomain ... } realm host { type = radius authhost = LOCAL accthost = LOCAL strip } This configuration gives an error: rlm_eap: Identity does not match User-Name, setting from EAP Identity. When I enable with_ntdomain_hack in eap.conf it works quite well. Could anyone tell me why it's neccesary? The problem is that this secondary_radius do proxy when it doesn't find the user in its LDAP and the master_radius gives this error: rlm_eap: Identity does not match User-Name, setting from EAP Identity. I've tried in master_radius the same configuration with and without ntdomain_hack and it fails. I've been thinking of adding the realm before the secondary do proxy, so the master could treat the request as it's been local. But I don't like this too much. Does anyone have a better idea of what to do? Thanks.
Well I have found the answer. In the proxy realm I've put nostrip and it is working now. 2006/5/18, wekz <fbl.list@gmail.com>:
Hello everyone,
I've configured a freeradius 1.1.1 + LDAP for eap-tls authentication with domains.
authorize { preprocess ntdomain ... }
realm host { type = radius authhost = LOCAL accthost = LOCAL strip }
This configuration gives an error:
rlm_eap: Identity does not match User-Name, setting from EAP Identity.
When I enable with_ntdomain_hack in eap.conf it works quite well. Could anyone tell me why it's neccesary?
The problem is that this secondary_radius do proxy when it doesn't find the user in its LDAP and the master_radius gives this error:
rlm_eap: Identity does not match User-Name, setting from EAP Identity.
I've tried in master_radius the same configuration with and without ntdomain_hack and it fails.
I've been thinking of adding the realm before the secondary do proxy, so the master could treat the request as it's been local. But I don't like this too much.
Does anyone have a better idea of what to do?
Thanks.
hello, everyone i use radrelay there are errors in log from rlm_detail like Error: rlm_detail: Couldn't open file /var/log/radius/radacct/detail-relay: Bad file descriptor while examine rlm_detail.c i found two places in it. first while open (create if need) detail-file (line 204 rlm_detail.c). second while do converting the FD to FP (line 243) after aquiring filelock of detail file. Bad file description error appear because radrelay can remove detail file while rad_detail trying to aquire filelock, I think (line 655 of radrelay.c). rlm_detail.c: 201: if ((outfd = open(buffer, O_WRONLY | O_APPEND | O_CREAT, 202: inst->detailperm)) < 0) { 203: radlog(L_ERR, "rlm_detail: Couldn't open file %s: %s", 204: buffer, strerror(errno)); 205: return RLM_MODULE_FAIL; 206: } 208: /* 209: * If we're not using locking, we'll just pass straight though 210: * the while loop. 211: * If we fail to aquire the filelock in 80 tries (approximately 212: * two seconds) we bail out. 213: */ 214: locked = 0; 215: lock_count = 0; 216: do { .... 231: } while (!locked && inst->locking && lock_count < 80); ... 239: /* 240: * Convert the FD to FP. The FD is no longer valid 241: * after this operation. 242: */ 243: if ((outfp = fdopen(outfd, "a")) == NULL) { 244: radlog(L_ERR, "rlm_detail: Couldn't open file %s: %s", 245: buffer, strerror(errno)); 246: if (inst->locking) { 247: lseek(outfd, 0L, SEEK_SET); 248: rad_unlockfd(outfd, 0); 249: DEBUG("rlm_detail: Released filelock"); 250: } 251: close(outfd); 253: return RLM_MODULE_FAIL; 254: } radrelay.c: 655: if (detail_move(r_args->detail, work) == 0) { 656: if (debug_flag > 0) 657: fprintf(stderr, "Moving %s to %s\n", 658: r_args->detail, work); 659: /* 660: * rlm_detail might still write 661: * something to <detail>.work if 662: * it opens <detail> before it is 663: * renamed (race condition) 664: */ 665: ms_sleep(1000); 666: state = STATE_BACKLOG; 667: } 668: fpos = ftell(fp); 669: fseek(fp, 0L, SEEK_SET); 670: rad_unlockfd(fileno(fp), 0); 671: fseek(fp, fpos, SEEK_SET); so detail_move can be called by radrelay while rad_detail already opens detail (line 201) have outfd and try to aquire lock. after radrelay made rad_unlockfd(fileno(fp), 0) (line 670), rlm_detail try to fdopen (line 243) and will get error. As workaround we can give to rlm_detail recreate detail... --- rlm_detail.c-orig 2006-06-15 12:09:43.000000000 +0600 +++ rlm_detail.c 2006-06-15 12:22:49.000000000 +0600 @@ -119,6 +119,7 @@ struct stat st; int locked; int lock_count; + int opencount=0; struct timeval tv; REALM *proxy_realm; char proxy_buffer[16]; @@ -195,6 +196,8 @@ *p = '/'; } /* else there was no directory delimiter. */ + +reopen: /* * Open & create the file, with the given permissions. */ @@ -241,8 +244,9 @@ * after this operation. */ if ((outfp = fdopen(outfd, "a")) == NULL) { - radlog(L_ERR, "rlm_detail: Couldn't open file %s: %s", - buffer, strerror(errno)); + radlog(L_ERR, "rlm_detail: Couldn't open file %s: %s. %s", + buffer, strerror(errno), + (opencount==0)?"try reopen to create":"return MODULE_FAIL"); if (inst->locking) { lseek(outfd, 0L, SEEK_SET); rad_unlockfd(outfd, 0); @@ -250,7 +254,10 @@ } close(outfd); - return RLM_MODULE_FAIL; + if (opencount++ == 0) + goto reopen; + else + return RLM_MODULE_FAIL; } /* btw, why to sleep 1000ms on 665@radrelay.c? how rlm_detail can write something to detail.work, while file is locked by radreplay? Mike.
Michael Chernyakhovsky wrote:
i use radrelay there are errors in log from rlm_detail like Error: rlm_detail: Couldn't open file /var/log/radius/radacct/detail-relay: Bad file descriptor
[...]
Bad file description error appear because radrelay can remove detail file while rad_detail trying to aquire filelock, I think (line 655 of radrelay.c).
I don't think so: you can continue to write in a file which has been unlinked.
so detail_move can be called by radrelay while rad_detail already opens detail (line 201) have outfd and try to aquire lock. after radrelay made rad_unlockfd(fileno(fp), 0) (line 670), rlm_detail try to fdopen (line 243) and will get error.
Indeed, things are done in the wrong order. This was already discussed on the freeradius-devel mailing list. The thread starts here: http://lists.freeradius.org/pipermail/freeradius-devel/2005-March/008139.htm... I think the fixes are in CVS head but they were never included in any stable release.
btw, why to sleep 1000ms on 665@radrelay.c? how rlm_detail can write something to detail.work, while file is locked by radreplay?
rlm_detail opens the file and wait for the lock. During this time, the file may be renamed by radrelay, but rlm_detail doesn't notice it. Therefore the file descriptor in rlm_detail points to detail.work. -- Nicolas Baradakis
participants (4)
-
Alan DeKok -
Michael Chernyakhovsky -
Nicolas Baradakis -
wekz