- Freeradius-Users - lists.freeradius.org

question on ldap_escape_func in rlm_ldap.c (author: Kostas Kalevras)
by Qin Zhen 07 Dec '05

07 Dec '05

Hi All, I'm new to Radius, now encountered problems with ldap_escape_func in rlm_ldap. please help me since it's really a bit urgent. the comments regarding to this function is 'Add an ldap_escape_func. Escape the * character from the filter so that we can avoid the trivial DoS of username=*'. if i was not wrong, this function intends to filter out the * which follows the username, i.e, if username is 'userid*' in access-request packet, ldapsearch is only based on 'userid'. but what's the purpose for doing this and is it secure? or did i misunderstand the comments? the lastest version freeradius-1.0.5 has a slightly different version for this piece of code, ***************************************************************** freeradius-1.0.5 if (strchr("*=\\,()", *in)) { static const char *hex = "0123456789abcdef"; if (outlen <= 3) break; *(out++) = '\\'; *(out++) = hex[((*in) >> 4) & 0x0f]; *(out++) = hex[(*in) & 0x0f]; outlen -= 3; continue; } ************************************************************** freeradius-1.0.4 and previous if (strchr("*", *in)) { in++; outlen--; continue; } i couldn't figure out what does the change intend to do, is it to filter out '*', '\\', '()' and '=' from username? and why should it be in that way? please help me. thanks a lot in advance.

2 5

RE: question on ldap_escape_func in rlm_ldap.c
by Guy Davies 07 Dec '05

07 Dec '05

-----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Nicolas Baradakis Sent: 07 December 2005 13:18 To: FreeRadius users mailing list Subject: Re: question on ldap_escape_func in rlm_ldap.c Qin Zhen wrote: > so in lastest version (1.0.5), a username 'jam\' will be converted > into 'jam\5c' and ldapsearch will be based on 'jam\5c' right? so this > username is supposed not to be found in ldap in this case? > but how come in my server, the ldapsearch will base on 'jam' and those > invalid charactors r just simply eliminated? scratching head...pls > assist..thanks so much That's what is said in http://www.ietf.org/rfc/rfc2254.txt <<<<< If a value should contain any of the following characters Character ASCII value --------------------------- * 0x2a ( 0x28 ) 0x29 \ 0x5c NUL 0x00 the character must be encoded as the backslash '\' character (ASCII 0x5c) followed by the two hexadecimal digits representing the ASCII value of the encoded character. The case of the two hexadecimal digits is not significant. >>>>> -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

multiple groups behind one NAS
by nl 07 Dec '05

07 Dec '05

Hi, I have problem with multiple groups behind one NAS after upgrade from freeradius0.9.x to 1.0.4-1. There was no problem with this configuration before upgrade. Scenario: 2 groups: GPRS_1 and GPRS_2 both groups are behind NAS 1.1.1.1 user_1 is member of group GPRS_2 and he and all members of GPRS_2 are rejected. It looks that only members of first group matched in huntgroups file are positive processed. #################### my users file: DEFAULT Huntgroup-Name == DENY, Auth-Type := Reject Reply-Message = "!!! You are NOT allowed to access the resource !!!" DEFAULT Huntgroup-Name == GPRS_1, Ldap-Group == "cn=GPRS_1,cn=radius,dc=my,dc=domain" Fall-Through = no DEFAULT Huntgroup-Name == GPRS_2, Ldap-Group == "cn=GPRS_2,cn=radius,dc=my,dc=domain" Fall-Through = no #(I tried Fall-Through = yes but without success ) #################### my huntgroups file: GPRS_1 NAS-IP-Address == 1.1.1.1 GPRS_2 NAS-IP-Address == 1.1.1.1 #################### debug> rad_recv: Access-Request packet from host 1.1.1.1:49152, id=113, length=282 User-Name = "user_1" User-Password = "*******" Acct-Session-Id = "C35B9B41550234E2DB" NAS-IP-Address = 1.1.1.1 Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context Calling-Station-Id = "01234567898" Called-Station-Id = "apn" NAS-Port-Type = Wireless-Other NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_checkval: Item Name: NAS-IP-Address, Value: 1.1.1.1 rlm_checkval: Could not find attribute named NAS-IP-Address in check pairs modcall[authorize]: module "nas-ip" returns notfound for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for user_1 radius_xlat: '(uid=user_1)' radius_xlat: 'cn=radius,dc=my, dc=domain' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=my,dc=domain/******* to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in cn=radius ,dc=my, dc=domain, with filter (uid=user_1) rlm_ldap: Password header not found in password {MD5}M6SF989545MZxq0dPLluAAoY for user user_1 rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 01234567898 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedIPAddress as Framed-IP-Address, value 10.10.10.10 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: user user_1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'cn=radius ,dc=my, dc=domain' radius_xlat: '(&(objectClass=groupOfUniqueNames)(uniquemember=uid=user_1,cn=GPRS_1,dc=my,dc=domain))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=GPRS_1,cn=radius,dc=my,dc=domain, with filter (&(objectClass=groupOfUniqueNames)(uniquemember=uid=user_1,cn=GPRS_1,cn=radius,dc=my,dc=domain)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=GPRS_1,cn=radius,dc=my,dc=domain not found or user is not a member. users: Matched entry DEFAULT at line 128 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Thanx for adviced :) Aktivujte si aj vy schranku s neobmedzenou kapacitou na ATLAS.SK. http://mail.atlas.sk

1 0

Re: OS Update broke FR - rlm_exec-1.0.0.so not found
by Landon Cox 07 Dec '05

07 Dec '05

Thanks, Alan. FYI - more research on the topic, I did an ldd on the rlm_exec file: On a freeradius box I have which is working, I did: radius1:/usr/lib/freeradius # ldd rlm_exec-1.0.0.so linux-gate.so.1 => (0xffffe000) libnsl.so.1 => /lib/libnsl.so.1 (0x40018000) libresolv.so.2 => /lib/libresolv.so.2 (0x4002f000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x40042000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0x40054000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0x40145000) libc.so.6 => /lib/tls/libc.so.6 (0x40175000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x80000000) libdl.so.2 => /lib/libdl.so.2 (0x4028b000) Then on the radius box I updated and broke I did: radius2:/usr/lib/freeradius # ldd rlm_exec-1.0.0.so linux-gate.so.1 => (0xffffe000) libnsl.so.1 => /lib/libnsl.so.1 (0x55577000) libresolv.so.2 => /lib/libresolv.so.2 (0x5558e000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x555a1000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0x555b3000) libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0x556a4000) libc.so.6 => /lib/tls/libc.so.6 (0x556d4000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x56555000) libdl.so.2 => /lib/libdl.so.2 (0x557ea000) I hunted down and verified that every library that was pointed to by rlm_exec indeed existed on the file system. On both systems, they had everything except both had no linux-gate.so.1. But then radius1 works fine and it shows the same paths and library existence as the radius2 box which fails. Also, googling linux-gate.so.1 I saw: "What is linux-gate.so.1?": http://www.trilithium.com/johan/2005/08/ linux-gate/ and http://kerneltrap.org/node/3405 The first link explains that an ldd report of linux-gate.so.1 that doesn't point to a file/path is normal in recent kernels and goes into detail of what it is. In any case, it's not a problem. After verifying that every library that is pointed to by rlm_exec-1.0.0.so actually exists on both the machine that works fine and the one that doesn't, I understand a little more but don't see what the problem is. There's something else bizarre going on...or perhaps I still need to run ldd on each of the dependent libraries - maybe there's one in that tree of dependencies that's missing. I'll also try going to 1.0.5. Thanks, Landon

2 1

attrs file
by Chuck 07 Dec '05

07 Dec '05

I have a need on one of my radius servers to pass every reply attribute my realms I proxy for send up to me regardless of what they are. I then pass these replies upstream. Everything I read describing the default 'realm' in the attrs file mention adding attributes I want to pass on. However in this one instance I would have to list every dictionary attribute. Is there not a way to tell radius to pass everything, maybe with a * on a single line or maybe nothing in the default section? Or must I list every single one? -- Chuck

2 2

(no subject)
by Josh 07 Dec '05

07 Dec '05

I'm using FreeRadius (with mysql) to authenticate VPN users on a PIX. I have multiple vpngroups setup on the PIX and want to be able to assign users in the radius database to specific vpngroups on the PIX. For instance, I have a username 'bob' in radcheck (mysql). Bob can use any valid vpngroup (setup on the PIX) and then authenticate (via radius) with his 'bob' username and successfully connect. -- not exactly what I had in mind. Bob should only be able to connect to vpngroup 'usersvpn' and not 'adminsvpn'. I figured there must be an attribute to get this to work? Anyone have any success doing this with a PIX in the picture? __________________________________________ Yahoo! DSL Something to write home about. Just $16.99/mo. or less. dsl.yahoo.com

2 1

rlm_counter
by Lisa Casey 07 Dec '05

07 Dec '05

Hi, I have Freeradius 1.01 on FreeBSD 5.3. Two questions: 1) Is there a way to show which modules are currently installed? 2) I want to use the rlm_counter module. So I went to /usr/ports/distfiles/freeradius-1.0.1/src/modules/rlm_counter and did a ./configure. That went OK, no errors. I next typed make with the following result: radius# make "../rules.mak", line 65: Missing dependency operator Error expanding embedded variable. I did some googling and found a suggestion that I probably should use gmake on FreeBSD. That bombed also: radius# gmake ../rules.mak:137: warning: overriding commands for target `clean' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:107: warning: ignoring old commands for target `clean' ../rules.mak:157: warning: overriding commands for target `install' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:111: warning: ignoring old commands for target `install' gmake: *** No rule to make target `radiusd.c', needed by `radiusd.o'. Stop. radius# gmake rlm_counter ../rules.mak:137: warning: overriding commands for target `clean' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:107: warning: ignoring old commands for target `clean' ../rules.mak:157: warning: overriding commands for target `install' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:111: warning: ignoring old commands for target `install' cc -I../../include -I/usr/local/include/ -c rlm_counter.c -o rlm_counter.o rlm_counter.c:26:22: autoconf.h: No such file or directory In file included from rlm_counter.c:27: ../../include/libradius.h:12:22: autoconf.h: No such file or directory In file included from ../../include/libradius.h:59, from rlm_counter.c:27: ../../include/sha1.h:15: error: syntax error before "uint32_t" ../../include/sha1.h:20: error: syntax error before "state" ../../include/sha1.h:22: error: syntax error before '*' token ../../include/sha1.h:23: error: syntax error before "digest" ../../include/sha1.h:29: error: syntax error before "digest" ../../include/sha1.h:34: error: syntax error before "mk" In file included from ../../include/libradius.h:60, from rlm_counter.c:27: ../../include/md4.h:72: error: syntax error before "uint32_t" ../../include/md4.h:81: error: syntax error before '*' token ../../include/md4.h:83: error: syntax error before '[' token ../../include/md4.h:85: error: syntax error before '[' token In file included from rlm_counter.c:27: ../../include/libradius.h:100: error: syntax error before "uint8_t" ../../include/libradius.h:138: error: syntax error before "uint32_t" ../../include/libradius.h:140: error: syntax error before "uint8_t" ../../include/libradius.h:156: error: syntax error before "uint32_t" ../../include/libradius.h:162: error: syntax error before "uint8_t" ../../include/libradius.h:165: error: syntax error before "uint8_t" ../../include/libradius.h:221: error: syntax error before '*' token ../../include/libradius.h:244: error: syntax error before '*' token ../../include/libradius.h:288: error: syntax error before "uint32_t" ../../include/libradius.h:289: error: syntax error before "ip_getaddr" ../../include/libradius.h:289: warning: data definition has no type or storage class ../../include/libradius.h:290: error: syntax error before "uint32_t" ../../include/libradius.h:291: error: syntax error before "ip_addr" ../../include/libradius.h:291: warning: data definition has no type or storage class ../../include/libradius.h:292: error: syntax error before "uint8_t" ../../include/libradius.h:293: error: syntax error before '*' token ../../include/libradius.h:293: error: syntax error before "uint8_t" ../../include/libradius.h:293: warning: data definition has no type or storage class ../../include/libradius.h:318: error: syntax error before "uint32_t" ../../include/libradius.h:328: error: syntax error before "lrad_rand" ../../include/libradius.h:328: warning: data definition has no type or storage class In file included from rlm_counter.c:34: ../../include/radiusd.h:11:22: radpaths.h: No such file or directory In file included from rlm_counter.c:34: ../../include/radiusd.h:26: error: syntax error before "child_pid_t" ../../include/radiusd.h:26: warning: data definition has no type or storage class In file included from ../../include/radiusd.h:38, from rlm_counter.c:34: ../../include/missing.h:12: error: conflicting types for 'strncasecmp' /usr/include/strings.h:53: error: previous declaration of 'strncasecmp' was here ../../include/missing.h:12: error: conflicting types for 'strncasecmp' /usr/include/strings.h:53: error: previous declaration of 'strncasecmp' was here ../../include/missing.h:16: error: conflicting types for 'strcasecmp' /usr/include/strings.h:52: error: previous declaration of 'strcasecmp' was here ../../include/missing.h:16: error: conflicting types for 'strcasecmp' /usr/include/strings.h:52: error: previous declaration of 'strcasecmp' was here In file included from rlm_counter.c:34: ../../include/radiusd.h:56: error: syntax error before "uint32_t" ../../include/radiusd.h:67: error: syntax error before "child_pid_t" ../../include/radiusd.h:105: error: syntax error before "uint32_t" ../../include/radiusd.h:108: error: syntax error before "u_char" ../../include/radiusd.h:117: error: syntax error before "uint32_t" ../../include/radiusd.h:128: error: syntax error before "uint32_t" ../../include/radiusd.h:171: error: syntax error before "uint32_t" ../../include/radiusd.h:181: error: syntax error before "uint32_t" ../../include/radiusd.h:277: error: syntax error before "expiration_seconds" ../../include/radiusd.h:277: warning: data definition has no type or storage class ../../include/radiusd.h:292: error: syntax error before "nasaddr" ../../include/radiusd.h:294: error: syntax error before "uint32_t" ../../include/radiusd.h:325: error: syntax error before "ipno" ../../include/radiusd.h:326: error: syntax error before "ipno" ../../include/radiusd.h:332: error: syntax error before "ipno" ../../include/radiusd.h:334: error: syntax error before "ipno" ../../include/radiusd.h:342: error: syntax error before "ipno" ../../include/radiusd.h:343: error: syntax error before "ipno" ../../include/radiusd.h:345: error: syntax error before "uint32_t" ../../include/radiusd.h:410: error: syntax error before "rad_fork" ../../include/radiusd.h:410: warning: data definition has no type or storage class ../../include/radiusd.h:411: error: syntax error before "rad_waitpid" ../../include/radiusd.h:411: error: syntax error before "pid" ../../include/radiusd.h:411: warning: data definition has no type or storage class ../../include/radiusd.h:412: error: syntax error before "pid" rlm_counter.c: In function `counter_cmp': rlm_counter.c:156: error: structure has no member named `strvalue' rlm_counter.c:167: error: structure has no member named `lvalue' rlm_counter.c: In function `reset_db': rlm_counter.c:223: error: `errno' undeclared (first use in this function) rlm_counter.c:223: error: (Each undeclared identifier is reported only once rlm_counter.c:223: error: for each function it appears in.) rlm_counter.c: In function `counter_instantiate': rlm_counter.c:466: error: `errno' undeclared (first use in this function) rlm_counter.c: In function `counter_accounting': rlm_counter.c:556: error: structure has no member named `lvalue' rlm_counter.c:567: error: structure has no member named `strvalue' rlm_counter.c:593: error: structure has no member named `lvalue' rlm_counter.c:604: error: structure has no member named `lvalue' rlm_counter.c:605: error: structure has no member named `lvalue' rlm_counter.c:632: error: structure has no member named `strvalue' rlm_counter.c:635: error: structure has no member named `strvalue' rlm_counter.c:643: error: structure has no member named `strvalue' rlm_counter.c:655: error: structure has no member named `strvalue' rlm_counter.c:659: error: structure has no member named `strvalue' rlm_counter.c:661: error: structure has no member named `strvalue' rlm_counter.c:676: error: structure has no member named `lvalue' rlm_counter.c:676: error: structure has no member named `lvalue' rlm_counter.c:683: error: structure has no member named `lvalue' rlm_counter.c:693: error: structure has no member named `strvalue' rlm_counter.c: In function `counter_authorize': rlm_counter.c:769: error: structure has no member named `strvalue' rlm_counter.c:779: error: structure has no member named `strvalue' rlm_counter.c:794: error: structure has no member named `lvalue' rlm_counter.c:795: error: structure has no member named `lvalue' rlm_counter.c:823: error: structure has no member named `lvalue' rlm_counter.c:827: error: structure has no member named `lvalue' rlm_counter.c:828: error: structure has no member named `lvalue' rlm_counter.c:834: error: structure has no member named `lvalue' rlm_counter.c:843: error: structure has no member named `strvalue' rlm_counter.c:843: error: structure has no member named `lvalue' rlm_counter.c:845: error: structure has no member named `strvalue' rlm_counter.c:865: error: structure has no member named `strvalue' rlm_counter.c:865: error: structure has no member named `lvalue' gmake: *** [rlm_counter.o] Error 1 Any suggestions? Thanks! Lisa Casey

3 2

RE:Configuring freeRADIUS and NAS
by Sean 07 Dec '05

07 Dec '05

Hi, I use Linksys WRT54G Routers and I suggest that you check out DD-WRT firmware. It includes Chillispot and is easy to setup. I've posted a tutorial here http://swarmhotspots.com/faq.html BTW the new WRT54G (Release 5 Firmware) uses VxWorks and not Linux anyone needing to use third party firmware like DD-WRT should buy WRT54GL instead. I hope this helps. Regards, Sean Bracken

1 0

radius server reply
by Dinil Divakaran 07 Dec '05

07 Dec '05

Greetings !! I am using freeradius 1.0.4 server. I am trying to achieve the following. The radius client is supposed to send username, password and a text (say, abc). The server is supposed to authenticate using the system /etc/passwd and shadow (which it does currently). Apart from this the server should take the text and find another matching text (abc -> xyz). If such a matching entry exists, the radius server should send the matching text (xyz, here) along with the Access packet, or else it should send Access Reject packet. This can be achieved if we are able to define new attributes (like `Framed-IP-Address'), in which case we can add an entry Check-Item="abc", Reply-Item="xyz" for a user in the users file. But, unfortunately there are no user-defined attributes that are permitted ! Is there any other way to get this done ? Thanks in advance. - Dinil

2 2

Configuring freeRADIUS and NAS
by Madhuraka Godahewa 07 Dec '05

07 Dec '05

Hi All, First of all, let me thank for all those, who helped me to configure the freeRADIUS server. I have installed freeRADIUS 1.0.5 recently and configured it. I tested the server using RADIUS Test Client utility from IEA Software and it works well (both for authentication and accounting). Then, I configured a LinkSys WRT54G as a NAS and I configure it to make use of the freeRADIUS server to authenticate users. Now I can connect to the network using an XP Supplicant through the LinkSys WRT54G after authenticating through the RADIUS server (using PEAP). Now, I have a problem with the Session-Timeout attribute. With the Access- Accept packet, I send the Session-Timeout and Terminate-Action attributes to the NAS, but the NAS does not terminate the session as specified in the Session- Terminate parameter. And the NAS does not send any Account-Start or Account- Stop packets to the RADIUS server. Is this a problem with the configuration of the NAS or is it a limitation of the NAS? Have any body tried using LinkSys WRT54G as the NAS to do RADIUS accounting? I use the orginal firmware, which comes with the WRT54G. Thanking You., -------------------------------------------------------------------------------- Madhuraka Godahewa Telecommunications Engineer Research and Development Unit Electroteks Global Networks (Pvt.) Ltd. Mobile: + 94-777-647055

2 1