February 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

FreeRadius +BDB
by Sourav Chakraborty 02 Mar '09

02 Mar '09

Hi, I have a Berkeley DB 4.6.18 installed,and have a small code to insert/retrieve/delete info from the database.I want to integrate that code into the FreeRadius codebase to store Radius Accounting msgs into the Berkeley DB. Can you please tell me which part of code in the FreeRadius codebase should I modify ,to insert data obtained from radius accounting msgs,into the Berkeley DB? thanks & rgds Sourav

2 1

FreeRadius 2.1.3 authentication problem with passwd module
by bastardinho69 01 Mar '09

01 Mar '09

Hi, i want to authenticate users against a file similar to /etc/passwd file with passwd module. I have been reading the forums for some time but i cannot find out how to do it properly. I think i am loading that file in a wrong place in radiusd.conf file. I saw it must be called in authorize section but i cannot find such a section in my radiusd.conf file. When i call that file in instantiate section in debugging mode server says that passwd module has loaded my file but server just doesnt check user names against my file. Any help will be appreciated!

3 2

GIT Log for 2009-02-27 00:33 GMT
by aland＠deployingradius.com 27 Feb '09

27 Feb '09

commit a033caa7a5d138a398cf8725a6f6dafc8744942f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 26 17:55:23 2009 +0100 Point to correct buffer Files changed: src/modules/frs_control/frs_control.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 51a9e0099a1cebb49d9d8bc5b2b75edf17f096a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 26 16:15:34 2009 +0100 Export packet code table Files changed: src/include/libradius.h | 2 -- src/lib/radius.c | 24 +++++++++++++----------- 2 files changed, 13 insertions(+), 13 deletions(-) ======================================================================

1 0

pam_radius_auth & IPv6
by Stefan Winter 23 Feb '09

23 Feb '09

Hi, the documentation and ChangeLog of pam_radius_auth don't seem to mention IPv6 at all. Is IPv6 supported? If not, any plans? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 7

GIT Log for 2009-02-20 00:33 GMT
by aland＠deployingradius.com 20 Feb '09

20 Feb '09

commit 7297448b05c035dd56e9d6f0b0a27ca9dcedbcb5 Author: Chris Moules <chris(a)gms.lu> Date: Thu Feb 19 15:38:43 2009 +0000 Update debian patch for changes to radiusd.conf logic. Files changed: debian/patches/01-radiusd-to-freeradius.dpatch | 38 +++++++++++++++-------- 1 files changed, 25 insertions(+), 13 deletions(-) ====================================================================== commit db86d98443b17552e4345e438ab1d124de61d363 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 19 15:48:04 2009 +0100 Added constraint Noted by Sebastian Heil Files changed: raddb/sql/mssql/schema.sql | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit d32a1aa6e5eab0247e09498f76f113c54d0524d8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 19 15:20:21 2009 +0100 Differentiate "no result" from "too many results" Files changed: src/modules/rlm_ldap/rlm_ldap.c | 9 ++------- 1 files changed, 2 insertions(+), 7 deletions(-) ====================================================================== commit 16e80e6feca34d06179cb887a322fbe8d217c1dc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 19 10:09:13 2009 +0100 Moved debug_log_file back to log.c Files changed: src/main/log.c | 2 +- src/main/radconf2xml.c | 1 + src/main/radmin.c | 1 + src/main/radwho.c | 1 + src/modules/frs_control/frs_control.c | 2 +- 5 files changed, 5 insertions(+), 2 deletions(-) ======================================================================

1 0

Debian build fails with current GIT
by Chris Moules 19 Feb '09

19 Feb '09

Hi All, On Friday I started to look at building a Debian package for deployment on a amd64 server. I had been building some development packages on a i686 system up till now. As the git tree has some patches that I need, I grabbed the latest tree. I am having an issue trying to build a Debian package. It looks like some other changes since the 2.1.3 release have broken a few parts for the (Debian) build system. This morning pulling the latest git tree and doing a reset for good measure I (still) get: -*-*-*-*-*-*-*-*-*-*-*-*- git reset --hard Checking out files: 100% (1281/1281), done. HEAD is now at 1cbf67e Added sample commands dpkg-buildpackage -rfakeroot -us -uc dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set LDFLAGS to default value: dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: source package freeradius dpkg-buildpackage: source version 2.1.1-0 dpkg-buildpackage: source changed by Alan DeKok <aland(a)freeradius.org> dpkg-buildpackage: host architecture amd64 ... ... dpatch apply-all --verbose applying patch 01-radiusd-to-freeradius to ./ ... patching file Make.inc.in Hunk #1 succeeded at 48 with fuzz 1. patching file raddb/radiusd.conf.in Hunk #1 FAILED at 33. Hunk #2 succeeded at 112 with fuzz 2 (offset 17 lines). Hunk #3 succeeded at 164 with fuzz 2 (offset 43 lines). 1 out of 3 hunks FAILED -- saving rejects to file raddb/radiusd.conf.in.rej make: *** [patch-stamp] Error 1 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 -*-*-*-*-*-*-*-*-*-*-*-*- This patch, I have patched. I tried "git format-patch" this time so I hope it is in the correct format. After this, the build process ran a little further but errors in the configure at: -*-*-*-*-*-*-*-*-*-*-*-*- checking for setkey in -lcipher... no checking gethostbyaddr_r() syntax... GNU-style checking gethostbyname_r() syntax... GNU-style checking ctime_r() syntax... POSIX-style top_builddir=/home/src/git/freeradius-server2 configure: updating cache config.cache configure: error: conditional "INSTALL_LTDL" was never defined. Usually this means the macro was only invoked conditionally. make: *** [configure-stamp] Error 1 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 -*-*-*-*-*-*-*-*-*-*-*-*- Looking into the 'configure' file and the change log I could see that there has been a number of modifications here. I could not see why INSTALL_LTDL_[TRUE|FALSE] was not set. Putting some debug 'echo's into the configure file showed that the "if test x"${enable_ltdl_install-no}" != xno; then" block was not even processed. Info: Debian Lenny (5.0) - Testing All default packages - All up-to-date Kernel: Linux 2.6.26-1-amd64 git version 1.5.6.5 gcc (Debian 4.3.2-1.1) 4.3.2 Regards Chris

2 3

Missing line in mssql-schema
by Sebastian Heil 19 Feb '09

19 Feb '09

Hello everybody, in the mssql-database-schema, there is one line missing. For the table radacct, in the section "ALTER TABLE [radacct] WITH NOCHECK ADD", there is no information for the column groupname. So, if the accounting packet has no information about the groupname, the insert/update-statement will fail. The following line in the schema.sql should fix this: ALTER TABLE [radacct] WITH NOCHECK ADD ........ CONSTRAINT [DF_radacct_GroupName] DEFAULT ('') FOR [GroupName], ........ Maybe someone can verify this, and add this to the current development-tree? Thanks. -- Jetzt 1 Monat kostenlos! GMX FreeDSL - Telefonanschluss + DSL für nur 17,95 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

2 1

FreeRADIUS+unixODBC+BerkeleyDB
by Sourav Chakraborty 19 Feb '09

19 Feb '09

Hi, We want to use FreeRadius alongwith Oracle Berkeley DB as the backend DB.We have installed FreeRADIUS 1.1.3 and BerkeleyDB.We also have installed unixODBC-2.2.12.Please let us know how to configure FreeRADIUS with unixODBC and connect FreeRADIUS <-->unixODBC<-->BerkeleyDB. Thanks in advance for your help Regards Sourav

3 7

GIT Log for 2009-02-19 00:33 GMT
by aland＠deployingradius.com 19 Feb '09

19 Feb '09

commit bef107d13c9366cd5d0d288d0fe581be846861b3 Author: Chris Moules <chris(a)gms.lu> Date: Wed Feb 18 12:48:52 2009 +0000 Patch so that the "allocate-find" ippool lookup will match "expiry_time" when is NULL. This is its default state, so unless otherwise set, you will never get a IP from the pool. Files changed: raddb/sql/mysql/ippool.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit b6453f333f6b86b7feb69d207e07d04f9c579404 Author: Chris Moules <chris(a)gms.lu> Date: Wed Feb 18 12:44:38 2009 +0000 Fix typo in MySQL ippool.conf and revert change from privous patch that modified one too many statements with "IS NULL" => "= NULL". One of these was in a WHERE clause where the "IS NULL" syntax is correct and needed. Files changed: raddb/sql/mysql/ippool.conf | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

Previous MySQL fix only half correct - Corrected MySQL syntax to = NULL
by Chris Moules 18 Feb '09

18 Feb '09

Sorry for not supplying decent patch files, I don't have time right now. Chris Looks like the follow commit fixed some issues but broke other: commit 243983349ba6d831da15677c46ff1f07fe977d68 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 28 14:59:42 2009 +0100 Corrected MySQL syntax to = NULL -- This patch seems to have blindly turned any instance of "IS NULL" into a "= NULL". This is wrong. The "IS NULL" syntax is correct for anything after the "WHERE" statement. You MUST use this syntax for checking for the NULL value. See http://dev.mysql.com/doc/refman/5.0/en/working-with-null.html The fix was correct in changing the assignment part of "UPDATE" statements from "IS NULL" to "= NULL". For example (snips from the commit log): Good ---- @@ -19,7 +19,7 @@ allocate-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, \ callingstationid = '', username = '', \ - expiry_time IS NULL \ + expiry_time = NULL \ WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" ---- This is an assignment therefore we use the '=' assignment operator. Bad ---- @@ -59,7 +59,7 @@ allocate-update = "UPDATE ${ippool_table} \ SET nasipaddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ - WHERE framedipaddress = '%I' AND expiry_time IS NULL" + WHERE framedipaddress = '%I' AND expiry_time = NULL" ---- This is a comparison and therefore we need to use the "IS NULL" syntax. *-*-*-*-*-*-*-*-* If you are still reading at this point, here is a mini-patch from myself for the "sql/mysql/ippool.conf". ## The ORDER BY clause of this query tries to allocate the same IP-address ## which user had last session... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ - WHERE pool_name = '%{control:Pool-Name}' AND expiry_time < NOW() \ + WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) \ ORDER BY (username <> '%{User-Name}'), \ (callingstationid <> '%{Calling-Station-Id}'), \ expiry_time \ If you do not check _explicitly_ for NULL then nothing will match (if expiry_time == NULL). As the 'ippool.sql' schema file sets 'default NULL' for expiry_time, this is likely to be the case. Example: mysql> select COUNT(*) from radippool WHERE pool_name = 'dummy' AND expiry_time < NOW(); +----------+ | COUNT(*) | +----------+ | 0 | +----------+ 1 row in set (0.00 sec) mysql> select COUNT(*) from radippool WHERE pool_name = 'dummy' AND (expiry_time < NOW() OR expiry_time IS NULL); +----------+ | COUNT(*) | +----------+ | 200 | +----------+ 1 row in set (0.00 sec)

2 2

EAP-PEAP issues with session resumption disabled
by Jouni Malinen 18 Feb '09

18 Feb '09

It looks like FreeRADIUS is currently checking whether session resumption is enabled very late during EAP-PEAP negotiation. Even the protected result indication for success is completed before FreeRADIUS does this and sends EAP-Failure. However, at that point the client is going to discard the EAP-Failure since the only allowed message after successfully completed result indication is EAP-Success. Would it be possible to move the session resumption enabled/disabled check to be done much earlier during the process? Ideally, this would be done when processing the TLS ClientHello so that server could just fall back to using full authentication without causing authentication problems. If that is not feasible for some reason, it would be useful for the protected result indication to result in Failure, not Success, so that the peer implementation would actually accept the EAP-Failure in the end. The code that triggers the current behavior is in eap_tls.c, eaptls_success(). Debug log shows this: [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [peap] FAIL: Forcibly stopping session resumption as it is not allowed. The EAP-TLV there was the end of the protected result (Success) indication. -- Jouni Malinen PGP id EFC895FA

2 1

GIT Log for 2009-02-18 00:33 GMT
by aland＠deployingradius.com 18 Feb '09

18 Feb '09

commit cc3baab2e70eb0d85c18d76ec57479fe2354c3dc Author: Chris Moules <chris(a)gms.lu> Date: Tue Feb 17 14:19:20 2009 +0000 Fix typo Files changed: raddb/sql/mysql/ippool.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 2d6ab03583f9e794220c268c4068cf1b7c85e60f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:14:18 2009 +0100 Fixed debug message. Noted by Dave Anderson. Files changed: src/modules/rlm_wimax/rlm_wimax.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 28571bd977d8e0de0a5700d4cb1456490ba4dfc6 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:13:07 2009 +0100 WiMAX needs OpenSSL for proper functionality Files changed: src/modules/rlm_wimax/Makefile | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a85798c1e7862113f0253fcb65a015fe53c06eef Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:11:31 2009 +0100 Remove broken macro. C preprocessor directives aren't allowed in macros Files changed: src/main/listen.c | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) ====================================================================== commit 9593cf2d31d5aa165ec26382a5914dcf27e93cdf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:09:30 2009 +0100 This was moved earlier Files changed: raddb/otp.conf | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 78 insertions(+), 0 deletions(-) ====================================================================== commit be8d29fcd13c194068a6853e1d07503e9fdb998c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:07:32 2009 +0100 Answer vmps reconfirmation request Patch from Hermann Lauer. Files changed: raddb/sites-available/vmps | 8 -------- 1 files changed, 0 insertions(+), 8 deletions(-) ====================================================================== commit 6b993089edd0e0c8a09e0cbeed0ea2d8d0b19b9d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 17 14:06:59 2009 +0100 Sample logrotate script Files changed: scripts/logrotate.freeradius | 12 ------------ 1 files changed, 0 insertions(+), 12 deletions(-) ======================================================================

1 0

patch for typo in sql/mysql/ippool.conf
by Chris Moules 17 Feb '09

17 Feb '09

Missing slash in sql/mysql/ippool.conf causes freeradius not to start if sqlippool is configured with MySQL. Chris

2 1

[patch] correct answer of a VMPS-Reconfirm-Request
by Hermann Lauer 17 Feb '09

17 Feb '09

Hello Developers, please consider the appended configuration patch for inclusion. It allows radiusd to correctly answer vmps reconfirmation request as OpenVMPS (http://vmps.sourceforge.net/) does this. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 1

GIT Log for 2009-02-17 00:33 GMT
by aland＠deployingradius.com 17 Feb '09

17 Feb '09

commit fdcf5b756f6b26b85e8e439ead6fd725959e3806 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 16 22:42:02 2009 +0100 Fix compile errors src/main/event.c | 2 +- src/modules/frs_detail/frs_detail.c | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-)

1 0

GIT Log for 2009-02-16 00:33 GMT
by aland＠deployingradius.com 16 Feb '09

16 Feb '09

commit 1cbf67ed784fd37dddbfa69493a1b1ebe640089d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 12:05:55 2009 +0100 Added sample commands Files changed: man/man8/radmin.8 | 83 ++--------------------------------------------------- 1 files changed, 3 insertions(+), 80 deletions(-) ====================================================================== commit 1a96258719cc5c808d8e127e8d2c4013befff45b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 11:49:36 2009 +0100 Added "help -r" This prints *all* of the available help Files changed: src/modules/frs_control/frs_control.c | 38 +++++++++----------------------- 1 files changed, 11 insertions(+), 27 deletions(-) ====================================================================== commit 02cfd3edbb412492ff9f3be18b4f7a42844d6a6a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 11:31:23 2009 +0100 Set Accounting-Response in post-proxy fail Files changed: src/modules/rlm_detail/rlm_detail.c | 8 +------- 1 files changed, 1 insertions(+), 7 deletions(-) ====================================================================== commit 652cc8fa317966880361d2199da4cf4ff1895a04 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 09:29:45 2009 +0100 Allow the detail poll interval to be configurable Files changed: raddb/sites-available/buffered-sql | 8 -------- src/include/detail.h | 1 + src/main/event.c | 8 ++++---- src/modules/frs_detail/frs_detail.c | 23 ++++------------------- 4 files changed, 9 insertions(+), 31 deletions(-) ====================================================================== commit 1cb7ac79d2d909872c5dd8b4d3915f19c1624e83 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 09:04:10 2009 +0100 More documentation Files changed: raddb/modules/wimax | 7 +------ 1 files changed, 1 insertions(+), 6 deletions(-) ====================================================================== commit 9eca88636bb1e3689ef649357a9c472518ac7e26 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 09:00:28 2009 +0100 Documentation for raddebug Files changed: man/man8/raddebug.8 | 96 --------------------------------------------------- 1 files changed, 0 insertions(+), 96 deletions(-) ====================================================================== commit b49f751ac57fd9f518f44c35da6495638307c66e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 15 08:44:38 2009 +0100 Minor cleanups Added -d and usage Files changed: scripts/raddebug | 20 +++++++------------- 1 files changed, 7 insertions(+), 13 deletions(-) ======================================================================

1 0

GIT Log for 2009-02-14 00:33 GMT
by aland＠deployingradius.com 15 Feb '09

15 Feb '09

commit 5ec5315e8b69b6dfcc7edec6a6859496c41d5c93 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 13 21:49:22 2009 +0100 Command to print debugging from a running server. Very useful! Files changed: scripts/Makefile | 1 - scripts/raddebug | 106 ------------------------------------------------------ 2 files changed, 0 insertions(+), 107 deletions(-) ====================================================================== commit a304396710dd348c67f356e5e16e218933682e17 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 13 16:08:27 2009 +0100 Fix handling of "debug file [filename]" Make filename optional, which means "no debug file". Re-arrange how we handle the pointers, to avoid threading issues Files changed: src/main/log.c | 3 +- src/main/mainconfig.c | 2 + src/modules/frs_control/frs_control.c | 37 ++++++++++---------------------- 3 files changed, 15 insertions(+), 27 deletions(-) ====================================================================== commit 87f846f0da715b112c6cce42322a67373347d6dd Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 13 16:06:07 2009 +0100 Suppress LF's if there's no output Files changed: src/main/radmin.c | 8 +++----- 1 files changed, 3 insertions(+), 5 deletions(-) ====================================================================== commit b503aa58292cf7bcecc90b98b2879bd6d208385c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Feb 13 15:08:14 2009 +0100 Change detail polling interval from 1s to 10s This lowers the noise in debugging mode. It shouldn't affect performance. Files changed: src/main/event.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit 1424d541fa9e13a09bd8bf464cf5b4e168f31a51 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Feb 11 18:39:21 2009 +0100 Fixed typo Files changed: share/dictionary.xedia | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 4232b637fc9f86dc501a0b928a0d2f270d6f5ed8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 10 09:48:17 2009 +0100 More instructions on DHCP Files changed: raddb/sites-available/dhcp | 5 ----- 1 files changed, 0 insertions(+), 5 deletions(-) ====================================================================== commit 04a3c32f5cfaa5a80ed96a62fe9b4de3d31b3e5f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 10 09:08:13 2009 +0100 Moved otp.conf to modules/otp Files changed: raddb/modules/otp | 78 ------------------------------------------------- raddb/radiusd.conf.in | 4 ++ 2 files changed, 4 insertions(+), 78 deletions(-) ====================================================================== commit 89d550682c2c78e2f87498325dff277af3b00868 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 5 16:22:10 2009 +0100 Add "require message authenticator" config to home servers Files changed: raddb/proxy.conf | 11 ----------- src/include/realms.h | 1 - src/main/realms.c | 14 -------------- 3 files changed, 0 insertions(+), 26 deletions(-) ====================================================================== commit 144f21d3a892a6999818e2d5f3af570a9df12fb0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 5 16:11:06 2009 +0100 Move "allocate request->proxy" to home_server_ldb In preparation for other work Files changed: src/main/event.c | 40 ++++++++++++++++++++++++++++++++ src/main/realms.c | 65 +++++++--------------------------------------------- 2 files changed, 49 insertions(+), 56 deletions(-) ====================================================================== commit f4ea2ec42465dacc681af06653f93742022d6ba5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 5 12:05:38 2009 +0100 Moved checks for detail to home_server_ldb Rather than proxying to a home server, and THEN deciding it wasn't a good idea, we simply skip that home server during the process of trying to find one. Files changed: src/main/event.c | 15 +++++++++++++++ src/main/realms.c | 13 ------------- 2 files changed, 15 insertions(+), 13 deletions(-) ======================================================================

4 5

FreeRadius msg processing rate
by Sourav Chakraborty 15 Feb '09

15 Feb '09

Hello, I have configured FreeRadius server with MySQL.I bombarded the server with Radius Accounting START and STOP msgs randomly with 178461 msgs in 1 minute(~3000 msgs/sec).I got response back of 23658 msgs.I have noted the UDP msg stats using (netstat -s).They are as below-- 67137 packets received 0 packets to unknown port received 111680 packet receive errors 23710 packets sent Note that the initial counts were all 0. >From the stats it seems that -- packets received + packet receive errors = ~msgs sent packets sent = ~response msgs received N.B:- the small anomalies in the counts may be due to unprocessed msgs in the socket buffers. In other words though the msg sending rate was ~3000 msgs/sec,the msg processing rate was ~400 msgs/sec. Can you comment on this?We need to process over 3000 msgs/sec.So is FreeRadius with MySQL a right choice?Please suggest. Thanks and Regards Sourav

4 5

change Access-Reject to Access-Accept after proxy
by Andrey kotrekhov 13 Feb '09

13 Feb '09

Hello, All! The task is: to proxy the request to the next radiusd, and if reply is reject to change it to access-accept and to add some avpairs during local authorization process. Is it possible? I see that I can modify in request->reply->code in own module. But is it right way? -- Andrey

2 1

Online Data(Radius Server)
by Stephen Alistoun 10 Feb '09

10 Feb '09

Hi all, I'm busy working with a Radius Server and want to get the data while the person is online but the problem is that I can only get the data while the person logs off. The Data is stored in the Radacct Table and the two columns are AcctInputOctets and AcctOutputOctets. Is it still possible to get the data of the uploaded and downloaded data while the person is online. Regards, Stephen Alistoun -- View this message in context: http://www.nabble.com/Online-Data%28Radius-Server%29-tp21931094p21931094.ht… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 4

FW: FreeRadius Data Accounting
by Andrew Paternoster 10 Feb '09

10 Feb '09

HI I was wondering if I could get some insight to how people are doing daily data accounting for users that stay connected for days. E.g. Adsl's or dial ups. The problem seems to be that the records in radacct only get a time stamp on a stop or a start. And the session time is updated at every interval. Could I find out if others have managed to get around this problem and how. Thank you Andrew Paternoster

2 2