April 2016 - Freeradius-Users - lists.freeradius.org

Restrict authentication types per user
by yolanda3000＠freenet.de 20 Apr '16

20 Apr '16

Hi, I want to test a supplicant. I'm looking for a way to restrict the allowed authentication types per user. Only one special authentication type per user. I know that it is a stupid thing to do, but I need it for testing. E.g. user1 is only allowed to use EAP-TLS user2 is only allowed to use EAP-TTLS/EAP-MSCHAPv2 user3 is only allowed to use EAP-TTLS/MSCHAPv2 .. Is there an easy way to do this? I'm using a standard installation of version 3.0.11. Thanks, Yolanda Fischer --- Mail & Cloud Made in Germany mit 3 GB Speicher! https://email.freenet.de/mail/Uebersicht?epid=e9900000450

3 3

strongSwan + FreeRadius DHCP pool
by Laurens Vets 20 Apr '16

20 Apr '16

Hello list, I'm trying to setup a strongSwan VPN solution with Freeradius. The plan is to have Freeradius authenticate users from a MariaDB database and give out ip addresses as well from the DB. The authentication part works fine. Users are authenticated and can make a connection, but DHCP is not working. What I've done is the following: - Add mods-config/sql/ippool-dhcp/mysql/schema.sql to the DB. - Enable the dhcp and dhcp_sqlippool mods. - Add dhcp_sqlippool to sites-available/default. - Configured sites-enabled/dhcp. I'm running Freeradius 3.0.11 on Debian 8. Is there anything I should be doing? Did I miss something obvious? Thanks in advance!

5 13

OpenSSL 1.1.0 support
by Arran Cudbard-Bell 19 Apr '16

19 Apr '16

There's now support for OpenSSL 1.1.0-pre4 support in v3.1.x. This was actually a fair amount of work. OpenSSL has switched to private structs, meaning we have to allocate things like HMAC_CTX on the heap now instead of using the stack. It also means we no longer have direct access to fields within SSL session contexts and have to use OpenSSL accessor functions in many places. Alan D completed the first part of the work a few months ago, and I finished off the changes yesterday. Our basic EAP test suite passes, but it would be useful if those who rely heavily on TLS could test this out in their lab environment. For large deployments of EAP-TLS/EAP-TTLS/EAP-PEAP there may be a noticeable performance improvement, as OpenSSL has (finally) removed their global object/type-specific mutexes. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

4 12

oracle-authentication
by Ejaz 19 Apr '16

19 Apr '16

All How to tell 'FreeRadius" in (radius.conf) to read my authentication table from remote oracle database. I am little confused. which one is the right one among the below.. Pleas point out for me.. thanks in advance.. * <https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/radiusd.c onf.in> radiusd.conf * <https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/clients.c onf> clients.conf * <http://wiki.freeradius.org/pages/modules/> modules configuration * <http://wiki.freeradius.org/config/Sites-configuration> sites configuration * <https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/proxy.con f> proxy.conf * <https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/raddb/policy.co nf> policy.conf (now <https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/policy.d> policy in >= 3.0.0) Thanks, Mohammed Ejaz Asst. Operation Director of Systems. Cyberia SAUDI ARABIA P.O.Box: 301079, Riyadh 11372 Phone: (+966) 11 464 7114 Ext. 140 Mobile: (+966) 562311787 Fax: (+966) 11 465 4735 Website: http://www.cyberia.net.sa

2 1

"device-traffic-class=voice" from FreeRADIUS?
by craig 18 Apr '16

18 Apr '16

Hi, I'm looking to setup "freeradius-3.0.4-6.el7.x86_64" on Centos 7 with 802.1x auth over LAN. The challenge is that I'd like to use Cisco phones and laptops behind those phones. The doco I've been reading (designed for Cisco ACS) suggest that the radius server needs to respond with a "RADIUS Access-Accept" message containing "device-traffic-class=voice". ref: http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec… Any way I can do this with FreeRADIUS? Regards, Craig

2 2

RE: fix ip address to an user
by Angel Elena 17 Apr '16

17 Apr '16

ok, thanks ------------------------------ Ángel Elena craem(a)craem.net ------------------------------ -------- Mensaje original -------- De: Alan DeKok <aland(a)deployingradius.com> Fecha: 17/04/2016 15:34 (GMT+01:00) Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Asunto: Re: fix ip address to an user On Apr 17, 2016, at 4:13 AM, Angel Elena <craem(a)craem.net> wrote: > For solve this problem, now, I delete 1.1.1.1 from radippool and assign to framed-ip-address. > > Is the unique via to set this configuration ? any attribute or config or idea to set fixed ip address ? Your changes are correct. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

fix ip address to an user
by Angel Elena 17 Apr '16

17 Apr '16

Hi, good moorning. I have a freeradius server 2.1.12 in a debian environment. This server is configured with sqlradippool and works fine... all ip's are defined in radippool table. For a new setup, with some users, i need "reserve" an ip address... i need, ex: user.detail assign 1.1.1.1. Actually, if user.detail is logged off and another user login, this ip is assigned to a new user. For solve this problem, now, I delete 1.1.1.1 from radippool and assign to framed-ip-address. Is the unique via to set this configuration ? any attribute or config or idea to set fixed ip address ? Thanks -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ --------------------------------

2 1

Memory leak parsing/relaying from detail files?
by Nathan Ward 16 Apr '16

16 Apr '16

Hi, I am working through debugging a memory leak I am hitting, and I think I have found the culprit. The trigger appears to be a malformed NAS-IPv6-Address attribute coming from a Cisco ASR9000, and I will certainly contact the vendor, however it occurs to me that we should work to solve this in FreeRADIUS as well. We use reliable proxied accounting with the detail file reader, however we write everything to a file and read from that file rather than writing only if the backend server pool has no reachable members. We are running 3.0.11, based on the 3.0.4 Redhat RPMs which we have forward ported. The ASR9000 sends a NAS-IPv6-Address attribute as follows: 0000 5f 16 1a 10 97 8c 00 00 00 00 00 00 00 00 00 00 _............... 0010 00 00 00 00 00 00 …… This has a length field of 0x16, while the standard defines this as always 0x12 - an IPv6 address is 16 bytes, plus two bytes for the type/len. I’m not sure what the ASR9000 thinks is going on.. but I guess that’s not in scope for this memory leak per se. FreeRADIUS interprets this as being not a valid NAS-IPv6-Address, so internally treats it as Attr-95 rather than NAS-IPv6-Address, which is the behaviour I’d expect. This gets written to a detail file, and some time later the detail file reader calls through to dict_unknown_afrom_fields, which allocates some memory that seems to never get freed. Running in valgrind, once for 5 mins, once for 25 mins, we note that the following call stack shows up as much larger after 25 mins. Here it is after about 5 mins: ==31363== 1,379,332 bytes in 5,653 blocks are definitely lost in loss record 1,935 of 1,937 ==31363== at 0x4C29BFD: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==31363== by 0x5B0CA20: __talloc_with_prefix (talloc.c:615) ==31363== by 0x5B0CA20: __talloc (talloc.c:655) ==31363== by 0x5B0CA20: _talloc_named_const (talloc.c:812) ==31363== by 0x5B0CA20: _talloc_zero (talloc.c:2206) ==31363== by 0x50786DE: dict_unknown_afrom_fields (dict.c:2826) ==31363== by 0x508573F: data2vp (radius.c:3794) ==31363== by 0x507F1B1: fr_pair_from_unkown (pair.c:1267) ==31363== by 0x507F1B1: fr_pair_make_unknown (pair.c:1365) ==31363== by 0x507F1B1: fr_pair_make (pair.c:1439) ==31363== by 0x507F807: fr_pair_list_afrom_str (pair.c:1865) ==31363== by 0x146B18: detail_poll (detail.c:735) ==31363== by 0x147028: detail_handler_thread (detail.c:1085) ==31363== by 0x67BBDF4: start_thread (pthread_create.c:308) ==31363== by 0x6F431AC: clone (clone.S:113) Again after about 25 mins: ==10362== 7,163,840 bytes in 29,360 blocks are definitely lost in loss record 1,943 of 1,944 ==10362== at 0x4C29BFD: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==10362== by 0x5B0CA20: __talloc_with_prefix (talloc.c:615) ==10362== by 0x5B0CA20: __talloc (talloc.c:655) ==10362== by 0x5B0CA20: _talloc_named_const (talloc.c:812) ==10362== by 0x5B0CA20: _talloc_zero (talloc.c:2206) ==10362== by 0x50786DE: dict_unknown_afrom_fields (dict.c:2826) ==10362== by 0x508573F: data2vp (radius.c:3794) ==10362== by 0x507F1B1: fr_pair_from_unkown (pair.c:1267) ==10362== by 0x507F1B1: fr_pair_make_unknown (pair.c:1365) ==10362== by 0x507F1B1: fr_pair_make (pair.c:1439) ==10362== by 0x507F807: fr_pair_list_afrom_str (pair.c:1865) ==10362== by 0x146B18: detail_poll (detail.c:735) ==10362== by 0x147028: detail_handler_thread (detail.c:1085) ==10362== by 0x67BBDF4: start_thread (pthread_create.c:308) ==10362== by 0x6F431AC: clone (clone.S:113) I have set up GDB to print out a backtrace whenever dict_unknown_afrom_fields is called with fr_pair_from_unkown 2 frames up the stack. We get this: #0 dict_unknown_afrom_fields (ctx=ctx@entry=0x0, attr=95, vendor=0) at src/lib/dict.c:2822 #1 0x00007fee4f416740 in data2vp (ctx=ctx@entry=0x0, packet=packet@entry=0x0, original=original@entry=0x0, secret=secret@entry=0x0, da=<optimized out>, start=<optimized out>, attrlen=20, packetlen=20, pvp=pvp@entry=0x7fee42bec848) at src/lib/radius.c:3794 #2 0x00007fee4f4101b2 in fr_pair_from_unkown (da=<optimized out>, vp=0x7fee340e3690) at src/lib/pair.c:1267 #3 fr_pair_make_unknown (op=<optimized out>, value=0x7fee42bec9d0 "Attr-95", attribute=0x7fee42bec9d0 "Attr-95", ctx=0x7fee5079c3f0) at src/lib/pair.c:1365 #4 fr_pair_make (ctx=ctx@entry=0x7fee5079c3f0, vps=vps@entry=0x0, attribute=attribute@entry=0x7fee42bec9d0 "Attr-95", value=value@entry=0x7fee42becad0 "0x1a108834", '0' <repeats 32 times>, op=<optimized out>) at src/lib/pair.c:1439 #5 0x00007fee4f410808 in fr_pair_list_afrom_str (ctx=ctx@entry=0x7fee5079c3f0, buffer=buffer@entry=0x7fee42bed570 "\tAttr-95 = 0x1a108834", '0' <repeats 32 times>, "\n", list=list@entry=0x7fee42becf48) at src/lib/pair.c:1865 #6 0x00007fee4facdb19 in detail_poll (listener=listener@entry=0x7fee5079c2a0) at src/main/detail.c:735 #7 0x00007fee4face029 in detail_handler_thread (arg=0x7fee5079c2a0) at src/main/detail.c:1085 #8 0x00007fee4dcd7df5 in start_thread (arg=0x7fee42bee700) at pthread_create.c:308 #9 0x00007fee4d5881ad in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113 Note Attr-95 - this is in every one of these backtraces that I looked at. I have attempted to filter out both Attr-95 and NAS-IPv6-Address at the start of my accounting section before it is written to the detail file - we don’t use this attribute so don’t care. I do this with the following: if (Attr-95) { update request { Attr-95 !* ANY } } But if (Attr-95) always returns false. I tried the same logic with NAS-IPv6-Address and get the same result, same trying this in preacct. Preacct has had no configuration changed from the standard “default” site config. Here is a trimmed output - let me know if you want the full thing, and I will get some test circuits set up which don’t have customer data: (469) Tue Mar 8 15:33:39 2016: Debug: Received Accounting-Request Id 141 from 103.241.56.176:51487 to 10.55.86.12:1813 length 1100 .. trimmed .. (469) Tue Mar 8 15:33:39 2016: Debug: Attr-95 = 0x1a10983400000000000000000000000000000000 .. trimmed .. (469) Tue Mar 8 15:33:39 2016: Debug: # Executing section preacct from file /etc/raddb/sites-enabled/trustpower-frontend .. trimmed .. (469) Tue Mar 8 15:33:40 2016: Debug: # Executing section accounting from file /etc/raddb/sites-enabled/trustpower-frontend (469) Tue Mar 8 15:33:40 2016: Debug: accounting { (469) Tue Mar 8 15:33:40 2016: Debug: if (Attr-95) { (469) Tue Mar 8 15:33:40 2016: Debug: if (Attr-95) -> FALSE I have two questions: 1) Can I filter this out in some way that I am unaware of as a short term fix? 2) I would like to figure out this memory leak myself and submit a patch, but I’m not sure how this part of the code works. I *think* that this should be freed after being proxied to the backend server - so, perhaps in process.c somewhere after a packet is sent, it should have any vp das that have is_unknown set to true freed? I’m not clear to me what impact that would have on other bits of code. -- Nathan Ward

3 6

rlm_sql logging results
by Laura Steynes 16 Apr '16

16 Apr '16

Hello, I am new-ish to freeradius, sort of stumped with resolving this - When a user goes to log on the logs start with Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): Closing connection (131): Hit idle_timeout, was idle for 3600 seconds Mon Apr 11 02:41:33 2016 : Warning: rlm_sql (sql): You probably need to lower "min" Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): Closing connection (132): Hit idle_timeout, was idle for 3600 seconds Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): Opening additional connection (133), 1 of 32 pending slots used Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): 0 of 1 connections in use. Need more spares Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): Opening additional connection (134), 1 of 31 pending slots used Mon Apr 11 02:41:33 2016 : Auth: (62) Login OK: [xxxxxx] (from client xxxxxxx port 0) now I have lowered min, I lowered it to several values including yet this still logs. I have tried more spares, more start/max servers, less servers, nothing I do seems to make this thing happy and my boss does not like seeing logs fill up with error type messages because he sees it as my failures, and rightly so I guess. My settings I think are related, and if I forgot some, please kindly ask and ye shall receive. radiusd.conf extract - start_servers = 5 max_servers = 32 min_spare_servers = 10 max_spare_servers = 15 max_requests_per_server = 0 auto_limit_acct = no from sql mod start = ${thread[pool].start_servers} # Minimum number of connections to keep open min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 90 We do not have a very busy radius, its for VPN and its rare everyone logs in at once, we have currently two access servers, but soon will have one on other states, so could be five in total by mid year. Are my radiusd,c.onf settings overkill and this is why the logs fill up with these errors? Would anyone have more suitable settings advice? Thank you. Lozza

2 4

mod_auth_radius not asking for username/password
by Süleyman Kuran 16 Apr '16

16 Apr '16

Hi there, I am on Centos 7 httpd 2.4 mod_auth_radius 1.5.8 My virtual host file is as follows: apache is not asking for username/password after 1 failed radius auth attempt. After 1 failed auth, Unauthorized page appears and if I refresh the page (F5) previous failed credentials are sent to the radius server without popping up a window asking for username/password. If login is OK the page is authorized. But if not, the user will have to wait for the popup window until the session is timed out. if apache is configured for basic auth with htpasswd file. It asks for the password after failed login as expected. Nothing is logged in apache error log. Is anybody having an idea about whats going on? <VirtualHost _default_:443> AddRadiusAuth freeradius_ip:1812 my_secret 5:3 AddRadiusCookieValid 60 <Location /> AuthType Basic AuthName "Please login" AuthBasicProvider radius AuthRadiusCookieValid 60 AuthRadiusActive On AuthRadiusAuthoritative on #AuthUserFile "/var/www/passwd" Require valid-user Order allow,deny Allow from all </Location> </VirtualHost>

3 12