October 2014 - Freeradius-Users - lists.freeradius.org

Re: Beginner help
by KAVYA PRABHAKAR 16 Oct '14

16 Oct '14

Hi, Thanks for the help. I am able to open 2083 tcp port. I have a RADIUS client which sends request to freeradius server. Before sending request to server, it creates a TCP\TLS connection with it. TCP connection is getting established and during TLS handhsake, server throws following error: (0) <<< TLS 1.0 Handshake [length 025c], Certificate --> verify error:num=18:self signed certificate (0) ERROR: SSL says error 18 : self signed certificate (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca (0) ERROR: SSL says: TLS Alert write:fatal:unknown CA (0) ERROR: SSL says: TLS_accept: error in SSLv3 read client certificate B (0) ERROR: SSL says: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. (0) FAILED in TLS handshake receive Closing TLS socket from client port 1645 Client has closed connection ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Waking up in 2.9 seconds. ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Looking at the debugs I think server expects client certificate information as well. Does it work on MTLS? (mutual TLS). I am using self signed certificate generated by ubuntu(where server is installed) and using the same in tls file. The same certificate is put under trusted root in client as well. Thanks, Kavya

2 1

Re: Beginner help
by KAVYA PRABHAKAR 16 Oct '14

16 Oct '14

Hi, I generated .csr using openssl command and used this csr to generate CA signed certificate. I installed this CA signed certificate under trusted root of server. But when I run freeradius in debug mode, I get the following error: (0) <<< TLS 1.0 Handshake [length 0208], Certificate --> verify error:num=20:unable to get local issuer certificate (0) ERROR: SSL says error 20 : unable to get local issuer certificate (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca (0) ERROR: SSL says: TLS Alert write:fatal:unknown CA (0) ERROR: SSL says: TLS_accept: error in SSLv3 read client certificate B (0) ERROR: SSL says: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. (0) FAILED in TLS handshake receive Closing TLS socket from client port 1645 Client has closed connection ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Debug says "fatal unknown_ca". I think I should be adding CA information somewhere in the server. Could anybody please guide me on the same. I would like to know where am I going wrong. Thanks, Kavya On Thu, Oct 16, 2014 at 8:26 AM, KAVYA PRABHAKAR < kavyamelinmaneprabhakar(a)gmail.com> wrote: > Hi, > > Thanks for the help. > I am able to open 2083 tcp port. > I have a RADIUS client which sends request to freeradius server. Before > sending request to server, it creates a TCP\TLS connection with it. > TCP connection is getting established and during TLS handhsake, server > throws following error: > > (0) <<< TLS 1.0 Handshake [length 025c], Certificate > --> verify error:num=18:self signed certificate > (0) ERROR: SSL says error 18 : self signed certificate > (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca > (0) ERROR: SSL says: TLS Alert write:fatal:unknown CA > (0) ERROR: SSL says: TLS_accept: error in SSLv3 read client > certificate B > (0) ERROR: SSL says: error:140890B2:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > SSL: SSL_read failed in a system call (-1), TLS session fails. > (0) FAILED in TLS handshake receive > Closing TLS socket from client port 1645 > Client has closed connection > ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, > 2083, virtual-server=default) > Waking up in 2.9 seconds. > ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, > virtual-server=default) > > Looking at the debugs I think server expects client certificate > information as well. Does it work on MTLS? (mutual TLS). > I am using self signed certificate generated by ubuntu(where server is > installed) and using the same in tls file. > The same certificate is put under trusted root in client as well. > > > Thanks, > Kavya >

2 1

Cache module to save user password?
by Enrique Sainz Baixauli 15 Oct '14

15 Oct '14

Hello there, I have a freeradius server for testing running v3.0.3, and I had a config where the server read the user details from an LDAP server and cached it to avoid future searches for the same user. I am pretty sure it used to work when I finally configured it, and without any changes or updates it just stopped working. Now, I can test any of the users in the database and it will send Access-Accept the first time I test, but if I try again while the entry in the cache is still there it will pop put "no known-good password for that user". My config for the auth section is as follows: update control { Cache-Status-Only := yes } cache if (notfound) { ldap update control { Cache-Status-Only := no } cache } While the update section of the cache module config is as follows: control:LDAP-Group += control:LDAP-Group control:Password-With-Header += control:Password-With-Header (although I also tried with control:User-Password instead of Password-With-Header) So the thing is that, when the cache module finds an entry for the user, it reads it (with Cache-Status-Only := yes, might that be the problem?) but then it doesn't find a known-good password for that user. If it had read the cache entry, I understand that it should be there. Any help is appreciated. And any additional info will be provided if needed :) Best regards, Enrique Sainz

1 0

Two questions SYSLOG (level of detail written and forwarding to a SIEM)
by Shawn Wiley 14 Oct '14

14 Oct '14

I have two questions. Please point me in the right direction if the answer is documented somewhere and I've missed it. First some background. I am running Red Hat Enterprise Linux 2.6.32-279.11.1.el6.x86_64 #1 SMP Sat Sep 22 07:10:26 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux Installed Package Name : freeradius Arch : x86_64 Version : 2.1.12 Release : 4.el6_3 I would like to feed logs into a SIEM (ArcSight). Has anyone done it? Is the procedure documented anywhere? It looks like I just parse the syslog output and feed that into the SIEM but I'd like some advice from anyone who has done it. Second Question The current syslog output is not very verbose but when I run Radiusd in -X mode I see a ton of data. I'd like to log close to what the -X outputs to my syslog file. From what I've read there's a module that will allow me to log that level of detail but I'm not sure I'm 100% familiar with the module concept. Do I just $INCLUDE modulename in the radius.conf file and then go into the module itself and make the configuration changes there? Ultimately I'd like my syslog file to show who tried to authenticate USERNAME, the IP address they initiated the auth request from USER's IP, successful authentication or fail/reject. Thanks in advance. Shawn L. Wiley, CISSP - Information and Application Security Architecture ________________________________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), Euronext or any of their subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired. ________________________________________________________

2 1

Version 3 ldap Generic
by Cody Ritts 14 Oct '14

14 Oct '14

Hello, I am upgrading from FR 1.1 to 3.0.4. I am struggling to understand the the syntax for upgrading my $GENERIC$ statement. I have only found 3 threads discussing, which I did non fully understand, and am not sure they covered my problem. In my old ldap.attrmap I have the following lines: > replyItem Framed-IP-Address dslIPAddress > replyItem Idle-Timeout dslIdleTimeout > replyItem $GENERIC$ dslACLin > replyItem $GENERIC$ dslACLout > replyItem $GENERIC$ dslINSPECTin > replyItem $GENERIC$ dslINSPECTout > replyItem $GENERIC$ dslStatus The example ldap contents of dslACLin and dslACLout are: > dslACLin: cisco-avpair += "ip:inacl=OUTBOUND" > dslACLout: cisco-avpair += "ip:outacl=FIREWALL" So, in my mods-enabled/ldap, when I added: > valuepair_attribute = "dslACLin" In my radtest reply, I do get a: > Cisco-AVPair = "ip:inacl=OUTBOUND" But based on one of the other threads and the way that it is configured, I will assume that "valuepair_attribute =" is only good once? Good news for me however, down at the bottom of update{} I see the following. > # These are provided for backwards compatibility. > # Where only a list is specified as the RADIUS attribute, > # the value of the LDAP attribute is parsed as a valuepair > # in the same format as the 'valuepair_attribute' (above). > # control: += 'radiusCheckAttributes' > # reply: += 'radiusReplyAttributes' so I add: > reply: += 'dslACLout' Then radiusd -X gets: >> /usr/local/etc/raddb/mods-enabled/ldap[85]: Invalid source for list '+=' so I try :=, and = with the same. To be honest, I dont know what the source list is. After reading man unlang I see that there is "update <list>" but then again, it says right above the block that this is not a unlang update format so, I am still lost. So I try this: > reply:Cisco-AVPair += 'dslACLout' And the server will start, but it does not parse out the avpair, this is the radius reply: > Cisco-AVPair = "cisco-avpair += \"ip:outacl=FIREWALL\"" So I dont know what I am doing wrong there, but I also bear in mind that this is just a "compatibility" feature, so when that gets dropped I will still be in the same spot. That makes me wonder about how I should have done that in the first place. I suppose I used GENERIC because it was in the same file as the other attributes, I tried it and it worked. Is there a "more correct" way of doing that for long term support? Like creating dictionary entries for those attributes then map them? Also, as an interim solution until I can update my schema and management applications, if I add dslACLout to the dictionary, and map it, then is it possible to use unlang and regex in post-auth/"update reply" to parse "cisco-avpair +=" out of dslACLout and then add it back in as cisco-avpair? Thanks in advance any help, Cody

2 4

Rlm_sqlippool with Simultaneous-Use > 1
by Amir Tal 14 Oct '14

14 Oct '14

Using freeradius-2.2.5-1.centos6.x86_64. Accounting data in mysql, IP pools in psql. Is it possible to use rlm_sqlippool with Simultaneous-Use > 1 ? Currently on second connection user is assigned same IP, causing a conflict on client side. Is it possible to add some other unique parameter to allow to assign multiple IPs for duplicate connections from same user? (assuming the two sessions are registered correctly in accounting DB) Amir.

2 1

FreeRadius 3.0.3 module thread safety
by Dejan Markic 14 Oct '14

14 Oct '14

Hello! I've written a module for FreeRadius currently running on version 3.0.3. I must admit, I have a very limited understanding about the thread safety in regards to modules. I register module as RLM_TYPE_THREAD_SAFE and in my instantiate function I load several MySQL database instances and some other instances. So they are all in rlm_MYMODULE_t instance stuct. Do I understand correctly, that if RLM_TYPE_THREAD_SAFE is used, this module instance struct might be used in different threads even tough I define only 4 instances, and 4 instances are created? So to put it in another way, I have four instances that might be used by 8 threads simultaneously? I now protect each instance with a mutex and sometimes it happens, that one instance gets the reply from our service with a bit of delay and then that instance mutex stays locked for >0.2 second and an avalanche effect occours. I guess three instances are working normaly, but one gets slowed down with each additional request, since it waits for that same mutex. Is that correct? Thank you very much for your replies. Kind regards, Dejan Markic

2 1

Re: Beginner help
by KAVYA PRABHAKAR 14 Oct '14

14 Oct '14

Hi, I am trying to setup radsec using freeradius version 3.0.3. I have generated self-signed certificate on my freeradius server using openssl commands. I generates .pem and .pfx certificate. I have placed the same files in certs folder of raddb and edited tls file respectively. Command to send radius request: radtest test 456 localhost 2083 testing123 When I run the above command I could see that request is going on 1812 port. Then i checked netstat command to check ports opened for radiusd. TCP port 2083 is not opened. How to open up TCP port and any extra parameters needs to be present in radtest command? Thanks, Kavya

2 1

Re: Cert validation on Android platforms
by Alan Buxey 13 Oct '14

13 Oct '14

Seems that one part of android dev doesn't talk to another part as if you use a private CA with recent releases you get a 'your network may be monitored' message which you can either just ignore/clear every time you restart your phone or remove the CA and don't validate your remote server!!! :( alan

1 0

Cert validation on Android platforms
by Arran Cudbard-Bell 13 Oct '14

13 Oct '14

I know a lot of people on here run WPA2-Enterprise and may be surprised to hear that it is currently not possible to configure the supplicant on Android devices to validate the CN in cert presented by the server. Maybe someone could poke the correct person at google and get this fixed: https://code.google.com/p/android/issues/detail?id=37178 Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2