October 2016 - Freeradius-Users - lists.freeradius.org

Access-Challenge on proxied radius request on eduroam
by Turner, Ryan H 04 Oct '16

04 Oct '16

I am prepared for a lashing, because I am sure I have missed something stupid.. We are running 2.2.8 (yes, I know we should be on 3.X. My systems architect quit and we are hiring another one and one of the first projects will be to get to 3.X. If you want to apply, message me). Eduroam is our primary SSID on campus and we run EAP-TLS. We authenticate 10s of thousands of people on our campus, and people at foreign campuses, every single day. However, there is one school nearby where neither our users can authenticate on their network (using eduroam which proxies back to our campus) nor can their users authenticate on ours. I am totally miffed. If I do a radius -XXX on an attempt (UNC person is at foreign institution connecting which proxies the auth packet to us), this is what I see on our local freeradius server: (Summary: we are sending an access challenge to the user who connects perfectly fine on our own network, but fails to connect on their network- what is going on???) rad_recv: Access-Request packet from host 152.2.X.X port 1814, id=0, length=276 User-Name = "username_removed(a)unc.edu" NAS-IP-Address = 10.229.9.1 NAS-Port = 0 NAS-Identifier = "10.229.9.1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "mac_address_removed" Called-Station-Id = "001A1E00ED18" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x020800060d00 Aruba-Essid-Name = "eduroam" Aruba-Location-Id = "aEtc3-W" Aruba-AP-Group = "ncssm-hi-avail-hi-density-ap-group" Aruba-Device-Type = "OS X" Message-Authenticator = 0x7afdd181fbc9ca389829bce95736da1f State = 0x16deaa5213d6a791b4d184b49f08d1c8 Vendor-9048-Attr-0 = 0x50726f786965642d42793d544c5253322e656475726f616d2e7573 Proxy-State = 0x313937 Mon Oct 3 16:12:29 2016 : Info: # Executing section authorize from file /opt/unc/freeradius-2.2.8/root/etc/raddb/sites-enabled/default Mon Oct 3 16:12:29 2016 : Info: +group authorize { Mon Oct 3 16:12:29 2016 : Info: ++[preprocess] = ok Mon Oct 3 16:12:29 2016 : Info: ++[chap] = noop Mon Oct 3 16:12:29 2016 : Info: ++[mschap] = noop Mon Oct 3 16:12:29 2016 : Info: ++[digest] = noop Mon Oct 3 16:12:29 2016 : Info: [suffix] Looking up realm "unc.edu" for User-Name = "username_removed(a)unc.edu" Mon Oct 3 16:12:29 2016 : Info: [suffix] Found realm "unc.edu" Mon Oct 3 16:12:29 2016 : Info: [suffix] Adding Realm = "unc.edu" Mon Oct 3 16:12:29 2016 : Info: [suffix] Authentication realm is LOCAL. Mon Oct 3 16:12:29 2016 : Info: ++[suffix] = ok Mon Oct 3 16:12:29 2016 : Info: [eap] EAP packet type response id 8 length 6 Mon Oct 3 16:12:29 2016 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Oct 3 16:12:29 2016 : Info: ++[eap] = updated Mon Oct 3 16:12:29 2016 : Info: [files] users: Matched entry DEFAULT at line 42 Mon Oct 3 16:12:29 2016 : Info: ++[files] = ok Mon Oct 3 16:12:29 2016 : Info: ++[expiration] = noop Mon Oct 3 16:12:29 2016 : Info: ++[logintime] = noop Mon Oct 3 16:12:29 2016 : Info: ++[pap] = noop Mon Oct 3 16:12:29 2016 : Info: +} # group authorize = updated Mon Oct 3 16:12:29 2016 : Info: Found Auth-Type = EAP Mon Oct 3 16:12:29 2016 : Info: # Executing group from file /opt/unc/freeradius-2.2.8/root/etc/raddb/sites-enabled/default Mon Oct 3 16:12:29 2016 : Info: +group authenticate { Mon Oct 3 16:12:29 2016 : Info: [eap] Request found, released from the list Mon Oct 3 16:12:29 2016 : Info: [eap] EAP/tls Mon Oct 3 16:12:29 2016 : Info: [eap] processing type tls Mon Oct 3 16:12:29 2016 : Info: [tls] Authenticate Mon Oct 3 16:12:29 2016 : Info: [tls] processing EAP-TLS Mon Oct 3 16:12:29 2016 : Info: [tls] Received TLS ACK Mon Oct 3 16:12:29 2016 : Info: [tls] ACK handshake fragment handler Mon Oct 3 16:12:29 2016 : Info: [tls] eaptls_verify returned 1 Mon Oct 3 16:12:29 2016 : Info: [tls] eaptls_process returned 13 Mon Oct 3 16:12:29 2016 : Info: ++[eap] = handled Mon Oct 3 16:12:29 2016 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 152.2.X.X port 1814 EAP-Message = 0x010904000dc0000016d755040313056d736361310078307631133011060a0992268993f22c640119160365647531133011060a0992268993f22c6401191603756e6331123010060a0992268993f22c64011916026164313630340603550403132d556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c2053756234003b3039313730350603550403132e556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c20526f6f74330078307631133011060a0992268993f22c640119160365647531133011060a0992268993f22c6401191603756e6331123010 EAP-Message = 0x060a0992268993f22c64011916026164313630340603550403132d556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c205375623300b73081b4310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e312d302b060355040b1324687474703a2f2f63657274732e676f64616464792e636f6d2f7265706f7369746f72792f313330310603550403132a476f2044616464792053656375726520436572746966696361746520417574686f7269747920 Mon Oct 3 16:12:29 2016 : Info: ++[files] = ok Mon Oct 3 16:12:29 2016 : Info: ++[expiration] = noop Mon Oct 3 16:12:29 2016 : Info: ++[logintime] = noop Mon Oct 3 16:12:29 2016 : Info: ++[pap] = noop Mon Oct 3 16:12:29 2016 : Info: +} # group authorize = updated Mon Oct 3 16:12:29 2016 : Info: Found Auth-Type = EAP Mon Oct 3 16:12:29 2016 : Info: # Executing group from file /opt/unc/freeradius-2.2.8/root/etc/raddb/sites-enabled/default Mon Oct 3 16:12:29 2016 : Info: +group authenticate { Mon Oct 3 16:12:29 2016 : Info: [eap] Request found, released from the list Mon Oct 3 16:12:29 2016 : Info: [eap] EAP/tls Mon Oct 3 16:12:29 2016 : Info: [eap] processing type tls Mon Oct 3 16:12:29 2016 : Info: [tls] Authenticate Mon Oct 3 16:12:29 2016 : Info: [tls] processing EAP-TLS Mon Oct 3 16:12:29 2016 : Info: [tls] Received TLS ACK Mon Oct 3 16:12:29 2016 : Info: [tls] ACK handshake fragment handler Mon Oct 3 16:12:29 2016 : Info: [tls] eaptls_verify returned 1 Mon Oct 3 16:12:29 2016 : Info: [tls] eaptls_process returned 13 Mon Oct 3 16:12:29 2016 : Info: ++[eap] = handled Mon Oct 3 16:12:29 2016 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 152.2.X.X port 1814 EAP-Message = 0x010904000dc0000016d755040313056d736361310078307631133011060a0992268993f22c640119160365647531133011060a0992268993f22c6401191603756e6331123010060a0992268993f22c64011916026164313630340603550403132d556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c2053756234003b3039313730350603550403132e556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c20526f6f74330078307631133011060a0992268993f22c640119160365647531133011060a0992268993f22c6401191603756e6331123010 EAP-Message = 0x060a0992268993f22c64011916026164313630340603550403132d556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c205375623300b73081b4310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e312d302b060355040b1324687474703a2f2f63657274732e676f64616464792e636f6d2f7265706f7369746f72792f313330310603550403132a476f2044616464792053656375726520436572746966696361746520417574686f7269747920 EAP-Message = 0x2d2047320086308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473200653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747900cd3081ca310b300906 EAP-Message = 0x03550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e31333031060355040b132a687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72793130302e06035504031327476f204461646479205365637572652043657274696669636174696f6e20417574686f726974793111300f06035504051308303739363932383701423082013e3136303406035504030c2d554e432d5365637572652047756573742041636365737320436572746966696361746520417574 EAP-Message = 0x686f72697479313830360603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x16deaa5210d7a791b4d184b49f08d1c8 Proxy-State = 0x313937 Mon Oct 3 16:12:29 2016 : Info: Finished request 888. Mon Oct 3 16:12:29 2016 : Debug: Going to the next request Mon Oct 3 16:12:29 2016 : Debug: Waking up in 0.3 seconds. Ryan Turner Manager of Network Operations ITS Communication Technologies The University of North Carolina at Chapel Hill r(a)unc.edu<mailto:r@unc.edu> +1 919 445 0113 Office +1 919 274 7926 Mobile

3 8

Simultaneous sessions and deleting stale sessions
by Anirudh Malhotra 04 Oct '16

04 Oct '16

Hi, I have a 2 tier question First would mention the simultaneous verify query for reference simul_verify_query = "\ SELECT \ radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, \ callingstationid, framedprotocol \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" One: I see many posts for deletion of stale sessions not working, One particular post which pretty close to solving the non working problem was: http://lists.freeradius.org/pipermail/freeradius-users/2015-November/080816… The posts conclusion was that fake accounting packet doesnt have the same acct-session-id as that of the stale session that is why it is not able to close it. As acct-unique-session-id(md5 of some attributes including acct-session-id NAS-Identifier etc) comes out to be different. But what i found from a little analysis was that actually the acct-session-id is not the problem but the "NAS-Identifier" is. The NAS-Identifier was being sent in a normal accounting packet(atlease in my case maybe not in somebody else's) but it was not being sent in the "fake accountng query" as it is not present in the radacct table it is not fetched from the table as can be seen in the query above. So the acct-unique-session-id calculated has two different values one in case the normal accounting packet comes and other if fake accounting packet comes, Thus failing over to insertion as updation would not pass. The acct-session-id was coming out to be the same as the stale session's so that was not the problem. Please shed some light on this. Two: I noticed some anomaly in simultaneous verify query in sql and when the attributes are selected to actually delete stale sessions, I am running 3.0.11. which selects radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol. That is 8 attributes from the radacct table. And somehow my stale sessions were all getting acctsessiontime as 0 so on reading the source code which goes like: while (rlm_sql_fetch_row(inst, request, &handle) == 0) { row = handle->row; if (!row) { break; } if (!row[2]){ RDEBUG("Cannot zap stale entry. No username present in entry"); rcode = RLM_MODULE_FAIL; goto finish; } if (!row[1]){ RDEBUG("Cannot zap stale entry. No session id in entry"); rcode = RLM_MODULE_FAIL; goto finish; } if (row[3]) { nas_addr = inet_addr(row[3]); } if (row[4]) { nas_port = atoi(row[4]); } check = rad_check_ts(nas_addr, nas_port, row[2], row[1]); if (check == 0) { /* * Stale record - zap it. */ if (inst->config->delete_stale_sessions == true) { uint32_t framed_addr = 0; char proto = 0; int sess_time = 0; if (row[5]) framed_addr = inet_addr(row[5]); if (row[7]){ if (strcmp(row[7], "PPP") == 0) proto = 'P'; else if (strcmp(row[7], "SLIP") == 0) proto = 'S'; } if (row[8]) sess_time = atoi(row[8]); session_zap(request, nas_addr, nas_port, row[2], row[1], framed_addr, proto, sess_time); } } The code above makes use of 9 attributes last one being(row[8]) acctsessiontime which was not getting fetched in the query. For that reason it always picks the value as 0 for acctsessiontime which is not ideal(a guess). BR, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 5

TLS failure reason as attribute
by Anirudh Malhotra 04 Oct '16

04 Oct '16

Hi, Is there a way to get the TLS failure reason(expired,revoked, invalid like one in the log below) in one of the attributes to be used in linelog? or do I have to check everything manually(unlang) using TLS attributes. Tue Oct 4 12:24:26 2016 : ERROR: (9) eap_tls: ERROR: SSL says error 10 : certificate has expired Tue Oct 4 12:24:26 2016 : ERROR: (9) eap_tls: ERROR: TLS Alert write:fatal:certificate expired Tue Oct 4 12:24:26 2016 : Error: tls: TLS_accept: Error in SSLv3 read client certificate B Tue Oct 4 12:24:26 2016 : Auth: (9) Login incorrect (eap_tls: SSL says error 10 : certificate has expired): [abi] BR, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 2

LDAP, SASL GSSAPI, and group membership, rebind fails
by Tom Carroll 04 Oct '16

04 Oct '16

Hello list, I'm experiencing difficulties with freeradius-3.0.11 when using Ldap-Group and SASL GSSAPI mechanism. rlm_ldap can successfully query for user accounts,binding anonyously and SASL GSSAPI. But when it queries for group membership, rebind operation fails, erroring: Strong(er) authentication required Server said: SASL:[GSSAPI]: Sign or Seal are required.. A subset of ldapsearch -X output: > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Searching for user in group "IPMI Admins" > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Reserved connection (0) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND TMPL XLAT > Thu Sep 29 11:49:54 2016 : Debug: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) > Thu Sep 29 11:49:54 2016 : Debug: Parsed xlat tree: > Thu Sep 29 11:49:54 2016 : Debug: literal --> (sAMAccountName= > Thu Sep 29 11:49:54 2016 : Debug: if { > Thu Sep 29 11:49:54 2016 : Debug: attribute --> Stripped-User-Name > Thu Sep 29 11:49:54 2016 : Debug: } > Thu Sep 29 11:49:54 2016 : Debug: else { > Thu Sep 29 11:49:54 2016 : Debug: attribute --> User-Name > Thu Sep 29 11:49:54 2016 : Debug: } > Thu Sep 29 11:49:54 2016 : Debug: literal --> ) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: --> (sAMAccountName=johndoe) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND TMPL LITERAL > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Performing search in "DC=example,DC=org" with filter "(sAMAccountName=johndoe)", scope "sub" > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Waiting for search result... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Rebinding to URL ldap://example.org/CN=Configuration,DC=example,DC=org > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Starting SASL mech(s): GSSAPI > SASL/GSSAPI authentication started > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL challenge : Authorization Name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL prompt : Please enter your authorization name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL result : RADIUS1$(a)EXAMPLE.ORG > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : `??? *?H??????? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : ???? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech (null)... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : > SASL username: RADIUS1$(a)EXAMPLE.ORG > SASL SSF: 56 > SASL data security layer installed. > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Bind successful > Thu Sep 29 11:49:54 2016 : Debug: (0) files: User object found at DN "CN=johndoe,CN=Users,DC=example,DC=org" > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Checking for user in group objects > Thu Sep 29 11:49:54 2016 : Debug: (&(cn=IPMI Admins)(objectClass=group)(member=%{control:Ldap-UserDn})) > Thu Sep 29 11:49:54 2016 : Debug: Parsed xlat tree: > Thu Sep 29 11:49:54 2016 : Debug: literal --> (&(cn=IPMI Admins)(objectClass=group)(member= > Thu Sep 29 11:49:54 2016 : Debug: attribute --> LDAP-UserDN > Thu Sep 29 11:49:54 2016 : Debug: literal --> )) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND (&(cn=IPMI Admins)(objectClass=group)(member=%{control:Ldap-UserDn})) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: --> (&(cn=IPMI Admins)(objectClass=group)(member=CN\3djohndoe\2cCN\3dUsers\2cDC\3dexample\2cDC\3dorg)) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND TMPL LITERAL > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Starting SASL mech(s): GSSAPI > SASL/GSSAPI authentication started > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL challenge : Authorization Name > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL prompt : Please enter your authorization name > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL result : RADIUS1$(a)EXAMPLE.ORG > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL response : `??? *?H??????? > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL response : ???? > Thu Sep 29 11:49:54 2016 : ERROR: (0) files: Bind with (anonymous) to ldap://ad1.example.org:389 failed: Strong(er) authentication required > Thu Sep 29 11:49:54 2016 : ERROR: (0) files: Server said: SASL:[GSSAPI]: Sign or Seal are required.. > Thu Sep 29 11:49:54 2016 : Info: rlm_ldap (ldap): Deleting connection (0) > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap: Closing libldap handle 0xb46810 > Thu Sep 29 11:49:54 2016 : Info: rlm_ldap (ldap): Need 6 more connections to reach 10 spares > Thu Sep 29 11:49:54 2016 : Info: rlm_ldap (ldap): Opening additional connection (5), 1 of 28 pending slots used > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://smbdc0.example.org:389 > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): New libldap handle 0xb46810 > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Starting SASL mech(s): GSSAPI > SASL/GSSAPI authentication started > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL challenge : Authorization Name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL prompt : Please enter your authorization name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL result : RADIUS1$(a)EXAMPLE.ORG > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : `??? *?H??????? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : ???? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech (null)... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : > SASL username: RADIUS1$(a)EXAMPLE.ORG > SASL SSF: 56 > SASL data security layer installed. > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Bind successful > Thu Sep 29 11:49:54 2016 : Debug: (0) files: User is not a member of "IPMI Admins"

3 6

Segfault at src/lib/misc.c:1193 in 3.0.4 (3.0.11 looks very similar)
by Mike Ely 04 Oct '16

04 Oct '16

Behavior is similar on two production hosts running Centos 7.2. Radius is setup as proxy only, passes authentication successfully for a time, then abruptly segfaults. Attached gdb to corefile and found this: Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `/usr/sbin/radiusd -d /etc/raddb'. Program terminated with signal 11, Segmentation fault. #0 fr_ipaddr_cmp (a=0x20, b=0x7f3965a30510) at src/lib/misc.c:1193 1193 if (a->af < b->af) return -1; It looks like it's somehow getting the memory address for "a" set to 0x20, which is obviously invalid, and then it segfaults. Where should I look in the configs for where realm acct_pool servers is being set up and what would I expect to see in a configuration that would allow the server to run successfully and then crash abruptly like this? Obviously let me know what other data to provide for debugging this. Thanks, Mike

5 26

insert ips to ippool
by Zubair Ayub 03 Oct '16

03 Oct '16

i want to ask that i have thousands of ips can you please tell me how to add these ips in ippool table .. it will take big effort and time to add one by one is there another way to add those ips like 175.1.2.0/24 .. regards zubair ayub thanks

3 5

Routing new RFC7542-style realms
by Stefan Paetow 03 Oct '16

03 Oct '16

Sooo, I'm looking at how to configure FreeRADIUS to be able to handle RFC7542-style usernames (i.e. "realhome.realm!username(a)intermediate.realm"). At the same time, that same FreeRADIUS server must be able to handle the standard RFC4282 NAI, and authenticate NAIs that are local to it. The inner identity obviously remains the standard NAI for the real home realm, unless someone else has a better idea: Scenario 1: Outer = username(a)intermediate.realm. Authenticate locally at 'intermediate.realm'. Scenario 2: Outer = realhome.realm!username(a)intermediate.realm. Route on to 'realhome.realm'. Authenticate locally at 'realhome.realm'. Scenario 1 works just fine... But Scenario 2? I can define a prefix/suffix that works on the bang (!), so I can handle one or the other... But not both? Alan D, since RFC7542 is your baby, how do we do this? I'd love to know this. :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

3 7

Radius 3.0.12 crashes on mysql DB conection failiure
by feroze waris 03 Oct '16

03 Oct '16

Hi all, I am using freeradius version 3.0.12 with rlm_perl module and using mysql with it. When there is connectivity issue with mysql DB or it is unavailable my radius gets crash and i am getting following error. Sat Oct 1 15:04:35 2016 : Debug: (1) perl: perl_embed:: module = /usr/local/etc/raddb/mods-config/perl/example.pl , func = authenticate exit status= All data sources failed! at /usr/local/share/perl5/DBD/Multi.pm line 367. I also tried to catch this error using TryCatch module but it failed. Regards Feroze

2 1

PAM order (ssh login)
by Janis Heller 02 Oct '16

02 Oct '16

I use pam_radius to protect my servers. Using the sshd file in /etc/pam.d with this config: # Standard Un*x authentication. @include common-auth auth sufficient pam_radius_auth.so client_id=server22 My common-auth(/etc/pam.d/common-auth) looks like this: auth sufficient pam_script.so auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass auth requisite pam_deny.so auth required pam_permit.so auth optional pam_cap.so Now when I try to login using for example root account the password is sent to radius too (but system seems to ignore the radius answer). I already tried to change the order, I would like to modify PAM in a way, all the default (local) PAM checks are runned before a check is made to radius. Where’s my fault? I think checking each login request first local will speed up the server performance. All the best;

2 1

Re: AES encrypted passwords
by Stefan Paetow 01 Oct '16

01 Oct '16

>(Maybe it's safer to use a different password for wireless access than >for the rest of your enterprise services to mitigate the problem? But if >you're going to do that, you could just go the EAP-TLS route anyway. And >it doesn't obviate the need for checking the AP certificate to prevent >traffic interception) Some organisations already do this. Some universities are clear about this, i.e. that your eduroam password should not be the same as your login password to your mail etc. Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. >

2 1