- Freeradius-Users - lists.freeradius.org

freeradius segfault/bus error
by Ivan Strelnikov 04 May '17

04 May '17

Hello! I use FreeBSD 10.3-RELEASE-p18, my openssl: > openssl version > OpenSSL 1.0.1s-freebsd 1 Mar 2016 > > /usr/local/bin/openssl version > OpenSSL 1.0.2k 26 Jan 2017 > > ./configure --with-openssl-lib-dir=/usr/local/lib > --with-openssl-include-dir=/usr/local/include I was using 3.0.10 and all was ok. Some day OS was upgraded and rebooted, then starts problems: process can terminate at randomly point. Fresh installation from pkg or sources of 3.0.13 doesn't help. There was nothing strange in -X before the falls. What diagnostic i can gather? When i start it with "-X", it faults in random places after different clients. It looks like: > (33) # Executing group from file > /usr/local/etc/raddb/sites-enabled/default > (33) authenticate { > (33) eap: Expiring EAP session with state 0x9ebf2e0b9cbb3744 > (33) eap: Finished EAP session with state 0x9ebf2e0b9cbb3744 > (33) eap: Previous EAP request found for state 0x9ebf2e0b9cbb3744, > released from the list > (33) eap: Peer sent packet with method EAP PEAP (25) > (33) eap: Calling submodule eap_peap to process data > (33) eap_peap: Continuing EAP-TLS > (33) eap_peap: [eaptls verify] = ok > (33) eap_peap: Done initial handshake > (33) eap_peap: <<< recv TLS 1.0 ChangeCipherSpec [length 0001] > (33) eap_peap: <<< recv TLS 1.0 Handshake [length 0010], Finished > (33) eap_peap: TLS_accept: SSLv3 read finished A > (33) eap_peap: (other): SSL negotiation finished successfully > (33) eap_peap: SSL Connection Established > (33) eap_peap: SSL Application Data > (33) eap_peap: Adding cached attributes from session > b52c69b7ee5577fa831cc45d31b5a366431c1bdb5993c35f7324cef87ca3cd60 > Ошибка сегментации // Seg fault (in my native) Sometimes i see Ошибка адресации на шине//Bus error Thank you.

2 1

bad radtest results with eap/peap mschap
by Michel Villeneuve 04 May '17

04 May '17

Hi, I use freeradius-3.0.12 on centos 7.3 with an openldap 2.4 and a samba attribute EAP / PEAP authentication MSCHAPV2. I want to authentificate and authorize users according to their attribute on the LDAP. I created an attribute LDAP-Desc mapped with the field eduPersonPrimaryAffilation on my LDAP. I want to put user on specific VLAN if they are students, employee .... or outer people. For that I use in the inner-tunnel the capabilities to return AVP like Tunnel-Private-Group-Id with the good value . It's work very well, for internal and also for external people. I tested also the realm value in the default server and I put also the good Tunnel-Private-Group-Id depending the value of realm. It's work with device like smartphone, pc ... and also with the command. eapol_test -c afile -p1812 -smysecret -r1 Everything seems good but not when I use radtest command I can't authentificate internal or external people with the test command radtest [root@freeradius-3-a test]# radtest 'teststudent' 'a1z2e3r4*' localhost 1812 mysecret Sent Access-Request Id 154 from 0.0.0.0:54585 to 127.0.0.1:1812 length 81 User-Name = "teststudent" User-Password = "a1z2e3r4*" NAS-IP-Address = 195.83.247.135 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "a1z2e3r4*" Received Access-Reject Id 154 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject nor radtest -t mschap 'teststudent' 'a1z2e3r4*' 127.0.0.1:18120 1 mysecret I got ot@freeradius-3-a test]# radtest -t mschap 'teststudent' 'secret' 127.0.0.1:18120 1 mysecret Sent Access-Request Id 129 from 0.0.0.0:34088 to 127.0.0.1:18120 length 137 User-Name = "teststudent" MS-CHAP-Password = "a1z2e3r4*" NAS-IP-Address = 195.83.247.135 NAS-Port = 1 Message-Authenticator = 0x00 Cleartext-Password = "secret" MS-CHAP-Challenge = 0x3a7dd0c59a922170 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000ae872e407e206d5579b1515fbf4e92f594e5c5e66739c6e7 Received Access-Reject Id 129 from 127.0.0.1:18120 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject Perhaps the problem comes from /etc/raddb/mods-enabled/mschap files and I tried differents values with no good results. mschap { with_ntdomain_hack = no #authtype = MS-CHAP allow_retry = yes use_mppe=yes require_encryption = yes require_strong = yes ..... I am not sure about the good values needing for this section. I would like to have an advice before using this configuration in production environment. here a debug with a Successful results Thanks in advance for you help PS: sorry for my english I hope it's comprehensible. -- Michel Villeneuve Tel 02 98 01 71 61

2 2

802.1x with multi AD domains
by Vittore Zen 04 May '17

04 May '17

Hi, there are a lot of freeradius configurations that's done a 802.1x PEAP AAA but I'm looking for a configuration that do this with: - multi Microsoft active directory domains - AD domains are not part of same forest - users authenticate using username and password I'm using FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu (a debian 8 on 64bit). Someone can share his configuration? Thanks in advance. v. -- ------------------------------ INFORMAZIONE PER IL RICEVENTE Le informazioni che sono contenute o che accompagnano questa comunicazione potrebbero essere riservate, coperte da segreto professionale, o altrimenti protette da altre restrizioni alla loro divulgazione, e sono destinate esclusivamente alle persone alle quali questa comunicazione é indirizzata. Se questa comunicazione non é indirizzata a Voi, siete pregati di distruggerne tutte le copie in Vostro possesso, di notificarci che avete ricevuto questa comunicazione per errore, e di considerare che sono espressamente vietate la lettura, la diffusione o la distribuzione totale o parziale di questa comunicazione, nonché l'agire sulla base di (informazioni contenute in) questa comunicazione. I messaggi di posta elettronica possono contenere virus o altri difetti, possono non essere accuratamente riprodotti su altri sistemi, o possono essere intercettati, cancellati o alterati senza che il mittente o il destinatario ne vengano a conoscenza. ConsorziSDB declina ogni responsabilitá in relazione a tali evenienze. Vogliate notare che ConsorziSDB riserva il diritto di intercettare, monitorare e conservare, nei limiti consentiti dalle disposizioni legislative o regolamentari applicabili, messaggi di posta elettronica provenienti dai suoi sistemi o ad essi destinati. Se non accettate i rischi associati con le comunicazioni di posta elettronica, potreste scegliere di non utilizzare la posta elettronica per comunicare con ConsorziSDB.

2 3

Reply-Radius
by Ejaz 04 May '17

04 May '17

Hello, when the user gets authenticated, the Radius will send some confirmation to router about that particular user? How can I check this As per my programmer(CRM application data packet service) any user gets authenticated its values should populate Home Agent router which is not happening. We use Cisco 7206 Mobile Wireless Home Agent. Any clue to see Reply response from the radius server Thanks, Mohammed Ejaz Asst. Operation Director of Systems. Cyberia SAUDI ARABIA P.O.Box: 301079, Riyadh 11372 Phone: (+966) 11 464 7114 Ext. 140 Mobile: (+966) 562311787 Fax: (+966) 11 465 4735 Website: http://www.cyberia.net.sa

3 3

Help for buy a real Cert (not self-signed)
by Spider s 04 May '17

04 May '17

Hello, I have got a few questions about radius and buy an original Certificate. Firsts thank you for the help here, but I can’t find an option for search on all post, is this possible ?? only find this: For example only can find post from this mount http://lists.freeradius.org/pipermail/freeradius-users/2017-January/thread.… Is for don’t disturb with my questions is are answered, sorry. And now my questions, first I have got running my freeradius installation 3.10 on ubuntu) with AD Auth, but with limitations, because I need install my self-signed cert on all device for connect to wifi. I don’t want this (I don’t want install the certs), and I need buy a real cert for a real CA, I know ,but I never buy one for this. (I never buy a certfor radius, web or similar) I need buy a real cert, where I can buy ?? recommendations webs?? And witch type ?? I see a lot of certs, and I don’t know the certification specification.( a lot of prices and options) Please a direct links if possible to correct cert. I never buy an original cert and I don’t know process. When I receive the certificates is like certs on the folder?? Need change data??? How can use this certs on my radius install?? Are 3, 5, 20 files ???? where i can find info about this ?? (On docs i reffer) Need a domain for this ?? can i use the cert from a Web (typical ssl cert that is used for web?? I see a lot of info on internet for use self-signed cert, but I can’t find info on documentations or on my Ubuntu install when use real certs. (Is very possible I don’t find) Thank you for your time when you read me, and sorry if a newbie questions. Thank you in advanced, i dont want confuse with this and spend money with this.

6 15

How to log AAA Reject packets?
by Periko Support 03 May '17

03 May '17

I would like to know if exist a way to log AAA Reject packets on FR2.2.x.? I had read the log manual but didn't find this special flag. Thanks all for your time!!!

2 2

freeradius3: multiple rlm_perl and thread pool
by Eugene Grosbein 03 May '17

03 May '17

Hi! Is it supported for freeradius3 to use two distinct rlm_perl modules inside single radiusd process but for different virtual servers? My perl installation is built with both of useithreads=define, usemultiplicity=define. In fact, I already run freeradius3/dhcp module with single server and rlm_perl and it works just fine: thread pool { start_servers = 1000 max_servers = 1000 min_spare_servers = 1000 max_spare_servers = 1000 } Each thread keeps its own persistent connection to powerful external MS SQL server and this 64bit FreeRADIUS has enough memory to run memory-hog embedded threaded Perl to be able to process hundreds of parallel DHCP requests without queueing delay. I need to add new virtual server to process plain RADIUS accounting requests (not DHCP requests) using another perl script and another rlm_perl instance. The question is: is it possible to define another thread pool for new virtual server with distinct *_servers parameters? If no, will new virtual server get a copy of its own thread pool with same parameters or FreeRADIUS uses same pool for all its virtual servers? Eugene Grosbein

3 3

documentation as epub and/or mobi
by Tobias Koeck 03 May '17

03 May '17

Hi, is there any way to get the documentation as epub and/or mobi format. It would be interesting to be able to use the own e-book reader to read the docs. Greetings Tobias

2 1

EAP TLS against multiple certificates?
by David Hartburn 03 May '17

03 May '17

Hi, Is it possible to check EAP-TLS against multiple certificate chains, or bundle two chains together into the same pem file? We have a potential problem where all our certificate auth laptops have been using SHA1 for quite some time. Recently we upgraded our certificate authority to SHA256, so any laptops that request a new cert will get a SHA256. If I put a SHA256 root chain certificate in the EAP-TLS config then a SHA256 client can authenticate, but naturally SHA1 can not. If I leave the SHA1 root chain on the server, then the newer SHA256 clients can not authenticate. I am worried that one day I will come in to find half the clients have renewed to a SHA256 and can no longer auth. Is there anything I can do to allow both certificate types to authenticate during this transition period? In terms of config, in mods-enabled/eap, I have tls-config loanlaptops { private_key_file = ${confdir}/certs/loan_laptop_server.pem certificate_file = ${confdir}/certs/loan_laptop_server.pem ca_file = ${confdir}/certs/unikentrootCAchain.pem ...... } tls { # Point to the Loan Laptops TLS configuration tls = loanlaptops virtual_server = check-eap-tls } Yours Dave Hartburn

2 5

Re: Radsec Clients
by Alan Buxey 03 May '17

03 May '17

Just populate the naslist table as you would for normal clients and ensure they are pointed to the correct virtual server and you've enabled reading of clients from the database in the SQL module alan On 2 May 2017 12:28 pm, "Xavier Maysonnave" <x.maysonnave(a)gmail.com> wrote: Hi, Thanks for the answer. You are right I don't want to put the tls sub-section in a sql table. I was referring to the clients radsec {...} sub-section defined in the file sites-available/tls. I'm looking at how to store those clients in a SQL table and didn't find out the correct solution yet. Thanks -- PGP: CAE5 CE4A EFE9 134F D991 5465 081C B6FB 2EAC 6CC9 <https://goo.gl/lPjb40> -- Light Xavier / Pudhuveedu 2017-05-01 17:35 GMT+05:30 Alan DeKok <aland(a)deployingradius.com>: > On Apr 30, 2017, at 11:33 PM, Xavier Maysonnave <x.maysonnave(a)gmail.com> > wrote: > > > > is there a way to store the radsec clients in an sql table rather than > > using the tls configuration file ? > > No. > > Clients can be listed in SQL. But the "tls" sub-section can't be put > into SQL. > > Alan DeKok. > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

2 2