June 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Patch: avpair.c - empty reply VALUE_PAIR (0x0) for replies with unknown vendor attributes
by Stefan Karss 08 Jul '10

08 Jul '10

Hello again, when the RADIUS servers sends a reply packet with an attribute for an unknown vendor freeradius-client just skips over this when filling response VALUE_PAIR list. Unfortunately it doesn't for unknown attributes from known vendors - in that case rc_avpair_gen returns NULL in the first recursion which results in a NULL pointer for reply VALUE_PAIR. The attached patch just skips over unknown attributes for known vendors just like the lib skips over attributes from unknown vendors. Rgds, Stefan

4 13

Fwd: Specifying sql instance to use for huntgroup group lookup
by Doug Warner 28 Jun '10

28 Jun '10

I found that all SQL instances would register themselves to handle the Sql-Group processing even if they couldn't. I've attached a patch that only attaches the instance to process Sql-Group if group_membership_list is set. I'm not sure if this is the best method for doing this or whether a new variable is called for, but thought I would share this regardless. -Doug -------- Original Message -------- Subject: Specifying sql instance to use for huntgroup group lookup Date: Mon, 21 Jun 2010 15:52:00 -0400 From: Doug Warner <doug(a)warner.fm> Reply-To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> I am specifying an Sql-Group required for one of my huntgroups and am finding that when looking up the group info from my database that the wrong sql instance is being used. I have an "sql_read" instance that's specified to be used in my authorize section, but when the Sql-Group is evaluated for the huntgroup my "sql_write" sql instance is used instead. Is there a way to specify which sql instance should be used in this situation? -Doug

2 1

No cleanup for abandoned EAP requests in radiusd
by Kunal Solanki 28 Jun '10

28 Jun '10

Hi All, I have been using freeradius version 2.1.4 and when I upgraded to 2.1.7 I am facing issues of high memory usage by radiusd. In 2.1.4 also the memory usage was quite high under high load but it used to come down after some time when abandoned requests are cleaned up. The cleanup trigger is not timer based in freeradius and is part of ongoing requests. In 2.1.7 version somehow this cleanup doesn't happen effectively and looks like for the same EAP requests a lot of dangling handlers are created which are not getting cleaned. I tried to cleanup old handlers in src/modules/rlm_eap/mem.c but that causes other side-affects of requests being present and no matching session state variable found for that. I believe in src/main/event.c we should have some sought of cleanup for the old requests itself. Please suggest, Thanks, Kunal

2 3

Challenge/Response and rlm_example
by Scott Neugroschl 25 Jun '10

25 Jun '10

OK, I'm trying to get the 2.1.8 server to do a simple challenge/response with Auth-Challenge, so as to test my client. I've setup rlm_example as an enabled module and modified it so that if will return RLM_MODULE_OK or RLM_MODULE_REJECT, depending upon the response. I've added an example file to the raddb/modules directory, and modified sites-available/default to include example at the end of the "authenticate" and "authorize" sections. The first Access-Request successfully generates an Access-Challenge in response. When I send the second Access-Request in response to the Access-Challenge, I get the output below. Note that the example module is returning RLM_MODULE_OK I checked every config file in raddb, and cannot find case where there is an "Auth-Type = Crypt". What am I doing wrong? Thanks, ScottN -- BEGIN radiusd -X output Thu Jun 24 12:36:36 2010 : Info: +- entering group authorize {...} Thu Jun 24 12:36:36 2010 : Info: ++[preprocess] returns ok Thu Jun 24 12:36:36 2010 : Info: ++[chap] returns noop Thu Jun 24 12:36:36 2010 : Info: ++[mschap] returns noop Thu Jun 24 12:36:36 2010 : Info: [suffix] No '@' in User-Name = "[redacted]", looking up realm NULL Thu Jun 24 12:36:36 2010 : Info: [suffix] No such realm "NULL" Thu Jun 24 12:36:36 2010 : Info: ++[suffix] returns noop Thu Jun 24 12:36:36 2010 : Info: [eap] No EAP-Message, not doing EAP Thu Jun 24 12:36:36 2010 : Info: ++[eap] returns noop Thu Jun 24 12:36:36 2010 : Info: ++[unix] returns updated Thu Jun 24 12:36:36 2010 : Info: [example] Found reply to access challenge Thu Jun 24 12:36:36 2010 : Info: [example] Found response in reply: '[redacted]' Thu Jun 24 12:36:36 2010 : Info: [example] Response is good Thu Jun 24 12:36:36 2010 : Info: ++[example] returns ok Thu Jun 24 12:36:36 2010 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Crypt' Thu Jun 24 12:36:36 2010 : Info: WARNING: Use the PAP module instead. Thu Jun 24 12:36:36 2010 : Info: Failed to authenticate the user. Thu Jun 24 12:36:36 2010 : Info: Delaying reject of request 1 for 1 seconds Thu Jun 24 12:36:36 2010 : Debug: Going to the next request Thu Jun 24 12:36:36 2010 : Debug: Waking up in 0.8 seconds. Thu Jun 24 12:36:37 2010 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 108 to 10.1.1.104 port 3277

2 2

wifi authentication failed in windows os. help
by 권란 25 Jun '10

25 Jun '10

I'm implementing a WiFi AAA server with PEAP(mschapv2) method over radius stack. and I test AAA server through PC with windows xp, vista, and also through iphone and serveral kind of smart phones. It succeed with iphone and smart phones , they can access internet after authenticated by my AAA server. But the problem is windows client. AAA server authenticated client successfully and answered with encrypted auth_string (rfc2759 : Microsoft PPP CHAP Extensions, Version 2). but the client (windows pc) does not answer. 1. I confirmed the success string (S=40byte string) is correct. 2. encryption key is also used at the previous step(challenge, response) and successfully passed. 3. then what could be the problem? if connect through intel proset wireless connection utility, it also succeed in windows xp. HELP PLEASE~~

1 0

Shared Secret questions.
by Scott Neugroschl 23 Jun '10

23 Jun '10

I'm looking through RFCs 2865 and 5080, and I can't really find anything specific on the format of the shared secret. Must it be pure ASCII, or can it be a hex string? Is there a maximum length (I found the minimum length recommendation)? These have to do with the specifics of the client that I'm developing using the FreeRADIUS client lib. Thanks, ScottN

3 8

Module 2 Help?
by Alexander Chen 22 Jun '10

22 Jun '10

Dear Sirs: How could write a module the function as hereunder: 1. Keep /usr/local/etc/raddb/users empty. 2. All Access-Request are all return Access-Accept. 3. I wish the function like rlm_sql (just modify authorization) Could you give me sample code. My config is: /usr/local/etc/raddb/sites-available/default authorize { preprocess chap mschap suffix eap { ok = return } unix #files #Alex:sql mymodule expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix #Alex:sql radutmp attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } Thanks.

1 0

Freeradius + ldap
by Marzieh Raoufnezhad 21 Jun '10

21 Jun '10

Hi, I installed freeradius and configured it with LDAP and installed pptp also in debian lenny. I can login to radius server from windows and I have VPN connection and internet. Now I want to restrict my VPN users' bandwidth and internet charge(for example 4G charge for each user), but I don't know how to do it with freeradius+LDAP. I would be grateful if you can answer me as soon as possible. Regards, Raoufnezhad

1 0