March 2006 - Freeradius-Devel - lists.freeradius.org

Crypt-Password
by Guy Fraser 13 Mar '06

13 Mar '06

I finally had some time to do some testing on FreeBSD. Some things have changed, for sure. Isn't it redundant to require ; Auth-Type := Crypt-Local and Crypt-Password == "..." for encrypted passwords and or Auth-Type := Local and User-Password == "..." for clear text passwords? Auth-Type:=Local used to work with User-Password for clear text and Crypt-Password for encrypted passwords. I remember vaguely there was some discussion about this or NT-Passwords and SHA-Passwords but I can't seem to find it. It will make transitioning to or from clear text passwords a bit more difficult.

2 1

Encrypted passwords
by Vishwanath Srikant Pattanshetti 10 Mar '06

10 Mar '06

Hello All I am using Freeradius1.1.0 with Oracle 10 in my project for user authentication. I need to store encrypted passwords in the database - I would be using Java code to access the database for this purpose. However, I will be sending the password in clear text, to the jradius api to form the access request. This may sound strange, but its true. Is there any way, I can support, such a scenario? - ie. Can I instruct FreeRadius to execute some code(java preferably) before comparing the passwords?? Can some one please point me to some documentation? Or advise me, so that I can go ahead in this regard. Thanks in advance. -Vishwa.

1 0

need info regarding Reply-Message
by Vishwanath Srikant Pattanshetti 10 Mar '06

10 Mar '06

Hello All I am using Freeradius 1.1.0 with Oracle. I want to return a reply-message for all failed authentications. How should I configure this? Do I need to handle it through the query - select the reply-message if password does not match? Any information, or pointer to the same would be of great help. Thanks in advance -Vishwa.

1 0

Solaris9 Configure Issue (1.1.0)
by Chris Parker 09 Mar '06

09 Mar '06

In src/modules/rlm_sql/drivers/rlm_sql_mysql/config.log It's not detecting properly that Solaris9 also needs "-lm -lz" ( math and compression functions ) to link with the MySQL libs: ... configure:971: checking for mysql_init in -lmysqlclient_r configure:988: gcc -o conftest -m64 -D_REENTRANT - D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG conftest.c -L/usr/local/mysql/lib - lmysqlclient_r -lpthread -lnsl -lresolv -lsocket -lposix4 -lpthread 1>&5 Undefined first referenced symbol in file floor /usr/local/mysql/lib/ libmysqlclient_r.a(libmysql.o) uncompress /usr/local/mysql/lib/ libmysqlclient_r.a(my_compress.o) compress /usr/local/mysql/lib/ libmysqlclient_r.a(my_compress.o) Is this fixed in HEAD/1.1.1? -Chris -- Chris Parker Director, Engineering StarNet A Service of US LEC (888)212-0099 Fax (847)963-1302 Wholesale Internet Services http://www.megapop.net VoiceEclipse, The Fresh Alternative http://www.voiceeclipse.com NOTICE: Message is sent IN CONFIDENCE to addressees. It may contain information that is privileged, proprietary or confidential.

1 0

how can i use the table 'nas' in the database instead of the clients.conf file
by 陈旭 09 Mar '06

09 Mar '06

Hello, everybody! I have a lot of clients, whose addresses are 192.168.x.x, 172.x.x.x, ..., every time a new client goes online, i have to configure it in the clients.conf file and what mostly make me sick is i have to restart my radius server again and again. Any body tell how to use the table 'nas' in the database instead of the clients.conf file? Thanks a lot, and have a good weekend.^_^ Kernal Chan

2 1

rlm_eap_tls restrict issuer
by Benjamin Bennett 09 Mar '06

09 Mar '06

Is there already a way to accept certs only from a particular issuer? For example, if we have a root CA (A), that issues another CA cert (B), from which our client certs will be issued, our CA_file must contain both A & B certs to validate our clients. However, certs issued directly from A will then also be valid. I'm about to add a check_cert_issuer (PW_TYPE_STRING_PTR) config option set to the DN of the issuer we want to use, and a string compare in cbtls_verify() just before the check_cert_cn happens. Does that sound about right? --ben

2 2

Automatic report from sources (radiusd) between 08.03.2006 - 09.03.2006 GMT
by Automatic cvs log generator 09 Mar '06

09 Mar '06

CVS log entries from 08.03.2006 (Wed) 09:00:05 - 09.03.2006 (Thu) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/doc/ChangeLog; Revisions: 1.57.2.31.2.13 File: radiusd/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c; Revisions: 1.15 ===================================================== Log entries ===================================================== Description: Minor re-arrangement Modified files: File: radiusd/doc/ChangeLog; Revision: 1.57.2.31.2.13; Date: 2006/03/08 22:39:51; Author: aland; Lines: (+13 -8) ------------------------------- Description: Removed silly use of magic cvs $ Log $ stuff Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c; Revision: 1.15; Date: 2006/03/08 23:14:14; Author: aland; Lines: (+1 -68) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.57.2.31.2.13 Authors: aland (+13 -8) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c Revisions: 1.15 Authors: aland (+1 -68) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

AcctStopDelay
by Peter Nixon 09 Mar '06

09 Mar '06

Does anyone disagree that AcctStopDelay should always equal 0 in these queries? accounting_onoff_query = "UPDATE ${acct_table1} \ SET AcctStopTime = (now() - '%{Acct-Delay-Time:-0}'::interval), \ AcctSessionTime = (EXTRACT(EPOCH FROM(now()::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, \ AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time:-0}' \ WHERE AcctSessionTime IS NULL AND AcctStopTime IS NULL AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= now()" accounting_update_query = "UPDATE ${acct_table1} \ SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, \ AcctSessionTime = (EXTRACT(EPOCH FROM(now()::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{Acct-Delay-Time:-0 }'::interval)))::BIGINT, \ AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), \ AcctOutputOctets = (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint) \ WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL" Note: I am the one who added originally modified the Postgres query to make AcctSessionTime not include Acct-Delay-Time in the first place to save post calculation in reports. (The default queries for other DBs do not do this currently) It also occurs to me that now() should probably be %S as now() will skew if the database is lagged or queries are being relayed somewhere else.. I guess the question is what is it that we want to default DB queries to do. Should they be faithfully logging the received radius accounting as closely as possible or should they be trying to give as correct a CDR as possible (Which is probably what the end user wants) In my opinion doing a little extra arithmetic upon reception of a packet is a fair tradeoff if it lets the user do a simple "select * from radacct" or something to that effect when they need to do reporting (Instead of trying to calculate out delay etc each time they do the report.) -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 1

Release 1.1.1 todo
by Alan DeKok 08 Mar '06

08 Mar '06

Hmm... never mind my EAP comments. It looks like I didn't do a "cvs update" Alan DeKok.

1 0

Automatic report from sources (radiusd) between 07.03.2006 - 08.03.2006 GMT
by Automatic cvs log generator 08 Mar '06

08 Mar '06

CVS log entries from 07.03.2006 (Tue) 09:00:02 - 08.03.2006 (Wed) 09:00:05 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.168, 1.122.2.8.2.5 File: radiusd/share/dictionary.erx; Revisions: 1.13, 1.9.4.2 File: radiusd/doc/ChangeLog; Revisions: 1.57.2.31.2.12 File: radiusd/src/lib/radius.c; Revisions: 1.179, 1.125.2.5.2.4 File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c; Revisions: 1.11, 1.8.4.1 File: radiusd/src/include/radius.h; Revisions: 1.80, 1.66.4.2 File: radiusd/src/main/radclient.c; Revisions: 1.98, 1.97, 1.72.2.1.2.4 File: radiusd/share/dictionary.freeradius.internal; Revisions: 1.10, 1.6.2.5 ===================================================== Combined list of identical log entries ===================================================== Description: Change CoF-* to CoA-*, because that's the proper name. Update radclient to allow sending coa requests update radius.c to clear the request vector, as per RFC 3576. This closes bug #344 Modified files: File: radiusd/share/dictionary.freeradius.internal; Revision: 1.10; Date: 2006/03/07 18:04:24; Author: aland; Lines: (+8 -4) File: radiusd/src/include/radius.h; Revision: 1.80; Date: 2006/03/07 18:04:24; Author: aland; Lines: (+4 -4) File: radiusd/src/lib/radius.c; Revision: 1.179; Date: 2006/03/07 18:04:25; Author: aland; Lines: (+12 -11) File: radiusd/src/main/radclient.c; Revision: 1.97; Date: 2006/03/07 18:04:26; Author: aland; Lines: (+7 -3) ------------------------------- Description: Pull CoA fixes from the head Modified files: File: radiusd/share/dictionary.freeradius.internal; Revision: 1.6.2.5; Date: 2006/03/07 18:10:09; Author: aland; Lines: (+7 -1) File: radiusd/src/include/radius.h; Revision: 1.66.4.2; Date: 2006/03/07 18:10:08; Author: aland; Lines: (+4 -4) File: radiusd/src/lib/radius.c; Revision: 1.125.2.5.2.4; Date: 2006/03/07 18:10:09; Author: aland; Lines: (+12 -11) File: radiusd/src/main/radclient.c; Revision: 1.72.2.1.2.4; Date: 2006/03/07 18:10:10; Author: aland; Lines: (+8 -4) ------------------------------- Description: Pull fix from the head Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c; Revision: 1.8.4.1; Date: 2006/03/07 18:38:17; Author: aland; Lines: (+6 -1) File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.122.2.8.2.5; Date: 2006/03/07 18:46:42; Author: aland; Lines: (+4 -2) ===================================================== Log entries ===================================================== Description: Updated for latest set of changes Modified files: File: radiusd/doc/ChangeLog; Revision: 1.57.2.31.2.12; Date: 2006/03/08 00:01:48; Author: aland; Lines: (+6 -1) ------------------------------- Description: Updates for 7.1. Patch from bug #315 Modified files: File: radiusd/share/dictionary.erx; Revision: 1.13; Date: 2006/03/07 23:44:27; Author: aland; Lines: (+28 -3) ------------------------------- Description: Pull fix from CVS head Modified files: File: radiusd/share/dictionary.erx; Revision: 1.9.4.2; Date: 2006/03/07 23:45:02; Author: aland; Lines: (+28 -3) ------------------------------- Description: Document coa Modified files: File: radiusd/src/main/radclient.c; Revision: 1.98; Date: 2006/03/07 18:05:33; Author: aland; Lines: (+4 -4) ------------------------------- Description: Additional sanity checks Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c; Revision: 1.11; Date: 2006/03/07 18:38:04; Author: aland; Lines: (+6 -1) ------------------------------- Description: Added debug message when setting Auth-Type Modified files: File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.168; Date: 2006/03/07 18:43:47; Author: aland; Lines: (+4 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.57.2.31.2.12 Authors: aland (+6 -1) ------------------------------- File: radiusd/share/dictionary.erx Revisions: 1.13, 1.9.4.2 Authors: aland (+28 -3), aland (+28 -3) ------------------------------- File: radiusd/share/dictionary.freeradius.internal Revisions: 1.10, 1.6.2.5 Authors: aland (+8 -4), aland (+7 -1) ------------------------------- File: radiusd/src/include/radius.h Revisions: 1.80, 1.66.4.2 Authors: aland (+4 -4), aland (+4 -4) ------------------------------- File: radiusd/src/lib/radius.c Revisions: 1.179, 1.125.2.5.2.4 Authors: aland (+12 -11), aland (+12 -11) ------------------------------- File: radiusd/src/main/radclient.c Revisions: 1.98, 1.97, 1.72.2.1.2.4 Authors: aland (+4 -4), aland (+7 -3), aland (+8 -4) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c Revisions: 1.11, 1.8.4.1 Authors: aland (+6 -1), aland (+6 -1) ------------------------------- File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.168, 1.122.2.8.2.5 Authors: aland (+4 -2), aland (+4 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0