- Freeradius-Devel - lists.freeradius.org

Expire account after first login
by Stephan Jaeger 27 Nov '08

27 Nov '08

Hi, i needed to expire an account x seconds after its initial login/first session start. I came up with this solution using the sqlcounter module. Maybe this is of interest to others and could go into the docs. This uses mysql. sqlcounter expirelogincounter { counter-name = Expire-After-Initial-Login check-name = Expire-After sqlmod-inst = sql key = User-Name reset = never query = "SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) \ FROM radacct \ WHERE UserName='%{%k}' \ ORDER BY acctstarttime \ LIMIT 1;" } Regards Stephan -- Stephan Jaeger <stephan.jaeger(a)ewetel.de> EWE TEL GmbH

1 0

GIT Log for 2008-11-27 00:33 GMT
by aland＠deployingradius.com 27 Nov '08

27 Nov '08

commit c52a046b2cb20f4650fe79585e927a9183bd91cb Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Nov 26 14:36:52 2008 +0100 Correct the attribute numbers for client accounting stats Files changed: src/modules/frs_status/frs_status.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) ====================================================================== commit 7f255bf4ce8b5ad232513010367559e79d7644e9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Nov 26 08:22:05 2008 +0100 Use "ln -s" rather than "cp" for in-tree operation Libtool on some platforms creates directories in the ".libs" directory. Using "ln -s" rather than "cp" means we don't care what the destination file type is, and we don't have to create a cross-platform "cp -R" Files changed: src/modules/Makefile | 1 - src/modules/rlm_eap/libeap/Makefile | 4 ---- src/modules/rlm_sql/drivers/rules.mak | 8 ++++---- src/modules/rules.mak | 6 ++---- 4 files changed, 6 insertions(+), 13 deletions(-) ====================================================================== commit 97e33a04b0654d581e7343cf9ff567a7bd93e889 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Nov 26 08:18:51 2008 +0100 More documentation for using multiple certs Files changed: raddb/eap.conf | 5 +---- 1 files changed, 1 insertions(+), 4 deletions(-) ======================================================================

1 0

GIT Log for 2008-11-26 00:33 GMT
by aland＠deployingradius.com 26 Nov '08

26 Nov '08

commit badbb9dae65418059a0fbd1303a9e03d843b63fc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 16:41:21 2008 +0100 Increase the field size for Acct-Session-Id to 64. This closes #540 Files changed: raddb/sql/mssql/schema.sql | 2 +- raddb/sql/mysql/schema.sql | 2 +- raddb/sql/oracle/schema.sql | 2 +- raddb/sql/postgresql/schema.sql | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit 3403519dbd0c02403f61262ec0d54fc7636a3d94 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 16:31:29 2008 +0100 LDAP-UserDn is in "control", not "request" Closes #596 Files changed: raddb/modules/ldap | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 629fc0b1079908e5a67947c2ca5f2781caac86d9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 14:44:00 2008 +0100 Add EVP_sha256 for WiMAX certificates OpenSSL apparently doesn't include the EVP_sha256 digest by default, and the WiMAX certificates require SHA256 certificates. So... we add it manually. However, the EVP_sha256 cipher is defined only if OPENSSL_FIPS is defined, meaning we have to write a "configure" script check for this. Files changed: src/modules/rlm_eap/types/rlm_eap_tls/config.h.in | 3 - src/modules/rlm_eap/types/rlm_eap_tls/configure | 3546 ++++++-------------- src/modules/rlm_eap/types/rlm_eap_tls/configure.in | 7 - .../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 14 - 4 files changed, 1036 insertions(+), 2534 deletions(-) ====================================================================== commit a49e682f0f4600f6c2c878f446e25c853fc78b7b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 11:39:30 2008 +0100 Remove more files Files changed: src/modules/Makefile | 4 +--- 1 files changed, 1 insertions(+), 3 deletions(-) ====================================================================== commit 1e6209870c24b9e71f844b0e1099ab293ba54e63 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 11:38:13 2008 +0100 Set default days because OpenSSL people won't do it. Files changed: raddb/certs/Makefile | 17 +++++++++-------- 1 files changed, 9 insertions(+), 8 deletions(-) ====================================================================== commit 4df74f9b1497fc4c88f9159a680707041c70a23d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 11:36:58 2008 +0100 Check for NULL pointer so we don't crash. Files changed: libltdl/ltdl.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) ====================================================================== commit 28b0b5af25c9400a903d9c2905032bb854cf6462 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 10:39:35 2008 +0100 Document listen "type = status" better. Closes #580 Files changed: raddb/radiusd.conf.in | 4 ---- raddb/sites-available/status | 8 ++------ 2 files changed, 2 insertions(+), 10 deletions(-) ====================================================================== commit 04e7ae80f0ba86a8140837b8c81486a054160cf0 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 10:38:59 2008 +0100 Do "rm -rf lib" on "make clean". It has no git controlled files, so this is OK Files changed: src/modules/rlm_sql/drivers/Makefile.in | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) ====================================================================== commit df19aa11e89d74d08e1052f2f7462dcd3b7a878a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 25 10:38:01 2008 +0100 Include <ltdl.h> The file calles lt_dlopen(), so we need to include <ltdl.h> fro proper function prototyping. Partially addresses bug #610 Files changed: src/modules/rlm_sql/rlm_sql.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ======================================================================

1 0

EAP-TLS Memory Leak
by Alexander Bergmann 24 Nov '08

24 Nov '08

Hi, I'm using FreeRADIUS 2.1.1 wiht EAP-TLS for my WLAN authentication. It's working great and I have no authentication problems at all. I've tested my setup with eapol_test from the wpa_supplicant package and used it inside an endless loop overnight and the memory usage was 100% stable. Then I've noticed that the FreeRADIUS memory usage increases if I interrupt the eapol_test tool after it sends the first RADIUS packet. This can be done till FreeRADIUS runs out of memory and gets an exception. Is this a known problem? To force the problem with eapol_test, I've inserted an 'exit(0);' inside the radius_client_send() function. Here's the diff: diff -Nur wpa_supplicant-0.5.10-orig/radius_client.c wpa_supplicant-0.5.10-crash/radius_client.c --- wpa_supplicant-0.5.10-orig/radius_client.c 2008-02-20 01:08:52.000000000 +0100 +++ wpa_supplicant-0.5.10-crash/radius_client.c 2008-11-03 22:06:10.000000000 +0100 @@ -494,6 +494,9 @@ radius_client_list_add(radius, msg, msg_type, shared_secret, shared_secret_len, addr); + printf("Unexpected EAPOL Client Problem....\n"); + exit(0); + return res; } Regards, Alex

2 2

website accessibility IPv6
by Stefan Winter 20 Nov '08

20 Nov '08

Hi, aparently freeradius.org (but not www.freeradius.org) has an IPv6 address: swinter@aragorn:~> host freeradius.org freeradius.org has address 64.34.165.250 freeradius.org has address 88.191.76.128 freeradius.org has IPv6 address 2a01:e0b:1:76:21c:c0ff:fe27:7b54 freeradius.org mail is handled by 10 mail.freeradius.org. swinter@aragorn:~> The address is pingable, but the web server doesn't deliver any content (no reply). This looks like a daemon binding only to IPv4:80, not the IPv6:80 address... Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 4

RLM_PERL Simultaneous-Use RLM_MODULE_REJECT
by Anatoly S. Zimin 20 Nov '08

20 Nov '08

Hello everybody! I am using rlm_perl for checking Simultaneous-Use. But this not work... :-( FreeRadius 2.1.1 session { perl } I see, that module is work. But if I return RLM_MODULE_REJECT the user is not REJECTED!!! What I do wrong? In debug mode (radiusd -X): Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "**************" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok +- entering group session {...} Using perl at 0xa6b40 rlm_perl: RLM_PERL => sub checksimul rlm_perl: RAD_REQUEST: NAS-Port-Type = Virtual rlm_perl: RAD_REQUEST: Service-Type = Framed-User rlm_perl: RAD_REQUEST: Framed-Protocol = PPP rlm_perl: RAD_REQUEST: User-Name = s_1295737 rlm_perl: RAD_REQUEST: User-Password = ****************** rlm_perl: RAD_REQUEST: Realm = DEFAULT rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.0.1 rlm_perl: RAD_REQUEST: NAS-Port-Id = 0/0/1/500 rlm_perl: RAD_REPLY: Framed-Protocol = PPP rlm_perl: RAD_REPLY: Session-Timeout = 90000 rlm_perl: RAD_REPLY: Service-Type = Framed-User rlm_perl: RAD_CONFIG: Crypt-Password = ***************** rlm_perl: RAD_CONFIG: Simultaneous-Use = 1 rlm_perl: RAD_CONFIG: Auth-Type = PAP rlm_perl: RAD_CHECK: Crypt-Password = **************** rlm_perl: RAD_CHECK: Simultaneous-Use = 1 rlm_perl: RAD_CHECK: Auth-Type = PAP rlm_perl: CHECK: send [s_1295737] to [194.186.47.51:6795] is ok rlm_perl: CHECK: Multiple logins (hits 3) (max 1) : [s_1295737] (from client 192.168.0.1 port 0) rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = s_1295737 rlm_perl: Added pair User-Password = **************** rlm_perl: Added pair Realm = DEFAULT rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 192.168.0.1 rlm_perl: Added pair NAS-Port-Id = 0/0/1/500 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Session-Timeout = 90000 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Crypt-Password = *************** rlm_perl: Added pair Simultaneous-Use = 1 rlm_perl: Added pair Auth-Type = PAP ++[perl] returns reject Login OK: [s_1295737] (from client cisco1 port 0) Also I attempted: RLM_MODULE_REJECT RLM_MODULE_FAIL RLM_MODULE_HANDLED RLM_MODULE_INVALID RLM_MODULE_USERLOCK and response still "Login OK: [s_1295737] (from client cisco1 port 0)".... P.S. authorize section work very good. Thanks a lot!

1 1

GIT Log for 2008-11-19 00:33 GMT
by aland＠deployingradius.com 19 Nov '08

19 Nov '08

commit 2933262a2a468ed7367c7cde2b449543b0cbca2b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 18 05:05:49 2008 -0800 Check return codes for more instances of regcomp Files changed: src/main/evaluate.c | 12 +----------- src/main/valuepair.c | 12 ++---------- 2 files changed, 3 insertions(+), 21 deletions(-) ====================================================================== commit f2ec5cec76ec01e25267f2035e5daf025210bfce Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Nov 18 04:58:26 2008 -0800 Check the return code of regcomp Files changed: src/main/evaluate.c | 12 +----------- 1 files changed, 1 insertions(+), 11 deletions(-) ======================================================================

1 0

adding items in server reply
by milk55 07 Nov '08

07 Nov '08

hi, I install freeradius server to authenticate user through edirectory. Now i would like radius to send groups the user is member when replying the NAS. how can i do so? thank for your help regards -- View this message in context: http://www.nabble.com/adding-items-in-server-reply-tp20378271p20378271.html Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

1 0

GIT Log for 2008-11-07 00:33 GMT
by aland＠deployingradius.com 07 Nov '08

07 Nov '08

commit 592fb19f8deb0e50a3d404e79d2136818784b472 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Nov 6 12:49:24 2008 -0800 Pass copy of debug_condition pointer to evalute In some cases, evaluate will update the pointer. We don't want this for debug conditions. Files changed: src/main/event.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) ====================================================================== commit 27f2db8169f2467d4f1fef772018428f75f86553 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Oct 23 10:41:15 2008 +0200 Use SUN_LEN here, too Files changed: src/main/radmin.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit baa901825e236befc6bc541c5bf24f545d8f92ae Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Oct 21 22:19:52 2008 +0200 Unstable head is 2.2.0, not 2.1.2 Files changed: VERSION | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 9d9ab63a79197094aea979b9c589f9b0e7c2b03b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Oct 21 16:39:58 2008 +0200 We don't require Data::Dumper Files changed: src/modules/rlm_perl/example.pl | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ======================================================================

2 1

Automatic report from sources (radiusclient) between 31.10.2008 - 01.11.2008 GMT
by Automatic cvs log generator 01 Nov '08

01 Nov '08

CVS log entries from 31.10.2008 (Fri) 07:00:01 - 01.11.2008 (Sat) 07:00:00 GMT ===================================================== Summary by authors ===================================================== Author: sobomax File: radiusclient/lib/buildreq.c; Revisions: 1.16 File: radiusclient/lib/sendserver.c; Revisions: 1.26 ===================================================== Log entries ===================================================== Description: Allow PW_ACCT_DELAY_TIME to be pre-populated in the accounting request, in which case use it as a starting point and increase as we go. While I am here assign few variables to shut-up gcc in the -Wall mode. Submitted by: Alfred E. Heggestad Modified files: File: radiusclient/lib/buildreq.c; Revision: 1.16; Date: 2008/10/31 18:23:10; Author: sobomax; Lines: (+17 -9) ------------------------------- Description: Replace select(2) with more modern interface poll(2) to avoid problem with sockfd > FD_SETSIZE. Prompted by: Alfred E. Heggestad Modified files: File: radiusclient/lib/sendserver.c; Revision: 1.26; Date: 2008/10/31 19:10:17; Author: sobomax; Lines: (+19 -13) ===================================================== Summary of modified files ===================================================== File: radiusclient/lib/buildreq.c Revisions: 1.16 Authors: sobomax (+17 -9) ------------------------------- File: radiusclient/lib/sendserver.c Revisions: 1.26 Authors: sobomax (+19 -13) -- Automatic cron job from /web/pages/us.freeradius.org/bin/rc-new_makelog.pl

1 0