- Freeradius-Devel - lists.freeradius.org

Commit report for master branch
by announce＠freeradius.org 17 Oct '13

17 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Remove suspicion Arran Cudbard-Bell@2013-10-17T21:13:25Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/83c7c676ca33ed73f72f… ====== Typo Arran Cudbard-Bell@2013-10-17T18:32:24Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/287390887d81e3c4a137… ====== Avoid string copy in vp_prints_value for PW_TYPE_STRING Arran Cudbard-Bell@2013-10-17T18:19:59Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/c27630db6efe9c31d6c7… ====== Fix indentation in vp_print_value function Arran Cudbard-Bell@2013-10-17T17:25:44Z Files modified: * src/lib/print.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/06cb65fe3c706f5b96a5… ====== Debug condition is allocated in the NULL context so that when the command socket goes away, it sticks around Fixes #454 Alan T. DeKok@2013-10-17T14:32:35Z Files modified: * src/main/command.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7c51a49ced642d6bc712… ====== -- This commit summary was generated @2013-10-18T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v3.0.x branch
by announce＠freeradius.org 16 Oct '13

16 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note issues with spaces in User-Name Alan T. DeKok@2013-10-16T16:49:12Z Files modified: * raddb/mods-config/files/authorize Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/536e334f5960314667ce… ====== -- This commit summary was generated @2013-10-17T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 16 Oct '13

16 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note issues with spaces in User-Name Alan T. DeKok@2013-10-16T17:16:54Z Files modified: * raddb/mods-config/files/authorize Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7a36d6bab8396d5acc75… ====== Quiet clang analyzer Alan T. DeKok@2013-10-16T17:14:52Z Files modified: * src/main/detail.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1ca9b237df724ba1efe6… ====== Merge pull request #453 from mcnewton/patch-exec-timeout exec_timeout patch Alan DeKok@2013-10-16T17:14:18Z Files modified: * raddb/mods-available/echo * raddb/mods-available/mschap * src/include/radiusd.h * src/main/evaluate.c * src/main/exec.c * src/main/modcall.c * src/main/threads.c * src/main/tls.c * src/main/valuepair.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/92c5d7db5d592e9e09ef… ====== add ntlm_auth_timeout option to rlm_mschap Matthew Newton@2013-10-15T23:49:56Z Files modified: * raddb/mods-available/mschap * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ab43d6a088411f052647… ====== add timeout option to rlm_exec Matthew Newton@2013-10-15T23:49:49Z Files modified: * raddb/mods-available/echo * src/modules/rlm_exec/rlm_exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/16da2041765c56f2c974… ====== add timeout arg to radius_exec_program, with default EXEC_TIMEOUT Matthew Newton@2013-10-15T23:49:22Z Files modified: * src/include/radiusd.h * src/main/evaluate.c * src/main/exec.c * src/main/modcall.c * src/main/threads.c * src/main/tls.c * src/main/valuepair.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1da1208fab38118a9352… ====== -- This commit summary was generated @2013-10-17T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 16 Oct '13

16 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note recent changes Alan T. DeKok@2013-10-16T17:39:24Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f16d4a9f64ee79ad42c4… ====== add ntlm_auth_timeout option to rlm_mschap Manual port of commit #ab43d6a0 Alan T. DeKok@2013-10-16T17:35:49Z Files modified: * raddb/modules/mschap * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/26dd6891487d365ef6c3… ====== add timeout option to rlm_exec Manual port of commit #16da20417 Alan T. DeKok@2013-10-16T17:35:49Z Files modified: * raddb/modules/echo * raddb/modules/exec * src/modules/rlm_exec/rlm_exec.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ad043b3a6b4b6454d313… ====== Add timeout arg to radius_exec_program, with default EXEC_TIMEOUT Manual port of commit #1da1208 Alan T. DeKok@2013-10-16T17:35:49Z Files modified: * src/include/radiusd.h * src/main/evaluate.c * src/main/exec.c * src/main/modcall.c * src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c * src/modules/rlm_exec/rlm_exec.c * src/modules/rlm_mschap/rlm_mschap.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a9c1bcc816d86f85d78c… ====== -- This commit summary was generated @2013-10-17T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Creating a two man login module
by PEOPLES, MICHAEL P 16 Oct '13

16 Oct '13

I am very new to RADIUS and C, so feel free to point and laugh. On Red Hat Enterprise Linux 5, I wish to create a login module that would require the "consent" of two users before either could login. I have already modified the pam_radius module to perform a few of the things I need and I know where to "intercept" the authentication process to control whether it is successful or not. When authenticating for sudo, the modified code seems to perform most of what I want. However, my problem is with initial system login. What I cannot figure out is how to provide a prompt during the initial system login so that the two users can "interact". I need to be able to do the following: 1) Provide a standard login prompt and accept the users PIN + Token 2) Generate and display a random number 3) Provide a prompt where that random number can be typed in My experience with the pam_radius module gives me confidence that I can code the underlying "logic" of the process. What I can't figure out is where do I code the prompts? There are suggestions that it is in one of the "getty" type processes, but I cannot figure it. Any help would be very much appreciated, including the suggestion that what I'm trying to do is either ill-advised (I'm not sure why that would be) or extremely difficult (i.e. requires modifying the core kernel). Thank you. Michael Peoples (mp4783) iGEMS COE, Deployment, Engineering, Application Support and Security Global Service Assurance, M5 AT&T Business Solutions Office: +1 614-886-0923 Mobile: +1 614-886-0923 Senior Systems Manager mpeoples(a)att.com<mailto:mpeoples@att.com> This e-mail and any files transmitted with it are AT&T property, are confidential, and are intended solely for the use of the individual or entity to whom this email is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited."

3 2

Re: Creating a two man login module
by Vladimir Grujić 16 Oct '13

16 Oct '13

Hi, You can use google two factor authentication where each user provides the token for another paired user. Both of them hold they own passwords and the token is appended to it. Vladimir Connected by MOTOBLUR™ -----Original message----- From: "PEOPLES, MICHAEL P" <mp4783(a)att.com> To: "freeradius-devel(a)lists.freeradius.org" <freeradius-devel(a)lists.freeradius.org> Sent: Wed, Oct 16, 2013 18:21:06 GMT+00:00 Subject: Creating a two man login module I am very new to RADIUS and C, so feel free to point and laugh. On Red Hat Enterprise Linux 5, I wish to create a login module that would require the “consent” of two users before either could login. I have already modified the pam_radius module to perform a few of the things I need and I know where to “intercept” the authentication process to control whether it is successful or not. When authenticating for sudo, the modified code seems to perform most of what I want. However, my problem is with initial system login. What I cannot figure out is how to provide a prompt during the initial system login so that the two users can “interact”. I need to be able to do the following: 1. Provide a standard login prompt and accept the users PIN + Token 2. Generate and display a random number 3. Provide a prompt where that random number can be typed in My experience with the pam_radius module gives me confidence that I can code the underlying “logic” of the process. What I can’t figure out is where do I code the prompts? There are suggestions that it is in one of the “getty” type processes, but I cannot figure it. Any help would be very much appreciated, including the suggestion that what I’m trying to do is either ill-advised (I’m not sure why that would be) or extremely difficult (i.e. requires modifying the core kernel). Thank you. Michael Peoples (mp4783) iGEMS COE, Deployment, Engineering, Application Support and Security Global Service Assurance, M5 AT&T Business Solutions Office: +1 614-886-0923 Mobile: +1 614-886-0923 Senior Systems Manager mpeoples(a)att.com<mailto:mpeoples@att.com> This e-mail and any files transmitted with it are AT&T property, are confidential, and are intended solely for the use of the individual or entity to whom this email is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited."

1 0

AD tokenGroups
by Phil Mayers 16 Oct '13

16 Oct '13

All, I recently discovered that newer versions of AD have a magic attribute on user objects, visible via a BASE scope search on the user object, called tokenGroups. This attribute is a list of all the SIDs of all groups the user is a member of, including nested groups, and taking account of disabled groups: $ ldapsearch -h $DC -b 'CN=usern,OU=...' -s base tokenGroups|head -20 dn: CN=usern,OU=... tokenGroups:: AQIAAAAAAAUgAAAAIQIAAA== $ ldapsearch -h $DC -b $B -s sub objectSid=<ldap escaped tokenGroup val> dn: CN=Users,CN=Builtin,DC=ic,DC=ac,DC=uk cn: Users It strikes me that reading this (and translating SIDs to CN) might be a useful feature to have in the LDAP module - the SIDs are basically static so can be cached internally, so in the long run it's quick, and handles the nesting which is nice. It's plain LDAP, so no weird #defines needed. If people want I'll knock together a patch (as I have working local code from another application that I wrote that reads it). The idea would be an ldap config item like this: ldap { # extract LDAP-Group values from AD magic tokenGroups # attribute once a user has been found - handles nested # and disabled groups ad_tokengroups = [no|yes] # which attribute of the group is the group "name" ad_tokengroup_name = "cn" }

3 5

Commit report for v3.0.x branch
by announce＠freeradius.org 15 Oct '13

15 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Quiet clang analyzer Alan T. DeKok@2013-10-15T17:43:33Z Files modified: * src/main/detail.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1bdc7f772efd0d7fb547… ====== Remove unused assignments Alan T. DeKok@2013-10-15T17:13:26Z Files modified: * src/main/tls.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/3219386c8961e43d2f9a… ====== -- This commit summary was generated @2013-10-16T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Performance probes
by Phil Mayers 15 Oct '13

15 Oct '13

Would a patch adding dtrace/systemtap-compatible source probes be looked upon favourably? I'm fiddling with the debuginfo-based stap stuff to try and get a histogram of our ntlm_auth timings, but it strikes me that the source-based stuff could be very useful indeed; in particular appropriate DTRACE_PROBEx statements could let us time individual requests from receive to reply, with minimal performance overhead. See: https://sourceware.org/systemtap/wiki/AddingUserSpaceProbingToApps

3 4

Commit report for master branch
by announce＠freeradius.org 14 Oct '13

14 Oct '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Better way of detecting clang Arran Cudbard-Bell@2013-10-14T23:31:59Z Files modified: * Make.inc.in * configure * configure.ac * scripts/boiler.mk * scripts/libtool.mk Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/013415ad9e1f465ddf84… ====== Add target-specific scan rules Alan T. DeKok@2013-10-14T22:52:23Z Files modified: * scripts/boiler.mk * scripts/libtool.mk Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/624a64531a0dd3eb8177… ====== Clang analyzer appears to ignore function attributes Alan T. DeKok@2013-10-14T22:48:52Z Files modified: * src/lib/event.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/cc171a9b3c9d282aa73a… ====== Minor fixes for scanner Alan T. DeKok@2013-10-14T22:47:21Z Files modified: * src/lib/sha1.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7d44f6462c2cca325815… ====== Allow clients to have "proto = tls". This means tls is REQUIRED for them. So if someone accidentally allows that client for RADIUS/TCP, or RADIUS/TCP, the connection will not be allowed. Alan T. DeKok@2013-10-14T22:16:40Z Files modified: * raddb/sites-available/tls * src/include/radiusd.h * src/main/client.c * src/main/listen.c * src/main/mainconfig.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/191655bfcadf72990743… ====== Note that the radsec shared secret is radsec Alan T. DeKok@2013-10-14T22:16:40Z Files modified: * raddb/sites-available/tls Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9305a159bf40964436e6… ====== set L_WARN to yellow, too Alan T. DeKok@2013-10-14T22:16:40Z Files modified: * src/main/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/9e9548dea3c8c4d446a1… ====== Merge pull request #450 from philmayers/fix-colourise correct the log/colourise logic Arran Cudbard-Bell@2013-10-14T15:39:03Z Files modified: * src/include/radiusd.h * src/main/mainconfig.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/8fc2475fa5579096f0c6… ====== correct the log/colourise logic Phil Mayers@2013-10-14T14:59:34Z Files modified: * src/include/radiusd.h * src/main/mainconfig.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/37bded5bb25f483a6a0b… ====== Seeing as we now encode ethernet, and we check that ethernet VPs are the correct length, we should probably decode ethernet to. Arran Cudbard-Bell@2013-10-14T14:40:16Z Files modified: * src/lib/radius.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1cf82b40b1af9e666eaa… ====== Use the special python macro for reference operations on possibly NULL python objects Arran Cudbard-Bell@2013-10-14T13:40:31Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a088ff86acac08d3c1f4… ====== regexec doesn't seem to initialised unused elements of rxmatch Arran Cudbard-Bell@2013-10-14T13:22:36Z Files modified: * src/main/evaluate.c * src/main/util.c * src/main/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/5a429bafbb9c0ae58573… ====== Revert afe57485. Fixes #442 Alan T. DeKok@2013-10-14T02:14:25Z Files modified: * src/main/modcall.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/262e9f0ccec16fda2199… ====== -- This commit summary was generated @2013-10-15T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0