- Freeradius-Devel - lists.freeradius.org

Re: addition to policy.conf
by Alan Buxey 26 Jun '12

26 Jun '12

One other thing, I would like this to be in the standard distribution so sites can just enable it with one line, however, we in UK will provide a local policy in addition which will capture the common UK realm problems we see (mainly derived from typos) and match our local UK technical specification...I also wanted a generic ruleset that could be acceptable rather than labelling/tagging it as eg 'eduroam' alan

4 6

checkrad patch to support Juniper's BRAS
by Guilherme Franco 18 Jun '12

18 Jun '12

Hello, I would like to submit a patch to checkrad (freeradius-server-2.1.12), adding support for Juniper's E-Series BRAS (ERX, E120, E320). It adds the possibility to query the subscriber's username using SNMP. If the subscriber is found, it returns 1 "Returning 1 (double detected)", else, returns 0 "Returning 0 (login ok)". On clients.conf, the nastype should be set to juniper. --- C:/Users/brgufr1/Downloads/freeradius-server-2.1.12/freeradius-server-2.1.12/src/main/checkrad.pl.in Fri Sep 30 11:12:07 2011 +++ C:/Users/brgufr1/Desktop/checkrad Wed Jun 13 18:49:32 2012 @@ -24,6 +24,7 @@ # digitro_rusers 1.1 Author: accdias(a)sst.com.br # cyclades_snmp 1.0 Author: accdias(a)sst.com.br # usrhiper_snmp 1.0 Author: igor(a)ipass.net +# juniper_e_snmp 1.0 Author: guilhermefranco(a)gmail.com # multitech_snmp 1.0 Author: ehonzay(a)willmar.com # netserver_telnet 1.0 Author: mts(a)interplanet.es # versanet_snmp 1.0 Author: support(a)versanetcomm.com @@ -466,6 +467,21 @@ } # +# Check the subscriber name on a Juniper JunosE E-Series BRAS ( ERX, E120, E320 ) +# +# Author: Guilherme Franco <guilhermefranco(a)gmail.com> +# +sub juniper_e_snmp { + + $out=snmpwalk($ARGV[1],$cmmty_string,".1.3.6.1.4.1.4874.2.2.20.1.8.4.1.2"); + if($out=~/\"$ARGV[3]\"/){ + return 1; + }else{ + return 0; + } +} + +# # Check a MultiTech CommPlete Server ( CC9600 & CC2400 ) # # Author: Eric Honzay of Bennett Office Products <ehonzay(a)willmar.com> @@ -1434,6 +1450,8 @@ $ret = &cisco_snmp; } elsif ($ARGV[0] eq 'cvx') { $ret = &cvx_snmp; +} elsif ($ARGV[0] eq 'juniper') { + $ret = &juniper_e_snmp; } elsif ($ARGV[0] eq 'multitech') { $ret = &multitech_snmp; } elsif ($ARGV[0] eq 'computone') { Regards, Guilherme de Oliveira Franco guilhermefranco(a)gmail.com

2 3

4tran
by bez742＠ovi.com 18 Jun '12

18 Jun '12

Nasa has resurfaced in computer world with open source entries of another Fortran development 'Nastran', I concidered this relative to NASA 1960s Goddard Space research Centres projects with probably the best Fortran that existed ,why within open source floating points, openGl global memory pooling, resource poolings a binary as upgraded compiler is a must. Not aloner though, are the implications of the 'XSat' net and all other Spaces in between 'words' that are indeed the computers conceptual usage of this very term 'binary' to resemble what we generally assume as the 'multi bit' builder/compiler/processor of much cipher lefted out of the American 'uni verses' by 'Californian' program stylesheets of British complete 'absolutes'. This utterance spy that has led to paranoia being a mented recurrance of mention in the start bright velocity of the synchronical accentuals upon words and syntactical hypenations, which are phonetically exploited to subject vocal, not literatures[where the binary first began ,with decimal, latin-square, crab, quiz, puzzel, cipher, key, plaintext, and cyrptological exhaustations' used in the first paper-weight assembly of the discovered recurrent effects , the 'processor' and other micro velocite massives of enigma. As I have recently refound certain works upoin this subject and input them to various 'workstations' that cluster & multi-parallelize themself in a whole omnipresence of results, I hope you dont think everything factual is matter or that literal means only an objectedrally to an abstract, and fall back into 'arted poetics' of which arent used in any matter, book, page or letter, much to many surprizes it really isnt a song and dance that these 'localized author' were 'titled' into as an 'metaphore' of explorative 'mertadata' for you know who"!(what??)Light Bulkbs OSram Perl WoolWorths(1646)Russian Nihilist. Bezooomy and Assocs,Inc [-kut oit jas beat oven! ]A lex.

1 0

Regexp match wrongly copied to control list
by Brian Candler 18 Jun '12

18 Jun '12

I have an issue with FreeRadius 2.1.12. If I make use of a check/control regexp match in either rlm_sql or rlm_files, and the match succeeds, then a spurious attribute is added onto the control list containing the regexp which was matched. To demonstrate: authorize { update reply { Reply-Message += "Before: %{control:User-Name}" } testuser update reply { Reply-Message += "After: %{control:User-Name}" } ... testuser is an instance of rlm_files which contains: DEFAULT User-Name =~ "@example\\.com$" Reply-Message += "Matched" Then send a test packet: # radtest test(a)example.com secret localhost 1 testing123 The response includes: Reply-Message = "Before: " Reply-Message = "Matched" Reply-Message = "After: @example\\.com$" Debug output: rad_recv: Access-Request packet from host 127.0.0.1 port 49269, id=27, length=86 User-Name = "test(a)example.com" User-Password = "secret" NAS-IP-Address = 192.168.56.101 NAS-Port = 1 Message-Authenticator = 0x476a68f002b8b1f49df07064f8e1411a # Executing section authorize from file /etc/freeradius/sites-enabled/stratRadius +- entering group authorize {...} expand: Before: %{control:User-Name} -> Before: ++[reply] returns notfound [testuser] expand: %{Called-Station-Id} -> [testuser] expand: %{User-Name} -> test(a)example.com [testuser] users: Matched entry DEFAULT at line 1 ++[testuser] returns ok expand: After: %{control:User-Name} -> After: @example\.com$ ++[reply] returns ok This is a problem because I was using the attribute in the control list for something else. It only seems to be a side-effect of the regexp match. If instead I use: DEFAULT User-Name == "test(a)example.com" Reply-Message += "Matched" then the control:User-Name is not updated. Regards, Brian.

2 2

Security considerations for SSL_get_quiet_shutdown
by august huber 13 Jun '12

13 Jun '12

Hi All, While performing some integration work with FreeRadius I have hit some barriers in providing meaningful errors to clients during failed SSL (eap_tls) transactions. I was perplexed to discover that all SSL contexts receive SSL_get_quiet_shutdown(ctx,1) called before shutdown. I'm curious about the logic behind this decision; specifically is it targeted to decrease attacker awareness of failure modes or a function of poor client integration causing some platform to barf when it receives a TLS Alert message? If neither, does anyone know how this change made it there? Adding a conflg flag seems relatively straightforward for this case to preserve the silent functionality when desired, but wanted to query the list to see if anyone has a strong opinion before I do.

2 5

Freeradius logs analyzer
by carlos.jc1986 06 Jun '12

06 Jun '12

Hi: I'm trying to find a log analyzer for freeradius to Ubuntu. I could provide some help. Greetings. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-logs-analyzer-tp5713597.… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

1 0

addition to policy.conf
by alan buxey 06 Jun '12

06 Jun '12

hi, a little something that I've been meaning to send out for a while. basically, a small addition to policy.conf (that probably could do with a few little extra additions) that will allow sites to easily check for NAI 4282 compliance - simply, that a User-Name is valid for proxying to other locations - a great boon for sites using eduroam , for example, as it stops end sites filling up the heirarchical proxy system with junk requests.... many sites have a lot of messy rules in place...with this addition to policy.conf all they need to do is call check_nai_compliance in their authorize section and things are nice. attached (should be all okay for 2.1.13 and 3.x ) alan

7 20

Re: addition to policy.conf
by Alan Buxey 06 Jun '12

06 Jun '12

Each sites NAS should be configured to block EAP attacks or DoS or multitude of failures. But anyways, it doesn't matter for each END site what their LOCAL auth levels are - huge sites work 10k concurrent local campus users will have big numbers. The problem is the proxy packets as proxying is the Achilles heel where many bad things can happen. Remote sites not responding etc etc Anyway, thus us just diversion. I saw no complaints when 'reject if not EAP' , for example, went into proxy.conf. noone is forced to use any of the existing policies (many dont!) However here we have a valid use case and many freeradius sites that will work better, out of the box, than other RADIUS solutions ;) alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart

1 0

Re: addition to policy.conf
by Alan Buxey 05 Jun '12

05 Jun '12

At least RFC 4282 which takes over the one you stated. I still believe it is good to separate it out to comprehensible checks as that will allow further enhancements/future changes to be trivial...and for less skilled admin to understand what it does On a bad day, more than 60% of our failed logins are due to duff realms with non-real format :( alan ----- Reply message ----- From: "Brian Candler" <B.Candler(a)pobox.com> Date: Tue, Jun 5, 2012 18:35 Subject: addition to policy.conf To: "FreeRadius developers mailing list" <freeradius-devel(a)lists.freeradius.org> On Mon, Jun 04, 2012 at 10:31:10PM +0200, Stefan Winter wrote: > Hi, > > > In that case though, I would be inclined to write a validation regexp > > which fully matches the ABNF in RFC 2486. > > Elsewhere in the thread I presented arguments why a full check is a bad > idea. > > Do you have arguments to back up your "inclinedness" or is it just a gut > feeling? Only a gut feeling of "either enforce RFC 2486, or don't". Anything else seems to be a kludge to me. Has anyone actually *measured* what proportion of their failed logins are due to usernames containing two dots, or realms which start or end with a dot, or the other things the OP's regexp tests rejected? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html

1 0

interesting issue with dictionary file in FR 3.x GIT
by alan buxey 30 May '12

30 May '12

hi, we have an interesting issue with dictionaries in 3.x with 2.x we have the following in /etc/raddb/dictionary ...and can see the following in detail logs VENDOR Cisco-ASA55x0 3076 BEGIN-VENDOR Cisco-ASA55x0 ATTRIBUTE Cisco-ASA55x0-Banner1 15 string ATTRIBUTE Cisco-ASA55x0-Class 25 string ATTRIBUTE Cisco-ASA55x0-Bookmark 71 string ATTRIBUTE Cisco-ASA55x0-Member-Of 145 string ATTRIBUTE Cisco-ASA55x0-IPv6-Pool 218 string ATTRIBUTE Cisco-ASA55x0-URL-1 223 string END-VENDOR Cisco-ASA55x0 Cisco-ASA55x0-Attr-146 = 0x44666661756c4457454356504e47726f7570 Cisco-ASA55x0-Attr-150 = 0x00000002 on 3.x we have the same dictionary file...but the detail logs show this: Attr-26.3076.146 = 0x44666661756c4457454356504e47726f7570 Attr-26.3076.150 = 0x00000002 ...so the dictionary file parsing is wrong/absent alan

3 4