- Freeradius-Devel - lists.freeradius.org

PATCH: lib install bug
by Curtis Doty 06 Mar '06

06 Mar '06

Minor bug in HEAD whereby libs don't get installed properly when using a test prefix that needs to create libdir. ../C Index: Makefile =================================================================== RCS file: /source/radiusd/src/lib/Makefile,v retrieving revision 1.28 diff -u -r1.28 Makefile --- Makefile 22 Jan 2006 21:46:35 -0000 1.28 +++ Makefile 6 Mar 2006 17:51:34 -0000 @@ -48,6 +48,6 @@ rm -rf .libs install: all - $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir) + $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir)/$(TARGET).la rm -f $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la; ln -s $(TARGET).la $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la

1 0

Tagged VSAs
by Chris Hellberg 06 Mar '06

06 Mar '06

Hi, I notice between 1.0.5 and 1.1.0 there was a check put in dict.c to prevent tagged VSAs from being added to the dictionary. What's the idea behind this check? Cheers, Chris -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.1.2/274 - Release Date: 3/03/2006

2 1

Special Characters in Passwords using LDAP authentication method
by Angelica Delgado 06 Mar '06

06 Mar '06

Hello all, We configured freeradius with ldap authentication. The setup is working ok. The problem is that passwords with special characters such as "$" sign are replaced by "%24". What variable that we need to change in order to allow special characters in passwords? Thanks. Angelica

1 1

eap-fast
by Herisanu Ioan 05 Mar '06

05 Mar '06

Hello to all, I am writting this email as i want to get some feedback on my thoughts on implementing eap-fast in freeRadius. At the time of writting, i am still a student in UPB, bucharest, final year. This work would be my graduation diploma. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

rlm_php
by Pezhman Lali 04 Mar '06

04 Mar '06

Hi I belive PHP has powerful features and stable core, and it's good idea to add rlm_php to freeradius's project. I want to do it, if anybody likes to help me to realize this dream, tell me. also if this project or anything similar it, was done, tell me again. Best Regards Pezhman --------------------------------- Yahoo! Mail Bring photos to life! New PhotoMail makes sharing a breeze.

2 1

Automatic report from sources (radiusd) between 03.03.2006 - 04.03.2006 GMT
by Automatic cvs log generator 04 Mar '06

04 Mar '06

CVS log entries from 03.03.2006 (Fri) 09:00:02 - 04.03.2006 (Sat) 09:00:02 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/doc/examples/postgresql.sql; Revisions: 1.2 File: radiusd/doc/examples/postgresql_update_radacct_group_trigger.sql; Revisions: 1.1 File: radiusd/doc/examples/oracle.sql; Revisions: 1.2 File: radiusd/doc/examples/mysql.sql; Revisions: 1.2 File: radiusd/doc/examples/mssql.sql; Revisions: 1.2 ===================================================== Combined list of identical log entries ===================================================== Description: This schema change and trigger updates fills in the groupname field (which doesnt come in Accounting packets) by querying the usergroup table. This makes it easier to do group summary reports, however note that it does add some extra database load to 50% of your SQL accounting queries. Note: Triggers to databases other than PostgreSQL still need to be written but I have updated all DB schemas for consistency Modified files: File: radiusd/doc/examples/mssql.sql; Revision: 1.2; Date: 2006/03/03 14:40:03; Author: pnixon; Lines: (+3 -0) File: radiusd/doc/examples/mysql.sql; Revision: 1.2; Date: 2006/03/03 14:40:04; Author: pnixon; Lines: (+3 -0) File: radiusd/doc/examples/oracle.sql; Revision: 1.2; Date: 2006/03/03 14:40:04; Author: pnixon; Lines: (+2 -1) File: radiusd/doc/examples/postgresql.sql; Revision: 1.2; Date: 2006/03/03 14:40:04; Author: pnixon; Lines: (+2 -1) File: radiusd/doc/examples/postgresql_update_radacct_group_trigger.sql; Revision: 1.1; Date: 2006/03/03 14:40:04; Author: pnixon; ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/doc/examples/mssql.sql Revisions: 1.2 Authors: pnixon (+3 -0) ------------------------------- File: radiusd/doc/examples/mysql.sql Revisions: 1.2 Authors: pnixon (+3 -0) ------------------------------- File: radiusd/doc/examples/oracle.sql Revisions: 1.2 Authors: pnixon (+2 -1) ------------------------------- File: radiusd/doc/examples/postgresql.sql Revisions: 1.2 Authors: pnixon (+2 -1) ------------------------------- File: radiusd/doc/examples/postgresql_update_radacct_group_trigger.sql Revisions: 1.1 Authors: pnixon -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 02.03.2006 - 03.03.2006 GMT
by Automatic cvs log generator 03 Mar '06

03 Mar '06

CVS log entries from 02.03.2006 (Thu) 09:00:02 - 03.03.2006 (Fri) 09:00:02 GMT ===================================================== Summary by authors ===================================================== Author: fcusack File: radiusd/src/modules/rlm_otp/otp_rlm.c; Revisions: 1.27, 1.19.2.9 File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revisions: 1.63, 1.62.2.2 File: radiusd/src/modules/rlm_otp/otp.h; Revisions: 1.30, 1.28.2.3 ===================================================== Combined list of identical log entries ===================================================== Description: Make the site transform optional (leave undocumented!). From Dave Mitchell. Modified files: File: radiusd/src/modules/rlm_otp/otp.h; Revision: 1.30; Date: 2006/03/03 00:54:44; Author: fcusack; Lines: (+2 -1) File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revision: 1.63; Date: 2006/03/03 00:54:44; Author: fcusack; Lines: (+13 -9) File: radiusd/src/modules/rlm_otp/otp_rlm.c; Revision: 1.27; Date: 2006/03/03 00:54:44; Author: fcusack; Lines: (+4 -2) ------------------------------- Description: import from HEAD: Make the site transform optional (leave undocumented!). From Dave Mitchell. Modified files: File: radiusd/src/modules/rlm_otp/otp.h; Revision: 1.28.2.3; Date: 2006/03/03 00:58:31; Author: fcusack; Lines: (+2 -1) File: radiusd/src/modules/rlm_otp/otp_cardops.c; Revision: 1.62.2.2; Date: 2006/03/03 00:58:32; Author: fcusack; Lines: (+13 -9) File: radiusd/src/modules/rlm_otp/otp_rlm.c; Revision: 1.19.2.9; Date: 2006/03/03 00:58:32; Author: fcusack; Lines: (+4 -2) ===================================================== Log entries ===================================================== ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_otp/otp.h Revisions: 1.30, 1.28.2.3 Authors: fcusack (+2 -1), fcusack (+2 -1) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_cardops.c Revisions: 1.63, 1.62.2.2 Authors: fcusack (+13 -9), fcusack (+13 -9) ------------------------------- File: radiusd/src/modules/rlm_otp/otp_rlm.c Revisions: 1.27, 1.19.2.9 Authors: fcusack (+4 -2), fcusack (+4 -2) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Automatic report from sources (radiusd) between 01.03.2006 - 02.03.2006 GMT
by Automatic cvs log generator 02 Mar '06

02 Mar '06

CVS log entries from 01.03.2006 (Wed) 09:00:02 - 02.03.2006 (Thu) 09:00:02 GMT ===================================================== Summary by authors ===================================================== Author: pnixon File: radiusd/raddb/oraclesql.conf; Revisions: 1.7 File: radiusd/raddb/sql.conf; Revisions: 1.53 File: radiusd/raddb/mssql.conf; Revisions: 1.10 ===================================================== Combined list of identical log entries ===================================================== Description: Bring Oracle and MySQL inline with Postgresl by setting all instances of Acct-Delay-Time to Acct-Delay-Time:-0 so that it defaults to 0 when some stupid NAS don't send it. (Otherwise the query fails) Modified files: File: radiusd/raddb/oraclesql.conf; Revision: 1.7; Date: 2006/03/02 07:47:42; Author: pnixon; Lines: (+6 -6) File: radiusd/raddb/sql.conf; Revision: 1.53; Date: 2006/03/02 07:47:42; Author: pnixon; Lines: (+6 -6) ===================================================== Log entries ===================================================== Description: Opps. Missed MS SQL. Update it to match Postgresql also (Along with previous commit for MySQL and Oracle) Modified files: File: radiusd/raddb/mssql.conf; Revision: 1.10; Date: 2006/03/02 07:56:06; Author: pnixon; Lines: (+6 -6) ===================================================== Summary of modified files ===================================================== File: radiusd/raddb/mssql.conf Revisions: 1.10 Authors: pnixon (+6 -6) ------------------------------- File: radiusd/raddb/oraclesql.conf Revisions: 1.7 Authors: pnixon (+6 -6) ------------------------------- File: radiusd/raddb/sql.conf Revisions: 1.53 Authors: pnixon (+6 -6) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

Re: syslog patch to rlm_detail in 1.1.0
by Geoff Silver 01 Mar '06

01 Mar '06

Alan DeKok wrote: >> I'd be much happier if the syslog functionality was in a separate >> module, that didn't touch the "detail" module. The functionality is >> really quite separate, even if there is some overlap in the code. >> >> I'd be OK with adding a "rlm_syslog" to the server, especially if it >> could log authentication success/fail, etc. in place of what's >> currently in the server core. The current syslog functionality is >> pretty bad, so replacing it with a module is a big win. Seems perfectly reasonable. I'll see if I can create an rlm_syslog that'll work. How would you like to receive it (I presume sending a 10k diff to the mailing list probably isn't preferred)? Thanks.

2 1

syslog patch to rlm_detail in 1.1.0
by Geoff Silver 28 Feb '06

28 Feb '06

I had to patch rlm_detail.c so that our auth and accounting logs are sent to a central syslog server. We have about two dozen radius servers around the world, so auditing their access is painful. I didn't know if anyone would be interested in putting this patch into the mainstream release, but I thought I'd toss it out there. If nobody is interested, then I'll just maintain it internally for us. This adds the following configuration options to rlm_digest: detailfile = syslog - If set to syslog, use syslog. Otherwise it's a file hidepasswd = {yes,no} - Replace the user's User-Password value with (hidden). logfacility = <string> - Should be a syslog facility such as auth or local0. loglevel = <string> - Should be a syslog level such as notice or info. logname = <string> - Whatever you want to log as (default is "radiusd"). logextra = <string> - Comma-seperated list of additional attributes to log (since syslog isn't breaking it apart by directory). ie. "Client-IP-Address = %{Client-IP-Address},NAS-Port=%{NAS-Port}" In order to avoid duplicating code, rlm_detail now builds a string and then prints it or syslog's it, rather than printing as it goes along. Anyhow, here goes: --- src/modules/rlm_detail/rlm_detail.c.orig 2006-02-27 15:03:45.000000000 -0500 +++ src/modules/rlm_detail/rlm_detail.c 2006-02-27 15:02:49.000000000 -0500 @@ -37,6 +37,14 @@ #include "modules.h" #define DIRLEN 8192 +#ifdef HAVE_SYSLOG_H +#define BUFSIZE sizeof(char)*1024 +#define SYSLOG_NAMES +#include <syslog.h> +static int pencode(char *); +static int decode(char *, CODE *); +#endif + static const char *packet_codes[] = { "", "Access-Request", @@ -68,6 +76,21 @@ /* if we want file locking */ int locking; + + /* If logging full info, do we want to hide the password? */ + char *hidepasswd; + + /* Special info we want logged */ + char *logextra; + + /* Syslog facility */ + char *logfacility; + + /* Syslog level */ + char *loglevel; + + /* Type/Name of log message app */ + char *logname; }; static CONF_PARSER module_config[] = { @@ -79,6 +102,16 @@ offsetof(struct detail_instance,dirperm), NULL, "0755" }, { "locking", PW_TYPE_BOOLEAN, offsetof(struct detail_instance,locking), NULL, "no" }, + { "hidepasswd", PW_TYPE_STRING_PTR, + offsetof(struct detail_instance,hidepasswd), NULL, "yes" }, + { "logextra", PW_TYPE_STRING_PTR, + offsetof(struct detail_instance,logextra), NULL, NULL }, + { "logfacility", PW_TYPE_STRING_PTR, + offsetof(struct detail_instance,logfacility), NULL, "local0" }, + { "loglevel", PW_TYPE_STRING_PTR, + offsetof(struct detail_instance,loglevel), NULL, "notice" }, + { "logname", PW_TYPE_STRING_PTR, + offsetof(struct detail_instance,logname), NULL, "radiusd" }, { NULL, -1, 0, NULL, NULL } }; @@ -115,6 +148,14 @@ int outfd; FILE *outfp; char buffer[DIRLEN]; + char buffer2[DIRLEN]; + char extra[DIRLEN]; + char divider[8]; + char divider2[8]; + char *result; + char *tostring; + char *splitstr; + char *buf; char *p; struct stat st; int locked; @@ -125,6 +166,7 @@ VALUE_PAIR *pair = packet->vps; struct detail_instance *inst = instance; + result = (char *)malloc(BUFSIZE); /* * Nothing to log: don't do anything. @@ -196,6 +238,138 @@ } /* else there was no directory delimiter. */ /* + * Determine formatting between attributes, based on method + */ + if (strcmp(buffer, "syslog") == 0) { + strcpy(divider, ", "); + strcpy(divider2, ", "); + } else { + strcpy(divider, "\n\t"); + strcpy(divider2, "\n"); + } + + /* + * Build the output string + */ + /* + * Print out names, if they're OK. + * Numbers, if not. + */ + strcpy(result, "Packet-Type = "); + if ((packet->code > 0) && + (packet->code <= PW_ACCESS_CHALLENGE)) { + strcat(result, packet_codes[packet->code]); + } else { + tostring = (char *)malloc(BUFSIZE); + sprintf(tostring, "%d", packet->code); + strcat(result, tostring); + free(tostring); + } + /* + * Post a timestamp + */ + if (strcmp(buffer, "syslog") != 0) { + strcat(result, divider2); + strcat(result, strtok(CTIME_R(&request->timestamp, buffer2, DIRLEN), "\n")); + } + strcat(result, divider); + + + /* Write each attribute/value to the log file */ + while (pair) { + /* + * Don't print passwords in old format... + */ + if (compat && (pair->attribute == PW_PASSWORD)) { + pair = pair->next; + continue; + } + + /* + * Print all of the attributes. + */ + buf = (char *)malloc(BUFSIZE); + vp_prints(buf, BUFSIZE, pair); + if ((strstr(buf, "User-Password") != 0) && + (strcmp(inst->hidepasswd, "yes") == 0)) { + strcat(result, "User-Password = (hidden)"); + } else { + strcat(result, buf); + } + strcat(result, divider); + pair = pair->next; + free(buf); + } + + /* + * Add non-protocol attibutes. + */ + if (compat) { + if ((pair = pairfind(request->config_items, + PW_PROXY_TO_REALM)) != NULL) { + proxy_realm = realm_find(pair->strvalue, TRUE); + if (proxy_realm) { + memset((char *) proxy_buffer, 0, 16); + ip_ntoa(proxy_buffer, proxy_realm->acct_ipaddr); + strcat(result, "Freeradius-Proxied-To = "); + strcat(result, proxy_buffer); + strcat(result, divider); + DEBUG("rlm_detail: Freeradius-Proxied-To set to %s", + proxy_buffer); + } + } + tostring = (char *)malloc(BUFSIZE); + strcat(result, "Timestamp = "); + sprintf(tostring, "%ld", (unsigned long) request->timestamp); + strcat(result, tostring); + strcat(result, divider); + free(tostring); + + if (request->packet->verified == 2) { + strcat(result, "Request-Authenticator = Verified"); + strcat(result, divider); + } else if (request->packet->verified == 1) { + strcat(result, "Request-Authenticator = None"); + strcat(result, divider); + } + } + + if (inst->logextra != NULL) { + radius_xlat(extra, sizeof(extra), inst->logextra, request, NULL); + DEBUG2("rlm_detail: %s expands to %s", inst->logextra, extra); + splitstr = strtok(extra, ","); + while (splitstr != NULL) + { + strcat(result, splitstr); + strcat(result, divider); + splitstr = strtok(NULL, ","); + } + } + +#ifdef HAVE_SYSLOG_H + /* + * If the log file name is "syslog", then the user is + * requesting this message go to syslog, not to a local + * file. + */ + if (strcmp(buffer, "syslog") == 0) { + int level; + char facil[16]; + + strcpy(facil, inst->logfacility); + strcat(facil, "."); + strcat(facil, inst->loglevel); + level = pencode(facil); + + openlog(inst->logname, LOG_CONS | LOG_PID, (level | LOG_FACMASK)), + syslog(level, "%s", result); + closelog(); + + return RLM_MODULE_OK; + } +#endif + + /* * Open & create the file, with the given permissions. */ if ((outfd = open(buffer, O_WRONLY | O_APPEND | O_CREAT, @@ -253,74 +427,8 @@ return RLM_MODULE_FAIL; } - /* - * Write the information to the file. - */ - if (!compat) { - /* - * Print out names, if they're OK. - * Numbers, if not. - */ - if ((packet->code > 0) && - (packet->code <= PW_ACCESS_CHALLENGE)) { - fprintf(outfp, "Packet-Type = %s\n", - packet_codes[packet->code]); - } else { - fprintf(outfp, "Packet-Type = %d\n", packet->code); - } - } - - /* - * Post a timestamp - */ - fseek(outfp, 0L, SEEK_END); - fputs(CTIME_R(&request->timestamp, buffer, DIRLEN), outfp); - - /* Write each attribute/value to the log file */ - while (pair) { - /* - * Don't print passwords in old format... - */ - if (compat && (pair->attribute == PW_PASSWORD)) { - pair = pair->next; - continue; - } - - /* - * Print all of the attributes. - */ - fputs("\t", outfp); - vp_print(outfp, pair); - fputs("\n", outfp); - pair = pair->next; - } - - /* - * Add non-protocol attibutes. - */ - if (compat) { - if ((pair = pairfind(request->config_items, - PW_PROXY_TO_REALM)) != NULL) { - proxy_realm = realm_find(pair->strvalue, TRUE); - if (proxy_realm) { - memset((char *) proxy_buffer, 0, 16); - ip_ntoa(proxy_buffer, proxy_realm->acct_ipaddr); - fprintf(outfp, "\tFreeradius-Proxied-To = %s\n", - proxy_buffer); - DEBUG("rlm_detail: Freeradius-Proxied-To set to %s", - proxy_buffer); - } - } - fprintf(outfp, "\tTimestamp = %ld\n", - (unsigned long) request->timestamp); - - if (request->packet->verified == 2) - fputs("\tRequest-Authenticator = Verified\n", outfp); - else if (request->packet->verified == 1) - fputs("\tRequest-Authenticator = None\n", outfp); - } - - fputs("\n", outfp); + /* send buffered output to file */ + fprintf(outfp, "%s\n", result); if (inst->locking) { fflush(outfp); @@ -337,6 +445,52 @@ return RLM_MODULE_OK; } +/* Decode a symbolic name to a numeric value + * this function is based on code from logger + */ +static int pencode(char *s) +{ + char *save; + int lev, fac = LOG_USER; + + for (save = s; *s && *s != '.'; ++s); + if (*s) { + *s = '\0'; + fac = decode(save, facilitynames); + if (fac < 0) { + fprintf(stderr, "unknown facility name: %s\n", save); + exit(FALSE); + } + *s++ = '.'; + } else { + s = save; + } + lev = decode(s, prioritynames); + if (lev < 0) { + fprintf(stderr, "unknown priority name: %s\n", save); + exit(FALSE); + } + return ((lev & LOG_PRIMASK) | (fac & LOG_FACMASK)); +} + +/* Help decode a symbolic name to a numeric value + * this function is based on code from logger + */ +static int decode(char *name, CODE * codetab) +{ + CODE *c; + + if (isdigit(*name)) + return (atoi(name)); + for (c = codetab; c->c_name; c++) { + if (!strcasecmp(name, c->c_name)) { + return (c->c_val); + } + } + + return (-1); +} + /* * Accounting - write the detail files. */

3 4