- Freeradius-Devel - lists.freeradius.org

excluding users from being processed by pam_radius_auth.so ?
by Jim Colten 15 Oct '07

15 Oct '07

What do folks think of this feature idea? We use a Two Factor Authentication product that provides a PAM agent. The PAM agent supports an option "xusers=/filename/" where /filename /names a file containing a list of userids which are excluded from being authenticated by the agent. Here would be an example pam.conf stack for authenticating ftp using this feature (Solaris 10's PAM): # for FTP ftp auth binding pam_safeword.so.1 *xusers=/etc/pam_excluded_users* ftp auth requisite pam_authtok_get.so.1 ftp auth required pam_dhkeys.so.1 ftp auth required pam_unix_cred.so.1 ftp auth required pam_unix_auth.so.1 Excluded users fall thru to get authenticated in the same manner they would be if we weren't using the two factor auth product. There is no Solaris 8 version of the pam_safeword.so.1 module used above, so we'd like to use pam_radius_auth.so .... but have a strong need for that xusers= option or something that'll accomplish the same effect. However, we have few C development skills in our shop and those we have are rusty. And then there's the problem that we aren't very familiar with PAM internals! Does the community see value in this enhancement? Anyone interested in working on it? Or is it already there and I haven't found it in the doc?

1 0

Useless setrlimit(RLIMIT_CORE, ...) and typo in mainconfig.c
by Enrik Berkhan 15 Oct '07

15 Oct '07

Hi, when coredumps are enabled in the config file, the code in mainconfig.c does an setrlimit(RLIMIT_CORE, ...) using the core limits retrieved by an earlier getrlimit(RLIMIT_CORE, ...). This looks useless to me. I think the original intention of the setrlimit() was to actually enable core dumping in case the server is started with core dump limit set to 0 but coredumps enabled in the config file. Further, a prctl() call to set the dumpable flag of the process is protected by HAVE_SYS_PRTCL_H which should be HAVE_SYS_PRCTL_H. Even with the typo fixed, the code will never be run, because configure does not check for prctl.h yet. I have attached a suggested patch (not including configure / prctl.h). Enrik Index: src/main/mainconfig.c =================================================================== RCS file: /source/radiusd/src/main/mainconfig.c,v retrieving revision 1.127 diff -u -r1.127 mainconfig.c --- src/main/mainconfig.c 9 Oct 2007 14:45:59 -0000 1.127 +++ src/main/mainconfig.c 15 Oct 2007 14:41:07 -0000 @@ -42,7 +42,7 @@ #include <grp.h> #endif -#ifdef HAVE_SYS_PRTCL_H +#ifdef HAVE_SYS_PRCTL_H #include <sys/prctl.h> #endif @@ -577,7 +577,7 @@ #endif if (allow_core_dumps) { -#ifdef HAVE_SYS_PRTCL_H +#ifdef HAVE_SYS_PRCTL_H #ifdef PR_SET_DUMPABLE if (prctl(PR_SET_DUMPABLE, 1) < 0) { radlog(L_ERR,"Cannot enable core dumps: prctl(PR_SET_DUMPABLE) failed: '%s'", @@ -587,6 +587,7 @@ #endif #ifdef HAVE_SYS_RESOURCE_H + core_limits.rlim_cur = core_limits.rlim_max; if (setrlimit(RLIMIT_CORE, &core_limits) < 0) { radlog(L_ERR, "Cannot update core dump limit: %s", strerror(errno));

2 1

Automatic report from sources (radiusd) between 14.10.2007 - 15.10.2007 GMT
by Automatic cvs log generator 15 Oct '07

15 Oct '07

CVS log entries from 14.10.2007 (Sun) 08:00:00 - 15.10.2007 (Mon) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/modules.c; Revisions: 1.148, 1.147, 1.146 File: radiusd/src/main/event.c; Revisions: 1.61 File: radiusd/src/main/modcall.c; Revisions: 1.89 File: radiusd/src/main/client.c; Revisions: 1.72, 1.71 ===================================================== Log entries ===================================================== Description: remove dumb assert Modified files: File: radiusd/src/main/client.c; Revision: 1.72; Date: 2007/10/14 15:38:11; Author: aland; Lines: (+2 -3) ------------------------------- Description: Update clients from root_clients, if possible Modified files: File: radiusd/src/main/client.c; Revision: 1.71; Date: 2007/10/14 14:03:46; Author: aland; Lines: (+8 -6) ------------------------------- Description: request->proxy may be set for requests with inner tunnel sessions Modified files: File: radiusd/src/main/event.c; Revision: 1.61; Date: 2007/10/14 19:11:25; Author: aland; Lines: (+4 -3) ------------------------------- Description: Add "method" to modcallable, so that we can call different module methods under administrator control Modified files: File: radiusd/src/main/modcall.c; Revision: 1.89; Date: 2007/10/14 13:22:58; Author: aland; Lines: (+49 -9) ------------------------------- Description: Define ALL types first, so that config in one section can reference types defined in another section Modified files: File: radiusd/src/main/modules.c; Revision: 1.148; Date: 2007/10/15 07:43:33; Author: aland; Lines: (+74 -39) ------------------------------- Description: Define dynamic types (Autz-type foo) etc. before trying to load the rest of the sections Modified files: File: radiusd/src/main/modules.c; Revision: 1.147; Date: 2007/10/15 07:35:11; Author: aland; Lines: (+29 -12) ------------------------------- Description: Cleaned up warning and error messages Modified files: File: radiusd/src/main/modules.c; Revision: 1.146; Date: 2007/10/14 17:36:05; Author: aland; Lines: (+5 -6) ===================================================== Summary of modified files ===================================================== File: radiusd/src/main/client.c Revisions: 1.72, 1.71 Authors: aland (+2 -3), aland (+8 -6) ------------------------------- File: radiusd/src/main/event.c Revisions: 1.61 Authors: aland (+4 -3) ------------------------------- File: radiusd/src/main/modcall.c Revisions: 1.89 Authors: aland (+49 -9) ------------------------------- File: radiusd/src/main/modules.c Revisions: 1.148, 1.147, 1.146 Authors: aland (+74 -39), aland (+29 -12), aland (+5 -6) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Bus Error when loading SQL clients
by Arran Cudbard-Bell 15 Oct '07

15 Oct '07

rlm_sql (sql_clients): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql_clients): Connected new DB handle, #19 rlm_sql (sql_clients): Processing generate_sql_clients rlm_sql (sql_clients) in generate_sql_clients: query is SELECT master.netreg_id, CONCAT(ip1,'.',ip2,'.',ip3,'.',ip4),master.name, master.nas_type,master.nas_secret FROM master WHERE master.nas_secret != '' rlm_sql (sql_clients): Reserving sql socket id: 19 rlm_sql (sql_clients): Read entry nasname=139.184.9.43,shortname=hp-e-artc-3-sw1,secret=zzz rlm_sql (sql_clients): Adding client 139.184.9.43 (hp-e-artc-3-sw1) to clients list rlm_sql (sql_clients): Read entry nasname=139.184.8.160,shortname=hp-e-russ-1-sw3,secret=xxx rlm_sql (sql_clients): Adding client 139.184.8.160 (hp-e-russ-1-sw3) to clients list Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_PROTECTION_FAILURE at address: 0x00000080 0x00003584 in client_add (clients=0x0, client=0x3cdb80) at client.c:215 215 if (!clients->trees[client->prefix]) { GDB Backtrace shows #0 0x00003584 in client_add (clients=0x0, client=0x3cdb80) at client.c:215 #1 0x00206d5c in rlm_sql_instantiate (conf=0x27090, instance=0x3cad74) at rlm_sql.c:337 #2 0x0000b3f8 in find_module_instance (modules=0x1, instname=0x311e40 "sql_clients") at modules.c:302 #3 0x0000beb8 in setup_modules (reload=1, config=0x300b50) at modules.c:807 #4 0x0000ae24 in read_mainconfig (reload=0) at mainconfig.c:917 #5 0x0000e7c4 in main (argc=4, argv=0xbffffa48) at radiusd.c:287 This has broken since cvs build date 21/09/07 and is broken in cvs build 12/10/07 Thanks, Arran

2 5

Automatic report from sources (radiusd) between 13.10.2007 - 14.10.2007 GMT
by Automatic cvs log generator 14 Oct '07

14 Oct '07

CVS log entries from 13.10.2007 (Sat) 08:00:01 - 14.10.2007 (Sun) 08:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/realms.c; Revisions: 1.38 File: radiusd/src/lib/event.c; Revisions: 1.12 ===================================================== Log entries ===================================================== Description: Corrected fix Modified files: File: radiusd/src/lib/event.c; Revision: 1.12; Date: 2007/10/13 09:53:06; Author: aland; Lines: (+4 -4) ------------------------------- Description: If there's no proxy section, use the defaults Modified files: File: radiusd/src/main/realms.c; Revision: 1.38; Date: 2007/10/13 12:48:31; Author: aland; Lines: (+12 -10) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/event.c Revisions: 1.12 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/main/realms.c Revisions: 1.38 Authors: aland (+12 -10) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

help
by InfoTec Computadores 13 Oct '07

13 Oct '07

Hello My name is Maikel Nixon Martin, I am developer and I am working in the integration of my systems MikroTik with Radius using database mysql. Everything is in perfect operation except the authentication for mac address of my MikroTik in her interface wireless. According to the manuals, I should add the mac address wanted as username in my table radcheck, however he always returns me that mistake: rad_recv: Access-Request packet from host 10.10.20.150:32769, id=115, length=86 Service-Type = Framed-User NAS-Port-Id = "wlan1" User-Name = "00:16:CF:9D:4C:B9" User-Password = "" NAS-Identifier = "MikroTik" NAS-IP-Address = 10.10.20.150 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql: The 'Attribute' field is empty or NULL, skipping the entire row. rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 rad_recv: Access-Request packet from host 10.10.20.150:32769, id=115, length=86 rad_recv: Access-Request packet from host 10.10.20.150:32769, id=115, length=86 As the error message says, it is as if I could not leave the attribute fields and null value. Then I added other attributes to try to do to work as NAS-Ip-Address, NAS-Port-id among others. But nothing was fast, the mistakes stay. I need an urgent help because only lack that to finish the project. Greetings Maikel Nixon Martin Development department InfoTec Wireless. RS/Brasil.

2 2

Automatic report from sources (radiusd) between 12.10.2007 - 13.10.2007 GMT
by Automatic cvs log generator 13 Oct '07

13 Oct '07

CVS log entries from 12.10.2007 (Fri) 08:00:01 - 13.10.2007 (Sat) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_mschap/opendir.c; Revisions: 1.8 File: radiusd/src/lib/event.c; Revisions: 1.11 ===================================================== Log entries ===================================================== Description: *ev_p may be NULL. Modified files: File: radiusd/src/lib/event.c; Revision: 1.11; Date: 2007/10/13 07:10:45; Author: aland; Lines: (+4 -4) ------------------------------- Description: Close ref. Patch as posted to the list by Apple. Modified files: File: radiusd/src/modules/rlm_mschap/opendir.c; Revision: 1.8; Date: 2007/10/12 16:08:15; Author: aland; Lines: (+3 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/event.c Revisions: 1.11 Authors: aland (+4 -4) ------------------------------- File: radiusd/src/modules/rlm_mschap/opendir.c Revisions: 1.8 Authors: aland (+3 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Re: Freeradius-Users Digest, Vol 30, Issue 50
by Steven Simon 12 Oct '07

12 Oct '07

Oops. Index: opendir.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_mschap/opendir.c,v retrieving revision 1.7 diff -u -w -r1.7 opendir.c --- opendir.c 9 Oct 2007 12:19:55 -0000 1.7 +++ opendir.c 12 Oct 2007 14:34:32 -0000 @@ -241,6 +241,8 @@ DEBUG2("rlm_osx_od: ds_mschap_auth: getUserNodeRef failed"); if (username_string != NULL) free(username_string); + if (dsRef != 0) + dsCloseDirService(dsRef); return status; } I don't have a good test environment at the moment, but the problem seems obvious. I suspect you're using a user population not in Directory Services. Thanks for the debug log. That was very helpful! - Steve On Oct 12, 2007, at 7:12 AM, freeradius-users- request(a)lists.freeradius.org wrote: > > From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> > Date: October 12, 2007 7:12:00 AM PDT > To: FreeRadius users mailing list <freeradius- > users(a)lists.freeradius.org> > Subject: Darwin DirectoryServices (warnnings) > Reply-To: FreeRadius users mailing list <freeradius- > users(a)lists.freeradius.org> > > > Hi, > Running radiusd 2.0pre2 (cvs head) > > Just checked the system logs on one of our radius servers, and i'm > seeing some strange error messages from directory services. > > Oct 12 12:02:50 wolverine DirectoryService[54]: Potential VM growth > in DirectoryService since client PID: 9179, has 675 open references > when the warning limit is 500.

1 0

Automatic report from sources (radiusd) between 10.10.2007 - 12.10.2007 GMT
by Automatic cvs log generator 12 Oct '07

12 Oct '07

CVS log entries from 10.10.2007 (Wed) 08:00:02 - 12.10.2007 (Fri) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.187 File: radiusd/src/main/radiusd.c; Revisions: 1.377 File: radiusd/raddb/certs/Makefile; Revisions: 1.6 ===================================================== Log entries ===================================================== Description: Made it work with non-GNU makes Modified files: File: radiusd/raddb/certs/Makefile; Revision: 1.6; Date: 2007/10/11 10:11:29; Author: aland; Lines: (+5 -5) ------------------------------- Description: More cleanups and warnings Modified files: File: radiusd/src/main/radiusd.c; Revision: 1.377; Date: 2007/10/10 13:17:53; Author: aland; Lines: (+14 -6) ------------------------------- Description: Fix from bug #483 Modified files: File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.187; Date: 2007/10/11 11:22:47; Author: aland; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/certs/Makefile Revisions: 1.6 Authors: aland (+5 -5) ------------------------------- File: radiusd/src/main/radiusd.c Revisions: 1.377 Authors: aland (+14 -6) ------------------------------- File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.187 Authors: aland (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Dial-up Admin patches
by Scott Lambert 11 Oct '07

11 Oct '07

These patches: 1) Let dialup_admin/bin/log_badlogins read the NAS table from SQL. 2) Make dialup_admin/bin/log_badlogins record the bad password in the callerid field. It is very useful for my support technicians to be able to look at the failed logins table and determine how the user has mis-typed their password, and the caller id field seemed to have the available chars. 3) Change the sort order in dialup_admin/htdocs/accounting.php3 so that the most recent entries are at the top. This usually prevents a lot of scrolling for my techs. 4) Remember the server for which we are showing stats on dialup_admin/htdocs/stats.php3 so that the techs doesn't have to reselect the NAS option every time the refresh the page. 5) Fix the html in dialup_admin/htdocs/user_finger.php3 so that NAS farther down the page do not get farther and farther apart. 6) MySQL 5 did not like the "DEFAULT '0'" for the auto-increment id fields in dialup_admin/sql/mysql/(badusers|userinfo).sql. I simply removed that phrase. Additionally, badusers.sql had a KEY defined on a Date column which apparanlty has been renamed to IncidentDate. I think thats about it for this patch set. Would it be an evil thing to repo-mv *.php3 to *.php and update the code to follow? Has anybody done any work toward making dialup_admin run under PHP5? It appears that PHP4 is on it's last legs. I'm not sure I can do it in a reasonable amount of time since to me "PHP is just this language, you know?" If I can't do it quickly, I probably won't get a chance to do it. -- Scott Lambert KC5MLE Unix SysAdmin lambert(a)lambertfam.org Yes, that was a HHGTTG reference.

1 1