- Freeradius-Users - lists.freeradius.org

Radclient Queries
by Himanshu Pandey 19 Sep '14

19 Sep '14

Dear Friends,As suggested I went through the code of freeradius thoroughly and developed a reasonable understanding of the same. Now I want to do a practical exercise:Using radclient I want to create and send a dummy request to user module in order to take it's statistics.I would like to store username & password in a file.Please tell me what all steps do I have to perform in order to test the above scenario. Meaning which all files do I have to modify and how to perform the testing.Thanks in advance.Sonu From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Sent: Fri, 19 Sep 2014 00:27:57 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius Queries > Fine I will go through the code thoroughly now. Good luck. As Alan said, if you have a specific need to modify the code then tell us what it is and we can advise you on the best way to achieve what you want. > One question that I have is how AVPs (Attribute Value Pairs) are stored in memory in freeradius. http://doc.freeradius.org/libradius_8h.html#structVALUE__PAIR They're stored in the above structure, and alloced on the heap at run time. They're parented from either the REQUEST struct, or from a RADIUS_PACKET struct to ensure they're cleaned up when the REQUEST is freed. Fixed length values are stored in the value_data_t union, octets, text and tlv attributes have dynamically allocated buffers parented off the VALUE_PAIR. These buffers are pointed to by the value_data_t union. VALUE_PAIRs are always allocated with pairalloc, and are freed using talloc_free or pairfree (if you need to free a linked list of AVPs). The vendor, number and type of attributes are in the DICT_ATTR struct. These are usually allocated on startup when reading the config and dictionaries. The da field of the VALUE_PAIR struct points to a DICT_ATTR struct. VALUE_PAIR (text, octets, tlv) buffers should be considered immutable. If a new value needs to be assigned, the old buffer is freed and a new one allocated. talloc_free performs all necessary cleanup for VALUE_PAIRs. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: help! Windows Phone8.1 access authentication failed
by Farrell Yang 19 Sep '14

19 Sep '14

Thanks for Alan's reply, but it do not work. I did this "use unlang to make SQL-User-Name have the username without the "Windows Phone\" part" like the following : if ("%{request:User-Name}" =~ /^(.*)\\(.*)/) { update request { User-Name := "%{2}" Realm := "%{1}" } } in the authorize section and this had no effect. Thus I think the problem doesn't exist in the mismatch of username between FR and Mysql, maybe the FR's processing for realm like "Windows Phone\" has something wrong.

2 1

rlm_perl multiple processes/threads behavior
by Nick Rogers 19 Sep '14

19 Sep '14

Hello, I am hoping someone can clarify some questions I have about how rlm_perl should behave in FreeRADIUS 2.2.5 with respect to multiple instances and freeradius threads. I know there has been some discussion and changes/fixes to this behavior over the years, and I've been using rlm_perl successfully for nearly the last decade. Previously rlm_perl had its own "thread" pool, where multiple instances of the perl process would run simultaneously. Now I understand that rlm_perl uses the same freeradius thread management that everything else does. My problem is that my freeradius rlm_perl installation no longer spawns multiple instances of the perl process, effectively causing my server to be single threaded, which has begun to cause performance issues at some of my larger sites with increased load. I do not have perl with multiplicity or ithreads compiled, as this causes issues with other perl applications running on the same server. My question is, is there a way to support multiple instances of the rlm_perl interpreter without having ithreads or multiplicity compiled with perl? Is there a way for freeradius to simply launch a perl process for every freeradius server thread, instead of all threads relying on the same rlm_perl process? I am not interested in using perl threads or having multiple perl interpreters within the same perl process. I would really appreciate some clarification if this is possible or not. Thanks! -Nick

3 7

Re: Freeradius Queries
by Arran Cudbard-Bell 18 Sep '14

18 Sep '14

> Fine I will go through the code thoroughly now. Good luck. As Alan said, if you have a specific need to modify the code then tell us what it is and we can advise you on the best way to achieve what you want. > One question that I have is how AVPs (Attribute Value Pairs) are stored in memory in freeradius. http://doc.freeradius.org/libradius_8h.html#structVALUE__PAIR They're stored in the above structure, and alloced on the heap at run time. They're parented from either the REQUEST struct, or from a RADIUS_PACKET struct to ensure they're cleaned up when the REQUEST is freed. Fixed length values are stored in the value_data_t union, octets, text and tlv attributes have dynamically allocated buffers parented off the VALUE_PAIR. These buffers are pointed to by the value_data_t union. VALUE_PAIRs are always allocated with pairalloc, and are freed using talloc_free or pairfree (if you need to free a linked list of AVPs). The vendor, number and type of attributes are in the DICT_ATTR struct. These are usually allocated on startup when reading the config and dictionaries. The da field of the VALUE_PAIR struct points to a DICT_ATTR struct. VALUE_PAIR (text, octets, tlv) buffers should be considered immutable. If a new value needs to be assigned, the old buffer is freed and a new one allocated. talloc_free performs all necessary cleanup for VALUE_PAIRs. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

help! Windows Phone8.1 access authentication failed
by Farrell Yang 18 Sep '14

18 Sep '14

I'm running FreeRADIUS Version 2.2 and Mysql for VPN access authentication on ubuntu 14.04, the Windows Phone8.1 clients send username as *Windows Phone\username*, the Mysql radcheck table doesn't include *Windows Phone\*, so access authentication failed. I 've googled this issue, and haven't found anything that worked. I have tried the methods in this post: http://lists.freeradius.org/pipermail/freeradius-users/2011-March/052650.ht…, but problem still exists.

3 2

Re: Freeradius Queries
by Himanshu Pandey 18 Sep '14

18 Sep '14

Hi Alan, Fine I will go through the code thoroughly now. One question that I have is how AVPs (Attribute Value Pairs) are stored in memory in freeradius. Thanks & Regards,Sonu From: Alan DeKok <aland(a)deployingradius.com> Sent: Thu, 18 Sep 2014 21:46:11 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius Queries Himanshu Pandey wrote: > If you could please answer the following 3 questions, it would be of > great help:  What helps more is to read the code.  I'm sorry, but this list isn't the palce to learn C programming. Anyone familiar with C programming should be able to read the code, and understand what it's doing.  If you're just trying to understand the code for fun, you need to figure it out yourself.  If you're doing it because you need to write some patches, describe the goal, and ask how to implement it.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: using userPassword instead sambaNTPassword
by Nicolás Guerra 18 Sep '14

18 Sep '14

this is the server log output: # radiusd -X > log.radius I don't understand what "**WARNING: No "known good" password was found in LDAP. Are you sure that *the **user is configured correctly?*" means? what is freeradius expecting from the openldap user's configuration? and, why if I enter sambaNTPassword works fine? Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.202.10.93 port 60123, id=47, length=165 User-Name = "nicolas.guerra" Called-Station-Id = "A0-F3-C1-CF-E3-06:OpenWrt" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "CC-FE-3C-92-E0-1B" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x02dc0013016e69636f6c61732e677565727261 Message-Authenticator = 0xb415d249f91323467312cdea8bd9ff84 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "nicolas.guerra", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 220 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for nicolas.guerra [ldap] expand: (uid=%u) -> (uid=nicolas.guerra) [ldap] expand: ou=People,ou=Users,dc=asse -> ou=People,ou=Users,dc=asse [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap:389, authentication 0 [ldap] bind as / to ldap:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=People,ou=Users,dc=asse, with filter (uid=nicolas.guerra) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... *WARNING: No "known good" password was found in LDAP. Are you sure that the **user is configured correctly?** *[ldap] user nicolas.guerra authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop *[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.** *++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 47 to 10.202.10.93 port 60123 EAP-Message = 0x01dd001604107fe91282f5b1fe93fa0490f7444fb1f6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x02a12214027c2680a4308d96285f86cc Finished request 0. any help woould be wellcome, Sds Nicolas.

2 1

Re: Freeradius Queries
by Alan DeKok 18 Sep '14

18 Sep '14

Himanshu Pandey wrote: > If you could please answer the following 3 questions, it would be of > great help: What helps more is to read the code. I'm sorry, but this list isn't the palce to learn C programming. Anyone familiar with C programming should be able to read the code, and understand what it's doing. If you're just trying to understand the code for fun, you need to figure it out yourself. If you're doing it because you need to write some patches, describe the goal, and ask how to implement it. Alan DeKok.

1 0

Re: Freeradius Queries
by Himanshu Pandey 18 Sep '14

18 Sep '14

Dear Alan, Thanks for the response. If you could please answer the following 3 questions, it would be of great help:I am not able to understand these concepts. 1. What is the role of configuration item linked list? 2. How is the linked list and Red-Black trees associated with each other.3. How the structures conf_item and conf_part are related to each other struct conf_item {         struct conf_item *next;         struct conf_part *parent;         int lineno;         const char *filename;         CONF_ITEM_TYPE type;     }; struct conf_part {         CONF_ITEM item;         const char *name1;         const char *name2;         struct conf_item *children;         struct conf_item *tail; /* for speed */         CONF_SECTION    *template;         rbtree_t        *pair_tree; /* and a partridge.. */         rbtree_t        *section_tree; /* no jokes here */         rbtree_t        *name2_tree; /* for sections of the same name2 */         rbtree_t        *data_tree;         void            *base;         int depth;         const CONF_PARSER *variables; }; Thanks in advance.Regards,Sonu From: Alan DeKok <aland(a)deployingradius.com> Sent: Thu, 18 Sep 2014 19:07:48 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius Queries Himanshu Pandey wrote: > I am very new to freeradius and right now I am going through the code of >  freeradius. I am facing problem to understand a couple of concepts. > They are: > > 1. What is the overall architecture of Freeradius?  Complicated.  We don't really have an architecture diagram.  For detailed API docs, see http://doc.freeradius.org/  As for the rest of your questions, they are both too vague and too specific.  The main reason to ask questions is to solve a particular problem.  You're asking a series of vague questions "how does it work", along with detailed questions "why is it done this way".  They're all nice questions, but they can usually be answered by reading the source.  The code is VERY well commented.  I see no reason to cut & paste those comments here.  Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Freeradius Queries
by Alan DeKok 18 Sep '14

18 Sep '14

Himanshu Pandey wrote: > I am very new to freeradius and right now I am going through the code of > freeradius. I am facing problem to understand a couple of concepts. > They are: > > 1. What is the overall architecture of Freeradius? Complicated. We don't really have an architecture diagram. For detailed API docs, see http://doc.freeradius.org/ As for the rest of your questions, they are both too vague and too specific. The main reason to ask questions is to solve a particular problem. You're asking a series of vague questions "how does it work", along with detailed questions "why is it done this way". They're all nice questions, but they can usually be answered by reading the source. The code is VERY well commented. I see no reason to cut & paste those comments here. Alan DeKok.

1 0