- Freeradius-Users - lists.freeradius.org

doc/rlm_sql is wrong?
by Phil Mayers 11 Jan '07

11 Jan '07

I've been looking at using rlm_sql to replace a fairly complex set of Autz-Type and rlm_passwd maps. Primarily this is to speed up updates when e.g. blocking systems and not have to HUP the server. The doc/rlm_sql file states that processing is done with pairs of check/reply items at a time - that is, first the user check items are compared and if matches the reply items added; then for each group (in order of priority) the group check items are compared and if match the reply items added. The code in rlm_sql.c definitely does not do that, at least in 1.1.3 as far as I can understand the code? Instead it appears to smoosh the user and all the group check items together, compares them, and if they *all* match adds *all* the reply items. This seems to make groups pretty useless except for using the SQL-Group construct in the users file. Comments?

4 4

Re: ldap { fail=1}
by jerrrry＠voila.fr 11 Jan '07

11 Jan '07

> Message du 10/01/07 à 15h38 > De : "Alan DeKok" > A : jerrrry(a)voila.fr, "FreeRadius users mailing list" > Copie à : > Objet : Re: ldap { fail=1} > > jerrrry(a)voila.fr wrote: > > > > i'm using freeradius 1.0.1 from Red Hat entreprise 4. > > You SHOULD upgrade: > > http://freeradius.org/security.html does not Red Hat supply any security patch with the OS support ? > > > I want the radius server to authenticate users thanks to the "users" > > file even if the ldap directory is not reachable and the radius server > > to start even if the DB is not reachable > > That's probably the way the server should work. Those issues probably > weren't though of when the server was written, as the SQL module works > the same way. > > > I tried with ldap { fail =1} in the authorize section and sql { fail > > = 1 } in the instantiate section without any success. > > > > "fail" doen't seem to be know. > > No, it doesn't work in the "instantiate" section. It could, though. > It's a good idea, and one I hadn't thought of. and "fail = 1" should work for ldap in the authorize section ? > > An alternative would be to update the LDAP module to NOT bind at > startup, and do it only when a request came in. That would help, too. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > >

3 2

Re: Freeradius-Users Digest, Vol 21, Issue 26 (Vacation)
by Michael Castillo 11 Jan '07

11 Jan '07

I will be out of the office from Thursday January 11th thru Monday January 15th, 2007. I will be returning to the office on Tuesday the 16th. Please contact Steve Fouchek at 463.2216 if you have any issues or question that require an immediate response. Michael

1 0

Bogus default attrs file?
by Tomas Hoger 10 Jan '07

10 Jan '07

Hi all! Default attrs file used by rlm_attr_filter contains following DEFAULT section: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, [ ... ] Framed-Protocol == PPP, Framed-Protocol == SLIP, [ ... ] This syntax, accompanied with tisp realm example, suggests that the attribute e.g. Framed-Protocol will be preserved in proxy reply if it's value is either PPP or SLIP. However, it does not seem to be true. Framed-Protocol will not pass this filter at all. Documentation quite clearly states: "an attribute must pass *all* the rules which affect it in order to make it past the filter". Hence using == rule twice with different values for same attribute should be the same as using !*. Or am I missing anything? Proposal for fix: check_pair function after comparison always increments either fail or pass counter for given attribute. It may be modified to not increment fail for '==' operator (and also '=~') when compare fails. This should be consistent with final " fail == 0 && pass > 0 " check and default attrs file should work as expected. Untested patch: For released code: --- rlm_attr_filter.c 2005-08-11 23:06:38.000000000 +0200 +++ rlm_attr_filter.c.new 2007-01-10 13:32:55.000000000 +0100 @@ -68,8 +68,6 @@ case T_OP_CMP_EQ: if (comp == 0) { ++*(pa); - } else { - ++*(fa); } break; @@ -120,8 +118,6 @@ regfree(&reg); if (comp == 0) { ++*(pa); - } else { - ++*(fa); } break; For CVS code (some #ifdef HAVE_REGEX_H should probably appear here): --- rlm_attr_filter.c 2006-11-22 22:44:19.000000000 +0100 +++ rlm_attr_filter.c.new 2007-01-10 13:37:05.000000000 +0100 @@ -68,7 +68,8 @@ compare = paircmp(check_item, reply_item); if (compare == 1) { ++*(pass); - } else { + } else if (check_item->operator != T_OP_CMP_EQ && + check_item->operator != T_OP_REG_EQ) { ++*(fail); } Ideas? th.

2 2

1.1.4 and rlm_sql_mysql.so
by Jeffrey Sewell 10 Jan '07

10 Jan '07

I'm installing freeRADIUS on a CentOS 4.0 system. When I used the RPM on a different box it worked fine, but the RPM is out of date and I want this new box to be more up-to-date than RPMs will allow. 1.1.4 compiles fine and works w/o MySQL (5.0). However, when I run it with the SQL lines in radiusd.conf uncommented, I get this: rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1844] Unknown module "sql". radiusd.conf[1773] Failed to parse authorize section. that library is on my other (RPM-installed) system, but is not anywhere on the file system of the new box (including the source dir--it isn't in the tarball). Where is that file stored for 1.1.4? Are there other libraries that I will need that should be with that one and are also missing? Jeffrey

2 2

ldap { fail=1}
by jerrrry＠voila.fr 10 Jan '07

10 Jan '07

Hi, i'm using freeradius 1.0.1 from Red Hat entreprise 4. my radius server is connected to a ldap directory to store users and to a mysql database to store NAS I want the radius server to authenticate users thanks to the "users" file even if the ldap directory is not reachable and the radius server to start even if the DB is not reachable I tried with ldap { fail =1} in the authorize section and sql { fail = 1 } in the instantiate section without any success. "fail" doen't seem to be know. Thank you for your help Thomas

2 1

freeRADIUS 1.1.3 and Cisco WLSE LEAP Authentication
by Mark Hollenbeck 10 Jan '07

10 Jan '07

Hallo, there has been a problem with Cisco WLSE LEAP authentication for WDS with an older version of freeRADIUS. Is this problem still there, or has it been fixed in the meantime? Thanks a lot Mark

3 2

FreeRADIUS 1.1.4 has been released
by Alan DeKok 09 Jan '07

09 Jan '07

Version 1.1.4 has been released, with a few notable improvements. The server has been updated to be compatible with Microsoft Vista clients for 802.1x. This feature should prove to be of significant interest in many deployments. The "rlm_pap" module has been updated, which should make many configurations much simpler. A new attribute has been added, called Cleartext-Password. This attribute should be used to hold the "known good" password, where configurations previously had used the "User-Password" attribute. Historically, User-Password has been used both as the users password in the Access-Request packet, and also for the "known good" password in the servers configuration ("users" file or SQL database). Having two meanings for one attribute is problematic, so we have modified the server to separate the meanings of the two attributes. Existing configurations will not be affected by this change. However, we recommend that everyone reads the "README" and "man rlm_pap" documentation once the server is installed. The ChangeLog is included below: Feature improvements * Major enhancements to rlm_pap, that make "encryption_scheme" a think of the past. See "man rlm_pap" for details. * Added SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS flag to use work-arounds that enable Windows Vista clients to work. * Added preliminary code to support Firebird. (closes: #378) Use at your own risk! * Send MS-CHAP2-Success, which makes EAP-TTLS/MSCHAP work on more platforms. (closes: #402) * Add a new "reply-name" directive in rlm_sqlcounter to define the name of the reply attribute. (closes: #403) * Added more dictionaries and attributes (closes: #408, among others) * Print ntlm_auth failure reason in Module-Failure-Message (closes: #398) * radsqlrelay is able to get the DB password from a file instead of command line. (closes: #395) Bug fixes * Fix a parse error in the digest module, where malformed digest requests would result in the user being accepted. Oops... * VALUEs can only be defined for 'integer', to catch mistakes with setting VALUEs for type 'string'. * Better parsing of VALUE names, so that values starting with a digit work correctly. * Check return from malloc (closes: #407) * Fix a double free() in rlm_eap_tls.c (closes: #404) * Check return code of malloc() during initialization. (closes: #407) * Fix a corner case where the proxy port isn't set either in radiusd.conf or in proxy.conf. NOT in this release * Threading issues with SSL and EAP on some systems. * MS-CHAP UTF-8 fixes. We expect both those fixes to be in a future release. Alan DeKok. FreeRADIUS Project Leader -- Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

6 11

Re: Can't access Internet?
by Tim Tyler 09 Jan '07

09 Jan '07

2 1

replicate database
by ann kok 09 Jan '07

09 Jan '07

Hi all Could you suggest a better way to replicate the database in 2 radius servers? rysnc / ssh / tar or any suggestion? Thank you very much __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 4