July 2006 - Freeradius-Devel - lists.freeradius.org

radrelay integration & other issues
by Alan DeKok 10 Jul '06

10 Jul '06

I've been looking into the issues surrounding adding radrelay to the server. While it's made some things better, it's made other things worse. In the future, I'd like to add tacacs+ to RADIUS gatewaying (bug #254), and radsec. After working on it for a while, it appears to be easier and better to do these as separate gateways, rather than integrating them into the server. So... maybe pulling radrelay out of the server isn't a bad idea, either. We could take a page from "radzap", and make radrelay into a tiny program that runs radclient, and sends the data to a server. It could even start the server itself, and monitor the server for process death. So it could still *look* like one program, even if 3-4 are running behind the scenes. That would be simpler and easier to manage. Comments? Flames? Other priorities? Alan DeKok.

2 3

Re:Problem of proxying Vendor Specific Attributes (VSA)!
by Laurent LOINGEVILLE 10 Jul '06

10 Jul '06

Hi everybody! My first question was the following: >I would like to know if there is an option to specify the proxy not deleting the VSA located in the access-reject response of the server >when the proxy send the access-reject to the client?(keep the VSA) >Clearer, currently, my Radius server send to the proxy an access-reject with VSA and when the proxy receive these packet, it send the >same packet to the client so an access-reject packet but with no VSA (it seem to delete them). >So currently, i have: *>Server Radius*>>>*packet access-reject with VSA*>>>>*Proxy Radius*>>>*packet access-reject without VSA>>>>>>**Client Radius * >So what i would like is: *>Server Radius*>>>*packet access-reject with VSA*>>>>*Proxy Radius*>>>*packet access-reject with VSA>>>>>>**Client Radius * ** >Thank you in advance So after that we told me to modify the function rfc_clean in the source code util.c. i've edited the function rfc_clean() in the source code (src/main/util.c) by adding the following line (in bold) but it doesn't work (the client don't receive the VSA: case PW_AUTHENTICATION_REJECT: pairmove2(&vps, &(packet->vps), PW_EAP_MESSAGE); pairmove2(&vps, &(packet->vps), PW_MESSAGE_AUTHENTICATOR); pairmove2(&vps, &(packet->vps), PW_REPLY_MESSAGE); pairmove2(&vps, &(packet->vps), PW_VENDOR_SPECIFIC); Could you please tell me what is wrong? have i to add something else in this procedure?Is there another file to modify? Thanks in advance for your answer!

1 0

Patch: support for custom simultaneous-use reply-message
by Josh Howlett 10 Jul '06

10 Jul '06

I'm re-sending this patch, because I attached the patch previously rather than sending in-line. This patch allows sending a custom reply-message in the event of simultaneous-use. It defines a two new internal attributes (SIMULTANEOUS_REPLY_MESSAGE_ONCE and SIMULTANEOUS_REPLY_MESSAGE_MULTIPLE) which hold the Reply-Message values and two new global config options to define the default values of these attributes. These attributes can be defined as configuration items in the user database to allow per-user messages. best regards, josh. --- freeradius-1.1.2/src/main/auth.c 2005-10-31 17:59:21.000000000 +0000 +++ freeradius-1.1.2-sim-use-reply/src/main/auth.c 2006-07-07 10:39:18.000000000 +0100 @@ -733,12 +733,25 @@ } if (!mpp_ok){ if (check_item->lvalue > 1) { - snprintf(umsg, sizeof(umsg), - "\r\nYou are already logged in %d times - access denied\r\n\n", - (int)check_item->lvalue); - user_msg = umsg; + /* + * Use a Reply-Message appropriate for reporting single session concurrency + */ + tmp = pairfind(request->reply->vps, PW_SIMULTANEOUS_REPLY_MESSAGE_MULTIPLE); + if ( tmp != NULL ){ + user_msg = strdup((char *)tmp->strvalue); + } else { + user_msg = mainconfig.simul_reply_message_multiple; + } } else { - user_msg = "\r\nYou are already logged in - access denied\r\n\n"; + /* + * Use a Reply-Message appropriate for reporting multiple session concurrency + */ + tmp = pairfind(request->reply->vps, PW_SIMULTANEOUS_REPLY_MESSAGE_ONCE); + if ( tmp != NULL ){ + user_msg = strdup((char *)tmp->strvalue); + } else { + user_msg = mainconfig.simul_reply_message_once; + } } request->reply->code = PW_AUTHENTICATION_REJECT; @@ -751,6 +764,20 @@ tmp = pairmake("Reply-Message", user_msg, T_OP_SET); request->reply->vps = tmp; + /* + * Xlat the Reply-Message. + * This is also done for Access-Accepts at line 1000, + * perhaps the code should be refactored to avoid + * this special case? + */ + + reply_item = pairfind(request->reply->vps, PW_REPLY_MESSAGE); + radius_xlat(buf, sizeof(reply_item->strvalue), + (char *)reply_item->strvalue, request, NULL); + strNcpy((char *)reply_item->strvalue, buf, + sizeof(reply_item->strvalue)); + reply_item->length = strlen((char *)reply_item->strvalue); + snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s", check_item->lvalue, r == 2 ? "[MPP attempt]" : ""); --- freeradius-1.1.2/src/main/mainconfig.c 2006-04-18 18:26:26.000000000 +0100 +++ freeradius-1.1.2-sim-use-reply/src/main/mainconfig.c 2006-07-07 13:35:07.000000000 +0100 @@ -138,6 +138,8 @@ { "nospace_user", PW_TYPE_STRING_PTR, 0, &mainconfig.do_nospace_user, "no" }, { "nospace_pass", PW_TYPE_STRING_PTR, 0, &mainconfig.do_nospace_pass, "no" }, { "checkrad", PW_TYPE_STRING_PTR, 0, &mainconfig.checkrad, "${sbindir}/checkrad" }, + { "simul_reply_message_once", PW_TYPE_STRING_PTR, 0, &mainconfig.simul_reply_message_once, "\r\nDear %{User-Name}, you are already logged in - access denied\r\n\n" }, + { "simul_reply_message_multiple", PW_TYPE_STRING_PTR, 0, &mainconfig.simul_reply_message_multiple, "\r\nDear %{User-Name}, you are already logged in %{check:Simultaneous-Use} times - access denied\r\n\n" }, { "proxy_requests", PW_TYPE_BOOLEAN, 0, &mainconfig.proxy_requests, "yes" }, { "proxy", PW_TYPE_SUBSECTION, 0, proxy_config, NULL }, { "security", PW_TYPE_SUBSECTION, 0, security_config, NULL }, --- freeradius-1.1.2/share/dictionary.freeradius.internal 2006-03-07 18:10:09.000000000 +0000 +++ freeradius-1.1.2-sim-use-reply/share/dictionary.freeradius.internal 2006-07-05 14:54:07.000000000 +0100 @@ -66,6 +66,8 @@ ATTRIBUTE User-Category 1029 string ATTRIBUTE Group-Name 1030 string ATTRIBUTE Huntgroup-Name 1031 string +ATTRIBUTE Simultaneous-Reply-Message-Once 1032 string +ATTRIBUTE Simultaneous-Reply-Message-Multiple 1033 string ATTRIBUTE Simultaneous-Use 1034 integer ATTRIBUTE Strip-User-Name 1035 integer ATTRIBUTE Hint 1040 string --- freeradius-1.1.2/src/include/radius.h 2006-03-07 18:10:08.000000000 +0000 +++ freeradius-1.1.2-sim-use-reply/src/include/radius.h 2006-07-05 14:21:03.000000000 +0100 @@ -143,6 +143,8 @@ #define PW_USER_CATEGORY 1029 #define PW_GROUP_NAME 1030 #define PW_HUNTGROUP_NAME 1031 +#define PW_SIMULTANEOUS_REPLY_MESSAGE_ONCE 1032 +#define PW_SIMULTANEOUS_REPLY_MESSAGE_MULTIPLE 1033 #define PW_SIMULTANEOUS_USE 1034 #define PW_STRIP_USER_NAME 1035 #define PW_HINT 1040 --- freeradius-1.1.2/raddb/radiusd.conf.in 2006-04-20 19:40:29.000000000 +0100 +++ freeradius-1.1.2-sim-use-reply/raddb/radiusd.conf.in 2006-07-07 11:52:46.000000000 +0100 @@ -352,6 +352,18 @@ nospace_user = no nospace_pass = no +# simul_reply_message_once / simul_reply_message_multiple: +# +# The default values to use for the Reply-Message attribute +# returned if session concurrency is detected. These can be +# over-ridden with the Simultaneous-Reply-Use-Once and +# Simultaneous-Reply-Message-Multiple reply attributes. +# +# The message to return if only a single session is permitted. +simul_reply_message_once = "\r\nDear %{User-Name}, you are already logged in - access denied\r\n\n" +# The message to return is more than one sessions are permitted. +simul_reply_message_multiple = "\r\nDear %{User-Name}, you are already logged in %{check:Simultaneous-Use} times - access denied\r\n\n" + # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad --- freeradius-1.1.2/src/include/radiusd.h 2005-04-12 00:45:21.000000000 +0100 +++ freeradius-1.1.2-sim-use-reply/src/include/radiusd.h 2006-07-05 12:50:57.000000000 +0100 @@ -209,6 +209,8 @@ char *nospace_time; char *log_file; char *checkrad; + char *simul_reply_message_once; + char *simul_reply_message_multiple; const char *pid_file; const char *uid_name; const char *gid_name;

1 0

Problem of proxying Vendor Specific Attributes (VSA)!
by Laurent LOINGEVILLE 10 Jul '06

10 Jul '06

Hi! When i receive an access-reject from the radius server (this packet has VSA ), the proxy send back the access-reject to the client but delete the VSA. I tried to modify the file "attrs" by specifying "Vendor-Specific == xxx (our vendor number)" but it doesn't work and i'm not sure if it is the good file to modify. What can i do to indicate the proxy not deleting the VSA when it receive an access-reject from the server? Thanks a lot! ** * *

3 3

Need help regarding date type attribute.
by Vishwanath Srikant Pattanshetti 10 Jul '06

10 Jul '06

Hello all I am using Freeradius 1.1.0 with Oracle 10g for user account management in my project. I am facing following problems. 1. My access accept contains two fields of type date. In the FreeRadius debug messages I see that some date are printed as EST and some are printed as EDT. Does it have anything to do with which month the date belongs to? 2. for a field account-expiry-date I store 'Jan 01 1970' in database table to denote "no expiry" - But in the Radius client program when we try to get the value of this field the value given is always 18000 and not 0 which is expected for date of 'Jan 01 1970' Do any one have a solution for this problem? Will this in any way affect my radius client side, if we are using an external RADIUS server(other than FreeRadius) Any quick help/pointers would be a great help. Thanks and regards. -Vishwa.

1 0

Last set of changes for 1.1.3
by Alan DeKok 10 Jul '06

10 Jul '06

OK, I've fixed rlm_detail. It builds now, sorry. Are there any other issues we need to fix before 1.1.3? RPM spec file fixes? Alan DeKok.

4 7

unsubscribe
by Assa Tal 09 Jul '06

09 Jul '06

-----Original Message----- From: freeradius-devel-bounces+tal.assa=comverse.com(a)lists.freeradius.org [mailto:freeradius-devel-bounces+tal.assa=comverse.com@lists.freeradius. org] On Behalf Of freeradius-devel-request(a)lists.freeradius.org Sent: Sunday, July 09, 2006 1:01 PM To: freeradius-devel(a)lists.freeradius.org Subject: Freeradius-Devel Digest, Vol 15, Issue 6 Send Freeradius-Devel mailing list submissions to freeradius-devel(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-devel or, via email, send a message with subject or body 'help' to freeradius-devel-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-devel-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Devel digest..." Today's Topics: 1. Re: Last set of changes for 1.1.3 (Lin Richardson) ---------------------------------------------------------------------- Message: 1 Date: Sat, 8 Jul 2006 22:53:21 -0600 From: "Lin Richardson" <lin(a)xmission.com> Subject: Re: Last set of changes for 1.1.3 To: freeradius-devel(a)lists.freeradius.org Message-ID: <79a8c65c0607082153n3679d713yb7ab1f438fc12186(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" If you would like a test compile on Solaris, let me know... and give me CVS instructions. On 7/7/06, Nicolas Baradakis <nbk(a)sitadelle.com> wrote: > > Frank Cusack wrote: > > > On July 6, 2006 2:28:27 PM +0200 Nicolas Baradakis > > <nbk(a)sitadelle.com> > > wrote: > > > > > The branch 1.1 fails to build from sources for me. There're still > > > many autoconf 2.13 scripts mixed with autoconf 2.59 scripts. > > > > Can you show a failure? The 2.59/2.13 mix works for me. > > I was seeing those errors: > configure: warning: CFLAGS=-Wall -g -O2: invalid host type > configure: error: can only configure for one host and one target at a > time > configure: error: /bin/sh './configure' failed for ./types/rlm_eap_md5 > > After Alan's fixes and a "cvs up" today, it builds normally. > > -- > Nicolas Baradakis > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

1 0

Authentication by validating RADIUS attribute value
by Hariharan R 08 Jul '06

08 Jul '06

1 0

Patch: custom Reply-Message for simultaneous-use
by Josh Howlett 07 Jul '06

07 Jul '06

Please find attached a patch against FR-1.1.2 to allow returning a custom (and xlat'd) Reply-Message attribute in the event of Simultaneous-Use. I've defined a couple of additional internal attributes, and a couple of new global configuration options that define the default Reply- Message values (one for the case where only a single session is permitted, and one for the case where >1 sessions are permitted). best regards, josh. Josh Howlett, Networking Specialist, University of Bristol. email: josh.howlett(a)bristol.ac.uk | phone: +44 (0)7867 907076 | internal: 7850

1 0

Issues with bug#235
by Kevin Bonner 06 Jul '06

06 Jul '06

I've been working to merge our auth and acct configs into one (previously we ran each on separate servers), and I am hitting bug#235. I snagged the rlm_sql.c changes from CVS and rebuilt 1.1.2. My sql.conf config looks like: sql sqlX { deletestalesessions = no simul_count_query = "select count(*) from radacct where ..." simul_verify_query = "select ... from radacct where ..." } Looking at rlm_sql.c (near line 1386 in the CVS head), we see: if (inst->config->deletestalesessions == FALSE || inst->config->simul_verify_query[0] == '\0') { sql_release_socket(inst, sqlsocket); return RLM_MODULE_OK; } Since the deletestalesessions check evaluates to true, the code never enters the section to verify any of the sessions found. This changes the behavior from all FreeRADIUS releases. Should this be fixed, is this the desired result, or am I forgetting something simple? Kevin Bonner

2 2