January 2006 - Freeradius-Devel - lists.freeradius.org

Automatic report from sources (radiusd) between 06.01.2006 - 07.01.2006 GMT
by Automatic cvs log generator 07 Jan '06

07 Jan '06

CVS log entries from 06.01.2006 (Fri) 09:00:02 - 07.01.2006 (Sat) 09:00:02 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/Makefile.in; Revisions: 1.9 File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/Makefile.in; Revisions: 1.4 File: radiusd/src/modules/rlm_eap/libeap/Makefile; Revisions: 1.5 File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/Makefile.in; Revisions: 1.9 File: radiusd/src/modules/rlm_eap/types/rlm_eap_md5/Makefile.in; Revisions: 1.3 File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/Makefile.in; Revisions: 1.11 File: radiusd/src/modules/rlm_eap/types/rlm_eap_sim/Makefile.in; Revisions: 1.5 File: radiusd/src/modules/rlm_eap/types/rlm_eap_psk/Makefile.in; Revisions: 1.2 ===================================================== Combined list of identical log entries ===================================================== Description: Do some reformatting and clean-up a few things like removing unnecessary headers, or always using the variables @eap_*_cflags@ and @eap_*_ldflags@ from Autoconf. Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_md5/Makefile.in; Revision: 1.3; Date: 2006/01/06 12:56:13; Author: nbk; Lines: (+7 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/Makefile.in; Revision: 1.4; Date: 2006/01/06 12:56:13; Author: nbk; Lines: (+7 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/Makefile.in; Revision: 1.9; Date: 2006/01/06 12:56:13; Author: nbk; Lines: (+8 -4) File: radiusd/src/modules/rlm_eap/types/rlm_eap_psk/Makefile.in; Revision: 1.2; Date: 2006/01/06 12:56:13; Author: nbk; Lines: (+7 -4) File: radiusd/src/modules/rlm_eap/types/rlm_eap_sim/Makefile.in; Revision: 1.5; Date: 2006/01/06 12:56:13; Author: nbk; Lines: (+8 -4) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/Makefile.in; Revision: 1.9; Date: 2006/01/06 12:56:14; Author: nbk; Lines: (+7 -3) File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/Makefile.in; Revision: 1.11; Date: 2006/01/06 12:56:14; Author: nbk; Lines: (+8 -4) ===================================================== Log entries ===================================================== Description: libeap is a shared library, not a module, which seems to be a completely different thing for libtool. If we build libeap.la with the rules from src/modules/rules.mak we get libtool warnings when linking the real eap modules. Therefore we need to redefine a sane link command for the target in libeap Makefile. Modified files: File: radiusd/src/modules/rlm_eap/libeap/Makefile; Revision: 1.5; Date: 2006/01/06 18:32:06; Author: nbk; Lines: (+10 -0) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_eap/libeap/Makefile Revisions: 1.5 Authors: nbk (+10 -0) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_md5/Makefile.in Revisions: 1.3 Authors: nbk (+7 -2) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/Makefile.in Revisions: 1.4 Authors: nbk (+7 -2) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/Makefile.in Revisions: 1.9 Authors: nbk (+8 -4) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_psk/Makefile.in Revisions: 1.2 Authors: nbk (+7 -4) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_sim/Makefile.in Revisions: 1.5 Authors: nbk (+8 -4) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/Makefile.in Revisions: 1.9 Authors: nbk (+7 -3) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/Makefile.in Revisions: 1.11 Authors: nbk (+8 -4) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 05.01.2006 - 06.01.2006 GMT
by Automatic cvs log generator 06 Jan '06

06 Jan '06

CVS log entries from 05.01.2006 (Thu) 09:00:02 - 06.01.2006 (Fri) 09:00:02 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/debian/patches/00list; Revisions: 1.1.2.4.2.3 File: radiusd/debian/patches/14_static_rlm_eap_link_mode.dpatch; Revisions: 1.1, 1.1.2.1 ===================================================== Log entries ===================================================== Description: Add 14_static_rlm_eap_link_mode.dpatch Modified files: File: radiusd/debian/patches/00list; Revision: 1.1.2.4.2.3; Date: 2006/01/05 20:33:21; Author: nbk; Lines: (+1 -0) ------------------------------- Description: file 14_static_rlm_eap_link_mode.dpatch was initially added on branch branch_1_1. Modified files: File: radiusd/debian/patches/14_static_rlm_eap_link_mode.dpatch; Revision: 1.1; Date: 2006/01/05 20:33:00; Author: nbk; ------------------------------- Description: Defined magic variable RLM_EAP_LINK_MODE, which should be set to -static. Modified files: File: radiusd/debian/patches/14_static_rlm_eap_link_mode.dpatch; Revision: 1.1.2.1; Date: 2006/01/05 20:33:01; Author: nbk; Lines: (+101 -0) ===================================================== Summary of modified files ===================================================== File: radiusd/debian/patches/00list Revisions: 1.1.2.4.2.3 Authors: nbk (+1 -0) ------------------------------- File: radiusd/debian/patches/14_static_rlm_eap_link_mode.dpatch Revisions: 1.1, 1.1.2.1 Authors: nbk, nbk (+101 -0) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Last patches for 1.1.0?
by Alan DeKok 05 Jan '06

05 Jan '06

The only thing I can see being relevant is the net-snmp patches, now in debian/patches. Odds are other systems need them too, so there's no reason not to put them into the mainstream. Or, should we put them in 1.1.1? I'd like to have a planned set of minor features/bug fixes that can go into point releases. Alan DeKok.

3 7

How to extract A/V pairs from an Access-Request packet
by Maria Ripolles 05 Jan '06

05 Jan '06

Hy all, I am developing a custom module and I am a bit lost with the code. I am not a C programmer so sorry if my question is very stupid. I want to extract the differents A/V pairs contained in the Access-Request packets and check if any of them is the attribute "Connect-Info". In that case I would like to pass the value of the "Connect-Info" attribute to a function called auxiliar. Here is my code: static int auxiliar (char * value) { ..... } static int mymodule_authorize (void *instance, REQUEST *request) { .... VALUE_PAIR *request_pairs; request_pairs=request->packet->vps; VALUE_PAIR *aux = NULL; char * Attribute_Name = NULL; char *Attribute_Value = NULL; int type = 0; for ( aux=request_pairs; aux; aux=aux->next) { Attribute_Name = aux->name; Attribute_Value = aux->strvalue; if (aux->attribute == PW_CONNECT_INFO) { type=auxiliar(aux->strvalue); /* is this correct? I mean, is aux->strvalue a char * type? */ } ..... } Am I on the right track? Thank you a lot for your help and best regards --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y moviles desde 1 centimo por minuto. http://es.voice.yahoo.com

3 3

Assertion failed in request_list.c, line 1257
by Stephan Jaeger 05 Jan '06

05 Jan '06

Hi, after running for 1-2 Minutes with aprox. 10 req/s, freeradius (cvs snapshot from yesterday) is dying with "Assertion failed in request_list.c, line 1257". Is there any chance to have this issue fixed in the near future? Regards Stephan Jaeger -- Stephan Jaeger <stephan.jaeger(a)ewetel.de> EWE TEL GmbH

3 2

How to extract A/V pairs from an Access-Request packet
by Susana Macias 05 Jan '06

05 Jan '06

Hy all, I am developing a custom module and I am a bit lost with the code. I am not a C programmer so sorry if my question is very stupid. I want to extract the differents A/V pairs contained in the Access-Request packets and check if any of them is the attribute "Connect-Info". In that case I would like to pass the value of the "Connect-Info" attribute to a function called auxiliar. Here is my code: static int auxiliar (char * value) { ..... } static int mymodule_authorize (void *instance, REQUEST *request) { .... VALUE_PAIR *request_pairs; request_pairs=request->packet->vps; VALUE_PAIR *aux = NULL; char * Attribute_Name = NULL; char *Attribute_Value = NULL; int type = 0; for ( aux=request_pairs; aux; aux=aux->next) { Attribute_Name = aux->name; Attribute_Value = aux->strvalue; if (aux->attribute == PW_CONNECT_INFO) { type=auxiliar(aux->strvalue); /* is this correct? I mean, is aux->strvalue a char * type? */ } ..... } Am I on the right track? Thank you a lot for your help and best regards, Susana --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

1 0

Automatic report from sources (radiusd) between 04.01.2006 - 05.01.2006 GMT
by Automatic cvs log generator 05 Jan '06

05 Jan '06

CVS log entries from 04.01.2006 (Wed) 09:00:01 - 05.01.2006 (Thu) 09:00:02 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/raddb/eap.conf; Revisions: 1.6, 1.4.4.1 ===================================================== Log entries ===================================================== Description: Fix typo. Modified files: File: radiusd/raddb/eap.conf; Revision: 1.6; Date: 2006/01/04 14:30:03; Author: nbk; Lines: (+19 -21) ------------------------------- Description: Pull from CVS head: Document more options for PEAP. Modified files: File: radiusd/raddb/eap.conf; Revision: 1.4.4.1; Date: 2006/01/04 14:29:29; Author: nbk; Lines: (+27 -16) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/eap.conf Revisions: 1.6, 1.4.4.1 Authors: nbk (+19 -21), nbk (+27 -16) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

rlm_krb5 vs. Active Directory how to
by Enrik Berkhan 04 Jan '06

04 Jan '06

Hi, I've spent the last two days understanding Kerberos and Active Directory interoperability by setting up FreeRADIUS to authenticate via rlm_krb5 against AD. As result, I've written the attached mini how to. As I don't believe its ready for the average user, I post it to -devel for review. If you think it is of any use, feel free to integrate it into the FreeRADIUS doc/ stuff. Enrik The following text briefly describes the steps necessary to setup an Active Directory Server and FreeRADIUS to use rlm_krb5 for authentication purposes. The setup has been tested using FreeRADIUS 1.0.2 (Debian sarge package 1.0.2-4), MIT Kerberos 5 1.4.3 (Debian etch package 1.4.3-4) and Microsoft Windows Server 2003 SP1. 0. Setup Kerberos client side on FreeRADIUS server The following examples assume /etc/krb5.conf to look something like this: [libdefaults] default_realm = EXAMPLE.COM [realms] EXAMPLE.COM = { kdc = <your.ads.server> admin_server = <your.ads.server> } The realms section might not be necessary if DNS SRV lookups work at your setup for the FreeRADIUS machine. 1. Create user account within AD to hold the service principal used for FreeRADIUS Create a normal user account (called `freeradius' form here on) to hold the service principal that rlm_krb5 should use to verify tickets. Remember the password as it will be used to derive kerberos keys later. Don't disable the account as this will prevent Kerberos from working. If you want to disable interactive logon for the account, set the list of allowed hosts to a non-existing one, e.g. Maybe there are better ways to achieve this ... 2. Map service principal to AD account on ADS side Use the Microsoft tool `ktpass' to map the service principal used by FreeRADIUS to the account created in step 1. `ktpass' can be found in "Windows Support Tools". In this example, the service principal shall be freeradius/radius.example.com and the Kerberos 5 realm shall be EXAMPLE.ORG. Of course, in real life the realm has to match your AD setup. Then `ktpass' could be called like this: C:\> ktpass -princ freeradius/radius.example.com(a)EXAMPLE.COM -pass * -mapuser freeradius(a)EXAMPLE.COM -desonly ... Type the password for freeradius/radius.example.com: ... Type the password again to confirm: ... ... This will generate the kerberos keys on the ADS side. `-desonly' prevents the account from being set to 'Use DES encryption only'. If not specified, arcfour-hmac would not be used by the ADS anymore for encrypting the service ticket acquired by FreeRADIUS for account verification. Theoretically, `ktpass' could be used to generate the keytab entries for the FreeRADIUS side, but again, DES keys only. 3. Generate keytab for FreeRADIUS Use Kerberos' `ktutil' to generate keytab entries for FreeRADIUS. We need two entries: One for des-cbc-md5, as rlm_krb5 uses this encryption type to verify that a host key is present at all before even attempting two authenticate (maybe this should be fixed?). The second key is for arcfour-hmac used by ADS since we didn't configure the freeradius account to use DES only. # cd ${confdir} # ktutil ktutil: addent -password -p freeradius/radius.example.com -k 3 -e des-cbc-md5 Password for freeradius/radius.example.com(a)EXAMPLE.COM: ... ktutil: addent -password -p freeradius/radius.example.com -k 3 -e arcfour-hmac Password for freeradius/radius.example.com(a)EXAMPLE.COM: ... ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 2 3 freeradius/radius.example.com(a)EXAMPLE.COM (DES cbc mode with RSA-MD5) 3 3 freeradius/radius.example.com(a)EXAMPLE.COM (ArcFour with HMAC/md5) ktutil: wkt radius.keytab ktutil: q # 4. Configure rlm_krb5 Configure rlm_krb5 to use the correct keytable and service principal: modules { ... krb5 { keytab = ${confdir}/radius.keytab service_principal = freeradius/radius.example.com } ... } ... authenticate { Auth-Type krb { krb5 } } Of course, you will have to set Auth-Type := krb somehow. 5. Authorization Additionally, rlm_ldap should/could be used for authorization purposes with AD. Currently, rlm_ldap seems to support simple bind only, so the kerberos setup from above can't be used to authenticate rlm_ldap to ADS via GSSAPI yet.

1 0

Automatic report from sources (radiusd) between 03.01.2006 - 04.01.2006 GMT
by Automatic cvs log generator 04 Jan '06

04 Jan '06

CVS log entries from 03.01.2006 (Tue) 09:00:01 - 04.01.2006 (Wed) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: fcusack File: radiusd/doc/ChangeLog; Revisions: 1.57.2.31.2.9 File: radiusd/src/modules/rlm_pam/rlm_pam.c; Revisions: 1.32.4.2 ===================================================== Log entries ===================================================== Description: rlm_pam changes Modified files: File: radiusd/doc/ChangeLog; Revision: 1.57.2.31.2.9; Date: 2006/01/04 05:55:19; Author: fcusack; Lines: (+2 -1) ------------------------------- Description: pull in changes from 1.39 (remove GET_MEM) Modified files: File: radiusd/src/modules/rlm_pam/rlm_pam.c; Revision: 1.32.4.2; Date: 2006/01/04 05:51:50; Author: fcusack; Lines: (+20 -16) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.57.2.31.2.9 Authors: fcusack (+2 -1) ------------------------------- File: radiusd/src/modules/rlm_pam/rlm_pam.c Revisions: 1.32.4.2 Authors: fcusack (+20 -16) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

rlm_pam updated
by Frank Cusack 04 Jan '06

04 Jan '06

I just pulled in the changes from HEAD for rlm_pam, into 1.1.0 and updated the ChangeLog. FYI in case things need to be tagged or something. -frank

1 0