July 2006 - Freeradius-Devel - lists.freeradius.org

Re: Last set of changes for 1.1.3
by Sandworm 13 Jul '06

13 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > > "Sandworm" <sandworm(a)mepd.hush.com> wrote: > > The RPM Spec fixes that have been discussed on the list several > > times (unpackaged files, etc) could be added. Diff from previous > > messages attached for your reference. > > > > $ diff -u /usr/src/redhat/SPECS/freeradius.spec > > That looks like Redhat's spec file, not the one we ship with the > server. Please file a bug with Redhat, asking them to update their > spec file. > > If there are problems with redhat/freeradius.spec, please discuss > those here. > > Alan DeKok. > - Alan This is definitely not Redhat's spec file - it is the spec file from the FR tarball ie. redhat/freeradius.spec. This will be a bit long, but see the whole file listed below (including the changes I showed as a diff in my previous post): Summary: High-performance and highly configurable RADIUS server URL: http://www.freeradius.org/ Name: freeradius Version: 1.1.1 Release: 0 License: GPL Group: Networking/Daemons Packager: FreeRADIUS.org Source0: %{name}-%{version}.tar.gz Prereq: /sbin/chkconfig BuildPreReq: libtool # FIXME: snmpwalk, snmpget and rusers POSSIBLY needed by checkrad Provides: radiusd Conflicts: cistron-radius BuildRoot: %{_tmppath}/%{name}-root %description The FreeRADIUS Server Project is a high-performance and highly configurable GPL'd RADIUS server. It is somewhat similar to the Livingston 2.0 RADIUS server, but has many more features, and is much more configurable. %prep %setup sed -i "s@doc/freeradius@doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --prefix=%{_prefix} \ --localstatedir=%{_localstatedir} \ --sysconfdir=%{_sysconfdir} \ --mandir=%{_mandir} \ --with-system-libtool \ --disable-ltdl-install \ --with-ltdl-lib=/usr/lib \ --with-ltdl-include=/usr/include \ --with-gnu-ld \ --with-large-files --with-udpfromto --with-edir \ --with-rlm-sql_postgresql-include-dir=/usr/include/pgsql \ --with-rlm-krb5-include-dir=/usr/kerberos/include \ --with-rlm-krb5-lib-dir=/usr/kerberos/lib make %install [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d,rc.d/init.d} make install R=$RPM_BUILD_ROOT RADDB=$RPM_BUILD_ROOT/etc/raddb # set radiusd as default user/group perl -i -pe 's/^#user =.*$/user = radiusd/' $RADDB/radiusd.conf perl -i -pe 's/^#group =.*$/group = radiusd/' $RADDB/radiusd.conf # shadow password file MUST be defined on Linux perl -i -pe 's/# shadow =/shadow =/' $RADDB/radiusd.conf # remove unneeded stuff rm -f $RPM_BUILD_ROOT%{_mandir}/man8/builddbm.8 rm -f $RPM_BUILD_ROOT%{_prefix}/sbin/rc.radiusd cd redhat install -m 755 rc.radiusd-redhat $RPM_BUILD_ROOT/etc/rc.d/init.d/radiusd install -m 644 radiusd-logrotate $RPM_BUILD_ROOT/etc/logrotate.d/radiusd install -m 644 radiusd-pam $RPM_BUILD_ROOT/etc/pam.d/radius cd .. %pre /usr/sbin/useradd -c "radiusd user" -r -s /bin/false -u 95 -d / radiusd 2>/dev/null || : %preun if [ "$1" = "0" ]; then /sbin/service radiusd stop > /dev/null 2>&1 /sbin/chkconfig --del radiusd fi %post /sbin/ldconfig /sbin/chkconfig --add radiusd # Done here to avoid messing up existing installations for i in radius/radutmp radius/radwtmp radius/radius.log # radius/radwatch.log radius/checkrad.log do touch /var/log/$i chown radiusd:radiusd /var/log/$i chmod 600 /var/log/$i done %postun if [ "$1" -ge "1" ]; then /sbin/service radiusd condrestart >/dev/null 2>&1 fi if [ $1 = 0 ]; then /usr/sbin/userdel radiusd > /dev/null 2>&1 || : fi /sbin/ldconfig %clean [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root) %doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX %doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema %doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend %doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover %doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas %doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file %doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt %doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL %config /etc/pam.d/radius %config /etc/logrotate.d/radiusd %config /etc/rc.d/init.d/radiusd %config (noreplace) /etc/raddb/* %{_bindir}/* %{_datadir}/%{name} %{_libdir}/* %{_mandir}/*/* %{_sbindir}/* %attr(0700,radiusd,radiusd) %dir /var/log/radius %attr(0700,radiusd,radiusd) %dir /var/log/radius/radacct %attr(0700,radiusd,radiusd) %dir /var/run/radiusd %changelog * Thu Dec 15 2004 Alan DeKok - - - update for 1.1.0 * Mon May 31 2004 Paul Hampson - - - update for 1.0.0 release * Fri May 23 2003 Marko Myllynen - - - update for 0.9 * Wed Sep 4 2002 Marko Myllynen - - - fix libtool issues for good * Thu Aug 22 2002 Marko Myllynen - - - update for 0.7/0.8 * Tue Jun 18 2002 Marko Myllynen - - - run as radiusd user instead of root - - - added some options for configure * Thu Jun 6 2002 Marko Myllynen - - - set noreplace for non-dictionary files in /etc/raddb * Sun May 26 2002 Frank Cusack <frank(a)google.com> - - - move /var dirs from %%post to %%files * Thu Feb 14 2002 Marko Myllynen - - - use dir name macros in all configure options - - - libtool is required only when building the package - - - misc clean ups * Wed Feb 13 2002 Marko Myllynen - - - use %%{_mandir} instead of /usr/man - - - rename %%postin as %%post - - - clean up name/version * Fri Jan 18 2002 Frank Cusack <frank(a)google.com> - - - remove (noreplace) for /etc/raddb/* (due to rpm bugs) * Fri Sep 07 2001 Ivan F. Martinez <ivanfm(a)ecodigit.com.br> - - - changes to make compatible with default config file shipped - - - adjusts log files are on /var/log/radius instead of /var/log - - - /etc/raddb changed to config(noreplace) to don't override - - - user configs * Fri Sep 22 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - - - spec file clear accordling to the libltdl fix and minor updates * Wed Sep 12 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - - - Updated to snapshot-12-Sep-00 * Fri Jun 16 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - - - Initial release -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkS2+hsACgkQmw4BJyaatJ1Z3QCgrVAgFL1Pku5QGw+Xtzfb2DLsB20A n25ttFsUO06KtVysqIjF0gnQzZFD =Wr4i -----END PGP SIGNATURE-----

1 0

rlm_attr_filter
by Josip Almasi 13 Jul '06

13 Jul '06

Hi, I need to remove some attributes from the reply(*). Attr_filter does that only for proxy responses. So I wrote it: I added another parameter to attr_filter config, filterlocal, defaults to 'no'. Once you set it to 'yes' it filters locally originated attributes too. I did it in 1.0.1 source cuz it comes with redhat. So, how do I contribute? *) Yes nonsense you might say, just don't put these attribs to your config and you won't need to remove them, right?:) But I use Caller-Station-Id (and others) to perform db lookups and in the process I change its value. For both proxied and local realms. In two-stage auth (proxy.conf:post_proxy_authorize=yes). Regards...

2 2

pairmove() patch with multiple vendor-specific attributes
by Geoffrey D. Bennett 13 Jul '06

13 Jul '06

Hi there, I'm using rlm_perl to add custom reply attributes, but there's a problem when I want to return multiple instances of the same attribute, eg.: Cisco-AVPair=lcp:interface-config=service-policy output RATE-512 Cisco-AVPair=lcp:interface-config=service-policy input RATE-128 rlm_perl supports this (it looks out for arrayrefs) but rlmperl_call() calls pairmove() to put the attributes into the reply: if ((get_hv_content(rad_reply_hv, &vp)) > 0 ) { pairmove(&request->reply->vps, &vp); pairfree(&vp); } and pairmove() will "move attributes from one list to the other if not already present". Unfortunately, this means that only the first Cisco-AVPair ends up getting moved. I've attached a patch which makes pairmove() move all vendor-specific attributes. It works for me. The patch says 1.1.1, but it applies to 1.1.2 as well (untested, but I guess it should work -- lib/valuepair.c and rlm_perl.c look similar enough). Thanks, -- Geoffrey D. Bennett, RHCE, RHCX mailto:g@netcraft.com.au Senior Systems Engineer sip:g@netcraft.com.au NetCraft Australia Pty Ltd http://www.netcraft.com.au/geoffrey/

2 1

rlm_digest module - how to return rows in authenticate part
by biuro＠globeinphotos.com 12 Jul '06

12 Jul '06

Hi Because I've encountered some problems with OpenSer-Radius (described in http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg27755.… ) I've started analysis of FreeRadius sources and I've discovered very strange thing. I've compared rlm_digest.c from ver.1.0.1 with 1.1.2 and it was appeared that part descibed as "rlm_digest: Converting Digest-Attributes to something sane..." was moved from digest_authorize function to digest_authenticate . It is almost not important but how to handle such situation when I want return few attribute to client but to set values in attributes I need to know what are values in few attributes from Request eg. from Digest-Method. In current version I cannot return rows with attributes because only one SQL query can be invoked after authotize part - postauth_query (defined in postgres.conf) but this query cannot return list of row it can only return one value. Can you write how to return attributes to client in my situation? P.S As I understand the 'something sane' means that e.g we convert values from Digest-Attributes to Digest-Method. Regards Michal Szymanski

3 3

Freeradius-1.1.1 with CRL configuration
by sumi thra 12 Jul '06

12 Jul '06

Hi All, I want to configure the CRL in freeradius-1.1.1 version. Followed the procedures given in the config file, but the result is not as expected. The configuration in eap.conf are, 1) Copy CA certificates and CRLs to same directory. I appended the crl into CA file 2) Execute 'c_rehash <CA certs&CRLs Directory>'. Is it necessary? But i did this too 3) Add 'CA_path=<CA certs&CRLs directory>' 4) enable the crl check check_crl = yes 5) Restart radiusd CRL says that the client certificate is revoked. But, the user is still able to get authenticated by the radius server. Please let me know if i am missing any configuration. Thanks for your kind help in advance.

1 0

radrelay integration & other issues
by Alan DeKok 10 Jul '06

10 Jul '06

I've been looking into the issues surrounding adding radrelay to the server. While it's made some things better, it's made other things worse. In the future, I'd like to add tacacs+ to RADIUS gatewaying (bug #254), and radsec. After working on it for a while, it appears to be easier and better to do these as separate gateways, rather than integrating them into the server. So... maybe pulling radrelay out of the server isn't a bad idea, either. We could take a page from "radzap", and make radrelay into a tiny program that runs radclient, and sends the data to a server. It could even start the server itself, and monitor the server for process death. So it could still *look* like one program, even if 3-4 are running behind the scenes. That would be simpler and easier to manage. Comments? Flames? Other priorities? Alan DeKok.

2 3

Re:Problem of proxying Vendor Specific Attributes (VSA)!
by Laurent LOINGEVILLE 10 Jul '06

10 Jul '06

Hi everybody! My first question was the following: >I would like to know if there is an option to specify the proxy not deleting the VSA located in the access-reject response of the server >when the proxy send the access-reject to the client?(keep the VSA) >Clearer, currently, my Radius server send to the proxy an access-reject with VSA and when the proxy receive these packet, it send the >same packet to the client so an access-reject packet but with no VSA (it seem to delete them). >So currently, i have: *>Server Radius*>>>*packet access-reject with VSA*>>>>*Proxy Radius*>>>*packet access-reject without VSA>>>>>>**Client Radius * >So what i would like is: *>Server Radius*>>>*packet access-reject with VSA*>>>>*Proxy Radius*>>>*packet access-reject with VSA>>>>>>**Client Radius * ** >Thank you in advance So after that we told me to modify the function rfc_clean in the source code util.c. i've edited the function rfc_clean() in the source code (src/main/util.c) by adding the following line (in bold) but it doesn't work (the client don't receive the VSA: case PW_AUTHENTICATION_REJECT: pairmove2(&vps, &(packet->vps), PW_EAP_MESSAGE); pairmove2(&vps, &(packet->vps), PW_MESSAGE_AUTHENTICATOR); pairmove2(&vps, &(packet->vps), PW_REPLY_MESSAGE); pairmove2(&vps, &(packet->vps), PW_VENDOR_SPECIFIC); Could you please tell me what is wrong? have i to add something else in this procedure?Is there another file to modify? Thanks in advance for your answer!

1 0

Patch: support for custom simultaneous-use reply-message
by Josh Howlett 10 Jul '06

10 Jul '06

I'm re-sending this patch, because I attached the patch previously rather than sending in-line. This patch allows sending a custom reply-message in the event of simultaneous-use. It defines a two new internal attributes (SIMULTANEOUS_REPLY_MESSAGE_ONCE and SIMULTANEOUS_REPLY_MESSAGE_MULTIPLE) which hold the Reply-Message values and two new global config options to define the default values of these attributes. These attributes can be defined as configuration items in the user database to allow per-user messages. best regards, josh. --- freeradius-1.1.2/src/main/auth.c 2005-10-31 17:59:21.000000000 +0000 +++ freeradius-1.1.2-sim-use-reply/src/main/auth.c 2006-07-07 10:39:18.000000000 +0100 @@ -733,12 +733,25 @@ } if (!mpp_ok){ if (check_item->lvalue > 1) { - snprintf(umsg, sizeof(umsg), - "\r\nYou are already logged in %d times - access denied\r\n\n", - (int)check_item->lvalue); - user_msg = umsg; + /* + * Use a Reply-Message appropriate for reporting single session concurrency + */ + tmp = pairfind(request->reply->vps, PW_SIMULTANEOUS_REPLY_MESSAGE_MULTIPLE); + if ( tmp != NULL ){ + user_msg = strdup((char *)tmp->strvalue); + } else { + user_msg = mainconfig.simul_reply_message_multiple; + } } else { - user_msg = "\r\nYou are already logged in - access denied\r\n\n"; + /* + * Use a Reply-Message appropriate for reporting multiple session concurrency + */ + tmp = pairfind(request->reply->vps, PW_SIMULTANEOUS_REPLY_MESSAGE_ONCE); + if ( tmp != NULL ){ + user_msg = strdup((char *)tmp->strvalue); + } else { + user_msg = mainconfig.simul_reply_message_once; + } } request->reply->code = PW_AUTHENTICATION_REJECT; @@ -751,6 +764,20 @@ tmp = pairmake("Reply-Message", user_msg, T_OP_SET); request->reply->vps = tmp; + /* + * Xlat the Reply-Message. + * This is also done for Access-Accepts at line 1000, + * perhaps the code should be refactored to avoid + * this special case? + */ + + reply_item = pairfind(request->reply->vps, PW_REPLY_MESSAGE); + radius_xlat(buf, sizeof(reply_item->strvalue), + (char *)reply_item->strvalue, request, NULL); + strNcpy((char *)reply_item->strvalue, buf, + sizeof(reply_item->strvalue)); + reply_item->length = strlen((char *)reply_item->strvalue); + snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s", check_item->lvalue, r == 2 ? "[MPP attempt]" : ""); --- freeradius-1.1.2/src/main/mainconfig.c 2006-04-18 18:26:26.000000000 +0100 +++ freeradius-1.1.2-sim-use-reply/src/main/mainconfig.c 2006-07-07 13:35:07.000000000 +0100 @@ -138,6 +138,8 @@ { "nospace_user", PW_TYPE_STRING_PTR, 0, &mainconfig.do_nospace_user, "no" }, { "nospace_pass", PW_TYPE_STRING_PTR, 0, &mainconfig.do_nospace_pass, "no" }, { "checkrad", PW_TYPE_STRING_PTR, 0, &mainconfig.checkrad, "${sbindir}/checkrad" }, + { "simul_reply_message_once", PW_TYPE_STRING_PTR, 0, &mainconfig.simul_reply_message_once, "\r\nDear %{User-Name}, you are already logged in - access denied\r\n\n" }, + { "simul_reply_message_multiple", PW_TYPE_STRING_PTR, 0, &mainconfig.simul_reply_message_multiple, "\r\nDear %{User-Name}, you are already logged in %{check:Simultaneous-Use} times - access denied\r\n\n" }, { "proxy_requests", PW_TYPE_BOOLEAN, 0, &mainconfig.proxy_requests, "yes" }, { "proxy", PW_TYPE_SUBSECTION, 0, proxy_config, NULL }, { "security", PW_TYPE_SUBSECTION, 0, security_config, NULL }, --- freeradius-1.1.2/share/dictionary.freeradius.internal 2006-03-07 18:10:09.000000000 +0000 +++ freeradius-1.1.2-sim-use-reply/share/dictionary.freeradius.internal 2006-07-05 14:54:07.000000000 +0100 @@ -66,6 +66,8 @@ ATTRIBUTE User-Category 1029 string ATTRIBUTE Group-Name 1030 string ATTRIBUTE Huntgroup-Name 1031 string +ATTRIBUTE Simultaneous-Reply-Message-Once 1032 string +ATTRIBUTE Simultaneous-Reply-Message-Multiple 1033 string ATTRIBUTE Simultaneous-Use 1034 integer ATTRIBUTE Strip-User-Name 1035 integer ATTRIBUTE Hint 1040 string --- freeradius-1.1.2/src/include/radius.h 2006-03-07 18:10:08.000000000 +0000 +++ freeradius-1.1.2-sim-use-reply/src/include/radius.h 2006-07-05 14:21:03.000000000 +0100 @@ -143,6 +143,8 @@ #define PW_USER_CATEGORY 1029 #define PW_GROUP_NAME 1030 #define PW_HUNTGROUP_NAME 1031 +#define PW_SIMULTANEOUS_REPLY_MESSAGE_ONCE 1032 +#define PW_SIMULTANEOUS_REPLY_MESSAGE_MULTIPLE 1033 #define PW_SIMULTANEOUS_USE 1034 #define PW_STRIP_USER_NAME 1035 #define PW_HINT 1040 --- freeradius-1.1.2/raddb/radiusd.conf.in 2006-04-20 19:40:29.000000000 +0100 +++ freeradius-1.1.2-sim-use-reply/raddb/radiusd.conf.in 2006-07-07 11:52:46.000000000 +0100 @@ -352,6 +352,18 @@ nospace_user = no nospace_pass = no +# simul_reply_message_once / simul_reply_message_multiple: +# +# The default values to use for the Reply-Message attribute +# returned if session concurrency is detected. These can be +# over-ridden with the Simultaneous-Reply-Use-Once and +# Simultaneous-Reply-Message-Multiple reply attributes. +# +# The message to return if only a single session is permitted. +simul_reply_message_once = "\r\nDear %{User-Name}, you are already logged in - access denied\r\n\n" +# The message to return is more than one sessions are permitted. +simul_reply_message_multiple = "\r\nDear %{User-Name}, you are already logged in %{check:Simultaneous-Use} times - access denied\r\n\n" + # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad --- freeradius-1.1.2/src/include/radiusd.h 2005-04-12 00:45:21.000000000 +0100 +++ freeradius-1.1.2-sim-use-reply/src/include/radiusd.h 2006-07-05 12:50:57.000000000 +0100 @@ -209,6 +209,8 @@ char *nospace_time; char *log_file; char *checkrad; + char *simul_reply_message_once; + char *simul_reply_message_multiple; const char *pid_file; const char *uid_name; const char *gid_name;

1 0

Problem of proxying Vendor Specific Attributes (VSA)!
by Laurent LOINGEVILLE 10 Jul '06

10 Jul '06

Hi! When i receive an access-reject from the radius server (this packet has VSA ), the proxy send back the access-reject to the client but delete the VSA. I tried to modify the file "attrs" by specifying "Vendor-Specific == xxx (our vendor number)" but it doesn't work and i'm not sure if it is the good file to modify. What can i do to indicate the proxy not deleting the VSA when it receive an access-reject from the server? Thanks a lot! ** * *

3 3

Need help regarding date type attribute.
by Vishwanath Srikant Pattanshetti 10 Jul '06

10 Jul '06

Hello all I am using Freeradius 1.1.0 with Oracle 10g for user account management in my project. I am facing following problems. 1. My access accept contains two fields of type date. In the FreeRadius debug messages I see that some date are printed as EST and some are printed as EDT. Does it have anything to do with which month the date belongs to? 2. for a field account-expiry-date I store 'Jan 01 1970' in database table to denote "no expiry" - But in the Radius client program when we try to get the value of this field the value given is always 18000 and not 0 which is expected for date of 'Jan 01 1970' Do any one have a solution for this problem? Will this in any way affect my radius client side, if we are using an external RADIUS server(other than FreeRadius) Any quick help/pointers would be a great help. Thanks and regards. -Vishwa.

1 0