- Freeradius-Devel - lists.freeradius.org

GIT Log for 2009-05-05 23:33 GMT
by aland＠deployingradius.com 05 May '09

05 May '09

commit aa2a38440f20807ad8c215bd26d89303f1139fd9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 5 21:30:38 2009 +0200 Update to do a LOT more checking, and to NOT send email. Sending email is bad, as it wasn't rate limited. This new script checks for a lot more conditions, including HUP and TERM sent to the script itself. Files changed: scripts/radwatch.in | 180 ++++++++++++++++++++++++++++++++++++++++----------- 1 files changed, 141 insertions(+), 39 deletions(-) ====================================================================== commit 53dd5fd18e7c494c218e01b5389d346ee115e97d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 5 14:51:12 2009 +0200 Exit with error on more signals Files changed: src/main/radiusd.c | 12 ++---------- 1 files changed, 2 insertions(+), 10 deletions(-) ====================================================================== commit a22bcfe089115679fcf4a15d8c787ea9677d6422 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue May 5 14:12:02 2009 +0200 Include more header files in the default install Files changed: src/include/Makefile | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) ======================================================================

1 0

mschap surpport pam_radius
by Ferdinand Tong 05 May '09

05 May '09

Now I am set up a System like pam_radius--->FreeRadius--->JRadius,and it is working.But the problem is the Pam_radius_auth.so send the radius packet use pap. I need it work with MSCHAP or eap, how can I do? I see your reply in mailinglist page that "See rlm_mschap in FreeRADIUS, and port the code to pam_radius".But I am sorry ,I can`t really catch it. Please tell me the process step by step . Thanks!

1 0

GIT Log for 2009-05-04 23:33 GMT
by aland＠deployingradius.com 04 May '09

04 May '09

commit 5bc5ceade71fa4631dc43ca0ec32140f47734539 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon May 4 16:14:47 2009 +0200 Fix double free on exit src/main/realms.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)

1 0

GIT Log for 2009-05-01 23:33 GMT
by aland＠deployingradius.com 01 May '09

01 May '09

commit 9aa51d1cb921815f8c25d786e5d139807b789baf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri May 1 18:32:39 2009 +0200 Don't mark pools for freeing twice src/main/realms.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0

Cisco WLC does not respect the Expiration of a user on Radius server.
by Matthew Carriere 01 May '09

01 May '09

Hi everyone, I have a CISCO WLC that is configured to use a FreeRadius server as the authentication point. Everything is working except the Expiration. I set an Expiration value programatically from a Ruby script by entering a record into the radcheck table: UserName | Matthew Attribute | Expiration op | := Value | April 29 2009 02:14:48 Here's the scenario, before the expiration date the user authenticates to the Radius server and then is able to use the Wireless (Cisco WLC). However, when the expiration time passes, the user can no longer authenticate to the radius server (which is correct), but they are still connected to the Wireless. Does anyone have some experience with this scenario to offer some suggestions to help troubleshoot? Thanks Matthew Carriere

4 4

help with dialup_admin
by Roger Ham 30 Apr '09

30 Apr '09

hi all i am from honduras and i am try of use the dialup_admin to freeradius. and i was run with phpMyadmin the tables to the BD dialup_admin, but some pages this show me this messages: Database query failed: Table 'radius.radacct' doesn't exist Database query failed: Table 'radius.usergroup' doesn't exist Database query failed: Table 'radius.radgroupcheck' doesn't exist how or when can find the structure of the tables for this db? thanks and so sorry for my bad english. -- Saludos! roghax85

2 7

freeradiusclient and CHAP support
by Christopher Gamio 30 Apr '09

30 Apr '09

Hi, I'm having an issue with the client library and was looking for some help. I'm currently using both the freeradius server and client and I was having some issues with CHAP support. I noticed in the code that the CHAP section of the client side was commented out. I'm tried uncommenting it, noticed the password length issues and checked google. I already know that CHAP isn't the best protocol to use, and I agree. Unfortunately, I still need to use it anyway. I have been looking through the source trying to figure out what the problem is the code is. Like I said, I noticed the password length error and tried simply compensating for that, but the passwords still do not match. What puzzles me is that CHAP works just fine in the radclient packaged with the server, so I feel that it should not be impossible to implement in the client library. If someone could point me in the right direction, or possibly explain the root cause of the problem in more detail, that would be much appreciated. Any help you could offer would be great. Thanks. Chris Gamio

2 3

GIT Log for 2009-04-29 23:33 GMT
by aland＠deployingradius.com 29 Apr '09

29 Apr '09

commit 8421494db011f0402d13ca1cb3c0bfb7f4f9821f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 29 17:09:39 2009 +0200 Manually merge change from 52e7cf6 Don't force reject if the home server doesn't respond. The main event handler already does this, so there's no need for us to do it, too. Files changed: src/modules/frs_auth/frs_auth.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) ====================================================================== commit 916b0f460eaf7c41587428bfc47915416e0ff21a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 29 17:02:11 2009 +0200 When not responding, wait longer for cleanups. wait max_request_time, not cleanup_delay to clean up packets that we're not responding to. This means that we don't clean up after 5s, and the re-process the packet. Instead, we just look at the cached packet, and don't respond Files changed: src/main/event.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-) ====================================================================== commit 77edb49f069fbe0d8df422befa028e3602dae9ab Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 29 17:04:43 2009 +0200 Fix last commit Files changed: src/main/event.c | 10 ++++------ 1 files changed, 4 insertions(+), 6 deletions(-) ====================================================================== commit ed33f645a6bbba7e73cea1ff3cc956f6827e7a27 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 29 14:34:13 2009 +0200 Cache modcallables for authorize, etc. for minor speed Files changed: src/main/modules.c | 50 ++++++++++++++++++++++++++++++++++---------------- 1 files changed, 34 insertions(+), 16 deletions(-) ====================================================================== commit f28c21cfea32b147f522505a03b21b5f51acf898 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 29 13:31:03 2009 +0200 Return proper error code Files changed: src/modules/frs_control/frs_control.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 76853195db38e8f6a906409296981bf5c0fbeba5 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 29 13:26:58 2009 +0200 Print out more server {} around debugging messages Files changed: src/main/event.c | 15 +++++++++++++-- 1 files changed, 13 insertions(+), 2 deletions(-) ====================================================================== commit 317b211764b60782e04e38d050a255d053f2f30d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 29 12:13:38 2009 +0200 Set free'd pointers to NULL Files changed: src/main/realms.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) ======================================================================

1 0

FIPS feature
by William Rettig 28 Apr '09

28 Apr '09

Good morning. My boss has asked me to add a FIPS feature to FreeRADIUS. It really doesn't amount to much at this point. We think that FIPS mode requires additional two things: 1) Use of HMAC-SHA1 MAC (vendor neutral) 2) AES Key Wrap of the MSK in the Access-Accept (attribute format is vendor specific - but feature could be mostly generic). Is this something that could be supported moving forward? Would someone be willing to direct my efforts? Bill

3 3

dynamic number of SQL sockets?
by Stefan Winter 24 Apr '09

24 Apr '09

Hi, we've been having fun with the SQL backend connection from our FR 2.1.4 yesterday night, when auth load suddenly increased tenfold. The issue at hand was that we execute a query in post-auth that takes ~ 300 milliseconds. We have configured the rlm_sql_mysql instance for 5 sockets to the MySQL backend, which means an approximate 15 logins per second sustainable (which is way more than enough for us during normal operation). As the auth load increased, so did the number of queries, and it went beyond 15. Auths would have failed (but luckily the query was in a redundant { ... ok } block, and so nothing serious happened). It's important to note that the actual *load* on the MySQL backend was negligible all the time, so this is not the usually-reported "database too slow" problem. These queries simply are quite sophisticated, and they take some time to execute. In short: more sockets would have solved the problem. But you wouldn't want so many sockets day-to-day. Something dynamic would be a really nice feature. In a way just like the thread pool of FreeRADIUS itself is managed: define a minimum number of SQL sockets, and a min-spare, max-spare, max-total pair so that the number of connections grows and shrinks as required. Does that feature make sense? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 3