- Freeradius-Devel - lists.freeradius.org

my first freeradius module
by Herbert Fischer 14 Mar '11

14 Mar '11

Hi, I'm kinda new to Freeradius and at the same time I'm learning it, I'm seeing I gonna need to develop a new module for it. This module will do OTP two way authentication. It will extract part of the password (ex.: latest 6 digits) to verify and the remaining "password" will be returned to Freeradius to test against another module (LDAP for example). In this module I need to store user information on some place, including usernames, keys, secrets, last OTP, offset, etc. I have some options: * Use some file like the "users" file from freeradius or a tabulated file. Read this file in memory and update user information in memory and in file when needed, so if Freeradius is restarted, or the machines crashes, the updated information is not lost. However I don't know exactly if I'm going to have problems with the "module needs to update file" part. Don't know how Freeradius's internal API/libs work with files. I'm trying to understand rlm_files.c but this module only reads the "users" file. * Use MySQL or Redis to store this information. As they support atomic operations I should have no problem using them. However I gonna need to link the module against some external lib and I fear this may bring Freeradius some problems, and I'll have another service to monitor, manage, etc. What do you suggest? Is there any other way to do this two way authentication without needing to develop a module for it? thanks in advance, Herbert

3 6

GIT Log for 2011-03-14 00:33 GMT
by aland＠deployingradius.com 14 Mar '11

14 Mar '11

commit 1b839fb77c533edea1ee99673a20e3d2949a1470 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 13 18:50:54 2011 +0100 Revert "Fix typos and regenerate for 2.1.11" This reverts commit 2d0c5fa94938f727b4f37fb7399b777437171eeb. Files changed: configure | 200 ++++++++++++++++++++++++++++++++++++++++++++++++++++--------- 1 files changed, 172 insertions(+), 28 deletions(-) ====================================================================== commit 842c4d887e44832159f34641127064d9ee75b05e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 13 10:12:11 2011 +0100 Complain about duplicate virtual servers, too Files changed: src/main/modules.c | 44 +++++++++++++++++++++++++++++++++----------- 1 files changed, 33 insertions(+), 11 deletions(-) ====================================================================== commit fc393073000c17ae122ff0cbdc1c831eb3642d4e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 13 10:02:33 2011 +0100 Look for duplicate module definitions. Doing an O(N^2) search over the modules{} section. If the same module is defined twice, print an error detailing *both* locations where it occurs, and exit. This helps prevent broken configurations by disallowing the server from loading two conflicting module definitions Files changed: src/main/modules.c | 39 ++++++++++++++++++++++++++++++++++++++- 1 files changed, 38 insertions(+), 1 deletions(-) ====================================================================== commit fbf4bb8fa1e8c1238e317fa0b6a2e2a7c08b18c2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 13 10:02:06 2011 +0100 Added cf_section_find_name2() API This lets us find the next section by name1 and name2 Files changed: src/include/conffile.h | 2 ++ src/main/conffile.c | 27 +++++++++++++++++++++++++++ 2 files changed, 29 insertions(+), 0 deletions(-) ====================================================================== commit d228cd073ac13196980a813df8f2ad0cb5e6dc0d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 11 10:49:43 2011 +0100 Added dictionary from Moonshot project Files changed: share/dictionary | 2 ++ share/dictionary.ukerna | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 0 deletions(-) ====================================================================== commit df9dfae2c1949514894e4e36a7172402714406e5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 13 10:14:30 2011 +0100 Added duplicate names for simplicity byte == uint8 short == uint16 integer == uint32 signed == int32 Files changed: src/lib/dict.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) ======================================================================

1 0

Compilation broken in v2.1.x branch?
by Brian Candler 13 Mar '11

13 Mar '11

I hadn't done a 'git pull' and recompile since 1st February. Now when I try it again, the build fails on my machine (Ubuntu 10.10 x86_64) $ make distclean && ./configure --prefix=/v/build/fr && make && make install ... gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/u/home/brian/git/freeradius-server/src -DHOSTINFO=\"x86_64-unknown-linux-gnu\" -DRADIUSD_VERSION=\"2.1.11\" -DOPENSSL_NO_KRB5 -c detail.c -o detail.o >/dev/null 2>&1 /u/home/brian/git/freeradius-server/libtool --mode=link gcc -export-dynamic -dlopen self \ -o radiusd acct.lo auth.lo client.lo conffile.lo crypt.lo exec.lo files.lo listen.lo log.lo mainconfig.lo modules.lo modcall.lo radiusd.lo stats.lo soh.lo session.lo threads.lo util.lo valuepair.lo version.lo xlat.lo event.lo realms.lo evaluate.lo vmps.lo detail.lo \ /u/home/brian/git/freeradius-server/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread \ -lcrypt -lltdl -lcrypto -lssl -lcrypto rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT creating .libs/radiusdS.c (cd .libs && gcc -g -O2 -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/soh.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /u/home/brian/git/freeradius-server/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -lssl -lcrypto -ldl -Wl,--rpath -Wl,/v/build/fr/lib .libs/modules.o: In function `setup_modules': /v/git/freeradius-server/src/main/modules.c:1395: undefined reference to `lt__PROGRAM__LTX_preloaded_symbols' collect2: ld returned 1 exit status make[4]: *** [radiusd] Error 1 make[4]: Leaving directory `/v/git/freeradius-server/src/main' make[3]: *** [main] Error 2 make[3]: Leaving directory `/v/git/freeradius-server/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/v/git/freeradius-server/src' make[1]: *** [src] Error 2 make[1]: Leaving directory `/v/git/freeradius-server' make: *** [all] Error 2 Doing a git bisect from 5853570817fc2a1b5e972fbafe10568813e426ac suggests the problem to be introduced here: 2d0c5fa94938f727b4f37fb7399b777437171eeb is the first bad commit commit 2d0c5fa94938f727b4f37fb7399b777437171eeb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 14 15:03:48 2011 +0100 Fix typos and regenerate for 2.1.11 :100755 100755 cd0356c27a219e968bf3cecaef08ca04f74eea64 d48179f54bd576f474168325dc0aaac2d9c4dfe0 M configure And to confirm this manually: - a checkout of 995b62f8 builds successfully - bc9435fd builds successfully - 2d0c5fa9 fails as above The relevant software versions are: ii autoconf 2.67-2ubuntu1 automatic configure script builder ii automake 1:1.11.1-1 A tool for generating GNU Standards-compliant Makefiles ii autotools-dev 20100122.1 Update infrastructure for config.{guess,sub} files ii libltdl-dev 2.2.6b-2ubuntu1 A system independent dlopen wrapper for GNU libtool ii libltdl7 2.2.6b-2ubuntu1 A system independent dlopen wrapper for GNU libtool ii libtool 2.2.6b-2ubuntu1 Generic library support script I'm no expert in autoconf black magic, but it seems to me that the "fix typos" actually introduced one (it should be libltdl not libtldl) Regards, Brian.

2 2

noresetcounter, and other counter
by Thierry MUSEUX - www.fwt.fr - 07 Mar '11

07 Mar '11

With the current git (2011-Mar-05) /usr/local/sbin/radiusd -v radiusd: FreeRADIUS Version 2.2.0, for host x86_64-unknown-linux-gnu, built on Feb 22 2011 at 23:50:57 Copyright (C) 1999-2010 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Mon Mar 7 13:19:46 2011 : Debug: (Loaded rlm_sqlcounter, checking if it's valid) Mon Mar 7 13:19:46 2011 : Debug: Module: Linked to module rlm_sqlcounter Mon Mar 7 13:19:46 2011 : Debug: Module: Instantiating module "noresetcounter" from file /usr/local/etc/raddb/sql/mysql/counter.conf Mon Mar 7 13:19:46 2011 : Debug: sqlcounter noresetcounter { Mon Mar 7 13:19:46 2011 : Debug: counter-name = "Max-All-Session-Time" Mon Mar 7 13:19:46 2011 : Debug: check-name = "Max-All-Session" Mon Mar 7 13:19:46 2011 : Debug: key = "User-Name" Mon Mar 7 13:19:46 2011 : Debug: sqlmod-inst = "sql" Mon Mar 7 13:19:46 2011 : Debug: query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" Mon Mar 7 13:19:46 2011 : Debug: reset = "never" Mon Mar 7 13:19:46 2011 : Debug: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Mon Mar 7 13:19:46 2011 : Debug: } Mon Mar 7 13:19:46 2011 : Debug: rlm_sqlcounter: Reply attribute set to Session-Timeout. Mon Mar 7 13:19:46 2011 : Error: rlm_sqlcounter: Failed to create check attribute Max-All-Session Mon Mar 7 13:19:46 2011 : Error: /usr/local/etc/raddb/sql/mysql/counter.conf[110]: Instantiation failed for module "noresetcounter" the module in sql/mysql/counter.conf, noresetcounter, and other counter fail to load. Is someone has tested this with the current git ? Works fine with 2.1.10 Thierry Museux France Wireless Technologies <http://www.fwt.fr/> www.fwt.fr msn: <mailto:tm@fwt.fr> tm(a)fwt.fr Tel: + 33 (0) 1 41 08 70 78 Gsm: + 33 (0) 6 15 22 09 62

1 0

Information about load a new rlm_sql module driver
by Ge＠＠ru 06 Mar '11

06 Mar '11

Hi at all, i created a new rlm_sql driver for oracle database that permit to use package/procedure that return a cursor and that doesn't use directly oci library but use ocilib (http://orclib.sourceforge.net/) For this module is there a way to load sources on freeradius repository or i must create a new project on sf.net as an indipendent project? Thanks in advance. Geaaru

2 6

rlm_ippool slowness
by Chris Hellberg 06 Mar '11

06 Mar '11

Hi, I modified rlm_ippool.c to create a hash key against Calling-Station-Id, which is unique across my NAS. I only have one NAS (it's a test enviornment) so no worries about duplicate ports keys. However, I find radiusd goes up to 97% CPU when I use this IP allocation method. If I don't use any server-side IP allocation, I get CPU use hovering around 4%. I can't use an integer like Nas-Id to hash against because it's not a unique value on my NAS, hence I had to modify rlm_ipool.c. So I can't easily check whether the problem is in the rest of rlm_ippool.c or in the change of the hashing method that I've done. Thoughts? Thanks, Chris

5 7

GIT Log for 2011-03-06 00:33 GMT
by aland＠deployingradius.com 06 Mar '11

06 Mar '11

commit 18a42c234afe1a439b30c40b0920d924885655fb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 5 08:07:14 2011 +0100 Hack to let developers catch bad dictionaries uses fprintf to print warning messages when the attributes are illegally defined in the IANA standard space Files changed: src/lib/dict.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) ====================================================================== commit f3e124347753b6065bae77ca24d8ff1da203d5d2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 5 07:55:14 2011 +0100 Move references to illegal dictionaries to raddb/dictionary The main dictionary files should NOT be edited. Ever. So placing the "illegal" attributes in a file which can be edited is a good idea. Files changed: raddb/dictionary.in | 29 +++++++++++++++++++++++++++++ share/dictionary | 3 --- 2 files changed, 29 insertions(+), 3 deletions(-) ====================================================================== commit ea82c9415bc9a7198747ed95581c6a0bcc146c64 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 5 07:50:37 2011 +0100 Added license text Files changed: share/format.pl | 20 ++++++++++++++++++++ 1 files changed, 20 insertions(+), 0 deletions(-) ====================================================================== commit a02efecb505c9cd501ed620b31b928a1ffa40cfc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 5 07:48:17 2011 +0100 Fix typo Files changed: share/dictionary.dhcp | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 58946eac7c920685a2c53219357cf076b591849a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 5 07:31:39 2011 +0100 Regen configure scripts Files changed: src/modules/rlm_caching/configure | 4651 +++++++++++++++++++++++++++++++++++++ src/modules/rlm_wimax/configure | 4412 +++++++++++++++++++++++++++++++++++ 2 files changed, 9063 insertions(+), 0 deletions(-) ====================================================================== commit 2d910841b65b37f6382616b468dda69121a0025f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Mar 5 07:20:21 2011 +0100 Look for <openssl/hmac.h> Files changed: src/modules/rlm_wimax/Makefile.in | 11 +++++++++ src/modules/rlm_wimax/configure.in | 41 ++++++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+), 0 deletions(-) ====================================================================== commit 4226fad1beb55ac2c3cced3fbe232d02e9f6a07d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Mar 4 15:07:56 2011 +0100 Mark pointer NULL when it's free Files changed: src/lib/dict.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ====================================================================== commit 77a183bc075a41657b7b3088ad3d5d640e2c057f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 3 15:25:59 2011 +0100 Use 3.0 API Files changed: src/modules/rlm_smsotp/rlm_smsotp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 2409d1a5f9c029fa38db31432ac62369738e6918 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Mar 3 15:22:26 2011 +0100 udpfromto doesn't seem to work for DHCP. It should really be replaced on sending by using an ethernet socket Files changed: src/lib/dhcp.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) ====================================================================== commit e9731d0bda4efa5fe5c2815d2337530805459786 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 1 16:58:57 2011 +0100 Be more forgiving about policy parsing Files changed: src/modules/rlm_policy/parse.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) ====================================================================== commit 115841072986d614dc598212d49671583239dc40 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 1 13:28:23 2011 +0100 Fix typo Files changed: raddb/modules/eap | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 375f54ca53ee24002b76b1c4b9154dbae361681b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Mar 1 10:04:24 2011 +0100 Allow SQLite to do non-NAS select queries Files changed: .../rlm_sql/drivers/rlm_sql_sqlite/sql_sqlite.c | 5 +---- 1 files changed, 1 insertions(+), 4 deletions(-) ======================================================================

1 0

failure to build if no openSSL headers are around - WiMAX module
by Alan Buxey 05 Mar '11

05 Mar '11

hi, just a quick note, it seems that if the openSSL headers/dev chain is not around then the configure doesnt check for this properly for WiMAX - so the build fails because it tries to build Wimax stuff even though wimax needs some openssl dev/headers: creating rlm_unix.la (cd .libs && rm -f rlm_unix.la && ln -s ../rlm_unix.la rlm_unix.la) for x in .libs/* rlm_unix.la; do \ rm -rf /usr/src/freeradius-src/src/modules/lib/$x; \ ln -s /usr/src/freeradius-src/src/modules/rlm_unix/$x /usr/src/freeradius-src/src/modules/lib/$x; \ done gmake[6]: Leaving directory `/usr/src/freeradius-src/src/modules/rlm_unix' Making all in rlm_wimax... gmake[6]: Entering directory `/usr/src/freeradius-src/src/modules/rlm_wimax' /usr/src/freeradius-src/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/usr/src/freeradius-src/src -c rlm_wimax.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/usr/src/freeradius-src/src -c rlm_wimax.c -fPIC -DPIC -o .libs/rlm_wimax.o rlm_wimax.c:27:26: error: openssl/hmac.h: No such file or directory rlm_wimax.c: In function 'wimax_postauth': rlm_wimax.c:175: error: 'HMAC_CTX' undeclared (first use in this function) rlm_wimax.c:175: error: (Each undeclared identifier is reported only once rlm_wimax.c:175: error: for each function it appears in.) rlm_wimax.c:175: error: expected ';' before 'hmac' rlm_wimax.c:180: error: 'EVP_MAX_MD_SIZE' undeclared (first use in this function) rlm_wimax.c:216: warning: implicit declaration of function 'HMAC_CTX_init' rlm_wimax.c:216: warning: nested extern declaration of 'HMAC_CTX_init' rlm_wimax.c:216: error: 'hmac' undeclared (first use in this function) rlm_wimax.c:217: warning: implicit declaration of function 'HMAC_Init_ex' rlm_wimax.c:217: warning: nested extern declaration of 'HMAC_Init_ex' rlm_wimax.c:217: warning: implicit declaration of function 'EVP_sha256' rlm_wimax.c:217: warning: nested extern declaration of 'EVP_sha256' rlm_wimax.c:219: warning: implicit declaration of function 'HMAC_Update' rlm_wimax.c:219: warning: nested extern declaration of 'HMAC_Update' rlm_wimax.c:220: warning: implicit declaration of function 'HMAC_Final' rlm_wimax.c:220: warning: nested extern declaration of 'HMAC_Final' rlm_wimax.c:308: warning: implicit declaration of function 'EVP_sha1' rlm_wimax.c:308: warning: nested extern declaration of 'EVP_sha1' rlm_wimax.c:545: warning: implicit declaration of function 'HMAC_CTX_cleanup' rlm_wimax.c:545: warning: nested extern declaration of 'HMAC_CTX_cleanup' rlm_wimax.c:181: warning: unused variable 'mip_rk' rlm_wimax.c:180: warning: unused variable 'mip_rk_2' rlm_wimax.c:180: warning: unused variable 'mip_rk_1' dont ask why I'm breaking it in this way.... ;-) alan

2 1

GIT Log for 2011-03-04 00:33 GMT
by aland＠deployingradius.com 04 Mar '11

04 Mar '11

commit 241d21a2519992089a9aeec165e03b07c2ee7b43 Author: Adrien Demarez <adrien.demarez(a)bolloretelecom.eu> Date: Thu Mar 3 08:22:04 2011 +0100 Fixes to make debian build for 3.x debian/changelog | 7 +++++ debian/freeradius-mysql.install | 1 + debian/freeradius.install | 3 -- debian/freeradius.postinst | 18 +++++------- debian/freeradius.prerm | 2 - debian/patches/radiusd-to-freeradius.diff | 42 ++++++++++++++++------------- debian/patches/series | 5 ++- 7 files changed, 42 insertions(+), 36 deletions(-)

1 0

FreeRADIUS data structure help
by Atif Razzaq 03 Mar '11

03 Mar '11

Dear Development Team I have FreeRADIUS deployment where Im using sql module for authentication/authorization with no accounting at all. Im looking for a possibility where FreeRADIUS loads all information from database into some data structure of its own and sends back the response to a request based on the information it has in the data structure. In this way, it doesnt go to the database on each request rather replies back from the information it has. However, the information loaded from database should be updated periodically (may be in a seperate thread) so that the data structure holds an updated copy of information. By doing this, i want to minimize the overhead of fetching information from db on each request especially on a very busy system where database might not be colocated Please let me know, is there any way to do this? And also what are the pros and cons of this approach with respect to FreeRADIUS's working/performance. Thanks in advance. -- Best Regards Atif Razzaq http://atif-razzaq.blogspot.com -- Best Regards Atif Razzaq http://atif-razzaq.blogspot.com

3 2