September 2007 - Freeradius-Devel - lists.freeradius.org

Without cleartext password
by Thiago Maluf 12 Sep '07

12 Sep '07

Hi people, I work with OPENSER + FREERADIUS + OPENLDAP But it just work with password's users is in cleartext. I need put them in some encrypt, I think to put in MD5 or SHA. Have someone that could help me ? Anything is good: references, tutorial or until config examples. Very thanks, Thiago Maluf.

1 0

Automatic report from sources (radiusd) between 10.09.2007 - 11.09.2007 GMT
by Automatic cvs log generator 11 Sep '07

11 Sep '07

CVS log entries from 10.09.2007 (Mon) 08:00:02 - 11.09.2007 (Tue) 08:00:02 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_sql/rlm_sql.c; Revisions: 1.174, 1.173 ===================================================== Log entries ===================================================== Description: Errors are < 0 Modified files: File: radiusd/src/modules/rlm_sql/rlm_sql.c; Revision: 1.174; Date: 2007/09/10 13:04:30; Author: aland; Lines: (+5 -5) ------------------------------- Description: Unconfigured strings are NULL, not "" Check for NULL, too Modified files: File: radiusd/src/modules/rlm_sql/rlm_sql.c; Revision: 1.173; Date: 2007/09/10 13:02:15; Author: aland; Lines: (+11 -7) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_sql/rlm_sql.c Revisions: 1.174, 1.173 Authors: aland (+5 -5), aland (+11 -7) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 09.09.2007 - 10.09.2007 GMT
by Automatic cvs log generator 10 Sep '07

10 Sep '07

CVS log entries from 09.09.2007 (Sun) 08:00:00 - 10.09.2007 (Mon) 08:00:02 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c; Revisions: 1.27, 1.11.4.4 File: radiusd/raddb/sql/mysql/dialup.conf; Revisions: 1.3 ===================================================== Combined list of identical log entries ===================================================== Description: Corrected typo Modified files: File: radiusd/raddb/sql/mysql/dialup.conf; Revision: 1.3; Date: 2007/09/10 07:31:42; Author: aland; Lines: (+2 -2) File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c; Revision: 1.27; Date: 2007/09/09 16:24:06; Author: aland; Lines: (+3 -3) File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c; Revision: 1.11.4.4; Date: 2007/09/09 16:23:41; Author: aland; Lines: (+2 -2) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sql/mysql/dialup.conf Revisions: 1.3 Authors: aland (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_eap/types/rlm_eap_peap/peap.c Revisions: 1.27, 1.11.4.4 Authors: aland (+3 -3), aland (+2 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

sql/mysql/dialup.conf typo
by Kevin Bonner 10 Sep '07

10 Sep '07

Another minor typo found in the MySQL example config. Kevin Bonner diff -u -r1.2 dialup.conf --- raddb/sql/mysql/dialup.conf 23 Jul 2007 14:34:27 -0000 1.2 +++ raddb/sql/mysql/dialup.conf 7 Sep 2007 22:15:38 -0000 @@ -20,7 +20,7 @@ # Use Stripped-User-Name, if it's there. # Else use User-Name, if it's there, # Else use hard-coded string "DEFAULT" as the user name. - #sql_user_name = "%{${Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" + #sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" # sql_user_name = "%{User-Name}"

2 1

Automatic report from sources (radiusd) between 07.09.2007 - 08.09.2007 GMT
by Automatic cvs log generator 08 Sep '07

08 Sep '07

CVS log entries from 07.09.2007 (Fri) 08:00:01 - 08.09.2007 (Sat) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/radiusd.conf.in; Revisions: 1.252 File: radiusd/raddb/clients.conf; Revisions: 1.9 File: radiusd/src/main/client.c; Revisions: 1.67 File: radiusd/man/man5/clients.conf.5; Revisions: 1.3 ===================================================== Combined list of identical log entries ===================================================== Description: Document new client format Modified files: File: radiusd/man/man5/clients.conf.5; Revision: 1.3; Date: 2007/09/07 09:19:55; Author: aland; Lines: (+15 -14) File: radiusd/raddb/clients.conf; Revision: 1.9; Date: 2007/09/07 09:19:55; Author: aland; Lines: (+72 -41) ===================================================== Log entries ===================================================== Description: Removed duplicate section Modified files: File: radiusd/raddb/radiusd.conf.in; Revision: 1.252; Date: 2007/09/07 08:52:30; Author: aland; Lines: (+1 -10) ------------------------------- Description: Change "prefix" to "netmask" Modified files: File: radiusd/src/main/client.c; Revision: 1.67; Date: 2007/09/07 09:09:43; Author: aland; Lines: (+5 -5) ===================================================== Summary of modified files ===================================================== File: radiusd/man/man5/clients.conf.5 Revisions: 1.3 Authors: aland (+15 -14) ------------------------------- File: radiusd/raddb/clients.conf Revisions: 1.9 Authors: aland (+72 -41) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.252 Authors: aland (+1 -10) ------------------------------- File: radiusd/src/main/client.c Revisions: 1.67 Authors: aland (+5 -5) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Duplicate logintime section
by Kevin Bonner 07 Sep '07

07 Sep '07

In the CVS head, there is a duplicate logintime module definition. Patch is below. Kevin Bonner diff -u -r1.251 radiusd.conf.in --- radiusd.conf.in 20 Jul 2007 12:57:43 -0000 1.251 +++ radiusd.conf.in 6 Sep 2007 22:00:54 -0000 @@ -1744,15 +1744,6 @@ # $INCLUDE ${confdir}/otp.conf # - # Implements Login-Time, Current-Time, and Time-Of-Day - # - logintime { - # - # Don't worry about anything here for now.. - # - } - - # # Kerberos. See doc/rlm_krb5 for minimal docs. # # krb5 {

2 1

Automatic report from sources (radiusd) between 06.09.2007 - 07.09.2007 GMT
by Automatic cvs log generator 07 Sep '07

07 Sep '07

CVS log entries from 06.09.2007 (Thu) 08:00:01 - 07.09.2007 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/realms.c; Revisions: 1.33 File: radiusd/src/main/evaluate.c; Revisions: 1.29 ===================================================== Log entries ===================================================== Description: Clearer error message Modified files: File: radiusd/src/main/evaluate.c; Revision: 1.29; Date: 2007/09/06 14:17:47; Author: aland; Lines: (+6 -2) ------------------------------- Description: Re-factor "allocate pool" code, to prepare for cool new features Modified files: File: radiusd/src/main/realms.c; Revision: 1.33; Date: 2007/09/06 14:36:20; Author: aland; Lines: (+28 -16) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/evaluate.c Revisions: 1.29 Authors: aland (+6 -2) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.33 Authors: aland (+28 -16) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

PEAP fragmentation
by Manuel Sánchez Cuenca 05 Sep '07

05 Sep '07

Hello all. I'm modifying the PEAP module included in freeradius 1.1.4 to send in the last message of the protected channel some information to the client. Specifically, I'm including a new TLV in the eappeap_success message. The code of the eappeap_success method in the peap.c file is the following: . . . tlv_packet[10] = EAP_TLV_SUCCESS; /* New code */ tlv_packet[11] = 0x80; /* mandatory AVP */ tlv_packet[12] = EAP_TLV_VENDOR_SPECIFIC; len_aux = 4 + mydata_len; tlv_len = htons(len_aux); ptr++; // [3] ptr++; // [4] ptr++; // [5] ptr++; // [6] ptr++; // [7] ptr++; // [8] ptr++; // [9] ptr++; // [10] ptr++; // [11] ptr++; // [12] ptr++; // [13] memcpy(ptr, &tlv_len, 2); tlv_packet[15] = 0; /* Vendor ID: Fixed to 0*/ tlv_packet[16] = 0; /* Vendor ID */ tlv_packet[17] = 0; /* Vendor ID */ tlv_packet[18] = 1; /* Vendor ID */ int i; for (i = 0; i < mydata_len; i++) {tlv_packet[19 + i] = mydata[i]; } /* End new code */ (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, packet_len); . . . When the data to be sent (mydata) is small, the protocol works ok, but when the the amount of data is big, there are some problems. In this situation, the server sends the first fragment with the bits L and M sets to 1. Then the client replies with a PEAP message without data (0x020b00061900). Now, the server sends something that doesn't seem the right data, because in one test, the total size of the fragments was 1029, the first fragment size was 1024, and the second one (with must be 5) was 37. When the fragment ACK is received, he log of freeradius shows: ... rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_verify returned 3 rlm_eap_peap: EAPTLS_SUCCESS ... Can anybody help me with this problem and tell me why the second fragment is not correct? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

2 5

Automatic report from sources (radiusd) between 04.09.2007 - 05.09.2007 GMT
by Automatic cvs log generator 05 Sep '07

05 Sep '07

CVS log entries from 04.09.2007 (Tue) 08:00:01 - 05.09.2007 (Wed) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/tests/eap-ttls-pap.conf; Revisions: 1.1 File: radiusd/src/tests/Makefile; Revisions: 1.4 File: radiusd/src/tests/eap-ttls-mschapv2.conf; Revisions: 1.1 File: radiusd/share/dictionary; Revisions: 1.144 File: radiusd/raddb/Makefile; Revisions: 1.32 File: radiusd/src/main/listen.c; Revisions: 1.100, 1.99 File: radiusd/src/main/client.c; Revisions: 1.66 File: radiusd/raddb/sites-available/README; Revisions: 1.1 File: radiusd/src/main/realms.c; Revisions: 1.32 File: radiusd/src/main/conffile.c; Revisions: 1.178 File: radiusd/src/main/radclient.c; Revisions: 1.115 File: radiusd/share/dictionary.prosoft; Revisions: 1.1 File: radiusd/src/tests/peap-mschapv2.conf; Revisions: 1.1 ===================================================== Combined list of identical log entries ===================================================== Description: Added more EAP tests Modified files: File: radiusd/src/tests/Makefile; Revision: 1.4; Date: 2007/09/05 07:36:49; Author: aland; Lines: (+3 -1) File: radiusd/src/tests/eap-ttls-mschapv2.conf; Revision: 1.1; Date: 2007/09/05 07:36:49; Author: aland; File: radiusd/src/tests/eap-ttls-pap.conf; Revision: 1.1; Date: 2007/09/05 07:36:50; Author: aland; File: radiusd/src/tests/peap-mschapv2.conf; Revision: 1.1; Date: 2007/09/05 07:36:50; Author: aland; ------------------------------- Description: As posted to the list, with the exception that Prosoft-Auth-Role is "integer", and not "string", because it VALUEs defined Modified files: File: radiusd/share/dictionary; Revision: 1.144; Date: 2007/09/04 11:54:24; Author: aland; Lines: (+2 -1) File: radiusd/share/dictionary.prosoft; Revision: 1.1; Date: 2007/09/04 11:54:25; Author: aland; ===================================================== Log entries ===================================================== Description: After a "cvs admin -o 1.32" to get it back to a cleaner state, re-create 1.32, this time by listing sites-available/README Modified files: File: radiusd/raddb/Makefile; Revision: 1.32; Date: 2007/09/04 13:12:51; Author: aland; Lines: (+3 -2) ------------------------------- Description: Something resembling documentation Modified files: File: radiusd/raddb/sites-available/README; Revision: 1.1; Date: 2007/09/04 13:11:23; Author: aland; ------------------------------- Description: Allow new syntax: client shortname { ipaddr = foo ... } For compatibility with the "listen" sections. Modified files: File: radiusd/src/main/client.c; Revision: 1.66; Date: 2007/09/04 15:43:05; Author: aland; Lines: (+89 -34) ------------------------------- Description: Moved code that turns a conf-reference into a CONF_ITEM into its own function. (e.g. "foo" -> pair in current section, "foo.bar" -> foo.bar in main config Used it in cf_expand_variables Added explicit $template foo.bar.baz function, which means that you no longer have to put those things into a separate file. Modified files: File: radiusd/src/main/conffile.c; Revision: 1.178; Date: 2007/09/04 08:46:22; Author: aland; Lines: (+132 -97) ------------------------------- Description: Print listening socket IP, port, and server name for some more messages. This makes it easier to know which virtual server has received a packet. Modified files: File: radiusd/src/main/listen.c; Revision: 1.100; Date: 2007/09/04 15:25:11; Author: aland; Lines: (+28 -12) ------------------------------- Description: Clients are found by: * clients = ... in listen section * clients in same virtual server as listen section * global clients Modified files: File: radiusd/src/main/listen.c; Revision: 1.99; Date: 2007/09/04 13:07:21; Author: aland; Lines: (+36 -38) ------------------------------- Description: No idea what the old code did... this is better Modified files: File: radiusd/src/main/radclient.c; Revision: 1.115; Date: 2007/09/04 12:52:36; Author: aland; Lines: (+5 -13) ------------------------------- Description: Don't key off of the values of the IP addresses for home servers, as INADDR_ANY is allowed. Instead, key off of names Modified files: File: radiusd/src/main/realms.c; Revision: 1.32; Date: 2007/09/04 15:42:13; Author: aland; Lines: (+6 -8) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/Makefile Revisions: 1.32 Authors: aland (+3 -2) ------------------------------- File: radiusd/raddb/sites-available/README Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/share/dictionary Revisions: 1.144 Authors: aland (+2 -1) ------------------------------- File: radiusd/share/dictionary.prosoft Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/main/client.c Revisions: 1.66 Authors: aland (+89 -34) ------------------------------- File: radiusd/src/main/conffile.c Revisions: 1.178 Authors: aland (+132 -97) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.100, 1.99 Authors: aland (+28 -12), aland (+36 -38) ------------------------------- File: radiusd/src/main/radclient.c Revisions: 1.115 Authors: aland (+5 -13) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.32 Authors: aland (+6 -8) ------------------------------- File: radiusd/src/tests/Makefile Revisions: 1.4 Authors: aland (+3 -1) ------------------------------- File: radiusd/src/tests/eap-ttls-mschapv2.conf Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/eap-ttls-pap.conf Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/src/tests/peap-mschapv2.conf Revisions: 1.1 Authors: aland -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Deleting reply items before post-proxy
by Eddie Stassen 04 Sep '07

04 Sep '07

Could someone please explain to me if there is any specific reasoning behind the following lines right in the beginning of proxy_receive() in proxy.c? (version 1.1.7, similar code in event.c in 2.0) /* * Delete any reply we had accumulated until now. */ pairfree(&request->reply->vps); I was trying to get rid of my 'post-proxy-authorize' dependency and found that any attributes added during the authorize stage are removed when the proxy reply is received. Surely this is not intended behaviour as further down in proxy_receive() we have the following lines: /* * Add the attributes left in the proxy reply to * the reply list. */ pairadd(&request->reply->vps, request->proxy_reply->vps); Removing the initial pairfree() gives me the behaviour I expected, i.e. add some stuff during authorize, proxy, then combine reply and proxy_reply items before responding. Am I missing something? Eddie

7 20