October 2006 - Freeradius-Devel - lists.freeradius.org

Automatic report from sources (radiusd) between 25.10.2006 - 27.10.2006 GMT
by Automatic cvs log generator 15 Nov '06

15 Nov '06

CVS log entries from 25.10.2006 (Wed) 08:00:01 - 27.10.2006 (Fri) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revisions: 1.36, 1.21.4.11 ===================================================== Combined list of identical log entries ===================================================== Description: Removed double free. This fixes bug #404 Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.36; Date: 2006/10/26 17:12:49; Author: aland; Lines: (+1 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.21.4.11; Date: 2006/10/26 17:13:04; Author: aland; Lines: (+1 -2) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c Revisions: 1.36, 1.21.4.11 Authors: aland (+1 -2), aland (+1 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

4 8

Re : Re : Bug on Accouting-Requests proxying
by Geoffroy Arnoud 02 Nov '06

02 Nov '06

> > Maybe can you explain us why it SHOULD NOT retransmit accounting packets? > Because the NAS will retransmit them. Having the proxying server > re-transmit them, too is unecessary. I agree on this. Nevertheless (correct me if I'm wrong), when FreeRADIUS acts as a proxy, it can be synchronous or asynchronous, right? We are developping a RADIUS proxy interconnecting many clients to many servers. We need to proxy both authentication and accounting requests. We need to set different timeout and retransmit per realm (customer request / patch under contruction). Using NAS restransmissions as you suggest supposes to be synchronous, but we need asynchronous behaviour (different TO / retries per realm - independant from the client). > If the server logs them locally, and then uses something like > "radrelay" to proxy them, then radrelay should take care of the > retransmits. Using radrelay may prove to be interesting, but was not considered useful because, at design time, we thought FreeRADIUS did respect RFC regarding retransmissions of accounting requests. Maybe in a future release of the project, we can think about using radrelay, but not for the moment. > > Our implementations of FreeRADIUS need to retransmit all types of packets > Why? For accounting requests, if retransmissions are not managed, this may result in billing issues for operators. Interconnection rules tell that if more than a number a accounting interim are missing, then it means that end-user session is over and that session can be terminated and billed. If session is not really terminated, this leads to a revenue loss. I hope that you understand the context and our concerns. Nevertheless, we are not in position to tell you what to do or not in the server, but we hope that such a modification (no proxy of accounting) will be marked as a major update of the server in the release notes. Best regards and thank you for your great opensource. Geof. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 2

Re : Bug on Accouting-Requests proxying
by Geoffroy Arnoud 30 Oct '06

30 Oct '06

> The solution is simple. The server SHOULD NOT retransmit accounting > packets. I will delete the code in the next release. Maybe can you explain us why it SHOULD NOT retransmit accounting packets? Are you talking of not retransmiting at all - or computing a new ID for retransmitted packets? Can one think of a configuration parameter to activate/deactivate retransmission of accounting packets instead of completely removing the code? Our implementations of FreeRADIUS need to retransmit all types of packets, so I think we may remove Acct-Delay-Time attribute and submit a patch - even if the patch is not shipped in future releases. Geof. ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

2 1

post-auth module
by Manuel Sánchez Cuenca 30 Oct '06

30 Oct '06

Hello all. I have developed a freeradius module which I want to be executed only after a successful authentication, therefore I have put it in the post-auth section. But the problem is that the module is being execute two times. This is the freeradius log: ------------------------------------------------------------------------------------------- Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 8 ********************************** rlm_my_module ********************************** * modcall[post-auth]: module "nassaml_authz" returns ok for request 8 modcall: leaving group post-auth (returns ok) for request 8 PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS modcall[authenticate]: module "eap" returns handled for request 8 modcall: leaving group authenticate (returns handled) for request 8 *Sending Access-Challenge *of id 0 to 155.54.205.100 port 2048 . . . rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group authenticate (returns ok) for request 9 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 9 ********************************** rlm_my_module *********************************** El usuario para autenticar es [lolo] El servidor con el que comunicarnos es [155.54.205.229:5555] La decision ha sido: 1 modcall[post-auth]: module "nassaml_authz" returns ok for request 9 modcall: leaving group post-auth (returns ok) for request 9 *Sending Access-Accept* of id 0 to 155.54.205.100 port 2048 ------------------------------------------------------------------------------------------- I can't understand why, after execute the first time the post auth section, an access-challenge is sent, instead of an Access-Accept, such as in the second time this section is executed. Can anybody help me? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

1 0

Bug on Accouting-Requests proxying
by Geoffroy Arnoud 29 Oct '06

29 Oct '06

FreeRADIUS 1.1.3 bug - Accounting requests reemission by FreeRADIUS In file "main\request_list.c", function "refresh_request". In the case of an accounting request (request->proxy->code == PW_ACCOUNTING_REQUEST), FreeRADIUS adds to the proxied packet the attribute "Acct-Delay-Time" (or updates it, if it was present in previous emission) with value set to the time difference between current time and time of initial proxied request. According to RFC 2866, chapter 4.1 : "The Identifier field MUST be changed whenever the content of the Attributes field changes, and whenever a valid reply has been received for a previous request. For retransmissions where the contents are identical, the Identifier MUST remain unchanged. Note that if Acct-Delay-Time is included in the attributes of an Accounting-Request then the Acct-Delay-Time value will be updated when the packet is retransmitted, changing the content of the Attributes field and requiring a new Identifier and Request Authenticator." FreeRADIUS updates the content of the packet when reemitting the accounting request, but does not change the Identifier. Thus, those packets sent after the first one are *not* true reemissions. This is a problem to us. For instance, we have the following setup : A client (A) sending an accounting request to FreeRADIUS (B), which retransmits the request to a proxy FreeRADIUS server (C). FreeRADIUS C is slow to respond, so FreeRADIUS B reemits the request, with different packet attributes (Acct-Delay-Time added), but keeps the same identifier. FreeRADIUS C receives the second request, but discards it since it has the same identifier as the request currently being processed. FreeRADIUS C then decides to finally respond (to the first request). FreeRADIUS B receives this response, and verifies if the request (the reemission) and response match. They do not, thus FreeRADIUS B drops the response and logs an error. FreeRADIUS should either : - NOT add Acct-Delay-Time attribute in accounting reemissions, thus preserving the content of the attributes in the packet. - or, add an Acct-Delay-Time, but change the identifier and handle the proxied packet as a new request. The second solution seems overly complicated, because FreeRADIUS would have to handle the second proxied request as a completely new request, but would also have keep the first one, as the proxy server can respond to any of the reemissions. The first solution is very simple to correct: it simply involves removing the block "if (request->proxy->code == PW_ACCOUNTING_REQUEST) {" in function "refresh_request" of file "main\request_list.c". I don't know if Acct-Delay-Time attribute is really useful to someone, I've never seen it used in any implementation of a RADIUS server. Anyhow, it seems way too much hassle to correctly handle this attribute in accounting reemissions. If tehre is any any objection, we will develop a patch to remove Acct-Delay-Time and provide it soon. Best regards, Geoff. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

FreeRadius module
by Manuel Sánchez Cuenca 26 Oct '06

26 Oct '06

Hello all. I'm interested in include an authorization module in freeradius which will be executed after an authentication success, but before send the success message to the AP and the user. Can anybody help me telling me how to create a new module for freeradius? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

2 1

Automatic report from sources (radiusd) between 23.10.2006 - 24.10.2006 GMT
by Automatic cvs log generator 24 Oct '06

24 Oct '06

CVS log entries from 23.10.2006 (Mon) 08:00:01 - 24.10.2006 (Tue) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: fcusack File: radiusd/src/modules/rlm_otp/otp_mppe.h; Revisions: 1.1.2.3 File: radiusd/src/modules/rlm_otp/ident.h; Revisions: 1.1.2.2 File: radiusd/src/modules/rlm_otp/otp_radstate.c; Revisions: 1.4.2.4 File: radiusd/src/modules/rlm_otp/extern.h; Revisions: 1.1.2.3 File: radiusd/src/modules/rlm_otp/otp_rlm.c; Revisions: 1.19.2.12, 1.19.2.11 File: radiusd/src/modules/rlm_otp/otp_pw_valid.h; Revisions: 1.3, 1.1.2.4, 1.1.2.3 File: radiusd/src/modules/rlm_otp/otp_pwe.c; Revisions: 1.8.2.4 File: radiusd/src/modules/rlm_otp/otp_util.c; Revisions: 1.13.2.3 File: radiusd/doc/ChangeLog; Revisions: 1.75 File: radiusd/src/modules/rlm_otp/Makefile.in; Revisions: 1.9, 1.4.2.5 File: radiusd/src/modules/rlm_otp/otp_mppe.c; Revisions: 1.1.2.3 File: radiusd/raddb/otppasswd.sample; Revisions: 1.4.2.3 File: radiusd/raddb/otp.conf; Revisions: 1.4.2.3 File: radiusd/src/modules/rlm_otp/otp_pw_valid.c; Revisions: 1.5, 1.4, 1.1.2.7, 1.1.2.6, 1.1.2.5 File: radiusd/src/modules/rlm_otp/otp.h; Revisions: 1.28.2.8 ===================================================== Combined list of identical log entries ===================================================== Description: otp_putfd(): add disconnect arg, to allow just mutex release, avoiding fd leak in radiusd and otpd otp_verify(): otp_putfd(fdp, 0) on successful return, otp_putfd(fdp, 1) on 2 error return cases that we missed Modified files: File: radiusd/src/modules/rlm_otp/otp_pw_valid.c; Revision: 1.5; Date: 2006/10/24 04:02:37; Author: fcusack; Lines: (+15 -9) File: radiusd/src/modules/rlm_otp/otp_pw_valid.h; Revision: 1.3; Date: 2006/10/24 04:02:38; Author: fcusack; Lines: (+3 -3) ------------------------------- Description: import from HEAD: otp_putfd(): add disconnect arg, to allow just mutex release, avoiding fd leak in radiusd and otpd otp_verify(): otp_putfd(fdp, 0) on successful return, otp_putfd(fdp, 1) on 2 error return cases that we missed Modified files: File: radiusd/src/modules/rlm_otp/otp_pw_valid.c; Revision: 1.1.2.5; Date: 2006/10/24 04:38:04; Author: fcusack; Lines: (+15 -9) File: radiusd/src/modules/rlm_otp/otp_pw_valid.h; Revision: 1.1.2.3; Date: 2006/10/24 04:38:04; Author: fcusack; Lines: (+2 -2) ------------------------------- Description: import from HEAD prevent rcsid from being optimized out Modified files: File: radiusd/src/modules/rlm_otp/extern.h; Revision: 1.1.2.3; Date: 2006/10/24 05:15:45; Author: fcusack; Lines: (+4 -1) File: radiusd/src/modules/rlm_otp/ident.h; Revision: 1.1.2.2; Date: 2006/10/24 05:15:46; Author: fcusack; Lines: (+35 -0) File: radiusd/src/modules/rlm_otp/otp.h; Revision: 1.28.2.8; Date: 2006/10/24 05:15:46; Author: fcusack; Lines: (+3 -4) File: radiusd/src/modules/rlm_otp/otp_mppe.c; Revision: 1.1.2.3; Date: 2006/10/24 05:15:46; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_mppe.h; Revision: 1.1.2.3; Date: 2006/10/24 05:15:46; Author: fcusack; Lines: (+4 -1) File: radiusd/src/modules/rlm_otp/otp_pw_valid.c; Revision: 1.1.2.7; Date: 2006/10/24 05:15:47; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_pw_valid.h; Revision: 1.1.2.4; Date: 2006/10/24 05:15:47; Author: fcusack; Lines: (+4 -1) File: radiusd/src/modules/rlm_otp/otp_pwe.c; Revision: 1.8.2.4; Date: 2006/10/24 05:15:47; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_radstate.c; Revision: 1.4.2.4; Date: 2006/10/24 05:15:48; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_rlm.c; Revision: 1.19.2.12; Date: 2006/10/24 05:15:48; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_util.c; Revision: 1.13.2.3; Date: 2006/10/24 05:15:48; Author: fcusack; Lines: (+3 -2) ===================================================== Log entries ===================================================== Description: document rlm_otp fd leak fix Modified files: File: radiusd/doc/ChangeLog; Revision: 1.75; Date: 2006/10/24 04:20:54; Author: fcusack; Lines: (+2 -1) ------------------------------- Description: typo Modified files: File: radiusd/raddb/otp.conf; Revision: 1.4.2.3; Date: 2006/10/24 04:34:24; Author: fcusack; Lines: (+1 -1) ------------------------------- Description: no longer used Modified files: File: radiusd/raddb/otppasswd.sample; Revision: 1.4.2.3; Date: 2006/10/24 04:33:53; Author: fcusack; Lines: (+0 -0) ------------------------------- Description: add new header ident.h Modified files: File: radiusd/src/modules/rlm_otp/Makefile.in; Revision: 1.9; Date: 2006/10/24 05:33:01; Author: fcusack; Lines: (+1 -1) ------------------------------- Description: import from HEAD add new header ident.h Modified files: File: radiusd/src/modules/rlm_otp/Makefile.in; Revision: 1.4.2.5; Date: 2006/10/24 05:36:08; Author: fcusack; Lines: (+1 -1) ------------------------------- Description: remove trailing "\n"s from some radlog() calls Modified files: File: radiusd/src/modules/rlm_otp/otp_pw_valid.c; Revision: 1.4; Date: 2006/10/24 03:19:06; Author: fcusack; Lines: (+10 -11) ------------------------------- Description: import from HEAD: remove trailing "\n" from some radlog() calls Modified files: File: radiusd/src/modules/rlm_otp/otp_pw_valid.c; Revision: 1.1.2.6; Date: 2006/10/24 04:40:58; Author: fcusack; Lines: (+10 -11) ------------------------------- Description: import from HEAD: s/bad state/bad radstate/ to be clear that it's not token state Modified files: File: radiusd/src/modules/rlm_otp/otp_rlm.c; Revision: 1.19.2.11; Date: 2006/10/24 04:45:13; Author: fcusack; Lines: (+8 -8) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.75 Authors: fcusack (+2 -1) ------------------------------- File: radiusd/raddb/otp.conf Revisions: 1.4.2.3 Authors: fcusack (+1 -1) ------------------------------- File: radiusd/raddb/otppasswd.sample Revisions: 1.4.2.3 Authors: fcusack (+0 -0) ------------------------------- File: radiusd/src/modules/rlm_otp/Makefile.in Revisions: 1.9, 1.4.2.5 Authors: fcusack (+1 -1), fcusack (+1 -1) ------------------------------- File: radiusd/src/modules/rlm_otp/extern.h Revisions: 1.1.2.3 Authors: fcusack (+4 -1) ------------------------------- File: radiusd/src/modules/rlm_otp/ident.h Revisions: 1.1.2.2 Authors: fcusack (+35 -0) ------------------------------- File: radiusd/src/modules/rlm_otp/otp.h Revisions: 1.28.2.8 Authors: fcusack (+3 -4) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_mppe.c Revisions: 1.1.2.3 Authors: fcusack (+3 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_mppe.h Revisions: 1.1.2.3 Authors: fcusack (+4 -1) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_pw_valid.c Revisions: 1.5, 1.4, 1.1.2.7, 1.1.2.6, 1.1.2.5 Authors: fcusack (+15 -9), fcusack (+10 -11), fcusack (+3 -2), fcusack (+10 -11), fcusack (+15 -9) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_pw_valid.h Revisions: 1.3, 1.1.2.4, 1.1.2.3 Authors: fcusack (+3 -3), fcusack (+4 -1), fcusack (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_pwe.c Revisions: 1.8.2.4 Authors: fcusack (+3 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_radstate.c Revisions: 1.4.2.4 Authors: fcusack (+3 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_rlm.c Revisions: 1.19.2.12, 1.19.2.11 Authors: fcusack (+3 -2), fcusack (+8 -8) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_util.c Revisions: 1.13.2.3 Authors: fcusack (+3 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Identity problem and MSK, EMSK management
by kky 22 Oct '06

22 Oct '06

Hi ! i have 2 main problem, i've tried to find the solutions mostly in rfc's and googleing around but without results !! i hope the questions are not to stupid ... ; ) 1) i'm developing and auth module for eap where the real identity of the user is passed in the 3rd message ( in eap response identity there is a fictitious string "anonymous" ) so i had to add an if( .. ) statement in eap_start() that says something like that : if memcmp(request->username, "anonymous" ...) && eap type is the one i'm developing set attribute User-Name in request->username and in request->packet->vps to the real identity (found in the packet receved). And all goes well : rlm_sql finds the user in the db and gets all the attributes from radreply table , so i can access them from handler->request->reply->vps. The protocol continues but when a new response comes from the supplicant the NAS, i suppose, sets the attribute User-Name to "anonymous", is there a way to tell the NAS to change the value of User-Name to the correct one ?! the problem is that next messages will not get anymore the right user because the section above will set the User-Name to something without sense ... suggestions ? 2) the protocol derives also MSK and EMSK but i don't know where to put them ! i have seen that eap_sim_sendsuccess(EAP_HANDLER *handler) sets 2 proprietary valuepairs in handler->request->reply->vps (MS-MPPE-Recv-Key , MS-MPPE-Send-Key)... should i do something like this ? with which attribute should i tell the NAS for the keys ? Thank you ! kky

2 1

Automatic report from sources (radiusd) between 20.10.2006 - 21.10.2006 GMT
by Automatic cvs log generator 21 Oct '06

21 Oct '06

CVS log entries from 20.10.2006 (Fri) 08:00:01 - 21.10.2006 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/log.c; Revisions: 1.52 File: radiusd/src/include/libradius.h; Revisions: 1.124 File: radiusd/src/main/modcall.c; Revisions: 1.56 File: radiusd/src/lib/log.c; Revisions: 1.12 Author: pnixon File: radiusd/doc/examples/postgresql.sql; Revisions: 1.9 ===================================================== Combined list of identical log entries ===================================================== Description: fix stdarg.h Modified files: File: radiusd/src/include/libradius.h; Revision: 1.124; Date: 2006/10/20 18:41:11; Author: aland; Lines: (+2 -1) File: radiusd/src/lib/log.c; Revision: 1.12; Date: 2006/10/20 18:41:11; Author: aland; Lines: (+2 -3) File: radiusd/src/main/log.c; Revision: 1.52; Date: 2006/10/20 18:41:12; Author: aland; Lines: (+2 -3) File: radiusd/src/main/modcall.c; Revision: 1.56; Date: 2006/10/20 18:41:12; Author: aland; Lines: (+1 -2) ===================================================== Log entries ===================================================== Description: Cleanup Modified files: File: radiusd/doc/examples/postgresql.sql; Revision: 1.9; Date: 2006/10/20 15:14:03; Author: pnixon; Lines: (+7 -7) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/examples/postgresql.sql Revisions: 1.9 Authors: pnixon (+7 -7) ------------------------------- File: radiusd/src/include/libradius.h Revisions: 1.124 Authors: aland (+2 -1) ------------------------------- File: radiusd/src/lib/log.c Revisions: 1.12 Authors: aland (+2 -3) ------------------------------- File: radiusd/src/main/log.c Revisions: 1.52 Authors: aland (+2 -3) ------------------------------- File: radiusd/src/main/modcall.c Revisions: 1.56 Authors: aland (+1 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Enabling login of users who are not in the users database and yet whose certificates are still valid.
by Jenny Ngo Gui 21 Oct '06

21 Oct '06

I just like to ask if there any other alternative means to support this feature, without the need to remove the [DEFAULT Auth-Type := Reject] part of the users database? or is this necessary to support the login of users who are not in the users database and yet whose certificates are still valid...? Please do tell me if you have any other kind of implementation in mind for this feature, as it conflicts with the huntgroup restriction of users... Thank you!

1 0

radeapclient won't build from cvs head
by Garber, Neal 20 Oct '06

20 Oct '06

I'm getting Undefined references to va_start in src/modules/rlm_eap/radeapclient.c because stdarg.h is no longer included (previously, it was included via radeapclient.c->eap_types.h->radiusd.h).

3 2

patch - support for stored procedures (MySQL 5.0.25 and later)
by Nenad Kljajic 20 Oct '06

20 Oct '06

This patch adds support for stored procedures for those who use MySQL 5.0.25+ (http://bugs.mysql.com/bug.php?id=15752) eg. in sql.conf you can do: authorize_check_query = "CALL Pradcheck('%{SQL-User-Name}');" with procedure declaration: SET AUTOCOMMIT=0; DELIMITER | DROP PROCEDURE IF EXISTS Pradcheck | CREATE PROCEDURE Pradcheck ( `SQL-User-Name` varchar(256) )BEGIN START TRANSACTION; SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = `SQL-User-Name` ORDER BY id; COMMIT; END; | DELIMITER ; etc. Tested on FreeBSD 6.1 freeradius port 1.1.2

1 0

Automatic report from sources (radiusd) between 19.10.2006 - 20.10.2006 GMT
by Automatic cvs log generator 20 Oct '06

20 Oct '06

CVS log entries from 19.10.2006 (Thu) 08:00:01 - 20.10.2006 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: fcusack File: radiusd/src/modules/rlm_otp/otp_mppe.h; Revisions: 1.2 File: radiusd/src/modules/rlm_otp/ident.h; Revisions: 1.1 File: radiusd/src/modules/rlm_otp/otp_radstate.c; Revisions: 1.8 File: radiusd/src/modules/rlm_otp/extern.h; Revisions: 1.2 File: radiusd/src/modules/rlm_otp/otp_rlm.c; Revisions: 1.32 File: radiusd/src/modules/rlm_otp/otp_pw_valid.h; Revisions: 1.2 File: radiusd/src/modules/rlm_otp/otp_pwe.c; Revisions: 1.11 File: radiusd/src/modules/rlm_otp/otp_util.c; Revisions: 1.16 File: radiusd/src/modules/rlm_otp/otp_mppe.c; Revisions: 1.2 File: radiusd/src/modules/rlm_otp/otp.h; Revisions: 1.36 File: radiusd/src/modules/rlm_otp/otp_pw_valid.c; Revisions: 1.3 ===================================================== Combined list of identical log entries ===================================================== Description: prevent rcsid from being optimized out Modified files: File: radiusd/src/modules/rlm_otp/extern.h; Revision: 1.2; Date: 2006/10/20 05:12:07; Author: fcusack; Lines: (+4 -1) File: radiusd/src/modules/rlm_otp/ident.h; Revision: 1.1; Date: 2006/10/20 05:12:08; Author: fcusack; File: radiusd/src/modules/rlm_otp/otp.h; Revision: 1.36; Date: 2006/10/20 05:12:08; Author: fcusack; Lines: (+3 -4) File: radiusd/src/modules/rlm_otp/otp_mppe.c; Revision: 1.2; Date: 2006/10/20 05:12:08; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_mppe.h; Revision: 1.2; Date: 2006/10/20 05:12:08; Author: fcusack; Lines: (+4 -1) File: radiusd/src/modules/rlm_otp/otp_pw_valid.c; Revision: 1.3; Date: 2006/10/20 05:12:08; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_pw_valid.h; Revision: 1.2; Date: 2006/10/20 05:12:08; Author: fcusack; Lines: (+4 -1) File: radiusd/src/modules/rlm_otp/otp_pwe.c; Revision: 1.11; Date: 2006/10/20 05:12:09; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_radstate.c; Revision: 1.8; Date: 2006/10/20 05:12:09; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_rlm.c; Revision: 1.32; Date: 2006/10/20 05:12:09; Author: fcusack; Lines: (+3 -2) File: radiusd/src/modules/rlm_otp/otp_util.c; Revision: 1.16; Date: 2006/10/20 05:12:09; Author: fcusack; Lines: (+3 -2) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_otp/extern.h Revisions: 1.2 Authors: fcusack (+4 -1) ------------------------------- File: radiusd/src/modules/rlm_otp/ident.h Revisions: 1.1 Authors: fcusack ------------------------------- File: radiusd/src/modules/rlm_otp/otp.h Revisions: 1.36 Authors: fcusack (+3 -4) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_mppe.c Revisions: 1.2 Authors: fcusack (+3 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_mppe.h Revisions: 1.2 Authors: fcusack (+4 -1) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_pw_valid.c Revisions: 1.3 Authors: fcusack (+3 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_pw_valid.h Revisions: 1.2 Authors: fcusack (+4 -1) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_pwe.c Revisions: 1.11 Authors: fcusack (+3 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_radstate.c Revisions: 1.8 Authors: fcusack (+3 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_rlm.c Revisions: 1.32 Authors: fcusack (+3 -2) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_util.c Revisions: 1.16 Authors: fcusack (+3 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

FreeRadius - NIS
by Dagoberto Carvalio Junior 19 Oct '06

19 Oct '06

Expensive friends, I am with authentication problem, being that I opted to using the FreeRadius. I ask for the gentility you to answer if the FreeRadius has support to catch the base of users of a server NIS. It forgives for my English, therefore I am Brazilian. Until more, and thanks. Dagoberto Carvalio Junior Analyst Systems - Universidade de São Paulo. -- ######################################################## Dagoberto Carvalio Junior - CCNA/CCAI/FCPF/FCPM/SCS Analista de Sistemas Instituto de Ciencias Matematicas e de Computacao UNIVERSIDADE DE SAO PAULO USER LINUX #417157 EMail : dago(a)icmc.usp.br Tel : 55 16 3373-9652 ########################################################

1 0

Automatic report from sources (radiusd) between 18.10.2006 - 19.10.2006 GMT
by Automatic cvs log generator 19 Oct '06

19 Oct '06

CVS log entries from 18.10.2006 (Wed) 08:00:02 - 19.10.2006 (Thu) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c; Revisions: 1.9, 1.5.4.1 File: radiusd/raddb/eap.conf; Revisions: 1.4.4.4 File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_fbapi.c; Revisions: 1.1, 1.1.2.1 File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure; Revisions: 1.1, 1.1.2.1 File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c; Revisions: 1.28, 1.17.2.2.2.3 File: radiusd/src/modules/rlm_mschap/rlm_mschap.c; Revisions: 1.59.2.3.2.3 File: radiusd/src/modules/rlm_digest/rlm_digest.c; Revisions: 1.24 File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_firebird.c; Revisions: 1.1, 1.1.2.1 File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_fbapi.h; Revisions: 1.1, 1.1.2.1 File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure.in; Revisions: 1.1, 1.1.2.1 Author: fcusack File: radiusd/raddb/otppasswd.sample; Revisions: 1.6 File: radiusd/raddb/otp.conf; Revisions: 1.6 ===================================================== Combined list of identical log entries ===================================================== Description: Send MS-CHAP2-Success, which makes EAP-TTLS/MSCHAP work This closes bug #402 Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c; Revision: 1.5.4.1; Date: 2006/10/18 21:49:47; Author: aland; Lines: (+9 -1) File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c; Revision: 1.17.2.2.2.3; Date: 2006/10/18 21:49:47; Author: aland; Lines: (+1 -11) ------------------------------- Description: Added preliminary code to support Firebird. Untested! This closes bug #378 Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure; Revision: 1.1.2.1; Date: 2006/10/18 21:03:11; Author: aland; Lines: (+3575 -0) File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure.in; Revision: 1.1.2.1; Date: 2006/10/18 21:03:12; Author: aland; Lines: (+103 -0) File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_fbapi.c; Revision: 1.1.2.1; Date: 2006/10/18 21:03:12; Author: aland; Lines: (+404 -0) File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_fbapi.h; Revision: 1.1.2.1; Date: 2006/10/18 21:03:13; Author: aland; Lines: (+53 -0) File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_firebird.c; Revision: 1.1.2.1; Date: 2006/10/18 21:03:13; Author: aland; Lines: (+276 -0) ------------------------------- Description: Send MS-CHAP2-Success, which makes EAP-TTLS/MSCHAP work. This closes bug #402 Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c; Revision: 1.9; Date: 2006/10/18 21:51:16; Author: aland; Lines: (+9 -1) File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c; Revision: 1.28; Date: 2006/10/18 21:51:16; Author: aland; Lines: (+1 -11) ===================================================== Log entries ===================================================== Description: Pull notes from CVS head Modified files: File: radiusd/raddb/eap.conf; Revision: 1.4.4.4; Date: 2006/10/18 19:15:14; Author: aland; Lines: (+29 -1) ------------------------------- Description: typo Modified files: File: radiusd/raddb/otp.conf; Revision: 1.6; Date: 2006/10/19 07:55:56; Author: fcusack; Lines: (+1 -1) ------------------------------- Description: no longer appropriate Modified files: File: radiusd/raddb/otppasswd.sample; Revision: 1.6; Date: 2006/10/19 07:56:10; Author: fcusack; Lines: (+0 -0) ------------------------------- Description: Check return codes. This fixes bug #394 Modified files: File: radiusd/src/modules/rlm_digest/rlm_digest.c; Revision: 1.24; Date: 2006/10/18 19:12:20; Author: aland; Lines: (+10 -4) ------------------------------- Description: Print ntlm_auth failure reason in Module-Failure-Message This closes bug #398, in this branch Modified files: File: radiusd/src/modules/rlm_mschap/rlm_mschap.c; Revision: 1.59.2.3.2.3; Date: 2006/10/18 21:11:09; Author: aland; Lines: (+17 -2) ------------------------------- Description: file configure was initially added on branch branch_1_1. Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure; Revision: 1.1; Date: 2006/10/18 21:03:11; Author: aland; ------------------------------- Description: file configure.in was initially added on branch branch_1_1. Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure.in; Revision: 1.1; Date: 2006/10/18 21:03:11; Author: aland; ------------------------------- Description: file sql_fbapi.c was initially added on branch branch_1_1. Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_fbapi.c; Revision: 1.1; Date: 2006/10/18 21:03:12; Author: aland; ------------------------------- Description: file sql_fbapi.h was initially added on branch branch_1_1. Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_fbapi.h; Revision: 1.1; Date: 2006/10/18 21:03:12; Author: aland; ------------------------------- Description: file sql_firebird.c was initially added on branch branch_1_1. Modified files: File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_firebird.c; Revision: 1.1; Date: 2006/10/18 21:03:13; Author: aland; ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/eap.conf Revisions: 1.4.4.4 Authors: aland (+29 -1) ------------------------------- File: radiusd/raddb/otp.conf Revisions: 1.6 Authors: fcusack (+1 -1) ------------------------------- File: radiusd/raddb/otppasswd.sample Revisions: 1.6 Authors: fcusack (+0 -0) ------------------------------- File: radiusd/src/modules/rlm_digest/rlm_digest.c Revisions: 1.24 Authors: aland (+10 -4) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c Revisions: 1.9, 1.5.4.1 Authors: aland (+9 -1), aland (+9 -1) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c Revisions: 1.28, 1.17.2.2.2.3 Authors: aland (+1 -11), aland (+1 -11) ------------------------------- File: radiusd/src/modules/rlm_mschap/rlm_mschap.c Revisions: 1.59.2.3.2.3 Authors: aland (+17 -2) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure Revisions: 1.1, 1.1.2.1 Authors: aland, aland (+3575 -0) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure.in Revisions: 1.1, 1.1.2.1 Authors: aland, aland (+103 -0) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_fbapi.c Revisions: 1.1, 1.1.2.1 Authors: aland, aland (+404 -0) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_fbapi.h Revisions: 1.1, 1.1.2.1 Authors: aland, aland (+53 -0) ------------------------------- File: radiusd/src/modules/rlm_sql/drivers/rlm_sql_firebird/sql_firebird.c Revisions: 1.1, 1.1.2.1 Authors: aland, aland (+276 -0) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

How to configure multi nas
by Enkhbat.N 18 Oct '06

18 Oct '06

Hi All I have those problems. Please help to solve the problems 1. How to configure many NASes on one RADIUS? 2. How to setting user's connection NAS. Example Special users are connected on Primary NAS and other users are connected on Secondary NAS. Is it possibility? Best Regard, E.N

2 1

How to obtain username and User-Password in a module
by Juan Luis Perez Perez 18 Oct '06

18 Oct '06

Hi, I'm coding a basic authorization module for FreeRadius, and i have a problem. When FreeRadius tries to authenticate says that: rlm_digest: Configuration item "User-Password" is required for authentication. Here is the function that do athorization in the module: static int xml_rpc_auth(void *instance, REQUEST *request) { int result; VALUE_PAIR **input_pairs, **output_pairs; VALUE_PAIR *answer, *check_pairs; rlm_xml_rpc_t *inst = (rlm_xml_rpc_t *) instance; int accept; const char username[1000], password[1000], realm[1000]; char cadena[1000]; char usrn[1000], pw[1000], rm[1000]; VALUE_PAIR *vpr, *vpd; DICT_ATTR *dict_attr; result = vp_prints(cadena, 1000, request->config_items); if ( result ) radlog(L_ERR, "En vp_prints config_items: %s", cadena); if ( request->config_items->next != NULL ) result = vp_prints(cadena, 1000, request->config_items->next); if ( result ) radlog(L_ERR, "En vp_prints config_items->next: %s", cadena); radlog(L_ERR, "En vp_prints_value request->packet->code: %d", request->packet->code); strcpy(username, request->username->strvalue); radlog(L_ERR, "En vp_prints_value username: %s", username); if ( request->password ){ strcpy(password, request->password->strvalue); radlog(L_ERR, "En vp_prints_value password: %s", password); //result = vp_prints_value(password, 1000, request->password, 254); } radlog(L_ERR, "Atribute del password: %s", request->password->name); /* * We require access to the plain-text password. */ if( request->packet->vps ){ vpr = pairfind(request->packet->vps, PW_DIGEST_REALM); if (!vpr) { radlog(L_AUTH, "rlm_xml_rpc: Configuration item\"Realm\" is required for" "authentication."); } } if ( vpr ){ strcpy(realm, vpr->strvalue); radlog(L_ERR, "rlm_xml_rpc: XML-RPC %d %p %p %p\n",accept, username, password, realm); result = xml_rpc_call(inst, request, &accept, username, password, realm, usrn, pw, rm); radlog(L_ERR, "rlm_xml_rpc: XML-RPC %d %s %s %s\n",accept, username, password, realm); radlog(L_ERR, "PW segun xml_rpc_call es %s\n", pw); vpr = rad_malloc(sizeof(VALUE_PAIR)); dict_attr = rad_malloc(sizeof(DICT_ATTR)); if(vpr && dict_attr){ dict_attr = dict_attrbyname("User-Password"); strcpy(vpr->name, "User-Password"); vpr->attribute = dict_attr->attr; vpr->type = dict_attr->type; vpr->length = strlen(pw); strcpy(vpr->strvalue, pw); vpr->flags = dict_attr->flags; vpr->operator = T_OP_EQ; radlog(L_ERR, "rlm_xml_rpc: creando el VALUE_PAIR con el password para meterlo en request->config" "y requerido para la authenticacion" "vpr->name = %s\n" "vpr->attribute = %d\n" "vpr->type = %d\n" "vpr->length = %d\n" "vpr->strvalue = %s\n", vpr->name, vpr->attribute, vpr->type, vpr->length, vpr->strvalue); } radlog(L_ERR, "rlm_xml_rpc: qué hay? %s %s %s", username, password, realm); if ( accept ) request->config_items = vpr; return RLM_MODULE_OK; } }

2 1

Re: proxy DEFAULT realm bug-o-feature?
by Mike 18 Oct '06

18 Oct '06

> > I placed the following into my preproxy_users file: > > > > DEFAULT Realm != "NULL" > > NAS-IP-Address := `%{Realm}` > > > > But instead of the expected result, I am observing: > > Could you please explain wat the "expected result" is? > > Realm is a string. NAS-IP-Address is an IP address. What do you > expect it to do, and why? Why are you trying to configure it this > way? What are you trying to do? Alan, Stefan, My RADIUS server is a third party POS that relies on NAS-IP-Address to match up the origin of the RADIUS request with the Realm it belongs to. This presents an obvious problem when one device needs to be used from multiple Realms. To further complicate the issue, the originating device has no way to convey the Realm outside of the User-Name field. I am using FreeRADIUS as a proxy between the device that has control over User-Name and RADIUS server that decies what Realm to use based on NAS-IP-Address. The configuration on the device allows me to put: some_user1(a)10.0.0.1 and some_user1(a)10.0.0.2 FreeRADIUS receives this request, strips off the Realm, and substitues the Realm (10.0.0.x) into the NAS-IP-Address field. When RADIUS server receives the request, it is able to properly handle it in the appropriate Realm by finding the realm with the correct IP address. The above example has two Realms. In reality I have 40+ and growing. I can solve it by copying and pasting: realm 10.0.0.1 { ... } realm 10.0.0.2 { ... } ... realm 10.0.0.40 { ... } 40 times and update in the future when I need more. Instead, I tried to be "smarter" by using the default realm, that way I need to only have a single realm statement in config and it will work "forever". When I did this, I find that the suffix module is actually returning the string DEFAULT instead of actual Realm name, so the real Realm name is lost and can not be used in the preproxy_user rules (in my case to put it into the NAS-IP-Address field.) I hope the explanation above makes sense. Thanks in advance for your help (and a great RADIUS proxy server: it works (seemingly) flawlessly as long as DEFAULT is not used.)

3 2

proxy DEFAULT realm bug-o-feature?
by Mike 17 Oct '06

17 Oct '06

I placed the following into my preproxy_users file: DEFAULT Realm != "NULL" NAS-IP-Address := `%{Realm}` But instead of the expected result, I am observing: NAS-IP-Address := 255.255.255.255 in the proxied requests. This seems hardly intuitive, but I can't quite figure out if this is a bug or a feature. If this is a feature, how can I "save" the Realm from being clobbered by the word DEFAULT? If this is a bug, a fix would certainly be nice...

3 2

SQL usergroup table
by Peter Nixon 17 Oct '06

17 Oct '06

Is there any reason why the "usergroup" table is not calle d"radgroup" by default to fit with the other radius tables? -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

4 6

Re: proxy DEFAULT realm bug-o-feature?
by Mike 17 Oct '06

17 Oct '06

> > DEFAULT Realm != "NULL" > > NAS-IP-Address := `%{Realm}` > > > > But instead of the expected result, I am observing: > > > > NAS-IP-Address := 255.255.255.255 > > You are assigning a string value to an attribute that carries an IP address. > Sounds like a less-than-perfect idea to me. Stefan, Actually, in my situation I know that realm will always be an IP address. However when using the "realm DEFAULT {}" configuration, I want the Realm variable to be set to the IP address, but instead, it appears to be set to the word "DEFAULT". So I am asking what is a way to overcome this bug (or feature, I'm still not sure which it is.)

2 1

module for deleting attributes
by Lars Ricken 16 Oct '06

16 Oct '06

How can I understand you developed module for deleting attributes from incoming radius requests. Can You send it to me via email or give a link where I can download it.It's very important for me. Thanks.

2 1

Automatic report from sources (radiusd) between 14.10.2006 - 15.10.2006 GMT
by Automatic cvs log generator 15 Oct '06

15 Oct '06

CVS log entries from 14.10.2006 (Sat) 08:00:04 - 15.10.2006 (Sun) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/raddb/sql.conf; Revisions: 1.57 ===================================================== Log entries ===================================================== Description: Further cleanup of the config file Modified files: File: radiusd/raddb/sql.conf; Revision: 1.57; Date: 2006/10/14 16:02:53; Author: pnixon; Lines: (+35 -31) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sql.conf Revisions: 1.57 Authors: pnixon (+35 -31) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

help
by Bolivar Soriano 14 Oct '06

14 Oct '06

I have the freeradius working just fine; it's saving the record in a text file, but I want to send the record to a mssql table; I already create the table in the DB required, but every time when I take out the comment from sql command I got an error. Can send me an step by step help or, an example of the two o three files that I have to modify. Thx Bolivar Soriano

3 4

IGNORE: nologin on 7.x
by Mike 14 Oct '06

14 Oct '06

Sorry all, last message was intended for a different mailing list, please disregard.

1 0