April 2015 - Freeradius-Users - lists.freeradius.org

No radeapclient on Debian debs
by Rui Ribeiro 13 Apr '15

13 Apr '15

Hi all, I am using 3.0.8 in Debian 8 and making debs via the rules that come with the sources. I have just noticed that whilst the man pages for radeapclient are installed, the binary itself is not. -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

2 1

Re: Problem with freeradius and LDAP: crypt and MD5 password (Ana Gallardo Gómez)
by Rui Ribeiro 13 Apr '15

13 Apr '15

Please do not use 2.1.12, it is too old and has know bugs. If using Debian and implementing a new project, you would better go with jessie. Jessie is very stable now, and is supposed to go from Beta to production in two weeks time. Regards > Message: 4 > Date: Mon, 13 Apr 2015 09:47:20 +0200 > From: Ana Gallardo Gómez <anaougu(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Problem with freeradius and LDAP: crypt and MD5 password > Message-ID: > <CAGVYYLSMbiLe7Xsa4W= > 9Tc_hKdDrhA2MB-1r2C9XExn3BryY3w(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Alan, > > There's no User-Password in the packet. The server CANNOT use password > > authentication. > > > > I'm so sorry, I didn't realize it was missing this data... > > One more cuestion, in freeradius 2.1.12, can I get the authentication > result from the bind result? > < > http://confluence.diamond.ac.uk/display/PAAUTH/Using+LDAP+as+authentication… > > > Thank you very much :D > > :::::::::::::::::::::::::::::::::::: > :: Ana Gallardo Gómez :: > :::::::::::::::::::::::::::::::::::: > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

2 1

Group membership
by Олег Кобелев 13 Apr '15

13 Apr '15

Hello gents, I want to create groups (profiles) for different WIFI SSID. I am using Airespace-Wlan-Id check attribute. When I am applying it to user - it works fine. For example if users comes from Wlan with id 8 and Airespace-Wlan-Id := 8 he will be connected. And if Airespace-Wlan-Id doesn't match he will be rejected. But when I am applying this attribute to the group user belongs to - it doesn't work. User will be connected anyway. What am I doing wrong?

2 2

Using NAS-Identifier with login criteria
by Brian Boere 12 Apr '15

12 Apr '15

We are in the process of setting up FreeRadius 2.1.1 on a SLES10 server to authenticate with/against eDirectory on the back end to allow access to our wireless networks. We having things working so far that users can get access to one of the wireless networks if they are a member of a specific eDirectory group. (using the users file and "DEFAULT Ldap-Group..." We are basically going to have 2 different wireless networks (wifi1 ad wifi2). When using the radius for authenticating, the different wireless networks use their SSID as the NAS-Identifier. (we are able to see this when running "radiusd -X". Ultimately we want to allow all users who have an edirectory account to be able to use wifi1, but only members of a specific edirectory group can have access to wifi2 (NAS-Identifier = wifi2) How do we go about accomplishing this? Thanks in advance for any suggestions. Brian

5 15

SQL\Simultaneous logins\Cisco WLC
by Олег Кобелев 12 Apr '15

12 Apr '15

Hello, gents Can you advise me with my issue with simultaneous logins, please? I can't use radutmp because NAS port identifies only SSID (in case of Cisco WLC 5508). So it is always the same. And there are always only two records in the file. I switched to SQL method: sites-available/default session { #radutmp # # See "Simultaneous Use Checking Queries" in sql.conf sql } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address" } But all my seesions became "closed" after less than 2 minutes with acctterminatecause = Stale-Session (radacct table) So this query doesn't work simul_count_query = "SELECT COUNT(*) \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" Who decides that the session is stale? And how can I avoid it?

3 5

Server side sort controls in rlm_ldap
by Arran Cudbard-Bell 11 Apr '15

11 Apr '15

Minor new feature in rlm_ldap. Server side sort controls can now be specified if the server is built against OpenLDAP's libldap. The controls are marked as critical, so will cause the search to fail if they're not allowed. It's assumed if you've enabled them, you'll know your server supports server side sort controls, or at least, will test, to make sure they work. The idea is to be able to specify a filter that resolves to multiple user objects, and then sort them based on attributes. The entry appearing first in the result set is the one that's used, the rest are discarded. This allows default users to be created with lower precedence than objects which relate to real users. You may find, depending on the LDAP server, that the ordering of the results are dependent on the ordering of the conditions in the filter, in which case server side sorting will not be required. Example here: https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/raddb/mods-avai… -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Re: Conflicting Packet
by battossai 11 Apr '15

11 Apr '15

Hi all, So it is really database issue ? I've truncate radacct table, and now i turning on slow query on mysql database. I see weird at radipool, some of user connected but no data on that table ony 18 from 64 row, is this normal too ? Is it from that make FR receive conficting packet ? Thank you. Regards, Franky Yu

4 7

EAP Session Resumption
by Donald Sherker 10 Apr '15

10 Apr '15

I am running FreeRADIUS v3.0.x. I am trying to enable EAP Session Resumption, but I am running into some problems. In the eap module it says that two files will be written per session. I am never seeing the .vps file in the cache directory, and the .asn1 file will be written sometimes. For this session the file was written: (7) eap_peap: processing EAP-TLS (7) eap_peap: TLS Length 134 (7) eap_peap: Length Included (7) eap_peap: eaptls_verify returned 11 (7) eap_peap: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (7) eap_peap: TLS_accept: SSLv3 read client key exchange A (7) eap_peap: <<< TLS 1.0 ChangeCipherSpec [length 0001] (7) eap_peap: <<< TLS 1.0 Handshake [length 0010], Finished (7) eap_peap: TLS_accept: SSLv3 read finished A (7) eap_peap: >>> TLS 1.0 ChangeCipherSpec [length 0001] (7) eap_peap: TLS_accept: SSLv3 write change cipher spec A (7) eap_peap: >>> TLS 1.0 Handshake [length 0010], Finished (7) eap_peap: TLS_accept: SSLv3 write finished A (7) eap_peap: TLS_accept: SSLv3 flush data SSL: adding session f72abc554bb004769d9c8bf121d63a412b519538ece70b34526f42e787bb5b38 to cache SSL: wrote session f72abc554bb004769d9c8bf121d63a412b519538ece70b34526f42e787bb5b38 to /<logdir>/tlscache/f72abc554bb004769d9c8bf121d63a412b519538ece70b34526f42e787bb5b38.asn1 len=147 However this session was not resumed: (18) eap_peap: processing EAP-TLS (18) eap_peap: eaptls_verify returned 7 (18) eap_peap: Done initial handshake (18) eap_peap: eaptls_process returned 7 (18) eap_peap: FR_TLS_OK (18) eap_peap: Session established. Decoding tunneled attributes (18) eap_peap: PEAP state send tlv success (18) eap_peap: Received EAP-TLV response (18) eap_peap: Success (18) eap_peap: WARNING: No information in cached session f72abc554bb004769d9c8bf121d63a412b519538ece70b34526f42e787bb5b38 (18) eap: Freeing handler The files referred to here was not written at all: (26) eap_ttls: Authenticate (26) eap_ttls: processing EAP-TLS (26) eap_ttls: TLS Length 134 (26) eap_ttls: Length Included (26) eap_ttls: eaptls_verify returned 11 (26) eap_ttls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (26) eap_ttls: TLS_accept: SSLv3 read client key exchange A (26) eap_ttls: <<< TLS 1.0 ChangeCipherSpec [length 0001] (26) eap_ttls: <<< TLS 1.0 Handshake [length 0010], Finished (26) eap_ttls: TLS_accept: SSLv3 read finished A (26) eap_ttls: >>> TLS 1.0 ChangeCipherSpec [length 0001] (26) eap_ttls: TLS_accept: SSLv3 write change cipher spec A (26) eap_ttls: >>> TLS 1.0 Handshake [length 0010], Finished (26) eap_ttls: TLS_accept: SSLv3 write finished A (26) eap_ttls: TLS_accept: SSLv3 flush data SSL: adding session 78a6af3ea358b3a251b2815c7b60124e5009fd6b916932d9a554d872e05aa136 to cache SSL: wrote session 78a6af3ea358b3a251b2815c7b60124e5009fd6b916932d9a554d872e05aa136 to /<logdir>/tlscache/78a6af3ea358b3a251b2815c7b60124e5009fd6b916932d9a554d872e05aa136.asn1 len=147 (38) eap_peap: processing EAP-TLS (38) eap_peap: TLS Length 134 (38) eap_peap: Length Included (38) eap_peap: eaptls_verify returned 11 (38) eap_peap: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (38) eap_peap: TLS_accept: SSLv3 read client key exchange A (38) eap_peap: <<< TLS 1.0 ChangeCipherSpec [length 0001] (38) eap_peap: <<< TLS 1.0 Handshake [length 0010], Finished (38) eap_peap: TLS_accept: SSLv3 read finished A (38) eap_peap: >>> TLS 1.0 ChangeCipherSpec [length 0001] (38) eap_peap: TLS_accept: SSLv3 write change cipher spec A (38) eap_peap: >>> TLS 1.0 Handshake [length 0010], Finished (38) eap_peap: TLS_accept: SSLv3 write finished A (38) eap_peap: TLS_accept: SSLv3 flush data SSL: adding session d6d13833c06ec03ff683827076a82fe14adecb384a9ef401a467dc2a225a8853 to cache SSL: wrote session d6d13833c06ec03ff683827076a82fe14adecb384a9ef401a467dc2a225a8853 to /<logdir>/tlscache/d6d13833c06ec03ff683827076a82fe14adecb384a9ef401a467dc2a225a8853.asn1 len=147 Why would the files be written sometimes and not other times, and why are there no vps files for these sessions? Thanks, Don

2 1

3.0.7 -> run "make install" twice
by tom greisch 10 Apr '15

10 Apr '15

Hello, today i compiled Freeradius Version 3.0.7./configure -> okmake -> okmake install -> Error Message====================================== INSTALL doc/deployment/MACOSX INSTALL doc/deployment/supervise-radiusd.rst INSTALL doc/deployment/OS2 INSTALL doc/deployment/CYGWIN.rst INSTALL raddb/ mkdir: cannot create directory ‘/usr/local/etc/raddb/’: File exists raddb/all.mk:69: recipe for target '/usr/local/etc/raddb/' failed make: *** [/usr/local/etc/raddb/] Error 1 ====================================== If i type "make install" again -> It works

6 9

Wired 802.1x certificate warning
by sander timmermans 10 Apr '15

10 Apr '15

Hey folks, I'm having some difficulty with setting up a test environment for wired 802.1x authentication with FreeRADIUS. For starters, let me just throw the freeradius -X output here: rad_recv: Access-Request packet from host 81.82.213.157 port 2000, id=11, length=104 User-Name = "test" EAP-Message = 0x020100090174657374 NAS-IP-Address = 192.168.2.199 NAS-Port = 1 Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "78-AC-C0-5C-C2-0D" NAS-Port-Type = Ethernet Message-Authenticator = 0x8869e4d26b2aad94456e66246fd97702 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 11 to 81.82.213.157 port 2000 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb43a5b16b438421b8325e3b40d9ef210 Finished request 4. Going to the next request Waking up in 4.9 seconds. Cleaning up request 4 ID 11 with timestamp +1293 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xb43a5b16b438421b did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. So after doing some research I have deduced that this error implies the supplicant (which is a Windows machine) doesn't like the certificate the FreeRADIUS server is hurling its way and stops communicating. Now comes the odd part. I haven't even touched the certificates when installing FreeRADIUS on the server, and connecting wirelessly through a UniFi AP with the very same protocol on the very same supplicant machine works flawlessly. I have very likely made a misconfiguration on the Windows machine, I just haven't figured out where. I followed this guide for setting up the Ethernet connection: https://kb.meraki.com/knowledge_base/configuring-8021x-wired-authentication… In the Protected EAP Properties window, I unticked "Validate server certificate", like I did with the wireless connection. I will admit I knew little about RADIUS before starting this project, so it is very possible I've made some obvious mistakes. -- I find trial and error to be one of the best learning methods for me personally. :) Is there at all a way to get around this issue without messing with the certs? Please also do let me know what other output or logs you might need. Best regards, Sander Timmermans Compoint BVBA

2 1