- Freeradius-Devel - lists.freeradius.org

Re: dialup admin & ippool administraton
by Guy Fraser 05 Apr '06

05 Apr '06

On Fri, 2006-31-03 at 10:37 +0200, Olaf Schäfer wrote: > > > > > > But the configuration information like "range-start" etc. is still > > > stored in the radiusd.conf. My idea was to put these configuration > > > information for each ippool into the mysql-db. > > > > That may be harder to do. But if you can create a patch, it will be > > welcome. > > I'm afraid this exceeds my abilities :( > > Thus I resigned to the fact and have started to parse the radiusd.conf > via PHP. > I have written a recursive function for reading radiusd.conf and all included files. I finally spent some time and built a simple site to host the current files for the FreeRadius Admin stuff I am working on. You can check it out at : http://sphinx.incentre.net/radius.html -- Guy Fraser Network Administrator The Internet Centre 1-888-450-6787 (780)450-6787

1 0

Couldn't stop Freeradius server on Debian!!
by lmyho 05 Apr '06

05 Apr '06

Dear All, I installed freeradius 1.1.0-1 on a debian system (2.6.15-1-686, etch) 2 days ago, via "aptitude install". The radius server started well automatically and each time when the system booting. But when I wanted to stop it for some test on my modified configuration files, I got trouble to stop the server! I tried to stop the server using command: 'freeradius stop' ('radiusd' command doesn't work on this debian system - anyone knows why this behavior??) But so werid, no matter what command I gave, with parameter stop|start|restart or even just a question mark(?), the server ALWAYS goes to START again!! even though from the /etc/init.d/freeradius I can read that the 'stop' param should stop the server! Can anyone tell me why the command doesn't stop the server and how should I stop it from command line?? The log file shows entries like this for each of my trying, even the command given was to "stop" it: Tue Apr 4 01:14:13 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Apr 4 01:14:13 2006 : Error: There appears to be another RADIUS server running on the authenticat What is happenning here? Also, from the log file I noticed: for each system automatically started freeradius server deamon, it is "Using deprecated naslist file"! The log entries show like this: Fri Mar 31 13:51:54 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Mar 31 13:51:54 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Mar 31 13:51:55 2006 : Info: Ready to process requests. Can anyone tell me what is happenning here? Why it keeps using the deprecating naslist file? But the installed radiusd.conf file doesn't show the server will use the naslist file at all! How can I stop the server to use this deprecating file? Also what does the 2nd line of the above log entries mean? Any help would be greatly appreciated! I am very much obliged for any of your help!! Thanks a lot!! Best regrads, leo __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 8

Automatic report from sources (radiusd) between 04.04.2006 - 05.04.2006 GMT
by Automatic cvs log generator 05 Apr '06

05 Apr '06

CVS log entries from 04.04.2006 (Tue) 08:00:01 - 05.04.2006 (Wed) 08:00:01 GMT ===================================================== Summary by authors ===================================================== Author: bjordanov File: radiusd/src/modules/rlm_perl/rlm_perl.c; Revisions: 1.34, 1.13.4.6 Author: nbk File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revisions: 1.29 ===================================================== Log entries ===================================================== Description: Previous patch put a closing bracket at the wrong place. Modified files: File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c; Revision: 1.29; Date: 2006/04/04 15:13:41; Author: nbk; Lines: (+2 -2) ------------------------------- Description: Added additional fix for #348 - each instance will have its own interp and this way shall avoid problems with multiple instances when destructing perl interp. Modified files: File: radiusd/src/modules/rlm_perl/rlm_perl.c; Revision: 1.34; Date: 2006/04/04 14:27:25; Author: bjordanov; Lines: (+10 -11) ------------------------------- Description: Added additional fix for #348 - each instance will have its own interp and this way shall avoid problems with multiple instances when destructing perl interp. Modified files: File: radiusd/src/modules/rlm_perl/rlm_perl.c; Revision: 1.13.4.6; Date: 2006/04/04 14:16:57; Author: bjordanov; Lines: (+11 -12) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c Revisions: 1.29 Authors: nbk (+2 -2) ------------------------------- File: radiusd/src/modules/rlm_perl/rlm_perl.c Revisions: 1.34, 1.13.4.6 Authors: bjordanov (+10 -11), bjordanov (+11 -12) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

RE: detail logs User-Password
by Ryan Melendez 04 Apr '06

04 Apr '06

> > My suggestion however is to have > > something a > > little more generic like the following > > > > detail auth_log { > > detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail- > > %Y%m%d.txt > > detailperm = 0600 > > detailstrip = User-Password > > detailstrip = 3GPP-IMSI > > detailstrip = Other-Random-Attribute > > } > > > > This easily lets people strip out whatever attributes they want, > > not only > > passwords. > > Throwing in my $0.02 USD, I think that Peter's approach is the best > method. > > There is a need, and this addresses backwards and forwards > compatibility. I'm > against hardcoding the Attribute name in the code. I've successfully implemented the "log_pass = yes/no" method. This patch compares with PW_PASSWORD. I agree Peter's approach is more scalable, but I'm not confident I know how to responsibly handle x number of config options. Is there another module that accepts an unknown number of config options I can take a peek at? Thanks, Ryan

2 1

multiple ldap modules and same nas ip
by Angelica Delgado 04 Apr '06

04 Apr '06

Hello, It is possible to have multiple ldap modules for the same nas ip in user file? Thanks. Angelica

2 1

RE: detail logs User-Password
by Ryan Melendez 04 Apr '06

04 Apr '06

> Personally, I don't see a lot of value in it. But if the patch is > simple & the config is easy, I have no objections to it going in. If someone would rather send plain text over the wire rather than storing plain text passwords, logging the password gives up the main advantage for many in using PAP over CHAP. > Question: are there *other* attributes which should be suppressed? > If so, the configuration should take a list of attributes to censor, > rather than just "logpass=yes/no" I don't know of any others, but suggestions are welcome. I'm going to go the single-line-option route unless someone chimes in. Thanks, Ryan

3 2

module programming
by Mingyur Koblensky 04 Apr '06

04 Apr '06

Hi, i would like to develop an authentication method based on EAP... I've look around a bit but didn't find nothing, is there any ? should i write here my doubts ? thank you, kky

2 3

detail logs User-Password
by Ryan Melendez 04 Apr '06

04 Apr '06

Hello, I've seen a couple of email in the list discussing the fact that User-Password is logged by the detail module. I have to change this behavior, but hope to get the change in future releases so I wanted to know where you guys stand. (so I don't have to patch) I plan on adding a config option for the detail module: logpass = yes/no In rlm_detail have the a/v pair associated with PW_PASSWORD skipped if logpass is set to no. Alternatively, output this line to the log: User-Password = <censored> Personally, I think any password attribute should not be logged, but there might be some history/backwards compatibility I'm unaware of. I welcome any comments or suggestions. Thanks, Ryan

2 1

multiple lap modules
by Angelica Delgado 01 Apr '06

01 Apr '06

Hello all, I am trying to setup cisco webvpn with ldap and I want to configure a ldap module for each vpn. The problem is that I get the same NAS ip from all the vpns. I enabled Calling-Station Id and NAS-Port attribute at the webvpn module but freeradius does not display it on its logs. If there is something I need to enable on the system in order to receive NAS-PORT and Calling-Station on the radius packet. Thanks in advance, Angelica

2 3

Re: v1.1.1 build problems (SSL, EAP)
by Alan DeKok 31 Mar '06

31 Mar '06

Nicolas Baradakis <nbk(a)sitadelle.com> wrote... (moved to -devel) > It's a bug: in version 1.1.1 "configure" in rlm_eap_peap uses a > different autoconf test than "configure" in top level directory. ... > It's a different bug: we should add the user defined directory > to LDFLAGS instead of LIBS. Are these fixed? I noticed there are no daily cvs log emails any more, so I'm not sure what's going on... Alan DeKok.

3 2