Re: 0.9.3 has been released

On Fri, Nov 21, 2003 at 09:12:31AM -0600, Nick Davis wrote: > On Thursday 20 November 2003 20:07, Paul Hampson wrote: > > As a bonus, the rlm_ippool pod2man call got fixed for perl < 5.6, and > > rlm_eap has been silenced in the case where it is called upon a non-EAP > > packet. > > > > There are p

Re: 093 Crashes with unknown tokens

On Fri, 21 Nov 2003, Matt Sapp wrote: > Personally, I don't see how the users file being in proper shape is any > less critical than any other configuration file being correct. You'd be > much better off implementing some solution to make sure the users file > is correct (perhaps some type checki

Re: 093 Crashes with unknown tokens

Greg, While you may have misunderstood Alan's terseness as him being nasty to you, please look at the situation. You're saying that if there was a configuration file error, then by all means, stop the server, but if it's "just" a users file error, then it shouldn't be halted and the server sho

Re: Freeradius, EAP-TTLS, and OpenSSL questions

> See scripts/CA.all Ran this, and it appears that everything worked right up until the end, when I got these errors: Certificate is to be certified until Nov 20 23:34:06 2004 GMT (365 days) Sign the certificate? [y/n]:y failed to update database TXT_DB error number 2 + openssl pkcs12 -export

Re: Freeradius, EAP-TTLS, and OpenSSL questions

Chris Woodfield <[EMAIL PROTECTED]> wrote: > 1. EAP-TTLS is dependent on EAP-TLS, which requires a server cert. So > far, I've been unable to successfully create a cert that freeradius > likes. In the radiusd.conf file, there's an certificate_file argument, > along with a CA_file argument. My under

Freeradius, EAP-TTLS, and OpenSSL questions

Hello, I'm trying to set up a radius server here in my office to permit WLAN usage, and I really feel like I'm coming up against my limits of understanding on the technologies involved. I've successfully compiled yesterday's CVS release which include EAP-TTLS support, but I'm running into so

Re: 093 Crashes with unknown tokens

Alan DeKok wrote: Greg G <[EMAIL PROTECTED]> wrote: It does, but not what you'd hoped. It looks like I'm going to wind up using GNU Radius, because it *doesn't* exit when it encounters something it doesn't understand in the user file. It discards the entry for the invalid

Re: 093 Crashes with unknown tokens

Greg G wrote: Nothing is unclear about it. I would prefer that the daemon not fail out if there's a data error in one of the files. It should report that error to a log and continue on. Otherwise, it becomes a fairly trivial task to crash out the daemon. Our users file is fairly dynamic an

Re: 093 Crashes with unknown tokens

Greg G <[EMAIL PROTECTED]> wrote: >It does, but not what you'd hoped. It looks like I'm going to wind > up using GNU Radius, because it *doesn't* exit when it encounters > something it doesn't understand in the user file. It discards the entry > for the invalid user. Meaning that the se

Re: 093 Crashes with unknown tokens

Alan DeKok wrote: Greg G <[EMAIL PROTECTED]> wrote: Ah, yes. The "you've got to do what I want NOW for FREE!" response. No, it's the "Hey, asshole, maybe you know the code better than I do" reponse. I *do* know the code better than you,

Re: 0.9.3 freezing

I got this problem sorted out. My prefix was defined wrong in radiusd.conf. I got another problem now. I cant seem to make freeradius use the proper myslq socket. In my.cnf I define it as /var/lib/mysql/mysql.sock. All other mysql apps work (the command line interface, mysqldump, etc etc)... Fr

Re: 093 Crashes with unknown tokens

Greg G <[EMAIL PROTECTED]> wrote: > > Ah, yes. The "you've got to do what I want NOW for FREE!" response. > > >No, it's the "Hey, asshole, maybe you know the code better than I do" > reponse. I *do* know the code better than you, and I disagree with your position. All else aside, that sh

RE: Can't get freeradius-0.9.3 compiled on Redhat 9

Title: Re: Can't get freeradius-0.9.3 compiled on Redhat 9 Oh, I just now read this email you send. Let me first try this before you put extra effort in it. I do have the right openssl RPM's so it might work. I'll let you know.   Cheers,   Seb -Original Message-From: Kaczmarek, Tha

Re: 0.9.3 freezing

I just installed 0.9.3 on our secondary RADIUS server and ran into something a bit weird... I had freeradius installed on it before and it worked fine... Now when I try to run it with the newly installed version, this happens: [EMAIL PROTECTED] radius]# /usr/sbin/radiusd Fri Nov 21 18:53:05 200

Re: 093 Crashes with unknown tokens

Alan DeKok wrote: Greg G <[EMAIL PROTECTED]> wrote: Well exuse the hell out of me for not having worked with open source stuff before. You've got a great bedside manner, ya know. Ah, yes. The "you've got to do what I want NOW for FREE!" response.    No, it's t

RE: Freeradius-Users digest, Vol 1 #2549 - 10 msgs

Hi everyone. I an new to linux I was wondering if anyone has a static compiled version that I could use. thanks -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Friday, November 21, 2003 2:36 PM To: [EMAIL PROTECTED] Subject: Fre

Re: 0.9.3 has been released

On Fri, Nov 21, 2003, Alan DeKok wrote: >Bill Campbell <[EMAIL PROTECTED]> wrote: >> > For uint8_t arrays, The 'sizeof' the array is the number of elements. >> >> OK. While that may be the case for uint8_t, it seems to me that good >> coding practice is to use sizeof here and not depend on knowl

Re: 093 Crashes with unknown tokens

Greg G <[EMAIL PROTECTED]> wrote: >Well exuse the hell out of me for not having worked with open source > stuff before. You've got a great bedside manner, ya know. Ah, yes. The "you've got to do what I want NOW for FREE!" response. Perhaps you didn't understand my explanations as to wh

Re: 093 Crashes with unknown tokens

   Well exuse the hell out of me for not having worked with open source stuff before.  You've got a great bedside manner, ya know. -Greg G Alan DeKok wrote: Greg G <[EMAIL PROTECTED]> wrote: I may have to, but I can't do that short-term. I really need a radius server that

Re: 093 Crashes with unknown tokens

Greg G <[EMAIL PROTECTED]> wrote: >I may have to, but I can't do that short-term. I really need a > radius server that I can force to re-read the users file on-demand. > FreeRadius seems to be able to do that, but isn't quite as stable as I'd > like. I've found that the SIGHUP will bring

Re: 093 Crashes with unknown tokens

Alan DeKok wrote: Greg G <[EMAIL PROTECTED]> wrote: Well, if I have one bad entry in a users file with 10,000 users in it, I'd rather it just ignore that user with the bad entry. Then use SQL.    I may have to, but I can't do that short-term.  I really need a ra

Re: What goes in acct_users & a seg fault

Chris Parker wrote: At 01:11 PM 11/21/2003, Greg G wrote: Chris Parker wrote: So, the packet being sent is an invalid accounting packet, as it doesn't contain NAS-IP-Address or NAS-Identifier. Nor a session-id. Now that's strange, because this packet is being sent from radclient. I tho

Re: Thanks out to Dave M and examples

Title: Re: Thanks out to Dave M and examples The lower case one is right :-) Ted On Fri, 2003-11-21 at 14:14, Kaczmarek, Thaddeus wrote: > joe-admin   Auth-Type := System > Acct-Authentic == RADIUS, > foundry-privilege-level = 0, > foundry-co

Re: 093 Crashes with unknown tokens

Greg G <[EMAIL PROTECTED]> wrote: >Well, if I have one bad entry in a users file with 10,000 users in > it, I'd rather it just ignore that user with the bad entry. Then use SQL. > > Then double check the files before you let the server use them. > >It's not the servers fault you made a mi

Re: 0.9.3 has been released

Bill Campbell <[EMAIL PROTECTED]> wrote: > > For uint8_t arrays, The 'sizeof' the array is the number of elements. > > OK. While that may be the case for uint8_t, it seems to me that good > coding practice is to use sizeof here and not depend on knowledge of the > internal size of the elements.

Re: What goes in acct_users & a seg fault

At 01:11 PM 11/21/2003, Greg G wrote: Chris Parker wrote: So, the packet being sent is an invalid accounting packet, as it doesn't contain NAS-IP-Address or NAS-Identifier. Nor a session-id. Now that's strange, because this packet is being sent from radclient. I thought I had seen it work in

Re: 093 Crashes with unknown tokens

>How would you recommend that I do that? The file will parse > correctly. And it's not something that should be a *fatal* mistake. > It's not really a mistake, either. We use some custom items now and > then. Then those items should go into a custom dictionary. -- --Mike --

Re: 093 Crashes with unknown tokens

Chris Parker wrote: Nothing is unclear about it. I would prefer that the daemon not fail out if there's a data error in one of the files. It should report that error to a log and continue on. Otherwise, it becomes a fairly trivial task to crash out the daemon. Our users file is fairly

Re: 0.9.3 install question

[EMAIL PROTECTED] wrote on 11/21/2003 01:04:25 PM: > [EMAIL PROTECTED] wrote: > > >$ cp ./raddb/dictionary /etc/raddb/dictionary > > > > But that note seems to contradict itself. It _seems_ as though it should > > say "please ensure that $prefix/etc/raddb/dictionary is the same as > >

Thanks out to Dave M and examples

Title: Thanks out to Dave M and examples joe-admin   Auth-Type := System     Acct-Authentic == RADIUS,     foundry-privilege-level = 0,     foundry-command-exception-flag = 1,     Cisco-AVPair = "shell:priv-lvl=0" joe-user    Auth-Type

Re: What goes in acct_users & a seg fault

Chris Parker wrote: At 12:39 PM 11/21/2003, Greg G wrote: I'm trying to figure out what goes into the acct_users. I had thought it was user entries like those in the users file, but that doesn't seem to really be the case. It appears to be getting parsed the same way (based on 'My-Key' ent

Re: 093 Crashes with unknown tokens

Alan DeKok wrote: Greg G <[EMAIL PROTECTED]> wrote: Nothing is unclear about it. I would prefer that the daemon not fail out if there's a data error in one of the files. It should report that error to a log and continue on. To doing what? Are you really askin

Re: 0.9.3 install question

[EMAIL PROTECTED] wrote: > >$ cp ./raddb/dictionary /etc/raddb/dictionary > > But that note seems to contradict itself. It _seems_ as though it should > say "please ensure that $prefix/etc/raddb/dictionary is the same as > /usr/local/share/freeradius/dictionary". No. It says to copy

Re: 0.9.3 has been released

On Fri, Nov 21, 2003, Alan DeKok wrote: >Bill Campbell <[EMAIL PROTECTED]> wrote: >> On a related security note, the src/lib/radius.c program has several >> references to msg_auth_vector and calc_auth_vector starting around line >> 1108 with several memcpy and memcmp operations, some of which refer

Re: 093 Crashes with unknown tokens

At 12:42 PM 11/21/2003, Greg G wrote: Alan DeKok wrote: Greg G <[EMAIL PROTECTED]> wrote: Here's what I get from FR 0.93 /usr/local/etc/raddb/users[9]: Parse error (reply) for entry 007gold: Unknown attribute My-Key Errors reading /usr/local/etc/raddb/users radiusd.conf[9

0.9.3 install question

I was still running FR 0.8, and because of yesterday's events, decided to go up to 0.93. I did the ./configure, make, make install dance. FR bombed when I tried to run radius, so I put it in debug mode, and saw messages about problems with the dictionary. Perused the INSTALL file, and saw thi

Re: What goes in acct_users & a seg fault

At 12:39 PM 11/21/2003, Greg G wrote: I'm trying to figure out what goes into the acct_users. I had thought it was user entries like those in the users file, but that doesn't seem to really be the case. It appears to be getting parsed the same way (based on 'My-Key' entries that get rejected)

Re: 093 Crashes with unknown tokens

Greg G <[EMAIL PROTECTED]> wrote: >Nothing is unclear about it. I would prefer that the daemon not fail > out if there's a data error in one of the files. It should report that > error to a log and continue on. To doing what? Are you really asking that the server send RADIUS responses w

Re: 093 Crashes with unknown tokens

Alan DeKok wrote: Greg G <[EMAIL PROTECTED]> wrote: Here's what I get from FR 0.93 /usr/local/etc/raddb/users[9]: Parse error (reply) for entry 007gold: Unknown attribute My-Key Errors reading /usr/local/etc/raddb/users radiusd.conf[921]: files: Module instantiation failed. An

Re: 0.9.3 has been released

At 12:26 PM 11/21/2003, Bill Campbell wrote: On Fri, Nov 21, 2003, Chris Parker wrote: >At 11:18 AM 11/21/2003, Bill Campbell wrote: >>On Fri, Nov 21, 2003, Alan DeKok wrote: >>>Oliver Graf <[EMAIL PROTECTED]> wrote: > With that said, 0.9.3 has been released. It's in the normal places:

What goes in acct_users & a seg fault

be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = xxx.xxx.xxx.xxx,NAS-IP-Address = xxx.xxx.xxx.xxx,,User-Name = "test1"' rlm_acct_unique: Acct-Unique-Session-ID = "4a16e50737b1c920". modcall[accounting]: module "acct_unique" returns ok for requ

Re: 0.9.3 has been released

Bill Campbell <[EMAIL PROTECTED]> wrote: > On a related security note, the src/lib/radius.c program has several > references to msg_auth_vector and calc_auth_vector starting around line > 1108 with several memcpy and memcmp operations, some of which refer use > sizeof(calc_auth_vector) for the leng

Re: 093 Crashes with unknown tokens

Greg G <[EMAIL PROTECTED]> wrote: > Here's what I get from FR 0.93 > > /usr/local/etc/raddb/users[9]: Parse error (reply) for entry 007gold: > Unknown attribute My-Key > Errors reading /usr/local/etc/raddb/users > radiusd.conf[921]: files: Module instantiation failed. > > And then back to a prom

093 Crashes with unknown tokens

Here's what I get from FR 0.93 /usr/local/etc/raddb/users[9]: Parse error (reply) for entry 007gold: Unknown attribute My-Key Errors reading /usr/local/etc/raddb/users radiusd.conf[921]: files: Module instantiation failed. And then back to a prompt. That's bad since I won't always be able to w

Re: 0.9.3 has been released

On Fri, Nov 21, 2003, Chris Parker wrote: >At 11:18 AM 11/21/2003, Bill Campbell wrote: >>On Fri, Nov 21, 2003, Alan DeKok wrote: >>>Oliver Graf <[EMAIL PROTECTED]> wrote: > With that said, 0.9.3 has been released. It's in the normal places: I submitted a security report and a new

Re: 092 Crashes with unknown tokens

Alan DeKok wrote: Greg G <[EMAIL PROTECTED]> wrote: I'm working on migrating from a Livingston 2.1.0 radius server to FreeRadius 0.9.2, and I'm running into some odd stuff. The most notable of this stuff is that if there's a key in the users file that FR doesn't recognize, it

Re: 0.9.3 has been released

At 11:18 AM 11/21/2003, Bill Campbell wrote: On Fri, Nov 21, 2003, Alan DeKok wrote: >Oliver Graf <[EMAIL PROTECTED]> wrote: >> > With that said, 0.9.3 has been released. It's in the normal places: >> >> I submitted a security report and a new package ebuild to the gentoo >> ( http://gentoo.org/

Re: rlm_radutmp: Logout entry for NAS has wrong ID

Hello all, Anyone know what causes this log entry: rlm_radutmp: Logout entry for NAS hostname port 0 has wrong ID Specifically the NAS in question is a Cisco 3640 router that is aggregating my ADSL traffic. Users are using PAP authentication. It's always worked fine, except for the wron

Re: Foundry command authorization help

Title: Re: Foundry command authorization help They came with both versions I have tried, 0.91 and 0.93. They were in /usr/share/freeradius folder. Ted On Fri, 2003-11-21 at 12:43, Chris Parker wrote: > At 11:23 AM 11/21/2003, Dave Mussulman wrote: > > >First, the Foundry dictionary file tha

Re: Foundry command authorization help

At 11:23 AM 11/21/2003, Dave Mussulman wrote: First, the Foundry dictionary file that comes with FreeRADIUS doesn't have those attributes, so you'll need to edit it. What you need to add is pretty straightforward in Foundry's docs. (I'll submit my dictionary file to the project when I'm sure it'

Re: Foundry command authorization help

> From: "Kaczmarek, Thaddeus" <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: Foundry command authorization help > Date: Fri, 21 Nov 2003 11:21:00 -0500 > Reply-To: [EMAIL PROTECTED] > > This message is in MIME format. Since your mail reader does not understand > this format, some or all of

link to my debian packages based on 0.9.3

All, I posted new versions of my slimed down debian packages: http://mrtizmo.com/freeradius/index.html The big thing I did was to remove the need for iodbc, since it has a lot of nasty dependencies. The page explains what all I removed and how I did so. Please feel free to use what you can. E

Re: 0.9.3 has been released

On Fri, Nov 21, 2003, Alan DeKok wrote: >Oliver Graf <[EMAIL PROTECTED]> wrote: >> > With that said, 0.9.3 has been released. It's in the normal places: >> >> I submitted a security report and a new package ebuild to the gentoo >> ( http://gentoo.org/ ) community. > > Thanks. This just re-ite

Re: Can't get freeradius-0.9.3 compiled on Redhat 9

Title: Re: Can't get freeradius-0.9.3 compiled on Redhat 9 download freeradius-0.9.3.tar.gz tar xvfz freeradius-0.9.3.tar.gz cp freeradius-0.9.3.tar.gz /usr/src redhat/SOURCES rpmbuild -ba freeradius-0.9.3/redhat/freeradius.spec If that doesn't work you probably don't have some development l

RE: Can't get freeradius-0.9.3 compiled on Redhat 9

Title: Re: Can't get freeradius-0.9.3 compiled on Redhat 9 Yea that would be nice! :) -Original Message-From: Kaczmarek, Thaddeus [mailto:[EMAIL PROTECTED]Sent: vrijdag 21 november 2003 17:40To: [EMAIL PROTECTED]Subject: Re: Can't get freeradius-0.9.3 compiled on Redhat 9

Re: Can't get freeradius-0.9.3 compiled on Redhat 9

Title: Re: Can't get freeradius-0.9.3 compiled on Redhat 9 Could you post the rpm file as well as the steps you used to create the rpm?  I have been playing around with trying to build an rpm and have not had much success.   dave   - Original Message - From: Kaczmarek, Tha

Re: Can't get freeradius-0.9.3 compiled on Redhat 9

Title: Re: Can't get freeradius-0.9.3 compiled on Redhat 9 Want me to email you the rpms I built? Ted On Fri, 2003-11-21 at 10:21, Sebastiaan Mangoentinojo wrote: > Hi, > > I spend the better half of the day trying to compile Freeradius on Redhat 9 > (I'm going to use it for test purposes), b

Re: 092 Crashes with unknown tokens

Greg G <[EMAIL PROTECTED]> wrote: > I'm working on migrating from a Livingston 2.1.0 radius server to > FreeRadius 0.9.2, and I'm running into some odd stuff. The most notable > of this stuff is that if there's a key in the users file that FR doesn't > recognize, it crashes! Key? What are k

092 radping calls radwho incorrectly?

It looks like radping is calling radwho with both a -o and a -e option. radwho doesn't take either of these options, and consequently doesn't run. Hmmm. Here's the other odd thing. I can't see where that radping script is being created. Do I maybe have something from a different radius dist

092 Crashes with unknown tokens

I'm working on migrating from a Livingston 2.1.0 radius server to FreeRadius 0.9.2, and I'm running into some odd stuff. The most notable of this stuff is that if there's a key in the users file that FR doesn't recognize, it crashes! That's bad. I haven't yet chased this down, as I wanted to

Foundry command authorization help

Title: Foundry command authorization help I am having some issues with command authorization. Foundry has a Foundry-Command-String attribute and suspect I am just a chucklehead :-) Syntax should be Foundry-Command-String = "configure terminal", Foundry-Command-String = "int ethernet 20",

Re: 0.9.3 has been released

Oliver Graf <[EMAIL PROTECTED]> wrote: > > With that said, 0.9.3 has been released. It's in the normal places: > > I submitted a security report and a new package ebuild to the gentoo > ( http://gentoo.org/ ) community. Thanks. This just re-iterates my beleif that RADIUS servers should on p

Re: Printable ascii characters

Lance Davis <[EMAIL PROTECTED]> wrote: > sql_escape_func() in rlm_sql.c doesnt think that '#' is an ascii printable > character, so replaces it with '=23' , which then fails to match the > username :( > > Is there any reason for this, and also for the other ascii printable > characters that are

Re: Authenticating users without a password..

At 10:01 AM 11/21/2003, Stephen Fulton wrote: Hi all, I forgot my RADIUS book, otherwise I'd look it up. I've Google'd without success. When I add a user without a password, I get this error message: Auth: Login incorrect: [a-test/] (from client 10.100.5.10 port 0) If I have the Password AV

Authenticating users without a password..

Hi all,   I forgot my RADIUS book, otherwise I'd look it up.  I've Google'd without success.  When I add a user without a password, I get this error message:   Auth: Login incorrect: [a-test/] (from client 10.100.5.10 port 0)   If I have the Password AV pair there, but without a password in t

huntgroups

Maybe I am using huntgroups wrong, but I would like huntgroup0 to use ports 1-8, huntgroup1 use ports 9-16 and huntgroup2 use ports 17-24 I am using mysql, and would like to keep using this as much as possible. I added username Huntgroup-Name == test1 to my radcheck table where username h

Can't get freeradius-0.9.3 compiled on Redhat 9

Hi, I spend the better half of the day trying to compile Freeradius on Redhat 9 (I'm going to use it for test purposes), but I'm stuck at the moment. I get the following ./configure warnings: configure: warning: silently not building rlm_eap_tls. configure: warning: FAILURE: rlm_eap_tls requir

Re: 0.9.3 has been released

ve been compromised and are down for inspection, so I am not able to search for the necessary versions of these libraries. http://cert.uni-stuttgart.de/files/fw/debian-security-20031121.txt I am going to get the cvs and build my own deb packages without these dependencies and without the extra

Re: 0.9.3 has been released

to search for the necessary versions of these libraries. http://cert.uni-stuttgart.de/files/fw/debian-security-20031121.txt I am going to get the cvs and build my own deb packages without these dependencies and without the extra modules like before, but I just wanted to see what your current t

Your prescripti/on delivered to your house by tomorrow!

Re[2]: 0.9.3 has been released

Dear 3APA3A, --Friday, November 21, 2003, 12:46:01 PM, you wrote to [EMAIL PROTECTED]: 3> http://www.security.nnov.ru/search/document.asp?docid=2578 Either I 3> missed this bug during audit 1,5 years ago or it was introduced 3> later. Ammm... 3 years ago :) time goes fast :)) Probably i

Re: 0.9.3 has been released

Dear Alan DeKok, --Thursday, November 20, 2003, 11:51:13 PM, you wrote to [EMAIL PROTECTED]: AD> As it turns out, however, the problem isn't as bad as it could have AD> been. The bug he reported can cause the server to crash, but is AD> difficult to exploit. Any attack code MUST be in the f

Logging is no longer working

Hi all I have just upgraded from 0.9.1 to 0.9.3. And I can still authenticate (from a Cisco VPN 3000 to freeRADIUS). But I can no longer receive authentication messages in the log files (as seen below): Fri Nov 21 07:33:23 2003 : Auth: rlm_unix: [auser]: invalid password Fri Nov 21 07:33:23 2003

ok

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

(no subject)

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: 0.9.3 has been released

On Thu, Nov 20, 2003 at 03:51:13PM -0500, Alan DeKok wrote: > Bug reports are nice. Lack of notification is stupid. > > With that said, 0.9.3 has been released. It's in the normal places: I submitted a security report and a new package ebuild to the gentoo ( http://gentoo.org/ ) community.