- Freeradius-Devel - lists.freeradius.org

FreeRadius 2.1.3 authentication problem with passwd module
by bastardinho69 01 Mar '09

01 Mar '09

Hi, i want to authenticate users against a file similar to /etc/passwd file with passwd module. I have been reading the forums for some time but i cannot find out how to do it properly. I think i am loading that file in a wrong place in radiusd.conf file. I saw it must be called in authorize section but i cannot find such a section in my radiusd.conf file. When i call that file in instantiate section in debugging mode server says that passwd module has loaded my file but server just doesnt check user names against my file. Any help will be appreciated!

3 2

GIT Log for 2009-02-27 00:33 GMT
by aland＠deployingradius.com 27 Feb '09

27 Feb '09

commit a033caa7a5d138a398cf8725a6f6dafc8744942f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 26 17:55:23 2009 +0100 Point to correct buffer Files changed: src/modules/frs_control/frs_control.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 51a9e0099a1cebb49d9d8bc5b2b75edf17f096a8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 26 16:15:34 2009 +0100 Export packet code table Files changed: src/include/libradius.h | 2 -- src/lib/radius.c | 24 +++++++++++++----------- 2 files changed, 13 insertions(+), 13 deletions(-) ======================================================================

1 0

pam_radius_auth & IPv6
by Stefan Winter 23 Feb '09

23 Feb '09

Hi, the documentation and ChangeLog of pam_radius_auth don't seem to mention IPv6 at all. Is IPv6 supported? If not, any plans? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 7

GIT Log for 2009-02-20 00:33 GMT
by aland＠deployingradius.com 20 Feb '09

20 Feb '09

commit 7297448b05c035dd56e9d6f0b0a27ca9dcedbcb5 Author: Chris Moules <chris(a)gms.lu> Date: Thu Feb 19 15:38:43 2009 +0000 Update debian patch for changes to radiusd.conf logic. Files changed: debian/patches/01-radiusd-to-freeradius.dpatch | 38 +++++++++++++++-------- 1 files changed, 25 insertions(+), 13 deletions(-) ====================================================================== commit db86d98443b17552e4345e438ab1d124de61d363 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 19 15:48:04 2009 +0100 Added constraint Noted by Sebastian Heil Files changed: raddb/sql/mssql/schema.sql | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit d32a1aa6e5eab0247e09498f76f113c54d0524d8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 19 15:20:21 2009 +0100 Differentiate "no result" from "too many results" Files changed: src/modules/rlm_ldap/rlm_ldap.c | 9 ++------- 1 files changed, 2 insertions(+), 7 deletions(-) ====================================================================== commit 16e80e6feca34d06179cb887a322fbe8d217c1dc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Feb 19 10:09:13 2009 +0100 Moved debug_log_file back to log.c Files changed: src/main/log.c | 2 +- src/main/radconf2xml.c | 1 + src/main/radmin.c | 1 + src/main/radwho.c | 1 + src/modules/frs_control/frs_control.c | 2 +- 5 files changed, 5 insertions(+), 2 deletions(-) ======================================================================

1 0

Debian build fails with current GIT
by Chris Moules 19 Feb '09

19 Feb '09

Hi All, On Friday I started to look at building a Debian package for deployment on a amd64 server. I had been building some development packages on a i686 system up till now. As the git tree has some patches that I need, I grabbed the latest tree. I am having an issue trying to build a Debian package. It looks like some other changes since the 2.1.3 release have broken a few parts for the (Debian) build system. This morning pulling the latest git tree and doing a reset for good measure I (still) get: -*-*-*-*-*-*-*-*-*-*-*-*- git reset --hard Checking out files: 100% (1281/1281), done. HEAD is now at 1cbf67e Added sample commands dpkg-buildpackage -rfakeroot -us -uc dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set LDFLAGS to default value: dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: source package freeradius dpkg-buildpackage: source version 2.1.1-0 dpkg-buildpackage: source changed by Alan DeKok <aland(a)freeradius.org> dpkg-buildpackage: host architecture amd64 ... ... dpatch apply-all --verbose applying patch 01-radiusd-to-freeradius to ./ ... patching file Make.inc.in Hunk #1 succeeded at 48 with fuzz 1. patching file raddb/radiusd.conf.in Hunk #1 FAILED at 33. Hunk #2 succeeded at 112 with fuzz 2 (offset 17 lines). Hunk #3 succeeded at 164 with fuzz 2 (offset 43 lines). 1 out of 3 hunks FAILED -- saving rejects to file raddb/radiusd.conf.in.rej make: *** [patch-stamp] Error 1 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 -*-*-*-*-*-*-*-*-*-*-*-*- This patch, I have patched. I tried "git format-patch" this time so I hope it is in the correct format. After this, the build process ran a little further but errors in the configure at: -*-*-*-*-*-*-*-*-*-*-*-*- checking for setkey in -lcipher... no checking gethostbyaddr_r() syntax... GNU-style checking gethostbyname_r() syntax... GNU-style checking ctime_r() syntax... POSIX-style top_builddir=/home/src/git/freeradius-server2 configure: updating cache config.cache configure: error: conditional "INSTALL_LTDL" was never defined. Usually this means the macro was only invoked conditionally. make: *** [configure-stamp] Error 1 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 -*-*-*-*-*-*-*-*-*-*-*-*- Looking into the 'configure' file and the change log I could see that there has been a number of modifications here. I could not see why INSTALL_LTDL_[TRUE|FALSE] was not set. Putting some debug 'echo's into the configure file showed that the "if test x"${enable_ltdl_install-no}" != xno; then" block was not even processed. Info: Debian Lenny (5.0) - Testing All default packages - All up-to-date Kernel: Linux 2.6.26-1-amd64 git version 1.5.6.5 gcc (Debian 4.3.2-1.1) 4.3.2 Regards Chris

2 3

Missing line in mssql-schema
by Sebastian Heil 19 Feb '09

19 Feb '09

Hello everybody, in the mssql-database-schema, there is one line missing. For the table radacct, in the section "ALTER TABLE [radacct] WITH NOCHECK ADD", there is no information for the column groupname. So, if the accounting packet has no information about the groupname, the insert/update-statement will fail. The following line in the schema.sql should fix this: ALTER TABLE [radacct] WITH NOCHECK ADD ........ CONSTRAINT [DF_radacct_GroupName] DEFAULT ('') FOR [GroupName], ........ Maybe someone can verify this, and add this to the current development-tree? Thanks. -- Jetzt 1 Monat kostenlos! GMX FreeDSL - Telefonanschluss + DSL für nur 17,95 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

2 1

FreeRADIUS+unixODBC+BerkeleyDB
by Sourav Chakraborty 19 Feb '09

19 Feb '09

Hi, We want to use FreeRadius alongwith Oracle Berkeley DB as the backend DB.We have installed FreeRADIUS 1.1.3 and BerkeleyDB.We also have installed unixODBC-2.2.12.Please let us know how to configure FreeRADIUS with unixODBC and connect FreeRADIUS <-->unixODBC<-->BerkeleyDB. Thanks in advance for your help Regards Sourav

3 7

GIT Log for 2009-02-19 00:33 GMT
by aland＠deployingradius.com 19 Feb '09

19 Feb '09

commit bef107d13c9366cd5d0d288d0fe581be846861b3 Author: Chris Moules <chris(a)gms.lu> Date: Wed Feb 18 12:48:52 2009 +0000 Patch so that the "allocate-find" ippool lookup will match "expiry_time" when is NULL. This is its default state, so unless otherwise set, you will never get a IP from the pool. Files changed: raddb/sql/mysql/ippool.conf | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit b6453f333f6b86b7feb69d207e07d04f9c579404 Author: Chris Moules <chris(a)gms.lu> Date: Wed Feb 18 12:44:38 2009 +0000 Fix typo in MySQL ippool.conf and revert change from privous patch that modified one too many statements with "IS NULL" => "= NULL". One of these was in a WHERE clause where the "IS NULL" syntax is correct and needed. Files changed: raddb/sql/mysql/ippool.conf | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ======================================================================

1 0

Previous MySQL fix only half correct - Corrected MySQL syntax to = NULL
by Chris Moules 18 Feb '09

18 Feb '09

Sorry for not supplying decent patch files, I don't have time right now. Chris Looks like the follow commit fixed some issues but broke other: commit 243983349ba6d831da15677c46ff1f07fe977d68 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 28 14:59:42 2009 +0100 Corrected MySQL syntax to = NULL -- This patch seems to have blindly turned any instance of "IS NULL" into a "= NULL". This is wrong. The "IS NULL" syntax is correct for anything after the "WHERE" statement. You MUST use this syntax for checking for the NULL value. See http://dev.mysql.com/doc/refman/5.0/en/working-with-null.html The fix was correct in changing the assignment part of "UPDATE" statements from "IS NULL" to "= NULL". For example (snips from the commit log): Good ---- @@ -19,7 +19,7 @@ allocate-clear = "UPDATE ${ippool_table} \ SET nasipaddress = '', pool_key = 0, \ callingstationid = '', username = '', \ - expiry_time IS NULL \ + expiry_time = NULL \ WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" ---- This is an assignment therefore we use the '=' assignment operator. Bad ---- @@ -59,7 +59,7 @@ allocate-update = "UPDATE ${ippool_table} \ SET nasipaddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ - WHERE framedipaddress = '%I' AND expiry_time IS NULL" + WHERE framedipaddress = '%I' AND expiry_time = NULL" ---- This is a comparison and therefore we need to use the "IS NULL" syntax. *-*-*-*-*-*-*-*-* If you are still reading at this point, here is a mini-patch from myself for the "sql/mysql/ippool.conf". ## The ORDER BY clause of this query tries to allocate the same IP-address ## which user had last session... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ - WHERE pool_name = '%{control:Pool-Name}' AND expiry_time < NOW() \ + WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) \ ORDER BY (username <> '%{User-Name}'), \ (callingstationid <> '%{Calling-Station-Id}'), \ expiry_time \ If you do not check _explicitly_ for NULL then nothing will match (if expiry_time == NULL). As the 'ippool.sql' schema file sets 'default NULL' for expiry_time, this is likely to be the case. Example: mysql> select COUNT(*) from radippool WHERE pool_name = 'dummy' AND expiry_time < NOW(); +----------+ | COUNT(*) | +----------+ | 0 | +----------+ 1 row in set (0.00 sec) mysql> select COUNT(*) from radippool WHERE pool_name = 'dummy' AND (expiry_time < NOW() OR expiry_time IS NULL); +----------+ | COUNT(*) | +----------+ | 200 | +----------+ 1 row in set (0.00 sec)

2 2

EAP-PEAP issues with session resumption disabled
by Jouni Malinen 18 Feb '09

18 Feb '09

It looks like FreeRADIUS is currently checking whether session resumption is enabled very late during EAP-PEAP negotiation. Even the protected result indication for success is completed before FreeRADIUS does this and sends EAP-Failure. However, at that point the client is going to discard the EAP-Failure since the only allowed message after successfully completed result indication is EAP-Success. Would it be possible to move the session resumption enabled/disabled check to be done much earlier during the process? Ideally, this would be done when processing the TLS ClientHello so that server could just fall back to using full authentication without causing authentication problems. If that is not feasible for some reason, it would be useful for the protected result indication to result in Failure, not Success, so that the peer implementation would actually accept the EAP-Failure in the end. The code that triggers the current behavior is in eap_tls.c, eaptls_success(). Debug log shows this: [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [peap] FAIL: Forcibly stopping session resumption as it is not allowed. The EAP-TLV there was the end of the protected result (Success) indication. -- Jouni Malinen PGP id EFC895FA

2 1