November 2015 - Freeradius-Users - lists.freeradius.org

cache_ocsp
by Scott Armitage 25 Nov '15

25 Nov '15

I might be doing something wrong but I can’t seem to find the cache_ocsp module anywhere which is called in the tls-cache server: /etc/raddb/sites-enabled/tls-cache[114]: Failed to find "cache_ocsp" as a module or policy. /etc/raddb/sites-enabled/tls-cache[114]: Please verify that the configuration exists in /etc/raddb/mods-enabled/cache_ocsp. /etc/raddb/sites-enabled/tls-cache[114]: Failed to parse "cache_ocsp" entry. Has anyone else experienced this problem? Regards Scott

5 11

about radius user password
by Serkan KASAP 25 Nov '15

25 Nov '15

hi. is it possible to insert raddacct password variable or value? username working but password not working. please help. accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')"

2 1

EAP-TLS and Active Directory
by Simon Larsson 25 Nov '15

25 Nov '15

Hi there! I’m having a problem where I don’t fully understand exactly how EAP-TLS works in regards to authorization. I'm trying to implement a 802.1x wireless network which uses EAP-TLS for security reasons. I already have a Windows server with a Certificate Authority, so that's not really an issue. All I have to do there is to create the certificates and then insert them into both the FreeRADIUS server and all the clients. Here’s my problem. As I understand it, EAP-TLS uses the certificates for authentication and therefor my users credentials become less important (not needed to log in to the network). Now, if my users never enter their credentials and the FreeRADIUS server never checks with Active Directory for authorization, what decides what network resources a specific user should have access to? My goal here is to have it so that when a user connects to the network, the user should automatically get access that users network resources. Thanks in advance, Simon

5 8

Filtering VLAN assignmen in eduroam
by Angel L. Mateo 25 Nov '15

25 Nov '15

Hello, I'm using freeradius 3.0.10 to authenticate eduroam connections. In my inner server I return attributes to assign VLAN to our internal users and I want these attributes to be filtered when the connection is from an external organization. So in the outer server I have: post-proxy { eduroam_log files_eduroam_outer.authorize attr_filter.post-proxy } and in the attr_filter.post-proxy file I have: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, MS-CHAP-MPPE-Keys =* ANY, State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Calling-Station-Id =* ANY, Operator-Name =* ANY, Port-Limit <= 2, GSS-Acceptor-Service-Name =* ANY, GSS-Acceptor-Host-Name =* ANY, GSS-Acceptor-Service-Specifics =* ANY, GSS-Acceptor-Realm-Name =* ANY, SAML-AAA-Assertion =* ANY, EAP-Channel-Binding-Message =* ANY According to attr_filter documentation, if I don't have the Tunnel-Private-Group-Id in this file, then the attribute should be filtered, isn't it? But, the attribute is not being filtered. It is returned to my upper radius server. Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

3 2

eapol_test question
by Alex Sharaz 24 Nov '15

24 Nov '15

Not a freeradius question as such, but guess people on the list use eapol_test. >From the man page -N attr spec Send arbitrary attribute specific by attr_id:syntax:value, or attr_id alone. attr_id should be the numeric ID of the attribute, and syntax should be one of 's' (string), 'd' (inte‐ ger), or 'x' (octet string). The value is the attribute value to send. When attr_id is given alone, NULL is used as the attribute value. Multiple attributes can be specified by using the option several times. so -N 61:d:19 means set NAS-Port-Type to be Wireless-802.11 ( val=19) Anyone know if I can specify a VSA attribute this way? is it just a case of VSA base val + attribute number ? Rgds Alex

5 7

State of RadSec in FR 3.0.10
by Sebastian Hagedorn 24 Nov '15

24 Nov '15

Hi, we have never used RadSec before but are planning to do so for Eduroam. I found this (three years old) document from GÉANT on it, and was planning on trying it that way: <https://wiki.geant.org/display/H2eduroam/freeradius3-flr> But our national Eduroam center (DFN) recommends using radsecproxy instead, because according to them RadSec isn't yet stable in FR 3.0. What's your take on that? To be honest, I'd rather help fix problems in FR's RadSec implementation than install another piece of software - unless you recommend against it. -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

3 3

Segfault on FR 3.0.4 when MySQL server goes away
by Jonathan Gazeley 24 Nov '15

24 Nov '15

I'm currently running a mixed estate of RADIUS 2 and 3 on CentOS 6 and 7 (halfway through a migration project). The older servers are running a home-built FR 2.2.9 and the newer ones are running stock FR 3.0.4, as supplied with CentOS 7. I've noticed the FR 3 boxes segfault from time to time and I think I've pinned it down to odd behaviour when the MySQL server is temporarily unavailable. We have clustered SQL behind an F5 load balancer but there is a small delay during failover when one of the SQL nodes goes away or when the F5 decides to switch to a different node for some other reason. The FR2 boxes cope fine with this transition but the FR3 boxes segfault in about 50% of cases. I understand 3.0.4 is not the latest and I'm happy to build 3.1.x if this will fix the problem but initially I'm trying to work out if this is a bug in the server, or a misconfiguration on my part (although I'd hope a misconfiguration wouldn't cause a crash). Backtrace included below, although this was not built with --enable-developer since it is a busy production system. I tried to replicate this on a dev system but the much lower load makes it hard to cause the crash. Thanks, Jonathan ... rlm_sql (uobsql-write): Reserved connection (4) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (4) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (3) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (3) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (2) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (2) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (1) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (1) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (0) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (0) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Failed to reconnect (0), no free connections are available Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff1a5f700 (LWP 23087)] sql_error (handle=0x0, config=0x555555b58b70) at src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c:479 479 rlm_sql_mysql_conn_t *conn = handle->conn; (gdb) bt #0 sql_error (handle=0x0, config=0x555555b58b70) at src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c:479 #1 0x00007ffff298558b in sql_xlat (instance=0x555555b58b70, request=0x555555ca2c90, query=0x7fffd4035970 "select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'", out=0x7fffd4017980 "", freespace=1024) at src/modules/rlm_sql/rlm_sql.c:185 #2 0x00007ffff7bcc606 in xlat_aprint (ctx=ctx@entry=0x555555ca2c90, request=0x555555ca2c90, node=0x555555c62b30, escape=escape@entry=0x0, escape_ctx=0x0, lvl=0) at src/main/xlat.c:2025 #3 0x00007ffff7bcd1bd in xlat_process (out=0x7ffff1a5df60, request=0x555555ca2c90, head=0x555555c62b30, escape=0x0, escape_ctx=0x0) at src/main/xlat.c:2103 #4 0x00007ffff7bcd210 in xlat_expand_struct (out=0x7ffff1a5e000, outlen=0, request=<optimized out>, node=<optimized out>, escape=<optimized out>, escape_ctx=<optimized out>) at src/main/xlat.c:2175 #5 0x00007ffff7bc105e in radius_expand_tmpl (out=out@entry=0x7ffff1a5e000, request=request@entry=0x555555ca2c90, vpt=0x555555aa28b0) at src/main/evaluate.c:135 #6 0x00007ffff7bc15ca in radius_evaluate_map (request=request@entry=0x555555ca2c90, modreturn=modreturn@entry=10, depth=depth@entry=0, c=c@entry=0x555555aa2620) at src/main/evaluate.c:807 #7 0x00007ffff7bc1be0 in radius_evaluate_cond (request=request@entry=0x555555ca2c90, modreturn=10, depth=depth@entry=0, c=0x555555aa2620) at src/main/evaluate.c:913 #8 0x0000555555577dd8 in modcall_recurse (request=0x555555ca2c90, component=RLM_COMPONENT_POST_AUTH, depth=3, entry=entry@entry=0x7ffff1a5e9d8) at src/main/modcall.c:489 #9 0x0000555555577a70 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7ffff1a5e9c0, c=<optimized out>, result=0x7ffff1a5e3e4) at src/main/modcall.c:420 #10 0x0000555555577c67 in modcall_recurse (request=0x555555ca2c90, component=RLM_COMPONENT_POST_AUTH, depth=2, entry=entry@entry=0x7ffff1a5e9c0) at src/main/modcall.c:798 #11 0x0000555555577a70 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7ffff1a5e9a8, c=<optimized out>, result=0x7ffff1a5e5f4) at src/main/modcall.c:420 #12 0x0000555555577c67 in modcall_recurse (request=0x555555ca2c90, component=RLM_COMPONENT_POST_AUTH, depth=1, entry=entry@entry=0x7ffff1a5e9a8) at src/main/modcall.c:798 #13 0x0000555555577a70 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7ffff1a5e990, c=<optimized out>, result=0x7ffff1a5e804) at src/main/modcall.c:420 #14 0x0000555555577c67 in modcall_recurse (request=request@entry=0x555555ca2c90, component=component@entry=RLM_COMPONENT_POST_AUTH, depth=depth@entry=0, entry=entry@entry=0x7ffff1a5e990) at src/main/modcall.c:798 #15 0x0000555555578e90 in modcall (component=component@entry=RLM_COMPONENT_POST_AUTH, c=c@entry=0x555555c33170, request=request@entry=0x555555ca2c90) at src/main/modcall.c:1138 #16 0x00005555555762bf in indexed_modcall (comp=comp@entry=RLM_COMPONENT_POST_AUTH, idx=idx@entry=0, request=request@entry=0x555555ca2c90) at src/main/modules.c:909 #17 0x0000555555576eef in process_post_auth (postauth_type=postauth_type@entry=0, request=request@entry=0x555555ca2c90) at src/main/modules.c:1930 #18 0x000055555556724e in rad_postauth (request=request@entry=0x555555ca2c90) at src/main/auth.c:305 #19 0x000055555558185c in request_finish (request=request@entry=0x555555ca2c90, action=action@entry=1) at src/main/process.c:1346 #20 0x00005555555866cf in request_running (request=0x555555ca2c90, action=<optimized out>) at src/main/process.c:1535 #21 0x0000555555580617 in request_handler_thread (arg=0x555555c5f250) at src/main/threads.c:678 #22 0x00007ffff625ddf5 in start_thread (arg=0x7ffff1a5f700) at pthread_create.c:308 #23 0x00007ffff5b0e1ad in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

2 1

Serious problems with buffered accounting
by Jorge Pereira 24 Nov '15

24 Nov '15

Hi, Nowadays, I have tons of Accounting packets as stats below. # radsniff -i eth0 -f "port 1813" -W10 ######### Stats Iteration 2 ######### Interface capture rate: eth0 : 42.700/s Accounting-Request counters: Total : 21.400/s Linked : 21.200/s Unlinked : 0.000/s Accounting-Request latency: High : 113.875ms Low : 7.446ms Average : 31.365ms MA : 31.365ms Accounting-Request retransmits & loss: RT (0) : 24.600/s Accounting-Response counters: Total : 21.200/s Linked : 21.200/s Unlinked : 0.000/s Accounting-Response latency: High : 113.875ms Low : 7.446ms Average : 31.365ms MA : 31.365ms # And my approach was to use the buffered accounting as example below. # Simple accounting server server default_accounting { listen { ipaddr = * port = 0 type = acct } accounting { detail-buffered } } # written by detail detail-buffered { filename = ${radacctdir}/buffered/detail-%Y%m%d-%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} escape_filenames = no permissions = 0600 header = "%t" log_packet_header = yes suppress { User-Password } } # consumed by server buffered-accounting { listen { type = detail filename = "${radacctdir}/buffered/detail-*" load_factor = 30 retry_interval = 5 # poll_interval = 15 # track = yes } preacct { preprocess acct_unique } accounting { -sql_accounting if (!ok) { linelog-fail-sql ok } } } My problem is: The process that receive and write the packets is completely fast them who consume (buffered-accounting). This causes a big queue of files in /var/log/freeradius/buffered/ resulting in a giant delay. I have thinking about some issue related to race-condition or dead-lock. I really appreciate some tips and suggestions. -- Jorge Pereira

2 2

Re: FreeRadius 3.0.4
by oscar 23 Nov '15

23 Nov '15

Sorry, I reinstalled all again and still the same problem. What i should do? Unlink sql? Thanks. -------- Mensaje original -------- De: A.L.M.Buxey(a)lboro.ac.uk Fecha: 22/11/2015 21:23 (GMT+01:00) Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Asunto: Re: FreeRadius 3.0.4 Hi, > including configuration file /etc/raddb/sites-enabled/inner-tunnel > /etc/raddb/mods-config/sql/main/mysql/queries.conf[145]: Reference "${group_attribute}" not found > Errors reading or parsing /etc/raddb/radiusd.conf file read at wrong time > First time I modified some parameters on radiusd.conf, and run ln -s ../mods-available/sql ./, and configure sql parametres. yes, dont do that. SQL is , like LDAP, now a module that understands if it can be run. if you are doing any linking at all it would be to link mods-available/sql to mods-enabled/sql ${group_attribute} is actually defined in the sql config file alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 3

advaice on how to create certificates and setup an EAP-TLS from freeradius
by Achuthan Paramanathan 23 Nov '15

23 Nov '15

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAP-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some certificates (I am thinking of openSSL for that?). But I was not able to find useful information (a step-by step guide) on the wide net that could help me so I am trying my luck here. The wiki page from Freeraius site is not working: http://www.missl.cs.umd.edu/wireless/eaptls/ About my system: * AP: A TP-Link n750 * Radius Server: Ubuntu Server 14.04.3 LTS, running FreeRADIUS 2.1.12 * Client: Another ubuntu desktop It would be great if someone knows a good and detailed (working) step-by-step guide to do this, and can give me some link information. Thanks in advance /Acp

5 9