October 2006 - Freeradius-Devel - lists.freeradius.org

Radiusd-radrelayd config file naming
by Peter Nixon 11 Oct '06

11 Oct '06

Hi Guys The attached 2 line patch makes radiusd load the config file matching the name that it is called with making the -n option unnecessary in many cases. This makes things simpler and makes "startproc" and family much simpler to use with radiusd. Example use: symlink radiusd to radrelay and then run radrelay and it will autoload radrelay.conf The -n command line option still overrides config file so everyone should be happy. If no-one has any complaints I plan to apply this to cvs head. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

6 10

Not restricting access to indicated huntgroup-name
by Jenny Ngo Gui 10 Oct '06

10 Oct '06

I don't know why, but for some reason, when the eap.tls.cn_check option in rad.conf is set to 0 (off), it could not restrict the access of users as stated in the users and huntgroups file. Despite the fact that certain users are set such that it would only be able to connect through one specific AP (Huntgroup-name = "Buffalo", as opposed to the other one having Huntgroup-name = "Cisco"), it seems to bypass this restriction when the eap.tls.cn_check option is turned off.. I'm not sure if this is a problem with freeradius, so I hope someone could shed some light on this matter.. Thanks

1 0

Not restricting access to indicated huntgroup-name
by Jenny Ngo Gui 10 Oct '06

10 Oct '06

I don't know why, but for some reason, when the eap.tls.cn_check option in rad.conf is set to 0 (off), it could not restrict the access of users as stated in the users and huntgroups file. Despite the fact that certain users are set such that it would only be able to connect through one specific AP (Huntgroup-name = "Buffalo", as opposed to the other one having Huntgroup-name = "Cisco"), it seems to bypass this restriction when the eap.tls.cn_check option is turned on.. I'm not sure if this is a problem with freeradius, so I hope someone could shed some light on this matter.. Thanks

1 0

Automatic report from sources (radiusd) between 09.10.2006 - 10.10.2006 GMT
by Automatic cvs log generator 10 Oct '06

10 Oct '06

CVS log entries from 09.10.2006 (Mon) 08:00:01 - 10.10.2006 (Tue) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/modcall.c; Revisions: 1.55, 1.54 ===================================================== Log entries ===================================================== Description: re-arrange the "apply priority" code so that it does so properly Update the debug printing so that it prints the childs name, and not the parents name Modified files: File: radiusd/src/main/modcall.c; Revision: 1.55; Date: 2006/10/09 21:01:50; Author: aland; Lines: (+33 -27) ------------------------------- Description: print out module return code, too. This appears to have been accidentally deleted Modified files: File: radiusd/src/main/modcall.c; Revision: 1.54; Date: 2006/10/09 20:39:37; Author: aland; Lines: (+6 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/modcall.c Revisions: 1.55, 1.54 Authors: aland (+33 -27), aland (+6 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

radrelay (mode) from cvs head
by Peter Nixon 10 Oct '06

10 Oct '06

Hi Guys I am testing radrelay from current cvs on a production server in the hope it will smooth out the traffic "bumps" however it seems to make them worse due to the way ot reads and sends huge chunks of packets to the backend (sql) at the same time. What happens when the following is logged? Is the packet deleted from the spool and dropped completely or is it sent again a little later? Wed Oct 4 10:05:37 2006 : Error: Dropping request (1024 is too many): from client UNKNOWN-CLIENT port 27272 - ID: 161 Wed Oct 4 10:05:37 2006 : Info: WARNING: Please check the radrelay.conf file. The value for 'max_requests' is probably set too low. I have set max_outstanding = 1 in an attempt to limit the number is requests but it doesn't seem to work. Basically I dont care is accounting requests are a few seconds late but they should always get to the sql server, and having > 1024 SQL sockets is unrealistic (Currently running with 50 but for this type of queued situation the fastest config SHOULD be 1-5 sockets depending on number of cpus and disks in the DB server). I am also running radrelay in single threaded mode in an attempt to slow it down. (That and the fact it crashes with "Error: Assertion failed in listen.c, line 620" when running threaded) Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

3 6

Automatic report from sources (radiusd) between 08.10.2006 - 09.10.2006 GMT
by Automatic cvs log generator 09 Oct '06

09 Oct '06

CVS log entries from 08.10.2006 (Sun) 08:00:01 - 09.10.2006 (Mon) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/doc/rlm_sqlippool; Revisions: 1.4 ===================================================== Log entries ===================================================== Description: spelling error Modified files: File: radiusd/doc/rlm_sqlippool; Revision: 1.4; Date: 2006/10/08 18:02:42; Author: pnixon; Lines: (+1 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rlm_sqlippool Revisions: 1.4 Authors: pnixon (+1 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Re: sqlippool error
by Peter Nixon 08 Oct '06

08 Oct '06

On Thu 05 Oct 2006 15:06, you wrote: > Hi Peter! > > I read your answer anywhere: sqlippool works fine, but my version > not work. i using debian sarge and > i downloaded and compiled freerdius 1.1.3 with mysql support and sqlippool > module. the output of radiusd -X ok, not error. > i use pppoe-server with radius, and if test user connecting to server, the > radius.log: > > Thu Oct 5 15:49:39 2006 : Error: sqlippool_command: database query error > Thu Oct 5 15:49:39 2006 : Error: sqlippool_query1: database query error > Thu Oct 5 15:49:39 2006 : Info: rlm_sqlippool: ip=[] len=0 > Thu Oct 5 15:49:39 2006 : Error: sqlippool_command: database query error > Thu Oct 5 15:49:42 2006 : Error: sqlippool_command: database query error > > what i do wrong? I believe the Debian packages need to be recompiled to enable Postgresql support. As the documentation says, sqlippool is currently only tested on Postgresql so if you are trying to use MySQL you will have to do a bit more work. http://wiki.freeradius.org/Rlm_sqlippool Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

Automatic report from sources (radiusd) between 06.10.2006 - 07.10.2006 GMT
by Automatic cvs log generator 07 Oct '06

07 Oct '06

CVS log entries from 06.10.2006 (Fri) 08:00:01 - 07.10.2006 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/exec.c; Revisions: 1.42.2.1.2.2 ===================================================== Log entries ===================================================== Description: Pull code from CVS head to split argv BEFORE radius_xlat, not before Modified files: File: radiusd/src/main/exec.c; Revision: 1.42.2.1.2.2; Date: 2006/10/06 23:39:21; Author: aland; Lines: (+224 -40) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/exec.c Revisions: 1.42.2.1.2.2 Authors: aland (+224 -40) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 05.10.2006 - 06.10.2006 GMT
by Automatic cvs log generator 06 Oct '06

06 Oct '06

CVS log entries from 05.10.2006 (Thu) 08:00:04 - 06.10.2006 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/packet.c; Revisions: 1.7, 1.6 Author: pnixon File: radiusd/suse/rcradius-relayd; Revisions: 1.5 ===================================================== Log entries ===================================================== Description: use struct sockaddr_storage, not struct sockaddr. Modified files: File: radiusd/src/lib/packet.c; Revision: 1.7; Date: 2006/10/05 22:01:47; Author: aland; Lines: (+10 -8) ------------------------------- Description: don't call librad_log Modified files: File: radiusd/src/lib/packet.c; Revision: 1.6; Date: 2006/10/05 21:35:18; Author: aland; Lines: (+2 -4) ------------------------------- Description: rename to radrelay Modified files: File: radiusd/suse/rcradius-relayd; Revision: 1.5; Date: 2006/10/05 13:19:08; Author: pnixon; Lines: (+1 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/packet.c Revisions: 1.7, 1.6 Authors: aland (+10 -8), aland (+2 -4) ------------------------------- File: radiusd/suse/rcradius-relayd Revisions: 1.5 Authors: pnixon (+1 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Radius-Client Access Request Password
by Johannes Luther 04 Oct '06

04 Oct '06

Hi all, I'm pretty new in that "Radius Business", so forgive me if I ask dumb questions. I see no chance, that someone could answer me my question in a Forum or in the normal mailing-list. I'm currenty developing a radius client class (Open-Source) in c#. I couldn't find something like that, but I need it to do certain things. Everything works fine and is clear regarding the construction of a radius paket, EXCEPT the ugly part of encrypting the user-password. I'm not talking about CHAP. The RFC's (http://www.freeradius.org/rfc/rfc2865.html#User-Password) sais the following: b1 = MD5(S + RA) c(1) = p1 xor b1 S is the Shared Secret RA is the random 16byte Request Authenticator and p1 is the first octet of the user password. For this example, the user password only has one byte (1 char) and the Shared Secret consists only of one char, too. Example: S = a (ASCII) p = b (ASCII) RA = EFB585C9F8CFB480B4F4B083B481E78E (HEX) 1.) How to do the operation (S+RA) ??? Do I have to convert the String a to a hex value (ASCII Table) ?? 2.) How to XOR the user password with b? OK ... the b is the easy part, because it's already a 16byte hex value... but how do I have to convert the user password (in this case "b") ? Is it a ASCII Conversion? if this would be the case, the char b is 0x62 hex. Could someone please explain that stuff to me? Kind regards, Joe

2 1