December 2006 - Freeradius-Devel - lists.freeradius.org

Reemission bug in multi-threaded mode - FreeRADIUS does not wake up properly
by Chaigneau Nicolas 12 Jan '07

12 Jan '07

FreeRADIUS 1.1.3 - Reemission bug in multi-threaded mode - FreeRADIUS does not wake up properly When receiving a request to proxy, FreeRADIUS should wake up in (at most) the proxied request retransmission delay parameter. This does not work. Note that in the case of the NAS reemitting the request, the problem does not appear, because when receiving new requests, FreeRADIUS wakes up and process its request list. The problem happens when a request is received, the request has to be proxied, but the NAS does not reemit (and no other request is received by FreeRADIUS from any NAS). The "wake up" delay is then set to 31 (probably max_request_time + 1) seconds instead of 5 (retry_delay), as we can see in debug mode: rad_recv: Accounting-Request packet from host *****:16384, id=233, length=53 Mon Nov 6 15:11:57 2006 : Debug: --- Walking the entire request list --- Mon Nov 6 15:11:57 2006 : Debug: Thread 4 got semaphore Mon Nov 6 15:11:57 2006 : Debug: Waking up in 31 seconds... Mon Nov 6 15:11:57 2006 : Debug: Thread 4 handling request 3, (1 handled so far) The behaviour is the same in normal (non debug) mode : the proxy server does only receive the request once, thus FreeRADIUS is not reemitting. In function refresh_request of file request_list.c, we should pass in the following condition : if (request->proxy && !request->proxy_reply) { ... (ie, request unfinished, but has been proxied and we are waiting for response from proxy server) It seems the condition is not met, so the next condition (ie, request unfinished but no proxy) is fulfilled. Thus, FreeRADIUS computes the time difference with: difference = (request->timestamp + mainconfig.max_request_time) - info->now; If FreeRADIUS is launched in single-thread mode (-X), the problem does not occur. It seems that "request->proxy" is 0 when the condition is tested, thus, FreeRADIUS considers there is no proxy outstanding for this request. From what I understand, when receiving a request, the thread that handles the list of requests wakes up, process its list and goes back to sleep. This thread finishes its work *before* the thread handling the request has proxied the request. This is the cause of the problem described above. Any hint as how to fix this ? (the problem is not critical: it appears on a test environment but will not happen in production, as a RADIUS server receives lots of requests) Should I log this in bugzilla ? Thanks. Best regards, Nicolas. ___________________________________________________________________________ Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international. Téléchargez sur http://fr.messenger.yahoo.com

3 2

Need help in writing a radius client
by Abhinay Sinha 06 Jan '07

06 Jan '07

Hi, I am planning to write an ISP billing server and gateway which communicates with a RADIUS server for AAA work. Can anybody please help me with the following: 1. I need an open source library for client. I found radiusclient-ng. Is it sufficient for work. 2. Can anybody please help me find some better documentation for working me with the library, i.e. details regarding its API, cause the docs provided with the library are minimal? 3. Can I get some sample code for client anywhere? Thanks in advance Abhinay

4 3

RE: [rlm_ldap] chase_referrals option
by Wileczek Michaël 30 Dec '06

30 Dec '06

> From: "Sandworm" <sandworm(a)mepd.hush.com> > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > On Friday, 29 December 2006 1:36 AM, Wileczek MichaÃ«l wrote: > > > > Since i was fighting with authentication on a Microsoft Active > > Directory (bad idea, i know) using referrals , i added an option > in > > rlm_ldap to > > enable/disable referral chasing during ldap requests. > > > > Here is the proposed patch : > > > <snip> > > That's not really necessary. See > http://lists.freeradius.org/pipermail/freeradius-users/2004-October/037218.… > > SW Modifying /etc/openldap/ldap.conf is a general configuration parameter. With the patch i provided, the option is switchable at the rlm_ldap module instance, therefore it allow using rlm_ldap in a mixed directories scheme. Michaël Wileczek System engineer - Technical Operations !TO-MCP-SSPI-IU-IW http://www.atosorigin.com Atos Wordline is an Atos Origin company : www.atosorigin.com Ce message est strictement confidentiel. Son intégrité n'est pas assurée sur Internet. Le contenu de ce message ne peut engager la responsabilité du groupe Atos Origin. Si vous n'êtes pas destinataire du message, merci d'en avertir immédiatement l'expéditeur et de le détruire. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis. This e-mail is privileged and may contain confidential information intended only for the person(s) named above. If you receive this e-mail in error, please notify the sender immediately by telephone or return e-mail. Although the sender endeavours to maintain a computer virus free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.

3 2

Re: Need help in writing a radius client
by Abhinay Sinha 29 Dec '06

29 Dec '06

Hi, Thanks for the comments. Anyways, I am not interested in radiusclient-ng specifically. I need a library to create a client to work with freeradius with some documentation of its API. On 12/29/06, Frank Cusack <fcusack(a)fcusack.com> wrote: > On December 29, 2006 2:07:09 AM +0530 Abhinay Sinha <sinhabhinay(a)gmail.com> > wrote: > > 1. I need an open source library for client. I found radiusclient-ng. > > Is it sufficient for work. > > Not sure why you are asking about non-freeradius software on a freeradius > mailing list. > > > 2. Can anybody please help me find some better documentation for > > working me with the library, i.e. details regarding its API, cause the > > docs provided with the library are minimal? > > Not sure why you are asking about non-freeradius software on a freeradius > mailing list. > > As to minimal docs, welcome to open source. > > > 3. Can I get some sample code for client anywhere? > > See radclient and radtest source in the freeradius distribution. Of > course this won't help you with radiusclient-ng. > > -frank > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html >

1 0

RE: [rlm_ldap] chase_referrals option
by Sandworm 29 Dec '06

29 Dec '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > On Friday, 29 December 2006 1:36 AM, Wileczek Michaël wrote: > > Since i was fighting with authentication on a Microsoft Active > Directory (bad idea, i know) using referrals , i added an option in > rlm_ldap to > enable/disable referral chasing during ldap requests. > > Here is the proposed patch : > <snip> That's not really necessary. See http://lists.freeradius.org/pipermail/freeradius-users/2004- October/037218.html SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkWUZIAACgkQmw4BJyaatJ3/qQCdER+kvVy+nYj0jh/aXSFq9xz2BmYA oIq+iZXExqJnq3X3nFmHtZjXDoRP =WX6x -----END PGP SIGNATURE-----

1 0

(no subject)
by Sandworm 29 Dec '06

29 Dec '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > On Friday, 29 December 2006 1:36 AM, Wileczek Michaël wrote: > > Since i was fighting with authentication on a Microsoft Active > Directory (bad idea, i know) using referrals , i added an option in > rlm_ldap to > enable/disable referral chasing during ldap requests. > > Here is the proposed patch : > <snip> That's not really necessary. See http://lists.freeradius.org/pipermail/freeradius-users/2004- October/037218.html SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkWUZCAACgkQmw4BJyaatJ3NYACgiG2jhwnBJZ2RH1StHRhwl+x2rXQA oIBr6QRCVE8VSGA31//2A9zPUXp8 =+S8c -----END PGP SIGNATURE-----

1 0

[rlm_ldap] chase_referrals option
by Wileczek Michaël 28 Dec '06

28 Dec '06

Since i was fighting with authentication on a Microsoft Active Directory (bad idea, i know) using referrals , i added an option in rlm_ldap to enable/disable referral chasing during ldap requests. Here is the proposed patch : ===patch=== --- rlm_ldap.c Thu Dec 28 15:30:43 2006 +++ new_rlm_ldap.c Thu Dec 28 15:30:56 2006 @@ -270,6 +270,7 @@ struct timeval net_timeout; struct timeval timeout; int debug; + int chase_referrals; int tls_mode; int start_tls; int num_conns; @@ -326,6 +327,7 @@ /* allow server unlimited time for search (server-side limit) */ {"timelimit", PW_TYPE_INTEGER, offsetof(ldap_instance,timelimit), NULL, "20"}, {"identity", PW_TYPE_STRING_PTR, offsetof(ldap_instance,login), NULL, ""}, + {"chase_referrals", PW_TYPE_BOOLEAN, offsetof(ldap_instance,chase_referrals), NULL, "yes"}, {"tls_mode", PW_TYPE_BOOLEAN, offsetof(ldap_instance,tls_mode), NULL, "no"}, {"start_tls", PW_TYPE_BOOLEAN, offsetof(ldap_instance,start_tls), NULL, "no"}, {"tls_cacertfile", PW_TYPE_STRING_PTR, offsetof(ldap_instance,tls_cacertfile), NULL, NULL}, @@ -1972,6 +1974,15 @@ } if (ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *) &(inst->net_timeout)) != LDAP_OPT_SUCCESS) { radlog(L_ERR, "rlm_ldap: Could not set LDAP_OPT_NETWORK_TIMEOUT %ld.%ld", inst->net_timeout.tv_sec, inst->net_timeout.tv_usec); + } + if(inst->chase_referrals) { + rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_ON); + } else { + rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF); + } + if (rc != LDAP_OPT_SUCCESS) { + ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ldap_errno); + radlog(L_ERR, "rlm_ldap: Could not set LDAP_OPT_REFERRALS %d %s", inst->chase_referrals, ldap_err2string(ldap_errno)); } if (ldap_set_option(ld, LDAP_OPT_TIMELIMIT, (void *) &(inst->timelimit)) != LDAP_OPT_SUCCESS) { radlog(L_ERR, "rlm_ldap: Could not set LDAP_OPT_TIMELIMIT %d", inst->timelimit); ===patch=== Michaël Wileczek System engineer - Technical Operations !TO-MCP-SSPI-IU-IW http://www.atosorigin.com Atos Wordline is an Atos Origin company : www.atosorigin.com Ce message est strictement confidentiel. Son intégrité n'est pas assurée sur Internet. Le contenu de ce message ne peut engager la responsabilité du groupe Atos Origin. Si vous n'êtes pas destinataire du message, merci d'en avertir immédiatement l'expéditeur et de le détruire. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis. This e-mail is privileged and may contain confidential information intended only for the person(s) named above. If you receive this e-mail in error, please notify the sender immediately by telephone or return e-mail. Although the sender endeavours to maintain a computer virus free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.

1 0

Automatic report from sources (radiusd) between 18.12.2006 - 19.12.2006 GMT
by Automatic cvs log generator 19 Dec '06

19 Dec '06

CVS log entries from 18.12.2006 (Mon) 09:00:00 - 19.12.2006 (Tue) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revisions: 1.15.2.2.2.2 File: radiusd/doc/ChangeLog; Revisions: 1.57.2.31.2.31 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.188.2.4.2.14 File: radiusd/man/man5/rlm_pap.5; Revisions: 1.3.4.1 ===================================================== Combined list of identical log entries ===================================================== Description: Updated functionality for rlm_pap Modified files: File: radiusd/man/man5/rlm_pap.5; Revision: 1.3.4.1; Date: 2006/12/19 00:35:57; Author: aland; Lines: (+117 -10) File: radiusd/raddb/radiusd.conf.in; Revision: 1.188.2.4.2.14; Date: 2006/12/19 00:35:57; Author: aland; Lines: (+21 -8) File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revision: 1.15.2.2.2.2; Date: 2006/12/19 00:35:58; Author: aland; Lines: (+667 -197) ===================================================== Log entries ===================================================== Description: Note changes to rlm_pap Modified files: File: radiusd/doc/ChangeLog; Revision: 1.57.2.31.2.31; Date: 2006/12/19 00:37:15; Author: aland; Lines: (+3 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.57.2.31.2.31 Authors: aland (+3 -1) ------------------------------- File: radiusd/man/man5/rlm_pap.5 Revisions: 1.3.4.1 Authors: aland (+117 -10) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.188.2.4.2.14 Authors: aland (+21 -8) ------------------------------- File: radiusd/src/modules/rlm_pap/rlm_pap.c Revisions: 1.15.2.2.2.2 Authors: aland (+667 -197) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Help with Simultaneous Login on Freeradius+Ldap
by listasmw＠netconsult.inf.br 15 Dec '06

15 Dec '06

Hi, we are using FreeRadius 1.1.3 on Fedora Core 6 and the RLM_LDAP module, we're needing control simultaneous logins, eg. the ldap user "John" can authenticate only one time. When are monitoring the ldap users logins, they can log successfully in ldap, but we can't see or monitoring the users login in radutmp log file is empty with 0kb, when we execute the radwho command, it is empty but is opening. could you help me please? Regards, Maicon Wendhausen Freeradius Files Logs File: [root@firedap3 radius]# ls -la total 24 drwx------ 3 radiusd radiusd 4096 Dec 14 18:21 . drwxr-xr-x 10 root root 4096 Dec 14 19:06 .. drwx------ 3 radiusd radiusd 4096 Dec 14 19:55 radacct -rw------- 1 radiusd root 5357 Dec 14 20:03 radius.log -rw-r--r-- 1 radiusd root 0 Dec 14 18:21 radutmp -rw-r--r-- 1 radiusd root 0 Dec 14 18:21 radwtmp [root@firedap3 radius]# Log do Radius in Debug mode rad_recv: Access-Request packet from host 10.69.70.210:32771, id=87, length=63 User-Name = "user6" User-Password = "user6" NAS-IP-Address = 10.69.70.210 Service-Type = Authenticate-Only NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "user6", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 modcall[authorize]: module "digest" returns noop for request 2 users: Matched entry DEFAULT at line 222 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for user6 radius_xlat: '(uid=user6)' radius_xlat: 'dc=nct,dc=com,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=nct,dc=com,dc=br, with filter (uid=user6) rlm_ldap: Added password {SSHA}f21M8OjksIKSJ1zUEii6JWKu43tWPRFgsBeiQg== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user user6 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "user6" with password "user6" rlm_ldap: user DN: uid=user6,dc=nct,dc=com,dc=br rlm_ldap: (re)connect to 10.69.70.25:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=user6,dc=nct,dc=com,dc=br/user6 to 10.69.70.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user user6 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 2 modcall: leaving group LDAP (returns ok) for request 2 Processing the session section of radiusd.conf modcall: entering group session for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'user6' modcall[session]: module "radutmp" returns ok for request 2 modcall: leaving group session (returns ok) for request 2 Login OK: [user6] (from client firepass port 0) Sending Access-Accept of id 87 to 10.69.70.210 port 32771 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... users file #...... DEFAULT Simultaneous-Use := 1 Fall-Through = 1 clients.conf file .... default configuration..... client 10.69.70.210 { secret = teste shortname = firepass } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { radutmp { filename = ${logdir}/radutmp ## username = "(uid=%{Stripped-User-Name:-%{User-Name}})" username = %{User-Name} case_sensitive = "yes" check_with_nas = "yes" perm = "0644" callerid = "no" } pap { encryption_scheme = crypt } chap { authtype = CHAP } #$INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = no } ldap { server="10.69.70.25" identity="uid=gged,dc=nct,dc=com,dc=br" password=ged basedn="dc=nct,dc=com,dc=br" filter = (uid=%{Stripped-User-Name:-%{User-Name}}) ## filter= (uid=gged,dc=nct,dc=com,dc=br) password_attribute = userPassword dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 150 ldap_cache_size = 0 ldap_connections_number = 1 timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no } realm suffix { format = suffix delimiter = "@" } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { #key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" key = "User-Name, Acct-Session-Id, NAS-IP-Address" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr # daily } authorize { #preprocess # auth_log # attr_filter chap mschap suffix digest # ntdomain #eap # Read the 'users' file files ldap # daily # checkval } authenticate { Auth-Type PAP { pap ldap } Auth-Type CHAP { chap ldap } Auth-Type MS-CHAP { mschap ldap } Auth-Type LDAP { ldap } } preacct { preprocess acct_unique suffix # Read the 'acct_users' file #files } accounting { detail # daily # # For Simultaneous-Use tracking. # radutmp # sradutmp # main_pool } session { radutmp # sql } post-auth { } pre-proxy { } post-proxy { }

1 0

Automatic report from sources (radiusd) between 14.12.2006 - 15.12.2006 GMT
by Automatic cvs log generator 15 Dec '06

15 Dec '06

CVS log entries from 14.12.2006 (Thu) 09:00:01 - 15.12.2006 (Fri) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/src/lib/udpfromto.c; Revisions: 1.9 File: radiusd/src/main/smux.c; Revisions: 1.21 ===================================================== Log entries ===================================================== Description: Include "autoconf.h" before testing the macro WITH_UDPFROMTO. Modified files: File: radiusd/src/lib/udpfromto.c; Revision: 1.9; Date: 2006/12/14 14:20:01; Author: nbk; Lines: (+4 -4) ------------------------------- Description: Include "autoconf.h" before testing the macro WITH_SNMP. Modified files: File: radiusd/src/main/smux.c; Revision: 1.21; Date: 2006/12/14 14:20:36; Author: nbk; Lines: (+3 -4) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/udpfromto.c Revisions: 1.9 Authors: nbk (+4 -4) ------------------------------- File: radiusd/src/main/smux.c Revisions: 1.21 Authors: nbk (+3 -4) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0