September 2006 - Freeradius-Users - lists.freeradius.org

Why is the default DH keysize only 512 bits?
by Jason Wittlin-Cohen 29 Sep '06

29 Sep '06

I noticed that the default DH keysize in FreeRadius 1.1.3 is 512 bits. As DH keys have approximately the same strength as RSA keys, and 512 bit RSA keys have already been broken, wouldn't it be adviseable to use at least 1024 bit DH keys as the minimum size. 1024 bits is currently the minimum recommended size for a DSA/RSA certificate. It might also be a good idea to include the option commented out in eap.conf so users know that it's something they can change. I originally thought that the DH keysize would be determined by the DH parameter file and only realized that it was still using 512 bit keys when I ran freeradius in debug mode. As fas as performance goes, I've tested with 2048 bit and 3072 bit DH keys with no performance degredation. Authentication occurs in 1-2 seconds using the Funk Odyssey client on Windows XP SP2 with 3072 bit RSA certificates and 3072 bit DH key exchange. Also, it might be a good idea to put a comment in the TLS cipher suite comment section that the Microsoft Windows supplicant in Windows XP SP2 uses RC4-MD5 by default (TLS_RSA_WITH_RC4_128_MD5). First, MD5 is deprecated and weak. SHA-1 should be used in its place. Secondly, DH is preferable to RSA for key exchange because it provides perfect forward secrecy. If RSA is used for encryption, a compromise of the client private key would allow an attacker to gain access to the master keys used to encrypt all prior wireless sessions whereas fresh DH keys are produced on each authentication and deleted after use. OpenSSL's 'HIGH' setting is probably the best for a Windows XP user as it uses EDH-RSA-DES-CBC3-SHA (TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA), so SHA1 is used for integrity, and DH is used for key exchange. Windows XP SP2 and earlier versions of Windows do not support AES for use in any of the EAP modes. Apparently, if you want to use AES you need to upgrade to Vista (See Security in Vista <http://www.microsoft.com/technet/itsolutions/network/evaluate/new_network.m…>) or use a 3rd party supplicant like the Funk Odyssey Client which I use (uses TLS_DH_RSA_WITH_AES_256_CBC_SHA with default Freeradius setup). Jason Wittlin-Cohen

3 5

Accounting stopped
by sean＠swarmhotspots.com 29 Sep '06

29 Sep '06

Hi All, Since a power cut last Sunday FreeRadius has stopped writing to its log files and updating radacct in MySQL. It is continuing to authenticate users. It gives no error messages running radiusd -X. I've tried upgrading from 1.0.3 to 1.1.3 with no effect. I've been working round the clock for five days now and seem no closer to a solution. Any hints, tips or advice would be very welcome. Regards, Sean -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

mysql radacct table no query
by Collen Blijenberg 29 Sep '06

29 Sep '06

Hmm, i was testing the mysql backend with freeradius 1.1.3. looks good at first glance, but i bumped into something essential (for us that is). We like to link MAC addresses with the user account's. what did i do: I added a user in table radcheck. worked! next step, added same user in table: radacct. username:gebruiker CalledStationId: 00166f980e79 did not work! I change the MAC address to a wrong one, and i still get in.?? also in debug (radiusd -X) no radacct query is done?, so no attribute checkings are done !!?? So my question is, how can i make the attributes work with the mysql backend.. are we missing some mysql queries in the sql.conf ?? (btw, this all did worked with the 'users' file from freeradius) Cheers Collen

3 2

dumb humble question about sqlippool
by Guilherme Franco 29 Sep '06

29 Sep '06

Hi, I know you guys must be angry with all the questions I'm posting here. In Devel-List, I found this: "Is it usefull to community? (SQLIPPOOL and NASCATS)" by Roman M. Bibikov on Thu, 16 Oct 2003 17:36:26 +1100. He says that created a sucessfull ip pool in Oracle (exactly what I'm trying to do) and also that developed stored functions and procedures handling in rlm_oracle (sql_runfunction() and sql_runprocedure()) I didn't found out those functions and I'm wondering if it's because of this that I can't make sqlippool work in oracle... Thanks in advance

2 5

peap client constantly re-authenticating
by Rob Shepherd 29 Sep '06

29 Sep '06

Dear list, This may not be the right place to discuss this issue, but radiusd -X is the only info i've got to go on. The windows PEAP client re-authenticates every 10-20 seconds or so. Has anybody else seen this? is it normal behavour? I have a cisco wlan controller, and freeradius 1.1.2. my OS X 802.1x client doesn't do this. Cheers for any pointers, Rob

1 0

rpl_perl and housekeeping
by Pshem Kowalczyk 29 Sep '06

29 Sep '06

Hi, We are building a proxy system using rlm_perl. Proxy is reposible for IP allocation, attributes rewriting and keeping the session database. The system works fine if all the NASes (and other proxies) behave properly (ie they send all the packets they supposed to send etc). Obviously real situation is a bit worse and sometimes we get stuck with a non-existent session in our session db (because the 'Stop' record never arrived). This situation can be easily detected as we timestamp all db opeartions, so in theory we could expire all outdated sessions or allocated IPs, but so far I can see only one option to do that - use an external program. We're not very keen to do it in the packet-handling functions as some of the opeartions can be very time consuming, and as a result that would live the packet without any answer. Ideally we would like to see an ability to run some functions on defined time intervals (not only when a packet comes) so the housekeeping is done then. I'm not sure if I'm not streetching the applications of rlm_perl a bit too far, if such functionality existed - that would be great. Or perhaps is there a different method of doing this? kind regards pshemko

2 2

RE: v1.1.3 - Logging Levels / Syslog / logging passwords
by Garber, Neal 29 Sep '06

29 Sep '06

> Is there any way to squish the user password in the -xx output? Are there any hidden/undocumented setting for radiusd.conf that do that? radiusd -Xx | sed -e "s/\([pP]\)assword.*/\1assword <masked>/" This is a tweak from something Alan suggested to me... It gets rid of most of the passwords (it leaves the password rlm_ldap uses to bind and it removed some other info. - but I think it's pretty close to what you want)..

1 0

v1.1.3 - Logging Levels / Syslog / logging passwords
by Lin Richardson 28 Sep '06

28 Sep '06

Hello All, I've been working to configure logging as an aide to supporting our Freeradius installation. I'm familiar with logging level flags -x and -xx, as well as the big debug -X flag. My first observation is that ALL of these flags output to console by default. Is there any way to make the -xx or -x log to the logfile? I have toyed with setting logdir to 'syslog' in the radiusd.conf file. Alan said in a note to the list on Sept 6 that this feature didn't work in 1.1.3, but would in 2.0 I find it actually works pretty well IF you use the -x -xx or -X flag. The output that usually goes to the screen (most of it anyway) gets dumped to the syslog on my Solaris box just fine. It must be because either stderr or stdout get redirected to syslog, but not both. The actual requests still scroll on the console. I figure I can use >/dev/null 2>&1 & or some variant to kill the output still going to console and background the process... All of this is good, because I WANT a very verbose log file... my only problem is that user passwords are logged in clear text as part of the output - specifically from the pap module. This presents a security problem. (Never mind why I'm using clear text pap if I'm concerned with security.) Is there any way to squish the user password in the -xx output? Are there any hidden/undocumented setting for radiusd.conf that do that? suggestions from those who know? I seem to recall seeing a related thread a few weeks back, but cannot find it... my apologies in advance if this is repetitive. Regards, Lin Richardson

2 1

Re: How to deny user with changed username when using EAP-TLS
by Marcos González 28 Sep '06

28 Sep '06

>> I think as I'm using digital certificates (EAP-TLS) to authenticate >> users, and the user has a valid one, if there aren't any aditional >> checks in radcheck, the user has already been authenticated due to the >> certificate, and is allowed to enter the network. Is that right? > > Yes. But you can still reject them before the certificate is >validated. Or, you can have a Certificate Revocation List that marks >their certificate as invalid. Yes, I'm using them to reject users that, although having a valid certificate, I want to be out of the network, and works OK. Only wanted to aditionally prevent users that bypass my access control system changing their 'UserName' to an unused one, accessing the network. The revocation list is something I'll give a look, thanks! > > If that's the case, I think about using the exec module to call a > external shell script which checks if 'UserName' is included in my > database, and if it's not, modify 'UserName' to something like > 'Unauthorized', user that will be in a group with an 'Auth-Type = Deny'. > Do you think there's an easier way? > > See "rlm_exec". Run the script, and have the script print >"Auth-Type := Reject" to stdout if the user isn't found. That should >cause them to be rejected. Yes, It seems a good solution. Thank you very much! > Alan DeKok.

1 0

Re: Re: How to deny user with changed username when using EAP-TLS
by Marcos González 28 Sep '06

28 Sep '06

=?ISO-8859-1?Q?Marcos_Gonz=E1lez?= <mgtroyas(a)gmail.com> wrote: >> Is there any way to allow known users (those whose UserName appears in >> radcheck) access, but deny unknown (all other) users? > >Huh? If the user & password aren't known to the server, the default >*is* to reject them. If that isn't happening, then something in your >config is allowing them in. > >As always, run the server in debugging mode to see what's going on. > >Alan DeKok. I think as I'm using digital certificates (EAP-TLS) to authenticate users, and the user has a valid one, if there aren't any aditional checks in radcheck, the user has already been authenticated due to the certificate, and is allowed to enter the network. Is that right? If that's the case, I think about using the exec module to call a external shell script which checks if 'UserName' is included in my database, and if it's not, modify 'UserName' to something like 'Unauthorized', user that will be in a group with an 'Auth-Type = Deny'. Do you think there's an easier way? Thank you for your help.

2 1