July 2015 - Freeradius-Users - lists.freeradius.org

Migrating from Mikrotik NAS to FreeBSD
by Cassiano Peixoto 22 Jul '15

22 Jul '15

Hi guys, I've been using Mikrotik as NAS for years, but i think now it's time to make some changes, and im thinking to replace it with FreeBSD+MPD consulting my freeradius. The problem is i still have to keep some mikrotik NAS in my network and i can't change mikrotik database attributes. I'd like to migrate transparently. I have in my freeradius database mikrotik attributes like Mikrotik-Rate-Limit. But MPD uses mpd-limit attribute. So my question is, what is the best way to replace Mikrotik-Rate-Limit with mpd-limit in a radius request? When an user connect via pppoe+mpd it will look for mpd-limit attribute on freeradius database, that doesn't exist, but it have to get the info from Mikrotik-Rate-Limit values, and send it back to pppoe+mpd with the right values got from Mikrotik-Rate-Limit Attribute. Has anyone done something like this before? Thanks.

2 7

eap-tls with a cisco phone
by Christian Bösch 22 Jul '15

22 Jul '15

Hi, I’m trying to authenticate a Cisco IP Phone with 802.1X EAP-TLS. I added the Cisco root certs to the CA file and the CN name from the phone’s cert to the users file. But it doesn’t work. Maybe anybody can give me a hint? Thanks, Chris — eap.conf — default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 tls { certdir = ${confdir}/user-certs cadir = ${confdir}/user-certs private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.crt CA_file = ${confdir}/certs/allcas.crt dh_file = ${confdir}/certs/dh random_file = ${confdir}/certs/random fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" #cache { #enable = yes #lifetime = 12 # hours #max_entries = 255 #} } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes #virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes #virtual_server = "inner-tunnel" } mschapv2 { } — debug output: rad_recv: Access-Request packet from host 111.222.333.444 port 1645, id=196, length=286 User-Name = "CP-7841-SEPDCEB94CF21FA" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9216 Called-Station-Id = "84-80-2D-47-CC-0D" Calling-Station-Id = "DC-EB-94-CF-21-FA" EAP-Message = 0x0201001c0143502d373834312d534550444345423934434632314641 Message-Authenticator = 0x6e734e719fdd0b92819587a021164920 Cisco-AVPair = "audit-session-id=C1AB9E16000003C10E2DC71C" Cisco-AVPair = "method=dot1x" NAS-IP-Address = 111.222.333.444 NAS-Port = 60000 NAS-Port-Id = "GigabitEthernet117/2/0/13" NAS-Port-Type = Ethernet server v_dot1x { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail.log -> /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail.log expands to /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] expand: %t -> Mon Jul 20 09:52:54 2015 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "CP-7841-SEPDCEB94CF21FA", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "CP-7841-SEPDCEB94CF21FA" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap-v_dot1x] EAP packet type response id 1 length 28 [eap-v_dot1x] No EAP Start, assuming it's an on-going EAP conversation ++[eap-v_dot1x] returns updated rlm_dbm: try open database file: /usr/local/etc/raddb/users-dot1x_dbm rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add CP-7841-SEPDCEB94CF21FA to user list sm_parse_user: start parsing: user: CP-7841-SEPDCEB94CF21FA parse buffer: <<>> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Cisco-AVPair = "device-traffic-class=voice", Cisco-AVPair += "subscriber:service-name=PHONES">> rlm_dbm: recod parsed rlm_dbm: Reply found Remove CP-7841-SEPDCEB94CF21FA from user list ++[users-dot1x] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = eap-v_dot1x # Executing group from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authenticate {...} [eap-v_dot1x] EAP Identity [eap-v_dot1x] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap-v_dot1x] returns handled } # server v_dot1x Sending Access-Challenge of id 196 to 111.222.333.444 port 1645 Cisco-AVPair = "device-traffic-class=voice" Cisco-AVPair += "subscriber:service-name=PHONES" EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x77057cce7707711b016ba7ac0a5a3d56 Finished request 462. Going to the next request Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 111.222.333.444 port 1645, id=197, length=400 User-Name = "CP-7841-SEPDCEB94CF21FA" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9216 Called-Station-Id = "84-80-2D-47-CC-0D" Calling-Station-Id = "DC-EB-94-CF-21-FA" EAP-Message = 0x0202007c0d8000000072160301006d01000069030356539e2e932132392e6c3258b6c47c4cddf0a003025e7f3c1f10a5343859e06100000ac030c02f0035002f00ff01000036000b000403000102000a000a00080019001800170013000d001c001a0000040105010601030102010101020204030503060303030203 Message-Authenticator = 0x18e2f1ae2927b7a72c339b23a9c4dc55 Cisco-AVPair = "audit-session-id=C1AB9E16000003C10E2DC71C" Cisco-AVPair = "method=dot1x" NAS-IP-Address = 111.222.333.444 NAS-Port = 60000 NAS-Port-Id = "GigabitEthernet117/2/0/13" NAS-Port-Type = Ethernet State = 0x77057cce7707711b016ba7ac0a5a3d56 server v_dot1x { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail.log -> /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail.log expands to /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] expand: %t -> Mon Jul 20 09:52:55 2015 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "CP-7841-SEPDCEB94CF21FA", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "CP-7841-SEPDCEB94CF21FA" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap-v_dot1x] EAP packet type response id 2 length 124 [eap-v_dot1x] No EAP Start, assuming it's an on-going EAP conversation ++[eap-v_dot1x] returns updated rlm_dbm: try open database file: /usr/local/etc/raddb/users-dot1x_dbm rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add CP-7841-SEPDCEB94CF21FA to user list sm_parse_user: start parsing: user: CP-7841-SEPDCEB94CF21FA parse buffer: <<>> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Cisco-AVPair = "device-traffic-class=voice", Cisco-AVPair += "subscriber:service-name=PHONES">> rlm_dbm: recod parsed rlm_dbm: Reply found Remove CP-7841-SEPDCEB94CF21FA from user list ++[users-dot1x] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = eap-v_dot1x # Executing group from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authenticate {...} [eap-v_dot1x] Request found, released from the list [eap-v_dot1x] EAP/tls [eap-v_dot1x] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 114 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 006d], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 121f], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0207], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap-v_dot1x] returns handled } # server v_dot1x Sending Access-Challenge of id 197 to 111.222.333.444 port 1645 Cisco-AVPair = "device-traffic-class=voice" Cisco-AVPair += "subscriber:service-name=PHONES" EAP-Message = 0x010304000dc00000146616030100310200002d030155aca8d7e81b8b3da4c459be39a8dde18295a38a91bea822ec2cfcb78fa0822a000035000005ff01000100160301121f0b00121b0012180004f6308204f2308203daa003020102021023c7cef71fc211363fa31e717c9041e2300d06092a864886f70d01010505003036310b3009060355040613024e4c310f300d060355040a1306544552454e41311630140603550403130d544552454e412053534c204341301e170d3132313231303030303030305a170d3135313231303233353935395a3079310b300906035504061302415431323030060355040a1329566f7261726c6265726720556e69 EAP-Message = 0x76657273697479206f66204170706c69656420536369656e636573311d301b060355040b1314496e666f726d6174696f6e205365727669636573311730150603550403130e656475726f616d2e6668762e617430820122300d06092a864886f70d01010105000382010f003082010a0282010100b8a1cd6fb3a2c64e4a7c3a29878251f475c356197216a9a0d64e6398307f32ec33f9a84023a5befde1346fc273ff4d1bd10b3f7a694fc3181a7d3a042ec3f5c427653b2e2c274e574c90104d8b843f10d8eb1ea2bf50b773bd9a77d763a6d15b4cd3e7d486a1c23ad515d2b3ab82b87bd89cfc42ee7fade1c3c7ba56d7111fdc7e0d0ab7f320a949e8 EAP-Message = 0xe25d905dba11fab8b46a50b79ba2bf96d5946f6ecbe27b098b6b9db9e6d9eb6d4c70498b463e0f9ed841d353fd1c5241d1b1d53bfaabadd6f3f318af047b090ecd4bdc2e66922e437fe91e241f0943b5fa16cbc27d60cb54e3120fcc0917e0c2fd13247eb33d09d22ebdafad9eb7e705ecc2e77866a4c90203010001a38201b7308201b3301f0603551d230418301680140cbd93680cf3deaba3496b2b375747ea90e3b9ed301d0603551d0e041604146ec40797cfbd94fb36d92f764970563218f4d65a300e0603551d0f0101ff0404030205a0300c0603551d130101ff04023000301d0603551d250416301406082b0601050507030106082b060105 EAP-Message = 0x0507030230180603551d200411300f300d060b2b06010401b2310102021d303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c2e7463732e746572656e612e6f72672f544552454e4153534c43412e63726c306d06082b060105050701010461305f303506082b060105050730028629687474703a2f2f6372742e7463732e746572656e612e6f72672f544552454e4153534c43412e637274302606082b06010505073001861a687474703a2f2f6f6373702e7463732e746572656e612e6f7267306f0603551d1104683066820e656475726f616d2e6668762e6174820f656475726f616d312e6668762e6174820f656475726f61 EAP-Message = 0x6d322e6668762e6174821872 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x77057cce7606711b016ba7ac0a5a3d56 Finished request 463. Going to the next request Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 111.222.333.444 port 1645, id=198, length=282 User-Name = "CP-7841-SEPDCEB94CF21FA" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9216 Called-Station-Id = "84-80-2D-47-CC-0D" Calling-Station-Id = "DC-EB-94-CF-21-FA" EAP-Message = 0x020300060d00 Message-Authenticator = 0x33e76f51ba9e31652e48e06e41fa52dd Cisco-AVPair = "audit-session-id=C1AB9E16000003C10E2DC71C" Cisco-AVPair = "method=dot1x" NAS-IP-Address = 111.222.333.444 NAS-Port = 60000 NAS-Port-Id = "GigabitEthernet117/2/0/13" NAS-Port-Type = Ethernet State = 0x77057cce7606711b016ba7ac0a5a3d56 server v_dot1x { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail.log -> /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail.log expands to /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] expand: %t -> Mon Jul 20 09:52:55 2015 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "CP-7841-SEPDCEB94CF21FA", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "CP-7841-SEPDCEB94CF21FA" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap-v_dot1x] EAP packet type response id 3 length 6 [eap-v_dot1x] No EAP Start, assuming it's an on-going EAP conversation ++[eap-v_dot1x] returns updated rlm_dbm: try open database file: /usr/local/etc/raddb/users-dot1x_dbm rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add CP-7841-SEPDCEB94CF21FA to user list sm_parse_user: start parsing: user: CP-7841-SEPDCEB94CF21FA parse buffer: <<>> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Cisco-AVPair = "device-traffic-class=voice", Cisco-AVPair += "subscriber:service-name=PHONES">> rlm_dbm: recod parsed rlm_dbm: Reply found Remove CP-7841-SEPDCEB94CF21FA from user list ++[users-dot1x] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = eap-v_dot1x # Executing group from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authenticate {...} [eap-v_dot1x] Request found, released from the list [eap-v_dot1x] EAP/tls [eap-v_dot1x] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap-v_dot1x] returns handled } # server v_dot1x Sending Access-Challenge of id 198 to 111.222.333.444 port 1645 Cisco-AVPair = "device-traffic-class=voice" Cisco-AVPair += "subscriber:service-name=PHONES" EAP-Message = 0x010404000dc0000014666164697573312d656475726f616d2e75636c762e6e65748218726164697573322d656475726f616d2e75636c762e6e6574300d06092a864886f70d010105050003820101004289ca0d398d3b5945da6a7c12bf1920a2d63b412da2f57719e5174b9c72d8fb85ab3882caa212b2b3f4bfb324264d438100aecff461287ed584de2830549266e64ae6e0238b21e98a6e7fa3807c5571a280d2dea3f5a6275377438b39b89a962071dc78f5e5eb6c8bd42e489a9ee590c66a7d8d9f26271007433e9b2c986e1d438a6b5c933f4c4302c8a562654bb62f00d27970cb819d9e1396eabe9b5496cfbe7224254527d137987300d929bf EAP-Message = 0xd9b6693867ee7e6834347fb7b988c0520c90b8b9e9ed17100118f16880d09d3f95ddcf3a91e8ea44874edec2772001baaab3f8e8b4fb0b2ee338f3a0b7ed3b4d8665cf6e11ac7b05848c9444b973b060ab2600049c3082049830820380a00302010202104bc814032f07fa6aa4f0da29df6179ba300d06092a864886f70d0101050500308197310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d31 EAP-Message = 0x1f301d0603550403131655544e2d5553455246697273742d4861726477617265301e170d3039303531383030303030305a170d3230303533303130343833385a3036310b3009060355040613024e4c310f300d060355040a1306544552454e41311630140603550403130d544552454e412053534c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c3e348c42f5cc1cba999fd1ba2835d8a3dad3ad0e2a4431f4d0efe352530a5691bc4e8e5c18f547ee16aa29a5c5cde3dfc02ce96b85f8f835bcc604090f8e4b63a259c5f1451ecb1e7af9e50a13155c702bdac528a7f358e82fa84ad15fea27f83103a55 EAP-Message = 0x53942c01167494546328a3f25b293d94888020e214592119b4a498e160e6f2eba2808343e0ad68f379198b6843513f8a9b41850c358c5db5f1b6e5a7c383b56b236fd4a5eb50e594f14a5fee274b141215244c0dcf628db70021ad3a320f580b5f1e9bd1df9d8ea91935502f41a9ad3bc6e045b253397f21bf221a875c34ae526f077da20b4e9f2b79a67d13ddf57f837c2f5a5d77787891a014bf7d0203010001a382013e3082013a301f0603551d23041830168014a1725f261b289843955d0737d585969d4bd2c345301d0603551d0e041604140cbd93680cf3deaba3496b2b375747ea90e3b9ed300e0603551d0f0101ff04040302010630120603 EAP-Message = 0x551d130101ff040830060101 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x77057cce7501711b016ba7ac0a5a3d56 Finished request 464. Going to the next request

2 2

Re: Freeradius-Users Digest, Vol 122, Issue 104
by firing neurons 22 Jul '15

22 Jul '15

What is the best way to allow radiusd? Will I have to add cutom policy for each type of access that is blocked? Or is there a quick way that doesn't involve disabling SElinux? Message: 1 Date: Thu, 25 Jun 2015 13:34:14 +0000 From: Ben Gatewood <Ben.Gatewood(a)essensys.co.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: radiusd not starting at boot. Message-ID: <4B8DA7A1-2801-4D0C-8FC7-1749BFB031EF(a)essensys.co.uk> Content-Type: text/plain; charset="utf-8" "SELinux is preventing radiusd from read access on the file /etc/raddb/dictionary" On 25/06/2015 14:28, "firing neurons" <firingneurons(a)mail.com> wrote: > I am using 3.0.8. > > The result of service radiusd status: > > Redirecting to /bin/systemctl status -l radiusd.service > ● radiusd.service - FreeRADIUS high performance RADIUS server. > Loaded: loaded (/usr/lib/systemd/system/ > radiusd.service; enabled; > vendor preset: disabled) > Active: failed (Result: exit-code) since Fri 2015-06-26 00:08:14 > IST; 5h 24min left > Process: 819 ExecStartPre=/usr/sbin/radiusd -C (code=exited, > status=1/FAILURE) > Process: 794 ExecStartPre=/bin/chown -R radiusd.radiusd > /var/run/radiusd (code=exited, status=0/SUCCESS) > Jun 26 00:08:11 localhost.localdomain systemd[1]: Starting FreeRADIUS > high performance RADIUS server.... > Jun 26 00:08:14 localhost.localdomain systemd[1]: radiusd.service: > control process exited, code=exited status=1 > Jun 26 00:08:14 localhost.localdomain systemd[1]: Failed to start > FreeRADIUS high performance RADIUS server.. > Jun 26 00:08:14 localhost.localdomain systemd[1]: Unit radiusd.service > entered failed state. > Jun 26 00:08:14 localhost.localdomain systemd[1]: radiusd.service > failed. > > result of service radiusd start: > Redirecting to /bin/systemctl start radiusd.service > Job for radiusd.service failed. See "systemctl status radiusd.service" > and "journalctl -xe" for details. > [cleardot.gif] > result of journalctl -xe: > > >Jun 25 18:50:56 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from read access on the file /etc/raddb/dictionary. For >complete SELin >ux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 >Jun 25 18:50:56 localhost.localdomain python[2449]: SELinux is preventing >radius >d from read access on the file /etc/raddb/dictionary. > > ***** Plugin >restorecon (99 >.5 confidence) suggests ************************ > > If you want to fix >the label >. > /etc/raddb/dictionary >defaul >t label should be radiusd_etc_t. > Then you can run >restorecon. > Do > # /sbin/restorecon -v >/etc/r >addb/dictionary > > ***** Plugin >catchall (1.49 > confidence) suggests ************************** > > If you believe that >radiusd >should be allowed read access on the dictionary file by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:50:56 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from read access on the file /etc/raddb/clients.conf. For >complete SEL >inux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 >Jun 25 18:50:56 localhost.localdomain python[2449]: SELinux is preventing >radius >d from read access on the file /etc/raddb/clients.conf. > > ***** Plugin >restorecon (99 >.5 confidence) suggests ************************ > > If you want to fix >the label >. > >/etc/raddb/clients.conf defa >ult label should be radiusd_etc_t. > Then you can run >restorecon. > Do > # /sbin/restorecon -v >/etc/r >addb/clients.conf > > ***** Plugin >catchall (1.49 > confidence) suggests ************************** > > If you believe that >radiusd >should be allowed read access on the clients.conf file by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:50:56 localhost.localdomain polkitd[660]: Unregistered >Authentication >Agent for unix-process:2678:78843 (system bus name :1.64, object path >/org/freed >esktop/PolicyKit1/AuthenticationAgent, locale en_IN.UTF-8) (disconnected >from bu >s) >Jun 25 18:51:00 localhost.localdomain polkitd[660]: Registered >Authentication Ag >ent for unix-process:2863:79253 (system bus name :1.65 >[/usr/bin/pkttyagent --no >tify-fd 5 --fallback], object path >/org/freedesktop/PolicyKit1/AuthenticationAge >nt, locale en_IN.UTF-8) >Jun 25 18:51:00 localhost.localdomain systemd[1]: Starting FreeRADIUS >high perfo >rmance RADIUS server.... >-- Subject: Unit radiusd.service has begun start-up >-- Defined-By: systemd >-- Support: [1]http://lists.freedesktop.org/mailman/listinfo/systemd-devel >-- >-- Unit radiusd.service has begun starting up. >Jun 25 18:51:00 localhost.localdomain audit[2886]: <audit-1400> avc: >denied { >sys_ptrace } for pid=2886 comm="radiusd" capability=19 >scontext=system_u:syste >m_r:radiusd_t:s0 tcontext=system_u:system_r:radiusd_t:s0 >tclass=capability permi >ssive=0 >Jun 25 18:51:00 localhost.localdomain kernel: ptrace of pid 2885 was >attempted b >y: radiusd (pid 2886) >Jun 25 18:51:00 localhost.localdomain audit[2885]: <audit-1400> avc: >denied { >read } for pid=2885 comm="radiusd" name="dictionary" dev="dm-1" >ino=1711521 sco >ntext=system_u:system_r:radiusd_t:s0 >tcontext=unconfined_u:object_r:user_home_t: >s0 tclass=file permissive=0 >Jun 25 18:51:00 localhost.localdomain audit[2885]: <audit-1400> avc: >denied { >read } for pid=2885 comm="radiusd" name="clients.conf" dev="dm-1" >ino=1711520 s >context=system_u:system_r:radiusd_t:s0 >tcontext=unconfined_u:object_r:user_home_ >t:s0 tclass=file permissive=0 >Jun 25 18:51:00 localhost.localdomain systemd[1]: radiusd.service: >control proce >ss exited, code=exited status=1 >Jun 25 18:51:00 localhost.localdomain systemd[1]: Failed to start >FreeRADIUS hig >h performance RADIUS server.. >-- Subject: Unit radiusd.service has failed >-- Defined-By: systemd >-- Support: [2]http://lists.freedesktop.org/mailman/listinfo/systemd-devel >-- >-- Unit radiusd.service has failed. >-- >-- The result is failed. >Jun 25 18:51:00 localhost.localdomain systemd[1]: Unit radiusd.service >entered f >ailed state. >Jun 25 18:51:00 localhost.localdomain systemd[1]: radiusd.service failed. >Jun 25 18:51:00 localhost.localdomain audit[1]: <audit-1130> pid=1 uid=0 >auid=42 >94967295 ses=4294967295 subj=system_u:system_r:init_t:s0 >msg='unit=radiusd comm= >"systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? >res=failed >' >Jun 25 18:51:00 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from using the sys_ptrace capability. For complete SELinux >messages. r >un sealert -l cac781eb-1cae-4673-b684-6308a2c7ff2b >Jun 25 18:51:00 localhost.localdomain python[2449]: SELinux is preventing >radius >d from using the sys_ptrace capability. > > ***** Plugin >catchall (100. > confidence) suggests ************************** > > If you believe that >radiusd >should have the sys_ptrace capability by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:51:00 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from read access on the file /etc/raddb/dictionary. For >complete SELin >ux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 >Jun 25 18:51:00 localhost.localdomain python[2449]: SELinux is preventing >radius >d from read access on the file /etc/raddb/dictionary. > > ***** Plugin >restorecon (99 >.5 confidence) suggests ************************ > > If you want to fix >the label >. > /etc/raddb/dictionary >defaul >t label should be radiusd_etc_t. > Then you can run >restorecon. > Do > # /sbin/restorecon -v >/etc/r >addb/dictionary > > ***** Plugin >catchall (1.49 > confidence) suggests ************************** > > If you believe that >radiusd >should be allowed read access on the dictionary file by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:51:00 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from read access on the file /etc/raddb/clients.conf. For >complete SEL >inux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 >Jun 25 18:51:00 localhost.localdomain python[2449]: SELinux is preventing >radius >d from read access on the file /etc/raddb/clients.conf. > > ***** Plugin >restorecon (99 >.5 confidence) suggests ************************ > > If you want to fix >the label >. > >/etc/raddb/clients.conf defa >ult label should be radiusd_etc_t. > Then you can run >restorecon. > Do > # /sbin/restorecon -v >/etc/r >addb/clients.conf > > ***** Plugin >catchall (1.49 > confidence) suggests ************************** > > If you believe that >radiusd >should be allowed read access on the clients.conf file by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:51:01 localhost.localdomain polkitd[660]: Unregistered >Authentication >Agent for unix-process:2863:79253 (system bus name :1.65, object path >/org/freed >esktop/PolicyKit1/AuthenticationAgent, locale en_IN.UTF-8) (disconnected >from bu >s) >- >List info/subscribe/unsubscribe? See >[3]http://www.freeradius.org/list/users.html ------------------------------ References 1. http://lists.freedesktop.org/mailman/listinfo/systemd-devel 2. http://lists.freedesktop.org/mailman/listinfo/systemd-devel 3. http://www.freeradius.org/list/users.html

3 2

configure freeRADIUS with a CHAP "access-challenge" message
by Arul Sundaramoorthy 22 Jul '15

22 Jul '15

Hi, Can anyone please let me know How to configure freeRADIUS server so it replies with a CHAP "access-challenge" message on "access-request" from a client? I am new to the freeradius tool. so it will better if anyone provide the document for above request. Thanks, Arnold

3 2

Re: udp sockets and proxy servers
by Sergey Komarov 22 Jul '15

22 Jul '15

Hello Arran, Alan and colleagues! > Hmmm, well that's problematic. Could you open a GitHub issue. > > -Arran > Ok, done. I opened issue at Github: "FreeRadius 3.0.9 tries to open more and more sockets for proxy server until crash" #1155 I understand thats FR is free software but I hope may be someone helps we with a patch or advise should I try to build 3.1.x or other versions to get CoA proxy stable with lots of home servers. Thank you in advance for your help! Best Regards, Serge Komaroff > > > I'm tring to run 3.0.9 configuration with about ~1500 clients and home > > > servers (as I have about 1500 WLCs in the network and I try to proxy > CoA > > > packet to WLCs via radius). > > > > > > Radius server tries to open as many sockets as possible doing like > that: > > > > > > Info: ... adding new socket proxy address * port 46527 > > > Info: ... adding new socket proxy address * port 38003 > > > > > > It happens slowly or fast and it depends of load as I see it... And > then > > > after about 256 sockets server quits from running with error: > > > > Is that with TLS? Or TCP? We didn't predict that people would use 256 > > or more clients with CoA and TCP. > > > > But it *should* work for UDP. There's no reason for it to open many > > proxy sockets. It just needs one or two. > > > > Alan DeKok. > > > > Hello Alan! The case is that I'm using UDP only, no any TLS now, just > common pap/sql and Acc Req/Accept/CoA Proxy... SQL sockets is ok and no > overflow there (it even close some connections to DB when don't need it). > > But it looks like FR tries to create as many sockets as home servers and it > happen slowly - depends on load. When I limit to 200 home servers - it > stopped to create sockets at number about 153... In case it overcome 256 it > drops soon with that error... > > > Best Regards, Serge Komaroff >

1 0

set up the linelog mod to create a CSV log
by Nash.Paz 22 Jul '15

22 Jul '15

Hi, Running 3.0.4 on Centos 7.1, I've been trying to set up the linelog mod to create a CSV log. Based on what I read here: http://marc.info/?l=freeradius-users&m=133167783813402 http://lists.freeradius.org/pipermail/freeradius-users/2012-March/059283.ht… I added a header, and a stop/start accounting for Acct-Status-Type to the linelog file (attached). Restarted radiusd, but no linelog files are created. Radius is working, the detail file gets updated. The module seems to load when running radiusd -X : # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } What am I doing wrong? -- -נחשון פז-

2 2

IPv6 coa isn't working having IPv6 NAS IP
by Samir Patel 21 Jul '15

21 Jul '15

Hi Experts, I need your help and expertise with pushing ipv6 coa on the 802.1x sessions. UUT (Switch) and Freeradius are directly connected and can ping each other. Freeradius installed: [root@ott-freerad-7a raddb]# radiusd -X radiusd: FreeRADIUS Version 2.2.8, for host x86_64-unknown-linux-gnu, built on Jul 15 2015 at 13:42:04 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. Issue: [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa 2020::11:1700 coa cisco radclient: Failed to find IP address for host 2020::11:1700: Success COA push works for IPv4 NAS IP but shows above for IPv6 case. Really appreciate your help with the issue. I am not sure if IPv6 coa push is supported yet with 2.2.8 freeradius version. [root@ott-freerad-7a raddb]# more coa Calling-Station-Id="c414.3c52.900e" Acct-Session-Id="0x0000000b" Cisco-Command-Code=" TEMP_IAF100" [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# /usr/local/bin/radclient -x -t 20 -c 1 -p 20 -f /usr/local/etc/raddb/coa 2020::11:1700 coa cisco [root@ott-freerad-7a raddb]# ifconfig eth0 Link encap:Ethernet HWaddr 00:50:56:8E:78:33 inet addr:172.16.7.11 Bcast:172.16.255.255 Mask:255.255.0.0 inet6 addr: fe80::250:56ff:fe8e:7833/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:80804 errors:0 dropped:0 overruns:0 frame:0 TX packets:20649 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:14539074 (13.8 MiB) TX bytes:3061296 (2.9 MiB) eth1 Link encap:Ethernet HWaddr 00:50:56:8E:5F:BB inet addr:99.0.7.12 Bcast:99.0.7.255 Mask:255.255.255.0 inet6 addr: 2020::250:56ff:fe8e:5fbb/64 Scope:Global inet6 addr: fe80::250:56ff:fe8e:5fbb/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:47806 errors:0 dropped:0 overruns:0 frame:0 TX packets:138 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:3463175 (3.3 MiB) TX bytes:17024 (16.6 KiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:936 errors:0 dropped:0 overruns:0 frame:0 TX packets:936 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:66843 (65.2 KiB) TX bytes:66843 (65.2 KiB) [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# ping6 2020::11 PING 2020::11(2020::11) 56 data bytes 64 bytes from 2020::11: icmp_seq=0 ttl=64 time=11.4 ms 64 bytes from 2020::11: icmp_seq=1 ttl=64 time=1.52 ms --- 2020::11 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 999ms rtt min/avg/max/mdev = 1.521/6.463/11.405/4.942 ms, pipe 2 [root@ott-freerad-7a raddb]# [root@ott-freerad-7a raddb]# uname -a Linux ott-freerad-7a 2.6.18-194.8.1.el5 #1 SMP Wed Jun 23 10:52:51 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux [root@ott-freerad-7a raddb]# On UUT: Router#show run int gig2/0/15 Building configuration... Current configuration : 108 bytes ! interface GigabitEthernet2/0/15 no switchport no ip address ipv6 address 2020::11/64 ipv6 enable end Router# Router# Router# Router# Router# Router# Router# Router#show access-sess Interface MAC Address Method Domain Status Fg Session ID -------------------------------------------------------------------------------------------- GigabitEthernet2/0/14 c414.3c52.900e dot1x DATA Auth 000000000000001706794990 Session count = 1 Key to Session Events Blocked Status Flags: A - Applying Policy (multi-line status for details) D - Awaiting Deletion F - Final Removal in progress I - Awaiting IIF ID allocation P - Pushed Session R - Removing User Profile (multi-line status for details) U - Applying User Profile (multi-line status for details) X - Unknown Blocker Router# Router#show access-sess poli Router#show access-sess inter Router#show access-sess interface gig2/0/14 polic Router#show access-sess interface gig2/0/14 policy Interface : GigabitEthernet2/0/14 MAC Address : c414.3c52.900e IPv6 Addres : Unknown IPv4 Addres : Unknown User-Name : client1 Status : Authorized Domain : DATA Oper host mode : multi-host Oper control dir : both Session timeout : N/A Timeout action : Reauthenticate Idle timeout : N/A Common Session ID : 000000000000001706794990 Acct Session ID : 0x0000000b Handle : 0x3c00000d Current Policy : DUAL Blocked On : Method status list: Method State dot1x Authc Success Device Classification Status: ------------------------------------------------------------------------------- Profile Device-Name Device-Class ------------------------------------------------------------------------------- Un Classified Un-Classified Un-Classified

3 7

Auth-Type := ldap
by ST Wong (ITSC) 21 Jul '15

21 Jul '15

Hi all, We're using freeradius 3.0.4-6.el7 on RHEL 7, using LDAP authentication. The server is setup and running without problem. However, I got error when running radwho: -------------- cut here -------------------- ]# radwho Tue Jul 21 18:58:16 2015 : Error: /etc/raddb/sites-enabled/default[384]: Parse error in condition Tue Jul 21 18:58:16 2015 : Error: if ((ok || updated) && User-Password) { Tue Jul 21 18:58:16 2015 : Error: ^ Expected a module return code radwho: Error reading or parsing radiusd.conf -------------- cut here -------------------- I modified /etc/raddb/sites-enabled/default as following as mods-available/ldap mentioned: -------------- mods-available/ldap -------------------- # Note: set_auth_type was removed in v3.x.x # Equivalent functionality can be achieved by adding the following # stanza to the authorize {} section of your virtual server. # # ldap # if ((ok || updated) && User-Password) { # update { # control:Auth-Type := ldap # } # } -------------- cut here -------------------- -------------- /etc/raddb/sites-enabled/default -------------------- # # The ldap module reads passwords from the LDAP database. # -ldap ldap if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } -------------- cut here -------------------- Did I miss anything? Besides, I'm new to freeradius 3.x and can't find doc about the meaning of the minus sign before module (e.g. "-ldap"). Would anyone please help? Thanks a lot. Regards, /ST Wong

1 0

Re: udp sockets and proxy servers
by Sergey Komarov 21 Jul '15

21 Jul '15

Hello! > Hmmm, well that's problematic. Could you open a GitHub issue. > > -Arran > Hello Arran. Well, I'm not a developer actually I will try to post it to GitHub in case my credentials is ok for that... > Date: Mon, 20 Jul 2015 19:48:25 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: udp sockets and proxy servers > Message-ID: <56E2A5E4-DFAD-4B47-816E-28CDFF51DACF(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Jul 20, 2015, at 7:15 PM, Sergey Komarov <sergey.komaroff(a)gmail.com> > wrote: > > I'm tring to run 3.0.9 configuration with about ~1500 clients and home > > servers (as I have about 1500 WLCs in the network and I try to proxy CoA > > packet to WLCs via radius). > > > > Radius server tries to open as many sockets as possible doing like that: > > > > Info: ... adding new socket proxy address * port 46527 > > Info: ... adding new socket proxy address * port 38003 > > > > It happens slowly or fast and it depends of load as I see it... And then > > after about 256 sockets server quits from running with error: > > Is that with TLS? Or TCP? We didn't predict that people would use 256 > or more clients with CoA and TCP. > > But it *should* work for UDP. There's no reason for it to open many > proxy sockets. It just needs one or two. > > Alan DeKok. > Hello Alan! The case is that I'm using UDP only, no any TLS now, just common pap/sql and Acc Req/Accept/CoA Proxy... SQL sockets is ok and no overflow there (it even close some connections to DB when don't need it). But it looks like FR tries to create as many sockets as home servers and it happen slowly - depends on load. When I limit to 200 home servers - it stopped to create sockets at number about 153... In case it overcome 256 it drops soon with that error... Best Regards, Serge Komaroff

1 0

RLM_Rest and Dynamic Clients
by Nick Cappelletti 20 Jul '15

20 Jul '15

FreeRADIUS version: 3.0.9 I was curious if there was a way to include dynamic-clients via the rest api module in FreeRADIUS. I currently have it setup using LDAP, but we’re looking to use a dedicated server cluster to manage our NAS’s and I’m having a hard time wrapping my head around a way of configuring such an implementation. Any links or previous threads would be extremely helpful. Thanks!

3 8