- Freeradius-Devel - lists.freeradius.org

Re: dialup_admin php notice errors
by Stefan Winter 13 Jan '11

13 Jan '11

Hi, just now I have had to upgrade my dialup_admin installation to a machine running PHP5.3, and also noticed numerous PHP errors. I have fixed the code, see attached patch. It solves the following bugs/deprecated code warnings: * replace ereg -> preg_match, ereg_replace -> preg_replace, split -> preg_split for PHP5.3 compatibility * fix LIMIT not working when using MySQL * add configuration item "timezone" to make PHP 5.1+ happy and adds one (trivial, one-liner) feature: * add comparison operators "!=" and "not like" to Accounting Now, I have an almost error/warning/notice free installation. There is still something bogus around the use of mktime() someplace, but I don't use that part of dialup_admin, so I'll leave that alone. It's tested to work at my installation, and I would appreciate if the code could get into mainstream release. But it can of course use much more testing! Particularly the LDAP-related parts (user_edit a.s.o.) only got the same code massage about preg's but got no testing because that's also an unused code part for me. Doesn't help for Todd's errors, I suppose, but I find these code changes useful anyway. Greetings, Stefan Winter Am 06.01.2011 21:53, schrieb Alan DeKok: > Todd Bateman wrote: >> Is CS down or the information change? I went to try to see if that was >> the problem, but I get a connection refused. > dialup_admin hasn't used CVS for many years. > > The latest version is included in 2.1.10, but if you look at the "git" > repository, the dialup_admin code hasn't been changed in years. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 7

rlm_perl.c questions
by Anatoly Ivanov 11 Jan '11

11 Jan '11

Hi everybody, I have a couple of questions regarding modules/rlm_perl/rlm_perl.c: perl_detach(...): 1. Is it correct to call PERL_SYS_TERM in detach()? I am experiencing quite random and unpredictable segfaults with radius 2.1.8 and rlm_perl, and it really looks like memory allocation/multithreading error. I have very similar system running radius 2.1.7, and it works just fine. The most significant difference in rlm_perl between 2.1.7 and 2.1.8 is that PERL_SYS_TERM call. According to the documentation (http://perldoc.perl.org/perlembed.html) PERL_SYS_TERM should be called only once. In our case, it is called once per detaching thread. 2. This code: embed = rad_malloc(4*(sizeof(char *))); memset(embed, 0, sizeof(4*(sizeof(char *)))); looks like a misprint to me. Not that it would cause any real errors, but it is inaccurate anyway. Thank you, Anatoly.

3 7

freeRadius with SOAP
by Rajkumar R 10 Jan '11

10 Jan '11

Hi, I would like to use SOAP or any non-persistent connection(please suggest if any good alternatives) to send a trigger message upon a radius-acct-start message inorder to do one more level of authentication. For this, I request you to provide any examples/documents describing on the same would be helpful for me. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Framework to support multiple BRAS specific AVPs
by Rajkumar R 10 Jan '11

10 Jan '11

Hi, Request you to clarify on my below question: Is it possible to have a different AVPs grouped (for a COA message) for different NAS vendors? If so, is it achievable with configurable settings? Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Re: Module Creation and Incoming request identification
by Rajkumar R 05 Jan '11

05 Jan '11

Thanks all for your inputs. Is it the account type listen section in radiusd.conf file you are referencing about(to include new module)? -Raj ________________________________________ De: freeradius-devel-bounces+lscrlstld=gmail.com(a)lists.freeradius.org [mailto:freeradius-devel-bounces+lscrlstld=gmail.com@lists.freeradius.org] Em nome de Rajkumar R Enviada em: ter?a-feira, 4 de janeiro de 2011 08:59 Para: freeradius-devel(a)lists.freeradius.org Assunto: Module Creation and Incoming request identification > 2. How do I make the new procedure(to send UDPmsg to other application) > aware that a new Acc-Start/Stop message has arrived? This is because, > sending a msg to other application should be instantaneous. You can create a perl module e call it in accounting section, it is possible to filter acct stop and start using ulang. ------------------------------ Message: 2 Date: Tue, 4 Jan 2011 12:56:54 +0000 From: Alexander Clouter <alex(a)digriz.org.uk> Subject: Re: Module Creation and Incoming request identification To: freeradius-devel(a)lists.freeradius.org Message-ID: <m1ibv7-mk8.ln1(a)chipmunk.wormnet.eu> Rajkumar R <rajkumar.r(a)aricent.com> wrote: > > I need to create a new module, which should send a UDP msg to another > application server upon a Account-Start/Stop message request from a > NAS. For this, request you to provide your inputs on the below > queries: > rlm_perl Cheers -- Alexander Clouter .sigmonster says: Today is the last day of your life so far. ------------------------------ Message: 3 Date: Wed, 5 Jan 2011 07:58:52 +1000 From: Nikki Watt <nikki.watt(a)qut.edu.au> Subject: RE: Module Creation and Incoming request identification To: FreeRadius developers mailing list <freeradius-devel(a)lists.freeradius.org> Message-ID: <6D78B4DCFF9785409FE29BE1F01B3A6BA8179461(a)QUTEXMBX03.qut.edu.au> Content-Type: text/plain; charset="us-ascii" Hi Raj, I've written a similar module for freeradius (except that it does asynchronous HTTP interaction with another server rather than UDP) by following the instructions on the freeradius wiki. There's also an excellent example module included in the freeradius source code (<freeradius source directory>/src/modules/rlm_example/rlm_example.c) that I used as a guide. If you're comfortable with the C language, perhaps that's the way to go? If not, as others have suggested, rlm_perl may be better for you. In either case, you just need to reference the module in the accounting section of your config and freeradius will call the module whenever it receives an accounting packet. Regards, Nikki Nikki Watt | Network Programmer | Network Operations Centre | ITS | Level 3, Synergy Building (88 Musk Avenue, Kelvin Grove) | Ph: 3138 6858 | nikki.watt(a)qut.edu.au<mailto:nikki.watt@qut.edu.au> | www.its.qut.edu.au<http://www.its.qut.edu.au> | CRICOS No 00213J From: freeradius-devel-bounces+nikki.watt=qut.edu.au(a)lists.freeradius.org [mailto:freeradius-devel-bounces+nikki.watt=qut.edu.au@lists.freeradius.org] On Behalf Of Rajkumar R Sent: Tuesday, 4 January 2011 8:59 PM To: freeradius-devel(a)lists.freeradius.org Subject: Module Creation and Incoming request identification Hi, I need to create a new module, which should send a UDP msg to another application server upon a Account-Start/Stop message request from a NAS. For this, request you to provide your inputs on the below queries: 1. I read in the wiki link that rlm approach to be used for creating a new module. Any examples available on the same? 2. How do I make the new procedure(to send UDPmsg to other application) aware that a new Acc-Start/Stop message has arrived? This is because, sending a msg to other application should be instantaneous. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

RE: Module Creation and Incoming request identification
by Rajkumar R 05 Jan '11

05 Jan '11

Could anyone please provide your inputs on this? thanks, Raj From: Rajkumar R Sent: Tuesday, January 04, 2011 4:29 PM To: 'freeradius-devel(a)lists.freeradius.org' Subject: Module Creation and Incoming request identification Hi, I need to create a new module, which should send a UDP msg to another application server upon a Account-Start/Stop message request from a NAS. For this, request you to provide your inputs on the below queries: 1. I read in the wiki link that rlm approach to be used for creating a new module. Any examples available on the same? 2. How do I make the new procedure(to send UDPmsg to other application) aware that a new Acc-Start/Stop message has arrived? This is because, sending a msg to other application should be instantaneous. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

Module Creation and Incoming request identification
by Rajkumar R 04 Jan '11

04 Jan '11

Hi, I need to create a new module, which should send a UDP msg to another application server upon a Account-Start/Stop message request from a NAS. For this, request you to provide your inputs on the below queries: 1. I read in the wiki link that rlm approach to be used for creating a new module. Any examples available on the same? 2. How do I make the new procedure(to send UDPmsg to other application) aware that a new Acc-Start/Stop message has arrived? This is because, sending a msg to other application should be instantaneous. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

4 3

proposal for using filter-id attribute for authorization with pam_radius
by Renke Brausse 03 Jan '11

03 Jan '11

Hi list, we're using for OPT authentification a Vasco Identikey server. Unfortunately the software is rather limited, e.g. it is not possible to define access rules based on groups. The server is able to perform a RADIUS password challenge but only as "PIN and OTP are correct" - not exactly the kind of authentication I expected... The only way to get something like grouping with this product is out-sourcing to the client: Vasco cann add a filter-id attribute to the response, if the client is capable of interpreting such responses it is possible to group users (though with strings on a per-user base). As we plan to use the OTP tokens to secure our SSH service I searched for a method to authorize users not only with RADIUS but additionally the feature to check for specific filter-ids in the response - it seems no one has ever implemented such a thing. Anyway, I extended pam_radius* so it is possible to use filter-ids for authentication - the patches for 1.3.17 are attached. Would an extension like this useful for the vanilla release of pam_radius? Greetings Renke *) I am _not_ a programmer, the stuff I changed should be checked/rewritten/used only as concept...

2 1

detail auth_log question
by ziyen 30 Dec '10

30 Dec '10

Hi Happy new year :) to day i get git last version and run /tmp/radius.log file contain some gabage date like below whats wring? ========== Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 Calling-Station-Id = "02-00-00-00-00-01" Tq?9 Message-Authenticator = 0xfc6df77c404b6b26285398a3934fe79f User-Name = "test01" = 0xfc6df77c404b6b26285398a3934fe79f EAP-Message = 0x0200000b01746573743031 b26285398a3934fe79f Connect-Info = "CONNECT 11Mbps 802.11b" 26285398a3934fe79f NAS-IP-Address = 127.0.0.1 bps 802.11b" 26285398a3934fe79f Framed-MTU = 1400 27.0.0.1 bps 802.11b" 26285398a3934fe79f Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f5925130f212f609555b234f Tq뷣 Calling-Station-Id = "02-00-00-00-00-01" f Tq뷣 Message-Authenticator = 0xe0b618c927062d4e55a64806d9c33db9 User-Name = "test01" = 0xe0b618c927062d4e55a64806d9c33db9 EAP-Message = 0x02010064150016030100590100005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M Connect-Info = "CONNECT 11Mbps 802.11b" 00005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M NAS-IP-Address = 127.0.0.1 bps 802.11b" 00005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M Framed-MTU = 1400 27.0.0.1 bps 802.11b" 00005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f4915130f212f609555b234f Tq?d Calling-Station-Id = "02-00-00-00-00-01" f Tq?d Message-Authenticator = 0xd39e6b915c0352029f43706a4afc102f User-Name = "test01" = 0xd39e6b915c0352029f43706a4afc102f EAP-Message = 0x020200061500 e6b915c0352029f43706a4afc102f Connect-Info = "CONNECT 11Mbps 802.11b" 029f43706a4afc102f NAS-IP-Address = 127.0.0.1 bps 802.11b" 029f43706a4afc102f Framed-MTU = 1400 27.0.0.1 bps 802.11b" 029f43706a4afc102f Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f7905130f212f609555b234f Tqphx Calling-Station-Id = "02-00-00-00-00-01" f Tqphx Message-Authenticator = 0x92f8db888a344fcc73d13ac23d0b75e4 User-Name = "test01" = 0x92f8db888a344fcc73d13ac23d0b75e4 EAP-Message = 0x020300061500 8db888a344fcc73d13ac23d0b75e4 Connect-Info = "CONNECT 11Mbps 802.11b" cc73d13ac23d0b75e4 NAS-IP-Address = 127.0.0.1 bps 802.11b" cc73d13ac23d0b75e4 Framed-MTU = 1400 27.0.0.1 bps 802.11b" cc73d13ac23d0b75e4 Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f6975130f212f609555b234f Tqh죱 Calling-Station-Id = "02-00-00-00-00-01" f Tqh죱 Message-Authenticator = 0xcb39b9ef7678c743e0467a6d637db2aa User-Name = "test01" = 0xcb39b9ef7678c743e0467a6d637db2aa EAP-Message = 0x020400cc150016030100861000008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? Connect-Info = "CONNECT 11Mbps 802.11b" 00008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? NAS-IP-Address = 127.0.0.1 bps 802.11b" 00008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? Framed-MTU = 1400 27.0.0.1 bps 802.11b" 00008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 02.11b" 26285398a3934fe79f State = 0xf5934438f1965130f212f609555b234f 85398a3934fe79f Calling-Station-Id = "02-00-00-00-00-01" f 85398a3934fe79f Message-Authenticator = 0xeee6ca5f69b02354bc56bd8d29b0ab63 User-Name = "test01" = 0xeee6ca5f69b02354bc56bd8d29b0ab63 EAP-Message = 0x0205009015001703010020579ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t Connect-Info = "CONNECT 11Mbps 802.11b" 9ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t NAS-IP-Address = 127.0.0.1 bps 802.11b" 9ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t Framed-MTU = 1400 27.0.0.1 bps 802.11b" 9ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request CHAP-Password = 0x060bb5ca76578168f759811c519a20e4ce 퇼㎌델??x ?CHAP-Challenge = 0xb561a6ab4003cb2378b5e8cede5d15ce 퇼㎌델??x ?User-Name = "test01" 61a6ab4003cb2378b5e8cede5d15ce 퇼㎌델??x ?NAS-IP-Address = 127.0.0.1 4003cb2378b5e8cede5d15ce 퇼㎌델??x ?

2 1

How the freeradius server can repeat eap-start when receive EAP-FAILURE?
by zhangyan 30 Dec '10

30 Dec '10

hello, Now, the freeradius server version I used is 2.1.6, and I want to the freeradius repeat eap-start when EAP-FAILURE received in my testing, How to configure the freeradius server? Thanks, Yan -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-the-freeradius-server-can-repea… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 2