January 2011 - Freeradius-Devel - lists.freeradius.org

why the freeradius server can't support eap-aka?
by zhangyan 14 Jan '11

14 Jan '11

hello, why the freeradius server can't support eap-aka, if because of license needed? Does anyone know which server can do eap-aka authentication? Thanks very much. BR, Yan -- View this message in context: http://freeradius.1045715.n5.nabble.com/why-the-freeradius-server-can-t-sup… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 2

rlm_redis module "patch"
by Gabriel Blanchard 13 Jan '11

13 Jan '11

Attached is two new modules. Apologies ahead of time for submitting this as a tgz. rlm_redis allows you to connect and query a redis key-store database. Basically same idea as memcached except the keys don't expire if you allow them to. http://redis.io/ rlm_redis requires a redis server instance and the hiredis libraries to be installed https://github.com/antirez/hiredis Preferably redis should be running version 2.2 as it allows you to expire keys. rlm_rediswho is a module that is similar to rlm_radwho, it obviously uses the rlm_redis module. What it does is that it basically "dumps" all the accounting data/sessions into this key store database. Once a user has so many sessions (defined by trim-count) rlm_radwho will start trimming out old data. If there is no update for said user for expiry-time, the redis server itself will expire the key. I anticipate the rlm_redis module could be used for something else, since it is _considerably_ faster than any sql module (about 100,000 queries per second) . But I thought that this was perfect for a radwho module as it allows you to expire stale sessions automatically, therefore the db won't grow an insane amount. Obviously this is all work in progress, but it appears to run stable. It compiles clean on my Mac but may need some configure script magic to make it a little more portable.

2 7

Re: dialup_admin php notice errors
by Stefan Winter 13 Jan '11

13 Jan '11

Hi, just now I have had to upgrade my dialup_admin installation to a machine running PHP5.3, and also noticed numerous PHP errors. I have fixed the code, see attached patch. It solves the following bugs/deprecated code warnings: * replace ereg -> preg_match, ereg_replace -> preg_replace, split -> preg_split for PHP5.3 compatibility * fix LIMIT not working when using MySQL * add configuration item "timezone" to make PHP 5.1+ happy and adds one (trivial, one-liner) feature: * add comparison operators "!=" and "not like" to Accounting Now, I have an almost error/warning/notice free installation. There is still something bogus around the use of mktime() someplace, but I don't use that part of dialup_admin, so I'll leave that alone. It's tested to work at my installation, and I would appreciate if the code could get into mainstream release. But it can of course use much more testing! Particularly the LDAP-related parts (user_edit a.s.o.) only got the same code massage about preg's but got no testing because that's also an unused code part for me. Doesn't help for Todd's errors, I suppose, but I find these code changes useful anyway. Greetings, Stefan Winter Am 06.01.2011 21:53, schrieb Alan DeKok: > Todd Bateman wrote: >> Is CS down or the information change? I went to try to see if that was >> the problem, but I get a connection refused. > dialup_admin hasn't used CVS for many years. > > The latest version is included in 2.1.10, but if you look at the "git" > repository, the dialup_admin code hasn't been changed in years. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 7

rlm_perl.c questions
by Anatoly Ivanov 11 Jan '11

11 Jan '11

Hi everybody, I have a couple of questions regarding modules/rlm_perl/rlm_perl.c: perl_detach(...): 1. Is it correct to call PERL_SYS_TERM in detach()? I am experiencing quite random and unpredictable segfaults with radius 2.1.8 and rlm_perl, and it really looks like memory allocation/multithreading error. I have very similar system running radius 2.1.7, and it works just fine. The most significant difference in rlm_perl between 2.1.7 and 2.1.8 is that PERL_SYS_TERM call. According to the documentation (http://perldoc.perl.org/perlembed.html) PERL_SYS_TERM should be called only once. In our case, it is called once per detaching thread. 2. This code: embed = rad_malloc(4*(sizeof(char *))); memset(embed, 0, sizeof(4*(sizeof(char *)))); looks like a misprint to me. Not that it would cause any real errors, but it is inaccurate anyway. Thank you, Anatoly.

3 7

freeRadius with SOAP
by Rajkumar R 10 Jan '11

10 Jan '11

Hi, I would like to use SOAP or any non-persistent connection(please suggest if any good alternatives) to send a trigger message upon a radius-acct-start message inorder to do one more level of authentication. For this, I request you to provide any examples/documents describing on the same would be helpful for me. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Framework to support multiple BRAS specific AVPs
by Rajkumar R 10 Jan '11

10 Jan '11

Hi, Request you to clarify on my below question: Is it possible to have a different AVPs grouped (for a COA message) for different NAS vendors? If so, is it achievable with configurable settings? Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Re: Module Creation and Incoming request identification
by Rajkumar R 05 Jan '11

05 Jan '11

Thanks all for your inputs. Is it the account type listen section in radiusd.conf file you are referencing about(to include new module)? -Raj ________________________________________ De: freeradius-devel-bounces+lscrlstld=gmail.com(a)lists.freeradius.org [mailto:freeradius-devel-bounces+lscrlstld=gmail.com@lists.freeradius.org] Em nome de Rajkumar R Enviada em: ter?a-feira, 4 de janeiro de 2011 08:59 Para: freeradius-devel(a)lists.freeradius.org Assunto: Module Creation and Incoming request identification > 2. How do I make the new procedure(to send UDPmsg to other application) > aware that a new Acc-Start/Stop message has arrived? This is because, > sending a msg to other application should be instantaneous. You can create a perl module e call it in accounting section, it is possible to filter acct stop and start using ulang. ------------------------------ Message: 2 Date: Tue, 4 Jan 2011 12:56:54 +0000 From: Alexander Clouter <alex(a)digriz.org.uk> Subject: Re: Module Creation and Incoming request identification To: freeradius-devel(a)lists.freeradius.org Message-ID: <m1ibv7-mk8.ln1(a)chipmunk.wormnet.eu> Rajkumar R <rajkumar.r(a)aricent.com> wrote: > > I need to create a new module, which should send a UDP msg to another > application server upon a Account-Start/Stop message request from a > NAS. For this, request you to provide your inputs on the below > queries: > rlm_perl Cheers -- Alexander Clouter .sigmonster says: Today is the last day of your life so far. ------------------------------ Message: 3 Date: Wed, 5 Jan 2011 07:58:52 +1000 From: Nikki Watt <nikki.watt(a)qut.edu.au> Subject: RE: Module Creation and Incoming request identification To: FreeRadius developers mailing list <freeradius-devel(a)lists.freeradius.org> Message-ID: <6D78B4DCFF9785409FE29BE1F01B3A6BA8179461(a)QUTEXMBX03.qut.edu.au> Content-Type: text/plain; charset="us-ascii" Hi Raj, I've written a similar module for freeradius (except that it does asynchronous HTTP interaction with another server rather than UDP) by following the instructions on the freeradius wiki. There's also an excellent example module included in the freeradius source code (<freeradius source directory>/src/modules/rlm_example/rlm_example.c) that I used as a guide. If you're comfortable with the C language, perhaps that's the way to go? If not, as others have suggested, rlm_perl may be better for you. In either case, you just need to reference the module in the accounting section of your config and freeradius will call the module whenever it receives an accounting packet. Regards, Nikki Nikki Watt | Network Programmer | Network Operations Centre | ITS | Level 3, Synergy Building (88 Musk Avenue, Kelvin Grove) | Ph: 3138 6858 | nikki.watt(a)qut.edu.au<mailto:nikki.watt@qut.edu.au> | www.its.qut.edu.au<http://www.its.qut.edu.au> | CRICOS No 00213J From: freeradius-devel-bounces+nikki.watt=qut.edu.au(a)lists.freeradius.org [mailto:freeradius-devel-bounces+nikki.watt=qut.edu.au@lists.freeradius.org] On Behalf Of Rajkumar R Sent: Tuesday, 4 January 2011 8:59 PM To: freeradius-devel(a)lists.freeradius.org Subject: Module Creation and Incoming request identification Hi, I need to create a new module, which should send a UDP msg to another application server upon a Account-Start/Stop message request from a NAS. For this, request you to provide your inputs on the below queries: 1. I read in the wiki link that rlm approach to be used for creating a new module. Any examples available on the same? 2. How do I make the new procedure(to send UDPmsg to other application) aware that a new Acc-Start/Stop message has arrived? This is because, sending a msg to other application should be instantaneous. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

RE: Module Creation and Incoming request identification
by Rajkumar R 05 Jan '11

05 Jan '11

Could anyone please provide your inputs on this? thanks, Raj From: Rajkumar R Sent: Tuesday, January 04, 2011 4:29 PM To: 'freeradius-devel(a)lists.freeradius.org' Subject: Module Creation and Incoming request identification Hi, I need to create a new module, which should send a UDP msg to another application server upon a Account-Start/Stop message request from a NAS. For this, request you to provide your inputs on the below queries: 1. I read in the wiki link that rlm approach to be used for creating a new module. Any examples available on the same? 2. How do I make the new procedure(to send UDPmsg to other application) aware that a new Acc-Start/Stop message has arrived? This is because, sending a msg to other application should be instantaneous. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Module Creation and Incoming request identification
by Rajkumar R 04 Jan '11

04 Jan '11

Hi, I need to create a new module, which should send a UDP msg to another application server upon a Account-Start/Stop message request from a NAS. For this, request you to provide your inputs on the below queries: 1. I read in the wiki link that rlm approach to be used for creating a new module. Any examples available on the same? 2. How do I make the new procedure(to send UDPmsg to other application) aware that a new Acc-Start/Stop message has arrived? This is because, sending a msg to other application should be instantaneous. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

4 3

proposal for using filter-id attribute for authorization with pam_radius
by Renke Brausse 03 Jan '11

03 Jan '11

Hi list, we're using for OPT authentification a Vasco Identikey server. Unfortunately the software is rather limited, e.g. it is not possible to define access rules based on groups. The server is able to perform a RADIUS password challenge but only as "PIN and OTP are correct" - not exactly the kind of authentication I expected... The only way to get something like grouping with this product is out-sourcing to the client: Vasco cann add a filter-id attribute to the response, if the client is capable of interpreting such responses it is possible to group users (though with strings on a per-user base). As we plan to use the OTP tokens to secure our SSH service I searched for a method to authorize users not only with RADIUS but additionally the feature to check for specific filter-ids in the response - it seems no one has ever implemented such a thing. Anyway, I extended pam_radius* so it is possible to use filter-ids for authentication - the patches for 1.3.17 are attached. Would an extension like this useful for the vanilla release of pam_radius? Greetings Renke *) I am _not_ a programmer, the stuff I changed should be checked/rewritten/used only as concept...

2 1