May 2012 - Freeradius-Devel - lists.freeradius.org

LDAP module
by Alan DeKok 04 May '12

04 May '12

I'm taking a look at the LDAP module. It's rather more complicated than I like. I'm thinking of moving it to use the new connection pools. I have a first draft which uses the connection pool to open the sockets. But... the behavior of the module is hard to understand. I'll start off with my thoughts: 1) connection pool is working. They don't *do* anything, but they connect 2) authentication. The "bind as user" code is simple. But what's with the "perform_search" and "filter" stuff? Why not use have a statically configured user DN? I'd like to avoid some of the complexity of the current code. So is the user DN really some arbitrarily changing value? Do you really have to search over the entire DB for "uid=username" in order to find the user? Alan DeKok.

6 7

small patch for detail.log module (2.x or 3.x)
by alan buxey 02 May '12

02 May '12

hi, small patch for the detail.log in freeRADIUS - this aligns it with the detail module - and ensures that people with IPv6 clients get their directories/files sorted properly rather than all stuff from IPv6 clients going into the same single files --- detail.log 2012-02-27 13:54:12.000000000 +0000 +++ /tmp/detail.log 2012-05-02 10:17:24.000000000 +0100 @@ -15,7 +15,7 @@ # in the 'authorize' section, below. # detail auth_log { - detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d + detailfile = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read @@ -37,7 +37,7 @@ # in the 'post-auth' section, below. # detail reply_log { - detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d + detailfile = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d detailperm = 0600 } @@ -49,7 +49,7 @@ # in the 'pre-proxy' section, below. # detail pre_proxy_log { - detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d + detailfile = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read @@ -69,7 +69,7 @@ # in the 'post-proxy' section, below. # detail post_proxy_log { - detailfile = ${radacctdir}/%{Client-IP-Address}/post-proxy-detail-%Y%m%d + detailfile = ${radacctdir}/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d detailperm = 0600 } alan

1 0

Apache2 mod-auth-radius - include client IP address
by Matthew Newton 01 May '12

01 May '12

Hi, Not sure if this is the correct list - if not, apologies. I've set up mod_auth_radius, which is working great, but it doesn't include the user's IP address in the radius query. It would be nice to be able to check against this in certain circumstances. Of course, proxies and other things can mess with this, so it can't always be trusted for authorization purposes, but on corporate LANs where the network is known it should be safe to use, and is always good to log. The following mini patch adds the Calling-Station-Id attribute to the RADIUS request, with apache's remote_ip as the value. Cheers, Matthew >From 08cbb6eb5df3246c602fbce54c61ae3f124ca415 Mon Sep 17 00:00:00 2001 From: Matthew Newton <mcn4(a)leicester.ac.uk> Date: Tue, 1 May 2012 15:08:52 +0100 Subject: [PATCH] add calling-station-id = client ip to radius request --- mod_auth_radius-2.0.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/mod_auth_radius-2.0.c b/mod_auth_radius-2.0.c index 8b659f4..08671ef 100644 --- a/mod_auth_radius-2.0.c +++ b/mod_auth_radius-2.0.c @@ -348,6 +348,7 @@ typedef struct radius_packet_t { #define RADIUS_REPLY_MESSAGE 18 #define RADIUS_STATE 24 #define RADIUS_SESSION_TIMEOUT 27 +#define RADIUS_CALLING_STATION_ID 31 #define RADIUS_NAS_IDENTIFIER 32 /* service types : authenticate only for now */ @@ -883,6 +884,10 @@ radius_authenticate(request_rec *r, radius_server_config_rec *scr, /* ************************************************************ */ + /* add client IP address */ + add_attribute(packet, RADIUS_CALLING_STATION_ID, r->connection->remote_ip, strlen(r->connection->remote_ip)); + + /* ************************************************************ */ /* add state, if requested */ if (state != NULL) { add_attribute(packet, RADIUS_STATE, state, strlen(state)); -- 1.7.2.5 -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

1 0