December 2015 - Freeradius-Users - lists.freeradius.org

Proxying with radsec/TLS, Access-Reject leads to "spoofed proxy reply"
by Susan Barnes 01 Jan '16

01 Jan '16

Hello, I am playing with radsec. I have set up a proxy-connection between our staging server and an additional testserver to act as homeserver. Both servers are v3.0.10. What I have managed so far is: The staging-server can contact the homeserver and establish a TLS-secured connection. The staging server sends a request to the homeserver and the homeserver will process it. The homeserver replies. If the homeserver rejects the Request, the staging-server will not accept the reply, but discards it with "Ignoring spoofed proxy reply. Signature is invalid" If the homeserver sends an Access-Accept, the staging-server will accept the reply. I have tried the proxy setup without radsec/TLS. In that case both Accept and Reject work. On the homeserver's side I have: client radiustest { ipaddr = $STAGING proto = tls secret = radsec } On the staging-server's side I have: home_server radiusdevel { ipaddr = $HOME port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { ... } } In debug output I first see on HOME: (0) SSL Connection Established on STAGING: (0) (other): SSL negotiation finished successfully I assume, that means that I set up the TLS-part correctly. Then I see on STAGING: Listening on proxy (STAGING, 46303) -> home_server (HOME, 2083) Waking up in 0.2 seconds. (0) Proxying request to home server HOME port 2083 (TLS) timeout 10.000000 (0) Sent Access-Request Id 239 from STAGING:46303 to HOME:2083 length 137 on HOME (0) tls_recv: Access-Request packet from host STAGING port 46303, id=239, length=137 (0) <running>: Received Access-Request Id 239 from STAGING:46303 to HOME:2083 length 137 (0) Sent Access-Reject Id 239 from HOME:2083 to STAGING:46303 length 49 And then on STAGING: "Ignoring spoofed proxy reply. Signature is invalid" 10 seconds later: (0) No proxy response, giving up on request and marking it done (0) ERROR: Failing proxied request for user "radtest(a)testrealm.de", due to lack of any response from home server HOME port 2083 I have poked around with gdb on the staging server a bit. Within rad_verify() at the point of calc_replydigest() we get to the point of "Received %s packet from home server %s port %d with invalid Response Authenticator! (Shared secret is incorrect.)", (did not appear anywhere in the Debug Output). Does anyone have an idea what the problem could be? Regards and Thanks Susan -- S.Barnes Cologne University IT/Networking Dept.

3 5

FreeRADIUS allows connections locally, but not remotely
by Ernie Dunbar 01 Jan '16

01 Jan '16

Hi everyone. I have a difficult problem that appears to have come out of the blue. After rebooting the Debian Wheezy server that hosts our RADIUS authentication this morning, suddenly FreeRADIUS v2.1.12+dfsg-1.2 is no longer working. I can successfully test the connection locally using 'radtest' like this: # /usr/bin/radtest customer password localhost:1812 5 localsecret -4 127.0.0.1 Sending Access-Request of id 218 to 127.0.0.1 port 1812 User-Name = "customer" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 5 Message-Authenticator = 0x00000000000000000000000000000000 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=218, length=38 Framed-Protocol = PPP Service-Type = Framed-User Framed-Compression = Van-Jacobson-TCP-IP I get the rad_recv response right away. When I test it from the same machine, but *saying* I'm connecting remotely, it apparently times out: www:/etc/freeradius# /usr/bin/radtest customer password localhost:1812 5 remotesecret -4 XXX.XXX.XXX.254 Sending Access-Request of id 34 to 127.0.0.1 port 1812 User-Name = "customer" User-Password = "password" NAS-IP-Address = XXX.XXX.XXX.254 NAS-Port = 5 Message-Authenticator = 0x00000000000000000000000000000000 Framed-Protocol = PPP Sending Access-Request of id 34 to 127.0.0.1 port 1812 User-Name = "customer" User-Password = "password" NAS-IP-Address = XXX.XXX.XXX.254 NAS-Port = 5 Message-Authenticator = 0x00000000000000000000000000000000 Framed-Protocol = PPP ^C The connection evidently times out and radtest retries, at which point I hit Ctrl-C. I get the same results when I actually test the connection from a remote site as when I pretend to make the connection from a remote site with -4 XXX.XXX.XXX.254. I can't really test *from* that site, since it's a Cisco AS5300. The only thing I can think of that *might* have changed was the Debian package version, but I can't even confirm that really, and it's in the old stable branch, which I believe is no longer supported with new patches. Nothing has changed in the FreeRADIUS configuration since about 2010. Any assistance would be appreciated!

3 9

Radius assigned IP for WPA2 Clients.
by Marc Beaumont 31 Dec '15

31 Dec '15

Hi, I'm in process of setting up a Xirrus Wifi access point to authenticate using a Freeradius Server. At the moment, I can get it to authenticate okay, but the client once connected always get it's IP from the DHCP server on the network. Is there a way to force it to use what I put in Framed-IP-Address as a the moment it ignores this? Marc Beaumont Network Admin / Linux Specialist Comms365 Limited e: marc.beaumont(a)comms365.com ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud http://www.intycascade.com/products/symantec/ ______________________________________________________________________

2 2

prepaid volume quota with cisco nas
by riki 31 Dec '15

31 Dec '15

Hello, i am working with Cisco NAS, it supports enforcing volume based quota. On first authorizations, i am expected to send QV value. When user runs out of quota, NAS wants to reauthorize. No problem on NAS side [1]. I am on freeradius-3.0.4 from Centos 7 repositories. Accounting is on PostgresSQL backend, acctinputoctets and acctoutputoctets are updated every 5 minutes. I can use following query for sqlcounter check on last session end expire it hourly: query = "\ SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) FROM radacct \ WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime \ > '%b'" I want to limit session volume for 5MB per every hour (if achieved in 20 minutes, do not authorize for next 40 minutes). Counters are cumulative for session so i have identified so far these options: 1. reset session when quota reached with CoA update/disconnect, it will causes new session every hour if quota is depleted and my query works. 2. i can use a trigger for update on radacct table which will insert delta of old and new value with timestamp to kind of "stats" table and use this one for sqlcounter query, counting data for last 12 5-minute intervals or so. 3. modify radacct table/update query to do the same as point 2. If you have some other ideas, please let me know. >From the future upgrade compatibility point of view, the 2 looks best. [1] http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/isg/configuration/xe-3s/as… Thanks for feedback r.

4 6

home_server status_check and radsec
by Mark Moseley 30 Dec '15

30 Dec '15

I'm still fairly new to freeradius so be gentle :) I'm setting up radsec and I had a question on home_server failover. Since the home_server is by necessity set to 'tcp', radiusd errors out with a message that 'status_check' must be set to 'none', if you try to set it to anything. Does that mean it's not possible to do failover with radsec proxies? I've got a home_server pool set up with two nodes. When I take down the first-listed home_server with tcpdump running, the freeradius on the 'client' side just keeps trying to hit the now-disabled server and never attempts the secondary. Presumably I'm missing something but google is no help so far. I can paste configs but I wanted to see first if it was known to just not be possible. Version is 3.0.4 (on Centos 7.1). The 3.0.4 -> 3.0.10 changelogs didn't have anything promising that sounded like this. Thanks!

2 4

RE: CoA config
by Franks Andy (IT Technical Architecture Manager) 30 Dec '15

30 Dec '15

I'm doing CoAs with FR..? Check out sites-available/originate-coa or radclient docs. Hope that's what you were after.. :-) -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Jorge Pereira Sent: 30 December 2015 14:35 To: FreeRadius users mailing list Subject: Re: CoA config this feature isn't available. -- Jorge Pereira On Wed, Dec 30, 2015 at 5:32 AM, Anirudh Malhotra <8zero2ops(a)gmail.com> wrote: > Can the NAS CoA config be done in NAS sql table? Or do i have to use file > only. > > BR, > Anirudh Malhotra > 8zero2 > Mail: 8zero2.in(a)gmail.com > Facebook: www.facebook.com/8zero2 > Twitter: @8zero2_in > Blog: blog.8zero2.in > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

CoA config
by Anirudh Malhotra 30 Dec '15

30 Dec '15

Can the NAS CoA config be done in NAS sql table? Or do i have to use file only. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 2

Errors authenticating certain users.
by Migo Pod 29 Dec '15

29 Dec '15

Hello List, A few years ago I inherited a FreeRADIUS environment, and it has been more or less trouble free for the whole time. In mid-December, however, we started getting reports of authentication failures from computers that were joined to our Active Directory environment and only those computers. Previously we've been having no issues authenticating people with username. AD\username. and username@realm, but on around the 16th people with the AD\username format started getting authentication failures. We're running RHEL6 with the distro supplied freeradius binary (freeradius-2.2.6-6.el6_7.x86_64) and haven't made any changes to anything besides system updates in over a year, and it has been working perfectly up until now. Here's a relevant log snippet that appears to describe the issue, but I have no idea where to start looking for a solution. +group authorize { ++[preprocess] = ok ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "podia-user", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry DEFAULT at line 50 ++[files] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Identity (AD\podia-user) does not match User-Name (podia-user). Authentication failed. [eap] Failed in handler ++[eap] = invalid +} # group authenticate = invalid Thanks in advance for any advice, -mat houser

3 8

MAC authentication using FreeRadius
by Max .M 29 Dec '15

29 Dec '15

Hi everyone, i'm looking in a way to set-up MAC authentication using FreeRadius and MySQL and any help would be much appreciated :) I have a scenario where multiple shops will have guest authenticating and when someone register to their public wi-fi, we want their MAC to be stored in the SQL database and do a check against it using MAC authentication on the Aruba IAPs. I guess I need to find a way to capture the Calling-Station-Id and store it into a table into the database and then I need to do a check against it for every MAC it receives as a "username and password' Right now I can authenticate to my captive portal using FreeRadius + MySQL, I can also enable MAC auth on my IAP and add a user with my phone's MAC address as a username and password and it's working. I'm really looking into a way to automate this :) Thanks a lot

4 8

RE: REG: change in email id
by Danner, Mearl 29 Dec '15

29 Dec '15

http://lists.freeradius.org/mailman/listinfo/freeradius-users Sent from my Android phone using Symantec TouchDown (www.symantec.com)

2 1