March 2018 - Freeradius-Users - lists.freeradius.org

Compilation Warning - FreeRadius 3.0.16
by Andrea Mucci 01 Jun '18

01 Jun '18

Hi All, we downloaded the source software freeradius 3.0.16 from: git clone https://github.com/FreeRADIUS/freeradius-server.git cd freeradius-server git checkout release_3_0_16 The OS is RHEL 7.4. We will use freeRadius with Oracle 12 DataBase. We compiled with this enviroment variable seting export LD_LIBRARY_PATH=/usr/lib/oracle/12.2/client64/lib:/usr/lib:/usr/lib64 export ORACLE_HOME=/usr/include/oracle/12.2/client64 We had this WARNING: configure: WARNING: securid headers not found. Use --with-rlm-securid-include-dir=<path>. checking for SD_Init in -laceclnt... no checking for SD_Init in -laceclnt in /usr/local/lib... no checking for SD_Init in -laceclnt in /opt/lib... no configure: WARNING: securid libraries not found. Use --with-rlm-securid-lib-dir=<path>. configure: WARNING: silently not building rlm_securid. configure: WARNING: FAILURE: rlm_securid requires: acexport.h libaceclnt. configure: WARNING: silently not building rlm_opendirectory. configure: WARNING: FAILURE: rlm_opendirectory requires: membership.h. configure: WARNING: Oracle version >= 12 needs -laio We would like to know if these warnings can generate incorrect behavior of the software. Thanks Andrea

4 4

Some attributes are showing hexa values
by Nimesha Balasuriya 01 May '18

01 May '18

Dear Team, I am using freeradius version 3 and there is some issue i am facing once write the some radius attributes to mariadb. I am getting hexa values to specific attribute call (Chargeable-User-Identity) 0x123456789. How can i convert this to correct this hex value to normal ascii words. Thank you ! Best Regards, Nimesha

3 4

Radius crashing with "Failed adding event handler for socket: Too many readers"
by Campbell McKenzie 30 Apr '18

30 Apr '18

Hello, I'm running Free Radius 3.0.16 on Redhat 7 and the about once or 10 times a day the service will "crash" (Exit with error code 1) with the error message "Failed adding event handler for socket: Too many readers". The only messages prior to Radius crashing are: Mar 19 21:37:34 radius1.acme.com radiusd[11344]: ... adding new socket proxy address 202.AA.BB.CC port 57158 Mar 19 21:37:34 radius1.acme.com radiusd[11344]: ... adding new socket proxy address 202.AA.BB.CC port 57158 Mar 19 21:37:34 radius1.acme.com radiusd[11344]:Failed adding event handler for socket: Too many readers Then systemd picks up the failure: Mar 19 21:37:34 radius1.acme.com systemd:radiusd.service: main process exited, code=exited, status=1/FAILURE Mar 19 21:37:34 radius1.acme.com systemd:Unit radiusd.service entered failed state. Mar 19 21:37:34 radius1.acme.com systemd:radiusd.service failed. Our configuration consists of about 157 home_servers (mostly running in auth+acct) and about 276 clients and two upstream proxies. (Eduroam). It seems like a new socket is created for each home_server (auth) + another socket for accounting and with such a high(?) number of home_servers we are running out of sockets (possibly). Is there a limit to the number of home_servers and/or clients? Kind regards, Campbell Campbell McKenzie AARNet Pty Ltd address: Tenancy 1, Ground Floor, 143 Coronation Drive, Milton, QLD, 4064, Australia postal: PO Box 1787, Milton, Qld, 4064 w. www.aarnet.edu.au

2 5

Perl vs. python vs. Lua?
by Dom Latter 12 Apr '18

12 Apr '18

Hi, we have been using the exec module with version 2 to run an external PHP script that (for example) assigns a VLAN depending on the user's location [1] - this is done post-auth. We have migrated to freeradius version 3. I note from http://networkradius.com/doc/3.0.10/raddb/mods-available/exec.html that "The exec module may look like it works for one or two tests, but in a live situation it can cause the server to become unresponsive under load. The perl module is recommended for general-purpose computing." Now if I had read that four years ago I'd not have gone down the exec route... anyway. So it seems to me we need to rewrite the exec module using one of the scripting modules. So I am wondering how the python module compares to the perl module. I found and read a great post from Herwin Weststrate <herwin(a)quarantainenet.nl> from November 2016 that explains some of the differences. I'd rather use python than perl, all else being equal. Lua is an outlier of an option. Any thoughts? Apologies if any of the above is unclear. [] which we get from the access-point identifier string.

3 17

Efficient AD group matching via the new wbclient interface
by Isaac Boukris 12 Apr '18

12 Apr '18

Hello all, I am working on improving AD group matching for mschap authentication, taking advantage of the new wbclient direct interface which returns the user's token (including group membership SIDs) as part of NTLM authentication. Work in progress: https://github.com/frenche/freeradius-server/commit/9af7dfd634a251f68b07064… I'm now thinking on how to implement the caching of group-name to SID mapping with configurable timeout, ideally using existing interface - ideas welcome. @mcnewton, I noticed at last there is a similar group-compare function in v4 branch, though I think the two actually can complete each other. Thoughts? Thank you, Isaac B.

3 9

freeradius + NTLM + samba AD 4.5.x
by Dr. Peer-Joachim Koch 09 Apr '18

09 Apr '18

Hi, we have updated our samba AD domain from 4.4.x to 4.5.x. The release notes for 4.5.0 included "NTLMv1 authentication disabled by default". So we had to enable it to get our radius (freeradius) server working (for 802.1x). What would be the best way to change the freeradius configuration in such a way, that we can disable NTLMv1 again. The radius server is used for WLAN (802.1x) and for VPN. -- Bye, Peer ________________________________________________________ Max-Planck-Institut für Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

6 5

Using machine auth from a remote eduroam site
by Alex Sharaz 07 Apr '18

07 Apr '18

For a long long time now I've been using freeradius to auth PEAP and EAP-TLS inbound requests from eduroam to our Tier 1 FreeRadius ( 3.0.16) servers. We now want to enable our managed laptops to connect to eduroam at a remote site using machine authentication using EAP-TTLS. I've got part of the way in that I can see an inbound request from host/<fqdn of laptop> and a failure "Login incorrect (mschap: No such user [0xC0000064]): [host/dpslap001.its.york.ac.uk] (from client yorkcc port 76 cli 80-86-F2-E0-7D-24 via TLS tunnel)" So I guess this makes sense as our machines are in a different part of our AD Tree to our users. On our clearpass system I check for a username of the form host/.....york.ac.uk/ and do an auth against different AD tree branch and everything works. I'm using winbindd on our Tier 1 FR servers. Guess I need to create another mschap instance specifically for machine auths and point it at another part of the AD tree. Assuming that's what I have to do, how do I point mschap at a different part of the AD tree for authentication? Rgds Alex

8 19

Freeradius crashing due to load?
by 8zero2 operations 05 Apr '18

05 Apr '18

Hi, I am attaching error logs of freeradius getting crashed randomly during day. Thu Mar 1 11:45:22 2018 : Info: (1304581) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Thu Mar 1 11:45:22 2018 : Info: (1304581) eap_peap: what went wrong, and how to fix the problem Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 7 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3869), 1 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 6 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3870), 2 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 5 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3871), 3 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 4 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3872), 4 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Error: (1304488) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 35 due to unfinished request in component authorize module Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 3 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3873), 5 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 2 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3874), 6 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Need 1 more connections to reach 10 spares Thu Mar 1 11:45:24 2018 : Info: rlm_sql (sql): Opening additional connection (3875), 7 of 21 pending slots used Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: The users session was previously rejected: returning reject (again.) Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: This means you need to read the PREVIOUS messages in the debug output Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: to find out the reason why the user was rejected Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Thu Mar 1 11:45:24 2018 : Info: (1304661) eap_peap: what went wrong, and how to fix the problem Thu Mar 1 11:45:25 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:26 2018 : Error: (1304488) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 35 due to unfinished request in component authorize module Thu Mar 1 11:45:26 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:26 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x947bd4f29372cdbc Thu Mar 1 11:45:26 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x947bd4f29372cdbc Thu Mar 1 11:45:27 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:28 2018 : Error: (1304488) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 35 due to unfinished request in component authorize module Thu Mar 1 11:45:28 2018 : ERROR: (1304488) ERROR: Timeout waiting for child Thu Mar 1 11:45:28 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:29 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:30 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:30 2018 : Error: (1304757) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 54 due to unfinished request in component authorize module Thu Mar 1 11:45:31 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:32 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:32 2018 : Error: (1304757) Ignoring duplicate packet from client XXXXXXXX port 44953 - ID: 54 due to unfinished request in component authorize module Thu Mar 1 11:45:32 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x3b06b4a33e01ad19 Thu Mar 1 11:45:32 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x3b06b4a33e01ad19 Thu Mar 1 11:45:33 2018 : Error: (1304618) Ignoring duplicate packet from client XXXXXXXX port 59536 - ID: 16 due to unfinished request in component accounting module Thu Mar 1 11:45:34 2018 : Error: (1304633) Ignoring duplicate packet from client XXXXXXXX port 41018 - ID: 188 due to unfinished request in component accounting module Thu Mar 1 11:45:34 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x4aaec49748aadd2b Thu Mar 1 11:45:34 2018 : Error: rlm_eap (EAP): No EAP session matching state 0x4aaec49748aadd2b Thu Mar 1 11:45:34 2018 : ERROR: (1304618) ERROR: Timeout waiting for child Thu Mar 1 11:45:34 2018 : ERROR: (1304633) ERROR: Timeout waiting for child This is the last log which comes. I have database server modules enabled of sql and ldap. I have monitored them and there is no considerable load on them when this crash happens. I know some module is timing out but i cant quite figure out which. I cannot run it in debug as the crash happens randomly during the day and I have huge amount of users authenticating. How can I debug it and find which module is unresponsive while crash? Just point a finger to a direction i will find the way. PS: freeradius is an awesome software so a big thanks to developers Allan , Arran and everybody Regards, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 5

SQL auth against existing database
by Charles Sprickman 03 Apr '18

03 Apr '18

Hi, I’m looking through the SQL docs on the wiki, and they seem very complete, but I’m not quite grasping how to accomplish what I want. In short, I have an existing database that’s primarily used for our email system. I currently also have gnu-radius using this db - in the past for dialup, but at this point just a few remaining oddball services like usenet. I’m moving away from gnu-radius because it’s not very actively developed. What I’d like to do is this: - Use existing db for user/pass check - Use static files for everything else - Optionally alter my sql query based on which client is asking for auth Is this possible? Right now I don’t need to really return anything other than Access-Accept or Access-Reject - literally any other reply items are ignored. I’m on a fresh install of FreeRadius 3.0.15. Database schema is very simple, columns are: pw_name, pw_domain, pw_passwd, pw_gid (vpopmail, for the curious) It’s not practical to change the schema at this point… Thanks, Charles

4 8

Releasing 3.0.17?
by Alan DeKok 02 Apr '18

02 Apr '18

There are a few issues found && fixed since 3.0.16. Unless there are major objections, I think we can release 3.0.17 next week. The next step after that would be to add support for multiple kinds of certificates at the same time. e.g. RSA and ECC. This is supported in OpenSSL since 1.0.2. It's starting to get more widely deployed, too. While we do try hard to have 3.0 in a "feature freeze", features can still be added if they are important enough. And I think this counts. Alan DeKok.

6 15