April 2012 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Complete authorize & accounting redis module
by Manuel Guesdon 31 Oct '12

31 Oct '12

Hi, I've adapted rlm_sql to REDIS (http://redis.io/) key-store database. It handle authorize, accounting, checksimul and post-auth (only authorize is deeply tested). Authorize works like rlm_sql with groups, etc... Files are here: http://free.oxymium.net/freeradius/rlm_redisn/ Available as .tgz here: http://free.oxymium.net/freeradius/rlm_redisn-20111112-001.tgz Manuel -- ______________________________________________________________________ Manuel Guesdon - OXYMIUM

4 11

New build system
by Alan DeKok 21 Sep '12

21 Sep '12

OK, I've fixed a bug with dependencies, where it wouldn't re-build a C file if a header changed. I've also added some "configure" support. So modules like rlm_pam, python, perl, etc. only get built if their prerequisites are found. One benefit is that "make -j 8" now works. On my quad-core system I get this: $ time make -j 8 clean all ... real 0m4.357s user 0m24.702s sys 0m3.580s A complete build in less than 5 seconds. Very nice! Alan DeKok.

4 6

packet dump module for debugging
by Matthew Newton 24 Apr '12

24 Apr '12

Hi, I was wondering a while ago exactly what AVPs were going through freeradius at a particular point, and it wasn't easy (that I could find) to just dump the lot out - detail or linelog will write certain AVPs, but not everything that's currently known. Maybe there's a way to do it, but I missed it :) So I hacked up a really quick module to do it. Whenever it's called in the server, it just dumps out all pairs in request, reply, control, and proxy lists as well if available. Made it much easier for me to see what state the packet was in at a particular point. Not submitting this necessarily for inclusion in the main tree, but just thought I'd tidy it up and push it out in case it's of any use to anyone else. https://github.com/mcnewton/freeradius-server/tree/rlm_debugpacket Example - include 'debugpacket' in post-auth, you might get debug output containing something like the following (obviously, you can call it as many times as you like, but after a couple or so it gets a bit confusing!): ... (0) debugpacket : ---------------------------------------------------- PACKET DEBUG -----v-v-v-v-v (0) debugpacket : Request: User-Name = "bob" User-Password = "Test" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x57c4fc026b2c741303aa0931f21b81f1 (0) debugpacket : Reply: Reply-Message = "Hi, come on in." (0) debugpacket : Control: Cleartext-Password := "Test" Auth-Type = PAP (0) debugpacket : -----------------------------------------------------------------------^-^-^-^-^ (0) [debugpacket] = noop ... I'm fully expecting there to already exist a better way - in which case I'd be pleased to be informed :) Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 2

Help: PAP with Sha1
by vishal_nitr 20 Apr '12

20 Apr '12

Hi,    I am using free-radius-2.1.12. I see that radius uses MD5 for encoding/decoding passwords. I am using PAP authentication.    In my radius client I changed encoding to SHA1; due to which radius started rejecting auth requests saying password mismatch from rlm_pap which is obvious.     I tried changing few things in lib/radius.c to SHA1 but with no success. I ran radiusd with -X option and I saw following:With MD5 from client:        User-Name = "vishal"        Calling-Station-Id = "00-23-68-0F-1A-E6"        NAS-Port = 0        NAS-Port-Type = Wireless-802.11        Framed-MTU = 1400        Service-Type = Framed-User        NAS-IP-Address = 127.0.0.1        NAS-Identifier = "ap7131-0F1AE6"        NAS-Port-Id = "0"        User-Password = "vishal123" With SHA1 from client:        User-Name = "vishal"        Calling-Station-Id = "00-23-68-0F-1A-E6"        NAS-Port = 0        NAS-Port-Type = Wireless-802.11        Framed-MTU = 1400        Service-Type = Framed-User        NAS-IP-Address = 127.0.0.1        NAS-Identifier = "ap7131-0F1AE6"        NAS-Port-Id = "0"        User-Password = "\356Ew\2310\347\326\367h\r1\223,\224\024\352\027\241>5" Alan Dekok just informed me that RADIUS uses MD5 and it can't be changed (thanks ALAN). And I don't want to go against protocol. But as I have spent almost a week in finding a location where RADIUS decodes the password received from client. Please can somebody point me the place where this happens. Thanks and Regards, Vishal Kotalwar, Bangalore-35. 09900055647.

3 2

Is it possible to log the Dial-In user password?
by Henrik Karlsson 19 Apr '12

19 Apr '12

Hi, I need to log the Dial-In users Password and I wonder if it is possible to do that in a freeRADIUS server? I'm using freeRadius and MySQL server to store information such as userinfo and traffic logs. If it is possible can someone please describe how? Regards Henrik Henrik Karlsson Projektledare Direkt: +46 (0)8-601 66 57 Mobil: +46 (0)76-104 65 87 Fax: +46 (0)19-10 19 45 Generic Mobile Systems Sweden AB Drottninggatan 10 702 10 ÖREBRO henrik.karlsson(a)generic.se<mailto:henrik.karlsson@generic.se> www.genericmobile.se<http://www.genericmobile.se/> Kommunikation via SMS, fax, e-post, Minicall, webb - välj det som passar ditt företag bäst [cid:image001.jpg@01CD1D6C.4E0275F0]

4 3

Fwd: Upgraded freeradius to 2.1.12 with openssl 0.9.8n - Error: No SSL info available. Waiting for more SSL data.
by Winson Fernandes 16 Apr '12

16 Apr '12

Hi, I upgraded freeradius version from 2.0.2 to 2.1.12 and also the openssl version from 0.9.7 to 0.9.8n. The issue I am facing now is with peap mschapv2 windows client not able to authenticate with my radius server. The error is [peap] No SSL info available. Waiting for more SSL data. I added few more logs and I could see the callback function cbtls_msg returning due to the arg (state) being NULL in freeradius-server-2.1.12/src/modules/rlm_eap/libeap/cb.c void cbtls_msg /* * Work around bug #298, where we may be called with a NULL * argument. We should really log a serious error */ if (!arg) return; Not sure what the bug298 is all about and also what could be the possible reason for the arg (state) to be NULL? Regards, Winson

2 3

few small bugfixes
by Matthew Newton 11 Apr '12

11 Apr '12

Hi, Three small bugs fixed over the Easter holiday: commit 98e44bb638aa0656e823e42f6bab37e33910c8b9 This one's my fault. You shouldn't try and change the group of the linelog file if you're using syslog. Moved the chgrp inside the block that does file-related non-syslog stuff. commit 45a0c370ad73384fbbe1fa8e5f7c8337b99423c1 I noticed that if FR started up and some eap sub-modules couldn't be loaded (weren't there, or on initial timeout the cert generation takes too long), it segfaulted. This fixes the test where the pointer had been set to NULL, and the if was trying to check the contents. commit ca706b82e6b0a8b774e97077e5e01489cd3bbefc Another one I missed before - there is now no need for EAP-TLS to be present for PEAP or TTLS to work, so no need for the check & error if it's not there. All three at https://github.com/mcnewton/freeradius-server/tree/smallfixes Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 1

Using %{User-Password} in sql query for mschapv2
by Oliver 01 Apr '12

01 Apr '12

Hi everybody, I use FreeRADIUS Version 2.1.10 on Debian with OpenVPN and xl2tp/openswan and the rlm_sql module. I want to use the user password in a sql query in dialup.conf. This works fine with ssh and openvpn logins but not with mschapv2. I don't know if the password is really not submitted or just not replaced in the sql query. Is there a simple way to make this work? Thanks in advance

3 6

Re: Using %{User-Password} in sql query for mschapv2
by Alan Buxey 01 Apr '12

01 Apr '12

It can be stored as nthash alan

2 1