June 2011 - Freeradius-Devel - lists.freeradius.org

Review request: rlm_xmlrpc
by Angelo Compagnucci 24 Jun '11

24 Jun '11

Hi list, I wrote a simple module to interface freeradius with a webserver via xmlrpc. This is an excerpt from the readme: "Have you ever wanted to trigger an action real time when the user logs in or logs off in freeradius? This module born to solve this problem in a message passing fashion using the xmlrpc tecnology really common to web application. With this module you can write a custom application that exposes an xmlrpc method as an entry point for radius accounting packets. This way you can trigger an event on your webservice at the same time freeradius processes accounting packets. ..." I think this module could be usefull and I wrote it just for fun and profit! The module is not heavily tested in production, but it is in production from a few days on a low traffic machine, just to test and stress it. I will be really gratefull to anyone who wants to use it or contribute to it, hoping that it will be added to freeradius in a near future! You can find the sources on github: https://github.com/angeloc/rlm_xmlrpc Angelo.

2 2

Number of LDAP/SQL queries in inner-tunnel
by Phil Mayers 23 Jun '11

23 Jun '11

Also in discussions on JANET-ROAMING, it seems people are seeing 3 queries to their LDAP servers in inner-tunnel. I believe this is because, with PEAP/MSCHAP, there are 3 passes through the inner tunnel: * EAP identity -> Access-Challenge with EAP-MSCHAP challenge * EAP-MSCHAP response packet -> Access-Challenge with EAP success * EAP success -> Access-Accept In the outer tunnel the trick: eap { ok = return } ...can be used to stop processing, but that's specific to the PEAP/TTLS EAP types; the EAP module just returns "updated" for EAP-Identity and EAP-Success packets. Should rlm_eap return "ok" (or something) in authorize if the packet is an EAP-Identity, NAK, Success or Failure packets? Or maybe "handled" (although that's riskier, since the user can't opt out of it). This would allow you to do: server inner-tunnel { authorize { eap { ok = return } ldap } } Obviously you need to run SQL/LDAP for inner-eap method "response" packets to read Cleartext-Password / NT-Password in time for the authenticate {} section. Cheers Phil

2 2

rlm_sql_iodbc wrong parameter parsing
by Angelo Compagnucci 13 Jun '11

13 Jun '11

I think I found a bug in module rlm_sql_iodbc. The problem is located in rlm_sql_iodbc driver, in the SQLConnect function. The function's signature requires sql_server as second parameter (config->sql_server), but the sql_db one was provided (config->sql_db). This bug forces to set the configuration parameter "radius_db" to the system DSN only for iodbc module, differing from the ODBC one where the "server" parameter is used. I opened the bug https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=150 in which I attached a patch that solves the problem. Hope this helps. Thank you for your interest.

2 5

freeradius memory leak
by Alexander Clouter 12 Jun '11

12 Jun '11

Hi, I have shitty news and really shitty news. The 'good' news, I know FreeRADIUS (2.1.x branch) has a memory leak. The bad news, I'm running in production FreeRADIUS on ARM boxen so things like valgrind are not an option. All I see is a SIGKILL. Spiel from top :) ---- 4260 freerad 20 0 411m 354m 3708 S 4.3 70.4 31:40.31 freeradius ---- What I do have is a 420MB core file of that above process..any takers :) Ideas welcomed. Cheers -- Alexander Clouter .sigmonster says: For adult education nothing beats children.

2 4

GIT Log for 2011-06-10 23:33 GMT
by aland＠deployingradius.com 10 Jun '11

10 Jun '11

commit ee6ba4d187f9e3ba3dea673a4e184ed6773dfa6b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Jun 10 14:52:57 2011 +0200 Make "cadir" and "certdir" globals raddb/modules/eap | 6 ------ raddb/radiusd.conf.in | 2 ++ raddb/sites-available/tls | 12 ------------ 3 files changed, 2 insertions(+), 18 deletions(-)

1 0

RADSEC cert validation doesnt seem to work...
by Alan Buxey 10 Jun '11

10 Jun '11

hi, # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate. If the values do not # match, the cerficate verification will fail, # rejecting the user. okay.. check_cert_issuer = "/DC=com/DC=edupki/CN=eduPKJ" <snip> (0) <<< TLS 1.0 Handshake [length 08b8], Certificate (0) chain-depth=1, (0) error=0 (0) --> BUF-Name = eduPKI CA G 01 (0) --> subject = /DC=org/DC=edupki/CN=eduPKI CA G 01 (0) --> issuer = /DC=org/DC=edupki/CN=eduPKI CA G 01 (0) --> verify return:1 <snip> (0) (other): SSL negotiation finished successfully SSL Connection Established ooops. something isnt quite right in the validation arena.. alan

3 9

RADSEC validation/verification
by Alan Buxey 10 Jun '11

10 Jun '11

hi, I note that the certificate being used in RADSEC can be validated by the certificate issuer - but this doesnt work if there are more than 1 certificate issuer, can RADSEC be validated by for example, an OID in the certificate? I've noted and tried the 'verify' section - which looks rather funky and useful...but my openssl doesnt seem to have any of the useful arguments (-policy) - 0.9.8e-fips-rhel5 I had: client = "/usr/bin/openssl verify -policy .1.3.6.1.4.1.25178.3.1.2 %{TLS-Client-Cert-Filename}" but no joy :-( alan

2 3

Crash of server with RADSEC
by Alan Buxey 09 Jun '11

09 Jun '11

hi, had a nasty Abort of the server when RADSEC configured: Opening new proxy (0.0.0.0, 0) -> home_server (192.168.100.2, 2083) Trying SSL to port 2083 Requiring Server certificate Waking up in 0.1 seconds. Listening on proxy (172.16.1.2, 42575) -> home_server (192.168.100.2, 2083) (1) Proxying request to home server 192.168.100.2 port 2083 Thread 53 waiting to be assigned a request Marking home server 192.168.100.2 port 2083 as zombie (it looks like it is dead). ASSERT FAILED process.c[2374]: home->proto != IPPROTO_TCP Aborted the remote server was up but just not responding at that time - the same test worked as expected when the remote end was answering a few minute later (have done about 100 auths through a RADSEC link now) PS the default config has the password 'testing123' for RADSEC - there is a proposed standard (think its waiting for ratification) - 'radsec' - though I believe that both RADIATOR and radsecproxy use 'mysecret' as the default - worth aligning? alan

3 4

GIT Log for 2011-06-08 23:33 GMT
by aland＠deployingradius.com 08 Jun '11

08 Jun '11

commit 040de881719d1490523c3200ba52cf8fadb6cafe Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jun 8 18:07:35 2011 +0200 Remove unnecessary assertion src/main/process.c | 4 ---- 1 files changed, 0 insertions(+), 4 deletions(-)

1 0

RadSec ... anyone?
by Alan DeKok 08 Jun '11

08 Jun '11

Has anyone managed to test the radsec work in the "master" branch? After all of the requests for it, there has been a surprising lack of response to it's public release. Alan DeKok.

6 12