- Freeradius-Users - lists.freeradius.org

How *not* to do research: MS NPS vs FreeRADIUS
by Alan DeKok 20 Jun '19

20 Jun '19

I found a fun paper today. Their conclusion? MS NPS is faster than FreeRADIUS! http://iajit.org/PDF/November%202019,%20No.%206/13255.pdf Some quotes, and my comments follow. The research revealed that FreeRADIUS by default allows the support for a variety of authentication methods including the ones using clear text passwords. This is okay if the implementer thinks of a broader compatibility but at the same time allows the network intruders may manipulate the user passwords. Additionally, FreeRADIUS was trying to initiate full authentication sessions when only reconnections were required. This ended up in increased overhead of the authentication system Comment: They didn't enable fast session resumption, so FreeRADIUS didn't use it. They then blamed FreeRADIUS for not using it. This is proven via the following statement: Overhead in reconnections were large in FreeRADIUS as it initiated a new EAP session altogether, resulting in an overhead nearly equal to that of a complete authentication phase. Comment: Yes, if you don't enable fast session resumption, FreeRADIUS does a complete authentication. It's not "nearly equal" to a complete authentication, it *is* a complete authentication. In addition to the RADIUS service, Microsoft NPS was capable of checking the health state of the connecting client and any non-compliant clients can be blocked or applied for automatic remediation of network health procedures. Comment: Not true. FreeRADIUS has had SoH support for a long time now. And further, it's not a surprise that MS products work together with proprietary MS protocols. Overhead in failed authentications were observed lower in Microsoft NPS Comment: Because FreeRADIUS has "reject_delay = 1" by default. For security reason. However, MS NPS doesn't do this. So it's less secure, but it's faster! Microsoft NPS has better performance for successfully authenticated sessions. Comment: Because they didn't change the default configuration. Which does all kinds of things that are useful to many people, but which aren't required for PEAP. The take-away is: * it's easy to generate fake statistics if you're willing to do a hack job of analysis * the default configuration of MS NPS is optimized for Windows and PEAP * the default configuration of FreeRADIUS is optimized to work everywhere Don't be fooled by nice graphs and polite lies. This only worth of this paper is to show people how *not* to write a paper. Alan DeKok.

2 1

clarification on eap configuration files and certificates
by Marco Santantonio 20 Jun '19

20 Jun '19

hi all, I have some doubts about eap module configuration file. In my organization we use a public CA for radius server certificates. The freeradius version is 3.0.12 from debian stable repository. What's the difference between: 1) setting only the server certificate in "certificate_file" and using "ca_file" to indicate the certificate of authority that issued "certificate_file" OR 2) set in "certificate_file" not only the server certificate, but also all of the CA certificates used to sign the server certificate and comment "ca_file" (this is my current configuration) I ask you this question because the ultimate goal is to deny use of EAP-TLS and allow only PEAP. I have read various posts with different solutions and I am a bit confused. Thank you! Marco -- **************************************** Marco Santantonio Direzione Sistemi Informativi, Portale, E-learning Sezione Fonia, VoIP e WiFi www.unito.it ****************************************

2 5

failed linking to libcrypto error during compilation from source
by Tal Nur 20 Jun '19

20 Jun '19

Hi all, I tried to compile FR from source on my Ubuntu 18.04 server according the instructions on wiki.freeradius.org.When I run ./configure command I got error: failed linking to libcrypto error I found the location of libcrypro.so.1.1. And run again ./configure command with explicit path to libcrypto.so..1.1: ./configure --with-openssl-lib-dir=/usr/lib/x86_64-linux-gnu/But I got again the same error message: failed linking to libcrypto error How can I fix the problem? Regards, nurtal

3 2

Exec-Program-Wait not working
by Gianni Costanzi 19 Jun '19

19 Jun '19

Hi, I was using the following syntax on Freeradius 2.x to determine if a user could connect to a particular IP address, even if the authentication succeeds, based on some parameters passed to a script: XXX747 Auth-Type = System, Realm == imp Service-Type := Login-User, cisco-avpair = "shell:priv-lvl=2", Exec-Program-Wait = "/opt/script/radius/bin/check_operator_access.sh %{NAS-IP-Address} %{User-Name} %{Realm}" It worked on my old 2.x installation, now I'm on the last version available on Red Hat Enterprise 7, which is 3.0.13-10.el7_6. The syntax gives no error, but the script is not invoked (it contains an invocation to logger system command to put an entry in /var/log/messages and I can't see it), even if the above entry in the users (authorize) file is mached. What could be the problem? If this is the wrong way to implement this check can you give me an hint on how should I do it on 3.x Freeradius installation? Wed Jun 19 17:01:52 2019 : Debug: (12) files: users: Matched entry XXX747 at line 497 Wed Jun 19 17:01:52 2019 : Debug: /opt/script/radius/bin/check_operator_access.sh %{NAS-IP-Address} %{User-Name} %{Realm} Wed Jun 19 17:01:52 2019 : Debug: Parsed xlat tree: Wed Jun 19 17:01:52 2019 : Debug: literal --> /opt/script/radius/bin/check_operator_access.sh Wed Jun 19 17:01:52 2019 : Debug: attribute --> NAS-IP-Address Wed Jun 19 17:01:52 2019 : Debug: literal --> Wed Jun 19 17:01:52 2019 : Debug: attribute --> User-Name Wed Jun 19 17:01:52 2019 : Debug: literal --> Wed Jun 19 17:01:52 2019 : Debug: attribute --> Realm Wed Jun 19 17:01:52 2019 : Debug: (12) files: EXPAND /opt/script/radius/bin/check_operator_access.sh %{NAS-IP-Address} %{User-Name} %{Realm} Wed Jun 19 17:01:52 2019 : Debug: (12) files: --> /opt/script/radius/bin/check_operator_access.sh 172.16.120.218 XXX747@imp imp Wed Jun 19 17:01:52 2019 : Debug: (12) modsingle[authorize]: returned from files (rlm_files) Wed Jun 19 17:01:52 2019 : Debug: (12) [files] = ok Thank you in advance for any help. Best regards, Gianni Costanzi

3 14

get statistics for sql connection pool
by Daniel Finger 18 Jun '19

18 Jun '19

Hi! If the radius server is running for about a month, I get messages like "No connections available and at max connection limit". Looking at the database, only very few connections are really connected (for example 2 out of 50), there are no slow queries, not much traffic (maybe one or two packets per second) and I really don't see a reason for this. Restarting freeRADIUS immediately fixes the problem. I suspect I am using a module (I have 2 own modules running) which does not return a connection to the connection pool under some circumstances. Is it possible to get statistics about the sql connection pool usage? This could help me size the number of connections I need and get a hint, if I am reaching the limit, before I hit it. Greetings, Daniel Finger

2 2

hourly auth logs -> change to daily
by Colleen Morrissey 18 Jun '19

18 Jun '19

Hopefully easy question - I recently rebuilt to v3.0.18 and the authentication logs in /usr/local/var/log/radius.log are being created hourly. I want to change this to daily - where is the config for this? I have my radacct detail files going daily via mods-enabled/detail but can't figure out config for the file = ${logdir}/radius.log Thank you in advance, Colleen

2 1

Debian buster packages from packages.freeradius.com?
by Mathieu Simon (Lists) 17 Jun '19

17 Jun '19

Hi I didn't want to hijack that other thread about Ubuntu bionic but was reminded about the question that I wanted to ask but then forgot to for some time: Are there plans to provide packags for Debian buster on that repository? I've been testing Debian buster, even though it is not yet officially released, however the stream of significant updates has slowed quite a bit (due to the version freeze in effect) and for many cases it already looks quite OK thus the Debian project looks like it might release make it a release in the next month or so. I've done a random package build from source and for what I can tell, it seems to be working for on my testing system, but I take these results with a grain of salt. ;-) Regards Mathieu

2 1

Rebuild of bionic package from packages.networkradius.com?
by Enno Gröper 17 Jun '19

17 Jun '19

Hi, last week Ubuntu pushed their libssl 1.1.0 -> 1.1.1 updates to the bionic-updates channel [1]. Since then the "upstream" package of freeradius from packages.networkradius.com stopped working: libssl version mismatch. built: 1010007f linked: 1010100f Are there any plans to publish an updated version? At the moment we need to put libssl on hold, which I'm not very comfortable with. Micha Ballmann asked a similar question last Friday, but didn't get an answer using this channel. Unfortunately I wasn't able to find the other channel(s) he seems to have used. Best regards, Enno [1] https://lists.ubuntu.com/archives/ubuntu-devel/2018-December/040567.html

3 2

Re: Need help on "ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject"
by Parth Gajjar (pagajjar) 17 Jun '19

17 Jun '19

Hi Team, I am facing below error, while using free radius. < radiusd.conf is attached> We are using dot1x, we have enabled pap & chap in the config. Added clients & users in both files. Ready to process requests (0) Received Access-Request Id 137 from 10.106.26.212:1645 to 10.105.41.247:1812 length 51 (0) User-Password = "hello" (0) User-Name = "parth" (0) NAS-IP-Address = 10.106.26.212 (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [parth/hello] (from client 10.106.26.212 port 0) (0) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (1) Received Access-Request Id 119 from 10.106.26.212:62566 to 10.105.41.247:1812 length 57 (1) User-Password = "hello" (1) User-Name = "parth" (1) NAS-IP-Address = 10.106.26.212 (1) Event-Timestamp = "Jan 1 1970 05:30:01 IST" (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) Post-Auth-Type sub-section not found. Ignoring. (1) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [parth/hello] (from client 10.106.26.212 port 0) (1) Delaying response for 1.000000 seconds (0) Sending delayed response (0) Sent Access-Reject Id 137 from 10.105.41.247:1812 to 10.106.26.212:1645 length 20 Waking up in 0.6 seconds. Waking up in 0.3 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 119 from 10.105.41.247:1812 to 10.106.26.212:62566 length 20 Waking up in 3.0 seconds. (0) Cleaning up request packet ID 137 with timestamp +8 Waking up in 0.9 seconds. (2) Received Access-Request Id 137 from 10.106.26.212:1645 to 10.105.41.247:1812 length 51 (2) User-Password = "hello" (2) User-Name = "parth" (2) NAS-IP-Address = 10.106.26.212 (2) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject (2) Post-Auth-Type sub-section not found. Ignoring. (2) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [parth/hello] (from client 10.106.26.212 port 0) (2) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Thanks & Regards, Parth Gajjar

2 4

Is there way to convert output octets and input octets to KB
by Mustafa Nassir 17 Jun '19

17 Jun '19

Hi there As I say from title is there any way to convert output and input octets to KB because I have small problem when I add to mysql value with 12 number in radtest I get small error it's give me the result just 10 number and note what I insert in SQL , I insert I SQL 10737418240 to limit my users 10 GB for total octets but in radtest I get other result but if I add 10 8 number I get same number in result any help for this ?

3 11