April 2014 - Freeradius-Users - lists.freeradius.org

radutmp and sradutmp modules
by Matthew Ceroni 04 Apr '14

04 Apr '14

Hi: I am utilizing FreeRadius as an authentication server for a 802.1x environment (wired and wireless). Everything is up and running great. I recently enabled Accounting and turned on the radutmp and sradutmp files. I am probably missing something simple but running radwho only shows the last person to login. So if I sign onto the wireless or wired network, authenticate successfully to the radius server and type radwho is shows me as logged in. If another users signs on the output of radwho just shows them (always a single line of output). Is radwho meant to keep track of all currently signed in users? Or am I missing something simple? Thanks

2 1

Trusted CA, Signed Certs and Verification
by Sam Fakhreddine 04 Apr '14

04 Apr '14

Hello, I have been trying to use a Trusted CA to sign our freeradius server. The certificates are installed, the key, cert, the root chain all in their appropriate PEM files. The devices try to get the certificate that we specify; However, whenever we try to connect with an iOS device or Windows we get an error saying that the identity cannot be verified. I spoke with our SSL provider's support department, and they say this is normal behavior. There will always be a warning about identity not being able to be verified. Is this true? Am I missing something obvious? Sam Fakhreddine Site Systems Administrator

5 12

DHCP module and external DHCP relay
by Eugene Grosbein 04 Apr '14

04 Apr '14

Hi! We use FreeRADIUS 2.2.0 as DHCP server with rlm_perl to connect to external database to run stored procedure there that returns IP/mask/DNS etc for option82-enabled requests. The database is pretty fast and serves hundreds of parallel requests in 1 second or less. FreeRADIUS receives all DHCP requests from external high loaded DHCP relay and threats them all as coming from single DHCP client. Our perl script does extensive logging through direct syslog connection and I see that there is great delay between the moment of DHCP request arrival as shown by tcpdump and the moment when post_auth perl function is invoked by FreeRADIUS. This delay is about 6 seconds and some DHCP clients do not wait for so long. Is it possible to eliminate these delays? Here are lines from radiusd log: Request 14280134 has been waiting in the processing queue for 6 seconds. Check that all databases are running properly! Discarding duplicate request from client dhcp port 67 - ID: 1381353109 due to unfinished request 14280311 Again, our database processes most request in less than 1 second and very seldom in 2 seconds but mentioned problem is persistent. Eugene Grosbein

2 11

Re: Freeradius-Users Digest, Vol 108, Issue 17
by Rui Ribeiro 03 Apr '14

03 Apr '14

This is very important. You either place your DHCPs in your multiple broadcast domains, or do your L4 routing with dhcp-helpers (which of course is the right way to do it). Even then you have to be careful how you are doing your routing. There is no other way. Be also careful with your NATs, many protocols are broken by NAT. Regards, Rui Ribeiro http://pt.linkedin.com/pub/rui-ribeiro/16/ab8/434/ > Message: 3 > Date: Thu, 03 Apr 2014 12:26:51 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius DHCP IP pool and not correct port for DHCP > Message-ID: <533D8BCB.3000403(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Thomas Bru wrote: > > You're true and your explanations are very usefull. > > That's good. > > > The IAD has no problem because it did what I programmed. > > But there are not solution to this source-nat problem. > > There is. DHCP traffic MUST NOT be NATed. The NAT gateway must > either (a) block the DHCP traffic, or (b) implement a DHCP relay. > > Alan DeKok. > >

1 0

Re: Freeradius-Users Digest, Vol 108, Issue 18
by Rui Ribeiro 03 Apr '14

03 Apr '14

Why not define networks/VLANs for the APs? The control network should be in an firewalled netblock anyway for security reasons. Regards, Rui Ribeiro > > Message: 3 > Date: Fri, 4 Apr 2014 00:26:19 +0200 > From: Benoit <goony(a)hotmail.fr> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: update NAS > Message-ID: <DUB124-W62743D37C6A0D2C4389E5CA6C0(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > > I've been looking up how to reload my SQL NAS list without having to > restart the service, and found this command: > > kill -1 `cat /var/run/freeradius/freeradius.pid` > > I checked and the freeradius.pid file is there, and if I run the command > it seems to work since no error returns. But it does not seem to affect the > freeradius process and my updated clients list is still not recognized. > > Is this the way to proceed? What can I be missing? > > > Anyways I was wondering, if I restart the freeradius service, will the > current connections (and/or their accounting) be lost or affected? Or is it > just a problem if someone tries to connect exactly when the service > restarts? > > Benoit > > >

1 0

Subject: Re: AW: freeradius EAP TLS / Windows 8 Client was Re: Freeradius-Users Digest, Vol 108, Issue 18
by Rui Ribeiro 03 Apr '14

03 Apr '14

As far as I remember Windows 8 is far more picky with configurations/certificates than the previous versions. It took a while and a couple of tries to get the certificate right. Rui > Message: 1 > Date: Thu, 03 Apr 2014 22:11:18 +0200 > From: Alain P?an <alain.pean(a)lpn.cnrs.fr> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: AW: freeradius EAP TLS / Windows 8 Client > Message-ID: <533DC066.1040706(a)lpn.cnrs.fr> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Le 03/04/2014 19:39, kai.zemke(a)hauni.com a ?crit : > > While i was investigating i also found this bugs about windows 8 and > cisco APs. > > But they all apply to setups with a centralized access point management. > I have only autonomous standalone access points. > > So from my point of view... this bug does not apply to my setup. > > I already read the report of such a behaviour with windows 8 and a > Netgear wireless access point (wnap300). If you have another wireless > AP available, for example aruba, you should try with it. Another test is > to try PKIP instead of WPA2 on your AP ssid. > >

1 0

eDirectory question :-)
by stefan.paetow＠diamond.ac.uk 03 Apr '14

03 Apr '14

Hi, Quick question... does the FreeRADIUS rlm_ldap module have to be built explicitly with eDirectory to support it or does it support it as standard? AFAIK eDirectory does standard LDAP/LDAPS anyway, doesn't it? Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

2 2

Querying freeRADIUS from Java
by Estefania figueroa buitrago 03 Apr '14

03 Apr '14

Hello guys, I just started to use freeRADIUS. The server is running and working with mySQL just like in this tutorial: http://wiki.freeradius.org/guide/SQL-HOWTO What I want to do is really simple. I want to be able to query the server from Java just like radtest does and get response information, for example: Framed-IP-Address = 2.3.4.1 Framed-IP-Netmask = 255.255.255.255 Framed-Routing = Broadcast-Listen Framed-Route = "2.3.4.0 255.255.255.248" Idle-Timeout = 900 Service-Type = Framed-User Framed-Protocol = PPP to be processed later also in Java. Is there a way to do this and keep it as simple as possible? I have an application server written in Java (Mobicents) and I only need to obtain authentication information from freeRADIUS to process it later. Sorry if my cuestion isn't pertinent, but I haven't find anything in the wiki. If there is no way to do this, I would be very grateful if you could show another way to do it. Greetings, Estefanía

4 3

update NAS
by Benoit 03 Apr '14

03 Apr '14

Hi, I've been looking up how to reload my SQL NAS list without having to restart the service, and found this command: kill -1 `cat /var/run/freeradius/freeradius.pid` I checked and the freeradius.pid file is there, and if I run the command it seems to work since no error returns. But it does not seem to affect the freeradius process and my updated clients list is still not recognized. Is this the way to proceed? What can I be missing? Anyways I was wondering, if I restart the freeradius service, will the current connections (and/or their accounting) be lost or affected? Or is it just a problem if someone tries to connect exactly when the service restarts? Benoit

2 1

freeradius EAP TLS / Windows 8 Client
by kai.zemke＠hauni.com 03 Apr '14

03 Apr '14

Hi everyone, we have a strange problem going on here. We have a Windows 8 Client that tries to join our WLAN using EAP TLS Auth. The Server writes to its logfiles that everything seems to be ok and he is willing to give this system a: ACCESS-ACCEPT Thu Apr 3 06:05:55 2014 : Auth: Login OK: [host/KP4101] (from client kc1034 port 807 cli 5C-51-4F-D9-5E-6D) In a traffic dump I can see the following packages to the end of the conversation: PacketNo Length Info 17 825 Access-Request 18 1132 Access-Challenge <<<< In this Packet is EAP-TLS Length of 1626 mentioned but its size is only 1024, shouldn't the server send the missing 602 bytes in response to the next request instead of the Access-Accept? 19 219 Access-Request 20 232 Access-Accept Because on the other side we have the client on there are the following log entries: 0086 [5060] 03-11 08:41:37:364: >> Received Request (Code: 1) packet: Id: 11, Length: 1024, Type: 13, TLS blob length: 1626. Flags: LM <<<< The client receives the 1024 bytes from packet no. 18, I assume and he is aware of the fact that the TLS blob is 1626 bytes. 0087 [5060] 03-11 08:41:37:364: EapTlsCMakeMessage, state(3) flags (0x1400) 0090 [5060] 03-11 08:41:37:364: << Sending Response (Code: 2) packet: Id: 11, Length: 6, Type: 13, TLS blob length: 0. Flags: <<<< The client is responding 0093 [5060] 03-11 08:41:37:379: >> Received Success (Code: 3) packet: Id: 11, Length: 4, Type: 0, TLS blob length: 0. Flags: <<<< The client receives a Success ( Access-Accept ), but aren't we expecting 602 Bytes here? 0094 [5060] 03-11 08:41:37:379: EapTlsCMakeMessage, state(3) flags (0x1410) 0095 [5060] 03-11 08:41:37:379: Code 3 unexpected in state SentFinished <<<< The client wonders about something ( 602 missing bytes?) and cancels the whole authentication process to restart it again 5 seconds later. 0096 [5060] 03-11 08:41:37:379: EapTlsEnd 0097 [5060] 03-11 08:41:37:379: EapTlsEnd(host/kp5975.hauni.koerber.de) This process loops for about 5 minutes than the client seems to be feed up and stops its joining efforts. In my lab I have a Cisco Access Point with a brand new IOS Version 15.2(4)JB4. Freeradius comes in its version 2.1.1 and the client runs Windows8 we also have a Windows8.1 client but the problem is the same. Can anyone bring a clarification to this? The exact same setup is working with Windows7 clients without any problems. Regards from Hamburg/Germany Kai

4 6