- Freeradius-Users - lists.freeradius.org

Your Amazon.com Inquiry
by Amazon.com 24 Aug '20

24 Aug '20

Thank you for writing to Amazon.com to bring this to our attention. Your message has been forwarded to our security department, and we will investigate the situation. Please note that you may not receive a personal response. In all likelihood, the message you received was not sent to you by Amazon.com. We strongly advise that you *not* send any information about yourself back to this individual (especially your credit card number or any personal information). If you have already submitted any personal information to this person via e-mail or on a potentially fraudulent web site, you may wish to contact Customer Service for assistance. To send an e-mail to Customer Service, please visit https://www.amazon.com/contact-us In the future, if you are ever uncertain of the validity of an e-mail, even from us, don't click on any supplied links--instead, type our web site address "https://www.amazon.com" directly into your browser and follow the regular links to Your Account. Many unscrupulous spoofers mislead consumers by displaying one URL while taking the visitor to another. By typing in a well-known address you can avoid this trick. Also, please be assured that Amazon.com is not in the business of selling customer information. Many spammers and spoofers use programs that randomly generate e-mail addresses, in the hope that some percentage of these randomly-generated addresses will actually exist. If you are trying to contact us about something other than a spoofed e-mail message, please contact Customer Service for assistance. To send an e-mail to Customer Service, please visit https://www.amazon.com/contact-us/ If you encounter any other uses of the Amazon.com name that you think may be fraudulent, please do not hesitate to contact us again. Thank you again for taking the time to notify us of this situation. Sincerely, Amazon.com https://www.amazon.com/

1 0

RE: Error starting radiusd when specifying private_key_password (INTERNAL)
by Per.Weisteen＠telenor.com 24 Aug '20

24 Aug '20

Hi Found the error. Used keepass to store passphrase and managed to use autotype to enter passphrase when generating keys. This added some spaces in front of the passphrase itself without me noticing it. ./PerW > -----Original Message----- > From: Freeradius-Users <freeradius-users- > bounces+per.weisteen=telenor.com(a)lists.freeradius.org> On Behalf Of > Alan DeKok > Sent: 23. august 2020 22:49 > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Error starting radiusd when specifying private_key_password > (OPEN) > > On Aug 23, 2020, at 3:49 PM, Per.Weisteen(a)telenor.com wrote: > > No special characters, just upper/lower case and numbers. Tried with > quotes though but that didn't work any better. > > That's not good. > > > Could I increase debug level and get some more details on the error ? > > Not really. We just take the password from the configuration file, and pass > it directly to OpenSSL. There's really very little which can go wrong here. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Freeradius 3. How to stop processing when ldap got the successful match.
by Ramon Escribà Lemiña 24 Aug '20

24 Aug '20

Hi, in my old working freeradius 2.1, on /etc/raddb/sites-available/default, in authorize section I have an ldap declaration to allow a successful match to stop any extra authorization process. So only gets the actual attributes got from ldap to answer the query discarding adding other/default new ones stored in users files. "files" is after "ldap" in this case. VLANxxx { ok = return } On freeradius 3.0.17 this seems now working anymore, so it finally add the default "users" file attributes. "files" is the last catch all too here. How can I tell freeradius 3 to stop processing, and get the already got ldap return values as the good ones?? Regards.

2 1

Auto connect users using freeradius
by Muhammed Buvaydani 24 Aug '20

24 Aug '20

Hello, I am trying to configure freeradius to auto-authenticate or connect users. let's say I have mac address table which has a whitelist for mac address, how can I configure freeradius to connect these mac address automatically without a web page, I don't know how can I do that, actually I am working on hotspot system, I can connect users when they send request from a web page, but what about the devices which do not have web browser like (Printer), how can I do that.

2 1

RE: Error starting radiusd when specifying private_key_password (OPEN)
by Per.Weisteen＠telenor.com 23 Aug '20

23 Aug '20

Hi Alan and thanks for your response. > -----Original Message----- > From: Freeradius-Users <freeradius-users- > bounces+per.weisteen=telenor.com(a)lists.freeradius.org> On Behalf Of > Alan DeKok > Sent: 21. august 2020 17:30 > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Error starting radiusd when specifying private_key_password > (INTERNAL) > > On Aug 21, 2020, at 10:06 AM, Per.Weisteen(a)telenor.com wrote: > > I've installed FreeRADIUS 3.0.13 on CentOS 7 and generated my own set of > CA, intermediate and server certificates using openssl version 1.0.2k-fips. > > Certificates etc is generated using > > https://jamielinux.com/docs/openssl-certificate-authority/ modified > > with info from > > https://devcentral.f5.com/s/articles/building-an-openssl-certificate-a > > uthority-introduction-and-design-considerations-for-elliptical-curves- > > 27720 > > That should be fine. > > > > > > > I've configured mods-enabled/eap using a private_key_password with a > length of 20 characters. > > Starting in debug mode I get error messages : > > > > tls: Failed reading private key file "/etc/raddb/certs/oslo-radius01v4- > test.nsc.no.pem" > > tls: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad > > decrypt > > tls: error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 > > cipherfinal error > > tls: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe > > crypt error > > tls: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib > > tls: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib > > rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to > > initialise rlm_eap_tls > > /etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" > > Weird. There is no limit on the length of the private_key_password. > > Are there special characters in it? You might need to quote the password, > and escape things. i.e. instead of: > > private_key_password = abcd'def > > do > > private_key_password = "abc'def" > No special characters, just upper/lower case and numbers. Tried with quotes though but that didn't work any better. Could I increase debug level and get some more details on the error ? > > If I comment out the private_key_password statement I'm prompted for > the password instead : > > > > Enter PEM pass phrase: > > > > Using the same password as specified in private_key_password the startup > seems to start ok. > > > > Any suggestions ? > > We just read the password from the configuration file and pass it to > OpenSSL. There's very little processing done by us. > > Alan DeKok. > Per Weisteen > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Error starting radiusd when specifying private_key_password (INTERNAL)
by Per.Weisteen＠telenor.com 21 Aug '20

21 Aug '20

Hi I've installed FreeRADIUS 3.0.13 on CentOS 7 and generated my own set of CA, intermediate and server certificates using openssl version 1.0.2k-fips. Certificates etc is generated using https://jamielinux.com/docs/openssl-certificate-authority/ modified with info from https://devcentral.f5.com/s/articles/building-an-openssl-certificate-author… I've configured mods-enabled/eap using a private_key_password with a length of 20 characters. Starting in debug mode I get error messages : tls: Failed reading private key file "/etc/raddb/certs/oslo-radius01v4-test.nsc.no.pem" tls: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt tls: error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error tls: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error tls: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib tls: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to initialise rlm_eap_tls /etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" If I comment out the private_key_password statement I'm prompted for the password instead : Enter PEM pass phrase: Using the same password as specified in private_key_password the startup seems to start ok. Any suggestions ? ./PerW

2 1

FR 3.0.21 : Failed adding proxy socket: Too many open sockets
by Arnaud LAURIOU 21 Aug '20

21 Aug '20

Hi, We are upgrading our eduroam proxy server to FR 3.0.21. We have ~550 clients and home_server. When we start FR, it seems that the number of udp socket keep increases, we have a lot of log lines like : Info: ... adding new socket proxy address * port 50740 Until this one : Error: Failed adding proxy socket: Too many open sockets Then, some proxied requests are still working fine but other ones (new ones which need a new socket ?) are rejected : (365476) Tue Aug 18 15:05:46 2020: ERROR: proxy: Failed allocating Id for proxied request With netstat or lsof, udp sockets are opened but not so many : $ lsof -p <freeradius_pid> | grep UDP | wc -l 259 Any idea how to solve this issue ? Regards, Arnaud Lauriou

3 8

Radius - radpostauth
by Eric Aguilar 20 Aug '20

20 Aug '20

Hello all, We suddenly started seeing strange entries in the radpostauth table - has anyone encountered something similar? Captura de pantalla de 2020-08-19 18-39-28.png (20 K) <https://mail.google.com/mail/u/1?ui=2&ik=4e1006f73e&attid=0.1&permmsgid=msg…>

2 3

query on freeradius-server ocsp function and rlm_unbound
by SIMON BABY 19 Aug '20

19 Aug '20

Hello, My name is Simon and I am new to this group. I have some basic queries regarding the ocsp functionality in freeradius-server code. I am referring to the file freeradius-server-3.0.17/src/main/tls.c with below code sample. RDEBUG2("ocsp: Using responder URL \"http://%s:%s%s\"", host, port, path); /* Check host and port length are sane, then create Host: HTTP header */ if ((strlen(host) + strlen(port) + 2) > sizeof(hostheader)) { RWDEBUG("ocsp: Host and port too long"); goto skipped; } snprintf(hostheader, sizeof(hostheader), "%s:%s", host, port); /* Setup BIO socket to OCSP responder */ cbio = BIO_new_connect(host); 1. How are we resolving the OCSP responder IP address from the name server ? Are we using DNS/DNSSEC (unbound APIs) ? 2. Do we really need to do DNSSEC validation for resolving OCSP domain names? 3. May I know in which file the BIO_ APIs are implemented? 4. what is the use of the rlm_unbound module in freeradius-server package? Can I use it for resolving OCSP name servers? If so, May I know the process to use it. Thank you for you time. Regards Simon

3 5

FR 3.0.21 on Debian Buster delivering strange cert+chain?
by Martin Pauly 19 Aug '20

19 Aug '20

Hi all, I'm getting an obscure effect with FR 3.0.21 on a fresh Debian Buster installation (I compiled myself from the download package). Despite an identical config (as compared to the predecessor with FR 3.017 on Debian Jessie), some clients will not match the server cert to the chain provided. Seemingly, these are all Apple supplicants and also eapol_test, see attached output Any idea what's going wrong? I've just seen there is FR 3.0.21 on buster-backports, are there any related changes in there? TIA, Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 9