January 2016 - Freeradius-Users - lists.freeradius.org

How is radius.seq file used?
by dev 11 Jan '16

11 Jan '16

Hi all, I'm trying to debug a custom openLDAP module I forked based on the pw-radius contrib module (Ubuntu 14.04 recently migrated from 12.04). I'm using libfreeradius-client2 (v1.1.6-7). What seems to be happening is the ldap daemon creates the radius.seq file without read/write permissions by the freeradius daemon. I suspect this is causing slapd to segfault: slapd[13868]: segfault at 0 ip 00007fc6f521dcd2 sp 00007fc6eeff6e38 error 4 in libfreeradius-client.so.2.0.0[7fc6f5216000+c000] From what I've read, this file is only needed for Radius Accounting. I'm using RADIUS for authenticating One Time Passwords generated on a software token so would like to try disabling radius.seq to see fi the problem goes away. How can I disable radius.seq? Thanks!

2 1

ldap_mac config in 3.x
by Anthony Cheng 11 Jan '16

11 Jan '16

Hi all, Currently looking to migrate a FreeRADIUS from 2.1.12 to 3.0.10. Does 3.x still support ldap_mac config. in the ldap configuration? I see no reference to it or mention that it was removed.

2 1

3.0.10: decrypting RSA private key failure
by Stefan Winter 11 Jan '16

11 Jan '16

Hi, now this is strange. I'm in the middle of a certificate rollover. I have protected the old (1024 bit RSA) and new (4096 bit RSA) key with the same passphrase. Using "openssl rsa" on the FreeRADIUS box, I can decrypt both keys. When starting FreeRADIUS with the old cert+key, it starts up. When trying with the new cert+key: # Instantiating module "eap-staff" from file /usr/local/freeradius/config/raddb/mods-enabled/eap-staff # Linked to sub-module rlm_eap_tls tls { tls = "tls-staff" } tls-config tls-staff { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/freeradius/config/raddb/certs/STAFF-CA/" pem_file_type = yes private_key_file = "/usr/local/freeradius/config/raddb/staff/cert-srv.key" certificate_file = "/usr/local/freeradius/config/raddb/staff/cert-srv.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/freeradius/config/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1300 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 name = "eduroam-staff" max_entries = 128 persist_dir = "/var/log/radius/tlscache-eduroam-staff" } verify { } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } } tls: Failed reading private key file /usr/local/freeradius/config/raddb/staff/cert-srv.key:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch rlm_eap_tls: Failed initializing SSL context rlm_eap (eap-staff): Failed to initialise rlm_eap_tls /usr/local/freeradius/config/raddb/mods-enabled/eap-staff[1]: Instantiation failed for module "eap-staff" Huh? The passphrase is identical, I'm pointing it to the correct filename, openssl can decode it - but FreeRADIUS can't? Looking at the encrypted private keys, I do see a small difference: OLD: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,EC24580B720DE947 [...] -----END RSA PRIVATE KEY----- NEW: -----BEGIN ENCRYPTED PRIVATE KEY----- [...] -----END ENCRYPTED PRIVATE KEY----- Both decode into: -----BEGIN RSA PRIVATE KEY----- [...] -----END RSA PRIVATE KEY----- openssl can handle both. Any clue why FreeRADIUS doesn't? This is a 3.0.10 installation. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 4

My Hotspot is passing some sites without authentication
by mohammed farouk 11 Jan '16

11 Jan '16

Weird issue since users once connected to the Coovachilli and not login login yet to correct freeradius credential they still can brows google and watch youtube. Freeradius can't feel there is packet flow to count or to block from the "freeradius -X" google keeps hopping between lots of IP's which skips the blocked ones and passes another one which not blocked, hotspot creates the following iptables: iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -i eth1 -j DROP -A INPUT -d 10.42.0.1/32 -i tun0 -p icmp -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p udp -m udp --dport 67:68 -j ACCEPT -A INPUT -d 255.255.255.255/32 -i tun0 -p udp -m udp --dport 67:68 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 10000 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 8080 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 4990 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 3990 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -j DROP -A FORWARD -i tun0 -o eth0 -j ACCEPT -A FORWARD -i tun0 ! -o eth0 -j DROP -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -o tun0 -j ACCEPT -A FORWARD -i tun0 -j ACCEPT -A FORWARD -o eth1 -j DROP -A FORWARD -i eth1 -j DROP *Best regards,* *Mohammed Farouk* *+20(0)1144767555* *goo.gl/WWUQrB <http://goo.gl/WWUQrB>*

2 1

Server certificate renewal
by douglas eseng 11 Jan '16

11 Jan '16

Not strictly freeradius issue, perhaps those on the list have insight on the issue. Using freeradius for PEAP authentication, server cert is signed by private CA. We don't use profile to install the CA cert onto iOS devices. After renewal of server cert, existing iOS devices ask user to again trust the cert. Is this normal behaviour? Since it was a renewal, would have thought it is recognized as the same cert and remain trusted. Anyone know once user trusted the cert, what digest/fingerprint of the cert does IOS remember? Unable to find info on this from Apple's site. Thanks.

5 5

Question on anonymous identity
by Mathieu Simon (Lists) 11 Jan '16

11 Jan '16

Hi, A question surfaced recently while I was reworking a configuration: By building 3.0 from source I saw that the upcoming 3.0.11 will be actively logging that anonymous identities should be used* to protect identities. I'm not with eduroam, but try to keep an eye on what participating institutions and others recommend. I see they generally tell users to set one (where possible). The profile data from cat.eduroam.org also contains one. We always recommended students to set an anonymous identity and profiles/config tools given to them would set it for them, but it wasn't actively enforced. If the device wasn't configured for sending an anonymous identity it would still let the device in, if inner-tunnel authentication and authorization requirements passed.** So, what is the current take: Would you / Do you (recommend) enforcing the use of an anonymous identity, resulting in Access-Reject? Do most enduser wireless devices finally support setting an anonymous identity these days? Thanks in advance Mathieu * https://github.com/FreeRADIUS/freeradius-server/commit/ec5cb167dd1de6d3c8e7…

3 4

Re: Logging (was: Freeradius-Users Digest, Vol 129, Issue 3)
by Stefan Paetow 08 Jan '16

08 Jan '16

>Yes, 'detail' is included in the accounting section. Ok, that's not going to log then. It will only log when it gets accounting packets. Look at the 'default' server. In the post-auth section you'll see a reply_log entry that is commented out by default. If you uncomment this, it will start logging entries as per the 'reply_log' line log that is defined in the 'detail.log' module in mods-available. However, note that this will *not* be a single-line entry (which is what's recommended by the eduroam operator in the UK). Look at https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/raddb/modules/l inelog for the current linelog for v2.x. If you're on 3.x, go to https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai lable/linelog - This will come in handy when doing what the Confluence page you found says. >Log file enclosed in ZIP format. Don't do that. Archives are stripped. A simple freeradius -X output capture is useful. >I found this website which may help to enable logging, looks like logging >functionality is different between 2.1.10 and 2.1.12. >http://confluence.diamond.ac.uk/pages/viewpage.action?pageId=22252353 Ahhh... My history comes back to haunt me... ;-) You may want to set up two of the three line logs defined on that page: eduroam_log and inner_auth_log. To log to the *log* directory, do *not* set 'filename' to 'syslog'. Instead set it to whatever you wanted the filename to be... "${logdir}/linelog" is the default in linelog. Tweak that appropriately for the inner_auth_log (if you want to log authentication of your own users separately). Then, like the page says, call 'eduroam_log' in the post-auth section, or, better yet, in the post-proxy section of your eduroam server, since post-proxy gets hit by an incoming reply from a home organisation before post-auth does (and post-auth also gets hit by your own users after their authentication reply returns from the inner-tunnel server). Also, like the page says, call 'inner_auth_log' from the post-auth section of your inner-tunnel. Stop your server. Start it in debug mode. Then hit it with an authentication request (for your own user). You should with any luck get an entry in your inner-tunnel authentication log. Then, if you have a test subject from another institution, get them to authenticate through eduroam and see what happens. Like Alan and others have pointed out, the module files are liberally commented so that it is easier to understand the operation of the server (and what the options do). Of course, if you strip out all comments for a bare-bones configuration, then yes, it becomes distinctly more difficult (or you spend a lot of time on Github to understand what each file does). :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Networkshop44, University of Manchester. Save the date: 22-24 March, 2016. #NWS44 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200. >

1 0

RE: Freeradius-Users Digest, Vol 129, Issue 3
by Peter Hutchison 08 Jan '16

08 Jan '16

>> We have set up Freeradius on Ubuntu 14.04 LTS but having trouble to >> get it to generating authorization logs for our 'eduroam' >> virtual server. >What does this virtual server do / when is it called? Allows users to authenticate on wireless network using Eduroam with their Active Directory login user (+ domain) and password. Users do authenticate ok no problem, but it is not logging requests for some reason to the /var/log/freeradius/radius-eduroam-yyyy-mm-dd.log >Do you call the linelog or detail modules in any of its sections? Yes, 'detail' is included in the accounting section. >> It is generating logs ok for the default and inner-tunnel but not >> eduroam. I have checked and re-checked the configuration with no >> result. You need to look at the debug output. On ubuntu run it as "freeradius -X" and examine the output then authenticate something you expect to get logs for. > /etc/freeradius/radius.conf log section looks like this: Mostly not useful - you really want linelog or detail, not the main server logging. It’s the requests logging I am interested in which doesn't seem to work. >> And in our eduroam file in sites-available (with link file in >> sites-enabled) has 'auth_log' enabled to in the authorize section. > Any ideas why the log isn't being generated when users connect to it? >Check -X debug output. I cannot see anything obvious, no mention of log being created or updated. >Send the debug here if it doesn't make sense, though it's fairly straightforward to read (if verbose). Right from the FreeRADIUS banner at the >top and including an authentication packet. >A small suspicion is that you might need to put logging in pre/post-proxy sections if you're trying to log non-local auths. I have updated those sections but made no difference with following lines: Pre_proxy_log Post_proxy_log ---- Update: Log file enclosed in ZIP format. I found this website which may help to enable logging, looks like logging functionality is different between 2.1.10 and 2.1.12. http://confluence.diamond.ac.uk/pages/viewpage.action?pageId=22252353 Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Infrastructure Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

case-statement regex
by O'Connell, Ryan 07 Jan '16

07 Jan '16

Using version 3.0.10. Can’t seem to implement regex matching with case statements. The request always results in “def” even though the string in the request contains “abc". switch DHCP-Subscriber-Id { case "/(abc)$/" { update control { &Pool-Name := “abc" } } case { update control { &Pool-Name := “def" } } } I have tried a bunch of different variations of the “case” without success. If I use the entire string in the case statement then I get the intended result “abc”. switch DHCP-Subscriber-Id { case 001122334455@abc { update control { &Pool-Name := “abc" } } case { update control { &Pool-Name := “def" } } } Does anyone have a suggestion on how to implement this? I haven’t been able to find examples in the documentation or google about doing this specifically. The same logic implemented with if/else works fine but I was hoping to use switch/case for performance. if (&DHCP-Subscriber-Id =~ /(abc)$/){ update control { &Pool-Name := “abc" } } else { update control { &Pool-Name := “def" } } Thanks, Ryan

2 4

RE: Safe characters, old and new versions of 3.1.0
by Franks Andy (IT Technical Architecture Manager) 07 Jan '16

07 Jan '16

Thanks Alan, that's really useful info, especially the fix - makes good sense. I was doubtful about the older server and what was written to SQL whether it was actually right or not, so this seems better anyway. I've never seen a date expressed with backslashes, dashes yes, forward slashes yes, but backslash is umm, different. Again, thanks very much. Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 07 January 2016 14:36 To: FreeRadius users mailing list Subject: Re: Safe characters, old and new versions of 3.1.0 On Jan 7, 2016, at 8:13 AM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > We're seeing differences in the way unusual characters are handled in the older version when compared with the newer, in terms of the way variable values with certain characters are expanded. The older versions uses "safe_characters" to determine which characters were "safe". The newer version uses the escape functions provided by the SQL driver. Which is better. Different, but better. > The main problem is it mucks up the SQL character writing - the frontend comes up with an odd asci character that in theory shouldn't be written according to the "safe characters" list afaics. > I can't change what's in the ldap description field we use as the source of this attribute unfortunately - a third party system writes into it which we have no change access to. OK... > Anyway, below are examples on old and new of the ldap attribute source, an example variable expansion of that attribute and lastly what goes into SQL. The examples aren't quite indentical as one is a live system that's so busy it's hard to get exactly the same string from it. Generally the string is "Amended by Directory Manager dd\mm\yyyy" in AD, but that comes over to ldap as dd\\mm?y for some reason, The "backslash digit" is typically used as an escape sequence for special characters. > presumably because of weird characters in the string that look ok in AD console. What gets inserted after that into SQL is, on the old server, > > "Amended by Directory Manager dd(asciicode)mm(asciicode)yy" > Which appears fine within mysql. And is still wrong, to be honest. > On the new server > > "Amended by Directory Manager dd\\mm?y" plus some other non-visible stuff I guess, which isn't fine. In SQL is looks like a square box, not sure of the actual ascii code. It's the escaping. > This character doesn't seem to be part of the "safe characters". Also on the old server and new one, the ordinary backslash makes its way through to sql but I can't see it on the SC list. > Any ideas?! Is there any way of replicating old behaviour or fixing the new? Re-write the date string in FreeRADIUS so that it uses forward slashes instead of backslashes. The easiest way to do this might be to use a regular expression. to parse the string into chunks, and the re-assemble the chunks: if (&control:Ldap-UserDescription =~ /(..).(..).(....)$/) { update control { Ldap-UserDescription := "Amended by Directory Manager %{1}/%{2}/%{3}" } } The simple lesson is "don't use backslashes". The third-party system you're using is broken. Happily, you should be able to fix it with FreeRADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0