portslave-devel Mailing List for Portslave

Hi all,

Not sure how many people are still actively reading these mailing lists,
but those of you also on the portslave-cvs list would have noticed a bit
of activity recently.

Russell has added me as a portslave administrator, and I've been doing a
bit of work to get portslave up and running with recent versions of ppp.
I'm a Un*x sysadmin, based in Melbourne, Australia, and currently
employed at a DNS registry.

I've just made a new release of portslave - I've given it a version
number of 1.9.9 (looking towards a 2.0.0 release when it's considered
stable). I've dumped the date version-numbering scheme.

Here is a list of the major changes in the new version:

* It now compiles against ppp 2.4.3; there were a number of API changes
in this version, particularly relating to CHAP. All major Linux
distributions now ship with ppp 2.4.2 or 2.4.3, so this will make
packaging portslave much less problematic.

* It no longer needs the ppp source code to be sitting in the parent
directory when compiling. Instead, it looks for the ppp header files
and libraries under /usr/include & /usr/lib, etc...

* It is now using automake as part of its build process. This makes
it much easier to make releases.

The new release is up on the portslave sourceforge release page, so I
encourage everyone to download it and try it out. 

Cheers,

Paul.


-- 
Paul Dwerryhouse				| PGP Key ID: 0x6B91B584

On Tue, 25 Feb 2003 15:24, Rafa Marín López wrote:
> Does portslave support IPv6 attributes on RFC 3162?

No, not yet.

> What updates should be made? Which part of code in?

I did put in some partial code for this, but most of it was broken in the 
re-write for libradius.

Almost everything for IPv6 support needs to be written.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

Hello all

Does portslave support IPv6 attributes on RFC 3162?

What updates should be made? Which part of code in?

Thank you very much.

-- 
------------------------------------------------------
Rafael Marin Lopez
Faculty of Computer Science-University of Murcia
30071 Murcia - Spain
Telf: +34968364644	e-mail: ra...@di...
------------------------------------------------------

Russell Coker wrote:
> On Thu, 22 Aug 2002 14:09, Justin Schoeman wrote:
> 
>>Thanks for the great work on portslave - it works really well.  Here is
>>a small patch to add Access-Challenge support.  The patch is included in
>>2 forms: CR-patch (a normal unified diff); CR-patch-2 (a unified diff
>>excluding indentation-only changes: added to make it more obvious what
>>has changed ;-) ).
> 
> 
> The second one is preferred.  "diff -uw" is what I like.
> 
> 
>>Basically what is done:
>>1) Add a do_challenge function (similar to - OK, copied from ;-> -
>>do_login). This prompts the user with any supplied messages, then
>>returns the response in the password field.  There is also a dummy for
>>this function in lib.c, as it is called from rad_client.c.
> 
> 
> Why is there a need for a dummy function in lib.c?

rad_client calls do_challenge. rad_client.o is compiled into 
libportslave.so, but getty.o is not... Therefore undefined symbol 
"do_challenge" in libportslave.so...

> I've put the change to getty.c into the CVS...
> 
> 
>>2) Wrap most of rad_client up in a do - while loop, which repeats as
>>long as the reply code is PW_ACCESS_CHALLENGE.  If it is, do_challenge
>>is called to request the challenge-response from the user. Support is
>>also added for copying PW_STATE attributes from the reply to the next
>>request.
>>
>>I appologise for not sending a patch against the CVS version - we are
>>working in a production environment here, so we only use release
>>packages.  If you find this patch useful, and want it ported to the CVS
>>version, please let me know, and I can do it.
> 
> 
> Thanks!  I would really appreciate having it ported to the CVS code.  I've 
> already checked in the getty.c part with a couple of trivial changes to make 
> it slightly easier for you.
> 
> 
> I look forward to seeing more patches from you!

;-)  I am a bit busy again, but I will get the patches in as soon as I can.

-justin

On Thu, 22 Aug 2002 14:09, Justin Schoeman wrote:
> Thanks for the great work on portslave - it works really well.  Here is
> a small patch to add Access-Challenge support.  The patch is included in
> 2 forms: CR-patch (a normal unified diff); CR-patch-2 (a unified diff
> excluding indentation-only changes: added to make it more obvious what
> has changed ;-) ).

The second one is preferred.  "diff -uw" is what I like.

> Basically what is done:
> 1) Add a do_challenge function (similar to - OK, copied from ;-> -
> do_login). This prompts the user with any supplied messages, then
> returns the response in the password field.  There is also a dummy for
> this function in lib.c, as it is called from rad_client.c.

Why is there a need for a dummy function in lib.c?

I've put the change to getty.c into the CVS...

> 2) Wrap most of rad_client up in a do - while loop, which repeats as
> long as the reply code is PW_ACCESS_CHALLENGE.  If it is, do_challenge
> is called to request the challenge-response from the user. Support is
> also added for copying PW_STATE attributes from the reply to the next
> request.
>
> I appologise for not sending a patch against the CVS version - we are
> working in a production environment here, so we only use release
> packages.  If you find this patch useful, and want it ported to the CVS
> version, please let me know, and I can do it.

Thanks!  I would really appreciate having it ported to the CVS code.  I've 
already checked in the getty.c part with a couple of trivial changes to make 
it slightly easier for you.


I look forward to seeing more patches from you!


Russell Coker

On Fri, 13 Sep 2002 23:43, Russell Coker wrote:
> Do you still have CVS access?
>
> Here's what happens when I try accessing the CVS:

Forget that.

I stuffed up my own CVS settings with a bad environment variable.  It all 
works now.


Russell Coker

Does anyone recall who wrote the ip assignment patch?

In my latest portslave code (which I haven't been able to commit to the CVS 
because it seems broken) I have added some more back-port PPP code from PPP 
2.4.2.  This greatly improves support for IP assignment!

I've put the support in for CHAP but it needs more testing.  Also the PAP code 
needs to use the new interface too.  Could someone who uses ip assignment 
please take a look at it?

-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
From field.

Do you still have CVS access?

Here's what happens when I try accessing the CVS:

et...@cv...'s password:
cvs checkout: warning: unrecognized response `' from cvs server
cvs checkout: warning: unrecognized response `Welcome to cvs.sourceforge.net' 
from cvs server
cvs checkout: warning: unrecognized response `' from cvs server
cvs checkout: warning: unrecognized response `This is a restricted Shell 
Account' from cvs server
cvs checkout: warning: unrecognized response `You cannot execute anything 
here.' from cvs server
cvs checkout: warning: unrecognized response `' from cvs server
cvs [checkout aborted]: end of file from server (consult above messages if 
any)
rjc@lyta:/usr/src/ps-cvs$

It seems that something has changed.


-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
From field.

Hi everybody!

Thanks for the great work on portslave - it works really well.  Here is 
a small patch to add Access-Challenge support.  The patch is included in 
2 forms: CR-patch (a normal unified diff); CR-patch-2 (a unified diff 
excluding indentation-only changes: added to make it more obvious what 
has changed ;-) ).

Basically what is done:
1) Add a do_challenge function (similar to - OK, copied from ;-> - 
do_login). This prompts the user with any supplied messages, then 
returns the response in the password field.  There is also a dummy for 
this function in lib.c, as it is called from rad_client.c.

2) Wrap most of rad_client up in a do - while loop, which repeats as 
long as the reply code is PW_ACCESS_CHALLENGE.  If it is, do_challenge 
is called to request the challenge-response from the user. Support is 
also added for copying PW_STATE attributes from the reply to the next 
request.

I appologise for not sending a patch against the CVS version - we are 
working in a production environment here, so we only use release 
packages.  If you find this patch useful, and want it ported to the CVS 
version, please let me know, and I can do it.

Thanks again for the great package!

-justin

I have just committed the new radiusclient based Portslave code to CVS.  The 
code that is now committed is very experimental (and has a few changes I 
haven't even compiled yet), but I will be uploading a new version soon that 
is more fully tested.

I just wanted to get something in CVS in case I stuff something up in the 
next round of development.

I have got a small contract for some Portslave development work which was my 
incentive to drop the other things I'm working on and go back to Portslave 
development.


I expect to have a major new release of Portslave on Sourceforge and in 
Debian in a few days.


Russell Coker

I suggest that we have a workshop on Portslave/ppp.  If you're interested 
then let me know ASAP.

----------  Forwarded Message  ----------

Subject: Linux-Kongress 2002: Call for Workshops
Date: Fri, 28 Jun 2002 20:58:19 +0200
From: joc...@gu...
To: ru...@co...

    Linux-Kongress 2002
			    -------------------

			     Call for Workshops

As in the last two years the German Unix User Group (GUUG) with the support
of the German Ministry of Education and Research (BMBF) is planning to hold
five 3-day workshops from Sunday, September 1, to Wednesday, September 4 just
before the Linux-Kongress. The workshops will give Open Source developers
from around the world the chance to meet in person and work on their
projects. All Open Source projects are encouraged to apply for sponsorship.
All expenses, including travel, accommodation and conference fees for the
Linux-Kongress will be paid for participating projects.

This is a unique chance for people who have been working together over the
Internet but never seen each other to meet face-to-face and give their
common project a push. Maybe you can use this workshop to finally get the
1.0 version done, or you need to come together to redesign your API, or
maybe you just want to write some code non-stop for a few days.

Workshops will take place at the "Kloster Walberberg", a former medieval
castle and now a monastery and conference hotel set in a beautiful park.
Everything, food, drinks, Internet connection will be provided for, so you
can really concentrate on the job. Meeting rooms will be open 24h a day for
your hacking pleasure.

Please see the FAQ at http://www.linux-kongress.org/2002/workshops/faq.html
for all the details and information about how to apply.

Please make sure to apply soon as the planning time is quite short.

If you have any questions don't hesitate to contact Jochen Topf at
joc...@gu....

-------------------------------------------------------

-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
From field.

Yeah it seems to be have a better responsible RAS .

--
Regards

    =================================================================
   /  Seyyed Hamid Reza    /        WINDOWS FOR NOW  !!            /
  /  Hashemi Golpayegani  /  Linux for future , FreeBSD for ever  /
 /    Morva System Co.   / ------------------------------------- /
/  Network Administrator/ ha...@mo...   ,   ICQ# : 42209876 /
================================================================
 

-----Original Message-----
From: Russell Coker [mailto:ru...@co...] 
Sent: Thursday, February 07, 2002 4:35 AM
To: Hamid Hashemi Golpayegani
Cc: Portslave Devel
Subject: Re: [pslave] Strip username and password !


On Wed, 6 Feb 2002 06:48, you wrote:
> Yeah you are right . Then it's better to make an option to discard 
> garbage and ask for another login . Also we can make some option to 
> changing all username and password to lower case and upper case or 
> make them without spaces . Then we can make a ras that accept upper 
> and lower case username password . Note that this must be option like 
> freeradius cause someone may want to have lower and upper case 
> sesetive system . What is your idea ?!

Sounds reasonable.

I'll add username-mangle and password-mangle attributes with values
"upper", 
"lower", and "nospace".

I might make it default the user-name to "nospace".

-- 
http://www.coker.com.au/bonnie++/     Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/       Postal SMTP/POP benchmark
http://www.coker.com.au/projects.html Projects I am working on
http://www.coker.com.au/~russell/     My home page

On Wed, 6 Feb 2002 06:48, you wrote:
> Yeah you are right . Then it's better to make an option to discard
> garbage and ask for another login . Also we can make some option to
> changing all username and password to lower case and upper case or make
> them without spaces . Then we can make a ras that accept upper and lower
> case username password . Note that this must be option like freeradius
> cause someone may want to have lower and upper case sesetive system .
> What is your idea ?!

Sounds reasonable.

I'll add username-mangle and password-mangle attributes with values "upper", 
"lower", and "nospace".

I might make it default the user-name to "nospace".

-- 
http://www.coker.com.au/bonnie++/     Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/       Postal SMTP/POP benchmark
http://www.coker.com.au/projects.html Projects I am working on
http://www.coker.com.au/~russell/     My home page

Yesterday I gave a presentation on Portslave at linux.conf.au.

Rusty informed me of an API to change device names and suggested that the 
device name be changed to "ppprjc" when user "rjc" logs in via portslave.  
This allows firewall rules that match on interface name to always be in 
place, and also gives other benefits.

What do you think about changing the device name to sprintf(buf, "ppp%s", 
ai->login) where ischar(ai->login[0]) && strlen(ai->login) < max_len?

-- 
http://www.coker.com.au/bonnie++/     Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/       Postal SMTP/POP benchmark
http://www.coker.com.au/projects.html Projects I am working on
http://www.coker.com.au/~russell/     My home page

I've got the code for radiusclient integration half done.  It basically 
compiles and may almost work.  I expect that I'll have it fully working in 
about a week.

This will have some major changes.

The IPv6 support is gone because radiusclient doesn't support it, re-adding 
it will involve changing radiusclient and may result in a cleaner interface 
(but will involve some significant coding).  This is not so bad because the 
IPv6 support was never fully functional.

CHAP support will be added RSN.  The radiusclient supports CHAP so adding 
Portslave support should be really easy.

I think that radiusclient doesn't handle intermittant RADIUS errors as well 
as Portslave used to.

I could have made the radiusclient configuration part of the Portslave 
configuration, but I won't.  I am making the radiusclient configuration file 
a Portslave configuration item, this means that each line could (potentially) 
have a different RADIUS configuration.  Also it means that if you have 5 
ports with one RADIUS configuration and 5 ports with another then you don't 
have to specify the full configuration (authorization and accounting server 
addresses etc) for each port.

Now for Debian the portslave package will depend on libradius1 and share the 
same default RADIUS config file as other libradius based programs.  Hopefully 
we can do the same for RPM based distributions.

Also this currently breaks Callback because at a quick glance I couldn't work 
out exactly what some of Alexandr's code was doing and how to convert it to 
the new libradius.  Hopefully Alexandr can quickly re-write this as soon as 
I've got some code worth releasing.

-- 
http://www.coker.com.au/bonnie++/     Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/       Postal SMTP/POP benchmark
http://www.coker.com.au/projects.html Projects I am working on
http://www.coker.com.au/~russell/     My home page

On Sun, 27 Jan 2002 13:40, Sarel J. Botha wrote:
> Even though I haven't contributed any code to the project, I do know this:
> Reusing existing libraries is always the best thing to do.
>
> 1. Like Russell said, you reap the benefits of their improvements, with
> little or sometimes no changes to your code at all.
> 2. Less code to debug, smaller program size, smaller program footprint.
> 3. Central control. If a system is running login and portslave off RADIUS,
> both use libradius and you don't have separate config files for each
> implementation of RADIUS.
> 4. Shared library during runtime. A library only needs to exist once in
> memory even while 2 programs use it at the same time. Basically the same as
> "smaller footprint".

I think that libradius has no support for 4, so implicitely I'd have to 
implement that myself.

Regarding 3, /bin/login for a shell session using RADIUS authentication 
serves no purpose IMHO.  /bin/login type functionality for a PPP login is 100 
times better in Portslave than in libradius and related code.

Regarding 2, yes once I debug all the code linking my code to their code.  I 
expect to take 6 months to get another non-beta release out.  But as I said 
before, I think that the current release is good enough to last that long 
without updates.

-- 
http://www.coker.com.au/bonnie++/     Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/       Postal SMTP/POP benchmark
http://www.coker.com.au/projects.html Projects I am working on
http://www.coker.com.au/~russell/     My home page

Even though I haven't contributed any code to the project, I do know this:
Reusing existing libraries is always the best thing to do.

1. Like Russell said, you reap the benefits of their improvements, with
little or sometimes no changes to your code at all.
2. Less code to debug, smaller program size, smaller program footprint.
3. Central control. If a system is running login and portslave off RADIUS,
both use libradius and you don't have separate config files for each
implementation of RADIUS.
4. Shared library during runtime. A library only needs to exist once in
memory even while 2 programs use it at the same time. Basically the same as
"smaller footprint".

Lastly... It's the UNIX way :)

My 2 cents.
Sarel


-----Original Message-----
From: por...@li...
[mailto:por...@li...]On Behalf Of Russell
Coker
Sent: Friday, January 25, 2002 7:44 PM
To: Alexandr D. Kanevskiy
Cc: por...@li...
Subject: Re: [Portslave-devel] So, where do we go from here?


On Sat, 26 Jan 2002 03:39, Alexandr D. Kanevskiy wrote:
> If we start use RP plugin - it's good but... We must continue
> use our own code for prompt auth. Seems what not very well.

I believe that they also have some matching code for a login: prompt.

> We can try port any good features from RP work to our code or start
> rewrite portslave from scratch. :) But, what also not good. B-(
>
>
> I think RP plugin usefull only in case of pptp/l2tp addon to pppd...
> For terminal access - portslave more usefull.

I agree that out code is much better for modem use apart from the issue of
CHAP.  We could add new code to our existing code base for CHAP, but I think
that we would be better off using the libradius and having only one set of
RADIUS client code (then next time they add a new feature we get the benefit
with little work).

Then we can try and offer all the functionality of the RP code and more, in
which case we can replace it.

--
http://www.coker.com.au/bonnie++/     Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/       Postal SMTP/POP benchmark
http://www.coker.com.au/projects.html Projects I am working on
http://www.coker.com.au/~russell/     My home page

_______________________________________________
Portslave-devel mailing list
Por...@li...
https://lists.sourceforge.net/lists/listinfo/portslave-devel

On Sat, 26 Jan 2002 03:39, Alexandr D. Kanevskiy wrote:
> If we start use RP plugin - it's good but... We must continue
> use our own code for prompt auth. Seems what not very well.

I believe that they also have some matching code for a login: prompt.

> We can try port any good features from RP work to our code or start
> rewrite portslave from scratch. :) But, what also not good. B-(
>
>
> I think RP plugin usefull only in case of pptp/l2tp addon to pppd...
> For terminal access - portslave more usefull.

I agree that out code is much better for modem use apart from the issue of 
CHAP.  We could add new code to our existing code base for CHAP, but I think 
that we would be better off using the libradius and having only one set of 
RADIUS client code (then next time they add a new feature we get the benefit 
with little work).

Then we can try and offer all the functionality of the RP code and more, in 
which case we can replace it.

-- 
http://www.coker.com.au/bonnie++/     Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/       Postal SMTP/POP benchmark
http://www.coker.com.au/projects.html Projects I am working on
http://www.coker.com.au/~russell/     My home page

On Fri, 25 Jan 2002, Russell Coker wrote:

>David F. Skoll from Roaring Penguin has just done a CVS commit to the pppd 
>project of a RADIUS plugin for pppd.
>
>The code offers some nice features that we haven't got (such as CHAP), but 
>lacks many things we have (good documentation, per-line configuration, 
>ctlportslave, and the start of IPv6 support just to name a few).
>
>If we changed Portslave to use libradius then we'd get CHAP (and the ability 
>to add new features more easily in future), we could even potentially combine 
>the projects and give the union of feature sets.  I think that at the moment 
>the only viable options are to either merge them or close down Portslave.
>
>Portslave in it's current form is working quite well.  It has no bugs of 
>note, works solidly, and gives reasonably good error messages when things go 
>wrong.  So I think it can go for a while without updates.
>
>I plan to now work on a new Portslave to merge with the RP work.  I won't be 
>able to do it all on my own, so I'd appreciate any contributions of code, the 
>latest PPP CVS snapshot is on http://www.coker.com.au/portslave/ppp-beta.tgz .
>
>Hopefully this will result in a better set of terminal server software for 
>all of us to use.

>Tell me what you think.

If we start use RP plugin - it's good but... We must continue 
use our own code for prompt auth. Seems what not very well.
We can try port any good features from RP work to our code or start
rewrite portslave from scratch. :) But, what also not good. B-(


I think RP plugin usefull only in case of pptp/l2tp addon to pppd...
For terminal access - portslave more usefull.

-- 
With best regards, Alexandr Kanevskiy.
ASPLinux Developers/Security Team
http://www.asplinux.ru
AK2240-RIPE, AK2-6BONE

David F. Skoll from Roaring Penguin has just done a CVS commit to the pppd 
project of a RADIUS plugin for pppd.

The code offers some nice features that we haven't got (such as CHAP), but 
lacks many things we have (good documentation, per-line configuration, 
ctlportslave, and the start of IPv6 support just to name a few).

If we changed Portslave to use libradius then we'd get CHAP (and the ability 
to add new features more easily in future), we could even potentially combine 
the projects and give the union of feature sets.  I think that at the moment 
the only viable options are to either merge them or close down Portslave.

Portslave in it's current form is working quite well.  It has no bugs of 
note, works solidly, and gives reasonably good error messages when things go 
wrong.  So I think it can go for a while without updates.

I plan to now work on a new Portslave to merge with the RP work.  I won't be 
able to do it all on my own, so I'd appreciate any contributions of code, the 
latest PPP CVS snapshot is on http://www.coker.com.au/portslave/ppp-beta.tgz .

Hopefully this will result in a better set of terminal server software for 
all of us to use.


Tell me what you think.

-- 
http://www.coker.com.au/bonnie++/     Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/       Postal SMTP/POP benchmark
http://www.coker.com.au/projects.html Projects I am working on
http://www.coker.com.au/~russell/     My home page

-- 
With best regards, Alexandr Kanevskiy.
ASPLinux Developers/Security Team
http://www.asplinux.ru
AK2240-RIPE, AK2-6BONE

---------- Forwarded message ----------
Date: Sat, 5 Jan 2002 00:01:53 +0200 (EET)
From: Alexandr D. Kanevskiy <ka...@bl...>
To: Mihail F Karpunin <ka...@ch...>
Subject: Re: [Portslave-devel] portslave+mppe+pptpd

On Fri, 4 Jan 2002, Mihail F Karpunin wrote:

>it is possible to use mppe patch from
>http://www.moretonbay.com/vpn/releases/ppp-2.3.8-mppe-others-norc4_TH7.diff.gz
>?
Only if you wish use radius as accounting. and use plain chap-secrets 
passwords. This is becouse pppd +portslave at this moment can't support
chap at all. I'm working on this, but mschap/mschapv2+mppe must be 
implemented on both sides (portslave and radius server) B-(

If I finish chap/mschap/mschap2 support - I merge it in main portslave 
tree offcouse.

-- 
With best regards, Alexandr Kanevskiy.
ASPLinux Developers/Security Team
http://www.asplinux.ru
AK2240-RIPE, AK2-6BONE

it is possible to use mppe patch from
http://www.moretonbay.com/vpn/releases/ppp-2.3.8-mppe-others-norc4_TH7.diff.gz
?

Hi folks...


I run portslave for a special configuration for Access Server via radius 
and all..

I use DatafireRAS PTE like board and portslave for menage radius accounting 
and ppp.
If i use version 2001_10_16 all seem to work ok..

The problem is that i need the Caller and Called ID info on radius accounting.
I searched around and i saw Portslave 2001_12_16 and 12_27 added the Caller-ID.

I tried to apply the patch on 12_16 but it won't compile.. so i downloaded 
the 12_27. it compile good but when i try to connect the modem reply me and 
after 2 seconds hung up immedialty sending me the error..

Jan  3 09:23:13 plugit-nas-01 port[S51]: Can't set serial 
attributes:Input/output error


Any help about ?