October 2014 - Freeradius-Users - lists.freeradius.org

OS and Freeradius
by Service Technique AreA 28 Oct '14

28 Oct '14

Hello, I have a server with freeradius v1.x I took a test server to test an OS update with a new version of freeradius. The stable version of freeradius is 2.2.5? What OS do you recommend? Ubuntu 14.04 LTS or Debian 7? 32 or 64 bit? Is it more difficult to move from version 1 to version 2.2.5? I use Freeradius to a Hotspot system. I Wi-Fi routers with integrated Chillispot (dd-wrt) and routers are connected to the box of customers Kind regards

3 3

EAP-TLS fails with 'TLS Alert read:fatal:bad certificate'
by Tabor Kelly 28 Oct '14

28 Oct '14

I'm trying to setup an EAP-TLS network with freeradius-server-2.2.5. I am using the example simple configuration with the username bob, password hello, and the sample server/client certificates that were generated in /usr/local/etc/raddb/certs. Authentication is failing with the following output: rad_recv: Access-Request packet from host 127.0.0.1 port 35906, id=101, length=188 User-Name = "bob" Called-Station-Id = "00-1A-EF-41-E2-2E:UBUNTU-TABOR" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "34-23-87-00-14-3F" Connect-Info = "CONNECT 11Mbps 802.11b" Acct-Session-Id = "544EC2A6-00000015" Framed-MTU = 1400 EAP-Message = 0x0250000d0d001503010002022a State = 0x45e158e041b155dbff559d4ce378d770 Message-Authenticator = 0xd1b7786e651558d6c517f695892a9827 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 80 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry bob at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Just to clarify: does this mean that freeradius didn't like the certificate that the client sent? Thank you, Tabor

2 1

EAP-TLS + username/password
by João Alves 27 Oct '14

27 Oct '14

Hello,I currently have a freeradius setup where the client authenticates using username/password. My goal is to authenticate the user using a client certificate (using EAP-TLS), however, I would still like to maintain the username/password authentication. Preferably the flow would be something like this:1.User authenticates to radius_server_1 using EAP_TLS2.radius_server_1 after authenticating the client (and only if authentication is sucessful) forwards a request to radius_server_2 with the client username/password3.radius_server_2 authenticates clientSo only if both radius_server_1 and radius_server_2 authenticate the client is the client granted access.The flow doesn't necessarily need to be like the one above, I am open to suggestions, I'm not really sure what is possible and what isn't and would like to know my options.

2 1

Re: Freeradius-Users Digest, Vol 114, Issue 81
by Rui Ribeiro 27 Oct '14

27 Oct '14

Hi, I have been using Debian 7 64 bits with 2.2.5 and 3.x and it is working fine. In my opinion Debian is more stable than Ubuntu. I would also strongly advise to go to 64 bits, unless you have very strong reasons to use 32 bits. Regards, Rui Message: 4 > Date: Mon, 27 Oct 2014 16:50:45 +0100 > From: Service Technique AreA <service.technique.area(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: OS and Freeradius > Message-ID: > <CA+w4UpgaF9Vm2YMR8bLALS2nP6YU8_= > bJgmsABxpZvVxWP-VVQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hello, > > I have a server with freeradius v1.x I took a test server to test an OS > update with a new version of freeradius. > > The stable version of freeradius is 2.2.5? > > What OS do you recommend? Ubuntu 14.04 LTS or Debian 7? 32 or 64 bit? > > Is it more difficult to move from version 1 to version 2.2.5? > > I use Freeradius to a Hotspot system. > I Wi-Fi routers with integrated Chillispot (dd-wrt) and routers are > connected to the box of customers > > Kind regards > >

1 0

FR 3.0.x Head + coova chilli + mysql Volume Limit
by Abdullah 27 Oct '14

27 Oct '14

Hello Fr disconects the user auto at 2gb, when i increase the ChilliSpot-Max-Total-Octets to anything more than 3.9GB, it never disconnects the user whereas any value under 3.9GB works fine and user gets disconnected when the limit is reached. I need some help as to how volume greater than 4GB can be implemented. I have tried some older methods involving setting up counters but either they dont get called/executed from the same config files as in 2.x branch So please guide me as to how can it be achieved Regards,

4 17

Backslash in password failing with NT-Password hashes
by Dave Duchscher 27 Oct '14

27 Oct '14

We had a strange case where a users was unable to authenticate with our VPN server but could on wireless. I think I have tracked down the problem and am hoping I can get help with a fix. My test environment is a stock freeradius 2.2.5 server with default configuration files. The only change was to manually add the NT-Password to check to the authorize section. update control { NT-Password := 'CD09F6070B94F498FC9D6668800E6854'; } That is the NT hash for the password 'pass\word'. Test client is radtest on the same system. radtest -d /usr/local/etc/raddb -t pap -x username pass\\word localhost 100 testing123 Testing this with the NT hash for the password 'password' works. When I test with password 'pass\word', I see the wrong NT hash being generated so authentication fails. Tue Oct 21 08:03:54 2014 : Info: [pap] login attempt with password "pass\word" Tue Oct 21 08:03:54 2014 : Info: [pap] Using NT encryption. Tue Oct 21 08:03:54 2014 : Info: [pap] expand: %{User-Password} -> pass\\word Tue Oct 21 08:03:54 2014 : Info: [pap] NT-Hash of pass\\word = 5a022f09a08097a8f2ca5d16ef3df23e Tue Oct 21 08:03:54 2014 : Info: [pap] expand: %{mschap:NT-Hash %{User-Password}} -> 5a022f09a08097a8f2ca5d16ef3df23e Tue Oct 21 08:03:54 2014 : Info: [pap] Passwords don't match From what I am seeing it look like the password is sent across correctly but then the backslash is escaped and that escaped result is hashed which gets us to the wrong hash. Any ideas? -- Dave

1 1

Freeradius 3.0.4 and 2+2 VSA issue
by Aleš Rygl 27 Oct '14

27 Oct '14

Hi all, I have a problem using VSA encoded in 2+2 format, namely those in dictionary.starent in 3.0.4 version of the Freeradius. The server uses the dictionary supplied within the tarball. The server is processing just accounting requests and saving the requests into a detail file at the moment. But they are not decoded: received Accounting-Request Id 177 from 10.49.36.49:37817 to 10.49.36.230:1813 length 735 User-Name = 'wap' Calling-Station-Id = '420601521211' NAS-IP-Address = 10.49.32.253 Acct-Status-Type = Stop NAS-Identifier = 'tmcz-gw1' Attr-26 = 0x00001fe40120001031352e302028353435313529 Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Wireless-Other Attr-26 = 0x00001fe4003e000800000001 3GPP-IMSI = '230015002746529' 3GPP-IMSI-MCC-MNC = '23001' 3GPP-NSAPI = '5' 3GPP-Selection-Mode = '1' 3GPP-Charging-ID = 559411603 3GPP-GPRS-Negotiated-QoS-profile = '05-1392127396D1FE7406FFFF001600' 3GPP-Charging-Characteristics = '0800' Called-Station-Id = 'internet.t-mobile.cz' 3GPP-SGSN-Address = 89.24.0.232 3GPP-GGSN-Address = 89.24.0.248 3GPP-GGSN-MCC-MNC = '23001' 3GPP-Negotiated-DSCP = 0 3GPP-RAT-Type = UTRAN Attr-26.10415.23 = 0x8001 3GPP-IMEISV = '8639640220236677' 3GPP-PDP-Type = 0 Acct-Session-Id = '591800F82157F193' Acct-Authentic = RADIUS Attr-26 = 0x00001fe4005e001a6d766e6f2d3030312d746d637a2d696e7465726e6574 Attr-26 = 0x00001fe400fa0013696e745f686f6d655f6e6f5f667570 Class = 0x6374782d6161612d6665313b313431323831333830393b3332333439363034 Attr-26 = 0x00001fe4000200066769 Attr-26 = 0x00001fe4007b000800000001 Attr-26 = 0x00001fe400680007616161 Attr-26 = 0x00001fe4012d000c6f63732d6c697665 3GPP-Charging-Gateway-Address = 10.94.77.53 Attr-26 = 0x00001fe40069000800000000 Acct-Multi-Session-Id = '591800F82157F191' Attr-26 = 0x00001fe40092000800000000 Framed-MTU = 1500 3GPP-Location-Info = 0x0132f0103520f9c2 3GPP-SGSN-MCC-MNC = '23001' 3GPP-Session-Stop-Indicator = 255 Attr-26 = 0x00001fe40003000800000002 Event-Timestamp = 'Oct 23 2014 15:36:57 CEST' Framed-IP-Address = 10.93.248.122 Attr-26 = 0x00001fe40018000800000004 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Session-Time = 1 Acct-Terminate-Cause = User-Request NAS-Port = 413912 Attr-26 = 0x00002149020331 Attr-26 = 0x00002149090a3237353530343536 It seems that just starent VSA are affected but I can see tha also Attr-26.10415.23 is not decoded to 3GPP-MS-Time-Zone thought it is present in /usr/share/freeradius/dictionary.3gpp The sample of dictionary.starent: VENDOR Starent 8164 format=2,2 BEGIN-VENDOR Starent ATTRIBUTE SN-VPN-ID 1 integer ATTRIBUTE SN-VPN-Name 2 string ATTRIBUTE SN-Disconnect-Reason 3 integer ATTRIBUTE SN-PPP-Progress-Code 4 integer ATTRIBUTE SN-Primary-DNS-Server 5 ipaddr ATTRIBUTE SN-Secondary-DNS-Server 6 ipaddr ATTRIBUTE SN-Re-CHAP-Interval 7 integer ATTRIBUTE SN-IP-Pool-Name 8 string Though the attributes are not decoded you can still refere to then in the configuration (i.e. no error is reported) so it looks like the server knows them. radiusd -XC show no errors, the binary was built from source and a .deb package was created. I can provide more samples if needed. Thanks for help. Regards Ales

3 4

Puppet module for FreeRADIUS
by Jonathan Gazeley 27 Oct '14

27 Oct '14

Hi chaps, I just wanted to announce that I've released a Puppet module on Puppet Forge which can be used to install and configure FreeRADIUS. https://forge.puppetlabs.com/jgazeley/freeradius The first release is not fully-featured but it does allow the administrator to configure clients, servers, modules, policies and dictionaries, amongst other things. It has only been tested using FreeRADIUS 2.x on CentOS 6. So if anyone else on this list is using Puppet to configure their servers, I'd be keen to get your feedback on the module, including testing on other distributions. Obviously patches etc are welcome via Github. I will continue developing the module as I use it more widely at my own site. Support for FreeRADIUS 3.x is on the roadmap, and I plan to extend the module to support it at the same time that my employer decides to migrate to 3.x. Thanks, Jonathan

1 0

detail server stopped working silently
by adrian.p.smith＠bt.com 24 Oct '14

24 Oct '14

We have version 3.0.3 running with 2 detail file servers. We have noticed that the relay of packets from these detail files stopped working with no error reported in the radius log. A restart of the radius process made it all work again. Is this a known issue and/or has it been addressed in 3.0.4? Thanks, Adrian Smith

2 11

[patch] [regression] freeradius 3.0.4: dhcp module cuts suboption list of option 82
by Eugene Grosbein 24 Oct '14

24 Oct '14

Hi! Today I made another attempt to migrate from freeradius-2.2.2 to latest release 3.0.4. I use dhcp module and rlm_perl. I found that radiusd passes DHCP-Relay-Circuit-Id suboption to my perl script but no DHCP-Relay-Remote-Id suboption. Long story short: radiusd receives both suboptions and parses them correctly but stores only first one due to subtle bug. I fixed the problem with the following patch: --- src/modules/proto_dhcp/dhcp.c.orig 2014-09-10 20:57:22.000000000 +0700 +++ src/modules/proto_dhcp/dhcp.c 2014-10-24 22:08:53.000000000 +0700 @@ -994,7 +994,7 @@ ssize_t fr_dhcp_decode_options(VALUE_PAI pairfree(out); return -1; } - fr_cursor_insert(&cursor, vp); + fr_cursor_merge(&cursor, vp); for (vp = fr_cursor_current(&cursor); vp; That is, the function fr_dhcp_decode_options() calls fr_dhcp_attr2vp() to parse list of suboptions but uses fr_cursor_insert() to store it. fr_cursor_insert stores only first suboption and fr_cursor_merge should be used instead to store all of suboptions. With noted fix, freeradius 3.0.4 runs just fine for me. Some time ago I reported crashes in the perl subsystem - I managed to elimitate them by abadoning usage of unixODBC/DBD::ODBC for MS SQL access and now use DBD::SyBase with freetds directly. Thank you for the great release. Eugene Grosbein

1 1