July 2016 - Freeradius-Users - lists.freeradius.org

detail polling stops after failover
by denis 04 Jul '16

04 Jul '16

Hello, I was using freeradius 2.1 for a while, and at some point I had to make robust proxy accounting solution. While testing I ran into problem with multiplying Proxy-State, described here: http://permalink.gmane.org/gmane.comp.freeradius.devel/6276 Hence I decided to move to 3.0.4 (installed from networkradius.com repo) I discarded all old configs I had and making setup from scratch, at first stage trying to make minimum changes in examples. Now I'm trying to make work/understand following scenario: - start freeradius with only one upstream servers alive (home1 is alive, home2 initially dead) - auth with client (pptp + radiusclient) - stop alive upstream server (home1 dies, so no server will respond to Interim-Update) acct data starts to get logged into detail.examle.com/ folder - then I bring up home1, it's clear from logs that radius server marks it "alive" but detail polling never goes on, i.e detail files remain on disk if I restart freeradius it polls detail files immediately and send to upstream I spent a while trying to debug/understand what's going on, but at this point I'm stuck, thus asking for help. configs and log are too long to include in mail, so created gists: debug log: https://gist.github.com/dzinevich/56b3259246b62a36d2ed62836b181fac configs: https://gist.github.com/dzinevich/cd7d8510093293f4b9fab49f60535918 -- Denis

2 2

Possible certificatre problem
by Henrik Kressner 04 Jul '16

04 Jul '16

I followed the howto up til this: http://deployingradius.com/documents/configuration/ca_import.html Trying to connnect from a win 7, as described, via a hostapd based AP/NAS, I get this on the radiuserver. (61) eap_peap: <<< recv TLS 1.0 Alert [length 0002], fatal unknown_ca (61) eap_peap: ERROR: TLS Alert read:fatal:unknown CA (61) eap_peap: ERROR: TLS_accept: Failed in unknown state (61) eap_peap: ERROR: SSL says: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca (61) eap_peap: ERROR: SSL_read failed inside of TLS (-1), TLS session failed (61) eap_peap: ERROR: TLS receive handshake failed during operation (61) eap_peap: ERROR: [eaptls process] = fail (61) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (61) eap: Sending EAP Failure (code 4) ID 55 length 4 I can read what it says, but I dont understand why it say so, if the howto is to be trustet. -- ------------------------------------------- Med venlig hilsen / Yours Sincerly Henrik Kressner

8 18

Differentiate between BYOD and corporate devices - looking for some input
by Mathieu Simon (Lists) 02 Jul '16

02 Jul '16

Hi I've been thinking about how FreeRADIUS would need to be configured to differentiate between authentication requests from BYOD devices and corporate (typically Windows Domain members) and i.e. put them in different VLANs. I've tried to find things that might be used as differentiators when i.e using PEAP-MSCHAPv2: Windows Domain member using PEAP-MSCHAPv2 send requests differently not having any domain part. Hosts authenticating use host/<hostname>$ formats for their username they send... IMO not really a reliable way to differentiate them in my opinion, an end user device could imitate that as well. The thing I currently see, is Calling-Station-Id being sent to FreeRADIUS where one could detect if a device is corporate-owned and thus i.e. an SQL database could be queried to check if the device figures in the known corporate devices DB. But then again we all know how easily MAC-addresses can be faked. Is there something else I'm likely missing here? Do some of you use different EAP methods like i.e. EAP-TLS for corporate devices while a password-based method is used for personal devices. Ideally if a certificate was given out for each corporate device and user as well as per BYOD device, well then it would be easy to identify things... But that's requiring a whole CA and issuing infrastructure while trying to keep onboarding personal devices as simple as possible for users. I don't have a urgent need for it right now but I have tried to get an idea on that topic yet haven't found a satisfying path (and without working every day with FreeRADIUS that is). Maybe someone is willing to share his or her experiences? -- Mathieu

2 2

RE: Possible certificatre problem
by Danner, Mearl 02 Jul '16

02 Jul '16

> On Jul 2, 2016, at 10:47 AM, Henrik Kressner <kressner(a)synkro.dk> wrote: >> Thanks for you comment, but now you are making assumption. > I'm going by what you said. And what you said contradicts itself. > >This is going nowhere. >Allan, as I know it, you are the only >devoloper in the freeradius >project, and I dont trust you. >That means I dont trust freeradius, so I >just leave the list and find >another product, if it should be >Microsoft based, so be it. If you don't put the CA on the Windows client, no product will authenticate it. The configuration of the supplicant is the problem. It has nothing to do with the server, no matter who makes it. >You are welcome to contact me if you >"come down to earth" some day, but >til then, have a nice Sent from my Android phone using Symantec TouchDown (www.symantec.com)

1 0

Connect problem
by Henrik Kressner 01 Jul '16

01 Jul '16

Installed freeradius v 3.0.11 as shown here: http://wiki.freeradius.org/building/Build No problem. Can execute #radtest bob hello localhost 0 testing123, on both the freeradus server and the NAS (With the right IP) Following this: http://deployingradius.com/documents/configuration/eap.html I get this response: .... (133) eap: Peer sent packet with method EAP MSCHAPv2 (26) (133) eap: Calling submodule eap_mschapv2 to process data (133) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (133) eap_mschapv2: Auth-Type MS-CHAP { (133) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (133) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (133) mschap: Creating challenge hash with username: bob (133) mschap: Client is using MS-CHAPv2 (133) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (133) mschap: ERROR: MS-CHAP2-Response is incorrect (133) [mschap] = reject (133) } # Auth-Type MS-CHAP = reject (133) eap: Sending EAP Failure (code 4) ID 24 length 4 (133) eap: Freeing handler .... What does it mean? -- ------------------------------------------- Med venlig hilsen / Yours Sincerly Henrik Kressner

4 14