November 2005 - Freeradius-Devel - lists.freeradius.org

Re: wiki
by Ruslan A Dautkhanov 24 Nov '05

24 Nov '05

Hello ! > >Message: 2 >Date: Wed, 23 Nov 2005 11:42:56 -0500 >From: "Alan DeKok" <aland(a)ox.org> > > >>If no one else steps up, I'll see what I can do. I've got a long >>weekend here, so this would be something to test out. >> >> > > I'd prefer something like "twiki", which is low impact as possible. >i.e. one perl script, and a whack of text files, which are version >controlled. That's better (IMHO) than an SQL database. > > Hmmm :-) I think text files is much more ugly for storing structured portions of data, it's harder to support, harder to expand any new features or even schema of data storing, I'm not saying anything about queries to such data also, for obvious reasons... :-) best regards Ruslan A Dautkhanov

2 1

Automatic report from sources (radiusd) between 23.11.2005 - 24.11.2005 GMT
by Automatic cvs log generator 24 Nov '05

24 Nov '05

CVS log entries from 23.11.2005 (Wed) 09:00:00 - 24.11.2005 (Thu) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/radius.c; Revisions: 1.175 File: radiusd/src/modules/rlm_digest/rlm_digest.c; Revisions: 1.15, 1.14 ===================================================== Log entries ===================================================== Description: A little more generic way of truncating tunnel-password-encrypted attributes. Hmm... much of these checks should also be added to pairmake() and friends, so that the admin can find limits earlier in the process Modified files: File: radiusd/src/lib/radius.c; Revision: 1.175; Date: 2005/11/23 18:30:57; Author: aland; Lines: (+35 -12) ------------------------------- Description: If no digest algorithm, default to MD5. Patch from Philippe Sultan Modified files: File: radiusd/src/modules/rlm_digest/rlm_digest.c; Revision: 1.15; Date: 2005/11/23 19:39:12; Author: aland; Lines: (+29 -17) ------------------------------- Description: Sanity check lengths of hex string Patch from Philippe Sultan Modified files: File: radiusd/src/modules/rlm_digest/rlm_digest.c; Revision: 1.14; Date: 2005/11/23 19:26:43; Author: aland; Lines: (+18 -7) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/radius.c Revisions: 1.175 Authors: aland (+35 -12) ------------------------------- File: radiusd/src/modules/rlm_digest/rlm_digest.c Revisions: 1.15, 1.14 Authors: aland (+29 -17), aland (+18 -7) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Need info about Reply-Message configuration in Access-Reject
by Vishwanath Srikant Pattanshetti 23 Nov '05

23 Nov '05

Hi all Following is my setup: I have a FreeRADIUS server (1.0.4) on a solaris machine. My clients and users information are stored in Oracle database. If an Access-request is rejected, it can be for two reasons: 1. Wrong password. 2. User does not exist in RADIUS server database. I want to send appropriate messages in Access-Reject packets, to the client. Can some one tell me how can I configure a Reply-Message for an Access-Reject packet? I tried putting Reply-Message along with other reply items for a user, but this configures Reply-Message only for Access-Accept message. Also when the user does not exist in the database, is there a way I can add appropriate message using Reply-Item to the Access-Reject packet? Or is it not possible with current FreeRADIUS? In addition to the above I need to setup an external RADIUS server to which I need to proxy Access-Requests. If such an external RADIUS server down, when an Access-Request is proxied to it, then my primary RADIUS server Would need to generate a Access-Reject packet(after retries), is there a way I can specify a Reply-Item in any such Access-Reject packet?? Or is it not possible with current implementation of FreeRADIUS. Any quick help would be of great help Thanks in advance. Regards. -Vishwa.

2 1

policy module concat default to bottom of vp list
by Joe Maimon 23 Nov '05

23 Nov '05

Which is a problem for me because I would like to use the policy module to add an attribute in certain circumstances in post-auth However my NAS will kick the user if that attribute follows another. It needs to be first. So would it be a good idea to extend the policy module to be able to specify a insert at head or a insert at $HERE , where here would be a vp that matches? And any tips on how to go about this Thanks, Joe

1 0

Need info about Reply-Message configuration in Access-Reject
by Vishwanath Srikant Pattanshetti 23 Nov '05

23 Nov '05

Hi all Following is my setup: I have a FreeRADIUS server (1.0.4) on a solaris machine. My clients and users information are stored in Oracle database. If an Access-request is rejected, it can be for two reasons: 1. Wrong password. 2. User does not exist in RADIUS server database. I want to send appropriate messages in Access-Reject packets, to the client. Can some one tell me how can I configure a Reply-Message for an Access-Reject packet? I tried putting Reply-Message along with other reply items for a user, but this configures Reply-Message only for Access-Accept message. Also when the user does not exist in the database, is there a way I can add appropriate message using Reply-Item to the Access-Reject packet? Or is it not possible with current FreeRADIUS? In addition to the above I need to setup an external RADIUS server to which I need to proxy Access-Requests. If such an external RADIUS server down, when an Access-Request is proxied to it, then my primary RADIUS server Would need to generate a Access-Reject packet(after retries), is there a way I can specify a Reply-Item in any such Access-Reject packet?? Or is it not possible with current implementation of FreeRADIUS. Any quick help would be of great help Thanks in advance. Regards. -Vishwa.

1 0

Automatic report from sources (radiusd) between 22.11.2005 - 23.11.2005 GMT
by Automatic cvs log generator 23 Nov '05

23 Nov '05

CVS log entries from 22.11.2005 (Tue) 09:00:00 - 23.11.2005 (Wed) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/radius.c; Revisions: 1.174 File: radiusd/share/dictionary.motorola; Revisions: 1.1 ===================================================== Log entries ===================================================== Description: Motorola Canopy stuff Modified files: File: radiusd/share/dictionary.motorola; Revision: 1.1; Date: 2005/11/22 23:03:24; Author: aland; ------------------------------- Description: Allow tunnel passwords to be longer than 16 characters. Oops.. Modified files: File: radiusd/src/lib/radius.c; Revision: 1.174; Date: 2005/11/22 19:35:40; Author: aland; Lines: (+20 -23) ===================================================== Summary of modified files ===================================================== File: radiusd/share/dictionary.motorola Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/lib/radius.c Revisions: 1.174 Authors: aland (+20 -23) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

policy segfault
by Joe Maimon 22 Nov '05

22 Nov '05

doing this policy test in postauth policy add_inter_vrf { reply .= { Cisco-Avpair += "ip:ip-unnumbered=l10" Cisco-Avpair += "ip:vrf-id=CHL-PRIVATE" Cisco-Avpair += "ip:addr-pool=privatepool" } } policy intervrf { # if ( (request:Client-Short-Name =~ "noc08rt1[45]") && # (request:Hint == "CHL-PRIVATE") # ) if ( control:Hint == "CHL-PRIVATE") { add_inter_vrf() pool_conflict_ipaddr() } } policy post-auth { intervrf() } segfaults. below patch seems to correct and match when expected to. ( Hint += check line in users file) The segfault is at valuepair.c:78 which could probably use a check for NULL This is on CVS 10/29, kindly ignore if CVS head addresses this. (Off to check) diff -u ../../debian5/freeradius-1.1.0/src/modules/rlm_policy/evaluate.c src/modules/rlm_policy/evaluate.c --- ../../debian5/freeradius-1.1.0/src/modules/rlm_policy/evaluate.c 2005-11-07 14:51:16.000000000 -0500 +++ src/modules/rlm_policy/evaluate.c 2005-11-22 22:04:46.000000000 -0500 @@ -612,9 +612,13 @@ * error codes than "comparison is less * than, equal to, or greater than zero". */ - compare = simplepaircmp(state->request, - vp, myvp); - pairfree(&myvp); + if (myvp) { + compare = simplepaircmp(state->request, + vp, myvp); + pairfree(&myvp); + } + else + compare = -1; } else { /*

1 0

bugzilla for 1.0.5
by Frank Cusack 21 Nov '05

21 Nov '05

whoever takes care of bugzilla, there is no category for version 1.0.5 -frank

2 1

MS-CHAP support for pam_radius?
by A T 19 Nov '05

19 Nov '05

Hi - Is anyone aware of a source for a pam_radius implementation that includes support for MS-CHAP authentication? Thanks, Albert --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

2 1

Re: rlm_pam fixes
by Frank Cusack 18 Nov '05

18 Nov '05

On November 18, 2005 10:46:36 AM +0100 Nicolas Baradakis <nbk(a)sitadelle.com> wrote: > Does this solve bug #291 ? (crash in rlm_pam) > http://bugs.freeradius.org/show_bug.cgi?id=291 Seems unlikely. That crash looks like either a bug in libpam (unlikely) or something in rlm_pam scribbling over pamh (also seems unlikely). I'll try to reproduce the problem. rlm_pam is a bit klunky but it's straightforward so if the problem is indeed there it shouldn't be hard to find. -frank

1 0