October 2009 - Freeradius-Users - lists.freeradius.org

wpa/wpa2 on logs
by Sergio Belkin 15 Oct '09

15 Oct '09

Hi, Is there a way to log if a supplicant is using either wpa or wpa2? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

4 8

Question regarding retrying of requests in detail-combined file
by Patric 15 Oct '09

15 Oct '09

Hi all :) FreeRADIUS 2.1.7 CentOS 5.2 I am not too sure where to start here so I will describe the symptoms first: I have 2 freeradius servers that both receive accounting requests, and proxy these requests to each other, as well as log these requests to a detail file. I have noticed now that while server A is processing the detail-combined file and proxying the requests to server B, server B will fail to get a lock on its detail file, and the request will fail. When this happens it is not passing anything back to server A, and server A does not seem to be timing out the request, so it stops processing the detail-combined file and just sits there. A bit more in depth, server B is still running FR 1.1.6. I am in the process of updating to 2.1.7 but am being delayed due to outdated OS, so am moving this lot to a new server. The lock fail is occurring when server B tries to get a lock on the detail-combined file, so it is very likely that I have had the proxying setup incorrectly here all along, but since it is 1.1.6 I do not expect help here... What I would like to try figure out is how to get server A (2.1.7) to time out a proxy request and retry it... Any pointers to sections/docs would be great as always, Thanks a mill! Patric

3 4

Problems with bootstrapping certificates
by Petr Uzel 15 Oct '09

15 Oct '09

Hi list, I have a question regarding bootstrapping default certificates using bootstrap script in raddb/certs directory. From the README: ------ $ radiusd -X That will cause the EAP-TLS module to run the "bootstrap" script in this directory. The script will be executed only once, the first time the server has been installed on a particular machine. This bootstrap script SHOULD be run on installation of any pre-built binary package for your OS. In any case, the script will ensure that it is not run twice, and that it does not over-write any existing certificates. ------ If I understand that right, it means that when I run the script twice, then generated certificates should not be changed (provided the *.cnf files did not change. But I observe something different: =======> cd raddb/certs/ =======> ./bootstrap openssl dhparam -out dh 1024 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time <SNIP> MAC verified OK openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der Everything OK so far =======> touch *.cnf =======> ./bootstrap openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key <SNIP> writing new private key to 'server.key' ----- openssl req -new -x509 -keyout ca.key -out ca.pem \ -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf Generating a 2048 bit RSA private key <SNIP> writing new private key to 'ca.key' ----- openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 2 (0x2) Validity Not Before: Oct 14 15:10:57 2009 GMT Not After : Oct 14 15:10:57 2010 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Oct 14 15:10:57 2010 GMT (365 days) failed to update database TXT_DB error number 2 make: *** [server.crt] Error 1 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time <SNIP> Generating a 2048 bit RSA private key ................................................+++ .....+++ writing new private key to 'server.key' ----- Generating a 2048 bit RSA private key .............................................................+++ .........................+++ writing new private key to 'ca.key' ----- Generating a 2048 bit RSA private key ........................+++ ...............+++ writing new private key to 'ca.key' ----- Using configuration from ./server.cnf Check that the request matches the signature Signature ok ERROR:Serial number 01 has already been issued, check the database/serial_file for corruption The matching entry has the following details Type :Valid Expires on :101014151025Z Serial Number :01 File name :unknown Subject Name :/C=FR/ST=Radius/O=Example Inc./CN=Example Server Certificate/emailAddress=admin(a)example.com Please notice that generating server.crt failed with "TXT_DB error number 2". Thus after issuing the ./bootstrap command for the second time, the server.crt file is empty. If I change unique_subject=yes to unique_subject=no in index.txt.attr before issuing second ./bootstrap, then the script finishes without errors, but I'm not sure the resulting files are correct. I have to admit that my knowledge of openssl is very limited, but as far as I understand that, this behavior is a bug, or at least it does not conform to the documentation. I would expect that the bootstrap/Makefile would simply do nothing if the required certificates are already present, no matter what are the timestamps of *.cnf files. The testing was done with current git master branch. -- Best regards / s pozdravem Petr Uzel, openSUSE Boosters Team ----------------------------------------------------------------- SUSE LINUX, s.r.o. e-mail: puzel(a)suse.cz Lihovarská 1060/12 http://www.suse.cz 190 00 Prague 9, CR

3 3

Default Proxy and Domain
by Andreas M. 15 Oct '09

15 Oct '09

Hello, i have a working setup but following question: In my proxy.conf i have one entry with our company nt domain (for wlan auth) realm ZB { type = radius authhost = LOCAL accthost = LOCAL strip } Why does it not work, if i configure the same with "realm DEFAULT", does the DEFAULT realm not match all realms, known or unknown ? regards, Andreas M. -- g, Andreas M.

2 1

Small suggestion for FreeRadius debug output
by Patric 15 Oct '09

15 Oct '09

Hi again, Alan I have a very small suggestion, if I may - what about adding a timestamp to the debug output? I am not familiar with C, so dont know how difficult it would be to implement though... I have been going through debug output for the last couple of days now attempting to resolve various configuration problems, and while not essential, it would be nice to see how much time has elapsed between a request and response for example... Something like this: [2009-10-15 10:00:00] Sending Accounting-Response of id 0 to xxx.xxx.xxx.xxx port 59807 Proxy-State = 0x323138 [2009-10-15 10:00:00] Finished request 701. [2009-10-15 10:00:01] Cleaning up request 701 ID 0 with timestamp +1286 [2009-10-15 10:00:01] Going to the next request [2009-10-15 10:00:02] Waking up in 0.3 seconds. Just a thought :) Thanks for everything! Patric

2 2

EAP-TLS failing after enabling crl_check
by Kyle O'Malley 14 Oct '09

14 Oct '09

Hi All, I've been very successful at getting EAP-TLS functional, up to the point of actually getting the CRL check to work. A little background on my setup: EAP-TLS Functional WITHOUT check_crl CRL downloaded via http interface (windows2k) which is by default DER format. This is converted to PEM. CRL can be verified with" openssl crl -in crlfile.pem -text" -- This shows up perfectly, as expected, including the serial#s of certs that are revoked. I can verify every cert, view with openssl -text etc. All of the certs are legit and work fine for non-crl auth so I don't think there is anything wrong with my certs. I've converted the private/public/cacerts into .pfx and extracted individual certs, just the cacerts, tried various bundles, everything is smooth, but makes no difference. The CA is running on win2k3, openssl isn't used on the freeradius box as a CA. I run a perl script c_rehash to create the symbolic links as hashed names to the PEM certs (c_rehash even seems to 'know' the CRL file is a crl by making it whatever.r0) Also verified permissions (freeradius will fail anyways if permissions to the certs don't work). In short, I've tried everything I can think of and no matter what, once I enable crl_check, clients are rejected. Full error msg below, however, this is the initial error: [tls] <<< TLS 1.0 Handshake [length 1076], Certificate --> verify error:num=3:unable to get certificate CRL See my config below; Running radiusd -X -f Here is my config: certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = "blah" private_key_file = ${certdir}/ca/freeradius-priv.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. certificate_file = ${certdir}/ca/freeradius-pub.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. CA_file = ${cadir}/ca/ca.pem # # For DH cipher suites to work, you have to # run OpenSSL to create the DH file first: # # openssl dhparam -out certs/dh 1024 # dh_file = ${certdir}/dh random_file = ${certdir}/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) uncomment the line below. # 5) Restart radiusd check_crl = yes crl_path = "/etc/raddb/certs/ca/crl.pem" CA_path = "/etc/raddb/certs/ca/" #pem_file_type = yes Here is the error: [tls] <<< TLS 1.0 Handshake [length 1076], Certificate --> verify error:num=3:unable to get certificate CRL [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [apophxw88397hpyjx.apollogrp.edu] (from client wireless_access_point1 port 12289 cli 00-26-B0-61-FD-32) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Here is the CApath directory: lrwxrwxrwx 1 root root 18 Oct 14 16:40 7a1f8db1.0 -> freeradius-pub.pem lrwxrwxrwx 1 root root 6 Oct 14 16:40 a7454e50.0 -> ca.pem lrwxrwxrwx 1 root root 7 Oct 14 16:40 a7454e50.r0 -> crl.pem -r--r----- 1 root radiusd 1760 Oct 14 16:18 ca.pem -rw-rw-r-- 1 root radiusd 1877 Oct 14 16:40 crl.pem -r--r----- 1 root radiusd 1751 Oct 14 16:40 freeradius-priv.pem -r--r----- 1 root radiusd 2268 Oct 14 16:40 freeradius-pub.pem I can post a more lengthy failure log if someone wants it - my question is, has anyone got this working without running the openssl CA right on the same box as freeradius? What am I missing? Thank you for any assistance.

1 0

typo in configure script version 2.17
by Andrew Stone 14 Oct '09

14 Oct '09

When I do a "./configure --help" I see the following: --with-system-libtldl Use the libtltdl installed in your system (default=use our own) I believe this should be: --with-system-libltdl Use the libltdl installed in your system (default=use our own) Hope this helps. -Andrew

1 0

virtual_server and the default server
by Alan Buxey 14 Oct '09

14 Oct '09

hi, this message is regarding the virtual_server definition in the clients section.... this allows you to point a client request directly to a virtual server. handy. okay - been trying to use this partially buried feature with clients in an SQL table if I add the special 'server' column (commented out in the schema by default) to the SQL table and then update the NAS query in dialup.conf (note, the server must be the last argument on the select query!) then add a named entry for a chosen client then its fine but, if I then query the server from a client that doesnt have a 'server' entry then it doesnt work..... this is what i get (all the startup stuff deleted) server { No such virtual server Invalid user: [testuser] (from client bigbox port 0) } # server Using Post-Auth-Type Reject No such virtual server Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 155 to 192.168.10.1 port 36684 Waking up in 4.9 seconds. if I go through and add 'default' to the virtual_server entry for all other clients then things still dont work - no such server : server default { No such virtual server default Invalid user: [testuser] (from client bigbox port 0) } # server default Using Post-Auth-Type Reject No such virtual server default Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 57 to 192.168.10.1 port 57991 Waking up in 4.9 seconds. but then if i add the 'server' wrapper around the sites-enabled/default ie server default { {rest of default server config } then it all works....this means that 2 presumptions are wrong: i thought that a blank virtual_server entry would be handled by default server i thought that the default server was known as 'default' i've obviously already been corrected by my trial and error...i'd rather not have been burned like this..but hey, we live and learn... but I am a little concerned by the 'no entry' failing - this means I have to edit a few more files to get things working as expected.... alan

1 0

FreeRADIUS Cluster && MySQL Webinar: online!
by Alan DeKok 14 Oct '09

14 Oct '09

The webinar is now recorded, and available online: http://www.mysql.com/news-and-events/on-demand-webinars/display-od-419.html Anyone wanting to know more about cluster performance should check it out. Alan DeKok.

1 0

errors There are no DB handles to use and Discarding conflicting packet from client
by Alisson 14 Oct '09

14 Oct '09

Hi, I have a dedicated server with freeradius 2.05 i'm getting 2 errors Error: Discarding conflicting packet from client net port 25000 - ID: 100 due to recent request 7343. There are no DB handles to use! skipped 0, tried to connect 0 I'm searching on the forums and a lot of people has this problem.. I change sql_num_socks = 30 I increase the max_connections=5000000 I increase everything that what was possible but the problem still happens I see on the forums in alot of web sites and nobody has the solution somebody can help? -- View this message in context: http://www.nabble.com/errors-There-are-no-DB-handles-to-use-and-Discarding-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 19