March 2017 - Freeradius-Users - lists.freeradius.org

online users and LNS users are not equal and fluctuating
by iQalalwa 21 Mar '17

21 Mar '17

Dear Sir, I have FreeRADIUS Version 2.2.0, I have 3 Clients (3 LNS Cisco routers) and I am facing problem that online users are not stable in radius. Details: LNS01(Cisco), LNS02(Cisco): handle same users found in freeradiusdb. BUT in radius, LNS03 is not handling same number of users found in LNS03(Cisco). they are fluctuating all time. configuration of cisco LNSs are same. and I don't know from where the problem comes from. note: on LNS03(cisco) the users are stable but the problem in radius online users. please help.

3 3

buffered sql is blocking
by Sami Jorl 21 Mar '17

21 Mar '17

Hi, After switching to buffered sql I noticed FreeRadius is still blocked if I lock the sql tables. So FreeRadius doesn't accept new requests and doesn't save them to the detail file until the tables are unlocked. AND all requests are timed out in NAS. Isn't the whole purpose of using this module to accept requests as fast as possible even when database is busy? Thanks Sam

2 1

None
by Jörn Volkhausen 21 Mar '17

21 Mar '17

unsubscribe sokazoeh volkhausen.joern(a)gmx.de

1 0

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Originate DHCP lease query from FreeRadius
by Waqas Toor 19 Mar '17

19 Mar '17

Hi Gents, At the time of access request I need to do DHCP lease query to the DHCP server (external ) to get the MAC address of the device. I need to know if there is a module that does that ( originate a lease query to dhcp server) or I have to write external script to be called as pre-auth hook. Regards, Waqas Toor

2 3

FreeRadius 3.0.12 crash on ubuntu
by Olaf Dreyer 17 Mar '17

17 Mar '17

Hi! I am running FreeRadius 3.0.12 on Ubuntu 14.04.5 LTS with freeradius 3.0.12-ppa1~trusty libssl1.0.0:amd64 1.0.1f-1ubuntu2.22 The Radius server is used mainly as AAA server for a bunch of Cisco WLCs with a few hundred Cisco WLAN APs behind. We are doing EAP-TLS, the devices only have to present their certificates. Additionally it is used for authentication of admin users on Cisco devices, here we use the ntlm_auth module. But i think this is not relevant. The server crashes now quite frequently, the error always looks like this: Mar 16 22:44:03 server kernel: [2614480.407628] freeradius[13294]: segfault at 44 ip 00007f21f1317f55 sp 00007f21e4ae5828 error 4 in libssl.so.1.0.0[7f21f12dc000+55000] So, this looks like the crash was related to libssl. in general EAP-TLS works fine, several thousand authentications per day, but then freeradius crashes with the above error. Might be some certificate which openssl 1.0.1f does not understand? Maybe this is a TLSv1.2 certificate? Or should this be already fixed? Regards, Olaf

2 2

TTLS+PAP with Windows
by Herman Øie Kolden 16 Mar '17

16 Mar '17

Hello! I am running FreeRADIUS 2.2.5 on Debian 8.7 (Jessie). The RADIUS server is using TTLS+PAP. I am trying to find a good way to authenticate the server to Windows clients. With macOS, Linux, Android etc., I am using a custom self signed CA certificate. On these devices it is possible to specify that this certificate is only usable for a specific SSID. However, for Windows I have found no way to accomplish this. To make it work, I have to install the CA certificate in the "Trusted Root CA" store. This is rather inconvenient. If I (against all odds) lose the private key, the attacker could use it to issue certificates for web pages, and the Windows clients would accept them. One of the options I have considered is make FreeRADIUS present multiple certificates simultaneously: an LE certificate for Windows and the self signed CA certficiate for other clients. As Windows clients already trust LE, they should also accept the server certificate. 1) Is it possible to use LE certificates with FreeRADIUS? 2) Is it possible to make the server present multiple certificates? The reason for wanting multiple certificates, is that a complete switch to LE would require reconfiguring all the non-Windows clients that use the CA certificate. Naturally, all thoughts concerning EAP and Windows are also welcome. Thanks in advance! -- Herman Øie Kolden Trondheim, Norway

9 21

Sending Access-Challenge instead of Access-Accept using MS-CHAPv2
by Lasse Odden 16 Mar '17

16 Mar '17

Hello! This is my first post in the maillist (that have solved all of my earlier problems), but now I'm not sure if my error is my mistake, Cisco's mistake or FreeRADIUS's mistake. I've set up a two-factor athentication against our Cisco AnyConnect VPN with access-challenge (this works when I use PAP between Cisco and FreeRADIUS). But with the username and password being sent between the Cisco and the FreeRADIUS-server in cleartext I enabled "Password management" on the Cisco ASA, so it sends the password with MS-CHAPv2. The authentication of the user works with MS-CHAPv2. To make the FreeRADIUS send an challenge after the authentication of the user I did this in sites-enabled/default: authenticate { .... Auth-Type MS-CHAP { mschap challenge } .... } The Cisco ASA recieves the Challenge and promts for and challenge. When I type in the correct challenge the FreeRADIUS sends an Access-Accept, but the Cisco ASA won't allow it. My question is if this is allowed by the standard or is it a bug on Cisco's side? Regards, Lasse Odden

3 6

tri-D systems no longer exists
by Alex Sharaz 16 Mar '17

16 Mar '17

While browsing the mods-available directory I found a module called otp. As i've been looking at www.multiotp.net for multi factor authentication I thought I might look at the otp module. http://www.tri-dsystems.com take you to an Indonesian online gambling site and the otp code now seems to be at code.google.ccom/p/otpd. does seem a bit old, perhaps the docn on FR 3.0.13 could be updated Rgds alex

1 0

FR support for RFC 7585
by Rui Ribeiro 16 Mar '17

16 Mar '17

Hi all, I was researching about FR support for RFC 7585 "Dynamic Peer Discovery for RADIUS/TLS", and only found a couple of threads mentioning partial support for 3.1, from around last summer. If I need to test it out in the next couple of weeks, does 3.0 or 3.1 supports it? TIA, Rui -- Regards, -- Rui Ribeiro Senior Linux Architect and Network Administrator ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 3