November 2015 - Freeradius-Users - lists.freeradius.org

Radius data counting questions
by Oliver Paget 10 Nov '15

10 Nov '15

Hi All :) I've been devving with freeradius with mysql for my DSL infrastructure (FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 3 2012 at 01:22:51) It is being sent 64 byte accounting packets from a cisco router, aka my dev LNS. I have been trying to find a viable method for counting data for my test LNS but I have noticed this behaviour. To get the total data used for a user I simply sum(AcctOutputOctets) to find the total amount of data transferred for that user ever. When I query the DB a second time an hour later, sometimes the value is less than the previous time. Can somebody confirm for me that this is either broken or intended as im not sure I am knowledgeable enough to determine whether freeradius has a specific reason for this. Cheers, ojx

2 1

RE: If block in authenticate statement
by Franks Andy (IT Technical Architecture Manager) 09 Nov '15

09 Nov '15

Hi Alan, Thanks for the reply. I did try the OK bit at the end of the module, but it still returns noop, which is what confuses me. Whether I did the ok bit in the correct place is debateable but I did try it in the logical places. Does the ok placement need to be after an "else" statement? I'd put it at logical exit, i.e. after the if bit that I would want an ok returned, but if I need to specifically reject within the if/else and ok for all other eventualities at the end I didn't try that.. Anyway, onto why - I don't want to flat reject people using that SSID, just people who use PEAP and use mschapv2 (instead of TLS) on certain SSIDs. In certain circumstances I might want them to be allowed if they bring me sweets at Christmas for example. The problem is we (afaik) don't find out what the auth type is until the authorize stage where that module (eap in this case) sets it, and the inner auth type here is a few layers into the onion, that's why it sort of made sense to me to do it at "final" authenticate stage. I could probably also do it post-auth too I guess, pass it then check and reject.. The custom debug message was an "overall" delivery message to the indicate why failure had occurred at any point in the chain. Module-Failure-Message only works on certain modules afaik (or did when I last asked) so failures in certain areas would yield blanks. I'd quite happily ditch that if all modules do it now! I also think (from unreliable memory) that I had issues copying some of the attributes from inner to outer, some worked and some didn't - does the module-failure-message get automatically copied now from inner to outer layer? Thanks for your help as always! Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 06 November 2015 14:42 To: FreeRadius users mailing list Subject: Re: If block in authenticate statement On Nov 5, 2015, at 7:20 PM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > I'm doing something off-piste again probably. > Can I get away with doing an if statement within the mschap auth block? Yes. > I'm trying to allow peap-eap-mschap inner tunnel auth on certain ssids only; without the if statement, it works ok, but when I check against a control variable containing SSID, it produces this : > > mschap: --> --nt-response=10fe5a0664f0f3debffdcd61b60865947601331bdefef81c > (9) mschap: Program returned code (0) and output 'NT_KEY: CD7018318BC2359E8A362E0557384BEC' > (9) mschap: Adding MS-CHAPv2 MPPE keys > (9) [mschap] = ok > (9) if (!ok) { > (9) if (!ok) -> FALSE > (9) } # if (( control:SSID == "A_WiFi" ) || ( control:SSID == "Another_WiFi" )) = ok > (9) } # Auth-Type MS-CHAP = noop That's the issue. You can fix it by listing "ok" as the last module in the block which should return "ok". But as a larger issue... why are you doing these checks in the authenticate section? You should be doing most of them in the "authorize" section. You want to reject users as early in the process as possible. authorize { ... if (( control:SSID != "A_WiFi" ) && ( control:SSID != "Another_WiFi" )) { reject } ... } And why are you updating Debug-RejectInformation? Why not just use Module-Failure-Message directly? So the authenticate section can then look like this: authenticate { ... Auth-Type MS-CHAP { mschap } ... } If you need to see why a request was rejected, use Post-Auth-Type Reject: post-auth { ... Post-Auth-Type Reject { # Module-Failure-Message says why the user was rejected } ... } Much simpler. Much easier to understand. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Sharing a server
by Jason Vanlandingham 08 Nov '15

08 Nov '15

New user here... I have not installed FreeRADIUS yet. When I do, it will be on a CentOS 6 machine with the version that is installed from yum. (2.2.6-6.el6_7) I'm also running a network monitoring utility. (Observium) I want to be sure I'm not going to have problems with the web interface, so I want to create port-based virtual hosts. I am a network guy, and I admit my Linux/web server admin knowledge is a bit on the slim side. Is there a doc that helps out with what I need to do? If I leave Observium's page in the default port 80, will there be a problem when FreeRADIUS gets installed?

2 1

Clarifications on expected behavior when using proxy-inner-tunnel (3.x)
by Brian Julin 07 Nov '15

07 Nov '15

I don't know whether to rely on this behavior, because it seems a bit convoluted. In a server configured to proxy inner tunnel requests the requests flow as expected between the outer server and the client until PEAP starts unwrapping. Then the packet flow seems to be this: 1) normal client -> (outer-eap) -> outer server -> peap -> 2) proxy-inner-tunnel server autz (sets Proxy-To-Realm) 3) proxy-inner-tunnel server ("sends reply" back to outer) 4) either outer pre-proxy section or pre-proxy from a realm virtual_server directive 5) request actually sent to external inner 6) either outer post-proxy section or post-proxy from a realm virtual_server directive 7) outer post-auth proxy-inner-tunnel's post-auth never gets run, and its pre-proxy/post-proxy will not get run unless you use a realm "virtual_server" directive to force it. If this is set up naively without an "eap" in outer's post-proxy section and with no realm virtual_server directive, the administrator will find inner tunnel replies being sent directly to the client. If you do provide a post-proxy in the outer server or a realm virtual_server directive, everything ends up "working" minus not running some sections of the proxy-inner-tunnel server. 3,4,5 look like this: (7) Debug: authorize { (7) Debug: update control { (7) Debug: Proxy-To-Realm := "idpi" (7) Debug: } # update control = noop (7) Debug: } # authorize = noop (7) Debug: } # server eduroam_idp_proxy (7) Debug: Virtual server sending reply (7) Debug: eap_peap: Got tunneled reply code 0 (7) Debug: eap_peap: Tunnelled authentication will be proxied to idpi (7) Debug: eap: Tunneled session will be proxied. Not doing EAP (7) Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 7 (7) Debug: [eap] = handled (7) Debug: } # authenticate = handled (7) Debug: Empty pre-proxy section in virtual server "eduroam_idp_in". Using default return values. (7) Debug: proxy: Trying to allocate ID (0/2) (7) Debug: proxy: Trying to open a new listener to the home server (7) Debug: proxy: Trying to allocate ID (1/2) (7) Debug: proxy: request is now in proxy hash (7) Debug: proxy: allocating destination X.X.X.X port 1812 - Id 149 (7) Debug: Proxying request to home server X.X.X.X port 1812 timeout 30.000000 If that's the way it is supposed to work, as long as I can get my session-state handling straight, I'm happy to do it that way, but it looked odd so I didn't want to rely on it without asking. Also the default mods-available/proxy-inner-tunnel could use some commentary to this effect.

2 4

HOW TO WIRED 802.1x FreeRadius RHEL6 configuration for Dummies?
by lux xul 07 Nov '15

07 Nov '15

All- brand New to linux and freeradius, networking. Im winging it as best I can. Linux: RHEL6 Linux System Admin Dropdown with INSTALLED filter shows: freeRadius 2.2.6-6.el6_7(x86_64) Command line "radiusd -v" shows "freeRadius version 3.0.8" Confused. I downloaded the RHEL6 compatible 2.2.6 RPM and installed it using yum. That was what I THOUGHT I was working with. I also ran Yum and updated the servers database, etc. Question 1: Are freeradius RPM files labeled differently than freeRadius installation versions? Meaning a 2.2.6.el6_7 RPM can actually be the binary of a freeRadius version 3.0.8? Then... Following the Using radtest and the HOW-TOs on the freeRadius site I have configured and was able to verify that the freeRadius Server authenticates PAP and EAP-MD5. I have spent several days trying to locate how to configure the freeRadius server and 802.1x Port Security in a LINUX ONLY (no ms windows) and WIRED only test lab on one RHEL6 linux box. I want to eventually enlarge upon that n/w setup to include at least one separate client node. One step at a time. I find many tutorials on how to configure "freeRadius/802.1x client/server" on WIFI and in MSwindows environment, or a combination of linux and MS Windows. Now, it may be my lack of experience and lack of linux/networking understanding, but I cannot confidently follow tutorials that are not in sync with my linux/wired only limitations, especially when written with certain assumptions of a knowledge / experience base/vocabulary that I do not possess at this time. Question 2: Is there any available how to guide that may prove more basic and "for dummies" that I may use to step through a freeRadius/802.1x/Wired only/RHEL linux Only process? thank you for your suggestions in advance. I spent many hours trying to answer this so I wouldnt have to ask. -nube

3 2

EAP Taking Too Long to Authenticate
by Syed Rais Ahmad NON DRI 06 Nov '15

06 Nov '15

How can I reduce authentication time FreeRadius takes to authenticate laptop users based on security certs/EAP ? My implementation is taking about 18 seconds for the users to get authenticated. Thanks. This e-mail message is for the sole use of the intended recipient and may contain information that is confidential, proprietary or privileged. Any unauthorized review, use, distribution, copying or disclosure is strictly prohibited. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, please notify sender of the delivery error by replying to this message and then delete it from your system. Receipt by anyone other than the intended recipient is not a waiver of confidentiality or privilege.

5 9

Problem building with freeradius-client (LITTLE_ENDIAN redefined)
by dev 06 Nov '15

06 Nov '15

I'm trying to build an openLDAP module using radexample.c from freeradius-client-1.1.7 and getting an error "/src/freeradius-client-1.1.7/config.h:212:0: warning: "LITTLE_ENDIAN" redefined [enabled by default]" This macro is also defined in the file /openldap_2.4.28.orig/include/ac/bytes.h. What's the best way to fix this?

2 3

If block in authenticate statement
by Franks Andy (IT Technical Architecture Manager) 06 Nov '15

06 Nov '15

Hi all, I'm doing something off-piste again probably. Can I get away with doing an if statement within the mschap auth block? I'm trying to allow peap-eap-mschap inner tunnel auth on certain ssids only; without the if statement, it works ok, but when I check against a control variable containing SSID, it produces this : mschap: --> --nt-response=10fe5a0664f0f3debffdcd61b60865947601331bdefef81c (9) mschap: Program returned code (0) and output 'NT_KEY: CD7018318BC2359E8A362E0557384BEC' (9) mschap: Adding MS-CHAPv2 MPPE keys (9) [mschap] = ok (9) if (!ok) { (9) if (!ok) -> FALSE (9) } # if (( control:SSID == "A_WiFi" ) || ( control:SSID == "Another_WiFi" )) = ok (9) } # Auth-Type MS-CHAP = noop (9) inner-eap: Freeing handler (9) [inner-eap] = reject Mschap returns ok, but the auth returns noop, and thus rejection happens. I've tried various combinations of "ok", handled etc after the if block but I'm probably doing something that's not allowed or better done another way. Auth-type MS-CHAP { if (( control:SSID == "A_WiFi" ) || ( control:SSID == "Another_WiFi" )) { mschap { reject = 1 invalid = 1 } if (!ok) { if (Module-Failure-Message) { update outer.control { Debug-RejectInformation := "%{Module-Failure-Message}" } } reject } } else { # mschap not allowed on this wifi ssid reject } } Thanks as always Andy

2 1

Urgent help, radius is crashing due to Child is hung for request
by bbnlrad＠bbnldevices.in 05 Nov '15

05 Nov '15

Hi, I am new to radius, hence please forgive me if i am asking very basic stupid questions. We have a production box having radius 2.2. it is talking to a mysql server 5.1. The broadband clients are coming in through mikrotik router 6x >From past a month a month we are seeing that the radius is getting into issues intermittently and does not respond. we keep seeing the following errors during that time. ue Nov 3 22:25:59 2015 : Info: WARNING: Child is hung for request 12221 in component <core> module <queue>. Tue Nov 3 22:25:59 2015 : Info: WARNING: Child is hung for request 11643 in component <core> module <queue>. Tue Nov 3 22:25:59 2015 : Info: WARNING: Child is hung for request 12795 in component <core> module <queue>. The connections on the db side is around In the radacct table we see around 8 to 9k users online. the mysql database is running on a dual core with around 1% loadaverage and the user cpu is just getting consume around 12%. Based on this i do presume the db is running fine. A small obseravtion from my team is that if the users crsossed around 10k the the issues starts. Can somebody please do help me out as to what configuration needs to be done in the radius server for a large volume we have around 60k customers, what internal tweaking needs to be done on the radius server side. Also please help me out as to what recommendation needs to set on the db side too. one the radiusd.conf file down below is what i see which is un commented max_request_time = 30 cleanup_delay = 5 max_requests = 2048 thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } sql.conf has num_sql_socks = 200 connect_failure_retry_delay = 60 lifetime = 0 max_queries = 0 nas_table = "nas" the db has symbolic-links=0 innodb_stats_on_metadata=0 key_buffer=128M myisam_sort_buffer_size=128M sort_buffer_size=32M innodb_buffer_pool_size=5120M innodb_log_file_size=256M innodb_file_per_table innodb_flush_log_at_trx_commit=2 innodb_flush_method=O_DIRECT when we start seeing the errors in the adius logs, i have tried to login to the mysql from the radius server, it takes time to login. The machine is a quad core with 8 gb ram Your help is greatly appreciated. Thanks Arun

2 2

[freeradius-users] Bug in dictionary.starent (freeradius-3.0.10)
by Aleksander Nycz 05 Nov '15

05 Nov '15

Hello, Please check dictionary.starent for freeradius-3.0.10: ATTRIBUTE SNA-Input-Gigawords 206 integer ATTRIBUTE SN-WiMAX-Auth-Only 206 integer Attribute 'SN-WiMAX-Auth-Only' should have code 306 except 206. Regards Aleksander Nycz -- Aleksander Nycz Chief Designer Telco_021 BSS R&D Comarch SA Phone: +48 17 785 5909 Mobile: +48 691 464 275 website: www.comarch.pl

2 1