- Freeradius-Devel - lists.freeradius.org

Automatic report from sources (radiusd) between 14.10.2006 - 15.10.2006 GMT
by Automatic cvs log generator 15 Oct '06

15 Oct '06

CVS log entries from 14.10.2006 (Sat) 08:00:04 - 15.10.2006 (Sun) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/raddb/sql.conf; Revisions: 1.57 ===================================================== Log entries ===================================================== Description: Further cleanup of the config file Modified files: File: radiusd/raddb/sql.conf; Revision: 1.57; Date: 2006/10/14 16:02:53; Author: pnixon; Lines: (+35 -31) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/sql.conf Revisions: 1.57 Authors: pnixon (+35 -31) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

help
by Bolivar Soriano 14 Oct '06

14 Oct '06

I have the freeradius working just fine; it's saving the record in a text file, but I want to send the record to a mssql table; I already create the table in the DB required, but every time when I take out the comment from sql command I got an error. Can send me an step by step help or, an example of the two o three files that I have to modify. Thx Bolivar Soriano

3 4

IGNORE: nologin on 7.x
by Mike 14 Oct '06

14 Oct '06

Sorry all, last message was intended for a different mailing list, please disregard.

1 0

nologin on 7.x
by Mike 14 Oct '06

14 Oct '06

Can whoever has access to a freshly installed 7.0 box tell me what is going on with the "nologin" shell? Is it not present by default? If it is, does it exist in /sbin or in /usr/sbin? Is it included in /etc/shells by default?

1 0

RE: Capturing ntlm_auth failure reasons in rlm_mschap
by Garber, Neal 13 Oct '06

13 Oct '06

> Please submit the patch on the bugs.freeradius.org site... The rlm_mschap patch is bug 398. I'll post the SSL patch shortly. Thanks Alan.

1 0

Capturing ntlm_auth failure reasons in rlm_mschap
by Garber, Neal 13 Oct '06

13 Oct '06

I would like ntlm_auth failure reasons more visible so our help desk can assist users who are having trouble authenticating. Currently, rlm_ldap creates a request attribute called "Module-Failure-Message" on some types of errors (e.g., user not found). I created a small patch for rlm_mschap that creates the same request attribute with the output from ntlm_auth if authentication fails. (Before someone asks how this lets our help desk see the information, I have written a post-auth perl script that captures this and other attributes and writes them to a custom log file. Our help desk then uses a viewer utility I wrote to search/display the logs.) I have a similar desire to capture SSL negotiation failure reasons in our logs. I have created another patch to capture these failures as well although it is currently against FR 1.1.2. If there's interest, I can integrate this change to CVS head and submit it as well. Below is the rlm_mschap patch for your review and comment. This was made against the CVS head I checked out on Oct. 12. Thanks for your time and consideration. --- src/modules/rlm_mschap/rlm_mschap.c.orig Tue Oct 3 17:46:50 2006 +++ src/modules/rlm_mschap/rlm_mschap.c Thu Oct 12 15:32:04 2006 @@ -786,6 +786,9 @@ } else { /* run ntlm_auth */ int result; char buffer[256]; + VALUE_PAIR *module_fmsg_vp; + char module_fmsg[MAX_STRING_LEN]; + int module_fmsg_lastchr = 0; memset(nthashhash, 0, 16); @@ -798,6 +801,13 @@ NULL, NULL, 1); if (result != 0) { DEBUG2(" rlm_mschap: External script failed."); + snprintf(module_fmsg, sizeof(module_fmsg), "rlm_mschap: %s", buffer); + module_fmsg_lastchr = strlen(module_fmsg)-1; + if (module_fmsg[module_fmsg_lastchr] = '\n') { + module_fmsg[module_fmsg_lastchr] = '\0'; + } + module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ); + pairadd(&request->packet->vps, module_fmsg_vp); return -1; }

2 1

RE: Capturing ntlm_auth failure reasons in rlm_mschap
by Garber, Neal 13 Oct '06

13 Oct '06

Oops! I pasted the wrong version of the patch in my previous msg. Please ignore the previous as it had a typo in the if stmt. comparing for a newline.. --- src/modules/rlm_mschap/rlm_mschap.c.orig Tue Oct 3 17:46:50 2006 +++ src/modules/rlm_mschap/rlm_mschap.c Thu Oct 12 15:36:04 2006 @@ -786,6 +786,9 @@ } else { /* run ntlm_auth */ int result; char buffer[256]; + VALUE_PAIR *module_fmsg_vp; + char module_fmsg[MAX_STRING_LEN]; + int module_fmsg_lastchr = 0; memset(nthashhash, 0, 16); @@ -798,6 +801,13 @@ NULL, NULL, 1); if (result != 0) { DEBUG2(" rlm_mschap: External script failed."); + snprintf(module_fmsg, sizeof(module_fmsg), "rlm_mschap: %s", buffer); + module_fmsg_lastchr = strlen(module_fmsg)-1; + if (module_fmsg[module_fmsg_lastchr] == '\n') { + module_fmsg[module_fmsg_lastchr] = '\0'; + } + module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ); + pairadd(&request->packet->vps, module_fmsg_vp); return -1; }

1 0

help
by Bolivar Soriano 13 Oct '06

13 Oct '06

Do you have an step by step how to setup Freeradius software to send the log record to mssql server Thx Bolivar Soriano

2 1

Radiusd-radrelayd config file naming
by Peter Nixon 11 Oct '06

11 Oct '06

Hi Guys The attached 2 line patch makes radiusd load the config file matching the name that it is called with making the -n option unnecessary in many cases. This makes things simpler and makes "startproc" and family much simpler to use with radiusd. Example use: symlink radiusd to radrelay and then run radrelay and it will autoload radrelay.conf The -n command line option still overrides config file so everyone should be happy. If no-one has any complaints I plan to apply this to cvs head. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

6 10

Not restricting access to indicated huntgroup-name
by Jenny Ngo Gui 11 Oct '06

11 Oct '06

I don't know why, but for some reason, when the eap.tls.cn_check option in rad.conf is set to 0 (off), it could not restrict the access of users as stated in the users and huntgroups file. Despite the fact that certain users are set such that it would only be able to connect through one specific AP (Huntgroup-name = "Buffalo", as opposed to the other one having Huntgroup-name = "Cisco"), it seems to bypass this restriction when the eap.tls.cn_check option is turned off.. I'm not sure if this is a problem with freeradius, so I hope someone could shed some light on this matter.. Thanks

1 0