- Freeradius-Users - lists.freeradius.org

RE: Error starting radiusd when specifying private_key_password (OPEN)
by Per.Weisteen＠telenor.com 23 Aug '20

23 Aug '20

Hi Alan and thanks for your response. > -----Original Message----- > From: Freeradius-Users <freeradius-users- > bounces+per.weisteen=telenor.com(a)lists.freeradius.org> On Behalf Of > Alan DeKok > Sent: 21. august 2020 17:30 > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Error starting radiusd when specifying private_key_password > (INTERNAL) > > On Aug 21, 2020, at 10:06 AM, Per.Weisteen(a)telenor.com wrote: > > I've installed FreeRADIUS 3.0.13 on CentOS 7 and generated my own set of > CA, intermediate and server certificates using openssl version 1.0.2k-fips. > > Certificates etc is generated using > > https://jamielinux.com/docs/openssl-certificate-authority/ modified > > with info from > > https://devcentral.f5.com/s/articles/building-an-openssl-certificate-a > > uthority-introduction-and-design-considerations-for-elliptical-curves- > > 27720 > > That should be fine. > > > > > > > I've configured mods-enabled/eap using a private_key_password with a > length of 20 characters. > > Starting in debug mode I get error messages : > > > > tls: Failed reading private key file "/etc/raddb/certs/oslo-radius01v4- > test.nsc.no.pem" > > tls: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad > > decrypt > > tls: error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 > > cipherfinal error > > tls: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe > > crypt error > > tls: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib > > tls: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib > > rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to > > initialise rlm_eap_tls > > /etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" > > Weird. There is no limit on the length of the private_key_password. > > Are there special characters in it? You might need to quote the password, > and escape things. i.e. instead of: > > private_key_password = abcd'def > > do > > private_key_password = "abc'def" > No special characters, just upper/lower case and numbers. Tried with quotes though but that didn't work any better. Could I increase debug level and get some more details on the error ? > > If I comment out the private_key_password statement I'm prompted for > the password instead : > > > > Enter PEM pass phrase: > > > > Using the same password as specified in private_key_password the startup > seems to start ok. > > > > Any suggestions ? > > We just read the password from the configuration file and pass it to > OpenSSL. There's very little processing done by us. > > Alan DeKok. > Per Weisteen > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Error starting radiusd when specifying private_key_password (INTERNAL)
by Per.Weisteen＠telenor.com 21 Aug '20

21 Aug '20

Hi I've installed FreeRADIUS 3.0.13 on CentOS 7 and generated my own set of CA, intermediate and server certificates using openssl version 1.0.2k-fips. Certificates etc is generated using https://jamielinux.com/docs/openssl-certificate-authority/ modified with info from https://devcentral.f5.com/s/articles/building-an-openssl-certificate-author… I've configured mods-enabled/eap using a private_key_password with a length of 20 characters. Starting in debug mode I get error messages : tls: Failed reading private key file "/etc/raddb/certs/oslo-radius01v4-test.nsc.no.pem" tls: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt tls: error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error tls: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error tls: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib tls: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to initialise rlm_eap_tls /etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" If I comment out the private_key_password statement I'm prompted for the password instead : Enter PEM pass phrase: Using the same password as specified in private_key_password the startup seems to start ok. Any suggestions ? ./PerW

2 1

FR 3.0.21 : Failed adding proxy socket: Too many open sockets
by Arnaud LAURIOU 21 Aug '20

21 Aug '20

Hi, We are upgrading our eduroam proxy server to FR 3.0.21. We have ~550 clients and home_server. When we start FR, it seems that the number of udp socket keep increases, we have a lot of log lines like : Info: ... adding new socket proxy address * port 50740 Until this one : Error: Failed adding proxy socket: Too many open sockets Then, some proxied requests are still working fine but other ones (new ones which need a new socket ?) are rejected : (365476) Tue Aug 18 15:05:46 2020: ERROR: proxy: Failed allocating Id for proxied request With netstat or lsof, udp sockets are opened but not so many : $ lsof -p <freeradius_pid> | grep UDP | wc -l 259 Any idea how to solve this issue ? Regards, Arnaud Lauriou

3 8

Radius - radpostauth
by Eric Aguilar 20 Aug '20

20 Aug '20

Hello all, We suddenly started seeing strange entries in the radpostauth table - has anyone encountered something similar? Captura de pantalla de 2020-08-19 18-39-28.png (20 K) <https://mail.google.com/mail/u/1?ui=2&ik=4e1006f73e&attid=0.1&permmsgid=msg…>

2 3

query on freeradius-server ocsp function and rlm_unbound
by SIMON BABY 19 Aug '20

19 Aug '20

Hello, My name is Simon and I am new to this group. I have some basic queries regarding the ocsp functionality in freeradius-server code. I am referring to the file freeradius-server-3.0.17/src/main/tls.c with below code sample. RDEBUG2("ocsp: Using responder URL \"http://%s:%s%s\"", host, port, path); /* Check host and port length are sane, then create Host: HTTP header */ if ((strlen(host) + strlen(port) + 2) > sizeof(hostheader)) { RWDEBUG("ocsp: Host and port too long"); goto skipped; } snprintf(hostheader, sizeof(hostheader), "%s:%s", host, port); /* Setup BIO socket to OCSP responder */ cbio = BIO_new_connect(host); 1. How are we resolving the OCSP responder IP address from the name server ? Are we using DNS/DNSSEC (unbound APIs) ? 2. Do we really need to do DNSSEC validation for resolving OCSP domain names? 3. May I know in which file the BIO_ APIs are implemented? 4. what is the use of the rlm_unbound module in freeradius-server package? Can I use it for resolving OCSP name servers? If so, May I know the process to use it. Thank you for you time. Regards Simon

3 5

FR 3.0.21 on Debian Buster delivering strange cert+chain?
by Martin Pauly 19 Aug '20

19 Aug '20

Hi all, I'm getting an obscure effect with FR 3.0.21 on a fresh Debian Buster installation (I compiled myself from the download package). Despite an identical config (as compared to the predecessor with FR 3.017 on Debian Jessie), some clients will not match the server cert to the chain provided. Seemingly, these are all Apple supplicants and also eapol_test, see attached output Any idea what's going wrong? I've just seen there is FR 3.0.21 on buster-backports, are there any related changes in there? TIA, Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 9

Having issues interpreting ldap search/filter attributes
by Steve Phillips 19 Aug '20

19 Aug '20

Hi There I’m really hoping someone out there can help, Freeradius version: 3.0.13 (installed via rpm on rhel 7) I have a reasonably simple (to my mind) setup that for some reason doesn’t seem to exist on the internet after much fruitless searching. In essence, I am performing PAP auth to free radius which then binds as the user to AD via LDAP and performs an authentication It then is supposed to return the groups the user is a member of and then I use the “files” directive to match a group and return a reply attribute I’m now busy pulling my hair out trying to work out how to debug what’s going on in the background, as I am having amazingly bad luck trying to work out how the group filter works (and yes, I did read the ldap module comments and couldn’t work anything out from this, or the rlm_ldap wiki) Running radiusd -X gives some information that it is attempting to check groups but claims the user is not a group member (see below for the log) So far I’ve tried #groupfilter = '(objectclass=*)' #groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDN}))" #groupmembership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" #groupmembership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))" #groupmembership_filter = '(|(member=%{control:LDAP-UserDN})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))' groupmembership_attribute = 'memberOf' #groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" #groupmembership_filter = "(sAMAccountName=%{User-Name})" groupmembership_filter = "(&(objectcategory=group)(member:1.2.840.113556.1.4.1941:=%{control:Ldap-UserDn}))" With some of these just hoping to get _anything_ to return (#groupmembership_filter = "(sAMAccountName=%{User-Name})") About the only thing I’ve had success in plugging into ldapsearch was the “(sAMAccountName=<my username>)” hence the attempt at doing that because it DID actually return “memberOf” attributes. I guess what I’m trying to do, is work out what I am supposed to plug into ldap search as every time I try it returns nothing. Is there a way to tell freeradius to print out what it thinks the various variables are? Like, %{Ldap-UserDN} I can see from the “sites-enabled” file as I can see it being set with.. update control { Ldap-UserDN := "%{User-Name}(a)xample.com" Auth-Type := LDAP } Is there an easy to follow guide for ldapsearch that describes that the (|(&(<attribute>=<value>)(<attribute>=<value>))) bits even mean? (primarily the (|(&( bit, as I can do a single <attribute>=<value> Search and get that to work) -- log from radisud -X – Ready to process requests (1) Received Access-Request Id 1 from 10.0.0.5:50847 to 10.0.0.10:1812 length 53 (1) User-Name = "username123" (1) User-Password = "password123" (1) NAS-IP-Address = 1.2.3.4 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (1) auth_log: --> /var/log/radius/radacct/10.0.0.5/auth-detail-20200810 (1) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.0.0.5/auth-detail-20200810 (1) auth_log: EXPAND %t (1) auth_log: --> Mon Aug 10 15:15:19 2020 (1) [auth_log] = ok (1) if (&User-Password) { (1) if (&User-Password) -> TRUE (1) if (&User-Password) { (1) update control { (1) EXPAND %{User-Name}(a)exmple.com (1) --> username123(a)example.com (1) Ldap-UserDN := username123(a)example.com (1) Auth-Type := LDAP (1) } # update control = noop (1) } # if (&User-Password) = noop (1) ... skipping else: Preceding "if" was taken (1) files: Searching for user in group "access_2fa" rlm_ldap (ldap): Reserved connection (5) (1) files: Using user DN from request "username123(a)example.com" rlm_ldap (ldap): Released connection (5) Need 3 more connections to reach min connections (5) rlm_ldap (ldap): Opening additional connection (7), 1 of 8 pending slots used rlm_ldap (ldap): Connecting to ldap://10.0.0.50:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) files: User is not a member of "ost_access_2fa" (1) files: Searching for user in group "OST_ACCESS_2FA" rlm_ldap (ldap): Reserved connection (6) (1) files: Using user DN from request "username123(a)example.com" rlm_ldap (ldap): Released connection (6) (1) files: User is not a member of " ACCESS_2FA" . . (note: The user in question IS in the group access_2fa and it isn’t a nested group)

2 3

Wrong type of Attribute ERX-Inner-Tag-Protocol-Id is octets should be string
by Daniel Finger 18 Aug '20

18 Aug '20

Hi! Our Juniper MX does not understand the Attribute ERX-Inner-Tag-Protocol-Id. I put ERX-Inner-Tag-Protocol-Id := 0x88a8 in our Database, but the MX logged: Inner-Vlan-Tag-Protocol-Id (Juniper-ERX-VSA), Err:"Attribute value is invalid" Decoded-val:0(0x0) authd_radius_parse_message: Error parsing common avps Framework - module(radius) return: MALFORMED DATA When I change the type from octets to string it works like a charm: -ATTRIBUTE ERX-Inner-Tag-Protocol-Id 211 octets +ATTRIBUTE ERX-Inner-Tag-Protocol-Id 211 string Their documentation states: hexadecimal string: - range = 0x600 through 0xffff. - 0x8100 = Inner VLAN tag for designated L2BSA subscribers Could you please change the dictionary.erx to use string instead of octets? TIA, Daniel Finger

2 1

after reinstallation of Freeradius on Ubuntu 20.04, cannot start service
by Gareth Tomlinson 17 Aug '20

17 Aug '20

Removed / purged freeradius after discovering daloradius didn't do what I needed, reinstalled and now cannot start the service. The issue SEEMS to be a missing shared library: freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; disabled; vendor preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Mon 2020-08-17 17:38:53 EDT; 15ms ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 11756 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cxm -lstdout (code=exited, status=127) Processing triggers for systemd (245.4-4ubuntu3.2) ... garetht@ecxbackup:/usr/lib$ sudo freeradius -v freeradius: error while loading shared libraries: libfreeradius-server.so: cannot open shared object file: No such file or directory garetht@ecxbackup:/usr/lib$ locate freeradius-server.so /usr/lib/freeradius/libfreeradius-server.so freeradius -CX freeradius: error while loading shared libraries: libfreeradius-server.so: cannot open shared object file: No such file or directory

2 1

Failover with Active Directory
by Robert Miller 17 Aug '20

17 Aug '20

Hello all, I have been doing a lot of research and reading to set up freeradius to work with my situation. The final issue I'm not able to solve is failover. It seems when I test by disabling the network card on one of my Active Directory servers, freeradius no longer works correctly. When watching the debug it is usually super quick, when one AD is down the debug is really slow. I believe that it being slow is the reason why the authorizations fail, they timeout. As soon as I bring either one of the downed ADs back online it works well. In both default and inner-tunnel I have failover setup like this: authorized { redundant { ldap1 ldap2 } I have also setup ldap1 and ldap2 pool { start = 0 My end goal with freeradius is to use AD for authorization, then freeradius will to the authentication. I have one policy setup to find allowed groups for the user. CentOS 8 with Freeradius 3.0.17 Thanks, Rob

2 4