- Freeradius-Users - lists.freeradius.org

Possible bug in !* operator handling?
by Marcel De Boer 13 Sep '07

13 Sep '07

Hi! Today I noticed some strange problems on a number of RADIUS users in a test setup: I have a number of users in MySQL that contain a large number of attributes that should not occur in the Access-Request (i.e. attributes with the !* operator). When I tried to authenticate these users, I noticed that in some cases users were getting authenticated while they should have been rejected. Some investigation later, it turned out that after the first row in the radcheck table that contains a !* operator, all further attributes get ignored... I crawled through the code a bit more, and the problem appears to occur on line 287 of main/valuepair.c. This is in the function paircmp, which iterates over the list of check items to verify whether the incoming request matches: /* * Not found, it's not a match. */ if (auth_item == NULL) { /* * Didn't find it. If we were *trying* * to not find it, then we succeeded. */ if (check_item->operator == T_OP_CMP_FALSE) return 0; else return -1; } The 'return 0;' above causes paircmp to exit successfully (accepting the user) if it could not find the attribute and it should not find the attribute (because of the !* operator) instead of continuing to see if the rest of the attributes is correct too. I've changed the 'return 0;' to a 'continue;', so it does not break the for loop anymore. This appears to work, is this fix correct or would this introduce problems elsewhere? Gtnx Marcel

1 1

Multiple postgresql servers with radius
by Jigar Dani 13 Sep '07

13 Sep '07

Hello, I am currently using free radius to insert radius records in a postgresql database. I need to write the same records, simultaneously to two databases, both postgresql. In postgresql.conf I have defined the database server, the database, the access information and the table to use. How do I change both radius.conf and postgresql.conf to write to two databases simultaneously. I am very new to radius/databases. Thanks & Regards, Jigar

3 2

Error while building
by Sujatha Pelluru 13 Sep '07

13 Sep '07

Hi, I am getting the following error when i am tring to build the rpm files for the freeradius-1.1.7 Error is as below: error: Installed (but unpackaged) file(s) found: /etc/raddb/postgresqlippool.conf RPM build errors: Installed (but unpackaged) file(s) found: /etc/raddb/postgresqlippool.conf When I am trying to build using rpmbuild -ba /usr/src/packages/SPECS/freeradius.spec, the above error is encountered. Can u please tell me the solution for this. Then I tried with the procedure ./configure , make and make install. But at that time when I am bringing up the deamon server using radiud -x , the output seen is like "command not found" Unlimited freedom, unlimited storage. Get it now, on http://help.yahoo.com/l/in/yahoo/mail/yahoomail/tools/tools-08.html/

1 0

RE : LOGs of eap-tls authentication
by anoop_c＠sifycorp.com 13 Sep '07

13 Sep '07

hi I am not able to start server by service radiusd restart command/. I used to start by simply typing radiusd command Pls anyone no the command to stop the server Regards Anoop > > ------------------------------ > > Message: 6 > Date: Thu, 13 Sep 2007 10:01:53 +0200 (CEST) > From: HBA BOX <hba_box(a)yahoo.fr> > Subject: RE : LOGs of eap-tls authentication > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <132413.84624.qm(a)web27406.mail.ukl.yahoo.com> > Content-Type: text/plain; charset=\"iso-8859-1\" > > hello, > > To restart the radius I knew only one command which is service radiusd > restart;all what you have to do when you are in debuce mode is stoping > it by using service radiusd stop, then you can restart it . I hope that > this can help you. > > regards > habiba > > anoop_c(a)sifycorp.com a ?crit : > > Dear Thanks for the information.I am getting the logs when > stopped server in debug mode. But the commands service radiusd stop and > service radiusd restart is not working.So i killed the process radiusd > using kill command.Pls let me know the commands to stop and start the > server in normal mode. Regards Anoop > > Message: 2 > > Date: Tue, 11 Sep 2007 10:39:38 +0200 (CEST) > From: inelec > communication > Subject: RE : LOGs of eap-tls authentication (inelec > communication) > To: FreeRadius users mailing list > > Message-ID: > <980737.95433.qm(a)web26005.mail.ukl.yahoo.com> > Content-Type: > text/plain; charset=\"iso-8859-1\" > > Hello, > > you have no > logs in your radius.log file because you are running in > debug mode , > you have to run in normal mode to get the logs, so what you > have to > do is the following: > first stop your debug mode by this command: > service radiusd stop; then > restart the service radius by: service > radiusd > restart; doing that you > are in normal mode and you can do your wlan > loging without any problem > and you get your log. > > regards > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > --------------------------------- > Ne gardez plus qu\'une seule adresse mail ! Copiez vos mails vers Yahoo! > Mail >

2 1

Re: sometimes double records in radacct
by Nelson Serafica 13 Sep '07

13 Sep '07

Is it advisable that I uncomment the accounting_start_query_alt? Would there be conflict to other query commands like accounting_stop_query_alt, accounting_stop_query, etc. ----- Original Message ---- From: Nelson Serafica <ntserafica(a)yahoo.com> To: freeradius-users(a)lists.freeradius.org Sent: Wednesday, September 12, 2007 1:33:30 PM Subject: sometimes double records in radacct I notice in my radacct that there are double records. See sample below: +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ | RadAcctId | AcctSessionId | AcctUniqueId | UserName | AcctStartTime | AcctStopTime | ConnectInfo_start | AcctStartDelay | +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ | 531828 | 41002919 | a8003a3450fdcddc | glastec | 2007-09-12 11:18:32 | 2007-09-12 11:20:14 | | 0 | | 531826 | 41002919 | a8003a3450fdcddc | glastec | 2007-09-12 11:18:33 | 2007-09-12 11:19:14 | 33333 LAPM/V42BIS | 0 | +-----------+---------------+------------------+----------+---------------------+---------------------+-------------------+----------------+ I noticed that the difference (AcctStartTime,AcctStartDelay,ConnectInfo_start) are indicated in the accounting_start_query_alt parameters. If you will noticed, there are identical AcctSessionId which was supposed to be none and the difference between them is the one that is updated by accounting_start_query_alt. It must not be identical. The problem is there are identical AcctSessionId. Would it be possible that the culprit is in the accounting_start_query_alt parameters? Is the accounting_start_query failing that's why accounting_start_query_alt take over? accounting_start_query is not broken and one line only. Is there a way to increase time before accounting_start_query_alt takes over? Tired of spam? Yahoo! Mail has the best spam protection around http://ph.mail.yahoo.com ____________________________________________________ Tired of spam? Yahoo! Mail has the best spam protection around http://ph.mail.yahoo.com

2 1

RE : LOGs of eap-tls authentication
by anoop_c＠sifycorp.com 13 Sep '07

13 Sep '07

Dear Thanks for the information.I am getting the logs when stopped server in debug mode. But the commands service radiusd stop and service radiusd restart is not working.So i killed the process radiusd using kill command.Pls let me know the commands to stop and start the server in normal mode. Regards Anoop > > Message: 2 > Date: Tue, 11 Sep 2007 10:39:38 +0200 (CEST) > From: inelec communication <inelec_communication(a)yahoo.fr> > Subject: RE : LOGs of eap-tls authentication (inelec communication) > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <980737.95433.qm(a)web26005.mail.ukl.yahoo.com> > Content-Type: text/plain; charset=\"iso-8859-1\" > > Hello, > > you have no logs in your radius.log file because you are running in > debug mode , you have to run in normal mode to get the logs, so what you > have to do is the following: > first stop your debug mode by this command: service radiusd stop; then > restart the service radius by: service radiusd restart; doing that you > are in normal mode and you can do your wlan loging without any problem > and you get your log. > > regards >

2 1

Re: Reply VSA Attributes in a list
by Faqeer ALI 13 Sep '07

13 Sep '07

I hope you have understand my problem right, but i will try to re explain it. i want to add the vp list in a VSA like following. (the way that NTRadping utility sends the vps) VSA ->vp ->vp ->vp This problem is my bottle line for me and i have to do it, because the client's application knows the attributes that way. please guide me where and what are the code changes that i have to make, and what structure i have to follow. special thanks. Regards FQ >Message: 6 >Date: Thu, 13 Sep 2007 07:28:45 +0200 >From: Alan DeKok <aland(a)deployingradius.com> >Subject: Re: Reply VSA Attributes in a list >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <46E8CA8D.5020606(a)deployingradius.com> >Content-Type: text/plain; charset=ISO-8859-1 > >Faqeer ALI wrote: > > In the response packet i want to add the VPS such that the VSA of one > > vendor attaches in a specific vendor list, ie specify the vendor once > > and then the list of attributes in it. > > You mean inside of the RADIUS packet? > > > By pairadd(&request->reply->vps,vp) the vps are added one after the > > another, but i want it such that there would be the name of the specific > > vendor once and list of attributes to follow behind it.. > > The VALUE_PAIRs don't work that way. > > For a number of reasons, FreeRADIUS doesn't pack multiple VSA's into >one Vendor-Specific attribute. There are interoperability issues, and >it would also require code changes. > > Alan DeKok. > _________________________________________________________________ Gear up for Halo® 3 with free downloads and an exclusive offer. http://gethalo3gear.com?ocid=SeptemberWLHalo3_MSNHMTxt_1

2 1

list problem?
by Norbert Wegener 13 Sep '07

13 Sep '07

Is there a problem with the list/mailserver? The archives show newer threads, where the last message I received from the list has been from September, 10. It arrived this mornig. If I'm the only one with that problem, sorry. My other mail comes in as usual. Norbert Wegener

2 1

Reply VSA Attributes in a list
by Faqeer ALI 13 Sep '07

13 Sep '07

AOA I am using freradius-1.1.6.. In the response packet i want to add the VPS such that the VSA of one vendor attaches in a specific vendor list, ie specify the vendor once and then the list of attributes in it. By pairadd(&request->reply->vps,vp) the vps are added one after the another, but i want it such that there would be the name of the specific vendor once and list of attributes to follow behind it.. Any hints would be warmly accepted. Thanks Regards FQ ALi _________________________________________________________________ Gear up for Halo® 3 with free downloads and an exclusive offer. http://gethalo3gear.com?ocid=SeptemberWLHalo3_MSNHMTxt_1

2 1

converting pap to chap
by Stefan Kronawithleitner 13 Sep '07

13 Sep '07

Hello, I have a little problem concerning proxying of pap-auths. The existing setup is a freeradius 1.1.6, allowing auth from a NAS and PEAP against an eDirectory (ldap) userbase, which works fine. However, users of another realm should be proxied to another radius-server - which works fine for PEAP, but failes from the NAS, because the NAS can do only PAP - which is not allowed on the other radius-server. It is not possible to make CHAP-Auth from the NAS or allow PAP on the other side (which is not under my control). So far, so bad. But theoretically it should be possible, to convert a PAP-Auth to a CHAP-Auth - so i did a search in the archives and found some threads of users with the exact same problem. There was a conversation in 2003 between someone submitting a patch for a module and Alan DeKok - talking about the best solution, but there never was a conclusion - only that it is not possible without code modification. I read through the changelogs, finding nothing like that - has there been a change? Is it possible to convert PAP to CHAP? Howto? Thanks in advance, Stefan

2 1