- Freeradius-Devel - lists.freeradius.org

rlm_perl and CHAP authentication
by Tomas Hoger 12 Feb '07

12 Feb '07

Hi all! It seems CVS version of rlm_perl may have some negative impact on CHAP authentication. If you use rlm_perl in authorize{}, it will replace request vps with contents of %RAD_REQUEST. After that, request->username and request->password are updated. Result is, that rlm_chap in authenticate{} is not able to find CHAP password any more. main/auth.c fallbacks to searching for PW_CHAP_PASSWORD if PW_PASSWORD is not found. Would it make sense to do the same in rlm_perl? Something like: --- rlm_perl.c.orig 2007-02-08 17:11:48.000000000 +0100 +++ rlm_perl/rlm_perl.c 2007-02-08 17:26:43.000000000 +0100 @@ -1069,6 +1069,11 @@ PW_USER_NAME); request->password = pairfind(request->packet->vps, PW_USER_PASSWORD); + /* User-Password not found, try CHAP-Password */ + if (request->password == NULL) { + request->password = pairfind(request->packet->vps, + PW_CHAP_PASSWORD); + } } if ((get_hv_content(rad_reply_hv, &vp)) > 0 ) { Maybe modifying rlm_chap may be better approach... Ideas? th.

2 3

Re: SecurityTracker Alert ID 1017463
by Alan DeKok 11 Feb '07

11 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SecurityTracker wrote: > Thanks for notifying us of this. My apologies for the excessive delay > in getting this posting corrected. We've just updated the Alert on our > site to indicate that you dispute that there is a security impact. As > part of our standard dispute resolution process, we have sent e-mail to > the original poster (Michal Bucko (sapheal)) just to see if he has any > other information to indicate security threat exists. Thanks. He hasn't responded to our queries. Maybe you'll have better luck. > The characterization as a remote issue was clearly an error on our part. OK. I was curious as to where it had come from. > BTW, the CVE entry does not yet reflect your position on the dispute, so > you may want to contact CVE (cve(a)mitre.org) It does allude to 3APA3A's > Bugtraq message questioning the claim. But CVE usually has a way of > more clearly indicating a vendor dispute. This is what they say right now: I've been in touch with CVE. The statement should be updated in a few days. Alan DeKok Project Leader The FreeRADIUS Server Project -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQCVAwUBRc7Gi6kul4vkAkl9AQLSlAP/awlC8kjl8LOKw/dfxFQ93ukEDFCQN8mZ 6EeVdcK4rB6bGk/5FhtAfdudBDqQX8kmFj61tAorLsPRxHCUed9X+gdHZ/MEG2r+ md5IvwLsTO96bFVqmeOWfPTNFKEyuhFvw/G4p+kxPhXPAc1gcb1Vr29moAdUy+Ej CpLUh7s5S2E= =1Xee -----END PGP SIGNATURE-----

1 0

Automatic report from sources (radiusd) between 09.02.2007 - 10.02.2007 GMT
by Automatic cvs log generator 10 Feb '07

10 Feb '07

CVS log entries from 09.02.2007 (Fri) 09:00:00 - 10.02.2007 (Sat) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/main/valuepair.c; Revisions: 1.60.2.4.2.1 File: radiusd/src/main/threads.c; Revisions: 1.116, 1.77.2.7.2.1 File: radiusd/src/main/radiusd.c; Revisions: 1.321.2.2.2.4 File: radiusd/src/modules/rlm_chap/rlm_chap.c; Revisions: 1.18 File: radiusd/src/include/radiusd.h; Revisions: 1.214, 1.156.2.4.2.1 File: radiusd/src/main/auth.c; Revisions: 1.160 File: radiusd/src/lib/dict.c; Revisions: 1.97, 1.50.2.4.2.15 File: radiusd/src/lib/hash.c; Revisions: 1.19, 1.9.2.10 File: radiusd/src/main/modules.c; Revisions: 1.113, 1.86.2.1.2.5 File: radiusd/src/main/xlat.c; Revisions: 1.72.2.7.2.4, 1.72.2.7.2.3 File: radiusd/src/main/mainconfig.c; Revisions: 1.99, 1.36.2.6.2.6, 1.36.2.6.2.5, 1.36.2.6.2.4 File: radiusd/src/modules/rlm_perl/rlm_perl.c; Revisions: 1.47 File: radiusd/share/dictionary.garderos; Revisions: 1.5, 1.2.2.1.2.2 File: radiusd/src/modules/rlm_eap/mem.c; Revisions: 1.20, 1.14.4.3 File: radiusd/src/main/nas.c; Revisions: 1.22.4.1 File: radiusd/src/include/libradius.h; Revisions: 1.76.2.2.2.11 File: radiusd/src/main/request_list.c; Revisions: 1.40.2.2.2.2 File: radiusd/src/main/session.c; Revisions: 1.35, 1.21.2.1.2.2 File: radiusd/src/main/exec.c; Revisions: 1.57, 1.42.2.1.2.3 File: radiusd/src/main/conffile.c; Revisions: 1.144, 1.100.2.1.2.3 ===================================================== Combined list of identical log entries ===================================================== Description: Don't start if radius_dir is globally writable Relax the checks on readability Modified files: File: radiusd/src/main/conffile.c; Revision: 1.144; Date: 2007/02/09 13:03:18; Author: aland; Lines: (+3 -3) File: radiusd/src/main/mainconfig.c; Revision: 1.99; Date: 2007/02/09 13:03:18; Author: aland; Lines: (+22 -2) ------------------------------- Description: Don't allow radius_dir to be globally writable Relax the checks on global readability Modified files: File: radiusd/src/main/conffile.c; Revision: 1.100.2.1.2.3; Date: 2007/02/09 13:01:41; Author: aland; Lines: (+3 -3) File: radiusd/src/main/mainconfig.c; Revision: 1.36.2.6.2.4; Date: 2007/02/09 13:01:40; Author: aland; Lines: (+21 -1) ------------------------------- Description: Free memory on detach Modified files: File: radiusd/src/modules/rlm_eap/mem.c; Revision: 1.20; Date: 2007/02/09 15:40:30; Author: aland; Lines: (+3 -2) File: radiusd/src/modules/rlm_eap/mem.c; Revision: 1.14.4.3; Date: 2007/02/09 15:42:03; Author: aland; Lines: (+3 -2) ------------------------------- Description: cleaned up the exec stuff again, and moved the "wait for 10 seconds or give up" code into rad_waitpid, where it's easier to manage Modified files: File: radiusd/src/include/radiusd.h; Revision: 1.214; Date: 2007/02/09 10:29:21; Author: aland; Lines: (+4 -4) File: radiusd/src/main/exec.c; Revision: 1.57; Date: 2007/02/09 10:29:21; Author: aland; Lines: (+16 -21) File: radiusd/src/main/session.c; Revision: 1.35; Date: 2007/02/09 10:29:21; Author: aland; Lines: (+4 -18) File: radiusd/src/main/threads.c; Revision: 1.116; Date: 2007/02/09 10:29:21; Author: aland; Lines: (+34 -26) ------------------------------- Description: Cleaned up exec stuff, to make it more like the CVS head, and to fix other errors (sigh) Modified files: File: radiusd/src/include/radiusd.h; Revision: 1.156.2.4.2.1; Date: 2007/02/09 10:27:57; Author: aland; Lines: (+4 -4) File: radiusd/src/main/exec.c; Revision: 1.42.2.1.2.3; Date: 2007/02/09 10:27:57; Author: aland; Lines: (+15 -4) File: radiusd/src/main/radiusd.c; Revision: 1.321.2.2.2.4; Date: 2007/02/09 10:27:58; Author: aland; Lines: (+13 -3) File: radiusd/src/main/session.c; Revision: 1.21.2.1.2.2; Date: 2007/02/09 10:27:59; Author: aland; Lines: (+4 -18) File: radiusd/src/main/threads.c; Revision: 1.77.2.7.2.1; Date: 2007/02/09 10:27:59; Author: aland; Lines: (+113 -63) ------------------------------- Description: Fix lrad_hash_table_free() Modified files: File: radiusd/src/lib/hash.c; Revision: 1.19; Date: 2007/02/09 15:05:37; Author: aland; Lines: (+18 -11) File: radiusd/src/lib/hash.c; Revision: 1.9.2.10; Date: 2007/02/09 15:06:01; Author: aland; Lines: (+16 -11) ------------------------------- Description: When a duplicate attribute is found, delete the old one Modified files: File: radiusd/src/lib/dict.c; Revision: 1.97; Date: 2007/02/09 15:32:13; Author: aland; Lines: (+10 -2) File: radiusd/src/lib/dict.c; Revision: 1.50.2.4.2.15; Date: 2007/02/09 15:32:24; Author: aland; Lines: (+10 -2) ------------------------------- Description: Be more aggressive about freeing memory on clean exit. This should help track down memory leaks, if any Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.36.2.6.2.6; Date: 2007/02/09 15:56:11; Author: aland; Lines: (+6 -1) File: radiusd/src/main/nas.c; Revision: 1.22.4.1; Date: 2007/02/09 15:56:12; Author: aland; Lines: (+4 -2) File: radiusd/src/main/request_list.c; Revision: 1.40.2.2.2.2; Date: 2007/02/09 15:56:12; Author: aland; Lines: (+8 -2) File: radiusd/src/main/valuepair.c; Revision: 1.60.2.4.2.1; Date: 2007/02/09 15:56:12; Author: aland; Lines: (+14 -2) File: radiusd/src/main/xlat.c; Revision: 1.72.2.7.2.4; Date: 2007/02/09 15:56:13; Author: aland; Lines: (+12 -2) ===================================================== Log entries ===================================================== Description: Updated with new attributes from bug #417 Modified files: File: radiusd/share/dictionary.garderos; Revision: 1.5; Date: 2007/02/09 10:52:32; Author: aland; Lines: (+3 -1) ------------------------------- Description: Added new attributes from bug #417 Modified files: File: radiusd/share/dictionary.garderos; Revision: 1.2.2.1.2.2; Date: 2007/02/09 10:51:46; Author: aland; Lines: (+3 -1) ------------------------------- Description: Define dict_free Modified files: File: radiusd/src/include/libradius.h; Revision: 1.76.2.2.2.11; Date: 2007/02/09 15:33:11; Author: aland; Lines: (+2 -1) ------------------------------- Description: Caching request->password is probably a bad idea Modified files: File: radiusd/src/main/auth.c; Revision: 1.160; Date: 2007/02/09 13:09:10; Author: aland; Lines: (+8 -5) ------------------------------- Description: Free more stuff on exit Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.36.2.6.2.5; Date: 2007/02/09 15:33:21; Author: aland; Lines: (+4 -1) ------------------------------- Description: use correct lineo. We could really us a cf_item_lineno() Modified files: File: radiusd/src/main/modules.c; Revision: 1.113; Date: 2007/02/09 10:38:25; Author: aland; Lines: (+7 -4) ------------------------------- Description: use correct lineno We could really use a cf_item_lineo() Modified files: File: radiusd/src/main/modules.c; Revision: 1.86.2.1.2.5; Date: 2007/02/09 10:39:11; Author: aland; Lines: (+8 -4) ------------------------------- Description: increase size of buffer to allow longer SQL qeuries Thise closes bug #405 Modified files: File: radiusd/src/main/xlat.c; Revision: 1.72.2.7.2.3; Date: 2007/02/09 10:43:52; Author: aland; Lines: (+3 -3) ------------------------------- Description: Use pairfind() to get CHAP-Password, not request->password Modified files: File: radiusd/src/modules/rlm_chap/rlm_chap.c; Revision: 1.18; Date: 2007/02/09 13:05:25; Author: aland; Lines: (+6 -11) ------------------------------- Description: request->password is User-Password or CHAP-Password. That's probably a bad idea Modified files: File: radiusd/src/modules/rlm_perl/rlm_perl.c; Revision: 1.47; Date: 2007/02/09 13:09:35; Author: aland; Lines: (+5 -2) ===================================================== Summary of modified files ===================================================== File: radiusd/share/dictionary.garderos Revisions: 1.5, 1.2.2.1.2.2 Authors: aland (+3 -1), aland (+3 -1) ------------------------------- File: radiusd/src/include/libradius.h Revisions: 1.76.2.2.2.11 Authors: aland (+2 -1) ------------------------------- File: radiusd/src/include/radiusd.h Revisions: 1.214, 1.156.2.4.2.1 Authors: aland (+4 -4), aland (+4 -4) ------------------------------- File: radiusd/src/lib/dict.c Revisions: 1.97, 1.50.2.4.2.15 Authors: aland (+10 -2), aland (+10 -2) ------------------------------- File: radiusd/src/lib/hash.c Revisions: 1.19, 1.9.2.10 Authors: aland (+18 -11), aland (+16 -11) ------------------------------- File: radiusd/src/main/auth.c Revisions: 1.160 Authors: aland (+8 -5) ------------------------------- File: radiusd/src/main/conffile.c Revisions: 1.144, 1.100.2.1.2.3 Authors: aland (+3 -3), aland (+3 -3) ------------------------------- File: radiusd/src/main/exec.c Revisions: 1.57, 1.42.2.1.2.3 Authors: aland (+16 -21), aland (+15 -4) ------------------------------- File: radiusd/src/main/mainconfig.c Revisions: 1.99, 1.36.2.6.2.6, 1.36.2.6.2.5, 1.36.2.6.2.4 Authors: aland (+22 -2), aland (+6 -1), aland (+4 -1), aland (+21 -1) ------------------------------- File: radiusd/src/main/modules.c Revisions: 1.113, 1.86.2.1.2.5 Authors: aland (+7 -4), aland (+8 -4) ------------------------------- File: radiusd/src/main/nas.c Revisions: 1.22.4.1 Authors: aland (+4 -2) ------------------------------- File: radiusd/src/main/radiusd.c Revisions: 1.321.2.2.2.4 Authors: aland (+13 -3) ------------------------------- File: radiusd/src/main/request_list.c Revisions: 1.40.2.2.2.2 Authors: aland (+8 -2) ------------------------------- File: radiusd/src/main/session.c Revisions: 1.35, 1.21.2.1.2.2 Authors: aland (+4 -18), aland (+4 -18) ------------------------------- File: radiusd/src/main/threads.c Revisions: 1.116, 1.77.2.7.2.1 Authors: aland (+34 -26), aland (+113 -63) ------------------------------- File: radiusd/src/main/valuepair.c Revisions: 1.60.2.4.2.1 Authors: aland (+14 -2) ------------------------------- File: radiusd/src/main/xlat.c Revisions: 1.72.2.7.2.4, 1.72.2.7.2.3 Authors: aland (+12 -2), aland (+3 -3) ------------------------------- File: radiusd/src/modules/rlm_chap/rlm_chap.c Revisions: 1.18 Authors: aland (+6 -11) ------------------------------- File: radiusd/src/modules/rlm_eap/mem.c Revisions: 1.20, 1.14.4.3 Authors: aland (+3 -2), aland (+3 -2) ------------------------------- File: radiusd/src/modules/rlm_perl/rlm_perl.c Revisions: 1.47 Authors: aland (+5 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 08.02.2007 - 09.02.2007 GMT
by Automatic cvs log generator 09 Feb '07

09 Feb '07

CVS log entries from 08.02.2007 (Thu) 09:00:00 - 09.02.2007 (Fri) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revisions: 1.43, 1.15.2.2.2.3 File: radiusd/src/lib/radius.c; Revisions: 1.193, 1.125.2.5.2.9 File: radiusd/src/modules/rlm_preprocess/rlm_preprocess.c; Revisions: 1.71 ===================================================== Combined list of identical log entries ===================================================== Description: If a packet is too long, truncate at the last good attribute Modified files: File: radiusd/src/lib/radius.c; Revision: 1.193; Date: 2007/02/08 14:06:28; Author: aland; Lines: (+15 -14) File: radiusd/src/lib/radius.c; Revision: 1.125.2.5.2.9; Date: 2007/02/08 14:05:52; Author: aland; Lines: (+15 -14) ------------------------------- Description: Don't leave 'vp' pointing to a deleted attribute Modified files: File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revision: 1.43; Date: 2007/02/08 10:25:09; Author: aland; Lines: (+6 -4) File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revision: 1.15.2.2.2.3; Date: 2007/02/08 10:24:35; Author: aland; Lines: (+6 -4) ===================================================== Log entries ===================================================== Description: Apply patch from 1.67 to accounting requests, too Modified files: File: radiusd/src/modules/rlm_preprocess/rlm_preprocess.c; Revision: 1.71; Date: 2007/02/08 09:38:27; Author: aland; Lines: (+4 -4) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/radius.c Revisions: 1.193, 1.125.2.5.2.9 Authors: aland (+15 -14), aland (+15 -14) ------------------------------- File: radiusd/src/modules/rlm_pap/rlm_pap.c Revisions: 1.43, 1.15.2.2.2.3 Authors: aland (+6 -4), aland (+6 -4) ------------------------------- File: radiusd/src/modules/rlm_preprocess/rlm_preprocess.c Revisions: 1.71 Authors: aland (+4 -4) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 06.02.2007 - 08.02.2007 GMT
by Automatic cvs log generator 08 Feb '07

08 Feb '07

CVS log entries from 06.02.2007 (Tue) 09:00:01 - 08.02.2007 (Thu) 09:00:00 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/packet.c; Revisions: 1.10, 1.9 File: radiusd/src/main/mainconfig.c; Revisions: 1.98 File: radiusd/src/main/radius_snmp.c; Revisions: 1.29 File: radiusd/src/main/conffile.c; Revisions: 1.143 File: radiusd/src/main/listen.c; Revisions: 1.52 File: radiusd/src/lib/md5.c; Revisions: 1.20 Author: pnixon File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revisions: 1.23, 1.22 File: radiusd/raddb/sqlippool.conf; Revisions: 1.9 ===================================================== Combined list of identical log entries ===================================================== Description: Add non-mandatory pool-check statement to allow detection of whether the Pool does not exist or rather is simply full Modified files: File: radiusd/raddb/sqlippool.conf; Revision: 1.9; Date: 2007/02/06 16:37:13; Author: pnixon; Lines: (+29 -37) File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.22; Date: 2007/02/06 16:37:12; Author: pnixon; Lines: (+51 -15) ===================================================== Log entries ===================================================== Description: Build on systems without IPv6 addresses Modified files: File: radiusd/src/lib/md5.c; Revision: 1.20; Date: 2007/02/06 12:50:14; Author: aland; Lines: (+3 -2) ------------------------------- Description: Don't copy too much data && crash the client Modified files: File: radiusd/src/lib/packet.c; Revision: 1.10; Date: 2007/02/06 14:06:32; Author: aland; Lines: (+4 -5) ------------------------------- Description: Build on non-IPv6 aware systems Modified files: File: radiusd/src/lib/packet.c; Revision: 1.9; Date: 2007/02/06 13:02:10; Author: aland; Lines: (+3 -2) ------------------------------- Description: Return -1 on error, not NULL The file permission checks here are probably too strong.. Modified files: File: radiusd/src/main/conffile.c; Revision: 1.143; Date: 2007/02/06 13:57:09; Author: aland; Lines: (+3 -3) ------------------------------- Description: Support Status-Server on accounting ports, too Modified files: File: radiusd/src/main/listen.c; Revision: 1.52; Date: 2007/02/06 14:06:55; Author: aland; Lines: (+47 -17) ------------------------------- Description: One more check Modified files: File: radiusd/src/main/mainconfig.c; Revision: 1.98; Date: 2007/02/06 13:46:37; Author: aland; Lines: (+3 -3) ------------------------------- Description: Check for existence of c->shortname before dereferencing it Modified files: File: radiusd/src/main/radius_snmp.c; Revision: 1.29; Date: 2007/02/06 10:12:20; Author: aland; Lines: (+6 -6) ------------------------------- Description: Change BEGIN to SQL99 conformant START TRANSACTION Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.23; Date: 2007/02/06 20:06:08; Author: pnixon; Lines: (+8 -8) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sqlippool.conf Revisions: 1.9 Authors: pnixon (+29 -37) ------------------------------- File: radiusd/src/lib/md5.c Revisions: 1.20 Authors: aland (+3 -2) ------------------------------- File: radiusd/src/lib/packet.c Revisions: 1.10, 1.9 Authors: aland (+4 -5), aland (+3 -2) ------------------------------- File: radiusd/src/main/conffile.c Revisions: 1.143 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/listen.c Revisions: 1.52 Authors: aland (+47 -17) ------------------------------- File: radiusd/src/main/mainconfig.c Revisions: 1.98 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/radius_snmp.c Revisions: 1.29 Authors: aland (+6 -6) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c Revisions: 1.23, 1.22 Authors: pnixon (+8 -8), pnixon (+51 -15) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Bug in radclient when parsing long value from file (FreeRADIUS 1.1.3)
by Geoffroy Arnoud 07 Feb '07

07 Feb '07

Hi all, There a bug in radclient when reading a valuepair from a file, when the value is to long to be read, when written in hexadecimal. Actually, when a value can be at most 253 bytes (on the network), when expressed in hexadecimal, it requires 253x2 + 2 (0x) characters. Here is a sample request that shows the issue. NAS-IP-Address = 10.194.96.114 Framed-IP-Address = 192.168.100.69 Event-Timestamp = "Dec 18 2006 08:42:08 CET" Acct-Status-Type = Stop WISPr-Location-Name = "Something" Acct-Output-Octets = 32411 Acct-Terminate-Cause = Session-Timeout Acct-Session-Id = "00000743" NAS-Identifier = "SomethingNAS" Acct-Output-Gigawords = 0 NAS-Port-Type = Virtual User-Name = "user@company" Acct-Session-Time = 600 Acct-Input-Gigawords = 0 Class = 0x53425232434cc383c2a6c382c2b4c383efbfbdc383c2adc383c2a7c383c2acc383c5b8c383e280b9c383c2b7c3a2e2809ac2ac11c3a2e2809ac2ac3901c3a2e2809ac2ac08c3afc2bfc2bdc385c2bec3a2e282acc2bac383c2acc383c2a7c3a2e282acc593c383e280b0c383c5bec382c2be02c3a2e2809ac2ac17c3afc2bfc2bdc385e2809cc385e28099c383c2a6c3a2e282acc593c3af Acct-Input-Octets = 324352 The bug is located in file src/lib/valuepair.c in function pairread. A patch is attached that increases the size of the "value" buffer to 512 bytes. Does anyone see side effects? Best regards, Geoff. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

How does EAP-SIM module decide whether read keys from file or calculate by itself?
by lishuai zhao 06 Feb '07

06 Feb '07

Hi, all After I studied the EAP-SIM and EAP-AKA parts, I have some doubts and questions: 1.I think the function eap_sim_sendchallenge is to calculate keys and send to authenticator, then authenticator forward it to the client. 2.I think the function process_eap_sim_challenge is to check the response and to decide weather to response with EAP-Success. 3.As said in 1, the eap_sim_sendchallenge can calculate keys itself, and also the rlm_sim_file module makes it can read keys from file. How to decide which method to use? Waiting for your replies, thank you! Best wishes! Lanny Zhao

1 0

Segmentation fault when processing SNMP
by Geoffroy Arnoud 06 Feb '07

06 Feb '07

Hi all, I am experiencing FreeRADIUS SNMP with FreeRADIUS CVS snapshot (20070201). I use Net-SNMP. FreeRADIUS makes a segmentation fault when processing the following SNMP request: snmpwalk -Cc -v 1 -m /PATH-TO-MIBs/RADIUS-AUTH-SERVER-MIB.txt -c verysecret 172.26.233.2 radiusAuth I use the configuration "out-of-the-box", except for snmp.conf, that is: smux_password = verysecret snmp_write_access = yes I run radiusd -X. Here is the output: [garnoud@loo sbin]$ ./radiusd -X Config: including file: /users/garnoud/freeradius/V2-20070201/etc/raddb/radiusd.conf Config: including file: /users/garnoud/freeradius/V2-20070201/etc/raddb/proxy.conf Config: including file: /users/garnoud/freeradius/V2-20070201/etc/raddb/clients.conf Config: including file: /users/garnoud/freeradius/V2-20070201/etc/raddb/snmp.conf Config: including file: /users/garnoud/freeradius/V2-20070201/etc/raddb/eap.conf Config: including file: /users/garnoud/freeradius/V2-20070201/etc/raddb/sql.conf Config: including file: /users/garnoud/freeradius/V2-20070201/etc/raddb/sql/mysql-dialup.conf FreeRADIUS Version 2.0.0-pre0, for host i686-pc-linux-gnu, built on Feb 5 2007 at 14:49:12 Starting - reading configuration files ... read_config_files: reading dictionary main: prefix = "/users/garnoud/freeradius/V2-20070201" main: localstatedir = "/users/garnoud/freeradius/V2-20070201/var" main: logdir = "/users/garnoud/freeradius/V2-20070201/var/log/radius" main: libdir = "/users/garnoud/freeradius/V2-20070201/lib" main: radacctdir = "/users/garnoud/freeradius/V2-20070201/var/log/radius/radacct" main: hostname_lookups = no main: snmp = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/users/garnoud/freeradius/V2-20070201/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/users/garnoud/freeradius/V2-20070201/var/run/radiusd/radiusd.pid" main: checkrad = "/users/garnoud/freeradius/V2-20070201/sbin/checkrad" main: debug_level = 0 main: proxy_requests = yes log: syslog_facility = "daemon" proxy: retry_delay = 5 proxy: retry_count = 3 proxy: default_fallback = yes proxy: dead_time = 120 proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no read_config_files: reading realms main: port = 1812 listen: type = "auth" listen: ipaddr = * listen: port = 0 listen: type = "acct" listen: ipaddr = * listen: port = 0 client: secret = "testing123" client: shortname = "localhost" client: nastype = "other" radiusd: entering modules setup Module: Library search path is /users/garnoud/freeradius/V2-20070201/lib Module: Loaded exec exec: wait = yes exec: input_pairs = "request" exec: shell_escape = yes rlm_exec: wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded expiration expiration: reply-message = "Password Has Expired " Module: Instantiated expiration (expiration) Module: Loaded logintime logintime: reply-message = "You are calling outside your allowed timespan " logintime: minimum-timeout = 60 Module: Instantiated logintime (logintime) Module: Loaded PAP pap: encryption_scheme = "auto" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no Module: Instantiated mschap (mschap) Module: Loaded System unix: radwtmp = "/users/garnoud/freeradius/V2-20070201/var/log/radius/radwtmp" Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/users/garnoud/freeradius/V2-20070201/etc/raddb/huntgroups" preprocess: hints = "/users/garnoud/freeradius/V2-20070201/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/users/garnoud/freeradius/V2-20070201/etc/raddb/users" files: acctusersfile = "/users/garnoud/freeradius/V2-20070201/etc/raddb/acct_users" files: preproxy_usersfile = "/users/garnoud/freeradius/V2-20070201/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/users/garnoud/freeradius/V2-20070201/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: header = "%t" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no detail: log_packet_header = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/users/garnoud/freeradius/V2-20070201/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded attr_filter attr_filter: attrsfile = "/users/garnoud/freeradius/V2-20070201/etc/raddb/attrs.accounting_response" attr_filter: key = "%{User-Name}" Module: Instantiated attr_filter (attr_filter.accounting_response) attr_filter: attrsfile = "/users/garnoud/freeradius/V2-20070201/etc/raddb/attrs.access_reject" attr_filter: key = "%{User-Name}" Module: Instantiated attr_filter (attr_filter.access_reject) main: smux_password = "verysecret" main: snmp_write_access = yes SMUX connect try 1 SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: verysecret SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 2 SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 2 Initializing the thread pool... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 12 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 32 SMUX message received type: 161 rest len: 28 SMUX_GETNEXT SMUX GET message parse: len 28 SMUX GET reqid: 33 len: 25 SMUX GET errstat 0 len: 22 SMUX GET errindex 0 len: 19 SMUX var parse: len 19 SMUX var parse: type 48 len 15 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1 SMUX val_type: 5 ASN_NULL SMUX function call index is 1 SMUX GETRSP send SMUX GETRSP reqid: 33 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 128 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 34 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.1.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 1 SMUX function call index is 2 SMUX GETRSP send SMUX GETRSP reqid: 34 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 39 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 35 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.2.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 2 SMUX function call index is 3 SMUX GETRSP send SMUX GETRSP reqid: 35 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 39 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 36 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.3.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 3 SMUX function call index is 4 SMUX GETRSP send SMUX GETRSP reqid: 36 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 37 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.4.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 4 SMUX function call index is 5 SMUX GETRSP send SMUX GETRSP reqid: 37 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 38 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.5.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 5 SMUX function call index is 6 SMUX GETRSP send SMUX GETRSP reqid: 38 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 39 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.6.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 6 SMUX function call index is 7 SMUX GETRSP send SMUX GETRSP reqid: 39 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 40 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.7.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 7 SMUX function call index is 8 SMUX GETRSP send SMUX GETRSP reqid: 40 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 41 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.8.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 8 SMUX function call index is 9 SMUX GETRSP send SMUX GETRSP reqid: 41 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 42 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.9.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 9 SMUX function call index is 10 SMUX GETRSP send SMUX GETRSP reqid: 42 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 43 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.10.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 10 SMUX function call index is 11 SMUX GETRSP send SMUX GETRSP reqid: 43 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 44 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.11.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 11 SMUX function call index is 12 SMUX GETRSP send SMUX GETRSP reqid: 44 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 45 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.12.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 12 SMUX function call index is 13 SMUX GETRSP send SMUX GETRSP reqid: 45 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 46 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.13.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 13 SMUX function call index is 14 SMUX GETRSP send SMUX GETRSP reqid: 46 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 38 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 37 SMUX message received type: 161 rest len: 33 SMUX_GETNEXT SMUX GET message parse: len 33 SMUX GET reqid: 47 len: 30 SMUX GET errstat 0 len: 27 SMUX GET errindex 0 len: 24 SMUX var parse: len 24 SMUX var parse: type 48 len 20 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.14.0 SMUX val_type: 5 ASN_NULL SMUX function call index is 14 SMUX function call index is 2 SMUX GETRSP send SMUX GETRSP reqid: 47 SMUX GETRSP errstat: 0 SMUX GETRSP errindex: 0 SMUX getresp send: 59 Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 39 SMUX message received type: 161 rest len: 35 SMUX_GETNEXT SMUX GET message parse: len 35 SMUX GET reqid: 48 len: 32 SMUX GET errstat 0 len: 29 SMUX GET errindex 0 len: 26 SMUX var parse: len 26 SMUX var parse: type 48 len 22 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.15.1.2.1 SMUX val_type: 5 ASN_NULL SMUX function call index is 2 SMUX function call index is 3 Segmentation fault Has anyone already encountered this issue? Best regards, Geoff. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

4 11

freeradius-client debian files
by Jan Janak 06 Feb '07

06 Feb '07

Hello, Is anyone maintaining the Debian control files in freeradius-client library? I am the original author of the debian packaging files in radiusclient-ng and one of the maintainers of the package in Debian so I thought I could update them for freeradius-client if nobody is working on that. Jan.

3 3

Automatic report from sources (radiusd) between 05.02.2007 - 06.02.2007 GMT
by Automatic cvs log generator 06 Feb '07

06 Feb '07

CVS log entries from 05.02.2007 (Mon) 09:00:01 - 06.02.2007 (Tue) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revisions: 1.21, 1.20 File: radiusd/raddb/sqlippool.conf; Revisions: 1.8 ===================================================== Combined list of identical log entries ===================================================== Description: Added new option sqlippool_log_clear to log when an IP address is deallocated Modified files: File: radiusd/raddb/sqlippool.conf; Revision: 1.8; Date: 2007/02/05 17:57:27; Author: pnixon; Lines: (+6 -3) File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.21; Date: 2007/02/05 17:57:27; Author: pnixon; Lines: (+10 -4) ===================================================== Log entries ===================================================== Description: On query error, emit the failed query to the log so we can track it down. Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.20; Date: 2007/02/05 12:17:13; Author: pnixon; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sqlippool.conf Revisions: 1.8 Authors: pnixon (+6 -3) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c Revisions: 1.21, 1.20 Authors: pnixon (+10 -4), pnixon (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0