April 2016 - Freeradius-Users - lists.freeradius.org

rlm_perl does not honor start_servers?
by Igor Novgorodov 11 Apr '16

11 Apr '16

Hello! I've got latest 3.0.11 FreeRADIUS and Perl authorization module under rlm_perl. The server is relatively highly loaded (around 1000 access-requests per sec). And although i have "start_servers = 256" and "min_spare_servers = 256" in the thread pool configuration, FreeRADIUS does not initialize those threads until the requests start to hit the daemon. After some requests in parallel it spawns all required 256 threads and then this number stays constant. The problem is that the thread creation in rlm_perl seems to be quite expensive timewise (or i may be doing something wrong?). It is clearly seen by testing with radclient - after daemon restart it is capable of only 30 req/s. Then, when all the threads come alive - it goes up to 1k req/s and more. So unless i warm up the server with a few thousand test queries to create all threads - it gets overwhelmed for several minutes when the real load shows up, which causes a lot of warnings in the logs and massive retransmits from NASes (there are about 900 of them with lots of clients each), which is nasty. So the question is - this behavior is expected? I can, of course, warm up server after each restart but it seems irrational for me. Thanks!

9 22

Re: does freeradius support key-wrap
by Michael Martinez 10 Apr '16

10 Apr '16

Ok, I have more context for my question: Does Freeradius support something similar to Cisco's use of key-wrap as defined in https://tools.ietf.org/html/draft-zorn-radius-keywrap-18 ? In their implementation they define a way to securely transmit cryptographic keying material (such as from an EAP conversation) between NAS and Radius server using a a keywrap around the keying material to protect encryption key distribution. Supposedly this "protects" a man-in-the-middle from grabbing the EAP keys? I'm not sure how this increases security because you can't do anything with the public keys anyway. But I suppose it's a "stronger" way of encrypting that information as opposed to the standard hash that's currently done. The reason I'm asking, I'm doing some contract work for a university. The bosses want to know, presumably because they have some compliance requirements they need to satisfy. I see a few past discussion of this from the mailing list, but no clear answer on whether freeradius does this. -- --- Michael Martinez http://www.michael--martinez.com

2 2

rlm_python
by Arran Cudbard-Bell 09 Apr '16

09 Apr '16

Spent some time poking at it in v3.1.x. It seems to work OK with multiple threads now, and i've reworked the code to use separate interpreters for each module instance for cleanliness. I don't see any of the crashes previously observed when using multiple rlm_python instances. If heavy users of python in v3.0.x could try v3.1.x it would be appreciated. As v3.0.x was marked as THREAD_UNSAFE, you should see substantial performance improvements in v3.1.x. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 8

Re: Forward Accounting Packets to Fortiage - need help
by Eby Mani 08 Apr '16

08 Apr '16

Thanks, i should have provided more details earlier. freeRadius is configured with mysql and users are authenticated using EAP - PEAP without certificates. Once users are authenticated thru radius, ip address is released thru another dhcp server. Issue 1, When Users are getting authenticated, freeradius isn't sending Class attribute of the usergroup/user in Access-Accept message. Only User-Name is sent to NAS. NAS is configured to forward RADIUS accounting packets to Fortigate, where fortigate gets only authenticated username and ip address from NAS. As freeRadius is not sending Class attributes in Access-Accept. NAS isn't sending any Class info to Fortigate. Without usergroup info in Class attribute, can't provide RSSO based access to various networks. While troubleshooting NAS it was found freeradius is sending Class attribute information in Access-Challenge message !!. . Further troubleshooting on radius server revealed the following; 1, radtest from the server return class attributes of user/usergroup. 2, when running server in debug mode and authenticating from NAS, it doesn't. Is this the default behaviour ?. How do i tell freeradius to send Class attribute of usergroup in Access-Accept ?. Issue 2, freeradius is not sending accounting copies to Fortigate. Having Added "realm {}" in proxy.conf, added "detailfile = ${radacctdir}/detail" in detail file and included "update control {}" in preacct section of copy-acct-to-home-server file and linked the same to sites-enabled folder. I'm not sure if i have missed anything. One might ask why send accounting again, Fortigate can have only one RSSO Agent, thus sending accounting packets from multiple NAS is not possible. Also I'm planning to use some old gear that doesn't support sending accounting to another server. Sending accounting copies from freeradius will eliminate various admin overheads. Attached config files. Eby -------------------------------------------- On Thu, 7/4/16, Alan DeKok <aland(a)deployingradius.com> wrote: Subject: Re: Forward Accounting Packets to Fortiage - need help To: "Eby Mani" <eby_km(a)yahoo.com>, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thursday, 7 April, 2016, 4:42 PM On Apr 7, 2016, at 11:37 AM, Eby Mani via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Thanks Alan, the NAS and Fortigate does RADIUS. > > The easiest way for me is to configure NAS to forward RADIUS accounting packets to Fortigate. But my freeRadius is not sending Class attributes in Access-Accept to NAS client, thus NAS client isn't sending any Class info to Fortigate. > > However freeRadius is sending Class attributes in Access-Challenge to NAS !!!. > > Is there a command to include Class attributes in Access-Accept ?. Configure the server to send it. As always, run the server in debug mode, and READ IT. Also, describe what you're doing. In detail. Your questions are nearly content free. We're not mind readers. We don't know what you've configured. You don't say if you're using EAP or another authentication method. Any answer to help you depends on knowing what you're actually doing. Since we don't know what you're doing, we can't really help you. Alan DeKok.

2 1

Session-Timeout
by Aurélio de Souza Ribeiro Neto 08 Apr '16

08 Apr '16

Helo Again! ;) Now I'm trying to enable session-timeout. I set in MySQL database in radgroupreply table Atrribute Session-Timeout := 86400 and tried to put the same in radreply table, but is not working. Someone can help me? Radacct LOG: Fri Apr 8 15:03:38 2016 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 15728675 NAS-Port-Type = Ethernet User-Name = "testepppoe" Calling-Station-Id = "F8:1A:67:58:42:E7" Called-Station-Id = "CE - TESTE PPPoE" NAS-Port-Id = "ether2" Acct-Session-Id = "81e00023" Framed-IP-Address = 187.120.201.79 Acct-Authentic = RADIUS Event-Timestamp = "Apr 7 2016 11:59:42 BRT" Acct-Status-Type = Start NAS-Identifier = "CE - TESTE PPPoE" Acct-Delay-Time = 0 NAS-IP-Address = 172.20.200.2 Acct-Unique-Session-Id = "8b6a5050f5d5ea7e" Timestamp = 1460138618 Thanks Aurelio

2 1

Freeradius dhcp + allow unknown-clients
by Алексей Елиферов 08 Apr '16

08 Apr '16

Hi! We have freeradius v.2.2.9 with dhcp module And it's understand how to give IP-address with MAC or opt82. But if it's a new client, that does not established in mysqldb, how to give IP? In isc-dhcp it is doing by allow unknown-clients and dynamic pool. Does freeradius have anything like it? -- Sincerely yours, Yeliferov A. CTO LLC INTRAFFIC intraffic.ua / 044.200.44.00

4 3

COA to multiple NAS
by Mike 08 Apr '16

08 Apr '16

Hi I've got a scenario where we have multiple NAS devices authenticating their clients via a freeradius server. I want to originate COA requests to the NAS devices from the radius server and I have succeeded for one device by making an entry for a specific NAS in the home-server section of originate-coa. We add and remove NAS devices quite often and don't want to have to reconfigure originate-coa and restart freeradius every time. How we can enable dynamic addition of NAS to send COA requests OR can we send COA to servers without preconfiguring? Currently using & testing Freeradius 2.2.6 but in the process of migrating to 3, latest.

5 10

Proxy Freeradius 3.0.11 remove Message-Authenticator
by LABAT, Xavier 08 Apr '16

08 Apr '16

Hello, We would like to upgrade our proxy RADIUS solution from Freeradius 2.2.6 to Freeradius 3.0.11. We collect and switch PPP authentication/accounting requests to our different customers. One of them reject all authentication request if they are sent with < Message-Authenticator > attribute. We would like to upgrade without asking any changes to our clients. We configure the home_server with option "require_message_authenticator = no" in proxy.conf but < Message-Authenticator > attribute is still present in the proxy request. Alan DeKok said previously : "> I believe Message-Authenticator is now always sent in 3.0, unconditionally. Yes. It's best to always send it. It enables security and debugging checks that are otherwise not possible." Even if it's recommanded, is it possible to remove < Message-Authenticator > attribute in the proxy request ? Regards. Xavier -- Les donnees et renseignements contenus dans ce message sont personnels, confidentiels et secrets. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee. Si vous n'etes pas le bon destinataire, nous vous demandons de ne pas lire, copier, utiliser ou divulguer cette communication. Nous vous prions de notifier cette erreur a l'expediteur et d'effacer immediatement cette communication de votre systeme. Any data and information contained in this electronic mail is personal, confidential and secret. Any total or partial publication, use or distribution must be authorized. If you are not the right addressee, we ask you not to read, copy, use or disclose this communication. Please notify this error to the sender and erase at once this communication from your system.

3 3

Multiple instances of custom module
by Richard Levenberg 08 Apr '16

08 Apr '16

I have a custom module that is working perfectly with FreeRADIUS. I am now interested in creating multiple instances of the module for different NAS's that might be connecting via RADIUS. So from what I gather I can use unlang's switch statement in both the authorize and authenticate sections of the config file like so: authorize { . . switch &request:NAS-IP-Address { case "192.168.1.100" { customer1 } case “192.168.1.110” { customer2 } case { reject } } . . } authenticate { . . Auth-Type CUSTOM { switch &request:NAS-IP-Address { case "192.168.1.100" { customer1 } case “192.168.1.110” { customer2 } } } . . } So my questions are 1) is that the correct way to address multiple instances and 2) is the default case of reject in the authorize section the appropriate way to limit things to the defined instances? r

2 1

Re: Forward Accounting Packets to Fortiage - need help
by Eby Mani 07 Apr '16

07 Apr '16

Thanks Alan, the NAS and Fortigate does RADIUS. The easiest way for me is to configure NAS to forward RADIUS accounting packets to Fortigate. But my freeRadius is not sending Class attributes in Access-Accept to NAS client, thus NAS client isn't sending any Class info to Fortigate. However freeRadius is sending Class attributes in Access-Challenge to NAS !!!. Is there a command to include Class attributes in Access-Accept ?. Eby -------------------------------------------- On Wed, 6/4/16, Alan DeKok <aland(a)deployingradius.com> wrote: Subject: Re: Forward Accounting Packets to Fortiage - need help To: "Eby Mani" <eby_km(a)yahoo.com>, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wednesday, 6 April, 2016, 4:39 PM On Apr 6, 2016, at 9:22 AM, Eby Mani via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > FreeRADIUS Version 2.1.12, Ubuntu 14.04 LTS You should really upgrade. 2.1.12 is many years out of date. > I'm trying to send copy of accounting packets to Fortigate. Is there any official documentation / example for this ?. There is a lot of documentation on proxying. There is no documentation for "how do I configure vendor X product Y firmware Z". If the product does RADIUS, then normal RADIUS configuration will work. If the product doesn't do RADIUS, throw it in the garbage and buy one that does RADIUS. > I'm trying to get "Group" info of authenticated users for providing access to other networks thru RSSO. Doesl the Fortigate documentation say it returns a group in a RADIUS attribute? If not, then it's impossible. > I configured as per the following blog, > https://freeradiustips.wordpress.com/2015/02/17/forward-accounting-packets-… That's better than most, but I'm still amazed at the work people put into *not* reading the documentation that comes with FreeRADIUS. > Fortigate interface is listening for Radius Accounting packets, yet i'm not getting any accounting packets from freeRadius. Not sure i've missed anything vital. Run the server in debugging mode as suggested in the FAQ, "man" pages, web pages, and daily on this list. This is documented. Alan DeKok.

2 1