freeradius developer list

Alan DeKok | 1 Nov 2006 05:40

Re: Re : Re : Bug on Accouting-Requests proxying

Geoffroy Arnoud <garnoud <at> yahoo.co.uk> wrote:

> I agree on this. Nevertheless (correct me if I'm wrong), when
> FreeRADIUS acts as a proxy, it can be synchronous or asynchronous,
> right?

  Yes, but I'm starting to think that's wrong.  The server should just
act synchronously.  It's a LOT easier on the server, and can't be
wrong...

> We need to set different timeout and retransmit per realm (customer
> request / patch under contruction).
> Using NAS restransmissions as you suggest supposes to be
> synchronous, but we need asynchronous behaviour (different TO /
> retries per realm - independant from the client).

  Why?  OK, the customers request it, that's nice... but why?  What
problem do they think it solves?

  I really don't think per-realm asynchronous retransmits help.  I
just don't see why they would matter to the home server.  Retransmits
matter to the NAS, but the NAS controls it's retransmissions...

> Using radrelay may prove to be interesting, but was not considered
> useful because, at design time, we thought FreeRADIUS did respect RFC
> regarding retransmissions of accounting requests. Maybe in a future
> release of the project, we can think about using radrelay, but not for the
> moment.

  So maintain local patches.

(Continue reading)

Automatic cvs log generator | 1 Nov 2006 10:03

Automatic report from sources (radiusd) between 31.10.2006 - 01.11.2006 GMT

CVS log entries from 31.10.2006 (Tue) 09:00:01 - 01.11.2006 (Wed) 09:00:01 GMT
=====================================================
Summary by authors
=====================================================
Author: pnixon
	File: radiusd/raddb/sql/postgresql-voip-postpaid.conf; Revisions: 1.2
	File: radiusd/raddb/sql/postgresql-dialup.conf; Revisions: 1.2

=====================================================
Log entries
=====================================================
Description:
This was a BUG. Acct-Delay-Time can be subtracted from the time of arrival on the server to find the
approximate time of the event generating this Accounting-Request. I must NOT be subtracted from the Session-Time!
Modified files:
	File: radiusd/raddb/sql/postgresql-dialup.conf; Revision: 1.2;
	Date: 2006/10/31 14:38:42; Author: pnixon; Lines:  (+2 -3)
-------------------------------
Description:
All tables should start with "rad"
Modified files:
	File: radiusd/raddb/sql/postgresql-voip-postpaid.conf; Revision: 1.2;
	Date: 2006/10/31 15:00:10; Author: pnixon; Lines:  (+1 -1)
=====================================================
Summary of modified files
=====================================================
File: radiusd/raddb/sql/postgresql-dialup.conf
Revisions: 1.2
Authors: pnixon (+2 -3)
-------------------------------

(Continue reading)

Geoffroy Arnoud | 2 Nov 2006 09:20

Picon

RE : Re: Re : Re : Bug on Accouting-Requests proxying

>   Why?  OK, the customers request it, that's nice...
> but why?  What
> problem do they think it solves?
> 
>   I really don't think per-realm asynchronous
> retransmits help.  I
> just don't see why they would matter to the home
> server.  Retransmits
> matter to the NAS, but the NAS controls it's
> retransmissions...

I agree with you, and we explained them that allowing
bigger TO/retries on proxy to address slow Home AAA
won't have any result, because the NAS is the one that
controls end-users' traffic.
It's just that we are migrating their AAA proxy from
an existing non-free RADIUS server to FreeRADIUS, and
they want to keep the same features. 

Anyway. We will do the job for the migration with 
1.1.3 and some locally maintained patches. Next we
will see how FreeRADIUS evolves, and take it into
consideration for next releases.

Thanks

Geof.

(Continue reading)

Automatic cvs log generator | 5 Nov 2006 10:03

Automatic report from sources (radiusd) between 04.11.2006 - 05.11.2006 GMT

CVS log entries from 04.11.2006 (Sat) 09:00:01 - 05.11.2006 (Sun) 09:00:01 GMT
=====================================================
Summary by authors
=====================================================
Author: nbk
	File: radiusd/man/man8/radsqlrelay.8; Revisions: 1.3
	File: radiusd/scripts/radsqlrelay; Revisions: 1.7

=====================================================
Combined list of identical log entries
=====================================================
Description:
	Add a new "-f" option to read the password from a file,
	instead of command line. (closes: #395)
	Thanks to Jakub Wartak <vnull <at> pcnet.com.pl>
Modified files:
	File: radiusd/man/man8/radsqlrelay.8; Revision: 1.3;
	Date: 2006/11/04 12:58:14; Author: nbk; Lines: (+4 -0)
	File: radiusd/scripts/radsqlrelay; Revision: 1.7;
	Date: 2006/11/04 12:58:14; Author: nbk; Lines: (+15 -3)
=====================================================
Log entries
=====================================================
=====================================================
Summary of modified files
=====================================================
File: radiusd/man/man8/radsqlrelay.8
Revisions: 1.3
Authors: nbk (+4 -0)
-------------------------------

(Continue reading)

Juan C. Sanchez-DelBarrio | 6 Nov 2006 12:13

Picon

Suggest the following patch for LDAP+EAP-TTLS+PAP+CRYPT

Hi all,

I propose the following patch to use EAP-TTLS+PAP+LDAP with CRYPT
PASSWORD. This feature would permit us to cipher the plain password in
LDAP using CRYPT hash and compare the CRYPT hash of user password from
LDAP with PAP authentication (crypt).

Best Regards,
-- 
Juan C. Sanchez-DelBarrio
Security Officer
Barcelona Supercomputing Center
http://www.bsc.es

Attachment (freeradius-1.1.3-crypt-ldap.patch): text/x-patch, 808 bytes

Hi all,

I propose the following patch to use EAP-TTLS+PAP+LDAP with CRYPT
PASSWORD. This feature would permit us to cipher the plain password in
LDAP using CRYPT hash and compare the CRYPT hash of user password from
LDAP with PAP authentication (crypt).

Best Regards,
--

-- 
Juan C. Sanchez-DelBarrio
Security Officer
Barcelona Supercomputing Center
http://www.bsc.es

(Continue reading)

Automatic cvs log generator | 6 Nov 2006 10:03

Automatic report from sources (radiusd) between 05.11.2006 - 06.11.2006 GMT

CVS log entries from 05.11.2006 (Sun) 09:00:01 - 06.11.2006 (Mon) 09:00:02 GMT
=====================================================
Summary by authors
=====================================================
Author: nbk
	File: radiusd/doc/rlm_sqlcounter; Revisions: 1.5
	File: radiusd/man/man5/rlm_counter.5; Revisions: 1.2
	File: radiusd/man/man5/rlm_attr_filter.5; Revisions: 1.3
	File: radiusd/raddb/radiusd.conf.in; Revisions: 1.235
	File: radiusd/src/modules/rlm_sqlcounter/rlm_sqlcounter.c; Revisions: 1.30
	File: radiusd/src/modules/rlm_counter/rlm_counter.c; Revisions: 1.54
	File: radiusd/src/modules/rlm_attr_filter/rlm_attr_filter.c; Revisions: 1.31

=====================================================
Combined list of identical log entries
=====================================================
Description:
	Document the new "reply-name" directive.
Modified files:
	File: radiusd/doc/rlm_sqlcounter; Revision: 1.5;
	Date: 2006/11/05 19:56:40; Author: nbk; Lines: (+3 -0)
	File: radiusd/man/man5/rlm_counter.5; Revision: 1.2;
	Date: 2006/11/05 19:56:39; Author: nbk; Lines: (+4 -0)
	File: radiusd/raddb/radiusd.conf.in; Revision: 1.235;
	Date: 2006/11/05 19:56:40; Author: nbk; Lines: (+8 -6)
=====================================================
Log entries
=====================================================
Description:
	Add "post-auth" to the list of valid sections for this module.

(Continue reading)

Juan C. Sanchez-DelBarrio | 6 Nov 2006 10:09

Picon

Another patch for X509 validation

Hi again,

I follow with the idea of the other developer. In our organization, we
need that you can filter not only using check_cert_cn if not using
organizational-unit (O) of the DN. Firstly, we propose the following
patch using external script where you can define your own filter.

Best Regards,
-- 
Juan C. Sanchez-DelBarrio
Security Officer
Barcelona Supercomputing Center
http://www.bsc.es

Attachment (freeradius-1.1.3-1.0_x509.patch): text/x-patch, 8 KiB

Hi again,

I follow with the idea of the other developer. In our organization, we
need that you can filter not only using check_cert_cn if not using
organizational-unit (O) of the DN. Firstly, we propose the following
patch using external script where you can define your own filter.

Best Regards,
--

-- 
Juan C. Sanchez-DelBarrio
Security Officer
Barcelona Supercomputing Center
http://www.bsc.es

(Continue reading)

Daniel Larsson | 6 Nov 2006 11:48

Re: Suggest the following patch for LDAP+EAP-TTLS+PAP+CRYPT

> Best Regards,
>  =20
> -----------------------------------------------------------------------=
-
>
> diff -urN ./src/modules/rlm_ldap/rlm_ldap.c ../freeradius-1.1.3-crypt-l=
dap/src/modules/rlm_ldap/rlm_ldap.c
> --- ./src/modules/rlm_ldap/rlm_ldap.c	2006-05-09 01:45:49.000000000 +02=
00
> +++ ../freeradius-1.1.3-crypt-ldap/src/modules/rlm_ldap/rlm_ldap.c	2006=
-07-18 16:24:42.734009032 +0200
>  <at>  <at>  -2511,6 +2511,15  <at>  <at> 
>  					DEBUG("rlm_ldap: Attribute %s has no value", element->attr);
>  					continue;
>  				}
> +			=09
> +				if (value[0] =3D=3D '{' && !strcmp(element->attr, "userPassword"))=
 {
> +					char *aux_value =3D strstr(value, "}");
> +					if (aux_value) {=09
> +						aux_value++;
> +						value =3D aux_value;=09
> +					}
> +					DEBUG("rlm_ldap: Delete {CRYPT} from attribute %s", element->attr=
);		=09
> +				}
> =20
>  				DEBUG("rlm_ldap: Adding LDAP attribute %s as RADIUS attribute %s %=
s %s",
>  				      element->attr, element->radius_attr,

(Continue reading)

Alan DeKok | 6 Nov 2006 16:40

Re: Suggest the following patch for LDAP+EAP-TTLS+PAP+CRYPT

"Juan C. Sanchez-DelBarrio" <carlos.sanchez <at> bsc.es> wrote:
> I propose the following patch to use EAP-TTLS+PAP+LDAP with CRYPT
> PASSWORD. This feature would permit us to cipher the plain password in
> LDAP using CRYPT hash and compare the CRYPT hash of user password from
> LDAP with PAP authentication (crypt).

  Why?  The server already supports pulling the crypt'd password from
LDAP, and comparing it to the users password via rlm_ldap.

  Alan DeKok.
--
  http://deployingradius.com       - The web site of the book
  http://deployingradius.com/blog/ - The blog

Alan DeKok | 6 Nov 2006 16:43

Re: Another patch for X509 validation

"Juan C. Sanchez-DelBarrio" <carlos.sanchez <at> bsc.es> wrote:
> I follow with the idea of the other developer. In our organization, we
> need that you can filter not only using check_cert_cn if not using
> organizational-unit (O) of the DN. Firstly, we propose the following
> patch using external script where you can define your own filter.

  Ok...

> +ATTRIBUTE       X509-Subject                            1102    string
> +ATTRIBUTE       X509-Issuer                             1103    string
...
> +#define PW_X509_SUBJECT			1100
> +#define	PW_X509_ISSUER			1101

  That's a typo.

  It looks interesting, though.

  Alan DeKok.
--
  http://deployingradius.com       - The web site of the book
  http://deployingradius.com/blog/ - The blog

Group

gmane.comp.freeradius.devel.

Project Web Page

freeradius developer list

Search Archive

Page

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12

Articles in period: 114

November 2006

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

Commit report for master branch (18 May 2013)
Commit report for master branch (17 May 2013)
More additions to unlang (16 May 2013)
Commit report for master branch (16 May 2013)
MODULE DEV: Problem adding an attribute to access-accept message (15 May 2013)
Commit report for master branch (15 May 2013)
How to convert the Reply-Message as challenge (14 May 2013)
Commit report for master branch (14 May 2013)
Commit report for v2.x.x branch (14 May 2013)
bugfix (13 May 2013)
ASSERT FAILED (13 May 2013)
Commit report for master branch (13 May 2013)
Freeradius-Devel Digest, Vol 97, Issue 15tz (12 May 2013)
rad_unlockfd (12 May 2013)
Commit report for master branch (12 May 2013)
New feature in v3: cast! (11 May 2013)
Commit report for v2.x.x branch (11 May 2013)
Commit report for master branch (11 May 2013)
Commit report for v2.x.x branch (10 May 2013)
Commit report for master branch (10 May 2013)
Commit report for master branch (9 May 2013)

Archives

117	May 2013
101	April 2013
132	March 2013
180	February 2013
90	January 2013
166	December 2012
104	November 2012
135	October 2012
146	September 2012
61	August 2012
19	July 2012
50	June 2012
44	May 2012
25	April 2012
12	March 2012
78	February 2012
99	January 2012
9	December 2011
96	November 2011
128	October 2011
69	September 2011
69	August 2011
90	July 2011
104	June 2011
99	May 2011
38	April 2011
69	March 2011
17	February 2011
52	January 2011
41	December 2010
64	November 2010
18	October 2010
46	September 2010
44	August 2010
31	July 2010
52	June 2010
45	May 2010
66	April 2010
28	March 2010
113	February 2010
19	January 2010
67	December 2009
30	November 2009
53	October 2009
103	September 2009
122	August 2009
55	July 2009
36	June 2009
64	May 2009
81	April 2009
98	March 2009
85	February 2009
79	January 2009
22	December 2008
26	November 2008
51	October 2008
60	September 2008
53	August 2008
53	July 2008
44	June 2008
50	May 2008
63	April 2008
60	March 2008
43	February 2008
93	January 2008
57	December 2007
111	November 2007
84	October 2007
107	September 2007
142	August 2007
236	July 2007
77	June 2007
211	May 2007
95	April 2007
119	March 2007
116	February 2007
114	January 2007
36	December 2006
114	November 2006
90	October 2006
146	September 2006
196	August 2006
88	July 2006
100	June 2006
90	May 2006
115	April 2006
92	March 2006
114	February 2006
195	January 2006
86	December 2005
101	November 2005
101	October 2005
150	September 2005
162	August 2005
79	July 2005
106	June 2005
144	May 2005
112	April 2005
171	March 2005
99	February 2005
80	January 2005
8	December 2004

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template