February 2013 - Freeradius-Users - lists.freeradius.org

Issues with Freeradius crashing after a sighup
by Alex Sharaz 08 Feb '13

08 Feb '13

Hi all, I've inherited a pair of Freeradius servers running Vsn 2.10 and have build a new server around the 2.2 source code. All of these servers exhibit the same problem in that after a SIGHUP to reload their configuration files the sometimes crash. Firstly the 2.1 servers We have 2 of them configured to support our wired and wireless auth user base. Each server has a primary auth function ( wired or wireless) and acts as a backup for the other server) These are running on an old Debian OS and make use of the Freeradius versions available through the apt-get package manager. Configuration wise everything uses password files and all logs are written to a local hard disk. We don't use SQL or AD or any other systems in the authentication or accounting process. password files are updated every 15 mins and are followed by a "service freeradius reload" command to bring them on line. At least once a day the freeradius daemon will crash just after the "reload" command. The normal logfiles (see below) just show the following with no indication of why the process crashed. Cfashes happen randomly on both servers, although the server handling the wireless network crashes more frequently than the one handling the wired network. Fri Feb 8 00:05:03 2013 : Info: HUP - loading modules Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "attr_filter.post-proxy" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "attr_filter.pre-proxy" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "attr_filter.access_reject" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "attr_filter.accounting_response" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "pap" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "files" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "accounting_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "auth_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "reply_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "pre_proxy_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "post_proxy_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "york_passwd" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "landb_device_info" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "switch_vlan_info" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "sql_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "suffix" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "mschap" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "mschap_default" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "detail" Fri Feb 8 00:05:03 2013 : Info: Loaded virtual server <default> Fri Feb 8 00:05:03 2013 : Info: Loaded virtual server inner-tunnel Fri Feb 8 00:05:03 2013 : Info: Loaded virtual server eduroam Freeradius version 2.2 - wireless server The 2.2 server was compiled from source on an Ubuntu 12.04 LTS VmWare server and has a slightly different configuration. Configuration files are used for MAC based authentication and for some standard users such as the university of york eduroam health check test account. For 802.1x authentication I use a back end AD system and authenticate all our "real users" against AD. Configuration files for MAC based authentication RADIUS clients and test users are generated once a day and the system is reloaded at midnight every day. The configuration used on this server is based upon the "template" one provided by UKERNA for their UK eduroam user base. This server can run for a couple of weeks before it crashes. I know I should run the daemon with the -X option and dump the output to a file, but given the random nature of these crashes, I'm not sure I'll have enough disk space to just run in debug mode and collect all the logs. Anyone else seen serve crashes on a reload? Rgds Alex

4 3

regarding radius crashing on sigHUP
by Alex Sharaz 08 Feb '13

08 Feb '13

> Alex Sharaz wrote: >> Anyone else seen serve crashes on a reload? > > Unfortunately I've seen this before. I haven't seen enough > information to track it down and fix it, though. |One workaround is to just do a restart instead of a reload. It's |not likely to make much of a difference. :-) that's what I ended up doing Rgds A

1 0

Re: [EAP/TLS] Authenfication through a certificate
by Alan Buxey 08 Feb '13

08 Feb '13

As already said, post output of radiusd -X (that will clearly show the logic taken) alan

2 1

Re: Freeradius-Users Digest, Vol 94, Issue 19
by Alex Sharaz 08 Feb '13

08 Feb '13

1st response On 8 Feb 2013, at 16:09, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Issues with Freeradius crashing after a sighup (Alan DeKok) > 2. RE: [EAP/TLS] Authenfication through a certificate > (vazoumana fofana) > 3. Re: Session-Timeout anomalies (Bill Isaacs) > 4. Re: Session-Timeout anomalies (Alan DeKok) > 5. Any interoperability issues with Aruba and Freeradius > (Alex Sharaz) > 6. Re: MAc-Auth with EAP (Tunde Ogedengbe) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 08 Feb 2013 10:10:05 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Issues with Freeradius crashing after a sighup > Message-ID: <5115154D.5070804(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Alex Sharaz wrote: >> Firstly the 2.1 servers > > <shrug> Upgrade. > >> password files are updated every 15 mins and are followed by a "service freeradius reload" command to bring them on line. > > See the changelog for 2.2.0. The "passwd" module had issues with > older versions of the server. > > You can also reload individual modules. That will be less likely to > have issues. i.e. > > $ radmin -e "hup passwd" > >> Anyone else seen serve crashes on a reload? > > Unfortunately I've seen this before. I haven't seen enough > information to track it down and fix it, though. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Fri, 8 Feb 2013 15:24:53 +0000 > From: vazoumana fofana <zoumlander(a)hotmail.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: [EAP/TLS] Authenfication through a certificate > Message-ID: <SNT137-W406D40D7E02D3B5D51A487D2050(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > i begin setting up configuration. bit i got two problems : > > client with good certificate can be authenticated even if they're not in "users" file. > I assume it's due to my code. Here is under authenticate section of default : > > Auth-Type eap { > eap > if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxx\// ) { > if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxxxxx\// ) { > ok > } > else { > fail > } > It's like when condition is checked, it bypassed "users" file. > > Maybe, i must move these lines under authorize ? > anyone to confirm it ? > > cheers > > >> Date: Mon, 4 Feb 2013 10:32:22 -0500 >> From: aland(a)deployingradius.com >> To: freeradius-users(a)lists.freeradius.org >> Subject: Re: [EAP/TLS] Authenfication through a certificate >> >> vazoumana fofana wrote: >>> i've got question about EAP/TLS and authentification for a client >>> through a certificate ? >>> I succeed setting up. But , i notice that freeradius matches client >>> login with certificate CNAME. >>> Is it possible to change it in order to match email instead of CNAME ? >> >> Yes. >> >> Read the eap.conf file, and the raddb/sites-available/default. This >> is documented. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

MAc-Auth with EAP
by Tunde Ogedengbe 08 Feb '13

08 Feb '13

I am setting up our Freeradius to do authentication for MAC address for windows PC. This is to enable PCs to connect to the AD to access Domain information just before Windows User Logon Screen. The PC is already connected to a Cisco switch port which has been configured 802.1x. I have stored list of authorized MAC addresses in a file called authorized_macs in Freeradius confdir. I have also set up appropriate commands in Authorize and Authentication sections of sites-enabled/default file for authorization and authentication. I can see from the log that the MAC addresses is checked and OK. But there is an [eap] returns reject just after the mac address was successfully checked. I guess I need a way to get radius to force an EAP accept after successful checking of the MAC addresses. Below is my Auth-Type statement which gets the system to do MAC address checking for PCs connecting with the hint “thehive”. The else statement is to cause all other requests to requests to be processed normally using mschap_ad (which is a function that calls ntlm_auth). Auth-Type MS-CHAP { if ( Hint == "validmac") { authorized_macs update control { Auth-Type := Accept } } else { mschap_ad } } Below is the extract of the log highlighting successful mac address checking but still returned [eap] returns reject # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if (outer.Hint == "validmac") [mschapv2] ? Evaluating (outer.Hint == "validmac") -> TRUE [mschapv2] ++? if (outer.Hint == "validmac") -> TRUE [mschapv2] ++- entering if (outer.Hint == "validmac") {...} [authorized_macs] expand: %{Calling-Station-ID} -> 00-1a-a0-b8-3b-73 +++[authorized_macs] returns noop ++- if (outer.Hint == "thehive") returns noop ++ ... skipping else for request 14: Preceding "if" was taken [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [host/hive-rjm2.library.networcs.net] (from client 193.62.48.37 port 50242 cli 00-1a-a0-b8-3b-73 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. -- 'Tunde Ogedengbe "But thanks be to God, who gives me the VICTORY through my Lord Jesus CHRIST" - 1 Corinthians 15:57

2 3

Configuring accounting on Freeradius server
by Deepti kulkarni 08 Feb '13

08 Feb '13

Hello, I am running Freeradius Server version 2.1.10 on a debian machine (64 bit). I have a debian client (using pam_radius_auth) for authentication and accounting. My client can authenticate into the the radius server, however, I dont see any accounting being done. Attached is the radiusd -X output. Is there any configuration required for the pam_radius_auth.so? Also on the freeradius server, I uncommented a line from acct_users - root@debian:/etc/freeradius# cat acct_users # # $Id$ # # This is like the 'users' file, but it is processed only for # accounting packets. # # Select between different accounting methods based for example on the # Realm, the Huntgroup-Name or any combinaison of the attribute/value # pairs contained in an accounting packet. # #DEFAULT Realm == "foo.net", Acct-Type := sql_log.foo # #DEFAULT Huntgroup-Name == "wifi", Acct-Type := sql_log.wifi # #DEFAULT Client-IP-Address == 10.0.0.1, Acct-Type := sql_log.other # #DEFAULT Acct-Status-Type == Start, Acct-Type := sql_log.start # Replace the User-Name with the Stripped-User-Name, if it exists. # DEFAULT User-Name := "%{Stripped-User-Name:-%{User-Name}}" root@debian:/etc/freeradius# Thanks in advance.

3 11

few accounting records with same radacctid
by Hocine M 08 Feb '13

08 Feb '13

hello, In ma accounting table there are many records with the same radacctid for one username. In this case | 23547 | SESS-50639-54b752-237134-642 | test(a)univ-rouen.fr | univ-rouen.fr| 2013-02-07 12:38:54 | NULL | 192.168.58.5 | 00-26-3E-70-99-C0:eduroam | 10.54.1.19 | CC-08-E0-BB-05-7E | | 23554 | SESS-50639-54b752-237134-642 | test(a)univ-rouen.fr | univ-rouen.fr| 2013-02-07 12:38:54 | 2013-02-07 12:39:41 | 192.168.58.4 | 00-0B-0E-A9-5B-C0:eduroam | 10.54.1.19 | CC-08-E0-BB-05-7E | Is it a normal records or is the simultaneous-use not working in my case? Thank

3 3

freeradius accounting of cdr and quotes for string attributes
by Kelly Roestel 07 Feb '13

07 Feb '13

My question is this, I need to write CDR information out using the linelog module in csv format. The requirement is that all string attributes need to be enclosed in double quotes. How does one go about doing this? If you look at the detailed format, these string attributes are enclosed. But there seems to be no option in linelog module. I am using freeradius v2.1.10. Thanks for any help Kelly

3 4

Re: FTP Error when Radius is UP
by Alan Buxey 07 Feb '13

07 Feb '13

Huh? How are the 2 related? What have you done to get onto thus state? alan

1 0

rlm_detail and locking
by Brian Candler 07 Feb '13

07 Feb '13

I have an application where I would like to read and process rlm_detail records in near-real-time (specifically to turn them into JSON and stuff them into a local database). I'm familiar with rlm_sql_log + radsqlrelay, and I know this is robust. So I was hoping to modify radsqlrelay to work with files being appended to by rlm_detail, but I turned up a wrinkle when checking the file locking in 2.2.x code. rlm_sql_log uses fcntl() locking only; but rlm_detail is different. It calls rad_lockfd_nonblock(), which uses lockf if available, else flock, and only uses fcntl if the other two are not available. It looks like fcntl and flock locks are independent of each other: http://www.mjmwired.net/kernel/Documentation/filesystems/locks.txt Question: what's the safe way to process detail files? Is there a Perl implementation of radrelay I can hack from? Looks like the original C implementation of radrelay was removed in 2005 (acd40e2e) I am aware of raddb/sites-available/buffered-sql, but that only shows how to get freeradius to read a detail file, not a standalone program. Thanks in advance, Brian.

2 2