May 2011 - Freeradius-Users - lists.freeradius.org

Edge case: TLS failure
by East, Bill 11 May '11

11 May '11

I feel I should put this out there just in case someone else does something as unusual as this: This morning, one of my staff members reported that her PC, which we're testing 802.1x authentication on, was dropping off the network. I thought to check the logfile and found Wed May 11 10:09:38 2011 : Error: TLS Alert write:fatal:bad record mac Wed May 11 10:09:38 2011 : Error: rlm_eap: SSL error error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Wed May 11 10:09:38 2011 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Googling came up with a lot of hits from this list, but none of the cases seemed to fit exactly. I restarted the daemon to see if there was a problem there but the error came back again. Finally since this seemed to be limited to the one machine alone I did some digging into the environment. Turns out, this is a newish machine, and the old one is still on the network and running. Further, she had just set a reservation for the new PC in DHCP, to use the old one's address. The old one, though, still had the old address. So we had two machines on a single switch port (using a dumb mini-switch), both with the same IP. We reassigned the old PC's IP and haven't seen a problem since. Amazing what can happen when you really screw up your environment. This E-mail, along with any attachments, is considered confidential and may well be legally privileged. If you have received it in error, you are on notice of its status. Please notify us immediately by reply e-mail or call 215-931-0300 / 800-228-8801 and then delete this message from your system. Please do not copy it or use it for any purposes, or disclose its contents to any other person. Thank you for your cooperation.

1 0

Re: Freeradius-Users Digest, Vol 73, Issue 8
by Daniel Davidson 11 May '11

11 May '11

I finally got this figured out. It did not have anything do do with freeradius, but since others using the program might run into it, I figured I should post it here. The arp cache of the server was limited by default to 128 addresses, which was running out pretty quickly. So I inserted and applied the values below in sysctl.conf and everything works great now. net.ipv4.neigh.default.gc_thresh3 = 4096 net.ipv4.neigh.default.gc_thresh2 = 2048 net.ipv4.neigh.default.gc_thresh1 = 1024 Dan On 05/04/2011 01:51 AM, freeradius-users-request(a)lists.freeradius.org wrote: > Message: 3 > Date: Tue, 3 May 2011 20:56:12 +0100 > From: Alexander Clouter<alex(a)digriz.org.uk> > Subject: Re: ldap server connection timeout > To:freeradius-users@lists.freeradius.org > Message-ID:<s73698-k73.ln1(a)chipmunk.wormnet.eu> > > Daniel Davidson<danield(a)igb.uiuc.edu> wrote: >> > >> > My new wireless network tested great, but now that I have rolled it out >> > to the entire building, I get error messages like: >> > >> > Mon May 2 15:15:06 2011 : Error: rlm_ldap: ldap_search() failed: Timed >> > out while waiting for server to respond. Please increase the timeout. >> > >> > And when these trigger, nearly everyone gets disconnected for about 5 >> > seconds. Possible relevant code from ldap module: >> > >> > ldap { >> > #private stuff<-- BUT CRUCIAL! >> > ldap_connections_number = 15 >> > timeout = 10 >> > timelimit = 10 >> > net_timeout = 5 >> > } >> > >> > The only existing firewalls are on the machines themselves and the ip >> > range of the servers are open with each other. Any ideas? >> > > I am guessing your LDAP server is*way* too slow when processing the > queries are making it munch through. Typical 'first-timer' mistakes are > that you are not indexing the important attribtues. For example our > filter looks like: > > filter = "(&(objectClass=Person)(|(businessCategory=staff)(businessCategory=student)(cn=avg*))(|(!(loginDisabled=*))(loginDisabled=FALSE))(cn=%{Stripped-User-Name}))" > > This takes ~0.02s to respond for us, how long does it take to process > the query at your end (test with the following and remember to test > the server when it is under load, which is probably why it worked > before you widely deployed it): > ---- > time ldapsearch -h ldap-server.example.com -x -LLL '<query>' > ---- > > Where<query> is what you see FreeRADIUS make in the output of 'radiusd > -X'. > > Cheers >

1 0

Multiple FR Server and NAS
by googerdi 11 May '11

11 May '11

Hi How can i configure FR if i have multiple FR Server and NAS. How can i tell for example a specific user is for specific NAS. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Multiple-FR-Server-and-NAS-tp438457… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Problem to start the daemon
by Meyer Jerome 11 May '11

11 May '11

Hello, I've installed the latest freeradius version (freeradius-server-2.1.10) from source! SO, I configured it and tested it with the command [radiusd -X] and it is ok! Now, I would to start the daemon in a normal way (/etc/rc.d). I copy the rc.radiusd into /etc/rc.d but nothing is started. Try to start like : /usr/sbin/radiusd nothing is started... Have someone an Idea? Regards, Jérôme

3 2

Free Radius 2.1.8 + Mikrotik
by Ahmed Syed 10 May '11

10 May '11

Can someone give me a hint how to solve following: We are using PPPoE server with FreeRadius autentification and we are using Simultaneous Use Checking. We are limiting number of simultaneous connections to 1. The problem is in nonstandard situation when PPPoE server is nonstandardly restarted and there will stay open sessions on the radius. New connections are unauthorized because of simultaneous checking. We must manually delete open sessions. All users are Reject/authetication failed that time...

3 2

De-autentication
by Rodrigo Yoshioka 10 May '11

10 May '11

Hi, I have just experienced some weird problem. I'm used to watch the mikrotik log of my pppoe.. and at some point more than 100 clients disconnected from it.. i was looking at the radius log, and I realize this information. Tue May 10 11:50:49 2011 : Error: Discarding duplicate request from client XXX.XXX.XXX.XXX/24:49942 - ID: 217 due to unfinished request 627656 Tue May 10 11:50:49 2011 : Error: Dropping conflicting packet from client XXX.XXX.XXX.XXX/24:54930 - ID: 202 due to unfinished request 627641 It repeated a dozens of times... do you know what could be happend. Thanks Rodrigo Yoshioka Suporte Tecnico Rede Telecom

3 2

Re: Restrict user only to a NAS
by Marcos TP 10 May '11

10 May '11

I forgot to mention that I use MySQL to manage my users and NAS. In the table that records the users exists a field 'radnas_id' where I can tell the NAS that he is entitled to connect, but can not enable this restriction

4 4

about access denied and Reject
by Tanjil Ahmed 10 May '11

10 May '11

Dear All im using version ffreeradius-server-2.1.8.. and also radius manager is installed here.. when my Mikrotik PPPOE users got Disconnect and trying to relogin they cant.. Access Denied,you are already logged in and Reject authentication failed msg like that which i got from My Radius Server.. at once too many connection Cannot login here .. how do i Resolve it thanks

1 1

Custom Accounting Fields
by Tim Donahue 10 May '11

10 May '11

Hi all, We are using Freeradius for accounting from our voip system. Is there documentation somewhere, that you can point me to, on how I can add a couple of custom vendor fields to the radacct database schema and the INSERT query? I have no problem reading the documentation, but I can't seem to find which documentation I need to review, especially to find what the default SQL query is, so I can make sure that the data stays consistent. Tim

2 1

PAP password check
by mic night 10 May '11

10 May '11

Hello, I have a freeradius server that i use to authenticate users before they access network switches. user passwords reside in an ldap directory with the following attributes and formats: userPassword: (CRYPT password) sambaNTPassword: (NT Hash) sambaLMPassword: (LM hash) PAP is choosing automaticaly the NT encryption to validate the password. Is there a way to force PAP to use the userPassword with the CRYPT encryption? PS: i have to keep sambaNTPassword and sambaLMPassword along with userPassword as check items for other use scenarii. i'll post the relevant part of my radius log file in case it helps, thank you. [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}$1$$xkbzS/dF4YU/JKyjA5.36." [ldap] sambaNtPassword -> NT-Password == 0x4539463933393235373938463136464345394639333932353739384631364642 [ldap] sambaLmPassword -> LM-Password == 0x4243333041323738464338383546424538393735438383546424538393735456 [ldap] userPassword -> User-Password == "{CRYPT}$1$$xkbzS/dF4YU/JKyjA5.36." [ldap] looking for reply items in directory... [ldap] user theUser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "thepassword" [pap] Using NT encryption. [pap] expand: %{User-Password} -> thepassword [pap] NT-Hash of thepassword = e9f93925798f16fc4c9f93925798f1 [pap] expand: %{mschap:NT-Hash %{User-Password}} -> e9f93925798f16fc4c9f93925798f1 [pap] User authenticated successfully

2 3