March 2015 - Freeradius-Users - lists.freeradius.org

Re: Access-Accept / Access-Reject based on LDAP Group & SSID
by Rui Ribeiro 24 Mar '15

24 Mar '15

Hi Ben, I have had problems with the final builds of 3.0.6 and 3.0.7 in Debian; but not with the intermediaries git head builds. At the moment using head (not the latest yet), and it is working well. I am used to build FreeRadius debs, invested quite some time in that. I would not mind to join and exchange contacts and ideas with other Debian fellows. It has been a challenge to keep FreeRadius working and keeping up the new versions. About maintaining a Debian package, I am not quite sure I have the time for that. Regards > > Message: 7 > Date: Mon, 23 Mar 2015 22:32:44 +0100 > From: Ben Humpert <ben(a)an3k.de> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Access-Accept / Access-Reject based on LDAP Group & SSID > Message-ID: > < > CAGbjqfEfH6nn6s20BpKYPpg+TwBSEZUM780VbaS2JU+AgwuZxQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > 2015-03-19 18:14 GMT+01:00 Alan DeKok <aland(a)deployingradius.com>: > > On Mar 19, 2015, at 12:20 PM, Ben Humpert <ben(a)an3k.de> wrote: > >> I'm running Ubuntu 14.04.1, FreeRADIUS 2.1.12 and OpenLDAP 2.4.31 > > > > <sigh> Upgrade to 2.2.6. The Debian / Ubuntu people have fixated on > 2.2.12 for reasons I don’t understand. > > > > I asked on ubuntu-devel-discuss and the answer is simple but sad. > > There isn't an active maintainer in debian (although someone did bump > the version there to 2.2.5), and no one in ubuntu has merged this from > debian since may last year. Sorry about that, but time is precious and > not everyone is interested in the package. It's probably too late, but > if this really matters to you have a look at > https://wiki.*ubuntu*.com/FreezeExceptionProcess > and make an FFe bug. > > > https://lists.ubuntu.com/archives/ubuntu-devel-discuss/2015-March/015417.ht… > > > I actually did build 3.0.7 packages on a fresh Ubuntu Server 14.04 > using http://wiki.freeradius.org/building/Build#Building-Debian-packages > but it's the first time I built a package and I really don't know if I > did everything right or missed something important. However, the > packages are working well on my servers so if it's really that simple > I could build and submit the latest stable to debian / ubuntu. > > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

Access-Accept / Access-Reject based on LDAP Group & SSID
by Ben Humpert 24 Mar '15

24 Mar '15

Hi, I already read plenty of Howtos, manpages and configuration examples and tried to find a Guide for what I'm trying to archive. The best matching I found was http://serverfault.com/questions/397087/auth-type-reject-in-radius-users-fi… and http://wiki.freeradius.org/guide/Mac-Authat but these didn't helped much. In fact they left me more confused than I was before. What I exactly want to archive is RADIUS to check 1) if the group the user is in is allowed to log into Called-Station-Ssid "guest" 2) if the username & password is correct 3) if user has "dialupAccess" set I'm running Ubuntu 14.04.1, FreeRADIUS 2.1.12 and OpenLDAP 2.4.31 I'd start from scratch but have modified dictionary, policy.conf and sites-available/default according to http://wiki.freeradius.org/guide/Mac-Auth Any help is greatly appreciated. Thank you very much in advance! Best regards, Ben Humpert

5 18

FreeRadius and OpenSSL 1.0.2
by Dave Duchscher 24 Mar '15

24 Mar '15

I am testing FreeRadius with OpenSSL 1.0.2 and noticed a strange issue. TTLS-MSCHAPv2 fails. PEAP and TTLS-(PAP, CHAP, MSCHAPv1) all work. The error that stands out is 'Invalid ACK received: 0'. I get this on both 2.2.6 and 3.0.7. 2.2.6 Mon Mar 23 08:40:09 2015 : Info: [ttls] Authenticate Mon Mar 23 08:40:09 2015 : Info: [ttls] processing EAP-TLS Mon Mar 23 08:40:09 2015 : Info: [ttls] Received TLS ACK Mon Mar 23 08:40:09 2015 : Info: [ttls] ACK default Mon Mar 23 08:40:09 2015 : Error: [ttls] Invalid ACK received: 0 Mon Mar 23 08:40:09 2015 : Info: [ttls] eaptls_verify returned 4 Mon Mar 23 08:40:09 2015 : Info: [ttls] eaptls_process returned 4 3.0.7 Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: Authenticate Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: processing EAP-TLS Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: Received TLS ACK Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: Received TLS ACK Mon Mar 23 09:14:26 2015 : ERROR: (21) eap_ttls: Invalid ACK received: 0 Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: eaptls_verify returned 0 Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: eaptls_process returned 0 Mon Mar 23 09:14:26 2015 : ERROR: (21) eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed Downgrading openssl to 1.0.1 and the issue goes away. 2.2.6 Mon Mar 23 08:50:40 2015 : Info: [ttls] Authenticate Mon Mar 23 08:50:40 2015 : Info: [ttls] processing EAP-TLS Mon Mar 23 08:50:40 2015 : Info: [ttls] Received TLS ACK Mon Mar 23 08:50:40 2015 : Info: [ttls] ACK handshake is finished Mon Mar 23 08:50:40 2015 : Info: [ttls] eaptls_verify returned 3 Mon Mar 23 08:50:40 2015 : Info: [ttls] eaptls_process returned 3 3.0.7 Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: Authenticate Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: processing EAP-TLS Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: Received TLS ACK Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: Received TLS ACK Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: ACK handshake is finished Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: eaptls_verify returned 3 Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: eaptls_process returned 3 This was tested with the default configuration and adding a user to the users file. The OS was FreeBSD 10.1. I assuming this a problem with the FreeBSD's OpenSSL 1.0.2 port but wanted to ask if anybody else has seen issues with the latest OpenSSL version? -- Dave

2 2

$FREERADIUS_OPTIONS in Freeradius startup
by Clement Ogedengbe 24 Mar '15

24 Mar '15

How do I use $FREERADIUS_OPTIONS in /etc/init.d/freeradius start/stop daemon script, to pass arguments such as config directort or logging to particular file/directory Best Regards Clement -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 19 March 2015 00:35 To: FreeRadius users mailing list Subject: Re: Crash > On 17 Mar 2015, at 17:23, Ben Gatewood <Ben.Gatewood(a)essensys.co.uk> wrote: > > This one: > > FreeRADIUS Version 3.0.8 (git #46056c1) Thanks, could you add a ticket in the issue tracker with the backtrace and any debug logging you have before the crash. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2

can EAP-PEAP-GTC use email pop3 server to authenticate?
by d tbsky 24 Mar '15

24 Mar '15

hi: I am using freeradius 3.0.1 at scientific linux 7.0. I want to use our pop3 server as database for wireless wpa authentication. (the eap-peap-mschapv2 works fine with our Active Directory. but for some reason we need another method). I try to test the idea as two parts: 1. setup a "test1" user at /etc/raddb/users like this test1 Cleartext-Password := "testtest" and use EAP-PEAP-GTC at windows client to test it, it works fine. 2. write a perl script to authenticate via pop3 server. I use "radtest 'user@domain' my-pop3-password 127.0.0.1:18120 0 testing123" to test, it works fine. the modification part of my inner-tunnel config is like below: authorize { pop3 if (ok || updated) { update control { Auth-Type := POP3 } } } Auth-Type POP3 { pop3 } 3. I can not combine above to the final result. I can not use EAP-PEAP-GTC from windows to authenticate via pop3 server. when I debug the perl script, I found no password input when using "EAP-PEAP-GTC". I try modify many settings but still can not get it work. so I wonder if my concept is wrong. is that possible to use EAP-PEAP-GTC against a pop3 server, or we need a cleartext-password file when using EAP-PEAP-GTC? I try to make the perl script dump %RED_REQUEST as below when using EAP-PEAP-GTC: $VAR1 = { 'User-Name' => 'xxx@xxxxxx', 'EAP-Message' => '0x020f00060306', 'Realm' => 'xxxxxxxxx', 'State' => '0x2dec2f402de335af33348f2ebbe6e91d', 'Stripped-User-Name' => 'xxxx', 'EAP-Type' => 'NAK', 'FreeRADIUS-Proxied-To' => '127.0.0.1' thanks a lot for help!! Regards, tbskyd

2 10

FreeRADIUS 3.x roadmap ?
by "RESTOUX, Loïc" 23 Mar '15

23 Mar '15

Hi, I found a roadmap of the 2.x branch of FreeRADIUS on the wiki. Is there something similar for the 3.x branches ? More specifically, I need to know if you're going to release the 3.0.8 version in the next weeks. Regards, -- LRS This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

5 6

EAP-TLS with check on DB possible?
by Stefano Zanmarchi 21 Mar '15

21 Mar '15

Hi, a newbie question before I start setting up Freeradius with EAP-TLS. Is it possible to configure Freeradius to make a double check when it receives an authentication request? I'd like it not only to check if the client certificate is valid but also if the user is in a DB "authorized_users" table. Thank you very much for your indications, Stefano

3 2

freeradius logging question
by Alex Sharaz 20 Mar '15

20 Mar '15

Hi, In common with (probably) every other freeradius user, my radius.log file shows logging of the form ..... Fri Mar 20 13:44:07 2015 : Auth: Login OK: [jah534(a)york.ac.uk] (from client arubal2 port 0 cli 78-4B-87-C0-81-97 via TLS tunnel) Fri Mar 20 13:44:07 2015 : Auth: Login OK: [@york.ac.uk] (from client arubal2 port 0 cli 78-4B-87-C0-81-97) Fri Mar 20 13:44:07 2015 : Auth: Login OK: [6C-F3-7F-C2-15-F0] (from client ce1sw4 port 29 cli 6C-F3-7F-C2-15-F0) ..... The above shows a local eduroam user log entry ( outer-tunnel user-name of @york.ac.uk ,inner tunnel username of jah534(a)york.ac.uk) and a mac auth entry from a switch. >From our point of view, the record with jah534(a)york.ac.uk is useful.... the @york.ac.uk record isn't. Is it possible to selectively disable what appears in the radius.log file ( e.g. modifying sites-enabled/default so that if RADIUS attribute EAP-Message exists don't add an entry to radius.log. This would allow our mac-auths to be logged as well as the TLS tunnel entries (as they are generated in sites-enabled/inner-tunnel) but discard the [@york.ac.uk] entries Rgds Alex

2 2

Re: Performance Problems ntlm_auth <-> Active Directory under heavy load
by Matthew Newton 19 Mar '15

19 Mar '15

Hi, [Please keep replies on-list] On Thu, Mar 19, 2015 at 12:58:40PM +0000, tom greisch wrote: > >Looks to me like you may have hit a different bug in winbind. Try > >running ntlm_auth from the command line and see if it gives the > >same problem. > > if i use ntlm_auth from the command line a Backtrace is not > logged. A Backtrace Log is also not generated if Freeradius does > only few "sporadic" User Authentications. If the Count of > Authentication increases i get a a lot of Backtraces logged. There are plenty of people running in this configuration, and this is the first I've heard of winbind/ntlm_auth crashing and producing backtraces. So it's likely something is odd about your setup. Have you tried Debian stable - it's possible there is a bug in the Samba version in Jessie. > ntlm_auth in freeradius not that ntlm_auth is the cause... sorry > my english is really not perfect but i hope you understand what > i mean... Your English is good. > >No, it doesn't say that, and you shouldn't do that. It will kill > >performance. Use ntlm_auth if you can't use the new patches (which > >aren't released yet anyway). > yes of course i know that i will lose Performance but is it not > better than a lot of Backtrace Logs or core dumps.. I think you should try a different version of Samba. Other people don't see that. They _do_ see performance issues with too many auths/second, which is, I believe, from the way people have to use ntlm_auth at present, which isn't really a Samba issue. Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

1 0

freeradius2 + iODBC + Informix
by vanish 19 Mar '15

19 Mar '15

Greeting, Fajar A. Nugraha-2, Alan DeKok-2. After yours answers i tried to rebuild freeradius with unixodbc module. 1. Install unixodbc and unixodbc-dev 2. Download 2.1.12 package: freeradius_2.1.12+dfsg-1.2ubuntu8.debian.tar.gz freeradius_2.1.12+dfsg-1.2ubuntu8.dsc freeradius_2.1.12+dfsg.orig.tar.bz2 2. Edit debian/rules : --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ !! --without-rlm_sql_iodbc \ !! --with-rlm_sql_unixodbc \ --with-system-libtool 3. Build package: dpkg-buildpackage -d -rfakeroot 4. Install deb packet: dpkg -i freeradius_2.1.12+dfsg-1.2ubuntu8_amd64.deb 5. Change sql.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "unixodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ 6. freeradius -X showed me: rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql_unixodbc: Connection failed rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. 7. On test.server.ru i used tcpdump utils to see incoming packets from my machine with freeradius - but the entering packets was not detected. Please, help me find the mistake. -- ============================================ С уважением, Богучарский Иван Владимирович. Начальник СУТС ОРЭТС и ШПД ЗАО "Коламбия-Телеком". тел. 8-937-084-25-89.

7 10