September 2016 - Freeradius-Users - lists.freeradius.org

PEAP/TTLS
by Peter Lesko 27 Sep '16

27 Sep '16

I'm having a similar issue to the one described here: http://freeradius.1045715.n5.nabble.com/PEAP-TTLS-and-Client-certificates-t… Currently, I can auth with just a signed cert, or just username/password I would like to enforce both, but I have been unable to determine the correct keywords/config after reading many forum posts, in addition to the comments provided in the default configuration I have attempted to add this config line to enforce signed certs in sites-available/default: EAP-TLS-Require-Client-Cert = yes This causes freeradius not to start for me though, and I'm pretty certain I have tried putting that in each block present in the file As for requiring user/password auth, I have tried: DEFAULT EAP-Type == EAP-Type-TLS, Auth-Type := Reject Which causes freeradius to fail to load DEFAULT EAP-Type == EAP-TLS, Auth-Type := Reject Which still allows EAP-TLS only DEFAULT EAP-Type != PEAP, Auth-Type := Reject Which still allows EAP-TLS only as well Please advise Thanks in advance, -Pete

4 5

accounting packet loss
by liran kessel 27 Sep '16

27 Sep '16

Hi In the past I have asked regarding this message that appears in the radius log Tue Sep 27 17:01:06 2016 : Error: Received conflicting packet from client XXXXXX port 33542 - ID: 47 due to unfinished request 885176866. Giving up on old request. and you explained that this is a problem probably because of my Mysql that is not managing to write quickly enough to the DB, and I understand that. However after changes we have made to other processes that run on the MySQL we have reached the point that we are only loosing messages for 2 or 3 seconds every 15 minutes when our scheduled processing runs. What I want to do is try and configure the radius to have a large enough cache to be able to handle this short spikes without losing messages, as I don’t have shortage in RAM. I have played around with the following parameters in the radiusd.conf file but they don’t see to be helping . max_requests max_request_time cleanup_delay we are not sending a reply ack to the GGSN for any message so cleanup delay as I understand it isn’t critical. is there a solution for me to “force” freeradius to be able to handle the MySQL problem without dropping messages? Thanks in Advance. Liran Kessel

5 7

Release of 3.0.12
by Alan DeKok 27 Sep '16

27 Sep '16

A belated request for last-minute tests of 3.0.12. I've pushed some changes to complain about OpenSSL. They work for me, but another check would be useful. If all is OK, I'll release 3.0.12 on Monday. For real this time. Alan DeKok.

5 10

Android and iOS and session-timeout with EAP
by Clayton Knorr 26 Sep '16

26 Sep '16

Does anybody know if Android and iOS just automatically try to reauthenticate after an hour or so (using PEAP or similar) regardless of what the session-timeout value is set to? I have been adjusting the value and I can see that the value is being sent in the reply. It seems like Windows is staying connected without reauthenticating early but Android and iOS do.

4 5

squid proxy login after freeradius login ( like SSO)
by Kouata Modibo 26 Sep '16

26 Sep '16

Hi, I'm using FreeRADIUS Version 2.2.5. I use ttls/chap for authentification. Users must use login/password to authentificate. After freeradius validation, they have to authentificate against proxy squid. freeradius and squid proxy are using the same database for authentification. now I would like to do SSO. In other word, when I user authentificate against freeradius, freeradius must request the squid proxy for user authentification for web browsing. can you help me ? thank you sande7kouata(a)gmail.com

2 1

Can't get rid of OpenSSL-message
by Philipp Trenz 26 Sep '16

26 Sep '16

Hi there, I newly compiled 3.0.12 for the upcoming release, but I can't get rid of the issue messages of openssl. openssl is already patched, allow_vulnerable_openssl = 'CVE-2016-6304' and allow_vulnerable_openssl = 'CVE-2014-0160' are added at the end of security {}. Running freeradius on a CentOS 7. Is this a bug or am I missing something? Thanks for help! radiusd -X last output: Debugger not attached Refusing to start with libssl version OpenSSL 1.0.1e-fips 11 Feb 2013 0x1000105f (1.0.1e release) (in range 1.0.1 dev - 1.0.1f release) Security advisory CVE-2014-0160 (Heartbleed) For more information see http://heartbleed.com Once you have verified libssl has been correctly patched, set security.allow_vulnerable_openssl = 'CVE-2014-0160' Refusing to start with libssl version OpenSSL 1.0.1e-fips 11 Feb 2013 0x1000105f (1.0.1e release) (in range 1.0.1 release - 1.0.1t rele) Security advisory CVE-2016-6304 (OCSP status request extension) For more information see https://www.openssl.org/news/secadv/20160922.txt Once you have verified libssl has been correctly patched, set security.allow_vulnerable_openssl = 'CVE-2016-6304'

3 2

Exercising Challenge/Response code path in pam client?
by Richard Perrin 24 Sep '16

24 Sep '16

Hi, I'm seeking a simple as possible config for freeradius server (version 2.1.12+dfsg-1.2ubuntu8.1 in Ubuntu 14.04) that would allow me to exercise the Challenge/Response path in the pam client (packaged as libpam-radius-auth-1.3.17). I see PW_ACCESS_CHALLENGE in several modules, but I haven't made the leap on how to configure the server to have pam-radius-auth (currently successfully authenticating against the server) receive an Access-Challenge instead of Accept/Reject. My end goal is verification of the client side code, rather than a production server deployment. Could you please provide me with guidance? Thanks Alan, and others, for both these pieces of software. - Richard Perrin

2 7

Translate authentication requests
by Laurens Vets 23 Sep '16

23 Sep '16

Hello list, I've got FreeRADIUS working with both OpenVPN (Android app + Windows) and StrongSwan (Android app). Authentication method used is eap-gtc with SSHA2 passwords. This all works. I'm now trying to integrate macOS and iOS clients as well, but I'm having a bit of a problem here. When either client sets up a connection to StrongSwan, FreeRADIUS receives an MSCHAPv2 request, which obviously doesn't work with SSHA2 passwords. Is there a way to either translate or proxy this MSCHAPv2 request into for instance an EAP-GTC request or is there a way to force the client to not use MSCHAPv2?

3 4

Linelog Event-Timestamp format
by rocky marciano 23 Sep '16

23 Sep '16

Hi, Im using linelog module and trying to generate a CSV file with the attribute "Event-Timestamp" with a custom format. The problem is that the module convert the value to a specific human readable format: Accounting-Request { Start = "%{Acct-Status-Type},%{Event- Timestamp},%{NAS-IP-Address},%{Framed-IP-Address},%{Called- Station-Id},%{Calling-Station-Id},%{Acct-Session-Id}" with that configuration I get: Start, Sep 10 2016 16:07:48,1.1.1.1,2.2.2.2,test.test,23354566767, 36u0qqarui9vlszx Is there a way to tell the module a required format for the date? Thanks.

3 8

Re: (freeradius 3) I'm trying to integrate freeradius with active directory in cenos 7.
by Marcelo Martinez 23 Sep '16

23 Sep '16

Hello, Thanks alan and other users for the help. I think all is working, but I don't know how to test freeradius with active directory users on localhost (radius server) Sorry for the dumb question. Any help please? Thanks.- On Mon, Sep 19, 2016 at 5:12 PM, Marcelo Martinez < marcelo.martinez(a)nexa.com.uy> wrote: > I fixed the issue with radtest. > > # radtest bob hello 127.0.0.1 0 testing123 > Sending Access-Request Id 154 from 0.0.0.0:47029 to 127.0.0.1:1812 > User-Name = 'bob' > User-Password = 'hello' > NAS-IP-Address = 192.168.72.22 > NAS-Port = 0 > Message-Authenticator = 0x00 > Received Access-Accept Id 154 from 127.0.0.1:1812 to 127.0.0.1:47029 > length 20 > > Thanks.- > > On Mon, Sep 19, 2016 at 4:58 PM, Marcelo Martinez < > marcelo.martinez(a)nexa.com.uy> wrote: > >> winbind is running >> >> # systemctl status winbind >> ● winbind.service - Samba Winbind Daemon >> Loaded: loaded (/usr/lib/systemd/system/winbind.service; disabled; >> vendor preset: disabled) >> Active: active (running) since lun 2016-09-19 16:39:35 UYT; 4min 43s >> ago >> Main PID: 4752 (winbindd) >> Status: "winbindd: ready to serve connections..." >> CGroup: /system.slice/winbind.service >> ├─4752 /usr/sbin/winbindd >> └─4753 /usr/sbin/winbindd >> >> sep 19 16:39:35 prueba systemd[1]: Starting Samba Winbind Daemon... >> sep 19 16:39:35 prueba winbindd[4752]: [2016/09/19 16:39:35.538056, 0] >> ../source3/winbindd/winbindd_cache.c:3235(initialize_winbindd_cache) >> sep 19 16:39:35 prueba winbindd[4752]: initialize_winbindd_cache: >> clearing cache and re-creating with version number 2 >> sep 19 16:39:35 prueba winbindd[4752]: [2016/09/19 16:39:35.542982, 0] >> ../lib/util/become_daemon.c:124(daemon_ready) >> sep 19 16:39:35 prueba winbindd[4752]: STATUS=daemon 'winbindd' >> finished starting up and ready to serve connections >> sep 19 16:39:35 prueba systemd[1]: Started Samba Winbind Daemon. >> >> My progress is fine... >> >> wbinfo -a Administrador%Passw0rd >> plaintext password authentication failed >> Could not authenticate user Administrador%Passw0rd with plaintext password >> challenge/response password authentication succeeded >> [root@miem-radius-test raddb]# ntlm_auth --request-nt-key --domain=TEST >> --username=Administrador --password=Passw0rd >> NT_STATUS_OK: Success (0x0) >> >> but radtest is not working... >> >> radtest -t mschap bob hello localhost 0 testing123 >> -bash: radtest: command not found >> >> yum provides radtest >> Complementos cargados:ps >> miemrepo-base >> | 3.6 kB 00:00:00 >> miemrepo-epel >> | 4.3 kB 00:00:00 >> miemrepo-base/filelists_db >> | 6.2 MB 00:00:00 >> miemrepo-epel/filelists_db >> | 7.1 MB 00:00:00 >> freeradius-utils-3.0.4-6.el7.x86_64 : FreeRADIUS utilities >> Repositorio : testrepo-base >> Resultado obtenido desde: >> Nombre del archivo : /usr/bin/radtest >> >> >> >> On Mon, Sep 19, 2016 at 4:34 PM, Matthew Newton [via FreeRADIUS] < >> ml-node+s1045715n5742624h28(a)n5.nabble.com> wrote: >> >>> On Mon, Sep 19, 2016 at 03:33:02PM -0300, Marcelo Martinez wrote: >>> > Any help please? >>> >>> As per my last e-mail... >>> >>> Is winbind running? >>> >>> Matthew >>> >>> >>> -- >>> Matthew Newton, Ph.D. <[hidden email] >>> <http:///user/SendEmail.jtp?type=node&node=5742624&i=0>> >>> >>> Systems Specialist, Infrastructure Services, >>> I.T. Services, University of Leicester, Leicester LE1 7RH, United >>> Kingdom >>> >>> For IT help contact helpdesk extn. 2253, <[hidden email] >>> <http:///user/SendEmail.jtp?type=node&node=5742624&i=1>> >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>> /users.html >>> >>> ------------------------------ >>> If you reply to this email, your message will be added to the discussion >>> below: >>> http://freeradius.1045715.n5.nabble.com/freeradius-3-I-m-try >>> ing-to-integrate-freeradius-with-active-directory-in-cenos- >>> 7-tp5742598p5742624.html >>> To unsubscribe from FreeRADIUS, click here >>> <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsu…> >>> . >>> NAML >>> <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macr…> >>> >> >> >

5 18