- Freeradius-Users - lists.freeradius.org

IPv6 Accounting + Volume Count
by Srijan 02 Jun '19

02 Jun '19

Hello, We are on verge of deploying Dual Stack mode to customer, while testing we found client v6 data is not counting for volume count. Inserting it to new column for v6 octets like v4 in radacct table modifing dialup.conf file will be fine as we need change lots of code to count user volume. Is there any way to add both & insert in existing column "acctinputoctets"/"acctoutputoctets". Acct-Input-Octets = 1892471418 Acct-Output-Octets = 1567085180 IPv6-Acct-Input-Octets = 539808892 IPv6-Acct-Output-Octets = 712113623 Regards

3 2

eap_ttls: ERROR: TLS Alert write:fatal:bad record mac
by Fredrik Lundhag 01 Jun '19

01 Jun '19

Hey guys, After a random interval (hours) our wifi clients gets disconnected after this log entry: ``` May 24 09:28:15 gra1-radius-01 : (205) Login incorrect (eap_ttls: TLS Alert write:fatal:bad record mac): [jolt] (from client Flattr port 85 cli 784f434d22ba) May 24 09:28:15 gra1-radius-01 : (205) eap_ttls: ERROR: TLS Alert write:fatal:bad record mac ``` This is on Alpine 3.9 with freeradius-eap-3.0.17-r5, and openssl-1.1.1b-r1. This is my first time setting this up, so bear with me. I'm running this together with an Asus router with EAP-TTLS and having mainly macbooks in this office. I have tried to search for others with this issue, but can't find much that seems related, I have set `tls_max_version = "1.2"` (to not trigger any tls1.3 bugs) but the issue still occurs. ## Output of ``[radiusd|freeradius] -fxx -l stdout`` if using eg RADIUS with TLS) ```text Waking up in 0.3 seconds. Thread 4 got semaphore Thread 4 handling request 231, (47 handled so far) (231) Received Access-Request Id 2 from 172.16.48.214:48268 to 172.16.54.20:1812 length 197 (231) User-Name = "jolt" (231) NAS-IP-Address = 172.16.48.214 (231) Called-Station-Id = "40b076368a34" (231) Calling-Station-Id = "784f434d22ba" (231) NAS-Identifier = "40b076368a34" (231) NAS-Port = 85 (231) Framed-MTU = 1400 (231) State = 0x63de82e165d997993bc43b07e7488f96 (231) NAS-Port-Type = Wireless-802.11 (231) EAP-Message = 0x020700431580000000391703030034e3e40e58ae7f7295d08781537dec10239ab8dc0c805e653756f82652fbb22f2840139d3800015443f177ff4266a1afcafaf4f27a (231) Message-Authenticator = 0x4ebdb0708a803b03cc27cd1f666e128a (231) session-state: No cached attributes (231) # Executing section authorize from file /etc/raddb/sites-enabled/default (231) authorize { (231) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (231) auth_log: --> /var/log/radius/radacct/172.16.48.214/auth-detail-20190528 (231) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.48.214/auth-detail-20190528 (231) auth_log: EXPAND %t (231) auth_log: --> Tue May 28 09:27:49 2019 (231) [auth_log] = ok (231) eap: Peer sent EAP Response (code 2) ID 7 length 67 (231) eap: Continuing tunnel setup (231) [eap] = ok (231) } # authorize = ok (231) Found Auth-Type = eap (231) # Executing group from file /etc/raddb/sites-enabled/default (231) authenticate { (231) eap: Expiring EAP session with state 0x7833efcb7832e926 (231) eap: Finished EAP session with state 0x63de82e165d99799 (231) eap: Previous EAP request found for state 0x63de82e165d99799, released from the list (231) eap: Peer sent packet with method EAP TTLS (21) (231) eap: Calling submodule eap_ttls to process data (231) eap_ttls: Authenticate (231) eap_ttls: Continuing EAP-TLS (231) eap_ttls: Peer indicated complete TLS record size will be 57 bytes (231) eap_ttls: Got complete TLS record (57 bytes) (231) eap_ttls: [eaptls verify] = length included (231) eap_ttls: >>> send TLS 1.2 [length 0002] (231) eap_ttls: ERROR: TLS Alert write:fatal:bad record mac (231) eap_ttls: SSL_read Error (231) eap_ttls: ERROR: Error in fragmentation logic (231) eap_ttls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1408F119:SSL routines:ssl3_get_record:decryption failed or bad record mac (231) eap_ttls: ERROR: System call (I/O) error (-1) (231) eap_ttls: ERROR: [eaptls process] = fail (231) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (231) eap: Sending EAP Failure (code 4) ID 7 length 4 (231) eap: Failed in EAP select (231) [eap] = invalid (231) } # authenticate = invalid (231) Failed to authenticate the user (231) Using Post-Auth-Type Reject (231) # Executing group from file /etc/raddb/sites-enabled/default (231) Post-Auth-Type REJECT { (231) attr_filter.access_reject: EXPAND %{User-Name} (231) attr_filter.access_reject: --> jolt (231) attr_filter.access_reject: Matched entry DEFAULT at line 11 (231) [attr_filter.access_reject] = updated (231) policy remove_reply_message_if_eap { (231) if (&reply:EAP-Message && &reply:Reply-Message) { (231) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (231) else { (231) [noop] = noop (231) } # else = noop (231) } # policy remove_reply_message_if_eap = noop (231) } # Post-Auth-Type REJECT = updated (231) Delaying response for 1.000000 seconds Thread 4 waiting to be assigned a request Waking up in 0.6 seconds. (231) Sending delayed response (231) Sent Access-Reject Id 2 from 172.16.54.20:1812 to 172.16.48.214:48268 length 44 (231) EAP-Message = 0x04070004 (231) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (231) Cleaning up request packet ID 2 with timestamp +330184 Ready to process requests Waking up in 0.3 seconds. Thread 3 got semaphore Thread 3 handling request 232, (47 handled so far) ``` Any guesses? -- Fredrik Lundhag wire.com <http://wire.com/>: @jolt

2 2

Trying to use sql module
by Matthew McTague 01 Jun '19

01 Jun '19

Hi, When I soft link raddb/mods-available/sql to raddb/mods-enabled/sql, and comment out $INCLUDE mods-enabled/sql in raddb/radiusd.conf, I get the below debug output, ending in a segmentation fault. The only other changes I have made since compiling were to set the dialect and database connection details in raddb/mods-available/sql. I've read each file that I've modified, and I'm unsure what is causing this issue. I'm using git to manage my changes, so can go back to the very beginning easily if I need to. Debug output: Info : FreeRADIUS Version 4.0.0 Info : Copyright 1999-2019 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/freeradius/raddb/dictionary" Debug : including configuration file /etc/freeradius/raddb/radiusd.conf Debug : including configuration file /etc/freeradius/raddb/clients.conf Debug : including configuration file /etc/freeradius/raddb/mods-enabled/sql Debug : including configuration file /etc/freeradius/raddb/mods-config/sql/driver/mysql Debug : including configuration file /etc/freeradius/raddb/mods-config/sql/main/mysql/queries.conf Debug : Including files in directory "/etc/freeradius/raddb/mods-enabled/" Debug : including configuration file /etc/freeradius/raddb/mods-enabled/always Debug : including configuration file /etc/freeradius/raddb/mods-enabled/attr_filter Debug : including configuration file /etc/freeradius/raddb/mods-enabled/cache_eap Debug : including configuration file /etc/freeradius/raddb/mods-enabled/chap Debug : including configuration file /etc/freeradius/raddb/mods-enabled/client Debug : including configuration file /etc/freeradius/raddb/mods-enabled/delay Debug : including configuration file /etc/freeradius/raddb/mods-enabled/detail Debug : including configuration file /etc/freeradius/raddb/mods-enabled/detail.log Debug : including configuration file /etc/freeradius/raddb/mods-enabled/digest Debug : including configuration file /etc/freeradius/raddb/mods-enabled/dhcpv4 Debug : including configuration file /etc/freeradius/raddb/mods-enabled/echo Debug : including configuration file /etc/freeradius/raddb/mods-enabled/escape Debug : including configuration file /etc/freeradius/raddb/mods-enabled/exec Debug : including configuration file /etc/freeradius/raddb/mods-enabled/expiration Debug : including configuration file /etc/freeradius/raddb/mods-enabled/expr Debug : including configuration file /etc/freeradius/raddb/mods-enabled/files Debug : including configuration file /etc/freeradius/raddb/mods-enabled/linelog Debug : including configuration file /etc/freeradius/raddb/mods-enabled/logintime Debug : including configuration file /etc/freeradius/raddb/mods-enabled/mschap Debug : including configuration file /etc/freeradius/raddb/mods-enabled/ntlm_auth Debug : including configuration file /etc/freeradius/raddb/mods-enabled/pap Debug : including configuration file /etc/freeradius/raddb/mods-enabled/passwd Debug : including configuration file /etc/freeradius/raddb/mods-enabled/radius Debug : including configuration file /etc/freeradius/raddb/mods-enabled/radutmp Debug : including configuration file /etc/freeradius/raddb/mods-enabled/soh Debug : including configuration file /etc/freeradius/raddb/mods-enabled/sradutmp Debug : including configuration file /etc/freeradius/raddb/mods-enabled/stats Debug : including configuration file /etc/freeradius/raddb/mods-enabled/unix Debug : including configuration file /etc/freeradius/raddb/mods-enabled/unpack Debug : including configuration file /etc/freeradius/raddb/mods-enabled/utf8 CAUGHT SIGNAL: Segmentation fault Backtrace of last 12 frames: /usr/local/lib/libfreeradius-util.so(fr_fault+0xe8)[0x7fe35056e6ec] /lib64/libpthread.so.0(+0xf5d0)[0x7fe34edc25d0] /lib64/libc.so.6(fgets+0x1b)[0x7fe34ea5483b] /usr/local/lib/libfreeradius-server.so(+0x15990)[0x7fe350c40990] /usr/local/lib/libfreeradius-server.so(+0x18216)[0x7fe350c43216] /usr/local/lib/libfreeradius-server.so(+0x165dc)[0x7fe350c415dc] /usr/local/lib/libfreeradius-server.so(+0x18216)[0x7fe350c43216] /usr/local/lib/libfreeradius-server.so(cf_file_read+0x23d)[0x7fe350c434b0] /usr/local/lib/libfreeradius-server.so(main_config_init+0x42c)[0x7fe350c62c8d] radiusd(main+0x95f)[0x404982] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7fe34ea083d5] radiusd[0x403e09] No panic action set _EXIT(139) CALLED src/lib/util/debug.c[921]. Last error was: Not built with support for LSAN interface Warm Regards, Matthew McTague Head of Infrastructure, Reliance Networks d. +64 3 222 6013 t. 0800 483 882 (+64 3 683 9090) Website | Service Desk | Internet Services Reliance Networks Ltd accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company.

2 3

Importing the GPG keys
by Paul Pathiakis 31 May '19

31 May '19

Hi, I was looking at the CentOS packages here: FreeRADIUS Packages - Network RADIUS | | | | | | | | | | | FreeRADIUS Packages - Network RADIUS | | | In the middle of the CentOS section, it says: gpg --keyserver keys.gnupg.net --recv-key 0x41382202 gpg --armor --export packages(a)networkradius.com > /etc/pki/rpm-gpg/packages.networkradius.com.gpg The first one fails with an error. Keyserver timed outKeyserver error Does anyone else have this problem? Is there a workaround? Thank you! P.

2 4

Freeradius Packages
by Nicolas Breuer 30 May '19

30 May '19

Hello, Is there a way to change the link to a more recent mysql client library ? The linked library is the compat mysql lib. [root@ns1 freeradius]# ldd rlm_sql_mysql.so linux-vdso.so.1 => (0x00007ffe659bb000) libmysqlclient_r.so.16 => /usr/lib64/mysql/libmysqlclient_r.so.16 (0x00007efed1200000) libz.so.1 => /lib64/libz.so.1 (0x00007efed0fea000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007efed0dcc000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007efed0b95000) libnsl.so.1 => /lib64/libnsl.so.1 (0x00007efed097c000) libm.so.6 => /lib64/libm.so.6 (0x00007efed06f7000) libssl.so.10 => /usr/lib64/libssl.so.10 (0x00007efed048b000) libcrypto.so.10 => /usr/lib64/libcrypto.so.10 (0x00007efed00a6000) libc.so.6 => /lib64/libc.so.6 (0x00007efecfd11000) /lib/ld-linux.so.2 (0x000055a5f8a11000) libfreebl3.so => /lib64/libfreebl3.so (0x00007efecfb0e000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007efecf8ca000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007efecf5e2000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007efecf3de000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007efecf1b2000) libdl.so.2 => /lib64/libdl.so.2 (0x00007efecefad000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007efeceda2000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007efeceb9f000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007efece984000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007efece765000) Thanks

2 1

FR and accounting question
by dg 30 May '19

30 May '19

Hello i have question about accounting in freeradius (3.0.18) i notced in sql table radacct that from time to time i have as a "username" host/DELL-LAPBD5 logged. so in file /etc/raddb/policy.d/filter i put if (User-Name =~ /^host/) { update request { Module-Failure-Message += 'Rejected: banned host' } reject } not i have "Access-Reject" and username starting with "host" are denied. But anyway when i check accouting host/DELL-LAPBD5 still is appears (with some data downloaded). How it this possible that username is Rejected but can download data from network (browsing websites etc.. ) and appears in accounting ?? I thought that if someone is Rejected should not be able to download data from internet. best regards

2 1

Help in moving FR1.x to 3.x EAP-TLS setup.
by Gregory Sloop 30 May '19

30 May '19

So, I've got a current FR setup, version 2.2.8 [although the last time I've done this was under a 1.x FR version - these configs are under an upgraded distro version - so the newer FR setups are somewhat confusing for me. This is all under Ubuntu - this setup started life as a 12.04 (IIRC) setup, and got upgraded to 16.04. I'm now trying to migrate it to a fresh setup on 18.04.] I'm trying to move it to a new FR setup under 3.0.16. It's a Wifi WPA setup - using EAP-TLS with certificates/key only. [Not PEAP etc.] And I'm having trouble. Rather than have you look at a debug - perhaps I should start here. I'm not sure I'm doing the right steps for setup/configuration. Moving clients.conf is obvious. [Though I've added the newer "ipaddr" to them.] I have created new certs/keys/ca - and I'm pretty sure I've done that correctly. [Lets assume I have for now - we'll come back to that later, if needed. I can always test with the old certs/keys too, because I know those work. I'm using GNUTLS to handle CA/Cert/Key creation, and I know I need to add the OID's for "server" and "client" as applicable. And I've verified these are present in the relevant certs.] Now, to where I'm quite unsure... I need to edit the EAP configuration in ./mods-available, and create a link to it in ./mods-enabled - right? --- Here's what is in my current eap [in FR 2.2.8] - though the eap.conf file isn't in the mods-available directory, it's in the main FR config dir. I suppose I could probably leave it that way, but I'm trying to do this the "new" way. --- eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 #md5 { #} # #leap { #} # #gtc { # auth_type = PAP #} tls { certdir = ${confdir}/certs cadir = ${confdir}/certs #private_key_password = whatever private_key_file = ${certdir}/radius.somedom.local.key certificate_file = ${certdir}/radius.somedom.local.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom CA_path = ${cadir} check_crl = yes cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 } verify { } } #ttls { # default_eap_type = md5 # copy_request_to_tunnel = no # use_tunneled_reply = no # virtual_server = "inner-tunnel" #} #peap { # default_eap_type = mschapv2 # copy_request_to_tunnel = no # use_tunneled_reply = no # virtual_server = "inner-tunnel" #} #mschapv2 { #} } --- Though to start, I think I'll avoid checking a CRL - just to keep things simple. Do, I just essentially paste this config straight into the new one? [I don't think so - there's a new section "tls-config tls-common" and I'm unsure about that.] I don't believe there are any changes I made previously [or need to make now] to radiusd.conf? Is there anything else I need to do? Thanks in advance! -Greg

2 5

Commercial support on freeRADIUS
by Raghu nathan 29 May '19

29 May '19

Hello Evereyone, We are looking for some commercial support on freeRADIUS. Is there any company providing commercial support for freeRADIUS? I'm trying to contact networkRADIUS but no response. Regards, Raghu.

4 3

CoA request.
by myxmail1919＠yahoo.com 29 May '19

29 May '19

Hi , anyone knows why i get thi warnining message ? WARNING: Unknown destination 88.99.xx.xx:3799 for CoA request.

2 1

[REQ] Users of the rlm_securid module, make yourselves known
by Arran Cudbard-Bell 28 May '19

28 May '19

Dear list users, We're currently debating about whether to remove the rlm_securid module from FreeRADIUS v4, and are looking for a quick show of hands to see if people are actually using it currently in FreeRADIUS v3. If you're using it, and are comfortable sharing that fact, can you reply to this thread, or send me a message off list (a.cudbardb(a)freeradius.org) Many Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0