- Freeradius-Users - lists.freeradius.org

Free Radius Nak List Issue
by Aman Arneja 21 Dec '11

21 Dec '11

Hi FreeRadius Users We seem to be facing a problem while using EAP with free radius. If the client is proposing a list of methods in the NAK message being sent in response to server method proposal, it seems free radius is just looking at the first entry rather than parsing the list. Is this a known issue? Any workarounds or patches? Thanx Aman Arneja

2 2

Simultaneous-use check but don't reject
by Alexander Kosykh 21 Dec '11

21 Dec '11

Hi I'm using Simultaneous-use := 1 and sql for check on my Freeradius server. When the radius found that customer connected already it reject customer with Reply-Message := "\r\nYou are already logged in - access denied\r\n\n". Is the way do not reject customer to be able connect customer and redirect them to Error page? Regards, Alexander.

4 12

Problems with radzap: radclient:: failed to get value
by Sean Reifschneider 21 Dec '11

21 Dec '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm trying to run a radzap and having no luck. For example, if I try: radzap -d /etc/raddb -N $NAS_IP -P 1 -u las $NAS_IP $NAS_PW radclient:: failed to get value radclient: Nothing to send. I've also tried it with the NAS name ("52a2", from /etc/raddb/naslist) rather than IP: radzap -d /etc/raddb -N $NAS_IP -P 1 -u las 52a2 $NAS_PW radclient: Failed to find IP address for host 52a2: Success If I run radwho: radwho -ZR -N 216.138.63.130 -P 1 -u las I get a reasonable-looking: User-Name = "las" Acct-Session-Id = "000001C1" Acct-Status-Type = Stop NAS-IP-Address = $NAS_IP NAS-Port = 1 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = Acct-Session-Time = 239370 However, if I pipe that through radclient: radclient -x -d /etc/raddb -f - $NAS_IP acct $NAS_PW I get the error above: radclient:: failed to get value radclient: Nothing to send. I've been trying various combinations of both the output of radwho, and commands for radclient to log a user out, based on searches on the Internet including things like sending the "packet of disconnect" (PoD), including things on this page: http://wiki.freeradius.org/Disconnect_Messages including trying sending to ports 1700 and 3799, using commands like "disconnect" and "40", using packets like: Acct-Session-Id = "000001C1" User-Name = "las" NAS-IP-Address = $NAS_IP Using the above packet looks most promising, in that I don't get an error, it just hangs a few seconds and then fails with "no response from server for ID 141 socket 3" or similar. Any pointers on this? The version of FreeRADIUS is 2.1.10 from CentOS. There are a couple of micro version updates I could do, but I didn't see any mention in the changelog of anything related to this issue being resolved. Thanks, Sean -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iD8DBQFO774BxUhyMYEjVX0RAu4aAJ0R/vUb8XSKO2J0lCW9UKsq0jUgVwCeJF7a 8wxcDliE2oHyfqtDzJrgA00= =II6m -----END PGP SIGNATURE-----

2 2

Upstream NAS flooding my radius
by Nathan M 20 Dec '11

20 Dec '11

I have a setup such as: NAS > Freeradius Proxy > Freeradius Auth Periodically the NAS (different company and outside of my control) gets rebooted and when it starts up it sends thousands of simultaneous requests to the radius proxy, which in turn forwards them all to the appropriate freeradius auth server. The challenge is, the auth server can get overwhelmed and starts throwing some of these errors: Error: rlm_sql (sql): There are no DB handles to use! I'm curious if there's an elegant way on the freeradius proxy to rate limit the # of connections per second being thrown at the auth server. Ideally if the threshold is reached, requests above the threshold would be dropped (and not rejected). I've searched all the docs, the mailing list, and config files and haven't turned up a solution yet. Any help or advice is appreciated. - N

4 8

Re: VLAN attribution in an eduroam setting - proxied users
by Rui Ribeiro 20 Dec '11

20 Dec '11

> > Message: 2 > Date: Tue, 20 Dec 2011 13:22:48 +0100 > From: Stefan Winter <stefan.winter(a)restena.lu> > Subject: Re: VLAN attribution in an eduroam setting - proxied users > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4EF07E18.30809(a)restena.lu> > Content-Type: text/plain; charset="iso-8859-1" > > Hello Rui, > >> As for the VLAN attribution wether the user is a roaming user (i.e. goes >> to a proxy to be authenticated), I have done several tries, without >> sucess. Haven't managed to do it through the users file above;my last >> attemp was trying to setting them up in the /etc/freeradius/attrs file >> with attr_filter.post-proxy, however it seems to interfere with the >> AEP/password negotiation. The setup is as follows, and I would like to ask >> for an alternative of where to insert the roaming VLAN. >> >> post-proxy { >> post_proxy_log >> attr_filter.post-proxy # here <--------------------------- >> Post-Proxy-Type Fail { >> detail >> } >> } > > The attr_filter module only controls what to strip out of the incoming > reply, it can not be used to add new attributes. What you specified in > the file: > >> Tunnel-Type := "VLAN", >> Tunnel-Medium-Type := "IEEE-802", >> Tunnel-Private-Group-Id := "216", > > means: "Only leave these attributes in the reply packet if they have > exactly these values, otherwise strip them out". That is obviously not > what you want. > > The solution is rather simple with unlang: > > post-proxy { > post_proxy_log > update reply { > Tunnel-Type := "VLAN" > Tunnel-Medium-Type := "IEEE-802" > Tunnel-Private-Group-Id := "216" > } > Post-Proxy-Type Fail { > detail > } > } > > (syntax is "free-handed", you should try this on a testing server first) > > Greetings, > > Stefan Winter > > -- > Stefan WINTER > Ingenieur de Recherche > Fondation RESTENA - R?seau T?l?informatique de l'Education Nationale et > de la Recherche > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > > Tel: +352 424409 1 > Fax: +352 422473 > Stephan, The point is not being capable of changing them, and in fact I have both trying ulang and the attrs file -- and the debug information shows they are indeed changed -- the point is that changing them at that particular point seems to interfere with EAP/password negotiation, and I haven't been able to find a specific point to insert the VLAN quietly with roaming users. Best regards, Rui Ribeiro

2 1

RV: Reading winbind reply failed!
by Erick Rojas Bastidas 20 Dec '11

20 Dec '11

Help please!! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Tue, 20 Dec 2011 13:20:50 To: Alan Buxey<A.L.M.Buxey(a)lboro.ac.uk> Reply-To: erickj_rojasb(a)hotmail.com Subject: Re: Reading winbind reply failed! Hi Alan, Yes, I do 'net ads join' and responds with Using short domain name -- Worgroup Joined 'machine' to realm 'domain' No DNS domain configured for freeradius. Unable to perform DNS update. DNS update failed! You know why this problem with winbind? Appreciate your help.. Thank you! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Date: Mon, 19 Dec 2011 21:39:12 To: <erickj_rojasb(a)hotmail.com> Subject: Re: Reading winbind reply failed! Hi, > If run the command ntlm_auth responds with: > Could not obtain winbind separator! sounds to me linke winbindd isnt running - the winbindd and smbd processes must both be running...and you did 'net ads join' process as per the docs, yes? alan

2 1

RV: Reading winbind reply failed!
by Erick Rojas Bastidas 20 Dec '11

20 Dec '11

If run the command winbindd -i receive 'invalid permissions on socket directory /var/run/samba/winbindd_privileged' Winbindd_setup_listeners() failed.. Why is this? What are the correct permissions? I have: dwrx-x--- 2 freerad winbindd_priv 4096 dic 16 09:09 winbindd_privileged. Help me please!! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Tue, 20 Dec 2011 13:22:21 To: <freeradius-users(a)lists.freeradius.org> Reply-To: erickj_rojasb(a)hotmail.com Subject: RV: Reading winbind reply failed! Help please!! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Tue, 20 Dec 2011 13:20:50 To: Alan Buxey<A.L.M.Buxey(a)lboro.ac.uk> Reply-To: erickj_rojasb(a)hotmail.com Subject: Re: Reading winbind reply failed! Hi Alan, Yes, I do 'net ads join' and responds with Using short domain name -- Worgroup Joined 'machine' to realm 'domain' No DNS domain configured for freeradius. Unable to perform DNS update. DNS update failed! You know why this problem with winbind? Appreciate your help.. Thank you! Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Date: Mon, 19 Dec 2011 21:39:12 To: <erickj_rojasb(a)hotmail.com> Subject: Re: Reading winbind reply failed! Hi, > If run the command ntlm_auth responds with: > Could not obtain winbind separator! sounds to me linke winbindd isnt running - the winbindd and smbd processes must both be running...and you did 'net ads join' process as per the docs, yes? alan

3 2

logging accounting
by vazoumana fofana 20 Dec '11

20 Dec '11

Hello , I enable accounting on freeradius server. I see logs are stored under repository wich contains the ip of controller. Is it possible to change this and specify an other name ? Cheers

2 1

EAP-TTLS/EAP-PEAP Certificats
by Vincent Guardiola 20 Dec '11

20 Dec '11

Hi all, I have just one question about client certificats with EAP-TTLS or EAP-PEAP. I would like use certificats client with authentication MSCHAPv2 it's possible ? It's possible to use client certificats for create TLS tunel and use mschapv2 auth inside ? In my test the authentication is MSCHAPv2 or client certificat but not both in same time . Thx. Vincent

3 10

Inner tunnel external proxy fails under stress due to zero vectors
by Brian Julin 20 Dec '11

20 Dec '11

Greetings, While testing a setup that uses inner tunnel proxying I was noticing that there were spurious failures if the setup was stress tested. I managed to eliminate back-end latency as a possible cause by testing instead to a simple auth against rlm_passwd (with NTLM crypts.) I also tried with both servers running recent 3.0 repo code, so it's a problem that has likely been there at least from 2.1.10. After a long dig through the debugs, finally I noticed from a packet dump that packets with 0x00 vectors were hitting the wire, and when IDs were recycled that of course results in false "duplicates" (as well as the other crypto-related issues with that.) The packets with the 0x00 vectors were the inner-tunneled packets emitted from the proxying server. If I understand things right, these packets are generated by the EAP modules allocating a fake request, which is passed back through as if the server were handling the inner tunnel itself, and then when the proxy codepath is taken, this "fake" packet is then recycled as the outgoing request to the home server. Looking through the source we have this warning in request_alloc_fake src/main/utils.c: /* * This isn't STRICTLY required, as the fake request MUST NEVER * be put into the request list. However, it's still reasonable * practice. */ ...however this seems to be just what is happening. In fact, if above that I change: diff --git a/src/main/util.c b/src/main/util.c index 94ee443..e6a1a26 100644 --- a/src/main/util.c +++ b/src/main/util.c @@ -437,7 +437,7 @@ REQUEST *request_alloc_fake(REQUEST *request) */ fake->server = request->server; - fake->packet = rad_alloc(0); + fake->packet = rad_alloc(1); if (!fake->packet) { request_free(&fake); return NULL; ...then the setup passes stress testing just fine. Trouble is I'm not sure if there are ramifications to doing that...

2 1