December 2020 - Freeradius-Users - lists.freeradius.org

rlm_ldap: Limit accepted TLS versions on LDAPS
by Robert Hentsch-Jesse 07 Dec '20

07 Dec '20

Hello Freeradius Users, I'm using freeradius with the rlm_ldap module to request users from a OpenLDAP server using the LDAPS protocol. Is there any best practice how to limit the accepted TLS versions to 1.2 and 1.3 on the LDAPS connection? SSL and TLS <= 1.1 should be denied. I found a "tls_min_version" option for the rlm_eap module, but not for rlm_ldap. Are there other possibilities than stripping down the used libssl? Thank you in advance and best regards, Robert Hentsch-Jesse ....................................................................................... PHOENIX CONTACT Cyber Security GmbH Richard-Willstätter-Straße 6, 12489 Berlin, Germany Register Court: AG Charlottenburg, HR B 202908 Geschäftsführer/General Manager: Kilian Golm

2 1

rlm_sql Closing Connections
by Ammad Ali 07 Dec '20

07 Dec '20

Hi Guys, I am having below logs in my radius.log file. The connections are getting closed and some it suddenly got utilized and radius spawns new connections and it takes time to spawn. Also connections are getting closed even the idle timeout isn't reached. Please advise. Below are the logs. Mon Dec 7 12:11:06 2020 : Info: Ready to process requests Mon Dec 7 12:11:31 2020 : Warning: rlm_sql (sql): 22 of 22 connections in use. You probably need to increase "spare" Mon Dec 7 12:11:31 2020 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress Mon Dec 7 12:11:31 2020 : Warning: rlm_sql (sql): 23 of 23 connections in use. You probably need to increase "spare" Mon Dec 7 12:11:31 2020 : Info: rlm_sql (sql): Opening additional connection (23) Mon Dec 7 12:11:31 2020 : Warning: rlm_sql (sql): 23 of 23 connections in use. You probably need to increase "spare" Mon Dec 7 12:11:31 2020 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress Mon Dec 7 12:11:52 2020 : Warning: rlm_sql (sql): 24 of 24 connections in use. You probably need to increase "spare" Mon Dec 7 12:11:52 2020 : Info: rlm_sql (sql): Opening additional connection (24) Mon Dec 7 12:13:31 2020 : Info: rlm_sql (sql): Closing connection (15), from 19 unused connections Mon Dec 7 12:13:46 2020 : Info: rlm_sql (sql): Closing connection (27), from 18 unused connections Mon Dec 7 12:13:53 2020 : Info: rlm_sql (sql): Closing connection (4), from 17 unused connections Mon Dec 7 12:13:56 2020 : Info: rlm_sql (sql): Closing connection (21), from 16 unused connections Mon Dec 7 12:13:57 2020 : Info: rlm_sql (sql): Closing connection (2), from 15 unused connections Mon Dec 7 12:13:58 2020 : Info: rlm_sql (sql): Closing connection (12), from 14 unused connections Mon Dec 7 12:13:59 2020 : Info: rlm_sql (sql): Closing connection (13), from 13 unused connections Mon Dec 7 12:14:00 2020 : Info: rlm_sql (sql): Closing connection (29), from 12 unused connections Mon Dec 7 12:14:01 2020 : Info: rlm_sql (sql): Closing connection (18), from 9 unused connections Mon Dec 7 12:14:02 2020 : Info: rlm_sql (sql): Closing connection (36), from 10 unused connections Mon Dec 7 12:14:03 2020 : Info: rlm_sql (sql): Closing connection (33), from 9 unused connections Mon Dec 7 12:14:04 2020 : Info: rlm_sql (sql): Closing connection (17), from 8 unused connections Mon Dec 7 12:14:05 2020 : Info: rlm_sql (sql): Closing connection (23), from 7 unused connections Mon Dec 7 12:14:06 2020 : Info: rlm_sql (sql): Closing connection (8), from 6 unused connections Mon Dec 7 12:14:07 2020 : Info: rlm_sql (sql): Closing connection (37), from 5 unused connections Mon Dec 7 12:14:08 2020 : Info: rlm_sql (sql): Closing connection (35), from 3 unused connections Mon Dec 7 12:14:09 2020 : Info: rlm_sql (sql): Closing connection (14), from 3 unused connections Mon Dec 7 12:14:10 2020 : Info: rlm_sql (sql): Closing connection (31), from 2 unused connections Mon Dec 7 12:14:11 2020 : Info: rlm_sql (sql): Closing connection (11), from 1 unused connections Mon Dec 7 12:14:20 2020 : Warning: rlm_sql (sql): 20 of 20 connections in use. You probably need to increase "spare" Mon Dec 7 12:14:20 2020 : Info: rlm_sql (sql): Opening additional connection (40) Mon Dec 7 12:14:20 2020 : Warning: rlm_sql (sql): 20 of 20 connections in use. You probably need to increase "spare" Mon Dec 7 12:14:20 2020 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress Mon Dec 7 12:14:20 2020 : Warning: rlm_sql (sql): 20 of 20 connections in use. You probably need to increase "spare" Mon Dec 7 12:14:20 2020 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress Mon Dec 7 12:14:20 2020 : Warning: rlm_sql (sql): 21 of 21 connections in use. You probably need to increase "spare" Mon Dec 7 12:14:20 2020 : Info: rlm_sql (sql): Opening additional connection (41) Mon Dec 7 12:14:20 2020 : Warning: rlm_sql (sql): 21 of 21 connections in use. You probably need to increase "spare" Mon Dec 7 12:14:20 2020 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress Mon Dec 7 12:14:20 2020 : Warning: rlm_sql (sql): 22 of 22 connections in use. You probably need to increase "spare" Mon Dec 7 12:14:20 2020 : Info: rlm_sql (sql): Opening additional connection (42) Below are my sql config of radius. sql { driver = "rlm_sql_mysql" dialect = "mysql" server = "localhost" port = 3306 login = "nbbdb" radius_db = "nbbdb" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" authreply_table = "radreply" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" delete_stale_sessions = yes pool { min = 20 max = ${thread[pool].max_servers} spare = 20 uses = 0 lifetime = 0 idle_timeout = 900 } client_table = "nas" $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf } --

2 3

log proxy auth?
by Matt Zagrabelny 05 Dec '20

05 Dec '20

Greetings, I've looked in both: radiusd.conf proxy.conf for a way to log auth attempts that get routed through a proxy, but I'm not seeing it. I've enabled auth logs via: log { auth = yes } but I'm not seeing my proxied auth attempts in the log. Of course I see details when running radiusd -X: [...] (1) Expecting proxy response no later than 29.666655 seconds from now (1) Received Access-Accept Id 172 from 10.0.0.1:1812 to 192.168.0.1:36687 length 53 [...] (1) Login OK: [bob] (from client foo port 0) (1) Sent Access-Accept Id 222 from 192.168.0.1:1812 to 172.16.0.1:56468 length 0 Is it possible to log proxied auth attempts? Thanks for the help. -m

2 2

Re: Requests being rejected with "Invalid user"
by Dan M 05 Dec '20

05 Dec '20

> Date: Wed, 2 Dec 2020 18:01:15 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > > On Dec 2, 2020, at 5:33 PM, Dan M <dan.red.beard(a)gmail.com> wrote: > > > > We have been running FreeRadius for about 18 months with very light > > traffic and no issues. > > Recently, within the last month, some requests are rejected and a > > message appears in the log Invalid user: [the actual user id] (from > > client <the actual client id> port > > 0) > > That message comes out when the user is rejected. > > > It seems completely random. > > The end user just hits enter again which runs thru the client system > > and generates a new request that succeeds. > > (Well it seems that none of the second requests have failed. I have > > no reports otherwise) The user id seems to me to be identical (at > > least in the log) for both the failure and the success. > > Sure. Sounds like a DB connection issue, TBH. Not using a DB. > > i.e. if FreeRADIUS can't talk to the database, it can't get the user credentials. > So to be safe, it has to reject the user. > > Are there *other* error messages in the logs, around the same time that > user is rejected? Well, that's the thing. There is NOTHING else. I'd have expected something that might identify the reason for the rejection > > > This happened on multiple instances in multiple locations. > > Restarting the instances seemed to clear the issue for a while, but > > it's resurfaced (after about 12 days). > > > > I do not think that the request is getting to the "authorize" phase > > because there is no message from the python plug-in indicating that it > started. > > What "python plugin?" We are using python to make a web service call as part of authorize. Python log has nothing for these requests. So I'm five nines confident it isn't getting that far. Python makes the webservice call which actually does the authentication, and if it succeeds, sets the cleartext password to the password in the request and lets pap (the only thing in authentication section, handle the reply) If it fails, it returns configTuple = (('Auth-Type', "Reject"),)> > i.e. we don't have access to your system. So you shouldn't assume that we > know what you're talking about, when you refer to custom changes you > made. The point was it's getting rejected by something I didn't write and isn't reaching the thing I did. I left all of these in place and haven't changed any of the files. Authorize { filter_username preprocess auth_log suffix expiration logintime python pap } > > > So maybe this comes from some pre-authorize step? > > Maybe. It depends on how you configured it. If the configuration says to > reject the user in the "authorize" stage, then it rejects the user. > > > I scanned all the configuration and don't find that string "Invalid user" > > anywhere, > > so I'm thinking it's generated internally when something else fails. > > It's in the source. > > > Unfortunately, this is in a locked-down, production environment and I > > can't just "start it up in debug mode" > > Is this something you have seen before? > > Is there something I might do to increase the log level? Where, how, > > and of what? > > see raddb/sites-enabled/control-socket, and "radmin". I looked at this and started a different thread about this specifically. > > > We are running version 3.0.17. > > Probably upgrade to 3.0.21. It might not help this issue, but it's not a bad > idea. It's on the long list of maintenance tasks for 2021 > > Alan DeKok. > Lastly, while most requests are generating detail request/reply entries, there are no failures in the detail-reply log. Odd. Dan M Scanned by McAfee and confirmed virus-free. Find out more here: https://bit.ly/2zCJMrO

2 1

Enabling debug level on server
by Dan M 04 Dec '20

04 Dec '20

I need to get debug output without being able to start the server with -X. After reviewing your reply to: Requests being rejected with "Invalid user" and reviewing the related docs I see two options: radmin OR possibly in authorize section Both require config changes and both have challenges in our locked down environment. For using radmin - update control-socket file with socket file name, uid, gid, mode = rw - enable control-socket by creating the symlink - restart Invoke radmin issue useful commands: (possibly using the -f socket_file and -I input_file) show debug level show module list debug file [filename full path] # If I don't set the filename will debug go to the current log file? # e.g. from: log { destination = files file = ${logdir}/radius.log ... # Can I just use the same logfile filename and base logging and debug will go to same file? # Can the debug file name be set permanently in the config somewhere? set debug level 1 # (What is a good/recommended level?) - watch for failures and go read the debug data Alternately, in Vers 3.17 can I just add the below to my authorize section?: update control { Tmp-String-0 = "%{debug:1}" } Does it REQUIRE a conditional? If so would: "if ( "A" == "A") { ... }" suffice? Thanks in advance Dan Mullen Scanned by McAfee and confirmed virus-free. Find out more here: https://bit.ly/2zCJMrO

2 1

iOS doesn't trust server certificate signed by intermediate issuer
by Igor Sousa 04 Dec '20

04 Dec '20

Hi, My institution generated our server certificate by GlobalSign, but we received a server certificate signed by an intermediate issuer, an intermediate issuer. We receveid the server, intermediate and root certificates files. I created a bundle with intermediate and root certificates, in this order an. I configured the /etc/freeradius/mods-enabled/eap as below: private_key_file = <path for server private key that I created> certificate_file = <new path for server.pem received from GlobalSign> ca_file = <path to ca.bundle obtained by cat intermediate.pem >> ca.bundle and cat root.pem >> ca.bundle> I run freeradius service with no issues as well as Android validates server certificate. When I tested the iOS connection the device showed me the server certificate as Not Trusted. I verified server certificate information and it is correct. If I click on the Trust button on the device screen, I can authenticate on Freeradius server with no issues. Is this behavior right? Doesn't iOS trust in server certificate signed by an intermediate chain? -- Igor Sousa

5 7

No logs being generated
by Paul Rattu 03 Dec '20

03 Dec '20

Hello, I've set up and configured my freeradius server but I'm not seeing any log files being generated. In the radiusd.conf file I've uncommented this line " requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log " and I have auth, auth_badpass, and auth_goodpass set to "yes". According to this file the logs should be generated and put into /var/log/radius but I'm not seeing any log files from freeradius, there's only a folder called radacct which is also empty. I don't think it should matter, but I am running freerad in Debug mode currently, will the logs start generating when I've enabled the service and have it running daemonized? Thanks for any help! For reference, here is the log section from the radiusd.conf file: log { destination = files colourise = yes file = ${logdir}/radius.log requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes msg_denied = "You are already logged in - access denied" } -- [image: Cinesite Logo] *Paul Rattu * | Systems Administrator Cinesite | 500-565 Great Northern Way, Vancouver, BC, V5T 0H8 t: +1 604 216 2615 cinesite.com

2 1

Requests being rejected with "Invalid user"
by Dan M 02 Dec '20

02 Dec '20

We have been running FreeRadius for about 18 months with very light traffic and no issues. Recently, within the last month, some requests are rejected and a message appears in the log Invalid user: [the actual user id] (from client <the actual client id> port 0) It seems completely random. The end user just hits enter again which runs thru the client system and generates a new request that succeeds. (Well it seems that none of the second requests have failed. I have no reports otherwise) The user id seems to me to be identical (at least in the log) for both the failure and the success. This happened on multiple instances in multiple locations. Restarting the instances seemed to clear the issue for a while, but it's resurfaced (after about 12 days). I do not think that the request is getting to the "authorize" phase because there is no message from the python plug-in indicating that it started. So maybe this comes from some pre-authorize step? I scanned all the configuration and don't find that string "Invalid user" anywhere, so I'm thinking it's generated internally when something else fails. Unfortunately, this is in a locked-down, production environment and I can't just "start it up in debug mode" Is this something you have seen before? Is there something I might do to increase the log level? Where, how, and of what? We are running version 3.0.17. Dan Mullen Scanned by McAfee and confirmed virus-free. Find out more here: https://bit.ly/2zCJMrO

2 1

Radius authorization
by Bidisha Mandal 02 Dec '20

02 Dec '20

Hi, How to setup Radius for authorization of a client? I'm new to FreeRadius and I'm able to authenticate the client for SSH but where do I need to configure authorization assigned to a user . In /etc/freeradius/3.0/users file I have added a user admincdot as follows - admincdot Cleartext-Password := "123que" Reply-Message := "Hello, %{User-Name}", Session-Timeout := "10" Now I want to authorize this user to perform some certain task or may be a list o command that this user is authorize to perform. Even this Session-Timeout := "10" is not working. As I have read Radius can do this authorization stuff but don't know where to configure this. Let me know if there is any way. Thanks & regards, Bidisha Mandal Research Engineer C-Dot, New Delhi

2 1

PEAP / EAP-TLS
by Thomas Rosenstein 02 Dec '20

02 Dec '20

Hi, I have tried to add EAP-TLS support to my working configuration with PEAP/MSCHAPv2, following: http://notes.asd.me.uk/2012/01/20/freeradius-with-peap-eap-tls-for-microsof… First it complains (/etc/freeradius/sites-enabled/inner-tunnel[26]: Unknown Auth-Type "inner-eap" in authenticate sub-section) about having innereap in the authenticate section of the inner-tunnel, if I leave eap (which I think is correct?!) Then the EAP authentication stops with: (480) eap: Peer sent packet with method EAP NAK (3) (480) eap: Peer NAK'd asking for unsupported EAP type TLS (13), skipping... (480) eap: ERROR: No mutually acceptable types found Which should mean that the inner-eap config file is not working? Currently the inner-eap config looks like that: eap inner-eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no mschapv2 { } tls-config tls-inner { private_key_file = ${raddbdir}/tls-certs/vpn.key certificate_file = ${raddbdir}/tls-certs/vpn.crt ca_file = ${raddbdir}/tls-certs/ca.pem dh_file = ${raddbdir}/tls-certs/dh.pem random_file = /dev/urandom fragment_size = 1024 check_crl = no cipher_list = "DEFAULT" } tls { tls = tls-inner } } I am not sure about the tls-config, the sample files use the tls config like that for the eap file, but the inner-eap sitll has the config directly in the tls sections - anyways, I tried both and same result. Additionally mschapv2 just continues to work, if I add it, or remove it, no change. I'm using: radiusd: FreeRADIUS Version 3.0.20 (git #d94c953), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.0.20 I also read that there's a new option "inner_eap_module" for the PEAP section inside eap, but I can't figure out if that's actually in 3.0.20 or not ... Can someone provide a working config for PEAP/EAP-TLS? Can someone describe why my config is not working? Thanks Thomas

3 4