- Freeradius-Devel - lists.freeradius.org

FreeRadius as a RADIUS server cum GPRS subscriber database
by Sourav Chakraborty 15 Jan '09

15 Jan '09

Hi All, We are evaluating whether we can use FreeRadius as a RADIUS server cum GPRS subscriber database(using MYSQL).There are these queries which we have and hence I am seeking your help --- 1>What is the rate of RADIUS msgs that FreeRadius can handle? 2>What needs to be done if we want to write handlers for START/STOP/Interim Update acct msgs?The handlers would basically extract info of the corresponding subscriber(framed-IP) from the mySQL database and send out radius response. 3>On receiving STOP msg from NAS,can FreeRadius send out notification to a particular IP?Any event handling capability existing? Thanks in Advance Sourav

2 1

freeradius FreeTDS/sybase
by Gabriel Blanchard 14 Jan '09

14 Jan '09

Reading through the freeradius archive I realize that FreeTDS support has been "abandoned". But I'm at the point where I need this support for MSSQL connectivity and ready to spend the time coding the necessary modules to support it. Would it be safe to simply use the Sybase library and go from there? What is currently missing from FreeTDS for it to be stable with Freeradius? -Gabriel

3 3

GIT Log for 2009-01-13 00:33 GMT
by aland＠deployingradius.com 13 Jan '09

13 Jan '09

commit 11143e95d2ed10ba31f9ca12174d0ddbd101343f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jan 12 14:35:30 2009 +0100 run_dir depends on ${name}, too Files changed: raddb/radiusd.conf.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 72d69c97d779ac6fdeb0cc64d60846ef533da1f2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jan 12 14:32:10 2009 +0100 Commented out SQL modules by default. Unlike the EAP module, they need *additional* things to be configured before they will work. So you can't just build the server with SQL support, and then start it. You need to edit sql.conf, etc. In the interest of making the server start quickly in debugging mode, the SQL module configurations are now commented out. Files changed: raddb/radiusd.conf.in | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) ====================================================================== commit 3a7c42724175b11c08c29a128b6f11c7b8c0311a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Jan 12 10:14:12 2009 +0100 Change default hash function to SHA1. MD5 is broken. Files changed: raddb/certs/ca.cnf | 2 +- raddb/certs/client.cnf | 2 +- raddb/certs/server.cnf | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) ====================================================================== commit 82188f7ec3ad2793467e358fecd90d214008dffe Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Jan 7 10:51:34 2009 +0100 Added notes on using "screen" Files changed: doc/bugs | 23 ----------------------- 1 files changed, 0 insertions(+), 23 deletions(-) ======================================================================

1 0

FreeRADIUS and OpenSSL Linkage
by Alan DeKok 10 Jan '09

10 Jan '09

It would be useful to be able to link FreeRADIUS with OpenSSL, for systems like Debian that have restrictive license policies. Upon auditing the source code (and some offline discussion), it looks like it may be possible. The code using OpenSSL is: src/main/threads.c src/modules/rlm_eap/ src/modules/rlm_otp/ src/modules/rlm_wimax/ The ownership of the relevant code is largely myself, a bankrupt company (rlm_eap), and Tri-D systems (rlm_otp). We've tried contacting Tri-D systems (now owned by RedHat), but have had little response. My suggestion is to do the following: 1) add a license exception to the main LICENSE file: In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library, and distribute linked combinations including the two. This exception does not apply to the "rlm_otp" module. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. 2) remove rlm_otp from the "stable" module list. It's not being maintained, and I'm not sure anyone is using it. This will make life easier for package maintainers, as they can just configure --without-rlm_otp. The result will be a version of the server that can be linked with OpenSSL on Debian-based systems. Thoughts? Alan DeKok.

6 7

Does freeradius-client-1.1.6 library supports challenge-response mode of authentication?
by Gautam Tripathi 08 Jan '09

08 Jan '09

Hi all radius developers, We are using freeradius-client library version 1.1.6 for authenticating users against a Radius server. Our radius server uses the challenge-response mechanism of radius protocol. (It a steel belted radius server which acts as a front end for RSA ace manager). However, we are unable to use this client library for our needs. The reason is that the library does not seem to support challenge-response mode of authentication. From what I have understood by looking at the library source is that it can only give a yes/no answer to an authentication request. Specifically, the library provides a single method for radius authentication called rc_auth. However, this function seems to return only binary result (OK_RC or BADRESP_RC). There is no return code for an access-challenge message from the server. The client understand only access-accept or access-reject codes. So I am coming to the conclusion that the freeradius-client-1.1.6 is not a fully conforming radius client library. The library in its current form and at the current version doesn not support challenge-response type of authentications. Please corrent me if I am wrong. May be I am missing something here. But we need a definite answer to be able to decide if this library is sufficient for our needs or not. Best, Great Khan

2 1

Debian and RTLD_GLOBAL (again)
by Chris Moules 08 Jan '09

08 Jan '09

Hi, I have been following the development of the 2.x branch of FreeRADIUS for awhile. We have been looking at moving our Debian systems running FreeRADIUS 1.1.x to the 2.x release. Most things are fine, more than that, the FR 2.x release is great. There is a sticking point however, on systems that use the sqlippool module there is still the crash due to a symbol lookup error, the known Debian RTLD_GLOBAL (or lack thereof) issue (I have tried resolving some of this myself, but it is beyond my ken). I have seen that there has been work towards resolving this, The last I (productively) saw written on this was: <http://lists.freeradius.org/pipermail/freeradius-users/2008-November/msg001…> Alan, what would your "one more fix" be? I can try to work on this if you can point me in the right direction. I would really like to get this working so that I can decommission the last remaining 1.1.x servers. Thanks for any input. Regards Chris

2 3

bobby has recommended you
by bobby 08 Jan '09

08 Jan '09

1 0

bobby has recommended you
by bobby 08 Jan '09

08 Jan '09

1 0

GIT Log for 2009-01-07 00:33 GMT
by aland＠deployingradius.com 07 Jan '09

07 Jan '09

commit fb12a47d98e6bf919243f83180b95a9624166203 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Jan 6 11:37:37 2009 +0100 listen.c needs ltdl.h src/main/Makefile.in | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)

1 0

GIT Log for 2009-01-06 00:33 GMT
by aland＠deployingradius.com 06 Jan '09

06 Jan '09

commit 885d4329748651fae019a9907ff34acd2d054a80 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 28 11:42:59 2008 +0100 Limit the maximum number of queries over one SQL socket. Similar to the "lifetime" change. If there are issues such as DB memory leaks per client socket, then it is a good idea to periodically close the client sockets. Files changed: raddb/sql.conf | 5 ----- src/modules/rlm_sql/conf.h | 1 - src/modules/rlm_sql/rlm_sql.c | 2 -- src/modules/rlm_sql/rlm_sql.h | 1 - src/modules/rlm_sql/sql.c | 13 ------------- 5 files changed, 0 insertions(+), 22 deletions(-) ====================================================================== commit e77f5126525db69cfbf04627d6e3357a0d384ecc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Fri Nov 28 11:00:25 2008 +0100 Add "lifetime" to SQL sockets. After "lifetime" seconds, an open connection is closed. This can help address issues such as firewalls that time out open connections... Files changed: raddb/sql.conf | 7 ------- src/modules/rlm_sql/conf.h | 1 - src/modules/rlm_sql/rlm_sql.c | 2 -- src/modules/rlm_sql/rlm_sql.h | 1 - src/modules/rlm_sql/sql.c | 20 ++++---------------- 5 files changed, 4 insertions(+), 27 deletions(-) ======================================================================

1 0