April 2014 - Freeradius-Users - lists.freeradius.org

3.0.2: rlm_sql_null duplicating its statements
by Stefan Winter 11 Apr '14

11 Apr '14

Hi, I'm in the process of getting my first 3.0.2 instance to production level. Now that I've moved eduroam accounting handling into production (rlm_sql_null instance), I see something that looks like a concurrent write of sorts to me. I have this in my file: UPDATE radacct_eduroam SET FramedIPAddress = '10.36.10.174', AcctSessionTime = '586', AcctInputOctets = '0' << 32 | '59700', AcctOutputOctets = '0' << 32 | '83072' WHERE AcctSessionId = '53424d00/00:0a:5b:3a:b5:90/224195' AND UserName = '' AND NASIPAddress= '10.199.21.8'UPDATE radacct_eduroam SET FramedIPAddress = '10.36.10.174', AcctSessionTime = '586', AcctInputOctets = '0' << 32 | '59700', AcctOutputOctets = '0' << 32 | '83072' WHERE AcctSessionId = '53424d00/00:0a:5b:3a:b5:90/224195' AND UserName = '' AND NASIPAddress= '10.199.21.8'; ; That's right - an UPDATE statement is written twice in one line, and not separated by semicolon. The semicolon sits in its own newline. Unsurprisingly, when played back with radsqlrelay, the statement fails with the "trailing garbage" that is the second UPDATE. The UPDATE statement itself as per config is NOT duplicated of course. I also see plenty of other UPDATEs coming from the same line of config which are not-replicated as they should be. So some race condition maybe? Greetings, Stefan -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

5 34

thread pool and requests queueing
by Eugene Grosbein 11 Apr '14

11 Apr '14

Hi! What may be a reason for freeradius idle thread does not processing new request from the queue immediately? thread pool { start_servers = 256 max_servers = 256 min_spare_servers = 256 max_spare_servers = 256 max_queue_size = 262144 max_requests_per_server = 0 } As you see, I have lots of threads and my logs show they are mostly idle (each thread logs its internal OS pthread id when post_auth is started). However, this what happens here: 1. freeradius obtains new request R and successfully queues it. I added radlog() call to event.c, received_request() just before "return 1;" to make sure. 2. Eventually, some thread starts to process this request but between moment 1 and this moment this thread processes 2-3 another requests. So, the request R was waiting in the queue meantime in spite of presence many other idle threads. This is big problem for us as sometimes my perl code NEEDS to insert 2 seconds delay before it returns RLM_MODULE_NOTFOUND to the dhcp module so that DHCPNAK is sent with 2 seconds delay. This way we keep broken DHCP clients from abusing our DHCP relays with tons of requests per second. These broken clients keep repeating DHCPDISCOVER/DHCPREQUEST at high rate if they get DHCPNAK quickly and we cannot get rid of them all. With this delay, they patiently wait for answer this giving us some kind of "request throttling". How can I force radiusd to use some idle thread at once to minimize queueing delay? Eugene

2 5

Re: In auth request packet, Stripped-User-Name attribute value wrongly rewritten by radius server
by Adarsha S 11 Apr '14

11 Apr '14

Hi Alan, I'm resending the mail as previously it excessed the message size limit I've attached the truncated log in this mail. Please let me know your inputs. Thanks, Adarsha On Wed, Apr 9, 2014 at 11:55 AM, Adarsha S <s.adarsha(a)gmail.com> wrote: > Hi Alan, > > I did upgrade my free radius to 2.2.4 but still the issue persist. > I've attached the log of the same. > > On looking at code flow could make out while creating the new attribute > (stripped-user-name), " '\\' 't' " is replaced as '\t'. > As a fix I've made below changes. > > *File :* src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c > *Function:* do_attr_rewrite() > *RCA :* While paring attribute with value ,value is formatted and then > paired. During formation " \\t " is replaced by " \t " > *Fix:* Before paring attribute with value, convert the value to printable > formate and then send it for paring. > > > > > > > > > > > > > > > > > > *@@ -180,7 +184,17 @@ DEBUG2("%s: xlat on replace > string failed.", data->name); return ret; > }- attr_vp = > pairmake(data->attribute,replace_STR,0);++// attr_vp = > pairmake(data->attribute,replace_STR,0);+ lent = > fr_print_string(replace_STR, + 0,+ > modified_replace_STR, sizeof(modified_replace_STR));+ > modified_replace_STR[lent] = '\0';++ attr_vp = > pairmake(data->attribute,modified_replace_STR,0); + if > (attr_vp == NULL){ DEBUG2("%s: Could not add new > attribute %s with value '%s'", data->name, > data->attribute,replace_STR);* > > Pleaseguide me in understanding if this fix will create problem in any > other scenarios. > > Thanks, > Adarsha > > > > > > > On Tue, Apr 8, 2014 at 2:37 AM, Alan DeKok <aland(a)deployingradius.com>wrote: > >> Adarsha S wrote: >> > I'm having a setup where clients get authenticated by Windows AD 2003 >> server. >> > It uses stripped-user-name attribute. >> > I'm having free radius 2.1.12 as the radius server. >> > The username are provided as DomainName\Username. >> > Various combination of Domain name and user name worked but when ever >> > the username starts with "t" or "n" the authentication failed. >> >> Upgrade. IIRC this issue was fixed. >> >> The latest release is 2.2.4. You're running a version which is many >> years out of date. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > >

2 1

Chap Challenge Failing
by Joseph Showalter 11 Apr '14

11 Apr '14

# freeradius -v freeradius: FreeRADIUS Version 2.1.12 We have a puzzling issue with CHAP Authentication: Using radtest like this works: radtest -d /etc/freeradius/ -t chap "6064191000(a)ev.myawi.com" "6D464023735E40604457225169645C69" 127.0.0.1 1812 xxxxxx But when a real live device request comes in, it fails: This should be allowed but is rejected: Using md5 hashing, we have confirmed that it is accurate: Radius Protocol Code: Access-Request (1) Packet identifier: 0x51 (81) Length: 145 Authenticator: dbad48a07b45dc16a42806283bfa3432 [The response to this request is in frame 2] Attribute Value Pairs AVP: l=25 t=User-Name(1): 6064191000(a)ev.myawi.com User-Name: 6064191000(a)ev.myawi.com AVP: l=19 t=CHAP-Password(3): a7737618eb2d4f46a3945215a989923560 CHAP-Password: a7737618eb2d4f46a3945215a989923560 CHAP Ident: 0xa7 CHAP String: 737618eb2d4f46a3945215a989923560 AVP: l=6 t=NAS-IP-Address(4): 10.xxx.2.1 NAS-IP-Address: 10.xxx.2.1 (10.xxx.2.1) AVP: l=18 t=CHAP-Challenge(60): 5072685c0183c07d006ff00c160671a0 CHAP-Challenge: 5072685c0183c07d006ff00c160671a0 AVP: l=12 t=Vendor-Specific(26) v=3rd Generation Partnership Project 2 (3GPP2)(5535) VSA: l=6 t=3GPP2-HRPD-Access/Terminal-Authentication-and-1x-Access-Authorization(60): 1 3GPP2-HRPD-Access/Terminal-Authentication-and-1x-Access-Authorization: 1 AVP: l=23 t=Vendor-Specific(26) v=3rd Generation Partnership Project 2 (3GPP2)(5535) VSA: l=17 t=3GPP2-AT-Hardware-Identifier(61): [unhandled integer length(15)] AVP: l=18 t=Message-Authenticator(80): 8ce6cfeb0d0ef6a09bd3dbbdd7495226 Message-Authenticator: 8ce6cfeb0d0ef6a09bd3dbbdd7495226 AVP: l=4 t=Proxy-State(33): 3834 Proxy-State: 3834 Here is the users file we are using for testing: 6064191000(a)ev.myawi.com Cleartext-Password := "6D464023735E40604457225169645C69" Callback-Id = "000006064191000", Fall-Through = Yes Here is the debug on freeradius -X Thu Apr 10 15:21:22 2014 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.xx.xx.32 port 1814, id=81, length=145 User-Name = "6064191000(a)ev.myawi.com" CHAP-Password = 0xa7737618eb2d4f46a3945215a989923560 NAS-IP-Address = 10.xxx.2.1 CHAP-Challenge = 0x5072685c0183c07d006ff00c160671a0 3GPP2-Attr-60 = 0x00000001 3GPP2-Attr-61 = 0x010600000001020935799505892280 Message-Authenticator = 0x8ce6cfeb0d0ef6a09bd3dbbdd7495226 Proxy-State = 0x3834 Thu Apr 10 15:24:22 2014 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu Apr 10 15:24:22 2014 : Info: +- entering group authorize {...} Thu Apr 10 15:24:22 2014 : Info: ++[preprocess] returns ok Thu Apr 10 15:24:22 2014 : Info: ++[auth_log] returns ok Thu Apr 10 15:24:22 2014 : Info: [chap] Setting 'Auth-Type := CHAP' Thu Apr 10 15:24:22 2014 : Info: ++[chap] returns ok Thu Apr 10 15:24:22 2014 : Info: [suffix] Looking up realm "ev.myawi.com" for User-Name = "6064191000(a)ev.myawi.com" Thu Apr 10 15:24:22 2014 : Info: [suffix] No such realm "ev.myawi.com" Thu Apr 10 15:24:22 2014 : Info: ++[suffix] returns noop Thu Apr 10 15:24:22 2014 : Info: [files] users: Matched entry 6064191000(a)ev.myawi.com at line 1 Thu Apr 10 15:24:22 2014 : Info: ++[files] returns ok Thu Apr 10 15:24:22 2014 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Thu Apr 10 15:24:22 2014 : Info: ++[pap] returns noop Thu Apr 10 15:24:22 2014 : Info: Found Auth-Type = CHAP Thu Apr 10 15:24:22 2014 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu Apr 10 15:24:22 2014 : Info: +- entering group CHAP {...} Thu Apr 10 15:24:22 2014 : Info: [chap] login attempt by "6064191000(a)ev.myawi.com" with CHAP password Thu Apr 10 15:24:22 2014 : Info: [chap] Using clear text password "325C7727326B6176362A324754623247" for user 6064191000(a)ev.myawi.com authentication. Thu Apr 10 15:24:22 2014 : Info: [chap] Password check failed Thu Apr 10 15:24:22 2014 : Info: ++[chap] returns reject Thu Apr 10 15:24:22 2014 : Info: Failed to authenticate the user. Thu Apr 10 15:24:22 2014 : Auth: Login incorrect (rlm_chap: Wrong user password): [6064191000(a)ev.myawi.com/<CHAP-Password>] (from client radiusxx port 0) Thu Apr 10 15:24:22 2014 : Info: Using Post-Auth-Type Reject -- respectfully, Joseph | IT

2 3

timers
by Juan Pablo L. 10 Apr '14

10 Apr '14

Hello everybody, i have developed a module for a prepaid data service on a CDMA network, the module is 100% functional at this point but i have a little big problem. i have, as part of the module, a postgres connection pool, that takes care of all the databases queries/accesses as well as the management of the pool, but during tests i have noticed that when these connections (or some of the connections) are not used for a long period of time (some hours) because of low traffic (e.g between 2 - 4 am) the connections becomes idle and even though they are not disconnected it gives an I/O error when you try to send anything to the database (even though the underlying socket is created with the keepalive flag). Having said that, i have added timers to these connections that monitor the time of inactivity that they have and once the threshold is reached the module disconnects them, so when a next time a connection is requested the pool just check if connected or not, if not connected if connects it and gives it to the caller, very simple really. The problem is, that all the nice timers work in an epoll in a thread inside the module. After researching the lists i have found out that that is not possible to do (to run a thread inside a module) ... so i would like to ask if there is any functionality in freeradius i m not aware of that could help me with this issue ? or if any of you faced the same situation, how you fixed that ? ... even though i have read that according to the freeradius developer that is a bad design, i really do not know of any other way how to deal with this situation, so i would really appreciate any feedback on this. thank you very much!! P.S: i do not want to start an argument whether is or it isnt a bad/good design, i think that was established already in the past, but as i said, i do not know how to deal with the idle connections problem in an efficient manner (i dont want to open/close connections every time i get a radius package but i also do not want to keep connections open using database/network/server resources when they are not needed).

2 1

FR with Active Directory
by Rado Matisko 10 Apr '14

10 Apr '14

Hi I want to set up my FR to connect to AD, which is on another host. I was following this tutorial : http://deployingradius.com/documents/configuration/active_directory.html I configured smb.conf and then krb5.conf and then this works great : ntlm_auth --request-nt-key --domain=*MYDOMAIN* --username=*user* --password= *password* *root@friradius:/# ntlm_auth --request-nt-key --domain=FRI --username=hajtmanek --password=<password> NT_STATUS_OK: Success (0x0)* Then I configured FR : > commented "files" in sites-available/default and inner-tunnel and added ntlm_auth in authorize section > changed /modules/ntlm_auth After running *radtest* I get this debug : # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eduroam", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [eduroam] (from client localhost port 0) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> eduroam attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Apparently I'm missing something but tried to follow tutorial.

2 2

RE: NTLMv2 with FreeRADIUS
by John McCarthy 10 Apr '14

10 Apr '14

Thank you for the breakdown of what each of those do. That definitely helps me understand the process and what's going on. At the end of the day using IPsec is a great idea. We have talked about using that with other systems in the past. That is definitely worth bringing up as an option at work. The other option that is appealing is TTLS/PAP. I spun up a server at the end of the day today to start testing that out. Does it play well with active directory using Kerberos? That option sounds nice because traffic is encrypted at both ends of the FreeRADIUS server. I had been doing some research to get a better understanding on how all this worked. Alan DeKok had some great references at deployingradius.com to help me understand how all this works. I really appreciate all your guys help and feedback. I wasn't sure if FreeRADIUS had an active community or not. I've not seen a lot of talk in the freenode IRC channel. Its really nice you guys have something like this mailing list setup.

4 3

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

On 9 Apr 2014, at 15:14, arr2036 wrote: > It's not in a local configuration file if it's being sent to an AD server. Gotcha, and that is basically what makes NTLMv1 insecure- is if it is stored in a file that can be cracked (from what I understand of it). Is there a way to encrypt the NTLM traffic, just to be on the safe side (if it isn't already) On 9 Apr 2014, at 15:19, arr2036 wrote: > Hmm do you work for a *.edu? No, I work at an organization that deals with payment processing, so we have to abide by PCI's standards. That's why i have to make sure my FreeRADIUS server is setup correctly. Our sys admin scanned my server and it got flagged for using NTLMv1, which is what brought me creating this thread (I need my server to be PCI compliant).

3 2

Setting up a small test environment
by Daniel Schmalen 09 Apr '14

09 Apr '14

2 1

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

That's why i am here. So I can get it right ;)

1 0