June 2014 - Freeradius-Users - lists.freeradius.org

Radcheck gives Accept but still moves onto Radgroupcheck
by Brent Wilkinson 12 Jun '14

12 Jun '14

I am setting up a new Radius server or a mikrotik hotspot system. I am getting a wierd issue that I have not been able to solve or find hints to what to do to fix it. I have setup the system with mysql. I see the radcheck happen and show it retrieved a record. ( I have verified the sql statments do actually pull something). I am not sending any reply so nothing is found in that table. At this point from what I understand in reading how the sql module works at this point it should send back a Access-Accept. Unfortunatly it does not and continues to do group checks and I end up with a reject. Hoping someone can give me a idea of what I need to look at or what I can read up more on to track the issue I am having down. Here is the debug: rad_recv: Access-Request packet from host 76.8.212.170 port 36910, id=78, length=189 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C:4B:D6:A5:CD:BF" Called-Station-Id = "10631" NAS-Port-Id = "ether2" User-Name = "1" NAS-Port = 2152726611 Acct-Session-Id = "80500053" Framed-IP-Address = 10.69.103.254 Mikrotik-Host-IP = 10.69.103.254 CHAP-Challenge = 0x95b4afa9e0e37e62da70a83197931d11 CHAP-Password = 0x21b4c5ed3e3175b1b7672103936286b74e Service-Type = Login-User WISPr-Logoff-URL = "http://10.69.100.1/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.99.163 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "1" with CHAP password [chap] Using clear text password "1" for user 1 authentication. [chap] chap user 1 authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> 1 [sql_log] expand: %{%{User-Name}:-DEFAULT} -> 1 [sql_log] sql_set_user escaped user --> '1' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('1', 'Chap-Password', 'Access-Accept', '2014-06-11 18:42:31'); [sql_log] expand: /var/log/freeradius/radacct/sql-relay -> /var/log/freeradius/radacct/sql-relay [sql_log] Couldn't open file /var/log/freeradius/radacct/sql-relay: No such file or directory ++[sql_log] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> 1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 78 to 76.8.212.170 port 36910 Waking up in 4.9 seconds. Cleaning up request 0 ID 78 with timestamp +6 Ready to process requests. Thanks Brent

3 2

Segmentation fault (core dumped), 3.0.3
by Miha 11 Jun '14

11 Jun '14

Hi, I have installed the newest freeradius server (3.0.3) on centos 6.4. I am trying to start it but getting: name = "radiusd" Segmentation fault (core dumped) Jun 11 09:42:42 localhost kernel: radiusd[6162]: segfault at 19b ip 00000034d6802a3e sp 00007fffedf28180 error 4 in libtalloc.so.2.0.7[34d6800000+a000] Jun 11 09:42:42 localhost abrtd: Directory 'ccpp-2014-06-11-09:42:42-6162' creation detected Jun 11 09:42:42 localhost abrt[6163]: Saved core dump of pid 6162 (/usr/local/sbin/radiusd) to /var/spool/abrt/ccpp-2014-06-11-09:42:42-6162 (2945024 bytes) Jun 11 09:42:42 localhost abrtd: Executable '/usr/local/sbin/radiusd' doesn't belong to any package and ProcessUnpackaged is set to 'no' Jun 11 09:42:42 localhost abrtd: 'post-create' on '/var/spool/abrt/ccpp-2014-06-11-09:42:42-6162' exited with 1 Jun 11 09:42:42 localhost abrtd: Deleting problem directory '/var/spool/abrt/ccpp-2014-06-11-09:42:42-6162' Could some just point me to right direction what is wrong? tnx miha

2 2

use_tunneled_reply in PEAP or TTLS tunnels
by Herwin Weststrate 11 Jun '14

11 Jun '14

Hi all, I was playing around a bit with the option use_tunneled_reply today. The description given in the config is as follows: > The reply attributes sent to the NAS are usually > based on the name of the user 'outside' of the > tunnel (usually 'anonymous'). If you want to send > the reply attributes based on the user name inside > of the tunnel, then set this configuration entry to > 'yes', and the reply to the NAS will be taken from > the reply to the tunneled request. The last part (and the reply to the NAS will be taken from the reply to the tunneled request) makes me expect that all attributes from the reply of the home server are copied to the outer reply. In this case it would be the various attributes to change a VLAN (Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-Id). Looking at the reply, I only see the User-Name attribute updated to my inner user. The relevant code uses the method pairfilter, which is described as "Move pairs of a matching attribute number, vendor number and tag from the the input list to the output list." Basicly, this means that only values that are already present are overwritten. Not exactly what I was expecting. Is this a bug in the code, or is the problem just that the documentation could use a little clarification? -- Herwin Weststrate www.quarantainenet.nl

3 3

dynamic-clients with TLS
by Stefanos Boglou 11 Jun '14

11 Jun '14

Is it possible to use dynamic-clients with TLS? It does not seem to work. Dynamic-clients without TLS works and TLS itself seems to work. My NAS devices are over the internet and they get dynamic IPs from the ISPs but i use TLS for that added piece of security. Thanks, Stefanos

3 5

post-auth section in FR v2.1.12 - Re: Freeradius-Users Digest, Vol 110, Issue 39
by Rui Ribeiro 10 Jun '14

10 Jun '14

Hi Grabriel, You are missing in your update reply Service-Type := "Framed-User" Are you following v1.x recipes? BTW, upgrade to 2.2.4 at least, 2.1.12 is very old, and full of bugs specially when using mschap. Regards > > Message: 4 > Date: Tue, 10 Jun 2014 17:50:17 +0200 > From: gabriel_skupien <gabriel_skupien(a)o2.pl> > To: freeradius-users(a)lists.freeradius.org > Subject: post-auth section in FR v2.1.12 > Message-ID: <5c9f5cb4.6195ba31.53972939.95a05(a)o2.pl> > Content-Type: text/plain; charset="UTF-8" > > I am using EAP-TLS and I am trying to use post-auth section to dynamically > assign (based on the ldap group membership) vlan ID to the user. Leaving > the LDAP part away for testing purposes and concentrating just on the > post-auth section - I cannot make FR to override VLAN ID in post-auth > section. Here is the config: > > post-auth { > update reply { > Tunnel-Type := VLAN > Tunnel-Medium-Type := IEEE-802 > Tunnel-Private-Group-Id := "36" > } > exec > Post-Auth-Type REJECT { > attr_filter.access_reject > } > } > > And nothing happens here: > > .... > # Executing section post-auth from file > /etc/freeradius/sites-enabled/default > +- entering group post-auth {...} > ++[reply] returns noop > ++[exec] returns noop > Sending Access-Challenge of id 127 to X.X.X.X port 32769 > Tunnel-Private-Group-Id:0 = "36" > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Type:0 = VLAN > EAP-Message = 0x03040004 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd55884fdd75c9555353e80afe21cb577 > Finished request 6. > .... > But it finally ends with this: > ..... > Sending Access-Accept of id 128 to X.X.X.X port 32769 > Tunnel-Private-Group-Id:0 = "84" > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Type:0 = VLAN > Cisco-AVPair += "XXX" > EAP-Message = 0xXXXX > Message-Authenticator = 0x00000000000000000000000000000000 > User-Name = "XXXX" > Finished request 7. > > Hence, 3 questions: > 1) Does FR v2.1.12 support post-auth section? > 2) Can you explain the aim of "Sending Access-Challenge" ? > 2) Where is the best place to authorize users in LDAP while using EAP-TLS? > Is it post-auth? > > ps. it works fine while authorizing users based on LDAP in the authorize > section but we prefer to postpone this task to post-auth. In that way we > can achieve to goals: > -use ldap group membership for vlan assignments and > -significantly reduce LDAP load > > jinx > > H

1 0

Performance - was Re: LDAP Groups to Freeradius and then Ruckus Wireless?
by Rui Ribeiro 10 Jun '14

10 Jun '14

Hi Arran, To be fair, I have read a lot of performance problems in FreeRadius, and I have yet to see any. We have been running here for more than a year now, Debian 7/FreeRadius from 2.1.12 to 2.2.5, MySQL, detail files and AD authentication, roaming/proxying too, in a virtual machine with 64 bits, 1GB RAM and 2 CPUs, 3500 daily EDUROAM users, and I have yet to see the CPU loads go up more than 0.05-0.10. Even when I have major events that bring down the wifi intra-structure, like yesterdays where a switch went crazy, I hardly register an heavy load. What are your mileage, guys? Regards, Rui Ribeiro Regards, > > Message: 4 > Date: Tue, 10 Jun 2014 07:09:30 +0100 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: LDAP Groups to Freeradius and then Ruckus Wireless? > Message-ID: <B5471695-B7D2-4970-B4C8-6A4905489FCC(a)freeradius.org> > Content-Type: text/plain; charset="us-ascii" > > > On 10 Jun 2014, at 06:36, Fajar A. Nugraha <list(a)fajar.net> wrote: > > > On Mon, Jun 9, 2014 at 9:43 PM, Arran Cudbard-Bell > > <a.cudbardb(a)freeradius.org> wrote: > ...... > > > Would it make sense to enable the flag on all bundled package recipes? > > IIRC 2.x debian/rules has it (official debian/ubuntu package has it as > > well), but 3.0.x doesn't. Haven't checked others though. > > No, there's a noticeable performance impact. One of the other users said > it was as much as 15%. > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > ************************************************* >

4 3

I must have NT domain hack configured wrong.
by Matthew Berry 09 Jun '14

09 Jun '14

>From a fresh installation of Freeradius 2 on Ubuntu 13.10 Server, with a single test user added to the users file, and with mschap turned on, I've successfully received an access-accept response when testing with radtest both on the inner tunnel port 18120 and the regular 1812 port using mschap [1]. The test user is setup to mirror a user on a test windows laptop, using the HOSTNAME\username convention. On my first attempt to connect the laptop, I receive the below error about the inner username matching neither the outer username nor the eap identity. Info: [files] users: Matched entry HOSTNAME\me at line 93 ... Info: [peap] Identity - HOSTNAME\me ... ERROR: User-Name (HOSTNAME\me) is not the same as MS-CHAP Name (me) from EAP-MSCHAPv2 So from what I've read this has been addressed by adding the with_ntdomain_hack flag in the mschap module to 'yes'. However, as shown in the referenced pastebins [2][3], it appears to have no effect. There is one other place in the configuration where with_ntdomian_hack is present, which is in the preprocess module, however it specifically says in the comments not to use it. Based on observations, it seems to strip the "HOSTNAME\\" from the username (but not the eap identity). I must have done something wrong when I enabled the with_ntdomain_hack in the mschap configuration, as from my understanding that should have caused Freeradius to account for the way Windows performs the authentication. Is there something further I need to do? Server: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 24 2014 at 15:09:01 (ubuntu package version 2.1.12+dfsg-1.2ubuntu5.1 ) End-Host: Windows 7 host, which is not part of a domain, with hostname of HOSTNAME, with a user named 'me', who has a password 'PASSWORD' End-Host Network Profile: Server validation turned off since test certs are being used, "Use windows username/password" is on. NAS: Tomato 1.28 [1] radtest log: http://pastebin.com/S5Kb1ggd [2] with_ntdomain_hack off: http://pastebin.com/CnFcXWAX [2] with_nt_domain_hack on: http://pastebin.com/KS8AJPbc -Matt

3 2

authentication order
by Dan Letkeman 09 Jun '14

09 Jun '14

Hello, I am trying to find some info on authentication ordering. Is it the client(switch or wireless controller) that defines the authentication ordering or is it the radius server? If it is the radius server how would I define EAP as the first authentication method and then mac authentication as the second? Thanks, Dan.

2 3

Fwd: eap-sim on freeradius failed
by Muhammad Hasan 09 Jun '14

09 Jun '14

Hi, First, I want to apologize if my english is not so well and I have no experience in Ubuntu and freeradius before. I have a probem with freeradius when I was trying to install EAP-SIM with freeradius-server-2.2.0 on ubuntu server 12.04.4 I was following the steps on this web https://code.google.com/p/seek-for-android/wiki/EapSimAka the step are: 1. apt-get install dpkg-dev 2. apt-get build-dep freeradius 3. tar xvzf freeradius-server-2.2.0.tar.gz 4. apply patch on eapsimlib.c https://github.com/FreeRADIUS/freeradius-server/commit/cfd61d24b99022eb6130… 5. build the deb packages on freeradius-server folder debian/rules binary 6. out from freeradius-server folder and install the packages dpkg -i libfreeradius2_2.2.0... dpkg -i freeradius_2.2.0... dpkg -i freeradius-common_2.2.0... dpkg -i freeradius-utils_2.2.0... and then when I was on step 6, dpkg -i freeradius_2.2.0... i got fail, * checking FreeRADIUS daemon configuration ... [fail] invoke-rc.d: initscript freeradius, action "restart" failed. Processing triggers for ureadahead. this is result when I type Freeradius -X Unable to open file "/etc/freeradius/sql/mysql/ippool-dhc.conf": No such file or directory Errors reading or parsing /etc/feeradius/radius.conf what should I do then? please help me... -- Best Regards, Email : muhhasan.1311(a)gmail.com CP : 085694394257 -- Best Regards, Email : muhhasan.1311(a)gmail.com CP : 085694394257

3 5

Re: authentication order
by Rui Ribeiro 09 Jun '14

09 Jun '14

Hi Dan, Please read better the previous answer. Alan already told you EAP is authentication and MAC is authorisation. EAP also supports several types of authorisation, and you arent being very clear of what you intend to do. The sooner your learn how the process works, the better you are. It is no use to put together a few recipes over the Internet, if then you both cant maintain the service or do not understand how it works. Search the list arquive for answers before posting here, for starters discussions about policies to whitelist or blacklist MACs are rather frequent. Regards > Message: 5 > Date: Sun, 8 Jun 2014 18:00:31 -0500 > From: Dan Letkeman <danletkeman(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: authentication order > Message-ID: > <CAPY==jk0CzgvJC8+bux2XtBD2kiMoo=7S3OrfG68ML= > SPwo8ng(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > On Sun, Jun 8, 2014 at 5:39 PM, Alan DeKok <aland(a)deployingradius.com> > wrote: > > > Dan Letkeman wrote: > > > I am trying to find some info on authentication ordering. > > > > Probably because no one uses that term. > > > > Ok, but I just did, so I guess I use that term :) > > > > > > > Is it the client(switch or wireless controller) that defines the > > > authentication ordering or is it the radius server? > > > > You're asking the wrong question. > > > > Yes, I am asking the wrong question, because I need help, otherwise I would > not be posting a question.....(: > > > > > > > If it is the radius server how would I define EAP as the first > > > authentication method and then mac authentication as the second? > > > > MAC auth isn't authentication. MAC auth is just another authorization > > check. > > > > Ok, so I can authorize a user based on there mac address. I can also > authenticate a user using EAP. I want to authenticate a user using EAP, > but if the device that a user is using does not support EAP I would like to > authorize a user based on the mac address as a last resort. > > > > > > EAP is authentication. As part of authorizing a user, you can deny > > them access because their bills aren't paid, or because they're using > > the wrong MAC. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > >

1 0