November 2014 - Freeradius-Users - lists.freeradius.org

Comments before 3.0.5?
by Alan DeKok 20 Nov '14

20 Nov '14

We're going to release 3.0.5 soon. Please double-check that there are no last-minute issues. We've added a large number of regression tests to the source. They can't catch everything. So some manual double-checking is useful. Alan DeKok.

2 1

Freeradius version 2.1.12 with TTLS support
by Prasad Jadhav 20 Nov '14

20 Nov '14

Hi, I configured the freeradius version 2.1.12 with TTLS support. Note: for testing purpose using self signed certificate having following question 1. do I need to create certificate for per client machine base or per client username base. 2. Which certificates need to install on client side (OS: Windows 8) for TTLS Regards, Prasad Jadhav Alepo Technologies Pvt. Ltd. www.alepo.com<https://west.exch021.serverdata.net/owa/redir.aspx?C=519fb39324ec491582fa0b…> [Description: Description: cid:image001.png@01CAF37B.1103A920] _____________________________ Office: +91 22 61085000 Extn - 217 Skype ID : prasad9920 ________________________________ This email (message and any attachment) is confidential and may be privileged. If you are not certain that you are the intended recipient, please notify the sender immediately by replying to this message, and delete all copies of this message and attachments. Any other use of this email by you is prohibited. ________________________________

1 0

Error in user authentication : Freeradius + MySQL - Failed to create the pair: Invalid vendor name in attribute name "Password"
by Karuppasamy, Senthil 19 Nov '14

19 Nov '14

Hi, Followed the diff forum threads and have managed to link the Freeradius to look for users from a Mysql DB but am still not able to successfully authenticate users in this setup.I get the following error on receiving a user request Received Access-Request Id 24 from 10.127.6.21:59169 to 10.127.6.244:1645 length 76 User-Name = 'test' User-Password = 'test' NAS-IP-Address = 10.127.6.21 Service-Type = Administrative-User Calling-Station-Id = '10.120.92.40' NAS-Port-Type = Virtual (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "test", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) sql : EXPAND %{User-Name} (1) sql : --> test (1) sql : SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (1) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id desc (1) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc' rlm_sql: Failed to create the pair: Invalid vendor name in attribute name "Password" rlm_sql (sql): Error parsing user data from database result (1) ERROR: sql : SQL query error But the user exists in the DB as we can see from the following output : SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc; +----+----------+-----------+-------+----+ | id | username | attribute | value | op | +----+----------+-----------+-------+----+ | 2 | test | Password | test | := | | 1 | test | Auth-Type | Local | := | +----+----------+-----------+-------+----+ 2 rows in set (0.00 sec) I have attached the configuration files along with this mail. Any help in this would be very much appreciated. Senthil KSK ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

4 12

Verify Certificate
by Munroe Sollog 19 Nov '14

19 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When using 802.1x to authenticate clients to Active Directory using PEAP. It seems that even when using a complete trust chain for a certificate (a real honest-to-god certificate) the clients still get prompted to 'verify' the certificate. It would seem like this behavior is by design, as the user is still expected to confirm that the certificate is what they expect to see (similar to how ssh works). Setting aside the common user doesn't do any of that checking, and setting aside a managed computer environment (Active directory) can side load the certificate on the client automatically. Is my experience accurate, and if so how do people deal with this annoyance that I feel is perpetuating the 'ignore certificate alerts' behavior normal users have? For reference I have posted images of the certificate alert. http://i.imgur.com/gNOpBJ0.jpg - -- Munroe Sollog LTS - Network Analyst x85002 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJUbLTRAAoJEPbbZiWCKDVC1JcIAIYRcVbBVEyX1JvtboawuQBb bl14QohEhGg0W0dXbckaKXjJSZNoztvUXe1k/ckBlb6kG5v6uGZoOuEoLF11VrNT ISRYcJf3lBzFK4xg1ZABC8jVzpgS2a+UiGs0YmafuyvY6+hQAnvveVp1S8OtCs6I SsZtCUR4phxHvonUN/gKAYL2kaGKQcKDGED47hzXop3a/iUM63eFm1L9vz331lCr x9t9yN+yZTeJcfGPvJRd4AV03ALWgmnq9RbGcmMGvWpRXN9XpdDmtrgh4ml2RtcG 5JIkuxm4PtrxcVprRRzsQJCSv2Vejc8lJ8LsyuepoAFBw2pc6r18/MSRLvAwE6k= =H44Y -----END PGP SIGNATURE-----

1 0

Re: mac address in data vlan - drop
by A.L.M.Buxey＠lboro.ac.uk 19 Nov '14

19 Nov '14

Hi, > if ("%{User-Name}" =~ /^001ef7/) { > > > > update reply { > > Cisco-AVPair = "device-traffic-class=voice" rather than relying on the User-Name you might be able to do something more elegant - check the request to see if theres anything obvious/nice in it > And all works but when I plug off computer from CiscoPhone and plag in in > again, so computer mac-address is droped... because the port on the switch hasnt changed - the phone port PC has - check the phone settings for passthrough - but this isnt FreeRADIUS issue - this is all Cisco stuff. check eg http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/rel… alan

1 0

Freeradius 2.1.12-6 test issue
by Clive Allen 19 Nov '14

19 Nov '14

3 3

RE: mac address in data vlan - drop
by Alan Buxey 19 Nov '14

19 Nov '14

Cisco issue. Freeradius is sending back access-accept. Your issue sounds familiar to something I've seen with pass through before. Verify the behaviour with a change to the auth type on the switch eg multi-host alan

1 0

Use Mozilla's intermediate cipher suites set by default.
by Nick Lowe 19 Nov '14

19 Nov '14

Alan and Arran, Please may I suggest that you consider changing the default cipher suites configuration in FreeRADIUS 2.x and 3.x to use Mozilla's intermediate compatibility (default) set to encourage the use of better cipher suites that use ECDHE, GCM and PFS? See https://wiki.mozilla.org/Security/Server_Side_TLS This is: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA This is fully compatible all the way back to Windows XP where 3DES will be used. It also brings FreeRADIUS in to compliance with the very likely upcoming: https://datatracker.ietf.org/doc/draft-ietf-tls-prohibiting-rc4/ Cheers, Nick

3 11

mac address in data vlan - drop
by Bilik.AA＠lsrgroup.ru 19 Nov '14

19 Nov '14

Hello everybody! I faced such issue. When I connect CiscoPhone and a computer through it to my cisco switch port, authentication goes well (voice vlan for phone and data vlan for computer), but when I plug a computer off from Cisco Phone and plug in again, authentication is ok too but on port I see that: 1 a000xxxxxxxxxxxx DYNAMIC Drop 100 001exxxxxxxxxxxx STATIC Fa0/35 So computer can’t get access to local network. Port settings are following: --------------------------------------------------------- switchport mode access switchport nonegotiate switchport voice vlan 100 no logging event link-status authentication host-mode multi-domain authentication port-control auto authentication violation replace mab storm-control broadcast level pps 100 spanning-tree portfast spanning-tree bpduguard enable --------------------------------------------------------- How it can be fixed? (I work with freeradius-server-2.2.5 now) Thanks in advance, Alex Bilik С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image003.png@01D003E7.42ED21B0]

2 1

Version 2.2.6 has been released.
by Alan DeKok 18 Nov '14

18 Nov '14

We're happy to announce the release of Version 2.2.6. It has only minor changes from Version 2.2.5. ----------------- Feature improvements * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. Bug Fixes * Fix redundant-load-balance blocks to try other modules in the group if one fails. * Fix potential read into uninitialised memory in rlm_pap when normalising octet type attributes containing password hashes. This is very unlikely to happen in the wild. * Don't stop decoding DHCP options if we find a padding option. * Define sig_t on systems which don't have it. Closes #765 * When clients are loaded from SQL, allow them to be tied to a virtual server. * Prevent race conditions between fork and wait for child. Patch from James Rouzier. * Allow UTF-8 characters in SQL. * Back-port udpfromto fixes from v3

1 0