August 2014 - Freeradius-Users - lists.freeradius.org

Proxy listens to TCP home server on UDP port
by Nikolai Kondrashov 04 Aug '14

04 Aug '14

Hi everyone, Red Hat QA has noticed that a FreeRADIUS v3.0.1 server set up to use TCP with a home server still listens for replies on UDP. I couldn't find any requirements for that in RFCs and I lack the necessary protocol knowledge to conclude if this is a correct behavior. Could someone say if this is right or not? Could this have been done to simplify handling of mixed-protocol server pools? Some more details follow. The default configuration was modified to use TCP everywhere. I.e. to have default server listen for authentication and accounting on TCP, to have inner-tunnel virtual server listen on TCP, and to have localhost home server protocol specified as TCP. See attached patch for exact changes done. After starting "radiusd -X" these are the last few lines printed: Listening on auth proto tcp address * port 1812 as server default Listening on acct proto tcp address * port 1813 as server default Listening on auth proto tcp address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy address * port 1814 Listening on proxy address * port 1814 And "lsof" outputs these lines for radiusd: radiusd 2728 radiusd 3u IPv4 21180 0t0 TCP *:1812 (LISTEN) radiusd 2728 radiusd 4u IPv4 21181 0t0 TCP *:1813 (LISTEN) radiusd 2728 radiusd 5u IPv4 21182 0t0 TCP 127.0.0.1:18120 (LISTEN) radiusd 2728 radiusd 6u IPv4 21183 0t0 UDP *:1814 The original bug reported by QA: https://bugzilla.redhat.com/show_bug.cgi?id=1115137 Thank you. Nick

3 4

CPU utilization (Stefano PASCALI)
by Rui Ribeiro 04 Aug '14

04 Aug '14

Hello Stefano, 2.12 is quite old, and is has several bugs. Why not update it to at least 2.2.5? As for problems, there is a know bug when using mschap in 2.1.12, that often freeradius stops answering requests after a reload when rotating logs. You have to edit /etc/logrotate.d/freeradius and change the reload for a restart if that is your case. Another probable source of cpu/ I/O load is radwtmp and similar files, as they grow and are not rotated per the default configuration. I dont use them, I rely on the (My)SQL data. Hope these tips help you in some way. You are welcome to ask me any questions. Regards, Rui Date: Fri, 1 Aug 2014 10:57:48 +0200 > From: Stefano PASCALI <stefano.pascali(a)unisalento.it> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: CPU utilization > Message-ID: <488B69B7-9992-4940-B9D0-04A1DD6CD698(a)unisalento.it> > Content-Type: text/plain; charset=us-ascii > > Hi FR folks, > > I got a strange cpu load on my FR installation. Sometimes CPU utilization > rises to 100% and FR service doesn't respond anymore to the clients. I got > two virtual servers enabled: default and inner-tunnel and their > configurations are the provided ones by the FR installation. > Configuration details in the following: > > OS: Ubuntu server 14.04 > Deamon: freeradius 2.1.12+dfsg-1.2ubuntu8 amd64 > 2 vcpu > RAM 4GB > > Users on freeradius MySQL (5.x) DB installed on a different virtual host > on the same hosting server. > > Hosting server (Ubuntu server 14.04 + Xen 4.3) HP PL G5 > CPU: 2 x Intel(R) Xeon(R) CPU E7330 @ 2.40GHz - cpu cores 4; [total cores > 2x4 = 8] > RAM 16GiB > > Do you have any ideas to solve my issue? > Hope someone help me. > > Regards > Stefano > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 112, Issue 1 > ************************************************ >

3 2

Authorization according to openLDAP group or attribute?
by Mark jensen 03 Aug '14

03 Aug '14

I have configured freeradius successfully to authenticate users using IEEE802.1x && openLDAP as a back-end DB. I have seen that we can add `ldap` to the authorize section like this: authorize { ... ldap ... } and we can forbid some users according to openLDAP attribute authorize { ... ldap if (reply:Eduroam-Enabled != "Y") { reject } ... } But what if we want to do authorization like this: We have multiple web servers: 192.168.1.5 192.168.1.6 192.168.1.7 And we want only some users to have access to `192.168.1.5` web server, how can we forbid other users to access this web server or restrict this web servers to some users according to openLDAP attribute or openLDAP group? Is there could be done using "authorize" section or "post-auth" section? (provide me with links please)

2 4

Fix broken clock on NAS
by David Lopez 03 Aug '14

03 Aug '14

Hi, I have a installing with FreeRADIUS and Chilli/Cova Hotspot. Everything works good so far, just some NAS (Openmesh hardware mostly) appears with date time about 1970. Also, FreeRADIUS is running with MYSQL backend. I know FreeRADIUS uses TimeStamp attribute for accounting, but I don't find a way to resolve broken clock on NAS. Furthermore, I'm pretty sure clock on NAS is update. Anyone knows how I could solve this? Best regards. Thanks. David L.

2 1

RE: CPU utilization (Stefano PASCALI)
by Rui Ribeiro 02 Aug '14

02 Aug '14

Hi Arnaud, To disable it comment out radutmp and sradutmp in your sites-enabled and inner-tunnel files. Sure, fell free to email. Regards > > Date: Fri, 1 Aug 2014 17:37:04 +0200 > From: "Arnaud ." <arn0(a)live.fr> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: CPU utilization (Stefano PASCALI) > Message-ID: <DUB118-W5B4FE78DF8C0275C4EFBA9BE70(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > Hello Rui, > > I can contact you about radwtmp (as you mention below). Because I use > mysql but there is also radutmp / radwtmp archive and that I would either > disable it or empty it. Is this possible? how > > thank you > >

1 0

Freeradius authentification against Kerberos
by Benjamin Stahl 02 Aug '14

02 Aug '14

Hi, I’m a newbie with Freeserver. It is my first time with it. I try to make a configuration against Kerberos with your freeradius-server on centOS 6.5. I use FreeRadius 2.1.12 But now I got everytime the error: „no authenticate method (Auth-Type) found for the request“. So every user got a reject. I setup the server like explained at this tutorial from eduroam.us: https://www.eduroam.us/node/45 My problem is also that a PEAP - MSCHAPv2 auth from a Windows 7 - PC does not work. Can anyone help me, please? I attached the logs. Thanks, and best Benjamin.

8 15

Re: Freeradius-Users Digest, Vol 112, Issue 2
by Rui Ribeiro 01 Aug '14

01 Aug '14

Hi Mathew, I am dealing with 3.1.0, however I could swear I have this particular problem since 2.2.5. What kind of paches are you using? That seems interesting. I will answer with more details in a couple of hours. Thanks for the reply. Regards, Rui > > Message: 2 > Date: Fri, 1 Aug 2014 10:38:19 +0100 > From: Matthew Newton <mcn4(a)leicester.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: problems with reinstallation of deb packages from > repositories > Message-ID: <20140801093819.GC20472(a)rootmail.cc.le.ac.uk> > Content-Type: text/plain; charset=us-ascii > > On Fri, Aug 01, 2014 at 01:15:05AM +0100, Rui Ribeiro wrote: > > It is just me, or have people noticed problems while creating debs from > > freeradius.org and upgrading them from (local) repositories? > > Do this here with a local repository, and don't have a problem. > Currently running a fairly recent 2.x with some cherry-picked > patches. > > Giving version numbers you're dealing with (upgrade from, to) and > any appropriate debugging/console output might give people here > more to go on than guess what the problem is. > > Cheers, > > Matthew > >

2 1

Transcribe RADIUS pcap while replacing secret?
by Brian Julin 01 Aug '14

01 Aug '14

I have the need to take a PCAP file and, without any other rewriting than is necessary, transcribe all the packets with a new secret so I don't have to expose a production secret to a third-party TAC working to debug an issue. Anyone ever done that and care to share how? -- Brian S. Julin Network Administrator Clark University

1 0

CPU utilization
by Stefano PASCALI 01 Aug '14

01 Aug '14

Hi FR folks, I got a strange cpu load on my FR installation. Sometimes CPU utilization rises to 100% and FR service doesn't respond anymore to the clients. I got two virtual servers enabled: default and inner-tunnel and their configurations are the provided ones by the FR installation. Configuration details in the following: OS: Ubuntu server 14.04 Deamon: freeradius 2.1.12+dfsg-1.2ubuntu8 amd64 2 vcpu RAM 4GB Users on freeradius MySQL (5.x) DB installed on a different virtual host on the same hosting server. Hosting server (Ubuntu server 14.04 + Xen 4.3) HP PL G5 CPU: 2 x Intel(R) Xeon(R) CPU E7330 @ 2.40GHz - cpu cores 4; [total cores 2x4 = 8] RAM 16GiB Do you have any ideas to solve my issue? Hope someone help me. Regards Stefano

3 2

Policy to Respond to Accounting Packets
by Anthony McGarry 01 Aug '14

01 Aug '14

Hi, I receive CDRs from a gateway. There are two types SS7 and SIP I want to insert the SS7 and discard the SIP. However I need to respond to the gateway with an Accounting-Response for these SIP records or it will failover. I have tried this below deny_img_sip_acct { if (Dialogic-call-type =~ /SIP/) { update control { Response-Packet-Type := Accounting-Response } handled } } based on the do_not_respond template. It stops the SIP from being wrote to the DB but it is not sending the response. Is there a way to force a response? Anthony See below SS7 and SIP request \\\\\SIP Ready to process requests. rad_recv: Accounting-Request packet from host 10.101.20.201 port 1813, id=5, length=630 NAS-IP-Address = 10.101.20.201 NAS-Port = 1813 Calling-Station-Id = "499529638" Called-Station-Id = "ad061203407" Acct-Session-Id = "00201c1428fa008e00e213db832d4d0c1297" Acct-Status-Type = Start NAS-Port-Type = Ethernet Service-Type = Login-User Dialogic-call-origin = "answer" Dialogic-call-type = "SIP" Acct-Delay-Time = 6 Login-IP-Host = 10.101.20.96 Tunnel-Client-Endpoint:0 = "10.101.20.201" Dialogic-setup-time = "FRI AUG 01 13:08:14:285 2014" Dialogic-connect-time = "FRI AUG 01 13:08:14:295 2014" Dialogic-dnis-post-translate = "ad061203407" Dialogic-ani-post-translate = "499529638" Dialogic-call-direction = "OUTGOING LEG" Dialogic-trunk-grp-out = "cs03" Dialogic-next-hop-ip = "10.101.23.112" Dialogic-outgoing-req-uri = "sip:ad061203407@10.101.23.112" Dialogic-next-hop-dn = "10.101.23.112" Dialogic-call-id = "732a-408-71201412813-IMG1_DEG-1-10.101.23.201" Dialogic-voip-dst-sig-ip-out = "10.101.23.112" Dialogic-voip-dst-rtp-ip-out = "10.101.24.112" Dialogic-voip-src-rtp-ip-out = "10.101.24.201" Dialogic-voip-src-sig-ip-out = "10.101.23.201" Dialogic-voip-local-vocoders = "PCMA,PCMU,CLEARMODE,G729,telephone-event" Dialogic-voip-remote-vocoders = "PCMA,telephone-event" Dialogic-voip-codec-priority = "Local" Dialogic-span-id = "4160" Dialogic-channel-id = "8" server img1010 { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/raddb/radiusd.conf +- entering group accounting {...} ++- entering policy deny_img_sip_acct {...} +++? if (Dialogic-call-type =~ /SIP/) ? Evaluating (Dialogic-call-type =~ /SIP/) -> TRUE +++? if (Dialogic-call-type =~ /SIP/) -> TRUE +++- entering if (Dialogic-call-type =~ /SIP/) {...} ++++[control] returns noop ++++[handled] returns handled +++- if (Dialogic-call-type =~ /SIP/) returns handled ++- policy deny_img_sip_acct returns handled } # server img1010 Finished request 4. Cleaning up request 4 ID 5 with timestamp +24 Going to the next request \\\\SS7 Ready to process requests. rad_recv: Accounting-Request packet from host 10.101.20.201 port 1813, id=7, length=433 NAS-IP-Address = 10.101.20.201 NAS-Port = 1813 Calling-Station-Id = "871515967" Called-Station-Id = "17533010214548704f" Acct-Session-Id = "00201c1428fa009d000413db826a53181331" Acct-Session-Time = 206 Acct-Status-Type = Stop Acct-Terminate-Cause = NAS-Request NAS-Port-Type = Ethernet Service-Type = Login-User Dialogic-call-origin = "originate" Dialogic-call-type = "SS7" Dialogic-Q931-disconnect-cause = "10" Acct-Delay-Time = 0 Login-IP-Host = 10.101.20.96 Tunnel-Client-Endpoint:0 = "10.101.20.201" Dialogic-setup-time = "FRI AUG 01 13:04:58:108 2014" Dialogic-connect-time = "FRI AUG 01 13:05:02:258 2014" Dialogic-disconnect-time = "FRI AUG 01 13:08:27:948 2014" Dialogic-release-source = "CALLED PARTY RELEASE,Remote" Dialogic-dnis-pre-translate = "ad0214548704" Dialogic-ani-pre-translate = "871515967" Dialogic-call-direction = "INCOMING LEG" Dialogic-trunk-grp-in = “Trunk" Dialogic-span-id = "2" Dialogic-channel-id = "11" server img1010 { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/raddb/radiusd.conf +- entering group accounting {...} ++- entering policy deny_img_sip_acct {...} +++? if (Dialogic-call-type =~ /SIP/) ? Evaluating (Dialogic-call-type =~ /SIP/) -> FALSE +++? if (Dialogic-call-type =~ /SIP/) -> FALSE ++- policy deny_img_sip_acct returns noop [sql_virtual_1] expand: UPDATE radacct SET acctsessiontime = '%{Acct-Session-Time}', disconnecttime = '%{Dialogic-disconnect-time}' WHERE acctsessionid = '%{Acct-Session-Id}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctsessiontime = '206', disconnecttime = 'FRI AUG 01 13:08:27:948 2014' WHERE acctsessionid = '00201c1428fa009d000413db826a53181331' AND nasipaddress = '10.101.20.201' [sql_virtual_1] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql_virtual_1): Reserving sql socket id: 3 rlm_sql_mysql: query: UPDATE radacct SET acctsessiontime = '206', disconnecttime = 'FRI AUG 01 13:08:27:948 2014' WHERE acctsessionid = '00201c1428fa009d000413db826a53181331' AND nasipaddress = '10.101.20.201' [sql_virtual_1] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, nasipaddress, setuptime, connecttime, disconnecttime, callingstationid, calledstationid, trunkgroupin, trunkgroupout, spanid, channelid, calldirection) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{NAS-IP-Address}', '%{Dialogic-setup-time}', '%{Dialogic-connect-time}', '%{Dialogic-disconnect-time}', '%{Calling-Station-Id}', '%{Called-Station-Id}', '%{Dialogic-trunk-grp-in}', '%{Dialogic-trunk-grp-out}', '%{Dialogic-span-id}', '%{Dialogic-channel-id}', '%{Dialogic-call-direction}') -> INSERT INTO radacct (acctsessionid, acctuniqueid, nasipaddress, setuptime, connecttime, disconnecttime, callingst [sql_virtual_1] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, nasipaddress, setuptime, connecttime, disconnecttime, callingstationid, calledstationid, trunkgroupin, trunkgroupout, spanid, channelid, calldirection) VALUES ('00201c1428fa009d000413db826a53181331', '', '10.101.20.201', 'FRI AUG 01 13:04:58:108 2014', 'FRI AUG 01 13:05:02:258 2014', 'FRI AUG 01 13:08:27:948 2014', '871515967', '17533010214548704f', ’Trunk', '', '2', '11', 'INCOMING LEG') rlm_sql (sql_virtual_1): Released sql socket id: 3 ++[sql_virtual_1] returns ok } # server img1010 Sending Accounting-Response of id 7 to 10.101.20.201 port 1813 Finished request 6. Cleaning up request 6 ID 7 with timestamp +33 Going to the next request

1 0