April 2014 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 108, Issue 64
by Rui Ribeiro 15 Apr '14

15 Apr '14

Yes, of course thanks Allan, just had to confirm there was not any provision in place, although I already suspected what would the answer would be. The point is that I worked for some years in the Internet cable industry and I dearly miss some of the controls there were in place, like the equipment placing leasequeries calls to the DHCP server to confirm the validity of a new IP from a customer, for instance. About SQL, there used to be also a patched DHCP+TFTP package with an eye in the cable industry, called docsis-server. It was also very convenient interesting in that it mapped the isc-dhcp configuration to well, MySQL tables, simplifying a lot the development of glue software for customer provisioning. I used it at least in two sites, until giving up on it because it was too old and stopped being maintained. You might want to have a look at it. Regards, Rui Ribeiro http://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > Message: 4 > Date: Mon, 14 Apr 2014 21:16:15 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRADIUS DHCP service vs IP users control > Message-ID: <534C885F.3070309(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > Rui Ribeiro wrote: > > We have noticed that at least in one of our equipments the users can > > gain access with a fixed-ip-address instead of one gotten via our > > DHCP-server. > > That's how DHCP works. If the user doesn't do DHCP, he can use a > static IP of his choosing. > > > Whilst my ISP experience suggest the enforcement of DHCP-only clients > > belongs to the hardware side, since FreeRadius also implements the DHCP > > service, I am curious wether someone managed to enforce this via > > FreeRadius configurations. > > You can't enforce anything with DHCP. Like RADIUS, it just advises > the NAS. If the NAS (or the user) ignores DHCP or RADIUS, there's very > little you can do on the server. > > What you *can* do is use RADIUS accounting packets to double-check > users IP addresses. If the address in the accounting packet was *not* > assigned by DHCP, then you can do something. Complain, issue email, etc. > > And which open source DHCP server lets you write IPs into an SQL > database? Not ISC. FreeRADIUS. :) > > That's why we added DHCP. > > Alan DeKok. > >

1 0

FreeRADIUS DHCP service vs IP users control
by Rui Ribeiro 15 Apr '14

15 Apr '14

Hi, We have noticed that at least in one of our equipments the users can gain access with a fixed-ip-address instead of one gotten via our DHCP-server. Whilst my ISP experience suggest the enforcement of DHCP-only clients belongs to the hardware side, since FreeRadius also implements the DHCP service, I am curious wether someone managed to enforce this via FreeRadius configurations. Regards, Rui Ribeiro

3 2

nas id in radacct table
by Benoit 15 Apr '14

15 Apr '14

Hello everyone, I'd like to make some statistics about the connections and my nas clients. The problem is my clients using hotspots and having their IP changing constantly. I managed to keep my nas table updated with a heartbeat system. But the problem is that the connections in radacct seem to save the IP of the nas as the reference to the nas table. That's not good for me as those IPs keep changing. I can't track which connection comes from which client. This might have to do with the fact that there's no 'id' field for the nas when we use the file to set them up. I am using the database and the 'id' field is my best chance to keep good track of my connections. Am I missing a reference that can identify the NAS used for a connection, and other than the nas IP? Do you guys know a workaround for me? Even modifying the code a little bit so that I can save the NAS (database) id in the radacct table would not bother me but I would appreciate some help to locate this part of the code if it comes to this. Thank you in advance. Benoit

4 8

Lists server HTTP service down?
by Stefan Paetow 14 Apr '14

14 Apr '14

Hi, Just checking... Is the FreeRADIUS Mailman interface dead? http://lists.freeradius.org/mailman/listinfo/freeradius-users just times out? It's possible I missed an announcement stating this... just checking. Stefan

3 2

Re: FreeRADIUS auditory and performance
by Rui Ribeiro 14 Apr '14

14 Apr '14

Hi Antonio, SNMP is not supported at the moment directly by freeradius. You can get some data activating the status "virtual server" in sites-enabled and then doing echo "Message-Authenticator = 0x00,FreeRADIUS-Statistics-Type = 31" | radclient localhost:18121 status adminsecret You may eventually connect that to your snmp agent in your linux, I remember seeing some page about it. Regards > Message: 6 > Date: Mon, 14 Apr 2014 13:32:45 +0200 > From: Antonio Fern?ndez P?rez <antoniofernandez(a)fabergroup.es> > To: freeradius-users <freeradius-users(a)lists.freeradius.org> > Subject: FreeRADIUS auditory and performance > Message-ID: > < > CANz54jr6pKAt3m3oboYqA8kw32JPHmxteckQXYCd0OQ0dTUrEQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi everybody, > > I would like to know how can I do this on my server: Check FreeRADIUS > performance and authentication capacity. > > I have read about radperf but I can't download it from its web page. On the > other hand, I would like to know how can I monitor FreeRADIUS with SNMP ( > It's very interesting to know how many users are connected, how many > requests has received the server ...). > > I hope your advices. > > Thanks in advance. Regards, > > Antonio. >

1 0

Assert failed - FR 2.2.4 OS X Lion
by Alex Sharaz 12 Apr '14

12 Apr '14

Run FR 2.2.4 on os x lion Periodically I get :- Thu Apr 10 08:35:47 2014 : Info: WARNING: Child is hung for request 1312 in component authorize module auth_log. Thu Apr 10 08:36:04 2014 : Info: WARNING: Child is hung for request 1312 in component authorize module auth_log. Thu Apr 10 08:36:29 2014 : Info: WARNING: Child is hung for request 1312 in component authorize module auth_log. Thu Apr 10 08:37:08 2014 : Info: WARNING: Child is hung for request 1312 in component authorize module auth_log. Thu Apr 10 08:38:45 2014 : Error: ASSERT FAILED event.c[543]: request->child_state == REQUEST_DONE Thu Apr 10 18:53:43 2014 : Info: Starting - reading configuration fi Rgds A

4 7

FR 3 to AD via ldap
by Bc. Radovan Matisko 12 Apr '14

12 Apr '14

Hi, Im trying to use FR 3 to connect to remote AD via ldap module, tried playing with parameters but with no luck. Idk what i miss. I use own certificates. PEAP with MSCHAPv2. I config. ldap module : server = "pegasus.fri.uniza.sk" port = 636 base_dn = "dc=fri,dc=uniza,dc=sk" user { base_dn = "ou=People,dc=fri,dc=uniza,dc=sk" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' } options { chase_referrals = yes rebind = yes } tls { ca_path = ${certdir} ca_file = ${certdir}/cacert.cer certificate_file = ${certdir}/friradius.cer private_key_file = ${certdir}/friradius.key require_cert = "demand" } In sites-available/default and inner-tunnel I just added : authorize { ldap } In eap I config >eap { default_eap_type = peap tls { tls = tls-common } ttls { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" }In mschap >mschap { use_mppe = no require_encryption = yes require_strong = yes passchange { }}Also added realm to proxy >realm fri.uniza.sk {}Its starting all-right : "Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 47617 Ready to process requests." But when I try radtest :radtest -t mschap matisko(a)fri.uniza.sk <password>localhost 0 testing123rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=213, length=20Debug is : (1) suffix : Looking up realm "fri.uniza.sk" for User-Name = "hajtmanek(a)fri.uniza.sk"(1) suffix : Found realm "fri.uniza.sk"(1) suffix : Adding Stripped-User-Name = "hajtmanek"(1) suffix : Adding Realm = "fri.uniza.sk"(1) suffix : Authentication realm is LOCAL.(1) [suffix] = ok(1) eap : No EAP-Message, not doing EAP(1) [eap] = noop(1) [files] = nooprlm_ldap (ldap): Reserved connection (4)(1) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})(1) ldap : --> (uid=hajtmanek)(1) ldap : EXPAND ou=People,dc=fri,dc=uniza,dc=sk(1) ldap : --> ou=People,dc=fri,dc=uniza,dc=sk(1) ldap : Performing search in 'ou=People,dc=fri,dc=uniza,dc=sk' with filter '(uid=hajtmanek)', scope 'sub'(1) ldap : Waiting for search result...(1) ERROR: ldap : Failed performing search: Please set 'chas e_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details.(1) ERROR: ldap : Server said: 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1.rlm_ldap (ldap): Released connection (4)rlm_ldap (ldap): Opening additional connection (5)rlm_ldap (ldap): Connecting to pegasus.fri.uniza.sk:636TLS: warning: cacertdir not implemented for gnutlsrlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successful(1) [ldap] = fail(1) } # authorize = fail(1) Invalid user (ldap: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details.): [hajtmanek/pokus123] (from client localhost port 0)(1) Using Post-Auth-Type RejectBinding is succesfull, referals and rebind are changed. SSL handshake I think is ok (according to wireshark :) ).

2 2

Can freeRADIUS originate CoA Acks?
by Chavez, Andres ((HP Networking - Roseville)) 11 Apr '14

11 Apr '14

The short: I know freeRADIUS can originate CoA packets. I configured this and is working perfectly. However, I am in need of freeRADIUS (acting as proxy) to originate CoA Acks when it receives a CoA packet destined for the NAS. The long: I have a Cisco ACS and a non-Cisco NAS. The NAS does not support CoA. However, ACS is sending CoA packets to the NAS and the NAS must act accordingly (this is a requirement.) In order to meet these requirement, I placed freeRADIUS as a proxy between the NAS and ACS. This is what I already have working: 1. freeRADIUS intercepts Accept packets and modifies before sending to NAS. 2. freeRADIUS intercepts CoA packets and sends SOAP commands to NAS to perform actions in the CoA attributes. 3. freeRADIUS forwards CoA packet to NAS (which NAS ignores.) 4. NAS reacts to SOAP commands as expected. The problem is that since the NAS ignores the CoA packet, it never sends a CoA Ack. As a consequence, ACS's status is outdated since it does not know that the parameters in the CoA yielded results. What I need is a way to have freeRADIUS (acting as proxy) to send a CoA Ack when it intercepts the CoA packet (preferably after the SOAP commands are executed, but not required.) Can this be achieved with freeRADIUS? Or is there an external script I can run to generate and send such a packet to ACS? Thanx in advance. Andre

3 2

radperf - was Re: Assert failed - FR 2.2.4 OS X Lion
by Rui Ribeiro 11 Apr '14

11 Apr '14

Hi Arran, Do you still make available radperf to the public at large? The webpage where it lives no longer works. Regards, Rui > Message: 6 > > > > > Might just be able to reproduce it with radperf and a > > > > update request { > > Tmp-String-0 := `sleep 30` > > } > > > > Probably a bad path through the state machine. > > > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > > FreeRADIUS Development Team > > > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

2 1

Statement on OpenSSL security bug
by Alan DeKok 11 Apr '14

11 Apr '14

We've released a statement on the OpenSSL security issue: http://freeradius.org/security.html In short, Version 2 is not vulnerable. Version 3 using EAP or incoming RadSec is not vulnerable. Version 3 using outgoing RadSec is vulnerable. i.e. proxying over RadSec to a home server. But everyone using OpenSSL for anything *other* than RADIUS should assume that all secrets have been compromised. e.g. HTTPS user credentials, cookies, keys, passwords, etc. Thanks to Jouni Malinen for providing test cases and more detailed information about the bug. Alan DeKok.

3 4