November 2006 - Freeradius-Devel - lists.freeradius.org

Re: update user vp
by j6969＠inwind.it 12 Nov '06

12 Nov '06

> "j6969\(a)inwind\.it" <j6969(a)inwind.it> wrote: > > Hi all, i'm developing an authentication module. I need to associate > > a radom value to each user, what i did is create a new value pair, > > but i don't know if i can update that vp from my auth module, if yes > > could you make me an example of module that does that ? or a hint > > would be nice ;-) > > rlm_example? ops sorry ! i was thinking on updating a value pair in the SQL database; can i fetch it, work with it, assign a new value and store it in the db. Is there an example about that ? thanks > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html >

3 2

update user vp
by j6969＠inwind.it 09 Nov '06

09 Nov '06

Hi all, i'm developing an authentication module. I need to associate a radom value to each user, what i did is create a new value pair, but i don't know if i can update that vp from my auth module, if yes could you make me an example of module that does that ? or a hint would be nice ;-) if that is not possible maybe i could use a file but it doesen't seem so nice, suggestions ? thank you! Alex ------------------------------------------------------ Nuovo MOTOROLA MOTOKRZR K1. Superficie a specchio, fotocamera da 2 Megapixel e lettore MP3 integrato.Clicca e vinci ! http://click.libero.it/motorola9nov

2 1

Another patch for X509 validation
by Juan C. Sanchez-DelBarrio 09 Nov '06

09 Nov '06

Hi again, I follow with the idea of the other developer. In our organization, we need that you can filter not only using check_cert_cn if not using organizational-unit (O) of the DN. Firstly, we propose the following patch using external script where you can define your own filter. Best Regards, -- Juan C. Sanchez-DelBarrio Security Officer Barcelona Supercomputing Center http://www.bsc.es

3 3

Re: Reemission bug in multi-threaded mode - FreeRADIUS does not wake up properly
by Chaigneau Nicolas 08 Nov '06

08 Nov '06

> > It seems that "request->proxy" is 0 when the condition is tested, > > thus, FreeRADIUS considers there is no proxy outstanding for this > > request. > > Yes. It's an issue, but a minor one. The solution is to always > make the server synchronous, which has been done in the CVS head. > > Alan DeKok. I agree this is a minor issue. Setting up the serveur in synchronous mode is much simpler, although I think we would lose a few features that we need. Detecting a proxy server is dead and failover to a backup server is important to us. In the current 1.1.3 version, failover is possible only in asynchronous mode. Will failover still be possible in the next release of FreeRADIUS ? Also, we need to detect that a given proxied request did not receive any response, in order to send back a specific response to the NAS (Reject or Accept). Would it be possible in synchronous mode ? Will the possibility to choose between synchronous and asynchronous remain in the CVS head, or do you plan to completely remove asynchronous mode ? One more point about synchronous mode : currently, timeout and retries parameters are global to FreeRADIUS in the "proxy server" configuration section. If the retransmission mode is synchronous, wouldn't these parameters have to be defined per NAS, for instance in the clients.conf file ? each NAS can have different values for these settings. Nicolas. ___________________________________________________________________________ Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international. Téléchargez sur http://fr.messenger.yahoo.com

1 0

Suggest the following patch for LDAP+EAP-TTLS+PAP+CRYPT
by Juan C. Sanchez-DelBarrio 06 Nov '06

06 Nov '06

Hi all, I propose the following patch to use EAP-TTLS+PAP+LDAP with CRYPT PASSWORD. This feature would permit us to cipher the plain password in LDAP using CRYPT hash and compare the CRYPT hash of user password from LDAP with PAP authentication (crypt). Best Regards, -- Juan C. Sanchez-DelBarrio Security Officer Barcelona Supercomputing Center http://www.bsc.es

3 4

Automatic report from sources (radiusd) between 05.11.2006 - 06.11.2006 GMT
by Automatic cvs log generator 06 Nov '06

06 Nov '06

CVS log entries from 05.11.2006 (Sun) 09:00:01 - 06.11.2006 (Mon) 09:00:02 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/doc/rlm_sqlcounter; Revisions: 1.5 File: radiusd/man/man5/rlm_counter.5; Revisions: 1.2 File: radiusd/man/man5/rlm_attr_filter.5; Revisions: 1.3 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.235 File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revisions: 1.30 File: radiusd/src/modules/rlm_counter/rlm_counter.c; Revisions: 1.54 File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c; Revisions: 1.31 ===================================================== Combined list of identical log entries ===================================================== Description: Document the new "reply-name" directive. Modified files: File: radiusd/doc/rlm_sqlcounter; Revision: 1.5; Date: 2006/11/05 19:56:40; Author: nbk; Lines: (+3 -0) File: radiusd/man/man5/rlm_counter.5; Revision: 1.2; Date: 2006/11/05 19:56:39; Author: nbk; Lines: (+4 -0) File: radiusd/raddb/radiusd.conf.in; Revision: 1.235; Date: 2006/11/05 19:56:40; Author: nbk; Lines: (+8 -6) ===================================================== Log entries ===================================================== Description: Add "post-auth" to the list of valid sections for this module. Modified files: File: radiusd/man/man5/rlm_attr_filter.5; Revision: 1.3; Date: 2006/11/05 15:35:08; Author: nbk; Lines: (+3 -2) ------------------------------- Description: It isn't very useful to filter attributes in the incoming request, nothing will happen as any unexpected attribute will not be checked during authorize. Moreover the current attr_filter_authorize() function behave differently than in previous releases of FreeRADIUS, because it used to run in the deprecated post_proxy_authorize mode only. Therefore it's certainly less error-prone to remove a long time ago deprecated function, instead of changing its behaviour. Modified files: File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c; Revision: 1.31; Date: 2006/11/05 19:59:50; Author: nbk; Lines: (+3 -8) ------------------------------- Description: Change "return-attribute" to "reply-name" for consistency with rlm_sqlcounter. There is no backward compatibility problem because this directive doesn't exist in any release yet. Modified files: File: radiusd/src/modules/rlm_counter/rlm_counter.c; Revision: 1.54; Date: 2006/11/05 19:55:11; Author: nbk; Lines: (+16 -15) ------------------------------- Description: Add a new "reply-name" directive to choose the attribute which will contain the remaining value for the counter in the reply packet when the user is successfully authorized. (closes: #403) Thanks to Jonathan De Graeve <jonathan(a)imelda.be> Modified files: File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revision: 1.30; Date: 2006/11/05 19:54:24; Author: nbk; Lines: (+31 -6) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rlm_sqlcounter Revisions: 1.5 Authors: nbk (+3 -0) ------------------------------- File: radiusd/man/man5/rlm_attr_filter.5 Revisions: 1.3 Authors: nbk (+3 -2) ------------------------------- File: radiusd/man/man5/rlm_counter.5 Revisions: 1.2 Authors: nbk (+4 -0) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.235 Authors: nbk (+8 -6) ------------------------------- File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c Revisions: 1.31 Authors: nbk (+3 -8) ------------------------------- File: radiusd/src/modules/rlm_counter/rlm_counter.c Revisions: 1.54 Authors: nbk (+16 -15) ------------------------------- File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c Revisions: 1.30 Authors: nbk (+31 -6) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 04.11.2006 - 05.11.2006 GMT
by Automatic cvs log generator 05 Nov '06

05 Nov '06

CVS log entries from 04.11.2006 (Sat) 09:00:01 - 05.11.2006 (Sun) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/man/man8/radsqlrelay.8; Revisions: 1.3 File: radiusd/scripts/radsqlrelay; Revisions: 1.7 ===================================================== Combined list of identical log entries ===================================================== Description: Add a new "-f" option to read the password from a file, instead of command line. (closes: #395) Thanks to Jakub Wartak <vnull(a)pcnet.com.pl> Modified files: File: radiusd/man/man8/radsqlrelay.8; Revision: 1.3; Date: 2006/11/04 12:58:14; Author: nbk; Lines: (+4 -0) File: radiusd/scripts/radsqlrelay; Revision: 1.7; Date: 2006/11/04 12:58:14; Author: nbk; Lines: (+15 -3) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/man/man8/radsqlrelay.8 Revisions: 1.3 Authors: nbk (+4 -0) ------------------------------- File: radiusd/scripts/radsqlrelay Revisions: 1.7 Authors: nbk (+15 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Re : Re : Bug on Accouting-Requests proxying
by Geoffroy Arnoud 02 Nov '06

02 Nov '06

> > Maybe can you explain us why it SHOULD NOT retransmit accounting packets? > Because the NAS will retransmit them. Having the proxying server > re-transmit them, too is unecessary. I agree on this. Nevertheless (correct me if I'm wrong), when FreeRADIUS acts as a proxy, it can be synchronous or asynchronous, right? We are developping a RADIUS proxy interconnecting many clients to many servers. We need to proxy both authentication and accounting requests. We need to set different timeout and retransmit per realm (customer request / patch under contruction). Using NAS restransmissions as you suggest supposes to be synchronous, but we need asynchronous behaviour (different TO / retries per realm - independant from the client). > If the server logs them locally, and then uses something like > "radrelay" to proxy them, then radrelay should take care of the > retransmits. Using radrelay may prove to be interesting, but was not considered useful because, at design time, we thought FreeRADIUS did respect RFC regarding retransmissions of accounting requests. Maybe in a future release of the project, we can think about using radrelay, but not for the moment. > > Our implementations of FreeRADIUS need to retransmit all types of packets > Why? For accounting requests, if retransmissions are not managed, this may result in billing issues for operators. Interconnection rules tell that if more than a number a accounting interim are missing, then it means that end-user session is over and that session can be terminated and billed. If session is not really terminated, this leads to a revenue loss. I hope that you understand the context and our concerns. Nevertheless, we are not in position to tell you what to do or not in the server, but we hope that such a modification (no proxy of accounting) will be marked as a major update of the server in the release notes. Best regards and thank you for your great opensource. Geof. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 2

Automatic report from sources (radiusd) between 31.10.2006 - 01.11.2006 GMT
by Automatic cvs log generator 01 Nov '06

01 Nov '06

CVS log entries from 31.10.2006 (Tue) 09:00:01 - 01.11.2006 (Wed) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/raddb/sql/postgresql-voip-postpaid.conf; Revisions: 1.2 File: radiusd/raddb/sql/postgresql-dialup.conf; Revisions: 1.2 ===================================================== Log entries ===================================================== Description: This was a BUG. Acct-Delay-Time can be subtracted from the time of arrival on the server to find the approximate time of the event generating this Accounting-Request. I must NOT be subtracted from the Session-Time! Modified files: File: radiusd/raddb/sql/postgresql-dialup.conf; Revision: 1.2; Date: 2006/10/31 14:38:42; Author: pnixon; Lines: (+2 -3) ------------------------------- Description: All tables should start with "rad" Modified files: File: radiusd/raddb/sql/postgresql-voip-postpaid.conf; Revision: 1.2; Date: 2006/10/31 15:00:10; Author: pnixon; Lines: (+1 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sql/postgresql-dialup.conf Revisions: 1.2 Authors: pnixon (+2 -3) ------------------------------- File: radiusd/raddb/sql/postgresql-voip-postpaid.conf Revisions: 1.2 Authors: pnixon (+1 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0