July 2012 - Freeradius-Devel - lists.freeradius.org

rlm_sql_ocioracle driver v. 0.1
by Ge＠＠ru 14 Mar '15

14 Mar '15

Hi, in attachment patch to add rlm_sql_ocioracle driver to freeradius 2.1.x tree (it seems work yet on 3.x tree). This drivers permit to use function/procedure with CURSOR (through :Ret_Cursor string) like for example: group_membership_query = "begin :Ret_Cursor := \ pkRadius.group_membership_query('%{SQL-User-Name}'); end;" TODO for next release: - add support to oracle connection pool instead of open a new connection for every socket on startup; - enhancement on handle error (through error callback) on do query; - add documentation. Module need oracle instantclient library and ocilib library (http://orclib.sourceforge.net/) Good luck to rlm_sql_ocioracle driver!! Geaaru

2 5

Complete authorize & accounting redis module
by Manuel Guesdon 31 Oct '12

31 Oct '12

Hi, I've adapted rlm_sql to REDIS (http://redis.io/) key-store database. It handle authorize, accounting, checksimul and post-auth (only authorize is deeply tested). Authorize works like rlm_sql with groups, etc... Files are here: http://free.oxymium.net/freeradius/rlm_redisn/ Available as .tgz here: http://free.oxymium.net/freeradius/rlm_redisn-20111112-001.tgz Manuel -- ______________________________________________________________________ Manuel Guesdon - OXYMIUM

4 11

New build system
by Alan DeKok 21 Sep '12

21 Sep '12

OK, I've fixed a bug with dependencies, where it wouldn't re-build a C file if a header changed. I've also added some "configure" support. So modules like rlm_pam, python, perl, etc. only get built if their prerequisites are found. One benefit is that "make -j 8" now works. On my quad-core system I get this: $ time make -j 8 clean all ... real 0m4.357s user 0m24.702s sys 0m3.580s A complete build in less than 5 seconds. Very nice! Alan DeKok.

4 6

Inconsistent behaviour with duplicate dictionary entries
by Brian Candler 02 Aug '12

02 Aug '12

(freeradius 2.1.12) I have noticed an inconsistency when there are duplicate dictionary entries for the same attribute, in particular this one from dictionary.redback: ATTRIBUTE Qos-Policy-Metering 88 string ATTRIBUTE Qos-Metering-Profile-Name 88 string When radtest/radclient is decoding response packets it uses the second entry (this makes sense, it's the last entry read which takes precedence). However the debug output from freeradius -X displays the first entry instead. Example: $ echo -e 'User-Name = "foo(a)example.com"\nCalling-Station-Id="12345678"\nNAS-IP-Address=255.255.255.244\n' | radclient localhost auth testing123 Received response ID 166, code 2, length = 68 Qos-Metering-Profile-Name = "24M_P" Double-Authentication = 1 but freeradius -X shows: ... Sending Access-Accept of id 67 to 127.0.0.1 port 42234 Qos-Policy-Metering := "24M_P" Double-Authentication := 1 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 67 with timestamp +2 This is only significant because I have a GUI wrapper with a radtest function which displays the debug output. This uses the control socket to inject the packet, so I get slightly different output from freeradius -X, but it also shows the first dictionary entry: ... Injected Access-Accept packet to host 127.0.0.1 port 0 code=2, id=3 Qos-Policy-Metering := "24M_P" Double-Authentication := 1 Finished request 3. Going to the next request Thread 44 waiting to be assigned a request Anyway, this suggests to me that there may be two different code paths for looking up attribute numbers to names; maybe they could be unified? Regards, Brian.

2 2

Source Code Modification Help - No Clear Text User-Password logging
by Mark Selby 30 Jul '12

30 Jul '12

I am send this to the freeradius-devel list as I am asking for help on source code modification and felt this was more appropriate than freeradius-users list. If it is felt by many that I should re-submit under the users list I will be happy to do so. I do not have any C programming experience but have made small modifications and compiled tens of open source software programs. I am using freeradius for my company as 802.1x wireless authentication backend for our internal wifi network. We extensively use Kerberos (MIT) as an authentication mechanism and have configured TTLS/PAP on the client and rlm_krb5 to allow users to authenticate using their Kerberos principals and passwords. As a general practice we never ask what other users passwords are, never transmit passwords over the wire in clear text, and never log passwords on disk. I have found there are 2 ways to get the freeradius server to log clear text passwords and would like to ask for source code modification examples or at least pointers the right place to make them such that I can compile a custom version of the software that does not do this. We do want to be able ever to see our users passwords (1) log_auth_badpass|log_auth_goodpass I see there are 4 source files (radiusd.h auth.c mainconfig.c radiusd.c) that include references to log_auth_badpass and log_auth_goodpass. I figure that I can read the code and make any minor modifications that make sure these options can not be turned on. (2) radiusd -X When running in debug mode I can often see on the screen output like the below: [ttls] Got tunneled request User-Name = "gonzo" User-Password = "a_password" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "gonzo" User-Password = "a_password" FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 10.0.1.218 NAS-Identifier = "AP-7eff00" NAS-Port = 0 Called-Station-Id = "AA-1E-72-7A-AA-00:radius" Calling-Station-Id = "A4-5A-AE-54-04-48" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" I can not seem to figure out in the code how to make sure that the User-Password is never printed in the clear like it is above. Any pointers to where in the code I can turn this off would be greatly appreciated. Thanks!

4 3

Tabs in SQL queries...
by Arran Cudbard-Bell 23 Jul '12

23 Jul '12

What do people think to stripping out tabs in xlated SQL queries so that the debug output is actually readable? Is it likely to cause problems for different SQL dialects? -Arran

5 6

Issue with rlm_replicate and retransmissions
by Brian Candler 14 Jul '12

14 Jul '12

I have found some odd behaviour to do with proxying and retransmissions with rlm_replicate (specifically accounting packets) I set up a proxy config, where I also happen to modify the packet. preacct { ... Proxy-To-Realm := "handover" ... update request { Reply-Message += "foo" } } As well as proxying, rlm_replicate is used to feed the accounting packets elsewhere: accounting { sql_log ... replicate # using rlm_replicate and Replicate-To-Realm } Now, if the "handover" home servers are down, and I send a test packet with retransmissions using echo -e 'User-Name="briantest"\nEvent-Timestamp=1342099825\nFramed-IP-Address=1.2.3.4\nAcct-Status-Type=Interim-Update' | radclient -r3 -t3 -x localhost:1813 acct testing123 what I find is: * just the first packet is written to the sql_log (that's fine) * For the second and third packets, freeradius -X just shows "Discarding duplicate request from client localhost port 36957 - ID: 146" After that, freeradius says "Rejecting request 0 (proxy Id 181) due to lack of any response from home server 192.0.2.1 port 1813" * all three packets are replicated. The second and third replica packets are missing the Reply-Message attribute It's this last bit which I think is odd. Shouldn't the replicate also be suppressed for retransmissions? Or if not, shouldn't it at least process the packet in the same way? Regards, Brian.

2 1

Query regarding running radexample to connect to radiusd server over ipv6
by Harshit Shah 03 Jul '12

03 Jul '12

Hello, I have configured my server to run radius on ipv6 and I was also able to successfully connect to radius server using radclient binary on my client machine. I installed radiusclient as well my machine and I am trying to run radexample to login to radius server over ipv6, however I am not able to connect to it over ipv6. I was able to connect to radiusserver using ipv4 through radexample. Can anyone help me out with this? What all options shall I check to proceed further with this? Regards, Harshit

3 5