January 2012 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Complete authorize & accounting redis module
by Manuel Guesdon 31 Oct '12

31 Oct '12

Hi, I've adapted rlm_sql to REDIS (http://redis.io/) key-store database. It handle authorize, accounting, checksimul and post-auth (only authorize is deeply tested). Authorize works like rlm_sql with groups, etc... Files are here: http://free.oxymium.net/freeradius/rlm_redisn/ Available as .tgz here: http://free.oxymium.net/freeradius/rlm_redisn-20111112-001.tgz Manuel -- ______________________________________________________________________ Manuel Guesdon - OXYMIUM

4 11

New build system
by Alan DeKok 21 Sep '12

21 Sep '12

OK, I've fixed a bug with dependencies, where it wouldn't re-build a C file if a header changed. I've also added some "configure" support. So modules like rlm_pam, python, perl, etc. only get built if their prerequisites are found. One benefit is that "make -j 8" now works. On my quad-core system I get this: $ time make -j 8 clean all ... real 0m4.357s user 0m24.702s sys 0m3.580s A complete build in less than 5 seconds. Very nice! Alan DeKok.

4 6

RE: Not verifying username in EAP-TLS
by Verma Anurag-VNF673 30 Jan '12

30 Jan '12

Looks like the link below may provide what I need. I will try this out. http://www.dartmouth.edu/~pkilab/pages/EAP-TLSwFreeRadius.html From: Verma Anurag-VNF673 Sent: Friday, January 27, 2012 5:50 PM To: 'freeradius-devel(a)lists.freeradius.org' Subject: Not verifying username in EAP-TLS Hi, I want to bypass user verification when using EAP-TLS - i.e. freeRADIUS should only verify the certificate validity without verifying that the user name, contained in CN part of the Subject field in the certificate, is present in the user database. Is it possible to do this? If so, what should the configuration look like? Thanks, Anurag

1 0

Not verifying username in EAP-TLS
by Verma Anurag-VNF673 27 Jan '12

27 Jan '12

Hi, I want to bypass user verification when using EAP-TLS - i.e. freeRADIUS should only verify the certificate validity without verifying that the user name, contained in CN part of the Subject field in the certificate, is present in the user database. Is it possible to do this? If so, what should the configuration look like? Thanks, Anurag

3 2

New build system in "master" branch
by Alan DeKok 27 Jan '12

27 Jan '12

After 10+ years of fighting recursive make, I've committed a new system. It's only used if you want, by editing Make.inc, and adding a line: BOILER=yes When you do that, the build should be MUCH faster. Everything goes into a "build" directory, so don't look for libs/binaries in their usual places. On my system, the build is rather a lot faster. Anyone doing even occasional development should look into using it. Let me know what you think. Alan DeKok.

4 18

DHCP + sqlpippol test, v2.1.x
by Fajar A. Nugraha 25 Jan '12

25 Jan '12

Hi, I'm testing some modifications to make DHCP able to allocate dynamic IP address using sqlippool. It's only tested with one client, but it should be able to assign dynamic IP address (smallest ip address first, due to sorting). The modification is purely config files addition/modification, no source code change. Current version is here: https://github.com/fajarnugraha/freeradius-server/commit/8af7142 Static IP allocation SHOULD also be possible by having expiration time far in the future (e.g. 2100-01-01 00:00:00) on radippool table, and modifying the query to NOT overwrite the expiration time on that scenario. This hasn't been implemented though. Any thoughts on these changes? Perhaps there a simpler way to implement it. -- Fajar

3 11

Why using username instead of user id?
by Morteza Milani 24 Jan '12

24 Jan '12

In freeradius sql modules, queries are based on username instead of user id. Is it anything related to performance or it went in this way without any decision? Using username has two problems: * updating a username, or deleting one needs querying at least three tables. * Comparing strings needs more time than comparing integers when fetching data. Regards, Morteza Milani

5 8

ocsp timeout and server failure
by Matthew Newton 23 Jan '12

23 Jan '12

Hi, If freeradius tries to talk to an OCSP responder, and the server is not available for some reason, the ocsp check gets stuck for a while, then bombs out with (as expected) a verification failure. The two problems are that it takes quite a while for the client to be told it can't connect, and clients with good certificates can't connect. The obvious solution is to make the ocsp server more resilient, but that's not always going to be possible. The easy solution to the problem of the server temporarily going away seems to be to add a "soft-fail" option, whereby the server will accept the certificate if it can't talk to the OCSP responder. This obviously has some security implications so can't be done unless it's been thought through properly. However, even adding this feature doesn't solve the problem, as the whole client access request fails because the OCSP takes so long to timeout (depending on failure mode). I'm guessing a reasonable solution, apart from high availability OCSP, is to have a short timeout on the ocsp query, then enable success if the server fails to respond (e.g. the certificate can't be checked), and to also use CRLs that are updated frequently. OCSP can then be used as an 'immediate' solution, whereas the CRL is the more permanent in case OCSP isn't available. I've written two smallish patches against v2.1.x - the first adds a 'timeout' option to the ocsp section. This gives up checking after the set number of seconds. I've tested this code through several different scenarios and it seems to all behave as expected (setting timeout=0, the default, has the same behaviour as before): https://github.com/mcnewton/freeradius-server/commit/56d6093828839ece191dad… The second option adds the option 'softfail', which by default is "no" (the safer option). In the case it's set to yes, a failure to query the server (or get a response) is treated as a success in terms of validation. There are warnings in the eap.conf file that this is not entirely secure, so needs to be assessed according to the risk. It's a simpler patch from the above, and applies on top: https://github.com/mcnewton/freeradius-server/commit/119ac969d8c658934d86de… Comments? Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 2

Re: Why using username instead of user id?
by Morteza Milani 23 Jan '12

23 Jan '12

I couldn't get my answer! > On one of my systems, we use ids. It's somewhat complicated though: > - use stored procedures, as I need to use several statements to > achieve the same functionality. It's better than joins (which is very > expensive in mysql cluster) >- lookup user id based on username (on an additional table, obviously) >- lookup other properties (e.g. radcheck, radreply, etc.) based on the id The only extra step required is to lookup user id from another table. Then we can use it instead of username in all queries. To achieve this, we can set User-Name to that id. Maybe I'm missing something. I really want that "live" and "historical" tables implemented. I have 35000 users and I need fetching data from radacct for statistical analysis. It's a heavy table! Morteza Milani

3 2