- Freeradius-Users - lists.freeradius.org

FW: Session Resumption fails
by Panagiotis Georgopoulos 05 Oct '10

05 Oct '10

Hello all, I am resending this to the list as the debugging output was more than 100KB and the message was rejected. Alexander who was copied in my email, kindly provided feedback already. In short, "use_tunneled_reply = yes" should be able to solve the problem with session resumption in FR 2.1.10, although I understand that break the end client's privacy as it reveals its identity to the NAS. When I test it I'll get back to you as I am guessing this interests more people. Cheers, Panos Debug output here : http://pastebin.com/7u1tjbYE > -----Original Message----- > From: Panagiotis Georgopoulos [mailto:panos@comp.lancs.ac.uk] > Sent: Friday, September 24, 2010 04:17 > To: 'FreeRadius users mailing list'; 'Alexander Clouter' > Subject: RE: Session Resumption fails > > Hi Alexander, all > > Thanks a lot for your reply, it helped my understanding of what is > occurring. Please see below for my comments. > > > > > Panagiotis Georgopoulos <panos(a)comp.lancs.ac.uk> wrote: > > > > > > I have a client machine that authenticates to FreeRadius using > > > EAP-TTLS over Access_Point_1 just fine. When I roam the client to > > > Access_Point_2 and tries to authenticate again to FreeRadius, > > > session resumption seems to be failing with the following error. > > > > > > [snipped] > > > > > > One thing to note on the above is that there is no cached > > information, > > > which seems strange as the client was authenticated some minutes > > > over Access_Point_1. The other thing is that user authentication > > > fails completely and the client resides to restart EAP-TTLS from the > > > start that finishes successfully. > > > > > The session cache stores what is in the *reply* packet of the inner > > request (if that makes sense). > > > > In your eap.conf file, you refer to a virtual server to palm off > > requests to once the EAP layer has been peeled off. In that virtual > > server say in the authorize{} section: > > ---- > > update reply { > > User-Name := "%{request:User-Name}" > > } > > ---- > > > > Now you will find on resumption the username appears magically; > > session resumption is a feature of SSL/TLS and so the user-name is not > > accessible; hence the need to dig into the cache. > > > > I also recommend that you also do: > > ---- > > update outer.request { > > User-Name := "%{request:User-Name}" > > } > > ---- > > I am afraid your suggestion though to add the above in my inner-tunnel virtual > server didn't solve the problem. After having searched the archives of the > list, I found out that this is an OpenSSL bug and there is a fix in FreeRadius > 2.1.10 for it. > > I just compiled 2.1.10 and I verify that I don't see resuming sessions failing > with this no information in the cache : > > Info: [ttls] Skipping Phase2 due to session resumption > Info: [ttls] WARNING: No information in cached session! > > However, I am not seeing the correct behaviour either :-/ > > I am seeing the server adding information in the cache : > > - Debug: SSL: adding session > 1d6029bbddba233cd443d692b968df093237d9ad982f9ccc8a2defcd3edeb243 to cache > - Info: [ttls] (other): SSL negotiation finished successfully > - Debug: SSL Connection Established > > .. but it *never* says that it tries to e.g. skip phase 2 and try resumption > (as I was seeing with FR 2.1.8). > > However in some occasions it says : > > - Info: [ttls] WARNING: No information to cache: session caching will be > disabled for this session. > - Debug: SSL: Removing session > 69c204b29e84878591c19645ed74c1ff4b656c30f66adad78d268df65d2e1d14 from the > cache > > Does anyone have any pointers/suggestions? Anyone who managed to do session > resumption with 2.1.10? > > Thanks a lot in advance, > Panos > > > Ps. By the way, you can find attached my radiusd debugging output with a > client trying to authenticate over different NASs. All authentications > succeed, and info in the cache is stored, but FR never resumes a session. > (nb. in the attached debug, I am restarting my NASs first before the client > starts roaming from one NAS to the other using EAP-TTLS) >

2 8

Freeradius Attribute Subtypes
by Kevin Baier 04 Oct '10

04 Oct '10

Hi List, My freeradius version is 2.0.4 shipped with standard debian lenny package. I have to implement some special attribute to control the users bandwidth on an Special NAS. Here ist the attribute: Type: 26 Length = 12 Vendor ID: 3902 Vendor-Type = 3 Vendor-Length = 14 Sub-Type = 1 Forward maximum gross aggregate bandwidth value Length = 6 Vendor-Value = 1 – 2**32 -1(binary value of the gross aggregate bandwidth for the user, in bits per second) Sub-Type = 2 Reverse maximum gross aggregate bandwidth value Length = 6 Vendor-Value = 1 – 2**32 -1(binary value of the gross aggregate bandwidth for the user, in bits per second) As I can see the attribute itself has two subtyped values. How can I declare them in the dictionary file? Thank you for your help! -- Kevin Baier

2 2

unlang post-auth group-name
by Cameron Wood 02 Oct '10

02 Oct '10

Hi I'm trying to obtain the Group-Name for the requested user and use it with unlang in the Post-Auth section of my sites-available/default config. This hasn't work thus far, and I have tried a number of other ideas, such as getting it whilst in the Authorize section and creating new variable to hold it there and then referencing that, but still with no success. Can someone tell me how I can accomplish this, below is a snippet of my config so you can see what I am trying to accomplish, any help would be greatly appreciated. post-auth { > switch "%{client:vendor}" { > > case adva { > switch "%{Group-Name}" { > > case net_ro { > update reply { > ADVA-UUM-User-Level := "Monitor" > } > } > > case net_rw { > update reply { > ADVA-UUM-User-Level := "Admin" > } > } > > case net_su { > update reply { > ADVA-UUM-User-Level := "Root" > } > } > } > } > > case cisco { > ... > } > > case netscreen { > ... > } > } > } > Cheers Cam. --

6 26

Wipe existing reply attributes in rlm_files
by Brian Candler 02 Oct '10

02 Oct '10

Hello, I'm using freeradius 2.1.7. I would like to know if there's a simple way, within a users file, to *replace* the entire set of reply attributes with some others. For example, NONE Foo = "bar", Baz = "bap" # FIXME: delete all reply attributes which have accumulated so far Framed-IP-Address = 1.1.1.1 The idea is that I've already done a database dip using something like rlm_sql, which may have added some reply attributes; but then later logic requires that I need to remove those reply attributes and replace them with a different set (e.g. to L2TP tunnel them somewhere else) I know I could remove specific attributes using -=, but I don't know which attributes might have been added by this point. My current solution is very messy, using two users files. Firstly I set a temporary control list attribute: NONE Foo = "bar", Baz = "bap", Postauth-Action := "XXX" and then next in the authorize { } config I have: if ("%{control:PostAuth-Action}" =~ /./) { deleteall # invoke custom module to clear reply list postauth_attrs # invoke second users file } and finally, in a second users file, I add the new attributes: XXX Framed-IP-Address = 1.1.1.1 I can't even use the standard attr_filter module to delete the existing reply attributes, because when it's invoked in the authorize { } section it acts on the request list, not the reply list. Have I missed an easier way to do this? Thanks, Brian.

3 4

Unfinished Request no Database
by João Romariz 01 Oct '10

01 Oct '10

Hi, We are facing a strange issue with freeradius 2.1.9 running in a VM with Fedora Core 13. As soon as we start the server we get around 30 anthentication requests per second from a client. The first 30 to 40 request get a quick reply but from there on only very few replies are seen on the log file, all the other requests get this error: Fri Oct 1 05:06:28 2010 : Error: Discarding duplicate request from client GGs port 65035 - ID: 117 due to unfinished request 4 Searching the mailing list I found lots of references to this error as cause by "slow database server". The problem here is that we are not using any database on this server, we authenticate any user and don´t care for username or password. The server assigns IP addresses to the users by an ippool. Any ideas of what could be the causing the problem? Thanks for any help. Regards, Joao.

2 1

FreeRADIUS ECCN code ?
by Fabrizio Rossi 01 Oct '10

01 Oct '10

Hi all, Is somewhere declared the FreeRADIUS ECCN code ? (http://en.wikipedia.org/wiki/ECCN) I've looked in the WIKI and in the mailing list archives but I could not find this info. Thanks, Fabrizio

3 7

Freeradius + EAP_TLS + Cisco AP
by Esteban TALAVERA 01 Oct '10

01 Oct '10

Hi I configured a freeradius server with EAP_TLS to authenticate clients that connects to Cisco AP. When I run freeradius -X I got a lot of activity output but the client is still trying to authenticate I post last lines from the server's output I see the port of Access-request es 1645 but I did configure 1812 in both server and Cisco AP The line "[tls] eaptls_process returned 13 " means something wrong? What should be the correct output when successful authentication occurs? Thanks ==== rad_recv: Access-Request packet from host 192.168.X.X port 1645, id=51, length=143 User-Name = "etalaveran" Framed-MTU = 1400 Called-Station-Id = "aca0.16ba.89f2" Calling-Station-Id = "0021.63ca.fdbe" Service-Type = Login-User Message-Authenticator = 0x32824bc17cf2b4b4920577cc57e00177 EAP-Message = 0x020700060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 285 NAS-Port-Id = "285" State = 0x732b0744702c0abef63c2dd8a2b9de35 NAS-IP-Address = 192.168.1.82 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "etalaveran", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry etalaveran at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 51 to 192.168.X.X port 1645 EAP-Message = 0x0108000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x732b074477230abef63c2dd8a2b9de35 Finished request 19. Going to the next request Waking up in 4.8 seconds. Cleaning up request 15 ID 47 with timestamp +117 Cleaning up request 16 ID 48 with timestamp +117 Cleaning up request 17 ID 49 with timestamp +117 Cleaning up request 18 ID 50 with timestamp +117 Cleaning up request 19 ID 51 with timestamp +117 Ready to process requests. ================= -- *Esteban Talavera*

3 7

Install FR 2.1.10 on OS X 10.4.11
by Wolfgang Burger 01 Oct '10

01 Oct '10

Hello, I´m using version of 1.1.7 on a production system and it was working quite well for me. For severall reasons I want to update my setup now. When I startet to try the new versions some days ago, the "Frontpage"- Version was 2.1.9. I'm running my server under Mac OS X 10.4.11 PPC. 2.1.9 was building nicely but I was suffering the bug mentioned here: http://lists.freeradius.org/mailman/htdig/freeradius-users/2010-June/msg001… I tried to install the newest git version or the 2.1.10 release on this system, but failed. Part of output, created by "make" below. More on request. Is there a way to install 2.1.10 on this system? Thank you very much. Best regards, Wolfgang Making all in main... /usr/bin/make -C main all /Users/system/Desktop/freeradius-server-2.1.10/libtool --mode=link gcc -o radsniff radsniff.lo /Users/system/Desktop/freeradius- server-2.1.10/src/lib/libfreeradius-radius.la -framework DirectoryService -lresolv -lpthread -lpcap gcc -o radsniff radsniff.o -framework DirectoryService /Users/system/ Desktop/freeradius-server-2.1.10/src/lib/.libs/libfreeradius-radius.a - lresolv -lpthread -lpcap /usr/libexec/gcc/powerpc-apple-darwin8/4.0.1/ld: Undefined symbols: _pcap_dump_fopen _pcap_fopen_offline collect2: ld returned 1 exit status make[4]: *** [radsniff] Error 1 make[3]: *** [main] Error 2 make[2]: *** [all] Error 2 make[1]: *** [src] Error 2 make: *** [all] Error 2

2 2

inside Auth-Type has different rules
by Iliya Peregoudov 01 Oct '10

01 Oct '10

Hello, I have following configuration: authenticate { Auth-Type CHAP { chap db_backend chap { ok = 1 } db_backend } } First chap module call should handle cases when Cleartext-Password already set (for example, by files module). If there is Cleartext-Password, chap module returns *ok* or *reject*, so authentication should stop on these return codes. If there is no Cleartext-Password, chap module returns *invalid*, so authentication should proceed further. db_backend is a custom module that uses backend database. First db_backend call returns: - *ok* if backend database do not want password checking, - *reject* if backend database want to reject authentication, - *handled* if Proxy-To-Realm returned from backend database, - *updated* if Cleartext-Password returned from backend database. Authentication should stop on *ok*, *reject*, and *handled* return codes, and should proceed on *updated* return code. Second chap module call should check CHAP-Password against Cleartext-Password. Return code *ok* handling changed to proceed with authentication if password is correct. Second db_backend call returns *ok*, *reject*, or *handled* like first db_backend call. In freeradius 1.1.x this configuration works fine. In freeradius 2.1.x it doesn't work. I found that in freeradius 2.0.2 return code handling in Auth-Type subsections was changed. In freeradius 1.1.x return code handling was: - return notfound, ok, reject, userlock, handled - save noop, updated, fail, invalid (all with priority 1) In freeradius 2.1.x (starting with 2.0.2) return code handling is identical to authorize section: - save notfound (prio 1), noop (prio 2), ok (prio 3), updated (prio 4) - return fail, reject, userlock, invalid, handled This change was committed by commit id 4719ed0ce65f19586364. What is the reason for the change? It changes requirements for module return codes. Moreover, return code handling was changed only in Auth-Type subsections, not in authenticate section. When module's authenticate hook is called module has no clue is it called from authenticate section or from Auth-Type subsection. Regards, Iliya Peregoudov

2 1

Radius+Ldap:Allow the same host in multiple vlans
by Ramon Escriba 01 Oct '10

01 Oct '10

Hi I'm trying to organize my net using 802.1x able switches with freeradius 2.1.1+Openldap2-2.4+OpenSuse11.1 The system is running, at least @ test level but not yet deployed, but I reach a cross road and finally I've to choose. Or having one ldap subtree per vlan, filled with all host that bellong to this one, or store inside the host attributes all vlans it's allowed or may get in. The first "road" it's the one I've working actually, because I don't know how to implement the second, the elegant one. I have multiple devices that may belong to multiple vlans, so I shall have duplicated hosts, which I don't like @ all. In order to keep things easy I only use mac-"authentication", later 802.1x EAP wit user+pass ( EAP Mschapv2 or TTLS). The idea is to declare in one single place the vlans one host may be able to connect, from the first top priority vlan to try up to the last option.. Well, I'm using the radiusprofile attribute radiusTunnelGroupId to store the Vlan name or tag. If I set one host/user with the next "vlan tag" attributes: Uid=John.Cleese,ou=People,ou=Radius,xxxxxxxxxxxxxx ... radiusTunnelGroupId: 666 (Mad Scientist) radiusTunnelGroupId: 128 (Nut Engineers) radiusTunnelGroupId: 256 (Nerd IT guys) radiusTunnelGroupId: 51 ( blackhole control) ... userPassword XXXXXXXXXXXXXXXXX Or Uid=<mac-address>,ou=Devices,ou=Radius,xxxxxxxxxxxxxx cn: stupid.device.001 ... radiusTunnelGroupId: 666 (Mad scientist) radiusTunnelGroupId: 999 (FusionCore) ... The host/user, may have rights to connect to those vlans, from let say top prority (666) to the lesser one (51) [ldap attribute order], in the first case, and only 666 or 999 in the second. Some areas are restrited so only the ones with physical access may get connection to the right vlan. The problem is how may I configure radius so it may choose the "correct" vlan. Or try one and if not possible keep trying until no more choices are available. I also have "hungroups", but I realized, if I'm not wrong, that freeradius only gets the first match, never tries the others, so: BlackHoleCore NAS-IP-Address == 10.0.0.1 VacuumCleaner NAS-IP-Address == 10.0.0.1 CoffeeMachine NAS-IP-Address == 10.0.0.1 When in freeradius "users" file I try "DEFAULT Huntgroup-Name == CoffeeMachine, Auth-Type = LDAPCoffee" it will never get in, because NAS-IP 10.0.0.1 will always match BlackHoleCore, never the others.( It's ok?? Or I'm wrong or may I have to change something to get/force/allow multiple target??) A "problem" I found,I'm a newby in radius, is that I'm not able to choose between the diferent vlans, as radius always try to match first value of multivaluated attributes (radiusTunnelGroupId). I'm wrong again? Freeradius send the ACK-OK to the NAS-switch with the target Vlan for this device. If the "sent" vlan is not extended to that switch-NAS there fails silently( @ least seems so in Extreme networks), so the device is not connected. I was trying to use the "checkval" module, but I don't know it's the way it was thinked off. As far as I undertand I can not use it, maybe I'm wrong again. There's any elegant way to do it? Is that aproach, try the "next vlan" if exists @ ldap, possible, how? Many Thanks.

3 6