- Freeradius-Devel - lists.freeradius.org

2.x.x (and earier?): yet another decoding SSHA issue
by Stefan Winter 22 Jul '13

22 Jul '13

Hi, here's yet another thing which caused spurious authentication failures; luckily I was accidently in debug mode looking for something else when I found the cause for some failed auth: +++- entering policy redundant {...} [sql-imap-hash] expand: %{User-Name} -> pgloden [sql-imap-hash] sql_set_user escaped user --> 'pgloden' rlm_sql (sql-imap-hash): Reserving sql socket id: 7 [sql-imap-hash] expand: (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='%{SQL-User-Name}') -> (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='pgloden') rlm_sql_mysql: query: (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='pgloden') rlm_sql: Failed to create the pair: Non-hex characters at QX rlm_sql (sql-imap-hash): Error getting data from database [sql-imap-hash] SQL query error; rejecting user The query works just fine and returns a base64-encoded SSHA1 hash of a user's password. The base64 blob happens to start with the two characters "0X" (and then continues with QX, which is in the error message). It seems like the query response parser tries to be overly clever and thinks that anything starting with 0X is a hex number and needs decoding. This, of course, fails. Needsless to say that the schema doesn't suggest an integer at all, it's a varchar(168). The workaround right now for us is to set the hashed password, see if it happens to start with 0X, and if so, try with a different salt. That is obviously not very ideal. I would appreciate if 2.2.1 could stop hex-decoding non-hex values :-) I only saw this right now on yesterday's GIT; no idea if we've been hitting the wall with this earlier. The users in question didn't phone up our helpdesk yet, so maybe this crept in very recently? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

6 27

Commit report for master branch
by announce＠freeradius.org 21 Jul '13

21 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Always pass -export-dynamic as a direct linker argument GCC accepts the -export-dynamic argument, and will make decisions about whether to include it in the linker options. On OSX it does not include it in the linker options. clang ignores -export-dynamic even when linking, and newer versions when passed -rdynamic, will always pass -export-dynamic in the linker options, which causes linking to fail on OSX. The solution seems to be to pass -export-dynamic directly to the linker for LINUX/FreeBSD/NetBSD i.e. -Wl,-export-dynamic. Arran Cudbard-Bell@2013-07-21T23:54:10Z Files modified: * scripts/jlibtool.c * src/main/auth.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/f104b4fc1950f4004d99… ====== Remove -rdynamic again It's now become more urgent we have a proper fix for this as clang 3.4 accepts the -rdynamic flag. Unfortunately, unlike gcc, it just blindly emits -export-dynamic in the list of arguments to the linker which causes the ld to emit and error and the build fails. Arran Cudbard-Bell@2013-07-21T19:07:25Z Files modified: * scripts/libtool.mk Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/97be6fec10ede2b78eaf… ====== Ignore cui.sqlite generated on make test Arran Cudbard-Bell@2013-07-21T19:04:50Z Files modified: * src/tests/.gitignore Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a299cee514bd1f0b8d09… ====== Use numbered macros for RDEBUG_ENABLED Arran Cudbard-Bell@2013-07-21T18:27:42Z Files modified: * src/include/log.h * src/main/xlat.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/166e9ff90be0d0865705… ====== Better debugging for dlopen Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/main/modules.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/43b1b27875d2ae452656… ====== Do RTLD_NOW if built with NDEBUG Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/main/modules.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/93cba2d660b0218502c2… ====== Add the DEBUG_ENABLED macro Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/include/log.h * src/main/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fbc95b8a883633356ea6… ====== Do config check with maximum verbosity Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * Makefile Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/a051573dbdcf2df9b995… ====== Add function for creating IP address pairs from value of unknown type Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/include/libradius.h * src/lib/valuepair.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/2fc39aa6419c98ba185f… ====== Log fix Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/include/libradius.h * src/include/radius.h * src/lib/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/53e55afcc739637441f7… ====== Add fr_assert (soft asset which produces error messages) Arran Cudbard-Bell@2013-07-21T18:22:39Z Files modified: * src/include/libradius.h * src/lib/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/818cb62deaee3e71d3df… ====== Fix some more spelling mistakes Arran Cudbard-Bell@2013-07-21T00:11:35Z Files modified: * raddb/certs/README * raddb/certs/xpextensions * raddb/clients.conf * raddb/experimental.conf * raddb/mods-available/cache_eap * raddb/mods-available/counter * raddb/mods-available/cui * raddb/mods-available/detail * raddb/mods-available/idn * raddb/mods-available/inner-eap * raddb/mods-available/ldap * raddb/mods-available/logintime * raddb/mods-available/otp * raddb/mods-available/preprocess * raddb/mods-available/redis * raddb/mods-available/sql * raddb/mods-available/yubikey * raddb/mods-config/attr_filter/access_challenge * raddb/mods-config/attr_filter/access_reject Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/adfdfe73232081f24f05… ====== -- This commit summary was generated @2013-07-22T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 20 Jul '13

20 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Merge pull request #384 from alanbuxey/master myriad of spelling mistakes and corrected some documentation. Arran Cudbard-Bell@2013-07-20T21:37:57Z Files modified: * raddb/README.rst * raddb/experimental.conf * raddb/mods-available/cache_eap * raddb/mods-available/cui * raddb/mods-available/dynamic_clients * raddb/mods-available/eap * raddb/mods-available/ippool * raddb/mods-available/ldap * raddb/mods-available/logintime * raddb/mods-available/passwd * raddb/mods-available/preprocess * raddb/mods-available/realm * raddb/mods-available/wimax * raddb/mods-available/yubikey * raddb/mods-config/preprocess/huntgroups * raddb/mods-config/sql/counter/mysql/queries.conf * raddb/mods-config/sql/counter/postgresql/queries.conf * raddb/policy.d/filter * raddb/proxy.conf * raddb/radiusd.conf.in * raddb/sites-available/buffered-sql * raddb/sites-available/control-socket * raddb/sites-available/default * raddb/sites-available/example * raddb/sites-available/tls * raddb/vmpsd.conf.in * scripts/min-includes.pl * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_eap/rlm_eap.c * src/tests/eapsim-03/radiusd-example.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e5aefe007dbf8c7c884b… ====== myriad of spelling mistakes and corrected some documentation. also removed the part saying control-socket was highly experiment. Alan Buxey@2013-07-20T21:26:38Z Files modified: * raddb/README.rst * raddb/experimental.conf * raddb/mods-available/cache_eap * raddb/mods-available/cui * raddb/mods-available/dynamic_clients * raddb/mods-available/eap * raddb/mods-available/ippool * raddb/mods-available/ldap * raddb/mods-available/logintime * raddb/mods-available/passwd * raddb/mods-available/preprocess * raddb/mods-available/realm * raddb/mods-available/wimax * raddb/mods-available/yubikey * raddb/mods-config/preprocess/huntgroups * raddb/mods-config/sql/counter/mysql/queries.conf * raddb/mods-config/sql/counter/postgresql/queries.conf * raddb/policy.d/filter * raddb/proxy.conf * raddb/radiusd.conf.in * raddb/sites-available/buffered-sql * raddb/sites-available/control-socket * raddb/sites-available/default * raddb/sites-available/example * raddb/sites-available/tls * raddb/vmpsd.conf.in * scripts/min-includes.pl * src/modules/rlm_detail/rlm_detail.c * src/modules/rlm_eap/rlm_eap.c * src/tests/eapsim-03/radiusd-example.txt Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/47f03af2b9e82336fb4c… ====== RH requires that header files are not arch specific The main issue with the FR headers is that rpaths.h contains a macro 'LIBDIR' which changes depending on the arch. The fix is to not install rpaths.h, and instead build it's values libfreeradius-server. Arran Cudbard-Bell@2013-07-20T09:37:23Z Files modified: * Make.inc.in * src/include/all.mk * src/include/radiusd.h * src/main/radattr.c * src/main/radclient.c * src/main/radconf2xml.c * src/main/radmin.c * src/main/radsniff.c * src/main/util.c * src/modules/proto_dhcp/dhcpclient.c * src/modules/rlm_eap/radeapclient.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0e03de383e6840307387… ====== -- This commit summary was generated @2013-07-21T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for master branch
by announce＠freeradius.org 19 Jul '13

19 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Add length to compliment strlen Arran Cudbard-Bell@2013-07-19T23:43:35Z Files modified: * src/main/xlat.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/67f00ee090f9776b4c2d… ====== Fix typo in TLS macros Arran Cudbard-Bell@2013-07-19T23:35:19Z Files modified: * src/include/threads.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/52e333d14d398b51df7a… ====== -- This commit summary was generated @2013-07-20T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 19 Jul '13

19 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fix typo in TLS macros Arran Cudbard-Bell@2013-07-19T23:40:52Z Files modified: * src/include/threads.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d239616aa365ac343b6d… ====== -- This commit summary was generated @2013-07-20T00:00:02Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Patch for updated EAP-TNC support for freeradius from tnc@fhh
by Avesh Agarwal 19 Jul '13

19 Jul '13

Hello Alan, I have created a forked version of latest freeradius v2 branch on github and merged the updated EAP-TNC support from tnch@fhh. The link is here: https://github.com/aveshagarwal/freeradius-server/commit/40104449aa7bce926a… I have tested the patch on a testbed with 802.1x managed switch and wpa_supplicant and freeradius-server with EAP-TTLS as outer tunnel and EAP-MD5 and EAP-TNC as two inner EAP methods. I would appreciate any feedback on this patch to get it merged upstream. Thanks and Regards Avesh On Fri, Feb 1, 2013 at 4:32 PM, Alan DeKok <aland(a)deployingradius.com>wrote: > Avesh Agarwal wrote: > > Thanks for your response. But if you could tell some specific reasons > > why it is not enabled by default that would really help me understand > > what is required to be done. > > Because I don't think it works. I haven't had time to look into it. > > > It is here: https://github.com/trustatfhh/tnc-fhh > > OK. > > > Yes, I agree. But some specifics would really help. > > I don't have many. Make sure it works. Make sure the code is clean, > and formatted correctly. Make sure the patches are readable. > > I know pretty much nothing about EAP-TNC. So all I can give is > general guidelines for getting code into the server. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/devel.html >

3 13

FreeRadius 2.2.1 + 3.0 and the updated dictionary.ukerna?
by stefan.paetow＠diamond.ac.uk 19 Jul '13

19 Jul '13

Sorry to bring this up, but it doesn't look like the JANET dictionary (dictionary.ukerna) has been updated with the updated GSS-* attribute Ids: ATTRIBUTE GSS-Acceptor-Service-Name 164 string ATTRIBUTE GSS-Acceptor-Host-Name 165 string ATTRIBUTE GSS-Acceptor-Service-Specific 166 string ATTRIBUTE GSS-Acceptor-Realm-Name 167 string Both in the master and the 2.x.x branch, the numbers are still all 128-131. AFAIK SAML-AAA-Assertion remains 132? I've cc:ed Sam Hartman in in case I'm horribly wrong. Is that intentional or... did someone just forget? :-) Just checking. Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

5 9

Commit report for master branch
by announce＠freeradius.org 18 Jul '13

18 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Fixup python examples Arran Cudbard-Bell@2013-07-18T19:38:41Z Files modified: * src/modules/rlm_python/all.mk.in * src/modules/rlm_python/example.py * src/modules/rlm_python/radiusd.py * src/modules/rlm_python/radiusd_test.py Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/edc6cf1da252399ea3f0… ====== No longer applicable Arran Cudbard-Bell@2013-07-18T19:22:16Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/6542d0065f214e424327… ====== Add support for setting python_path from within module config Arran Cudbard-Bell@2013-07-18T19:12:52Z Files modified: * raddb/mods-available/python * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/50bb169ec87bccc5a73d… ====== Typo Arran Cudbard-Bell@2013-07-18T18:59:32Z Files modified: * raddb/mods-available/python Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/d720af13c29b0d999e3f… ====== Typo Arran Cudbard-Bell@2013-07-18T18:50:17Z Files modified: * raddb/README.rst Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/7c7d4e7bb24e0a0ce99f… ====== mod_error needs to be called with the GIL even though the server is running in single threaded mode, and the error is during instantiation Arran Cudbard-Bell@2013-07-18T18:31:25Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/700fdc31f99758fc1f04… ====== More python fixes... Arran Cudbard-Bell@2013-07-18T15:12:13Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/15bc47032a7a0ebe42bd… ====== Fixup radsniff logging macros Arran Cudbard-Bell@2013-07-18T14:16:45Z Files modified: * src/main/radsniff.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/fb63aa9d0b9ae3e58847… ====== Do python cleanup properly on thread exit Arran Cudbard-Bell@2013-07-18T14:16:30Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/813f37fb6d6325d13f6e… ====== Explicitly free libradius error buffer on thread exit Arran Cudbard-Bell@2013-07-18T14:16:04Z Files modified: * src/lib/log.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/0e7f5388f867be8a9e15… ====== Add support for registering destructors for TLS Arran Cudbard-Bell@2013-07-18T14:13:06Z Files modified: * src/include/threads.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/ad5a3dde696e1f43ef39… ====== -- This commit summary was generated @2013-07-19T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

Commit report for v2.x.x branch
by announce＠freeradius.org 18 Jul '13

18 Jul '13

New activity for FreeRADIUS (the high performance and highly configurable RADIUS server) ====== Note TLS fixes for python Arran Cudbard-Bell@2013-07-18T18:40:22Z Files modified: * doc/ChangeLog Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/e6c924479723dde30ab8… ====== mod_error needs to be called with the GIL even though the server is running in single threaded mode, and the error is during instantiation Arran Cudbard-Bell@2013-07-18T18:35:48Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/1323ca50f4fd03cc7651… ====== Trip whitespace from base64 strings Arran Cudbard-Bell@2013-07-18T18:08:41Z Files modified: * src/modules/rlm_expr/rlm_expr.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/26c392a750c4600d7edb… ====== More python fixes Arran Cudbard-Bell@2013-07-18T18:08:27Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/334bd1ee2dbc656c9f3a… ====== Do python cleanup properly on thread exit Arran Cudbard-Bell@2013-07-18T15:14:14Z Files modified: * src/modules/rlm_python/rlm_python.c Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/b41d2cc2b638d5a785a8… ====== Add support for registering destructors for TLS Arran Cudbard-Bell@2013-07-18T14:17:20Z Files modified: * src/include/threads.h Commit diff: https://github.com/FreeRADIUS/freeradius-server/commit/74b6d84d5a0e0e6df201… ====== -- This commit summary was generated @2013-07-19T00:00:01Z by lgfeed version 0.00 (https://github.com/arr2036/lgfeed)

1 0

eap-ttls/mschapv2 versus eap-peap/mschapv2 behaviour
by Olivier Beytrison 18 Jul '13

18 Jul '13

Hello, We're in the middle of migrating all of our radius server to FR3. This is the opportunity to discuss a the difference of behaviour between EAP-TTLS/MSCHAPv2 and EPA-PEAP/MSCHAPv2 which is bothersome. With EAP-TTLS/MSCHAPv2 we have the following flow 1. NAS and Freeradius establish TLS tunnel while in authorize{} 2. Once tunnel is established, the ldap/sql/ntlm_auth modules are executed in authorize{} 3. Then the request pass to authenticate{} and eap/mschap does theire job 4. The request is then passed to post-auth and the final response is sent to the outer tunnel With EAP-PEAP/MSCHAPv2 the flow is somewhat different 1. NAS and Freeradius establish TLS tunnel while in authorize{} 2. Once tunnel is established, the ldap/sql/ntlm_auth modules are executed in authorize{} 3. Then the request pass to authenticate{} and eap does another round of challenge/response 4. While in authenticate, mschap does the authentication 5. The request is then passed to post-auth This mean that with EAP-PEAP/MSCHAPv2, if the ldap/sql/xxx module in authorize{} add attributes to the reply, they will be sent during the last challenge/response in authenticate{}, and will not be present in post-auth or the final access-accept. On our side, we are doing the policying in the inner-tunnel post-auth section, based on values directly mapped from ldap attributes to our private dictionary through the ldap module called in authz{} With EAP-TTLS we don't need to do anything special to make this work, but for PEAP actually we need to use the rlm_cache to cache and restore the attributes in post-auth. It would be really nice if eap would cache automatically all attributes present in the reply list if it has to do another round of challenge/response and restore them once the final access-accept (or reject) is reached. Now this is a behaviour I always encountered in our configs (based on the default shipped config). Still it's possible that it is due to what've done. For this purpose you'll find the inner-tunnel config below [1]. Olivier [1] server secure-hefr-inner-tunnel{ authorize { mschap ntdomain update control { Proxy-To-Realm := LOCAL } if(User-Name =~ /SOFR.(.*)$/) { update request { Stripped-User-Name := "%{1}" } } eap { ok = return } ldap pap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type CHAP { chap } Auth-Type PAP{ pap } eap } post-auth { Post-Auth-Type REJECT { -sql attr_filter.access_reject } auth_log # that's where we need the attributes added # by the ldap module in authz{} wireless-policy } } -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier(a)heliosnet.org

4 16