October 2013 - Freeradius-Devel - lists.freeradius.org

Commit report for v3.0.x branch
by announce＠freeradius.org 18 Oct '13

18 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note recent changes Alan T. DeKok@2013-10-18T16:36:49Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b21dfd9f512258516625… ====== Document timeout here, too Alan T. DeKok@2013-10-18T16:36:49Z Files modified: * raddb/mods-available/exec Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5738aa9588db38c1c66f… ====== -- This commit summary was generated @2013-10-19T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 17 Oct '13

17 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Remove suspicion Arran Cudbard-Bell@2013-10-17T21:13:58Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/78b2c65faff5b02d3373… ====== Typo Arran Cudbard-Bell@2013-10-17T18:32:07Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0b5b7aa05660f5a22675… ====== Avoid string copy in vp_prints_value for PW_TYPE_STRING Arran Cudbard-Bell@2013-10-17T18:23:25Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/24757035541c137b623e… ====== Fix indentation in vp_print_value function Arran Cudbard-Bell@2013-10-17T18:23:25Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1bbe5731a63c645057d3… ====== Debug condition is allocated in the NULL context so that when the command socket goes away, it sticks around Fixes #454 Alan T. DeKok@2013-10-17T14:30:36Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/38f9d8f8b028e26b90c1… ====== add ntlm_auth_timeout option to rlm_mschap Matthew Newton (via Alan T. DeKok)@2013-10-16T17:16:06Z Files modified: * raddb/mods-available/mschap * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2593d05c46474278f44f… ====== add timeout option to rlm_exec Matthew Newton (via Alan T. DeKok)@2013-10-16T17:16:04Z Files modified: * raddb/mods-available/echo * src/modules/rlm_exec/rlm_exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/031bc3ec2ea6a76d56ff… ====== add timeout arg to radius_exec_program, with default EXEC_TIMEOUT Matthew Newton (via Alan T. DeKok)@2013-10-16T17:16:02Z Files modified: * src/include/radiusd.h * src/main/evaluate.c * src/main/exec.c * src/main/modcall.c * src/main/threads.c * src/main/tls.c * src/main/valuepair.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/de81919d7e48848bbc97… ====== -- This commit summary was generated @2013-10-18T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 17 Oct '13

17 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Remove suspicion Arran Cudbard-Bell@2013-10-17T21:13:25Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/83c7c676ca33ed73f72f… ====== Typo Arran Cudbard-Bell@2013-10-17T18:32:24Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/287390887d81e3c4a137… ====== Avoid string copy in vp_prints_value for PW_TYPE_STRING Arran Cudbard-Bell@2013-10-17T18:19:59Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c27630db6efe9c31d6c7… ====== Fix indentation in vp_print_value function Arran Cudbard-Bell@2013-10-17T17:25:44Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/06cb65fe3c706f5b96a5… ====== Debug condition is allocated in the NULL context so that when the command socket goes away, it sticks around Fixes #454 Alan T. DeKok@2013-10-17T14:32:35Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7c51a49ced642d6bc712… ====== -- This commit summary was generated @2013-10-18T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 16 Oct '13

16 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note issues with spaces in User-Name Alan T. DeKok@2013-10-16T16:49:12Z Files modified: * raddb/mods-config/files/authorize Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/536e334f5960314667ce… ====== -- This commit summary was generated @2013-10-17T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 16 Oct '13

16 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note issues with spaces in User-Name Alan T. DeKok@2013-10-16T17:16:54Z Files modified: * raddb/mods-config/files/authorize Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7a36d6bab8396d5acc75… ====== Quiet clang analyzer Alan T. DeKok@2013-10-16T17:14:52Z Files modified: * src/main/detail.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1ca9b237df724ba1efe6… ====== Merge pull request #453 from mcnewton/patch-exec-timeout exec_timeout patch Alan DeKok@2013-10-16T17:14:18Z Files modified: * raddb/mods-available/echo * raddb/mods-available/mschap * src/include/radiusd.h * src/main/evaluate.c * src/main/exec.c * src/main/modcall.c * src/main/threads.c * src/main/tls.c * src/main/valuepair.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/92c5d7db5d592e9e09ef… ====== add ntlm_auth_timeout option to rlm_mschap Matthew Newton@2013-10-15T23:49:56Z Files modified: * raddb/mods-available/mschap * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ab43d6a088411f052647… ====== add timeout option to rlm_exec Matthew Newton@2013-10-15T23:49:49Z Files modified: * raddb/mods-available/echo * src/modules/rlm_exec/rlm_exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/16da2041765c56f2c974… ====== add timeout arg to radius_exec_program, with default EXEC_TIMEOUT Matthew Newton@2013-10-15T23:49:22Z Files modified: * src/include/radiusd.h * src/main/evaluate.c * src/main/exec.c * src/main/modcall.c * src/main/threads.c * src/main/tls.c * src/main/valuepair.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1da1208fab38118a9352… ====== -- This commit summary was generated @2013-10-17T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 16 Oct '13

16 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note recent changes Alan T. DeKok@2013-10-16T17:39:24Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f16d4a9f64ee79ad42c4… ====== add ntlm_auth_timeout option to rlm_mschap Manual port of commit #ab43d6a0 Alan T. DeKok@2013-10-16T17:35:49Z Files modified: * raddb/modules/mschap * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/26dd6891487d365ef6c3… ====== add timeout option to rlm_exec Manual port of commit #16da20417 Alan T. DeKok@2013-10-16T17:35:49Z Files modified: * raddb/modules/echo * raddb/modules/exec * src/modules/rlm_exec/rlm_exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ad043b3a6b4b6454d313… ====== Add timeout arg to radius_exec_program, with default EXEC_TIMEOUT Manual port of commit #1da1208 Alan T. DeKok@2013-10-16T17:35:49Z Files modified: * src/include/radiusd.h * src/main/evaluate.c * src/main/exec.c * src/main/modcall.c * src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a9c1bcc816d86f85d78c… ====== -- This commit summary was generated @2013-10-17T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Creating a two man login module
by PEOPLES, MICHAEL P 16 Oct '13

16 Oct '13

I am very new to RADIUS and C, so feel free to point and laugh. On Red Hat Enterprise Linux 5, I wish to create a login module that would require the "consent" of two users before either could login. I have already modified the pam_radius module to perform a few of the things I need and I know where to "intercept" the authentication process to control whether it is successful or not. When authenticating for sudo, the modified code seems to perform most of what I want. However, my problem is with initial system login. What I cannot figure out is how to provide a prompt during the initial system login so that the two users can "interact". I need to be able to do the following: 1) Provide a standard login prompt and accept the users PIN + Token 2) Generate and display a random number 3) Provide a prompt where that random number can be typed in My experience with the pam_radius module gives me confidence that I can code the underlying "logic" of the process. What I can't figure out is where do I code the prompts? There are suggestions that it is in one of the "getty" type processes, but I cannot figure it. Any help would be very much appreciated, including the suggestion that what I'm trying to do is either ill-advised (I'm not sure why that would be) or extremely difficult (i.e. requires modifying the core kernel). Thank you. Michael Peoples (mp4783) iGEMS COE, Deployment, Engineering, Application Support and Security Global Service Assurance, M5 AT&T Business Solutions Office: +1 614-886-0923 Mobile: +1 614-886-0923 Senior Systems Manager mpeoples(a)att.com<mailto:mpeoples@att.com> This e-mail and any files transmitted with it are AT&T property, are confidential, and are intended solely for the use of the individual or entity to whom this email is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited."

3 2

Re: Creating a two man login module
by Vladimir Grujić 16 Oct '13

16 Oct '13

Hi, You can use google two factor authentication where each user provides the token for another paired user. Both of them hold they own passwords and the token is appended to it. Vladimir Connected by MOTOBLUR™ -----Original message----- From: "PEOPLES, MICHAEL P" <mp4783(a)att.com> To: "freeradius-devel(a)lists.freeradius.org" <freeradius-devel(a)lists.freeradius.org> Sent: Wed, Oct 16, 2013 18:21:06 GMT+00:00 Subject: Creating a two man login module I am very new to RADIUS and C, so feel free to point and laugh. On Red Hat Enterprise Linux 5, I wish to create a login module that would require the “consent” of two users before either could login. I have already modified the pam_radius module to perform a few of the things I need and I know where to “intercept” the authentication process to control whether it is successful or not. When authenticating for sudo, the modified code seems to perform most of what I want. However, my problem is with initial system login. What I cannot figure out is how to provide a prompt during the initial system login so that the two users can “interact”. I need to be able to do the following: 1. Provide a standard login prompt and accept the users PIN + Token 2. Generate and display a random number 3. Provide a prompt where that random number can be typed in My experience with the pam_radius module gives me confidence that I can code the underlying “logic” of the process. What I can’t figure out is where do I code the prompts? There are suggestions that it is in one of the “getty” type processes, but I cannot figure it. Any help would be very much appreciated, including the suggestion that what I’m trying to do is either ill-advised (I’m not sure why that would be) or extremely difficult (i.e. requires modifying the core kernel). Thank you. Michael Peoples (mp4783) iGEMS COE, Deployment, Engineering, Application Support and Security Global Service Assurance, M5 AT&T Business Solutions Office: +1 614-886-0923 Mobile: +1 614-886-0923 Senior Systems Manager mpeoples(a)att.com<mailto:mpeoples@att.com> This e-mail and any files transmitted with it are AT&T property, are confidential, and are intended solely for the use of the individual or entity to whom this email is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited."

1 0

AD tokenGroups
by Phil Mayers 16 Oct '13

16 Oct '13

All, I recently discovered that newer versions of AD have a magic attribute on user objects, visible via a BASE scope search on the user object, called tokenGroups. This attribute is a list of all the SIDs of all groups the user is a member of, including nested groups, and taking account of disabled groups: $ ldapsearch -h $DC -b 'CN=usern,OU=...' -s base tokenGroups|head -20 dn: CN=usern,OU=... tokenGroups:: AQIAAAAAAAUgAAAAIQIAAA== $ ldapsearch -h $DC -b $B -s sub objectSid=<ldap escaped tokenGroup val> dn: CN=Users,CN=Builtin,DC=ic,DC=ac,DC=uk cn: Users It strikes me that reading this (and translating SIDs to CN) might be a useful feature to have in the LDAP module - the SIDs are basically static so can be cached internally, so in the long run it's quick, and handles the nesting which is nice. It's plain LDAP, so no weird #defines needed. If people want I'll knock together a patch (as I have working local code from another application that I wrote that reads it). The idea would be an ldap config item like this: ldap { # extract LDAP-Group values from AD magic tokenGroups # attribute once a user has been found - handles nested # and disabled groups ad_tokengroups = [no|yes] # which attribute of the group is the group "name" ad_tokengroup_name = "cn" }

3 5

Commit report for v3.0.x branch
by announce＠freeradius.org 15 Oct '13

15 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Quiet clang analyzer Alan T. DeKok@2013-10-15T17:43:33Z Files modified: * src/main/detail.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1bdc7f772efd0d7fb547… ====== Remove unused assignments Alan T. DeKok@2013-10-15T17:13:26Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3219386c8961e43d2f9a… ====== -- This commit summary was generated @2013-10-16T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0