November 2008 - Freeradius-Devel - lists.freeradius.org

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Issue with rlm_digest module
by malaya.kishore＠wipro.com 28 Nov '08

28 Nov '08

Hi, Greetings, I am Kishore here working in Wipro Technologies. We were testing MD5 digest with FreeRadius as Authentication Server. FreeRadius AAA is running on SUSE Linux machine. We are finding the below two problems: Problem 1: In the sanity check of rlm_digest module, we find that the attrlen attribute is not incremented correctly. FreeRadius version 2.1.1 Source: freeradius-server-2.1.1\src\modules\rlm_digest\rlm_digest.c Line: 138 Code: attrlen = p[1]; /* stupid VSA format */ Solution: attrlen = p[1]+2; /* stupid VSA format */ Problem 2: As per the FreeRadius site, FreeRadius support RFC: 4590 and 5090. But while testing for MD5 digest, FreeRadius server not sending any Digest-Challenge (Access-Challenge). Can someone please clarify the above issues. Thank you. Kind Regards, Kishore Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 6

GIT Log for 2008-11-28 00:33 GMT
by aland＠deployingradius.com 27 Nov '08

27 Nov '08

commit 8c9700aed39f5f2dc07ec2cea0865acdea66c109 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 27 12:07:18 2008 +0100 Permanently switch UID only if we succeed in doing setuid mainconfig.c does setuid to an unpriviledged user (temporarily). We do setuid(0) back to bind to the sockets. But before running anything else, we permanently switch uid's back to the unpriviledged user. But only if the first suid was done Files changed: src/main/event.c | 9 ++------- src/main/mainconfig.c | 3 +-- 2 files changed, 3 insertions(+), 9 deletions(-) ====================================================================== commit 74f3b146b474c58ccf303c54c028f0517c1f4d80 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 27 10:54:26 2008 +0100 Show module name, not listen type Files changed: src/main/listen.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ======================================================================

1 0

Expire account after first login
by Stephan Jaeger 27 Nov '08

27 Nov '08

Hi, i needed to expire an account x seconds after its initial login/first session start. I came up with this solution using the sqlcounter module. Maybe this is of interest to others and could go into the docs. This uses mysql. sqlcounter expirelogincounter { counter-name = Expire-After-Initial-Login check-name = Expire-After sqlmod-inst = sql key = User-Name reset = never query = "SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) \ FROM radacct \ WHERE UserName='%{%k}' \ ORDER BY acctstarttime \ LIMIT 1;" } Regards Stephan -- Stephan Jaeger <stephan.jaeger(a)ewetel.de> EWE TEL GmbH

1 0

GIT Log for 2008-11-27 00:33 GMT
by aland＠deployingradius.com 26 Nov '08

26 Nov '08

commit c52a046b2cb20f4650fe79585e927a9183bd91cb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Nov 26 14:36:52 2008 +0100 Correct the attribute numbers for client accounting stats Files changed: src/modules/frs_status/frs_status.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) ====================================================================== commit 7f255bf4ce8b5ad232513010367559e79d7644e9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Nov 26 08:22:05 2008 +0100 Use "ln -s" rather than "cp" for in-tree operation Libtool on some platforms creates directories in the ".libs" directory. Using "ln -s" rather than "cp" means we don't care what the destination file type is, and we don't have to create a cross-platform "cp -R" Files changed: src/modules/Makefile | 1 - src/modules/rlm_eap/libeap/Makefile | 4 ---- src/modules/rlm_sql/drivers/rules.mak | 8 ++++---- src/modules/rules.mak | 6 ++---- 4 files changed, 6 insertions(+), 13 deletions(-) ====================================================================== commit 97e33a04b0654d581e7343cf9ff567a7bd93e889 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Nov 26 08:18:51 2008 +0100 More documentation for using multiple certs Files changed: raddb/eap.conf | 5 +---- 1 files changed, 1 insertions(+), 4 deletions(-) ======================================================================

1 0

GIT Log for 2008-11-26 00:33 GMT
by aland＠deployingradius.com 25 Nov '08

25 Nov '08

commit badbb9dae65418059a0fbd1303a9e03d843b63fc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 16:41:21 2008 +0100 Increase the field size for Acct-Session-Id to 64. This closes #540 Files changed: raddb/sql/mssql/schema.sql | 2 +- raddb/sql/mysql/schema.sql | 2 +- raddb/sql/oracle/schema.sql | 2 +- raddb/sql/postgresql/schema.sql | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit 3403519dbd0c02403f61262ec0d54fc7636a3d94 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 16:31:29 2008 +0100 LDAP-UserDn is in "control", not "request" Closes #596 Files changed: raddb/modules/ldap | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 629fc0b1079908e5a67947c2ca5f2781caac86d9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 14:44:00 2008 +0100 Add EVP_sha256 for WiMAX certificates OpenSSL apparently doesn't include the EVP_sha256 digest by default, and the WiMAX certificates require SHA256 certificates. So... we add it manually. However, the EVP_sha256 cipher is defined only if OPENSSL_FIPS is defined, meaning we have to write a "configure" script check for this. Files changed: src/modules/rlm_eap/types/rlm_eap_tls/config.h.in | 3 - src/modules/rlm_eap/types/rlm_eap_tls/configure | 3546 ++++++-------------- src/modules/rlm_eap/types/rlm_eap_tls/configure.in | 7 - .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 14 - 4 files changed, 1036 insertions(+), 2534 deletions(-) ====================================================================== commit a49e682f0f4600f6c2c878f446e25c853fc78b7b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 11:39:30 2008 +0100 Remove more files Files changed: src/modules/Makefile | 4 +--- 1 files changed, 1 insertions(+), 3 deletions(-) ====================================================================== commit 1e6209870c24b9e71f844b0e1099ab293ba54e63 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 11:38:13 2008 +0100 Set default days because OpenSSL people won't do it. Files changed: raddb/certs/Makefile | 17 +++++++++-------- 1 files changed, 9 insertions(+), 8 deletions(-) ====================================================================== commit 4df74f9b1497fc4c88f9159a680707041c70a23d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 11:36:58 2008 +0100 Check for NULL pointer so we don't crash. Files changed: libltdl/ltdl.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) ====================================================================== commit 28b0b5af25c9400a903d9c2905032bb854cf6462 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 10:39:35 2008 +0100 Document listen "type = status" better. Closes #580 Files changed: raddb/radiusd.conf.in | 4 ---- raddb/sites-available/status | 8 ++------ 2 files changed, 2 insertions(+), 10 deletions(-) ====================================================================== commit 04e7ae80f0ba86a8140837b8c81486a054160cf0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 10:38:59 2008 +0100 Do "rm -rf lib" on "make clean". It has no git controlled files, so this is OK Files changed: src/modules/rlm_sql/drivers/Makefile.in | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit df19aa11e89d74d08e1052f2f7462dcd3b7a878a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 10:38:01 2008 +0100 Include <ltdl.h> The file calles lt_dlopen(), so we need to include <ltdl.h> fro proper function prototyping. Partially addresses bug #610 Files changed: src/modules/rlm_sql/rlm_sql.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ======================================================================

1 0

EAP-TLS Memory Leak
by Alexander Bergmann 24 Nov '08

24 Nov '08

Hi, I'm using FreeRADIUS 2.1.1 wiht EAP-TLS for my WLAN authentication. It's working great and I have no authentication problems at all. I've tested my setup with eapol_test from the wpa_supplicant package and used it inside an endless loop overnight and the memory usage was 100% stable. Then I've noticed that the FreeRADIUS memory usage increases if I interrupt the eapol_test tool after it sends the first RADIUS packet. This can be done till FreeRADIUS runs out of memory and gets an exception. Is this a known problem? To force the problem with eapol_test, I've inserted an 'exit(0);' inside the radius_client_send() function. Here's the diff: diff -Nur wpa_supplicant-0.5.10-orig/radius_client.c wpa_supplicant-0.5.10-crash/radius_client.c --- wpa_supplicant-0.5.10-orig/radius_client.c 2008-02-20 01:08:52.000000000 +0100 +++ wpa_supplicant-0.5.10-crash/radius_client.c 2008-11-03 22:06:10.000000000 +0100 @@ -494,6 +494,9 @@ radius_client_list_add(radius, msg, msg_type, shared_secret, shared_secret_len, addr); + printf("Unexpected EAPOL Client Problem....\n"); + exit(0); + return res; } Regards, Alex

2 2

website accessibility IPv6
by Stefan Winter 20 Nov '08

20 Nov '08

Hi, aparently freeradius.org (but not www.freeradius.org) has an IPv6 address: swinter@aragorn:~> host freeradius.org freeradius.org has address 64.34.165.250 freeradius.org has address 88.191.76.128 freeradius.org has IPv6 address 2a01:e0b:1:76:21c:c0ff:fe27:7b54 freeradius.org mail is handled by 10 mail.freeradius.org. swinter@aragorn:~> The address is pingable, but the web server doesn't deliver any content (no reply). This looks like a daemon binding only to IPv4:80, not the IPv6:80 address... Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 4

RLM_PERL Simultaneous-Use RLM_MODULE_REJECT
by Anatoly S. Zimin 20 Nov '08

20 Nov '08

Hello everybody! I am using rlm_perl for checking Simultaneous-Use. But this not work... :-( FreeRadius 2.1.1 session { perl } I see, that module is work. But if I return RLM_MODULE_REJECT the user is not REJECTED!!! What I do wrong? In debug mode (radiusd -X): Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "**************" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok +- entering group session {...} Using perl at 0xa6b40 rlm_perl: RLM_PERL => sub checksimul rlm_perl: RAD_REQUEST: NAS-Port-Type = Virtual rlm_perl: RAD_REQUEST: Service-Type = Framed-User rlm_perl: RAD_REQUEST: Framed-Protocol = PPP rlm_perl: RAD_REQUEST: User-Name = s_1295737 rlm_perl: RAD_REQUEST: User-Password = ****************** rlm_perl: RAD_REQUEST: Realm = DEFAULT rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.0.1 rlm_perl: RAD_REQUEST: NAS-Port-Id = 0/0/1/500 rlm_perl: RAD_REPLY: Framed-Protocol = PPP rlm_perl: RAD_REPLY: Session-Timeout = 90000 rlm_perl: RAD_REPLY: Service-Type = Framed-User rlm_perl: RAD_CONFIG: Crypt-Password = ***************** rlm_perl: RAD_CONFIG: Simultaneous-Use = 1 rlm_perl: RAD_CONFIG: Auth-Type = PAP rlm_perl: RAD_CHECK: Crypt-Password = **************** rlm_perl: RAD_CHECK: Simultaneous-Use = 1 rlm_perl: RAD_CHECK: Auth-Type = PAP rlm_perl: CHECK: send [s_1295737] to [194.186.47.51:6795] is ok rlm_perl: CHECK: Multiple logins (hits 3) (max 1) : [s_1295737] (from client 192.168.0.1 port 0) rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = s_1295737 rlm_perl: Added pair User-Password = **************** rlm_perl: Added pair Realm = DEFAULT rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 192.168.0.1 rlm_perl: Added pair NAS-Port-Id = 0/0/1/500 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Session-Timeout = 90000 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Crypt-Password = *************** rlm_perl: Added pair Simultaneous-Use = 1 rlm_perl: Added pair Auth-Type = PAP ++[perl] returns reject Login OK: [s_1295737] (from client cisco1 port 0) Also I attempted: RLM_MODULE_REJECT RLM_MODULE_FAIL RLM_MODULE_HANDLED RLM_MODULE_INVALID RLM_MODULE_USERLOCK and response still "Login OK: [s_1295737] (from client cisco1 port 0)".... P.S. authorize section work very good. Thanks a lot!

1 1

GIT Log for 2008-11-19 00:33 GMT
by aland＠deployingradius.com 18 Nov '08

18 Nov '08

commit 2933262a2a468ed7367c7cde2b449543b0cbca2b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 18 05:05:49 2008 -0800 Check return codes for more instances of regcomp Files changed: src/main/evaluate.c | 12 +----------- src/main/valuepair.c | 12 ++---------- 2 files changed, 3 insertions(+), 21 deletions(-) ====================================================================== commit f2ec5cec76ec01e25267f2035e5daf025210bfce Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 18 04:58:26 2008 -0800 Check the return code of regcomp Files changed: src/main/evaluate.c | 12 +----------- 1 files changed, 1 insertions(+), 11 deletions(-) ======================================================================

1 0