- Freeradius-Devel - lists.freeradius.org

ntpasswd not UTF-8 safe?
by Josh Howlett 25 Jul '06

25 Jul '06

I don't think that the ntpasswd function in smbencrypt.c is safe with multi-byte character encodings, such as UTF-8. I think that the problem is in the conversion of the password to Unicode, for the construction of the NT hash. The function assumes a single-byte character-set encoding (which works fine for Latin1, etc) but not for multi-byte encodings such as UTF-8. I'm not quite sure what the best approach to fix this is; does anyone have any suggestions? best regards, josh. Josh Howlett, Networking Specialist, University of Bristol. email: josh.howlett(a)bristol.ac.uk | phone: +44 (0)7867 907076 | internal: 7850

3 6

Automatic report from sources (radiusd) between 24.07.2006 - 25.07.2006 GMT
by Automatic cvs log generator 25 Jul '06

25 Jul '06

CVS log entries from 24.07.2006 (Mon) 08:00:04 - 25.07.2006 (Tue) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: aland File: radiusd/src/lib/radius.c; Revisions: 1.185, 1.184 ===================================================== Log entries ===================================================== Description: More checks for diameter length Modified files: File: radiusd/src/lib/radius.c; Revision: 1.185; Date: 2006/07/24 23:08:44; Author: aland; Lines: (+8 -6) ------------------------------- Description: Decode multiple Diameter attributes from inside one or more Extended-Attributes. It's inefficient (i.e. copying data to yet another buffer on the stack), but it works, and handles pretty much anything we can throw at it. Modified files: File: radiusd/src/lib/radius.c; Revision: 1.184; Date: 2006/07/24 21:53:08; Author: aland; Lines: (+204 -78) ===================================================== Summary of modified files ===================================================== File: radiusd/src/lib/radius.c Revisions: 1.185, 1.184 Authors: aland (+8 -6), aland (+204 -78) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Testing...
by Alan DeKok 24 Jul '06

24 Jul '06

Quiet list.. Alan DeKok.

4 5

build error
by Peter Nixon 21 Jul '06

21 Jul '06

Hi Guys When I build on the openSUSE Build Service I get the following errors scattered throughout the build (On all SUSE versions) but the build continues, but doesnt make anu .so files. /usr/src/packages/BUILD/freeradius-1.1.2/libtool --mode=link gcc -release 1.1.2 \ -module -export-dynamic -o rlm_eap_tls.la \ -rpath /usr/lib/freeradius rlm_eap_tls.lo rlm_eap_tls.c /usr/src/packages/BUILD/freeradius-1.1.2/src/lib/libradius.la \ ../../libeap/libeap.la -lcrypto -lssl -lcrypto -lnsl -lresolv -lpthread rm -fr .libs/rlm_eap_tls.la .libs/rlm_eap_tls.* .libs/rlm_eap_tls-1.1.2.* *** Warning: This library needs some functionality provided by -lcrypto. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lssl. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lcrypto. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lnsl. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lresolv. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: This library needs some functionality provided by -lpthread. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: libtool could not satisfy all declared inter-library *** dependencies of module rlm_eap_tls. Therefore, libtool will create *** a static module, that should work as long as the dlopening *** application is linked with the -dlopen flag. ar cru .libs/rlm_eap_tls.a rlm_eap_tls.o ranlib .libs/rlm_eap_tls.a When I build locally I dont get the same errors so, does anyone know what dependency I am missing on the build service? I currently specify (plus base system): BuildRequires: cyrus-sasl-devel BuildRequires: db-devel BuildRequires: e2fsprogs-devel BuildRequires: gcc-c++ BuildRequires: gdbm-devel BuildRequires: gettext-devel BuildRequires: glibc-devel BuildRequires: libtool BuildRequires: mysql-devel BuildRequires: ncurses-devel BuildRequires: openldap2-devel BuildRequires: openssl-devel BuildRequires: pam-devel BuildRequires: perl BuildRequires: postgresql-devel BuildRequires: python-devel BuildRequires: sed BuildRequires: unixODBC-devel BuildRequires: zlib-devel TIA -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

Session-Timeout & h323-credit-time Difference
by Akhnukh 20 Jul '06

20 Jul '06

Hi, Please anyone tell me exact difference between Session-Timeout attribute and VSA credit-time attribute. According to RFC both definitions looks same. Please specify difference. Thanks -- View this message in context: http://www.nabble.com/Session-Timeout---h323-credit-time-Difference-tf19718… Sent from the FreeRadius - Dev forum at Nabble.com.

2 1

rlm_ippool and tcp TIME_WAIT state
by Sebastien Cantos 19 Jul '06

19 Jul '06

Hi, I've already posted this to the user's mailing list, but I think that here is a best place for this. I've noticed that rlm_ippool is nearly always reassigning an IP address that has just been releasing for a new connexion. This causes some TCP connexion problems because of the TIME_WAIT state. Scenario: 1/ one device connects using source port 1024 (ppp) and gets an IP address from freeradius 2/ this device disconnects, the ip is freed from the pool 3/ another devices connects using source port 1024 and gets the same ip address as before 4/ the connexion is impossible to the server because the connexion of last device is still in TIME_WAIT state How can I make sure an IP address is not assigned before some time period (240 seconds, time period of the TIME_WAIT state) after being released? I got one answer : >Interesting. >The IPs are allocated by a GDBM walk of the database, and use of the first free or expired IP. This will always tend to be the same one hence the repeat >allocations. >It would in theory be possible to save the key from the last walk, and next time we allocate an IP start from that key and wrap back around, which would >allocate IPs in a more round-robin fashion. I would appreciate if someone can help doing the hack or give me some hints to modify rlm_ippool.c to add some retention time parameter to make sure an ip is not reassigned instantly after being freed or to make things work more in a random or round robin way. Thanks in advance. Regards, Sebastien.

2 1

RE: Last set of changes for 1.1.3
by Sandworm 15 Jul '06

15 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Are there any other issues we need to fix before 1.1.3? RPM spec > file fixes? The RPM Spec fixes that have been discussed on the list several times (unpackaged files, etc) could be added. Diff from previous messages attached for your reference. $ diff -u /usr/src/redhat/SPECS/freeradius.spec freeradius.spec.orig - - - --- /usr/src/redhat/SPECS/freeradius.spec 2006-04-09 18:26:53.000000000 +1000 +++ freeradius.spec.orig 2006-02-13 02:54:56.000000000 +1100 @@ -23,8 +23,6 @@ %prep %setup - - - -sed -i "s@doc/freeradius@doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile - - - - %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --prefix=%{_prefix} \ @@ -101,14 +99,7 @@ %files %defattr(-,root,root) - - - -%doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX - - - -%doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema - - - -%doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend - - - -%doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover - - - -%doc doc/duplicate-users doc/ldap_howto.txt doc/load- balance.txt doc/misc-nas - - - -%doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file - - - -%doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt - - - -%doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL +%doc doc/ChangeLog doc/README* todo/ COPYRIGHT INSTALL %config /etc/pam.d/radius %config /etc/logrotate.d/radiusd %config /etc/rc.d/init.d/radiusd -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkStm1MACgkQmw4BJyaatJ2+7wCgrgRxv/4ieXR/0/rsTNNaBzNO67gA n2H07LeL1kKwvr8TKlU5d/H2moc2 =CArD -----END PGP SIGNATURE-----

4 3

Problem with change of shared secret
by Vishwanath Srikant Pattanshetti 14 Jul '06

14 Jul '06

All I am using FreeRADIUS 1.1.0 with Oracle 10. Am storing the clients data in database table 'nas' When I change the shared secret entry in this table the RADIUS server which is Already running does not seem to pick this change, and I get an error saying invalid Authenticator - however this problem does not occur if I restart the RADIUS server. Is there a way I can make the RADIUS server pick up changes to the 'nas' table dynamically? Any help would be a great help. -vishwa.

1 0

Re: Last set of changes for 1.1.3
by Sandworm 14 Jul '06

14 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > > "Sandworm" <sandworm(a)mepd.hush.com> wrote: > > The RPM Spec fixes that have been discussed on the list several > > times (unpackaged files, etc) could be added. Diff from previous > > messages attached for your reference. > > > > $ diff -u /usr/src/redhat/SPECS/freeradius.spec > > That looks like Redhat's spec file, not the one we ship with the > server. Please file a bug with Redhat, asking them to update their > spec file. > > If there are problems with redhat/freeradius.spec, please discuss > those here. > > Alan DeKok. > - Alan This is definitely not Redhat's spec file - it is the spec file from the FR tarball ie. redhat/freeradius.spec. This will be a bit long, but see the whole file listed below (including the changes I showed as a diff in my previous post): Summary: High-performance and highly configurable RADIUS server URL: http://www.freeradius.org/ Name: freeradius Version: 1.1.1 Release: 0 License: GPL Group: Networking/Daemons Packager: FreeRADIUS.org Source0: %{name}-%{version}.tar.gz Prereq: /sbin/chkconfig BuildPreReq: libtool # FIXME: snmpwalk, snmpget and rusers POSSIBLY needed by checkrad Provides: radiusd Conflicts: cistron-radius BuildRoot: %{_tmppath}/%{name}-root %description The FreeRADIUS Server Project is a high-performance and highly configurable GPL'd RADIUS server. It is somewhat similar to the Livingston 2.0 RADIUS server, but has many more features, and is much more configurable. %prep %setup sed -i "s@doc/freeradius@doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --prefix=%{_prefix} \ --localstatedir=%{_localstatedir} \ --sysconfdir=%{_sysconfdir} \ --mandir=%{_mandir} \ --with-system-libtool \ --disable-ltdl-install \ --with-ltdl-lib=/usr/lib \ --with-ltdl-include=/usr/include \ --with-gnu-ld \ --with-large-files --with-udpfromto --with-edir \ --with-rlm-sql_postgresql-include-dir=/usr/include/pgsql \ --with-rlm-krb5-include-dir=/usr/kerberos/include \ --with-rlm-krb5-lib-dir=/usr/kerberos/lib make %install [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d,rc.d/init.d} make install R=$RPM_BUILD_ROOT RADDB=$RPM_BUILD_ROOT/etc/raddb # set radiusd as default user/group perl -i -pe 's/^#user =.*$/user = radiusd/' $RADDB/radiusd.conf perl -i -pe 's/^#group =.*$/group = radiusd/' $RADDB/radiusd.conf # shadow password file MUST be defined on Linux perl -i -pe 's/# shadow =/shadow =/' $RADDB/radiusd.conf # remove unneeded stuff rm -f $RPM_BUILD_ROOT%{_mandir}/man8/builddbm.8 rm -f $RPM_BUILD_ROOT%{_prefix}/sbin/rc.radiusd cd redhat install -m 755 rc.radiusd-redhat $RPM_BUILD_ROOT/etc/rc.d/init.d/radiusd install -m 644 radiusd-logrotate $RPM_BUILD_ROOT/etc/logrotate.d/radiusd install -m 644 radiusd-pam $RPM_BUILD_ROOT/etc/pam.d/radius cd .. %pre /usr/sbin/useradd -c "radiusd user" -r -s /bin/false -u 95 -d / radiusd 2>/dev/null || : %preun if [ "$1" = "0" ]; then /sbin/service radiusd stop > /dev/null 2>&1 /sbin/chkconfig --del radiusd fi %post /sbin/ldconfig /sbin/chkconfig --add radiusd # Done here to avoid messing up existing installations for i in radius/radutmp radius/radwtmp radius/radius.log # radius/radwatch.log radius/checkrad.log do touch /var/log/$i chown radiusd:radiusd /var/log/$i chmod 600 /var/log/$i done %postun if [ "$1" -ge "1" ]; then /sbin/service radiusd condrestart >/dev/null 2>&1 fi if [ $1 = 0 ]; then /usr/sbin/userdel radiusd > /dev/null 2>&1 || : fi /sbin/ldconfig %clean [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root) %doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX %doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema %doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend %doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover %doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas %doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file %doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt %doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL %config /etc/pam.d/radius %config /etc/logrotate.d/radiusd %config /etc/rc.d/init.d/radiusd %config (noreplace) /etc/raddb/* %{_bindir}/* %{_datadir}/%{name} %{_libdir}/* %{_mandir}/*/* %{_sbindir}/* %attr(0700,radiusd,radiusd) %dir /var/log/radius %attr(0700,radiusd,radiusd) %dir /var/log/radius/radacct %attr(0700,radiusd,radiusd) %dir /var/run/radiusd %changelog * Thu Dec 15 2004 Alan DeKok - - - update for 1.1.0 * Mon May 31 2004 Paul Hampson - - - update for 1.0.0 release * Fri May 23 2003 Marko Myllynen - - - update for 0.9 * Wed Sep 4 2002 Marko Myllynen - - - fix libtool issues for good * Thu Aug 22 2002 Marko Myllynen - - - update for 0.7/0.8 * Tue Jun 18 2002 Marko Myllynen - - - run as radiusd user instead of root - - - added some options for configure * Thu Jun 6 2002 Marko Myllynen - - - set noreplace for non-dictionary files in /etc/raddb * Sun May 26 2002 Frank Cusack <frank(a)google.com> - - - move /var dirs from %%post to %%files * Thu Feb 14 2002 Marko Myllynen - - - use dir name macros in all configure options - - - libtool is required only when building the package - - - misc clean ups * Wed Feb 13 2002 Marko Myllynen - - - use %%{_mandir} instead of /usr/man - - - rename %%postin as %%post - - - clean up name/version * Fri Jan 18 2002 Frank Cusack <frank(a)google.com> - - - remove (noreplace) for /etc/raddb/* (due to rpm bugs) * Fri Sep 07 2001 Ivan F. Martinez <ivanfm(a)ecodigit.com.br> - - - changes to make compatible with default config file shipped - - - adjusts log files are on /var/log/radius instead of /var/log - - - /etc/raddb changed to config(noreplace) to don't override - - - user configs * Fri Sep 22 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - - - spec file clear accordling to the libltdl fix and minor updates * Wed Sep 12 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - - - Updated to snapshot-12-Sep-00 * Fri Jun 16 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - - - Initial release -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkS2+hsACgkQmw4BJyaatJ1Z3QCgrVAgFL1Pku5QGw+Xtzfb2DLsB20A n25ttFsUO06KtVysqIjF0gnQzZFD =Wr4i -----END PGP SIGNATURE-----

1 0

rlm_attr_filter
by Josip Almasi 13 Jul '06

13 Jul '06

Hi, I need to remove some attributes from the reply(*). Attr_filter does that only for proxy responses. So I wrote it: I added another parameter to attr_filter config, filterlocal, defaults to 'no'. Once you set it to 'yes' it filters locally originated attributes too. I did it in 1.0.1 source cuz it comes with redhat. So, how do I contribute? *) Yes nonsense you might say, just don't put these attribs to your config and you won't need to remove them, right?:) But I use Caller-Station-Id (and others) to perform db lookups and in the process I change its value. For both proxied and local realms. In two-stage auth (proxy.conf:post_proxy_authorize=yes). Regards...

2 2