- Freeradius-Devel - lists.freeradius.org

RE: [rlm_ldap] chase_referrals option
by Wileczek Michaël 30 Dec '06

30 Dec '06

> From: "Sandworm" <sandworm(a)mepd.hush.com> > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > On Friday, 29 December 2006 1:36 AM, Wileczek MichaÃ«l wrote: > > > > Since i was fighting with authentication on a Microsoft Active > > Directory (bad idea, i know) using referrals , i added an option > in > > rlm_ldap to > > enable/disable referral chasing during ldap requests. > > > > Here is the proposed patch : > > > <snip> > > That's not really necessary. See > http://lists.freeradius.org/pipermail/freeradius-users/2004-October/037218.… > > SW Modifying /etc/openldap/ldap.conf is a general configuration parameter. With the patch i provided, the option is switchable at the rlm_ldap module instance, therefore it allow using rlm_ldap in a mixed directories scheme. Michaël Wileczek System engineer - Technical Operations !TO-MCP-SSPI-IU-IW http://www.atosorigin.com Atos Wordline is an Atos Origin company : www.atosorigin.com Ce message est strictement confidentiel. Son intégrité n'est pas assurée sur Internet. Le contenu de ce message ne peut engager la responsabilité du groupe Atos Origin. Si vous n'êtes pas destinataire du message, merci d'en avertir immédiatement l'expéditeur et de le détruire. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis. This e-mail is privileged and may contain confidential information intended only for the person(s) named above. If you receive this e-mail in error, please notify the sender immediately by telephone or return e-mail. Although the sender endeavours to maintain a computer virus free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.

3 2

Re: Need help in writing a radius client
by Abhinay Sinha 29 Dec '06

29 Dec '06

Hi, Thanks for the comments. Anyways, I am not interested in radiusclient-ng specifically. I need a library to create a client to work with freeradius with some documentation of its API. On 12/29/06, Frank Cusack <fcusack(a)fcusack.com> wrote: > On December 29, 2006 2:07:09 AM +0530 Abhinay Sinha <sinhabhinay(a)gmail.com> > wrote: > > 1. I need an open source library for client. I found radiusclient-ng. > > Is it sufficient for work. > > Not sure why you are asking about non-freeradius software on a freeradius > mailing list. > > > 2. Can anybody please help me find some better documentation for > > working me with the library, i.e. details regarding its API, cause the > > docs provided with the library are minimal? > > Not sure why you are asking about non-freeradius software on a freeradius > mailing list. > > As to minimal docs, welcome to open source. > > > 3. Can I get some sample code for client anywhere? > > See radclient and radtest source in the freeradius distribution. Of > course this won't help you with radiusclient-ng. > > -frank > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html >

1 0

RE: [rlm_ldap] chase_referrals option
by Sandworm 29 Dec '06

29 Dec '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > On Friday, 29 December 2006 1:36 AM, Wileczek Michaël wrote: > > Since i was fighting with authentication on a Microsoft Active > Directory (bad idea, i know) using referrals , i added an option in > rlm_ldap to > enable/disable referral chasing during ldap requests. > > Here is the proposed patch : > <snip> That's not really necessary. See http://lists.freeradius.org/pipermail/freeradius-users/2004- October/037218.html SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkWUZIAACgkQmw4BJyaatJ3/qQCdER+kvVy+nYj0jh/aXSFq9xz2BmYA oIq+iZXExqJnq3X3nFmHtZjXDoRP =WX6x -----END PGP SIGNATURE-----

1 0

(no subject)
by Sandworm 29 Dec '06

29 Dec '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > On Friday, 29 December 2006 1:36 AM, Wileczek Michaël wrote: > > Since i was fighting with authentication on a Microsoft Active > Directory (bad idea, i know) using referrals , i added an option in > rlm_ldap to > enable/disable referral chasing during ldap requests. > > Here is the proposed patch : > <snip> That's not really necessary. See http://lists.freeradius.org/pipermail/freeradius-users/2004- October/037218.html SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkWUZCAACgkQmw4BJyaatJ3NYACgiG2jhwnBJZ2RH1StHRhwl+x2rXQA oIBr6QRCVE8VSGA31//2A9zPUXp8 =+S8c -----END PGP SIGNATURE-----

1 0

[rlm_ldap] chase_referrals option
by Wileczek Michaël 28 Dec '06

28 Dec '06

Since i was fighting with authentication on a Microsoft Active Directory (bad idea, i know) using referrals , i added an option in rlm_ldap to enable/disable referral chasing during ldap requests. Here is the proposed patch : ===patch=== --- rlm_ldap.c Thu Dec 28 15:30:43 2006 +++ new_rlm_ldap.c Thu Dec 28 15:30:56 2006 @@ -270,6 +270,7 @@ struct timeval net_timeout; struct timeval timeout; int debug; + int chase_referrals; int tls_mode; int start_tls; int num_conns; @@ -326,6 +327,7 @@ /* allow server unlimited time for search (server-side limit) */ {"timelimit", PW_TYPE_INTEGER, offsetof(ldap_instance,timelimit), NULL, "20"}, {"identity", PW_TYPE_STRING_PTR, offsetof(ldap_instance,login), NULL, ""}, + {"chase_referrals", PW_TYPE_BOOLEAN, offsetof(ldap_instance,chase_referrals), NULL, "yes"}, {"tls_mode", PW_TYPE_BOOLEAN, offsetof(ldap_instance,tls_mode), NULL, "no"}, {"start_tls", PW_TYPE_BOOLEAN, offsetof(ldap_instance,start_tls), NULL, "no"}, {"tls_cacertfile", PW_TYPE_STRING_PTR, offsetof(ldap_instance,tls_cacertfile), NULL, NULL}, @@ -1972,6 +1974,15 @@ } if (ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *) &(inst->net_timeout)) != LDAP_OPT_SUCCESS) { radlog(L_ERR, "rlm_ldap: Could not set LDAP_OPT_NETWORK_TIMEOUT %ld.%ld", inst->net_timeout.tv_sec, inst->net_timeout.tv_usec); + } + if(inst->chase_referrals) { + rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_ON); + } else { + rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF); + } + if (rc != LDAP_OPT_SUCCESS) { + ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ldap_errno); + radlog(L_ERR, "rlm_ldap: Could not set LDAP_OPT_REFERRALS %d %s", inst->chase_referrals, ldap_err2string(ldap_errno)); } if (ldap_set_option(ld, LDAP_OPT_TIMELIMIT, (void *) &(inst->timelimit)) != LDAP_OPT_SUCCESS) { radlog(L_ERR, "rlm_ldap: Could not set LDAP_OPT_TIMELIMIT %d", inst->timelimit); ===patch=== Michaël Wileczek System engineer - Technical Operations !TO-MCP-SSPI-IU-IW http://www.atosorigin.com Atos Wordline is an Atos Origin company : www.atosorigin.com Ce message est strictement confidentiel. Son intégrité n'est pas assurée sur Internet. Le contenu de ce message ne peut engager la responsabilité du groupe Atos Origin. Si vous n'êtes pas destinataire du message, merci d'en avertir immédiatement l'expéditeur et de le détruire. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis. This e-mail is privileged and may contain confidential information intended only for the person(s) named above. If you receive this e-mail in error, please notify the sender immediately by telephone or return e-mail. Although the sender endeavours to maintain a computer virus free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.

1 0

Automatic report from sources (radiusd) between 18.12.2006 - 19.12.2006 GMT
by Automatic cvs log generator 19 Dec '06

19 Dec '06

CVS log entries from 18.12.2006 (Mon) 09:00:00 - 19.12.2006 (Tue) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revisions: 1.15.2.2.2.2 File: radiusd/doc/ChangeLog; Revisions: 1.57.2.31.2.31 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.188.2.4.2.14 File: radiusd/man/man5/rlm_pap.5; Revisions: 1.3.4.1 ===================================================== Combined list of identical log entries ===================================================== Description: Updated functionality for rlm_pap Modified files: File: radiusd/man/man5/rlm_pap.5; Revision: 1.3.4.1; Date: 2006/12/19 00:35:57; Author: aland; Lines: (+117 -10) File: radiusd/raddb/radiusd.conf.in; Revision: 1.188.2.4.2.14; Date: 2006/12/19 00:35:57; Author: aland; Lines: (+21 -8) File: radiusd/src/modules/rlm_pap/rlm_pap.c; Revision: 1.15.2.2.2.2; Date: 2006/12/19 00:35:58; Author: aland; Lines: (+667 -197) ===================================================== Log entries ===================================================== Description: Note changes to rlm_pap Modified files: File: radiusd/doc/ChangeLog; Revision: 1.57.2.31.2.31; Date: 2006/12/19 00:37:15; Author: aland; Lines: (+3 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/ChangeLog Revisions: 1.57.2.31.2.31 Authors: aland (+3 -1) ------------------------------- File: radiusd/man/man5/rlm_pap.5 Revisions: 1.3.4.1 Authors: aland (+117 -10) ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.188.2.4.2.14 Authors: aland (+21 -8) ------------------------------- File: radiusd/src/modules/rlm_pap/rlm_pap.c Revisions: 1.15.2.2.2.2 Authors: aland (+667 -197) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Help with Simultaneous Login on Freeradius+Ldap
by listasmw＠netconsult.inf.br 15 Dec '06

15 Dec '06

Hi, we are using FreeRadius 1.1.3 on Fedora Core 6 and the RLM_LDAP module, we're needing control simultaneous logins, eg. the ldap user "John" can authenticate only one time. When are monitoring the ldap users logins, they can log successfully in ldap, but we can't see or monitoring the users login in radutmp log file is empty with 0kb, when we execute the radwho command, it is empty but is opening. could you help me please? Regards, Maicon Wendhausen Freeradius Files Logs File: [root@firedap3 radius]# ls -la total 24 drwx------ 3 radiusd radiusd 4096 Dec 14 18:21 . drwxr-xr-x 10 root root 4096 Dec 14 19:06 .. drwx------ 3 radiusd radiusd 4096 Dec 14 19:55 radacct -rw------- 1 radiusd root 5357 Dec 14 20:03 radius.log -rw-r--r-- 1 radiusd root 0 Dec 14 18:21 radutmp -rw-r--r-- 1 radiusd root 0 Dec 14 18:21 radwtmp [root@firedap3 radius]# Log do Radius in Debug mode rad_recv: Access-Request packet from host 10.69.70.210:32771, id=87, length=63 User-Name = "user6" User-Password = "user6" NAS-IP-Address = 10.69.70.210 Service-Type = Authenticate-Only NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "user6", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 modcall[authorize]: module "digest" returns noop for request 2 users: Matched entry DEFAULT at line 222 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for user6 radius_xlat: '(uid=user6)' radius_xlat: 'dc=nct,dc=com,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=nct,dc=com,dc=br, with filter (uid=user6) rlm_ldap: Added password {SSHA}f21M8OjksIKSJ1zUEii6JWKu43tWPRFgsBeiQg== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user user6 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "user6" with password "user6" rlm_ldap: user DN: uid=user6,dc=nct,dc=com,dc=br rlm_ldap: (re)connect to 10.69.70.25:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=user6,dc=nct,dc=com,dc=br/user6 to 10.69.70.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user user6 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 2 modcall: leaving group LDAP (returns ok) for request 2 Processing the session section of radiusd.conf modcall: entering group session for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'user6' modcall[session]: module "radutmp" returns ok for request 2 modcall: leaving group session (returns ok) for request 2 Login OK: [user6] (from client firepass port 0) Sending Access-Accept of id 87 to 10.69.70.210 port 32771 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... users file #...... DEFAULT Simultaneous-Use := 1 Fall-Through = 1 clients.conf file .... default configuration..... client 10.69.70.210 { secret = teste shortname = firepass } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { radutmp { filename = ${logdir}/radutmp ## username = "(uid=%{Stripped-User-Name:-%{User-Name}})" username = %{User-Name} case_sensitive = "yes" check_with_nas = "yes" perm = "0644" callerid = "no" } pap { encryption_scheme = crypt } chap { authtype = CHAP } #$INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = no } ldap { server="10.69.70.25" identity="uid=gged,dc=nct,dc=com,dc=br" password=ged basedn="dc=nct,dc=com,dc=br" filter = (uid=%{Stripped-User-Name:-%{User-Name}}) ## filter= (uid=gged,dc=nct,dc=com,dc=br) password_attribute = userPassword dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 150 ldap_cache_size = 0 ldap_connections_number = 1 timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no } realm suffix { format = suffix delimiter = "@" } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { #key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" key = "User-Name, Acct-Session-Id, NAS-IP-Address" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr # daily } authorize { #preprocess # auth_log # attr_filter chap mschap suffix digest # ntdomain #eap # Read the 'users' file files ldap # daily # checkval } authenticate { Auth-Type PAP { pap ldap } Auth-Type CHAP { chap ldap } Auth-Type MS-CHAP { mschap ldap } Auth-Type LDAP { ldap } } preacct { preprocess acct_unique suffix # Read the 'acct_users' file #files } accounting { detail # daily # # For Simultaneous-Use tracking. # radutmp # sradutmp # main_pool } session { radutmp # sql } post-auth { } pre-proxy { } post-proxy { }

1 0

Automatic report from sources (radiusd) between 14.12.2006 - 15.12.2006 GMT
by Automatic cvs log generator 15 Dec '06

15 Dec '06

CVS log entries from 14.12.2006 (Thu) 09:00:01 - 15.12.2006 (Fri) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/src/lib/udpfromto.c; Revisions: 1.9 File: radiusd/src/main/smux.c; Revisions: 1.21 ===================================================== Log entries ===================================================== Description: Include "autoconf.h" before testing the macro WITH_UDPFROMTO. Modified files: File: radiusd/src/lib/udpfromto.c; Revision: 1.9; Date: 2006/12/14 14:20:01; Author: nbk; Lines: (+4 -4) ------------------------------- Description: Include "autoconf.h" before testing the macro WITH_SNMP. Modified files: File: radiusd/src/main/smux.c; Revision: 1.21; Date: 2006/12/14 14:20:36; Author: nbk; Lines: (+3 -4) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/udpfromto.c Revisions: 1.9 Authors: nbk (+4 -4) ------------------------------- File: radiusd/src/main/smux.c Revisions: 1.21 Authors: nbk (+3 -4) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Latest cvs debian build with udpfromto and smux
by Joe Maimon 14 Dec '06

14 Dec '06

During linking udpfromto and smux were unresolved I brute forced it by placing a #define WITH_xxx 1 at the top of the source file. Apparently those two arent defined to 1 in autconf.h Is this something specific to me?

3 2

Automatic report from sources (radiusd) between 13.12.2006 - 14.12.2006 GMT
by Automatic cvs log generator 14 Dec '06

14 Dec '06

CVS log entries from 13.12.2006 (Wed) 09:00:01 - 14.12.2006 (Thu) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/doc/DIFFS; Revisions: 1.5 ===================================================== Log entries ===================================================== Description: Fix list address Modified files: File: radiusd/doc/DIFFS; Revision: 1.5; Date: 2006/12/13 13:33:34; Author: pnixon; Lines: (+1 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/doc/DIFFS Revisions: 1.5 Authors: pnixon (+1 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0