October 2017 - Freeradius-Users - lists.freeradius.org

Re: Freeradius service - unexpected restarts
by Peter Hutchison 13 Oct '17

13 Oct '17

> Any ideas what cause the freeradius service to stop and restart > repeatedly like this? > > - do you run latest version of FR (or at least, latest available from your distro)? Yes - does it happen often, or only on that specified time? No it doesn't happen often, only yesterday so far. - does something happen on that time that restart freeradius (e.g. logrotate, apt-get upgrade, or something)? No, all scheduled job run outside normal daytime hours. - does FR access external things (e.g. database)? What is the state of those systems at that time? No, no databases are used. >The usual troubleshooting methods would be 'run freeradius in debug mode and read the logs', but it might not be able to help you much if the problem is due FR being restarted. It would be very hard do to 'read' such logs on a live system with the high number of connections made. Peter Hutchison MCP Senior Network Systems Specialist * 01484 473716 Networks Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 1

Questions about ldap authentication, huntgroup and authorize file
by Jérôme BERTHIER 13 Oct '17

13 Oct '17

Hi, I'm moving a setup from freeradius 2 (CentOS 6) to freeradius 3 (CentOS 7). The server is hosting : - a backend to authenticate users on Wifi 802.1X TTLS-PAP (openldap) and PEAP-MSCHAPv2 (Active Directory) - a backend to authenticate users on network equipment for admin purpose We use several ldap instances described in the ldap module. Our openldap server does not permit to read password. We use anonymous binding to run the authentication process. So, auth-type := <ldap_instance> is setted by ldap module file in each ldap instance : set_auth_type = yes Network equipements are grouped in the file huntgroup to apply a specific policy by using filters on huntgroup and ldap group in the file users. The filter replies differents vendor specific attributes for each ldap group and finally, we reject the authentication if there is no match. For example, for devices from Juniper, we use this setup : DEFAULT Ldap-Group==ldap_group_1,Huntgroup-Name == JuniperNet Service-Type = Login, Juniper-Local-User-Name := "radius-admin" DEFAULT Ldap-Group==ldap_group_2,Huntgroup-Name == JuniperNet Service-Type = Login, Juniper-Local-User-Name := "radius-operator" DEFAULT Auth-Type := Reject,Huntgroup-Name == JuniperNet I took care of the file README.rst. I had also a look to the documentation page about ldap module : http://wiki.freeradius.org/modules/Rlm_ldap I still have few questions : 1) I notice that the variable Ldap-Group is no more set by the last ldap instance called. So, I corrected my config to describe the default instance ldap {}. It works but is it planned to be able to call another instance in the file authorize ? 2) Since the module ldap does not set auth-type := ldap anymore, I add the lines to the configuration of the site where needed : if ((ok || updated) && User-Password) { update { control:Auth-Type := ldap } } Is it correct ? 3) Is it correct to use the file authorize to apply filters like we do ? or, shall we do it in the post auth section (it could be innacurate if we need to reject the access) ? Thanks you for your help Regards, -- Jérôme BERTHIER

2 7

Freeradius service - unexpected restarts
by Peter Hutchison 13 Oct '17

13 Oct '17

On our Freeradius 2.0.12 on Ubuntu 14.04 server, we are sometimes experiencing repeated service restarts. $ grep freeradius /var/log/syslog.1 Oct 12 16:08:52 texas kernel: [1380110.477452] init: freeradius main process (1688) terminated with status 1 Oct 12 16:08:52 texas kernel: [1380110.477460] init: freeradius main process ended, respawning Oct 12 16:08:52 texas kernel: [1380110.589303] init: freeradius main process (1699) terminated with status 1 Oct 12 16:08:52 texas kernel: [1380110.589312] init: freeradius main process ended, respawning Oct 12 16:08:52 texas kernel: [1380110.698334] init: freeradius main process (1708) terminated with status 1 Oct 12 16:08:52 texas kernel: [1380110.698342] init: freeradius main process ended, respawning Oct 12 16:08:52 texas kernel: [1380110.808440] init: freeradius main process (1718) terminated with status 1 Oct 12 16:08:52 texas kernel: [1380110.808449] init: freeradius main process ended, respawning Alert from monit: Timeout Service freeradius Date: Thu, 12 Oct 2017 16:21:23 Action: unmonitor Host: texas.hud.ac.uk Description: service restarted 5 times within 5 cycles(s) - unmonitor Any ideas what cause the freeradius service to stop and restart repeatedly like this? Peter Hutchison MCP Senior Network Systems Specialist * 01484 473716 Networks Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 2

RE: Freeradius-Users Digest, Vol 150, Issue 24
by Peter Hutchison 13 Oct '17

13 Oct '17

> Any ideas what cause the freeradius service to stop and restart > repeatedly like this? > > - do you run latest version of FR (or at least, latest available from your distro)? Yes. - does it happen often, or only on that specified time? It only happens occasionally, on you Fortinet wireless graphs we we a sudden drop in connections when it happens. - does something happen on that time that restart freeradius (e.g. logrotate, apt-get upgrade, or something)? No, there is nothing obvious I can see that could cause it. Any cron jobs run well outside normal daytime hours. - does FR access external things (e.g. database)? What is the state of those systems at that time? No databases are used. Logs are sent to local storage in /var/log. The usual troubleshooting methods would be 'run freeradius in debug mode and read the logs', but it might not be able to help you much if the problem is due FR being restarted. I would like to do that but debug logs generate a log of information and due to the high number of connections would be difficult to read. Peter University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

1 0

Ldap DNS SRV record support
by Dave Macias 12 Oct '17

12 Oct '17

Is it possible for the module to do DNS discovery of the available ldap servers? I created a srv record for my ldap servers which im able to resolve. # domain amer.nwk.jwm2.net _ldap._tcp SRV 0 1 389 my-ldap-server1 _ldap._tcp SRV 0 2 389 my-ldap-server2 _ldap._tcp SRV 0 3 389 my-ldap-server3 $ host -t srv _ldap._tcp.amer _ldap._tcp.amer.nwk.jwm2.net has SRV record 0 3 389 my-ldap-server3.amer.nwk.jwm2.net. _ldap._tcp.amer.nwk.jwm2.net has SRV record 0 2 389 my-ldap-server2.amer.nwk.jwm2.net. _ldap._tcp.amer.nwk.jwm2.net has SRV record 0 1 389 my-ldap-server1.amer.nwk.jwm2.net. $ ldapsearch -LLL -H "ldap:///dc%3Damer.nwk.jwm2.net" -b dc=datacom,dc=net -D "cn=manager,dc=datacom,dc=net" -w '<pass>' uid=config dn: uid=config,ou=People,dc=datacom,dc=net uid: config cn: ECR user givenName: ECR ... ... Thanks! -dave

5 7

Called-Station-Id
by Cassiano Peixoto 11 Oct '17

11 Oct '17

Hi there, I'm using radius proxy and I'm trying to send to main radius the value of NAS-Port-Id to Called-Station-Id Atribute. I added the following line on post-auth section: update reply { Called-Station-Id += "%{reply:NAS-Port-Id}" } But It's doesn't work. Anyone could help how should I proceeded? Thanks.

3 3

Reply issue on Class attribute
by Umut Arus 10 Oct '17

10 Oct '17

Hi, We are reconfiguring radius on 3.0.15 version and we would like to reply the Class attribute with variable data getting through ldap but it could not send to Controller. Have you an idea? Regards. -- *Umut A.*

2 1

"User-Password" in cleartext
by Samia El Haddouti 10 Oct '17

10 Oct '17

Dear All, Is there an option to do not show the fiedl "User-Password" in cleartext on the debug mode of freeradius when we use PAP as a default authentication method? -Sam

2 1

Freeradius Logging level - set log level to error
by Siddiqui Najam 10 Oct '17

10 Oct '17

Hi, We see client secrets being logged in the log (stdout), something like: Info: Adding client 192.168.1.2/32 with shared secret "testing123" Is there a way to set the log level to ERROR, basically suppress this log? Regards, Najam ________________________________ This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited. E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender. Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.

2 1

Problem with shared secret on H3C WX5004
by Igor Sousa 10 Oct '17

10 Oct '17

Hello everyone, Yes, I've known that H3C WX5004 is too old wireless controller, but it is that I have in moment. :D I've already radius configuration in WX5004 that pointing to a freeradius server 2.x. Aiming to test freeradius 3.0.15, I've configured another radius configuration and pointing to freeradius server 3.x, but when Access-Request arrives to freeradius 3.x, freeradius drops because shered secret is incorrect. Thus, I have two questions: 1. Is there a method to check shared secret in message sent to freeradius? 2. Someone have similar problem with this controller (H3C WX5004) Att., -- Igor Sousa

2 2