February 2013 - Freeradius-Users - lists.freeradius.org

Re: Degradation of service when authentication fails with Windows AD
by Antonio Alberola 11 Feb '13

11 Feb '13

> If you can describe the problem you're having, in correct terminology, > people might be able to make a suggestion. Be specific, about the > issues, the architecture you have, what you're trying to achieve, and so on. > Sorry, I will try to explain the problem better. I have a mail server where users are validated with local accounts (UNIX) or against a Windows AD. For this reason we use Radius. Sometimes the Radius server fails and stops authentication for everybody. In that point the logs that I sent to you appear. I need to restart Radius in order to it works again. > From what you've described so far, it sounds like you are losing > connectivity to one or more AD controllers, which is causing PAM > to hang (waiting for a Kerberos reply) or Samba/ntlm_auth to hang > (waiting for an RPC reply). > > It should be obvious what the solution is - reliable connectivity to a reliable AD controller. When we monitored the network and one of the Windows AD we could confirm that requests from Radius don't reach the AD, because they don't leave Radius. We believe that connectivity between Radius and AD is correct, they are on the same LAN and the AD continues to validate correctly even when Radius is failing. >From my point of view, for any reason, Radius receives requests that it can not manage, because of the AD, the network or whatever. These requests keep waiting and the buffer fills completly. I don't know why these requests are not removed from the queue and the buffer is cleared in order to allow new request. In this way we could avoid that request to the rest of the AD fail because of a particular AD.

3 2

Dualstack NAS ignored by RADIUS server when using IPv4
by Ondrej Famera 11 Feb '13

11 Feb '13

Hello all, I'm running freeRADIUS 2.2.0 server on dualstack machine. Some of the NAS devices that are using this server are dualstack, but they are not able to use IPv6 for communicating with RADIUS server so they use only the IPv4. Problem is that these NAS devices are rejected by RADIUS server with following error: Error: Ignoring request to authentication address 10.0.0.1 port 1812 from unknown client 10.0.0.2 port 1812 DNS: freeRADIUS server: radius.example.com - IPv4: 10.0.0.1 - IPv6: 2001:a:b:c::1 NAS device: dev1.example.com - IPv4: 10.0.0.2 - IPv6: 2001:a:b:c::2 RADIUS nas table: id | nasname | shortname | type | ports | secret | community | description | server ----+-------------------+-----------+-------+--------+---------------+-----------+-------------+-------------- 1 | dev1.example.com | dev1 | other | <NULL> | shared_secret | <NULL> | <NULL> | inner-tunnel By adding folloving to nas table it works: id | nasname | shortname | type | ports | secret | community | description | server ----+-------------------+-----------+-------+--------+---------------+-----------+-------------+-------------- 2 | 10.0.0.2 | dev1 | other | <NULL> | shared_secret | <NULL> | <NULL> | inner-tunnel ( it works as workaround but i think that it should work as well with hostname only ) Having IPv4-only or IPv6-only NAS doesn't trigger this problematic behaviour, as well as having dualstack NAS taht can communicate with RADIUS over IPv6. looks like bug to me, anyone experienced similiar problems? -- Ondrej Famera unix@fi

7 8

freeradius not working in normal mode but working in debug mode
by Nandkumar Palkar 11 Feb '13

11 Feb '13

Hi freeradius not working in normal mode but working in debug mode. Please suggest. Thanks, Nand

3 7

Libraries issue
by QASIM RAO 11 Feb '13

11 Feb '13

hi,i am facing problem during compilation of freeradius rlm_sql_mysql driver [root@localhost rlm_sql_mysql]# ./configure checking for gcc... gccchecking for C compiler default output file name... a.outchecking whether the C compiler works... yeschecking whether we are cross compiling... nochecking for suffix of executables... checking for suffix of object files... ochecking whether we are using the GNU C compiler... yeschecking whether gcc accepts -g... yeschecking for gcc option to accept ANSI C... none neededchecking for mysql_config... yeschecking for pthread_create in -lpthread... yeschecking for mysql_init in -lmysqlclient_r (using mysql_config)... yeschecking for mysql.h (using mysql_config)... yesconfigure: creating ./config.statusconfig.status: creating Makefileconfig.status: creating config.hconfig.status: config.h is unchanged[root@localhost rlm_sql_mysql]# make/usr/src/radius-iptv/libtool --mode=compile gcc -g -O2 -I../.. -I/usr/src/radius-iptv/src/include -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -fPIC -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -DMY_PTHREAD_FASTMUTEX=1 -c sql_mysql.cmkdir .libs gcc -g -O2 -I../.. -I/usr/src/radius-iptv/src/include -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -fPIC -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -DMY_PTHREAD_FASTMUTEX=1 -c sql_mysql.c -fPIC -DPIC -o .libs/sql_mysql.osql_mysql.c: In function 'sql_error':sql_mysql.c:335: warning: return discards qualifiers from pointer target type gcc -g -O2 -I../.. -I/usr/src/radius-iptv/src/include -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -fPIC -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -DMY_PTHREAD_FASTMUTEX=1 -c sql_mysql.c -o sql_mysql.o >/dev/null 2>&1/usr/src/radius-iptv/libtool --mode=link gcc -release 1.1.6 \ -module -export-dynamic -o rlm_sql_mysql.la \ -rpath /usr/local/lib sql_mysql.lo -L/usr/lib64 -lmysqlclient_r -lpthread -lm -lrt -ldl gcc -shared .libs/sql_mysql.o -L/usr/lib64 -lmysqlclient_r -lpthread -lm -lrt -ldl -Wl,-soname -Wl,rlm_sql_mysql-1.1.6.so -o .libs/rlm_sql_mysql-1.1.6.so(cd .libs && rm -f rlm_sql_mysql.so && ln -s rlm_sql_mysql-1.1.6.so rlm_sql_mysql.so)ar cru .libs/rlm_sql_mysql.a sql_mysql.oranlib .libs/rlm_sql_mysql.acreating rlm_sql_mysql.la(cd .libs && rm -f rlm_sql_mysql.la && ln -s ../rlm_sql_mysql.la rlm_sql_mysql.la)cp: target `../lib' is not a directorymake: *** [build-module] Error 1

1 0

FTP Error when Radius is UP
by George Innocent 11 Feb '13

11 Feb '13

Hi; I am using Freeradius on Ubuntu; The authentification part works fine but i am facing challenges when i try to ftp nodes on the network. When the Radius server is UP i get ftp error failure connection on the Nodes but with the Radius off the ftp works. FTP configuration on the Nodes are configured well. What could i be missing -- Regards: George Innocent.

4 5

Any interoperability issues with Aruba and Freeradius
by Alex Sharaz 10 Feb '13

10 Feb '13

Hi All, I'm sure the answer to this is nope, but ... At a recent Aruba training course in amongst the documentation supplied to us were a couple of presentation slides showing different types of eap authentication against recommended RADIUS servers for use with Aruba equipment (Just to be sure the slide heading said Aruba RADIUS Compatibility). The surprising bit was the fact that there was a "No" against Freeradius/TTLS (MD5,TLS,PEAP,LEAP,FAST all were yes) and a coment that said Freeradius also supports TTLS. Now it my well be that the slide is a bit old and just hasn't been updated but it does beg the question have any people using Freeradius with Aruba kit experienced any funnies that needed a specific set of "tweaking" for Aruba? I really can't imaging that it would be the case, but just thought I'd check. Rgds Alex

5 7

PAM authentication not working
by Jaap Winius 09 Feb '13

09 Feb '13

Hi folks, Having managed to get freeradius 2.10 to run on Debian squeeze with a username and password defined in /etc/freeradius/users, I was hoping to take a step forward by getting it to authenticate users through PAM. But, that's not working out as I had hoped. Could sombody please tell me what's missing, or what I'm doing wrong? So far I have done the following: 1.) Copied a set of 4096-bit MD5 SSL certificates that were used in the previous configuration to the /etc/freeradius/certs directory. To generate them, each time I used "LongStringNumberOne" for both the input and output passwords. Among the encryption files generated are ca.pem, dh, server.key and server.pem. The ca.pem file was also copied to my laptop's /etc/certs directory and is used with wpasupplicant for testing the system. 2.) Added the following lines to the end of /etc/freeradius/clients: client 192.168.2.0/24 { secret = LongStringNumberTwo shortname = mynet } 3.) Added the following line to the end of /etc/freeradius/users: DEFAULT Auth-Type = Pam 4.) In /etc/freeradius/eap.conf I changed the values of the following two attributes to: default_eap_type = ttls private_key_password = LongStringNumberOne 5.) In /etc/freeradius/radiusd.conf I changed the value of the following attribute to: user = root 6.) In both /etc/freeradius/sites-enabled/default and /etc/freeradius/sites-enabled/inner-tunnel, I uncommented the "pam" entry in section "authenticate". 7.) Some sources suggest changing it, but I chose to leave the contents of /etc/pam.d/radiusd unmodified: @include common-auth @include common-account @include common-password @include common-session 8.) My NAS is a Linksys is a WRT54GS running DD-WRT v24 firmware and is configured as follows: Wireless Mode AP Wireless Network Mode Mixed Wireless Network Name (SSID) mynet Wireless Channel 6 - 2.437 GHz Wireless SSID Broadcast Enable Network Configuration Bridged Security Mode WPA2 Enterprise WPA Algorithms TKIP+AES RADIUS Server Address 192.168.2.12 RADIUS Server Port 1812 RADIUS Shared Secret LongStringNumberTwo Key Renewal Interval (in sec.) 3600 Unfortunately, after starting the server in debugging mode with "freeradius -X", my client's authentication attempts get rejected and I get the following output from the freeradius server: ========================================= rad_recv: Access-Request packet from host 192.168.2.2 port 1025, id=0, length=245 Cleaning up request 6 ID 0 with timestamp +12 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2ecb21dd28cc340c did not finish! WARNING: !! Please read http://wiki.freeradius.org/ Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User-Name = "jwinius" NAS-IP-Address = 192.168.2.2 Called-Station-Id = "0014bf72f676" Calling-Station-Id = "00110a81fb2b" NAS-Identifier = "0014bf72f676" NAS-Port = 17 Framed-MTU = 1400 State = 0x2ecb21dd28cc340c8873b5871c637572 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700701500170301002073bdd7051dfb44f3caccd4c92... Message-Authenticator = 0x6cbe906a70bc7ee95f9ad3365a0471b0 # Executing section authorize from file /etc/freeradius/sites-enabled/ default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jwinius", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 112 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x0201001604109f00ed2b3ff2dd5111997f0ba6cee99e FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x0201001604109f00ed2b3ff2dd5111997f0ba6cee99e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "jwinius" State = 0xdbd7fca1dbd6f80c791225e3340ea6e4 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/ inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jwinius", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 1 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 211 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user jwinius [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jwinius attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 0 to 192.168.2.2 port 1025 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 ========================================= Any idea what I'm doing wrong? Thanks, Jaap

4 10

Session-Timeout anomalies
by Bill Isaacs 09 Feb '13

09 Feb '13

Hello all, I'm researching this anomaly myself in all the documentation, but thought it would also be helpful both to me and to others to post the problem here. SYMPTOM: Some "Access-Period" accounts (accounts which have X number of seconds to continue logging in and out starting from the very first login) are giving too much time -- that is, at some point they reload the full value of the account type and restart the count down. I discovered it while developing some interface code for our customer service dept. So far, this DOES NOT seem to be happening to all accounts. Moreover, the database info and radclient results are inconsistent on these accounts that ARE showing the anomaly. Here is an example of one such account, a development test account which I created for debugging purposes. It's value is 30 days (2592000 seconds) Radclient result: =============== # echo User-Name="cgitest",User-Password="cgitest" | radclient -c 1 -n 3 -r 3 -t 3 -x 127.0.0.1:1812 auth -S shared Sending Access-Request of id 24 to 127.0.0.1 port 1812 User-Name = "cgitest" User-Password = "cgitest" rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=24, length=26 Session-Timeout = 2366393 =============== sql query: SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM radacct WHERE UserName='cgitest' ORDER BY AcctStartTime LIMIT 1 \g +-------------------------------------------------------------------------------------+ | IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) | +-------------------------------------------------------------------------------------+ | 1447012 | +-------------------------------------------------------------------------------------+ =============== Ok, the problem here should be obvious but I'll explain these results for those who are impatient. The "Session-Timeout" number is way too large. As I stated previously, this is a 30 day account. It was counting down with no problems until a few days ago. It then mysteriously began reporting in the popup window which I was working on that it had 29.9 days left on it, after it had already counted down to something like 15 days. It simply seems to have reloaded itself, even though the sql query reports the accurate number of seconds which have actually expired. (1447012). So if we do the math: 2592000-1447012=1144988 (or roughly 13.25 days) should be the remaining time on this account. Not 27.38 days. Here is the sql counter from sqlcounter.conf: sqlcounter accessperiod { counter-name = Max-Access-Period-Time check-name = Access-Period reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = never query = “SELECT UNIX_TIMESTAMP() – UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = ‘%{%k}’ ORDER BY AcctStartTime LIMIT 1″ } (Before anyone bitches about the sql query being different, save your pixels -- no matter which style of query is used, the account reports that it began at the same time, there is truly no issue here that I can see). ALSO, BEFORE YOU ASK: There is only 1 radius server and only 1 sql server on the system. Besides, I have tested this exhaustively using different things like the public IP, the fqdn, etc etc. Results are the same - that is to say, wrong. lol Ok so the question then is: where the hell is radclient getting the notion that the account has 2366393 seconds left? Where is "Session-Timeout" getting this information? Why is it only doing it on some accounts and not others? Any insights would be greatly appreciated. I will post the resolution here (unless one of you smart lads or lasses beats me to it ;) ).

2 10

Re: Any interoperability issues with Aruba and Freeradius
by Alex Sharaz 08 Feb '13

08 Feb '13

Aruba now say they only support eap-tls and eap-peap when you offload eap onto their mobility controllers. Rgds Alex On 8 Feb 2013, at 16:46, freeradius-users-request(a)lists.freeradius.org wrote: > Re: Any interoperability issues with Aruba and Freeradius

3 3

Re: Issues with Freeradius crashing after a sighup
by Alex Sharaz 08 Feb '13

08 Feb '13

| See the changelog for 2.2.0. The "passwd" module had issues with |older versions of the server. | |You can also reload individual modules. That will be less likely to |have issues. i.e. | |$ radmin -e "hup passwd" | And from the control-socket code # # Control socket interface. # # HIGHLY experimental! It should NOT be used in production # environments. # The servers are in a production environment. I'd really like to try just reloading the passwd module to see if it makes any difference to the server stability but not at the detriment to any security type issues A On 8 Feb 2013, at 16:09, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Issues with Freeradius crashing after a sighup (Alan DeKok) > 2. RE: [EAP/TLS] Authenfication through a certificate > (vazoumana fofana) > 3. Re: Session-Timeout anomalies (Bill Isaacs) > 4. Re: Session-Timeout anomalies (Alan DeKok) > 5. Any interoperability issues with Aruba and Freeradius > (Alex Sharaz) > 6. Re: MAc-Auth with EAP (Tunde Ogedengbe) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 08 Feb 2013 10:10:05 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Issues with Freeradius crashing after a sighup > Message-ID: <5115154D.5070804(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Alex Sharaz wrote: >> Firstly the 2.1 servers > > <shrug> Upgrade. > >> password files are updated every 15 mins and are followed by a "service freeradius reload" command to bring them on line. > > See the changelog for 2.2.0. The "passwd" module had issues with > older versions of the server. > > You can also reload individual modules. That will be less likely to > have issues. i.e. > > $ radmin -e "hup passwd" > >> Anyone else seen serve crashes on a reload? > > Unfortunately I've seen this before. I haven't seen enough > information to track it down and fix it, though. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Fri, 8 Feb 2013 15:24:53 +0000 > From: vazoumana fofana <zoumlander(a)hotmail.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: [EAP/TLS] Authenfication through a certificate > Message-ID: <SNT137-W406D40D7E02D3B5D51A487D2050(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > i begin setting up configuration. bit i got two problems : > > client with good certificate can be authenticated even if they're not in "users" file. > I assume it's due to my code. Here is under authenticate section of default : > > Auth-Type eap { > eap > if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxx\// ) { > if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxxxxx\// ) { > ok > } > else { > fail > } > It's like when condition is checked, it bypassed "users" file. > > Maybe, i must move these lines under authorize ? > anyone to confirm it ? > > cheers > > >> Date: Mon, 4 Feb 2013 10:32:22 -0500 >> From: aland(a)deployingradius.com >> To: freeradius-users(a)lists.freeradius.org >> Subject: Re: [EAP/TLS] Authenfication through a certificate >> >> vazoumana fofana wrote: >>> i've got question about EAP/TLS and authentification for a client >>> through a certificate ? >>> I succeed setting up. But , i notice that freeradius matches client >>> login with certificate CNAME. >>> Is it possible to change it in order to match email instead of CNAME ? >> >> Yes. >> >> Read the eap.conf file, and the raddb/sites-available/default. This >> is documented. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

3 4