- Freeradius-Devel - lists.freeradius.org

Two requests shortly after each other
by Alexander Schrab 27 Nov '06

27 Nov '06

Hi, Is this some sort of anti-DoS-feature? I send one request with a username/password pair and get a sucessfull reply. Then I send another with different username/password directly after the first one. This request should result in a different reply, but I get a duplicate of the old reply: --------------------------------- radius_xlat: 'User' Sending Access-Accept of id 144 to 10.92.163.211 port 3079 Reply-Message = "User" Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.92.163.211:3079, id=144, length=53 Sending duplicate reply to client localhost:3079 - ID: 144 Re-sending Access-Accept of id 144 to 10.92.163.211 port 3079 Waking up in 6 seconds... --------------------------------- /Alex

1 0

Automatic report from sources (radiusd) between 26.11.2006 - 27.11.2006 GMT
by Automatic cvs log generator 27 Nov '06

27 Nov '06

CVS log entries from 26.11.2006 (Sun) 09:00:01 - 27.11.2006 (Mon) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/share/dictionary.erx; Revisions: 1.16, 1.9.4.5 File: radiusd/share/dictionary.sofaware; Revisions: 1.2, 1.1, 1.1.2.1 File: radiusd/src/lib/valuepair.c; Revisions: 1.82.2.1.2.4 File: radiusd/share/dictionary.usr; Revisions: 1.19, 1.9.2.1.2.2 File: radiusd/share/dictionary; Revisions: 1.93.2.5.2.7 File: radiusd/src/lib/dict.c; Revisions: 1.50.2.4.2.13 ===================================================== Combined list of identical log entries ===================================================== Description: pull fixes from branch_1_1 Modified files: File: radiusd/share/dictionary.erx; Revision: 1.16; Date: 2006/11/26 19:48:57; Author: aland; Lines: (+3 -3) File: radiusd/share/dictionary.usr; Revision: 1.19; Date: 2006/11/26 19:48:57; Author: aland; Lines: (+3 -3) ===================================================== Log entries ===================================================== Description: Include dictionary.sofaware Modified files: File: radiusd/share/dictionary; Revision: 1.93.2.5.2.7; Date: 2006/11/26 19:29:19; Author: aland; Lines: (+2 -1) ------------------------------- Description: Correct definitions for stats, from http://www.juniper.net/techpubs/software/erx/junose60/unisphere6-0.dct Modified files: File: radiusd/share/dictionary.erx; Revision: 1.9.4.5; Date: 2006/11/26 19:44:55; Author: aland; Lines: (+3 -3) ------------------------------- Description: From branch_1_1 Modified files: File: radiusd/share/dictionary.sofaware; Revision: 1.2; Date: 2006/11/26 18:21:42; Author: aland; Lines: (+36 -0) ------------------------------- Description: file dictionary.sofaware was initially added on branch branch_1_1. Modified files: File: radiusd/share/dictionary.sofaware; Revision: 1.1; Date: 2006/11/26 18:21:02; Author: aland; ------------------------------- Description: As posted to the list by Jacques Bourdeau Modified files: File: radiusd/share/dictionary.sofaware; Revision: 1.1.2.1; Date: 2006/11/26 18:21:02; Author: aland; Lines: (+36 -0) ------------------------------- Description: ATTRIBUTEs of type STRING shouldn't have VALUEs Modified files: File: radiusd/share/dictionary.usr; Revision: 1.9.2.1.2.2; Date: 2006/11/26 19:48:10; Author: aland; Lines: (+3 -3) ------------------------------- Description: VALUEs can only be defined for 'string' and 'octets' type. The 'octets' isn't really allowed, but is there until we support BYTE and SHORT types, for dictionary.cablelabs Modified files: File: radiusd/src/lib/dict.c; Revision: 1.50.2.4.2.13; Date: 2006/11/26 19:50:14; Author: aland; Lines: (+13 -2) ------------------------------- Description: Parse a VALUE as an integer only if ALL of its characters are decimal digits Modified files: File: radiusd/src/lib/valuepair.c; Revision: 1.82.2.1.2.4; Date: 2006/11/26 19:54:00; Author: aland; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/share/dictionary Revisions: 1.93.2.5.2.7 Authors: aland (+2 -1) ------------------------------- File: radiusd/share/dictionary.erx Revisions: 1.16, 1.9.4.5 Authors: aland (+3 -3), aland (+3 -3) ------------------------------- File: radiusd/share/dictionary.sofaware Revisions: 1.2, 1.1, 1.1.2.1 Authors: aland (+36 -0), aland, aland (+36 -0) ------------------------------- File: radiusd/share/dictionary.usr Revisions: 1.19, 1.9.2.1.2.2 Authors: aland (+3 -3), aland (+3 -3) ------------------------------- File: radiusd/src/lib/dict.c Revisions: 1.50.2.4.2.13 Authors: aland (+13 -2) ------------------------------- File: radiusd/src/lib/valuepair.c Revisions: 1.82.2.1.2.4 Authors: aland (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

A new dictionary for FreeRadius
by Jacques Bourdeau 26 Nov '06

26 Nov '06

Hi, Next is a dictionary file for VPN-1 Edge from Sofaware (Check Point appliance). Values are : SofaWare-Admin : "none" / "readonly" / "readwrite" Users have no, read-only or read-write access to the appliance's configuration interface (Web / SSH) SofaWare-VPN : `true" / "false" User can / cannot connect the VPN SofaWare-Hotspot : "true" / "false" The account can be used for authentication on the Hotspot web page (may be required before accessing the Internet) SofaWare-UFP : "true" / "false" The user can /cannot overwrite the URL Filtering policy Tested with a VPN Edge WU Unlimited firmware 6.5.41x ; FreeRadius 1.1.3 on Solaris 10. Jacques Bourdeau # -*- text -*- # # dictionary.sofaware # # Written by Jacques Bourdeau # # Version: $Id: dictionary.sofaware,v 0.1 2006/11/24 22:16:00 # VENDOR SofaWare 6983 BEGIN-VENDOR SofaWare ATTRIBUTE SofaWare-Admin 1 string SofaWare ATTRIBUTE SofaWare-VPN 2 string SofaWare ATTRIBUTE SofaWare-Hotspot 3 string SofaWare ATTRIBUTE SofaWare-UFP 4 string SofaWare END-VENDOR SofaWare

2 1

Automatic report from sources (radiusd) between 24.11.2006 - 25.11.2006 GMT
by Automatic cvs log generator 25 Nov '06

25 Nov '06

CVS log entries from 24.11.2006 (Fri) 09:00:01 - 25.11.2006 (Sat) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/attrs; Revisions: 1.7 ===================================================== Log entries ===================================================== Description: Add MS-MPPE-*, as suggested by Stefan Winter Modified files: File: radiusd/raddb/attrs; Revision: 1.7; Date: 2006/11/24 14:54:39; Author: aland; Lines: (+4 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/attrs Revisions: 1.7 Authors: aland (+4 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 22.11.2006 - 23.11.2006 GMT
by Automatic cvs log generator 23 Nov '06

23 Nov '06

CVS log entries from 22.11.2006 (Wed) 09:00:01 - 23.11.2006 (Thu) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/raddb/attrs.access_reject; Revisions: 1.1 File: radiusd/man/man5/rlm_attr_filter.5; Revisions: 1.4 File: radiusd/src/modules/rlm_files/rlm_files.c; Revisions: 1.79 File: radiusd/raddb/radiusd.conf.in; Revisions: 1.236 File: radiusd/raddb/attrs.accounting_response; Revisions: 1.1 File: radiusd/raddb/attrs; Revisions: 1.6, 1.4.8.1.2.1 File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c; Revisions: 1.33 File: radiusd/src/main/request_process.c; Revisions: 1.17 File: radiusd/src/include/radiusd.h; Revisions: 1.211 ===================================================== Combined list of identical log entries ===================================================== Description: Added 'key' field, so that we can later get rid of the rfc_clean() function. Added a bit of a wildcard for to handle 'Vendor-Specific =* ANY' Modified files: File: radiusd/man/man5/rlm_attr_filter.5; Revision: 1.4; Date: 2006/11/22 21:44:20; Author: aland; Lines: (+22 -14) File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c; Revision: 1.33; Date: 2006/11/22 21:44:19; Author: aland; Lines: (+39 -16) ------------------------------- Description: Remove rfc_clean function Modified files: File: radiusd/src/include/radiusd.h; Revision: 1.211; Date: 2006/11/22 22:48:43; Author: aland; Lines: (+2 -3) File: radiusd/src/main/request_process.c; Revision: 1.17; Date: 2006/11/22 22:48:44; Author: aland; Lines: (+2 -77) ------------------------------- Description: Filter the contents of Access-Reject and Accounting-Response packets, to enforce RFC compliance. Modified files: File: radiusd/raddb/attrs.access_reject; Revision: 1.1; Date: 2006/11/22 21:48:35; Author: aland; File: radiusd/raddb/attrs.accounting_response; Revision: 1.1; Date: 2006/11/22 21:48:35; Author: aland; File: radiusd/raddb/radiusd.conf.in; Revision: 1.236; Date: 2006/11/22 21:48:35; Author: aland; Lines: (+28 -8) ===================================================== Log entries ===================================================== Description: Pull fix from branch_1_1, so proxied EAP replies work Modified files: File: radiusd/raddb/attrs; Revision: 1.6; Date: 2006/11/22 17:00:34; Author: aland; Lines: (+3 -1) ------------------------------- Description: Permit EAP-Message and State from the home server, so that EAP works. Bug noted by Stefan Winter Modified files: File: radiusd/raddb/attrs; Revision: 1.4.8.1.2.1; Date: 2006/11/22 17:00:01; Author: aland; Lines: (+3 -1) ------------------------------- Description: Move buffer to enclosing block, so we don't point to a buffer on the stack which may be invalid Modified files: File: radiusd/src/modules/rlm_files/rlm_files.c; Revision: 1.79; Date: 2006/11/22 21:37:12; Author: aland; Lines: (+3 -3) ===================================================== Summary of modified files ===================================================== File: radiusd/man/man5/rlm_attr_filter.5 Revisions: 1.4 Authors: aland (+22 -14) ------------------------------- File: radiusd/raddb/attrs Revisions: 1.6, 1.4.8.1.2.1 Authors: aland (+3 -1), aland (+3 -1) ------------------------------- File: radiusd/raddb/attrs.access_reject Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/raddb/attrs.accounting_response Revisions: 1.1 Authors: aland ------------------------------- File: radiusd/raddb/radiusd.conf.in Revisions: 1.236 Authors: aland (+28 -8) ------------------------------- File: radiusd/src/include/radiusd.h Revisions: 1.211 Authors: aland (+2 -3) ------------------------------- File: radiusd/src/main/request_process.c Revisions: 1.17 Authors: aland (+2 -77) ------------------------------- File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c Revisions: 1.33 Authors: aland (+39 -16) ------------------------------- File: radiusd/src/modules/rlm_files/rlm_files.c Revisions: 1.79 Authors: aland (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

huntgroups question
by Alexandru Dincov 21 Nov '06

21 Nov '06

Hello, We plan to use freeradius for authenticating remote access to more than 2000 network devices (CISCO, Nortel, etc.) and we want to do some access control based on huntgroups. Users and RADIUS profiles are stored in an LDAP backend. Following freeradius documentation, we have to define all 2000+ IP addresses in huntgroups configuration file, apparently there is no way to use IP ranges for defining huntgroups. But this solution (having one huntgroups configuration file with more than 2000 entries for each freeradius server) would be very difficult to maintain. Anyone knows if there are any limitations in huntgroups size? Are there other solutions to have huntgroups functionality (access control based on NAS-IP-Address or Client-IP-Address) using IP address ranges? Thanks, Alex

6 6

Automatic report from sources (radiusd) between 20.11.2006 - 21.11.2006 GMT
by Automatic cvs log generator 21 Nov '06

21 Nov '06

CVS log entries from 20.11.2006 (Mon) 09:00:01 - 21.11.2006 (Tue) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/doc/rlm_sim_triplets; Revisions: 1.4, 1.3.4.1 ===================================================== Combined list of identical log entries ===================================================== Description: Update the types that were mistakenly inversed. (closes: #401) Thanks to Andrea Scharfe <schmedi(a)gmail.com> Modified files: File: radiusd/doc/rlm_sim_triplets; Revision: 1.4; Date: 2006/11/20 13:44:46; Author: nbk; Lines: (+3 -3) File: radiusd/doc/rlm_sim_triplets; Revision: 1.3.4.1; Date: 2006/11/20 13:45:25; Author: nbk; Lines: (+3 -3) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/doc/rlm_sim_triplets Revisions: 1.4, 1.3.4.1 Authors: nbk (+3 -3), nbk (+3 -3) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

rad_tunnel_pwencode - Constraint on the length of Plain Text Password.
by Mahesh Nayak 20 Nov '06

20 Nov '06

Hello, I see that we have the following check in the "rad_tunnel_pwencode(..) ". if (len > 127) len = 127; This means that we dont support encryption/decoding of password of length >127 ? Curious to know the the primary reason behind this check.. since I was in dire need of using the Radius for plaintext length > 127. Thank you in anticipation, Mahesh.

2 1

Automatic report from sources (radiusd) between 19.11.2006 - 20.11.2006 GMT
by Automatic cvs log generator 20 Nov '06

20 Nov '06

CVS log entries from 19.11.2006 (Sun) 09:00:03 - 20.11.2006 (Mon) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/debian/freeradius.init; Revisions: 1.1.2.3.2.3 File: radiusd/redhat/freeradius.spec; Revisions: 1.19.2.5.2.9 ===================================================== Log entries ===================================================== Description: Pull from CVS head: Patch to allow /var/run to be a tmpfs. Modified files: File: radiusd/debian/freeradius.init; Revision: 1.1.2.3.2.3; Date: 2006/11/19 18:46:31; Author: nbk; Lines: (+14 -2) ------------------------------- Description: Update for 1.1.4 Modified files: File: radiusd/redhat/freeradius.spec; Revision: 1.19.2.5.2.9; Date: 2006/11/19 18:25:40; Author: nbk; Lines: (+9 -8) ===================================================== Summary of modified files ===================================================== File: radiusd/debian/freeradius.init Revisions: 1.1.2.3.2.3 Authors: nbk (+14 -2) ------------------------------- File: radiusd/redhat/freeradius.spec Revisions: 1.19.2.5.2.9 Authors: nbk (+9 -8) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Testing...
by Alan DeKok 19 Nov '06

19 Nov '06

Let's see if I pass. :) Alan DeKok.

1 0