- Freeradius-Devel - lists.freeradius.org

Escaping of User Names
by Peter Nixon 06 Feb '07

06 Feb '07

Hi Guys Well, my lovely users have managed to find a bug. I am trying to figure out at present if I am doing something wrong in sqlippool or if there is a general problem with rlm_sql or more specifically rlm_sql_postgresql. I have 2 users sending me weird usernames. One is "?AZq?/?" and the other is "*?Z?�?-�" Now, I authorise my users on this system based on other attributes, and do no actual authentication so the username is ignored. I could just delete the username part from the queries and it would solve the problem for me, but thats beside the point. The main sql auth and acct s working fine, however sqlippool is throwing the following error: Error: sqlippool_command: database query error in: 'UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '3600 seconds'::interval WHERE nasipaddress = '217.31.232.36' AND pool_key = '038153' AND username = '?AZq?/?'' AND callingstationid = 'username' AND framedipaddress = '10.11.10.28'' The errors Postgresql shows in the log are: 2007-02-05 14:22:59 EET saaas raduser ERROR: invalid byte sequence for encoding "UTF8": 0x85 2007-02-05 14:23:26 EET saaas raduser ERROR: invalid byte sequence for encoding "UTF8": 0x87 The actual query in question is: alive-update = "UPDATE radippool \ SET expiry_time = 'now'::timestamp(0) + '${lease-duration} seconds'::interval \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' AND username = '%{SQL-User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" Does anyone know what is going wrong? -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 4

Is CVS snapshot (20070201) a minimal stable?
by Geoffroy Arnoud 05 Feb '07

05 Feb '07

Hi again, I am trying to test the new features of FreeRADIUS V2 and I'am getting a seg fault, when sending just an Access-Request to FreeRADIUS. The only configuration change is that I set snmp = no. Here is the request I send: User-Name = "geoffroy@pc_gao" User-Password = "gaogreiogeriogjeriog" Framed-IP-Address = 10.0.0.1 NAS-Port = 0 Here is the ouput with radiusd -Xxx Mon Feb 5 16:54:29 2007 : Info: Ready to process requests. Mon Feb 5 16:54:29 2007 : Debug: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.26.233.2 port 16385, id=162, length=83 User-Name = "geoffroy@pc_gao" User-Password = "gaogreiogeriogjeriog" Framed-IP-Address = 10.0.0.1 NAS-Port = 0 Mon Feb 5 16:54:33 2007 : Debug: Processing the authorize section of radiusd.conf Mon Feb 5 16:54:33 2007 : Debug: modcall: entering group authorize for request 0 Mon Feb 5 16:54:33 2007 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Does anyone have tested this snapshot? Thanks Geoff. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 2

How doed eap-sim module obtain the triplets?
by lishuai zhao 05 Feb '07

05 Feb '07

Hi, all: I want to analyze the source code eap-sim part in FreeRADIUS. As we know, the eap-sim needs server triplets. My questions are? (1) How the triplets were obtained? (2) The place that the triplets were obtained in the source code? (3) Can triplets obtained from exterior? Thank you!!!!

1 0

Automatic report from sources (radiusd) between 04.02.2007 - 05.02.2007 GMT
by Automatic cvs log generator 05 Feb '07

05 Feb '07

CVS log entries from 04.02.2007 (Sun) 09:00:01 - 05.02.2007 (Mon) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/suse/radiusd-pam; Revisions: 1.4, 1.2.4.1.2.1 File: radiusd/src/main/Makefile.in; Revisions: 1.63, 1.27.2.5.2.5 File: radiusd/src/modules/rlm_acctlog/configure; Revisions: 1.1 File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revisions: 1.19 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.239, 1.188.2.4.2.16 File: radiusd/src/modules/stable; Revisions: 1.17 ===================================================== Combined list of identical log entries ===================================================== Description: Add -pie patch thanks to SUSE Modified files: File: radiusd/src/main/Makefile.in; Revision: 1.63; Date: 2007/02/04 14:39:46; Author: pnixon; Lines: (+2 -2) File: radiusd/src/main/Makefile.in; Revision: 1.27.2.5.2.5; Date: 2007/02/04 14:39:50; Author: pnixon; Lines: (+2 -2) ------------------------------- Description: Applied radiusd-pamd.diff. thanks to SUSE Modified files: File: radiusd/suse/radiusd-pam; Revision: 1.4; Date: 2007/02/04 15:10:08; Author: pnixon; Lines: (+1 -1) File: radiusd/suse/radiusd-pam; Revision: 1.2.4.1.2.1; Date: 2007/02/04 15:10:11; Author: pnixon; Lines: (+1 -1) ------------------------------- Description: Apply SUSE's edir.patch to explicitly set edir_account_policy_check=no. Wont affect no edir users and saves a patch for SUSE Modified files: File: radiusd/raddb/radiusd.conf.in; Revision: 1.239; Date: 2007/02/04 15:28:56; Author: pnixon; Lines: (+2 -2) File: radiusd/raddb/radiusd.conf.in; Revision: 1.188.2.4.2.16; Date: 2007/02/04 15:28:46; Author: pnixon; Lines: (+2 -2) ===================================================== Log entries ===================================================== Description: Add configure to the tree Modified files: File: radiusd/src/modules/rlm_acctlog/configure; Revision: 1.1; Date: 2007/02/05 08:43:32; Author: pnixon; ------------------------------- Description: Change the order back. Turns out that we get unwanted No Pool-Name defined logs even with static ips. oops Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.19; Date: 2007/02/04 23:04:30; Author: pnixon; Lines: (+9 -9) ------------------------------- Description: Add sqlippool and acctlog to the list of stable modules Modified files: File: radiusd/src/modules/stable; Revision: 1.17; Date: 2007/02/04 17:12:06; Author: pnixon; Lines: (+3 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/radiusd.conf.in Revisions: 1.239, 1.188.2.4.2.16 Authors: pnixon (+2 -2), pnixon (+2 -2) ------------------------------- File: radiusd/src/main/Makefile.in Revisions: 1.63, 1.27.2.5.2.5 Authors: pnixon (+2 -2), pnixon (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_acctlog/configure Revisions: 1.1 Authors: pnixon ------------------------------- File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c Revisions: 1.19 Authors: pnixon (+9 -9) ------------------------------- File: radiusd/src/modules/stable Revisions: 1.17 Authors: pnixon (+3 -1) ------------------------------- File: radiusd/suse/radiusd-pam Revisions: 1.4, 1.2.4.1.2.1 Authors: pnixon (+1 -1), pnixon (+1 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 03.02.2007 - 04.02.2007 GMT
by Automatic cvs log generator 04 Feb '07

04 Feb '07

CVS log entries from 03.02.2007 (Sat) 09:00:01 - 04.02.2007 (Sun) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/src/modules/rlm_acctlog/rlm_acctlog.c; Revisions: 1.3 File: radiusd/src/main/log.c; Revisions: 1.54 File: radiusd/raddb/experimental.conf; Revisions: 1.36 File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revisions: 1.18, 1.17, 1.16 File: radiusd/src/include/radiusd.h; Revisions: 1.213 ===================================================== Combined list of identical log entries ===================================================== Description: Add new log type (L_ACCT) and use it in rlm_acctlog Modified files: File: radiusd/src/include/radiusd.h; Revision: 1.213; Date: 2007/02/03 23:09:52; Author: pnixon; Lines: (+3 -2) File: radiusd/src/main/log.c; Revision: 1.54; Date: 2007/02/03 23:09:52; Author: pnixon; Lines: (+6 -2) File: radiusd/src/modules/rlm_acctlog/rlm_acctlog.c; Revision: 1.3; Date: 2007/02/03 23:09:52; Author: pnixon; Lines: (+2 -2) ===================================================== Log entries ===================================================== Description: Add Acct-Session-Time to Stop logs and adjust other queries slightly Modified files: File: radiusd/raddb/experimental.conf; Revision: 1.36; Date: 2007/02/03 23:08:44; Author: pnixon; Lines: (+3 -3) ------------------------------- Description: Fix spelling in comments Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.18; Date: 2007/02/03 22:13:43; Author: pnixon; Lines: (+3 -3) ------------------------------- Description: Return RLM_MODULE_FAIL instead of RLM_MODULE_NOOP if there is no SQL socket Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.17; Date: 2007/02/03 19:19:04; Author: pnixon; Lines: (+3 -3) ------------------------------- Description: Switch the order of Framed-IP-Address and Pool-Name check. May make a small speed increase for those with a mix of static and dynamic addresses Modified files: File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c; Revision: 1.16; Date: 2007/02/03 19:03:52; Author: pnixon; Lines: (+9 -9) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/experimental.conf Revisions: 1.36 Authors: pnixon (+3 -3) ------------------------------- File: radiusd/src/include/radiusd.h Revisions: 1.213 Authors: pnixon (+3 -2) ------------------------------- File: radiusd/src/main/log.c Revisions: 1.54 Authors: pnixon (+6 -2) ------------------------------- File: radiusd/src/modules/rlm_acctlog/rlm_acctlog.c Revisions: 1.3 Authors: pnixon (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_sqlippool/rlm_sqlippool.c Revisions: 1.18, 1.17, 1.16 Authors: pnixon (+3 -3), pnixon (+3 -3), pnixon (+9 -9) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Question about rad_fork
by Garber, Neal 01 Feb '07

01 Feb '07

While reviewing rad_fork, as part of an enhancement I'm working on, I found something questionable. After the call to fork, it tests if child_pid != 0 (to see if the parent is the process executing, I presume). If true, then, the child_pid is added to the thread pool and the thread pool mutex is unlocked. However, if the fork failed, -1 is returned (and stored in child_pid), which I believe will then be added to the thread pool (because -1 != 0 and there isn't an explicit test for fork success/failure). Shouldn't there be a test for fork success (child_pid > 0) before adding to the thread pool? Perhaps this isn't a big deal because fork probably doesn't fail that often. But, it isn't clear to me what would happen in reap_children when it calls waitpid with -1 as this tells waitpid to return status for any child. Am I missing something? If not, and you want me to submit a bug report with the minor code change, let me know..

4 9

RFC 3748 compliancy
by Geoffroy Arnoud 01 Feb '07

01 Feb '07

hi all, I took a look at EAP method source code (even if crypto is not my speciality), and I'm wondering if all EAP methods shipped into freeRADIUS are compliant with RFC3748, regarding MSK and EMSK generation? This RFC states that "EAP method supporting key derivation MUST export a Master Session Key (MSK) of at least 64 octets, and an Extended Master Session Key (EMSK) of at least 64 octets." (§ 7.10) Which are the EAP methods that supports key derivation? And regarding other EAP methods, is there a way to add EMSK generation (maybe this is a stupid question)? I need those answers to see if FreeRADIUS would be able to act as a EAP RADIUS server compliant with WiMAX NWG stage 3. Many thanks for your answers Geoff. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 2

Automatic report from sources (radiusd) between 30.01.2007 - 01.02.2007 GMT
by Automatic cvs log generator 01 Feb '07

01 Feb '07

CVS log entries from 30.01.2007 (Tue) 09:00:00 - 01.02.2007 (Thu) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/doc/ChangeLog; Revisions: 1.57.2.31.2.32 File: radiusd/src/lib/valuepair.c; Revisions: 1.82.2.1.2.5 File: radiusd/share/dictionary.asn; Revisions: 1.1.2.2 File: radiusd/share/dictionary; Revisions: 1.93.2.5.2.8 File: radiusd/src/main/conffile.c; Revisions: 1.142, 1.100.2.1.2.2 File: radiusd/src/lib/dict.c; Revisions: 1.96, 1.50.2.4.2.14 File: radiusd/redhat/freeradius.spec; Revisions: 1.23 ===================================================== Combined list of identical log entries ===================================================== Description: Add ASN dictionary, and include it Modified files: File: radiusd/share/dictionary; Revision: 1.93.2.5.2.8; Date: 2007/01/30 10:55:00; Author: aland; Lines: (+2 -1) File: radiusd/share/dictionary.asn; Revision: 1.1.2.2; Date: 2007/01/30 10:55:00; Author: aland; Lines: (+93 -0) ===================================================== Log entries ===================================================== Description: Updated for latest changes Modified files: File: radiusd/doc/ChangeLog; Revision: 1.57.2.31.2.32; Date: 2007/01/30 13:11:54; Author: aland; Lines: (+15 -2) ------------------------------- Description: List include files as being OK to install Modified files: File: radiusd/redhat/freeradius.spec; Revision: 1.23; Date: 2007/01/30 15:46:57; Author: aland; Lines: (+1 -0) ------------------------------- Description: Don't allow globally writable dictionaries. This allows any user to control the behavior of the server. Modified files: File: radiusd/src/lib/dict.c; Revision: 1.96; Date: 2007/01/30 13:02:05; Author: aland; Lines: (+14 -2) ------------------------------- Description: Die if we see globally writable dictionaries. That lets any user control the server Modified files: File: radiusd/src/lib/dict.c; Revision: 1.50.2.4.2.14; Date: 2007/01/30 13:00:44; Author: aland; Lines: (+14 -2) ------------------------------- Description: Increase the size of the value buffer to allow parsing octet strings of "0x" + (253 * 2) bytes Modified files: File: radiusd/src/lib/valuepair.c; Revision: 1.82.2.1.2.5; Date: 2007/01/30 12:58:23; Author: aland; Lines: (+3 -3) ------------------------------- Description: Don't allow globally readable or writeable configuration files. Modified files: File: radiusd/src/main/conffile.c; Revision: 1.142; Date: 2007/01/30 13:10:02; Author: aland; Lines: (+23 -12) ------------------------------- Description: Don't start if the config files are globally readable or writable. Writable means that anyone can execute programs as the server. Readable means that anyone can read the shared secrets, and spoof the server Modified files: File: radiusd/src/main/conffile.c; Revision: 1.100.2.1.2.2; Date: 2007/01/30 13:04:40; Author: aland; Lines: (+32 -16) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.57.2.31.2.32 Authors: aland (+15 -2) ------------------------------- File: radiusd/redhat/freeradius.spec Revisions: 1.23 Authors: aland (+1 -0) ------------------------------- File: radiusd/share/dictionary Revisions: 1.93.2.5.2.8 Authors: aland (+2 -1) ------------------------------- File: radiusd/share/dictionary.asn Revisions: 1.1.2.2 Authors: aland (+93 -0) ------------------------------- File: radiusd/src/lib/dict.c Revisions: 1.96, 1.50.2.4.2.14 Authors: aland (+14 -2), aland (+14 -2) ------------------------------- File: radiusd/src/lib/valuepair.c Revisions: 1.82.2.1.2.5 Authors: aland (+3 -3) ------------------------------- File: radiusd/src/main/conffile.c Revisions: 1.142, 1.100.2.1.2.2 Authors: aland (+23 -12), aland (+32 -16) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Acct-Status-Type block
by Peter Nixon 01 Feb '07

01 Feb '07

It just occurred to me that it would be pretty cool to be able to do: accounting { Acct-Status-Type Stop { ## Log stop packets to disk stop_log } } In the same manner as: post-auth { Post-Auth-Type REJECT { ## Log authentication rejects to disk reply_log } } Is there any way to do this at present (short of writing a custom module)? Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 2

Re: Vendor statement re: CVE-2007-0080
by Alan DeKok 30 Jan '07

30 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Chang, Robert wrote: > Thank you for bringing this to our attention. I'm in the process of > updating this vulnerability with the vendor statement, the updated > evaluation, and the overview. I've read the Security Focus thread, and > I understand the vector of attack is through the manipulation of a > configuration file (stored locally). Yes. > However, it seems like obtaining > additional access privileges is still possible if a normal user was > given write/complete access to the program's directory. To me, that's a misconfiguration of local file permissions, and not a vulnerability in the server. > Could you > please confirm that a local user with full access to application's > directory cannot gain root access to the machine? If a local user can > gain root access, by default, Confidentiality, Integrity, and > Availability are set to complete. If a local user can write to the config files, then *any* server available on the net is vulnerable to this attack. There's no way for a server to reliably determine that users with write permission on the files are "authorized", or "unauthorized". Since many servers can be configured to execute arbitrary programs, this "vulnerability" would appear to be common across a wide range of servers. And in any case, it has nothing whatsoever to do with the SMB buffer overflow. And users who cannot run arbitrary programs as root can still cause configuration file parse errors, and take down programs that are critical to a systems operation. > Each NVD vulnerability is based on > worst-case, so the final scoring would reflect the worst case of root > access. If this is impossible by design, then I'll be sure to update > the vulnerability accordingly. Thank you again for your help. Like many servers, FreeRADIUS permits arbitrary programs to be executed from the configuration files. Buffer overflows are unnecessary, as there are ways to configure the server to directly execute arbitrary programs. As a data point, I just tested Apache2. It is similarly "vulnerable" to the "exploit" of local file permissions, since it also is able to run as "root". If you list this as a vulnerability in FreeRADIUS, then I'm curious as to whether or not you'd accept a similar vulnerability notification for Apache2. If so, I will submit one. If not, please explain why. I'm also curious as to how the server can determine that users with write permission are not, in fact, authorized to write to the configuration files. Some minimal checking is possible, but it does not help in all circumstances, and it can likewise be bypassed by local file permission misconfigurations. Alan DeKok Project Leader The FreeRADIUS Server Project PGP key: http://freeradius.org/pgp/aland@freeradius.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQCVAwUBRb4rKakul4vkAkl9AQL6twP9EYmIxtWKmLMM5aeGvNNgznb6D43+Nlx3 nL1yxSkFbN7bjYqKtPQ74MdDH4RaI3jYJktqOb8vqRrl3cxq/NBK67w1gC8y3tOT qqsVkjw5gHi6hYC4i79p2lVG/7SvFo2BTdAhlgkqewxNIYFcKAqdGUmjGsB+azfk 5yRQE1y+nzA= =BxuH -----END PGP SIGNATURE-----

2 1