July 2015 - Freeradius-Users - lists.freeradius.org

session log in SQL
by Khapare Joshi 31 Jul '15

31 Jul '15

Now its time to configure to log into SQL :) Until now we uses cisco wireless controller and only allow two connection for all users. I wanted to implement Simultaneous-user based in student and staff. and want to use sql for it. My users are authenticate against AD (samb +ntml_auth). So here is what I did : 1. Created database radius. 2. Populated admin.sql into the mysql 3. Populated schema.sql into the radius database 4. Enabled sql.conf in /etc/raddb/radius.conf 5. Disabled radutmp and enabled sql in accounting section in /etc/raddb/site-enabled/default 6. So, added DEFAULT Simultaneous-Use := 2 in /etc/raddb/users file for testing 7. restarted radius - try logging few users But I do not see any tables in radius database been updated. I just wanted to use session for the simultaneous user for restrict user. if this works then I can write regex to query LDAP if x is staff or student. Point me if i am doing wrong or some docs where I can see more reading reading reading. K

2 10

ntlm_auth: hex decode of 00 failed
by Scott Pickles 30 Jul '15

30 Jul '15

>>Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-FESYSTEMSCOM} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}:>>(0) ntlm_auth : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}}>>(0) ntlm_auth : --> --username=spickles>>(0) ERROR: ntlm_auth : No NT-Domain was found in the User-Name>>(0) ntlm_auth : EXPAND --domain=%{%{mschap:NT-Domain}:-FESYSTEMSCOM}>>(0) ntlm_auth : --> --domain=FESYSTEMSCOM>>(0) ERROR: ntlm_auth : No MS-CHAP-Challenge in the request>>(0) ntlm_auth : EXPAND --challenge=%{%{mschap:Challenge}:-00}>>(0) ntlm_auth : --> --challenge=00>>(0) ERROR: ntlm_auth : No MS-CHAP-Response or MS-CHAP2-Response was found in the request>>(0) ntlm_auth : EXPAND --nt-response=%{%{mschap:NT-Response}:-00}>>(0) ntlm_auth : --> --nt-response=00>>hex decode of 00 failed! (only got 1 bytes) I ultimately want to use FreeRADIUS to authenticate user logins to my Cisco infrastructure, VPN connections to my ASA, and MS-PEAP for WiFi. Currently I'm just trying to run a test connection from my ASA firewall using the RADIUS test built in: >>test aaa-server authorization RADIUS host 172.18.2.100 username spickles I'm failing at the ntlm_auth portion above, and if I'm understanding it correctly it's because the test from the ASA is likely sending something like a pap request as opposed to an mschap? >>ERROR: ntlm_auth : No MS-CHAP-Challenge in the request This is expected and the default is then '00' based on the setting 'ntlm_auth : EXPAND --challenge=%{%{mschap:Challenge}:-00}'. So I guess at this point I'm looking for some guidance on how I can make all of this work because the RADIUS test isn't going to send an MS-CHAP challenge. Do I need to modify the ntlm_auth configuration to include a 'password' option?

2 2

Re: udp sockets and proxy servers
by Sergey Komarov 30 Jul '15

30 Jul '15

Hello, I've tested 3.0.10 with patch issued by Alan. Thanks for attention for the case, but it still have some problems: 1. In case you put Dst-IP-Address, than FR ignores port settings in coa sections of clients (coa server derived from clients.conf). Doesn't matter if I put port 1700 in clients.conf it use 3799. Then I add Dst-IP-Port 1700 and after that it works normally. But... Next point still impact. 2. After 3.0.10 installed udp sockets finishing very quickly and then it dies. Best Regards, Serge Komaroff > Date: Tue, 21 Jul 2015 10:23:43 +0300 > From: Sergey Komarov <sergey.komaroff(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: udp sockets and proxy servers > Message-ID: > <CAAZqZfDuvfpQM6iERUOfA31X-pwgU=0ZBPxJ7st0K1= > Zkis2qA(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > Hello! > > > > > Hmmm, well that's problematic. Could you open a GitHub issue. > > > > -Arran > > > > Hello Arran. Well, I'm not a developer actually I will try to post it to > GitHub in case my credentials is ok for that... > > > > Date: Mon, 20 Jul 2015 19:48:25 +0200 > > From: Alan DeKok <aland(a)deployingradius.com> > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Subject: Re: udp sockets and proxy servers > > Message-ID: <56E2A5E4-DFAD-4B47-816E-28CDFF51DACF(a)deployingradius.com> > > Content-Type: text/plain; charset=us-ascii > > > > On Jul 20, 2015, at 7:15 PM, Sergey Komarov <sergey.komaroff(a)gmail.com> > > wrote: > > > I'm tring to run 3.0.9 configuration with about ~1500 clients and home > > > servers (as I have about 1500 WLCs in the network and I try to proxy > CoA > > > packet to WLCs via radius). > > > > > > Radius server tries to open as many sockets as possible doing like > that: > > > > > > Info: ... adding new socket proxy address * port 46527 > > > Info: ... adding new socket proxy address * port 38003 > > > > > > It happens slowly or fast and it depends of load as I see it... And > then > > > after about 256 sockets server quits from running with error: > > > > Is that with TLS? Or TCP? We didn't predict that people would use 256 > > or more clients with CoA and TCP. > > > > But it *should* work for UDP. There's no reason for it to open many > > proxy sockets. It just needs one or two. > > > > Alan DeKok. > > > > Hello Alan! The case is that I'm using UDP only, no any TLS now, just > common pap/sql and Acc Req/Accept/CoA Proxy... SQL sockets is ok and no > overflow there (it even close some connections to DB when don't need it). > But it looks like FR tries to create as many sockets as home servers and it > happen slowly - depends on load. When I limit to 200 home servers - it > stopped to create sockets at number about 153... In case it overcome 256 it > drops soon with that error... > > > Best Regards, Serge Komaroff > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 123, Issue 76 > ************************************************* >

2 1

is it dangerous to change sql safe_characters ?
by d tbsky 30 Jul '15

30 Jul '15

hi: we are using freeradius 3.0.9. and we want to make the sql accounting data easier to read/process. currently the characters below we may use are escaped by default '\' => for windows account like "domain\user". "+","=" => for base64 encoding these two characters are used is it safe the add these characters to query.conf "safe_characters"? PS: by default the method to escap the "\" character seems not correct. when user use "domain\user" to login, if I check with "radiusd -X", the name sometimes present as 'domain\user', and sometimes present as "domain\\user". but finally when it write to sql, it becomes "domain=5C=5Cuser". I think the correct escaped string should be "domain=5Cuser" ? thanks a lot for help!! Regards, tbskyd

4 7

Fwd: unixODBC Error
by Harvii Dent 30 Jul '15

30 Jul '15

Hello, I've installed FreeRADIUS (3.0.4-6.el7) on CentOS 7 from the repositories with the plan to use unixODBC and FreeTDS to authenticate against a MSSQL database; however, running radiusd -X results in this (similar error when using freeradius-3.0.8-3.fc23): rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to database "FreeRADIUS" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib '/usr/lib64/libtdsodbc.so.0.0.0' : ?w????: undefined symbol: get_vtable rlm_sql_unixodbc: SQL down 08003 [unixODBC][Driver Manager]Connnection does not exist rlm_sql_unixodbc: Can't allocate the statement rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" Other users faced this 'get_vtable' issue but it doesn't seem that anyone found a solution, any help is appreciated. Thanks

4 5

Proxy CoA
by Cassiano Peixoto 29 Jul '15

29 Jul '15

Hi, I've been running a freeradius proxy with mpd in the same machine. My mpd is configured to use my localhost freeradius proxy/ And i have a central freeradius server where my freeradius proxy is consulting the users. Everything is working fine. So my env is: Server1: Server2 mpd ----------->>> freeradius server freeradius proxy I have a doubt how i could do if something has changed on my freeradius on server2 like a value in a table. I'd like my server1 check server2 some time and if something has changed send a COA packet to mpd to make the change. To let it more clear: I have in my server2 the attribute Mikrotik-Rate-Limit. If this attribute change for any reason my server1 should know. But unfortunately i don't have access to server2 to change any freeradius configuration. My server1 should check server2 and compare the last attribute with the new one. If it has changed send a CoA to mpd. I thought something like this in my post-auth section on my freeradius proxy on server1, but didn't work: update control { Tmp-String-0 = "%{request:Mikrotik-Rate-Limit}" Tmp-String-1 = "%{Mikrotik-Rate-Limit}" } if ("%{Tmp-String-0}" != "%{Tmp-String-1}") { update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Mikrotik-Rate-Limit += "%{request:Mikrotik-Rate-Limit}" } } Anyone could help me please? Thanks

1 0

Handling multiple customers with one radius instance
by Manfred Wolf 29 Jul '15

29 Jul '15

Hello everyone, we want to install one central freeradius that handles requests from multiple customers. Nearly all the handling for those customers is the same. Even the database should be the same. Just the namespace for each customer's users should be different, so that for example customer1 and customer2 can both have a joe user. We're currently using the default sql user database, but this one doesn't seem to support this directly. On the other hand, we want radiusclient1.customer1 and radiusclient2.customer1 to be handled identically. Is there a special module that could help us achieving this or what would be the best way to solve this kind of problem? We have searched around and come across a few possible ways tho we are not sure if they are good or would work at all. Anyway, those are: 1. Somehow check for the client IP using sql queries. Tho this way it might be hard if not impossible to that vpnserver1.customer1 and vpnserver2.customer2 both belong to customer1 2. Something with using realms. If it is possible with virtual servers to force customers in realms and then later check in the database for those realms to determine the customers. 3. A custom unlang or similar script that would filter the clients by our needs Kind regards, Manfred -- CosmoKey GmbH & Co. KG, Amtsgericht Bielefeld HRA 16201, vertreten durch ihre Geschäftsführerin die CosmoKey Beteiligungs GmbH, Amtsgericht Bielefeld HRB 41522, diese vertreten durch ihren Geschäftsführer Herrn Dominic Adenuga Walther-Rathenau-Str. 39 33602 Bielefeld Germany Telefon: 0151-43144121 Telefax: 0521-69983 Email: info(a)cosmokey.de CosmoKey GmbH & Co. KG USt-ID: DE296278210 CosmoKey GmbH USt-ID: DE296278201

2 4

how to set allowed Called-Station-SSID for user in his LDAP configuration?
by Zeus Panchenko 28 Jul '15

28 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, how is it correct to set allowed Called-Station-SSID (the only SSID user allowed to connect to) for user who is configured via LDAP (without SSID issue, users are configured and authenticated/authorized successfully, my question relates *only* to SSID related configuration)? I hoped I can use attribute radiusCheckItem like this radiusCheckItem: Called-Station-SSID == AllowedSsidName but I have no evicence in debug, it is checked :( as well as anything configured via radiusCheckedItem is ignored, perhaps I need to say to FR to do that but I do not understand how to yet? is it in mods-enabled/ldap update section (like control:...)? in FR v.2.x in file users I used this configuration: - ---[ quotation start ]------------------------------------------- DEFAULT Ldap-Group == "wifi-AllowedSsidName", Called-Station-SSID == "AllowedSsidName", Simultaneous-Use := '1', User-Profile := "cn=wifi-AllowedSsidName,ou=rad-profiles,dc=xyz" Reply-Message := "%{User-Name}, SSID: %{Called-Station-SSID} access was permited to you.", Fall-Through = no - ---[ quotation end ]------------------------------------------- but how to get it confiured for v.3.x? for v.3.x have I to use users file too? if not, then how is it correct to get that logic configured in LDAP? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlW3dxoACgkQr3jpPg/3oyqvUACgl/c6blTfwpn+3fRIzhspAKyO YIkAn0sXia4m84vzIDiVKNE6PIxqV/UG =S2nH -----END PGP SIGNATURE-----

2 3

unavailable database makes freeradius 3.0.9 server unresponsive
by Michal Tomaszewski 28 Jul '15

28 Jul '15

Hello, We found a problem in freeradius 3.0.9 when database (mysql as well as redis) is not working for a while. Server: Ubuntu 14.04, fresh install of freeradius 3.0.9 compiled from sources using default settings. When database is going down server hangs on first processed request and stops processing any further requests. There is no connection timeout nor any other timeout to database request. In freeradius 2.x when database was not available server responded with Reject until database was on. In freeradius 3.0.9 server stops responding to any requests, even when database comes up. Below there is an example with redis module. The same problem we have when mysql server goes down. After redis is stopped: Fri Jul 24 17:44:34 2015 : Debug: (1) policy usercache.authorize { Fri Jul 24 17:44:34 2015 : Debug: (1) update request { Fri Jul 24 17:44:34 2015 : Debug: rlm_redis (redis): Reserved connection (3) Fri Jul 24 17:44:34 2015 : Debug: rlm_redis (redis): executing the query: "exists map/usercache/id/" Fri Jul 24 17:44:34 2015 : ERROR: (1) Server closed the connection Fri Jul 24 17:44:34 2015 : Debug: rlm_redis (redis): Reconnecting (3) Fri Jul 24 17:44:34 2015 : Error: rlm_redis (redis): Problems with redisConnect('10.113.13.245', 6379), Connection refused There are no other messages on screen when in radius -XXX mode. There is no timeout for such operation thus server stops processing any requests. When redis goes up few seconds later it does not enable processing requests. When radiusd works as a service in the log we have: Fri Jul 24 17:50:00 2015 : Info: Ready to process requests ****** First radiusclient requests Fri Jul 24 17:50:21 2015 : Info: rlm_redis (redis): 0 of 5 connections in use. Need more spares Fri Jul 24 17:50:21 2015 : Info: rlm_redis (redis): Opening additional connection (5), 1 of 27 pending slots used Fri Jul 24 17:50:21 2015 : Info: rlm_sql (sql): 0 of 5 connections in use. Need more spares Fri Jul 24 17:50:21 2015 : Info: rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used Fri Jul 24 17:50:21 2015 : Auth: (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test8/test] (from client stage-client port 0) Fri Jul 24 17:50:33 2015 : Info: rlm_redis (redis): Closing connection (3): Hit idle_timeout, was idle for 34 seconds Fri Jul 24 17:50:33 2015 : Info: rlm_redis (redis): Closing connection (4): Hit idle_timeout, was idle for 33 seconds ****** REDIS STOP + 2 radiusclient requests Fri Jul 24 17:50:33 2015 : ERROR: (1) ERROR: Server closed the connection Fri Jul 24 17:50:33 2015 : Error: rlm_redis (redis): Problems with redisConnect('10.113.13.245', 6379), Connection refused Fri Jul 24 17:50:38 2015 : Error: (1) Ignoring duplicate packet from client stage-client port 57494 - ID: 197 due to unfinished request in component authorize module Fri Jul 24 17:50:43 2015 : Error: (1) Ignoring duplicate packet from client stage-client port 57494 - ID: 197 due to unfinished request in component authorize module Fri Jul 24 17:50:57 2015 : Error: (2) Ignoring duplicate packet from client stage-client port 42331 - ID: 188 due to unfinished request in component authorize module Fri Jul 24 17:51:02 2015 : Error: (2) Ignoring duplicate packet from client stage-client port 42331 - ID: 188 due to unfinished request in component authorize module Fri Jul 24 17:51:11 2015 : Error: Unresponsive child for request 1, in component authorize module Fri Jul 24 17:51:30 2015 : Error: Unresponsive child for request 2, in component authorize module ****** REDIS START + 1 radiusclient request Fri Jul 24 17:52:24 2015 : Error: (3) Ignoring duplicate packet from client stage-client port 51752 - ID: 89 due to unfinished request in component authorize module Fri Jul 24 17:52:29 2015 : Error: (3) Ignoring duplicate packet from client stage-client port 51752 - ID: 89 due to unfinished request in component authorize module Fri Jul 24 17:52:57 2015 : Error: Unresponsive child for request 3, in component authorize module How to reproduce the issue: 1. Make a request to the freeradius server using radiusclient. 2. Stop the database server. 3. Make another connection to the freeradius server using radiusclient. (the client request will time-out...) 4. Start the database server. 5. All following radiusclient requests will time out. Can anybody suggest what shall be reconfigured in order to keep freeradius responding and properly get Access-reject response when database is unavailable? Mike ________________________________________ Uwaga: Tre?? niniejszej wiadomo?ci mo?e by? poufna i obj?ta zakazem jej ujawniania. Je?li czytelnik tej wiadomo?ci nie jest jej zamierzonym adresatem, pracownikiem lub po?rednikiem upowa?nionym do jej przekazania adresatowi, informujemy ?e wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomo?ci jest zabronione. Je?li otrzyma?e? t? wiadomo?? omy?kowo, prosz? bezzw?ocznie odes?a? j? nadawcy, a sam? wiadomo?? usun?? z komputera. Dzi?kujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

4 8

3.0.9: eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed
by Mohamed Lrhazi 27 Jul '15

27 Jul '15

Hello, Any idea why 3.0.9 would reject an ldap user with the above error, while 3.0.8 would successfully authenticate them? The two servers have the same config files. I looked at the debug output and could not see a difference.. just an error: for the same user, hence same password hash fetched from same LDAP server: 3.0.9 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Expiring EAP session with state 0x776c1e12716407f0 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Finished EAP session with state 0xb5c7569eb4cb5280 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Previous EAP request found for state 0xb5c7569eb4cb5280, released from the list Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Peer sent packet with method EAP MD5 (4) Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Calling submodule eap_md5 to process data Sat Jul 25 12:47:51 2015 : Debug: (1088) eap_md5: Cleartext-Password is required for EAP-MD5 authentication Sat Jul 25 12:47:51 2015 : ERROR: (1088) eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Sending EAP Failure (code 4) ID 12 length 4 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Failed in EAP select Sat Jul 25 12:47:51 2015 : Debug: (1088) modsingle[authenticate]: returned from eap (rlm_eap) for request 1088 Sat Jul 25 12:47:51 2015 : Debug: (1088) [eap] = invalid Sat Jul 25 12:47:51 2015 : Debug: (1088) } # authenticate = invalid Sat Jul 25 12:47:51 2015 : Debug: (1088) Failed to authenticate the user 3.0.8: Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Expiring EAP session with state 0x6843779268417367 Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Finished EAP session with state 0xa5b14de2a4bd57e0 Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Previous EAP request found for state 0xa5b14de2a4bd57e0, released from the list Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Peer sent method MSCHAPv2 (26) Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: EAP MSCHAPv2 (26) Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Calling eap_mschapv2 to process EAP data Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Freeing handler Sat Jul 25 12:52:12 2015 : Debug: (2534) modsingle[authenticate]: returned from eap (rlm_eap) for request 2534 Sat Jul 25 12:52:12 2015 : Debug: (2534) [eap] = ok Sat Jul 25 12:52:12 2015 : Debug: (2534) } # authenticate = ok Thanks, Mohamed.

5 17