December 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

detail auth_log question
by ziyen 30 Dec '10

30 Dec '10

Hi Happy new year :) to day i get git last version and run /tmp/radius.log file contain some gabage date like below whats wring? ========== Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 Calling-Station-Id = "02-00-00-00-00-01" Tq?9 Message-Authenticator = 0xfc6df77c404b6b26285398a3934fe79f User-Name = "test01" = 0xfc6df77c404b6b26285398a3934fe79f EAP-Message = 0x0200000b01746573743031 b26285398a3934fe79f Connect-Info = "CONNECT 11Mbps 802.11b" 26285398a3934fe79f NAS-IP-Address = 127.0.0.1 bps 802.11b" 26285398a3934fe79f Framed-MTU = 1400 27.0.0.1 bps 802.11b" 26285398a3934fe79f Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f5925130f212f609555b234f Tq뷣 Calling-Station-Id = "02-00-00-00-00-01" f Tq뷣 Message-Authenticator = 0xe0b618c927062d4e55a64806d9c33db9 User-Name = "test01" = 0xe0b618c927062d4e55a64806d9c33db9 EAP-Message = 0x02010064150016030100590100005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M Connect-Info = "CONNECT 11Mbps 802.11b" 00005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M NAS-IP-Address = 127.0.0.1 bps 802.11b" 00005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M Framed-MTU = 1400 27.0.0.1 bps 802.11b" 00005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f4915130f212f609555b234f Tq?d Calling-Station-Id = "02-00-00-00-00-01" f Tq?d Message-Authenticator = 0xd39e6b915c0352029f43706a4afc102f User-Name = "test01" = 0xd39e6b915c0352029f43706a4afc102f EAP-Message = 0x020200061500 e6b915c0352029f43706a4afc102f Connect-Info = "CONNECT 11Mbps 802.11b" 029f43706a4afc102f NAS-IP-Address = 127.0.0.1 bps 802.11b" 029f43706a4afc102f Framed-MTU = 1400 27.0.0.1 bps 802.11b" 029f43706a4afc102f Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f7905130f212f609555b234f Tqphx Calling-Station-Id = "02-00-00-00-00-01" f Tqphx Message-Authenticator = 0x92f8db888a344fcc73d13ac23d0b75e4 User-Name = "test01" = 0x92f8db888a344fcc73d13ac23d0b75e4 EAP-Message = 0x020300061500 8db888a344fcc73d13ac23d0b75e4 Connect-Info = "CONNECT 11Mbps 802.11b" cc73d13ac23d0b75e4 NAS-IP-Address = 127.0.0.1 bps 802.11b" cc73d13ac23d0b75e4 Framed-MTU = 1400 27.0.0.1 bps 802.11b" cc73d13ac23d0b75e4 Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f6975130f212f609555b234f Tqh죱 Calling-Station-Id = "02-00-00-00-00-01" f Tqh죱 Message-Authenticator = 0xcb39b9ef7678c743e0467a6d637db2aa User-Name = "test01" = 0xcb39b9ef7678c743e0467a6d637db2aa EAP-Message = 0x020400cc150016030100861000008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? Connect-Info = "CONNECT 11Mbps 802.11b" 00008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? NAS-IP-Address = 127.0.0.1 bps 802.11b" 00008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? Framed-MTU = 1400 27.0.0.1 bps 802.11b" 00008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 02.11b" 26285398a3934fe79f State = 0xf5934438f1965130f212f609555b234f 85398a3934fe79f Calling-Station-Id = "02-00-00-00-00-01" f 85398a3934fe79f Message-Authenticator = 0xeee6ca5f69b02354bc56bd8d29b0ab63 User-Name = "test01" = 0xeee6ca5f69b02354bc56bd8d29b0ab63 EAP-Message = 0x0205009015001703010020579ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t Connect-Info = "CONNECT 11Mbps 802.11b" 9ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t NAS-IP-Address = 127.0.0.1 bps 802.11b" 9ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t Framed-MTU = 1400 27.0.0.1 bps 802.11b" 9ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request CHAP-Password = 0x060bb5ca76578168f759811c519a20e4ce 퇼㎌델??x ?CHAP-Challenge = 0xb561a6ab4003cb2378b5e8cede5d15ce 퇼㎌델??x ?User-Name = "test01" 61a6ab4003cb2378b5e8cede5d15ce 퇼㎌델??x ?NAS-IP-Address = 127.0.0.1 4003cb2378b5e8cede5d15ce 퇼㎌델??x ?

2 1

How the freeradius server can repeat eap-start when receive EAP-FAILURE?
by zhangyan 30 Dec '10

30 Dec '10

hello, Now, the freeradius server version I used is 2.1.6, and I want to the freeradius repeat eap-start when EAP-FAILURE received in my testing, How to configure the freeradius server? Thanks, Yan -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-the-freeradius-server-can-repea… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 2

eap-aka patch for freeradius 1.1.4
by zhangyan 28 Dec '10

28 Dec '10

Hello, I want to know if the eap-aka patch for freeradius 1.1.4 has been verified or not, I setup the freeradius with the eap-aka patch, the following log is display in server. rlm_eap: EAP Identity rlm_eap: processing type aka eap-aka can not find EAP-Sim-RAND can not initiate aka, missing attributes rlm_eap: Default EAP type aka failed in initiate rlm_eap: Failed in EAP select Can anyone give help for me? thanks Regards, Yan -- View this message in context: http://freeradius.1045715.n5.nabble.com/eap-aka-patch-for-freeradius-1-1-4-… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

CoA trigger support in freeRadius 2.1.10
by Rajkumar R 27 Dec '10

27 Dec '10

Hi All, I'm a starter to freeRadius and i would like to know if freeRadius 2.1.10 supports sending CoA msg? Also please let me know how to achieve that with configuration setup, if any. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Re: Multiple Radius clients from the same host IP supported?
by Brian Candler 24 Dec '10

24 Dec '10

On Thu, Dec 23, 2010 at 07:51:22PM +0200, Murat Öztürk wrote: > Can multiple radius clients on the same server send request to > Freeradius? I ask this question because they may be producing the same > UniqueId in the packages. But they will bind to different UDP sockets, and so will send packets with a different UDP source port. Hence the combination [source address, source port, identifier] uniquely identifies the request, and will set the [dest address, dest port, identifier] in the reply. Regards, Brian.

1 0

Re: Multiple Radius clients from the same host IP supported?
by Alan DeKok 24 Dec '10

24 Dec '10

Murat Öztürk wrote: > Thanks Alan, > Our requirement is mainly "radius client need to send more than 256 IDs > concurrently from single IP, different ports." Then you need to say that. > If we develop such > application, will freeradius support that. Yes. Alan DeKok.

1 0

Re: Multiple Radius clients from the same host IP supported?
by Alan DeKok 24 Dec '10

24 Dec '10

Murat Öztürk wrote: > Can multiple radius clients on the same server send request to > Freeradius? I ask this question because they may be producing the same > /UniqueId/ in the packages. The RADIUS clients are determined by source IP address. I have no idea what a "UniqueId" is. > I believe that, if freeradius use check ip+unique id combination to > identify packages from specific BRAS, it will cause problem. Othwise, > there should not be any issue. Please read the RADIUS specifications which describe how RADIUS works. Alan DeKok.

2 1

Performance issue with Freeradius (2.1.7) running Veriwave
by Verma Anurag-VNF673 23 Dec '10

23 Dec '10

Hi, I am running freeradius version 2.1.7. I am seeing some performance issue when I ran Veriwave AAA test with 15 clients connecting at the rate of 15 client/sec. The auth type is PEAP-MSCHAPv2 and using the local database (i.e. not radius). It is using the file as a db store which in our system is mapped to a ramdisk. The test runs for 30 sec. The auth rate was 9 auth/sec. The same test when ran against Microsoft AAA server gives 25 auth/sec. With Freeradius, out of 450 attempted authentications, 209 was successful and 241 was failed. For single client the authentication time is around 110 ms. Is this the expected number? From the mailing list, it seems 150 msec is what has been observed. The RSA key generation on the server is offloaded to the hardware. Without it the auth rate was only 3 auth/sec. Initially, I had threading option turned off and then later turned it on, but the numbers did not change much. I have tried various suggestion put forward in the mailing list including radius file access during authentication by moving file section from authorize section to authenticate section etc., but not much improvement. I also see something similar query raised, but did not find any satisfactory reply. http://freeradius.1045715.n5.nabble.com/Performance-with-Freeradius-1-1- 4-td2760808.html Any help on this will be appreciated. Thanks, Anurag ________________________________ From: Verma Anurag-VNF673 Sent: Wednesday, December 15, 2010 11:37 AM To: 'freeradius-devel(a)lists.freeradius.org' Subject: building freeradius statically Hi, I am trying to build static version of freeradius by passing --enable-static --enable-shared=no to configure. However, I get an error related to static link of dynamic object libltdl.so. In the make output I can see it is explicitly referring to this shared library. How can I tell it to link with libltdl.a (which is already existing) instead? Thanks, Anurag

5 7