- Freeradius-Users - lists.freeradius.org

question about default site file
by Bill Schoolfield 13 Apr '17

13 Apr '17

I'm writing a little tool that our clients will execute to configure their freeradius instance (given a stock - nothing changed yet setup). Basically it parses the various setup files and makes substitutions, changes, etc. The idea here is the client won't (shouldn't) edit the files manually. Anyway I noticed that the files ship with sql module directives with a prefixed dash. Ie. -sql What's the meaning of this? Couldn't find it documented anywhere. Another comment method? Something else? Bill

3 3

freeradius, mysql and encrypted columns
by petr.linke＠seznam.cz 13 Apr '17

13 Apr '17

Hi, I have very simple question: Is it possible to use encrypted columns in freeradius? I wish to hide 'sensitive' data (cleartext-password in radcheck table, secret in nas table ...) from simple raw reading block device, where the mysql tables are stored. One way is to use LUKS (but here is performance storage impact), second way is encrypting on database level. And where is the problem: If in freeradius is used nas table and nas query from default, all works perfectly. But if I use encrypted columns - for example modified nas query like: nas_query = "SELECT id, nasname, shortname, type, DES_DECRYPT(secret), server FROM ${nas_table}", freeradius stops resolving clients from nas table. In column secret in nas table is des_encrypted value given by des_encrypt('some_secret',1), mysql is started with one key slot in key-file as a key for encryption. example: cleartext column secret in the nas table, nas_query is set to: "SELECT id, nasname, shortname, type, secret, server FROM ${nas_table}" result executing the nas query: SELECT id, nasname, shortname, type, secret, server FROM nas; +----+-------------------+-------------+-------+--------+--------+ | id | nasname | shortname | type | secret | server | +----+-------------------+-------------+-------+--------+--------+ | 6 | 10.255.246.120/32 | client test | other | test | NULL | +----+-------------------+-------------+-------+--------+--------+ - all works works fine - result from radtest: radtest user password 10.255.246.120 1 test Sending Access-Request of id 113 to 10.255.246.120 port 1812 User-Name = "user" User-Password = "password" NAS-IP-Address = 10.255.246.120 NAS-Port = 1 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 10.255.246.120 port 1812, id=113, length=37 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "123" But when I put into column secret des_encrypted value, and modify the nas query to: "SELECT id, nasname, shortname, type, DES_DECRYPT(secret), server FROM ${nas_table}", freeradius stops resolving correctly the clients from nas table, and in freeradius log appears: Ignoring request to authentication address 10.255.246.120 port 1812 from unknown client 10.255.246.120 port 56837 but the result from modified nas query with encrypted column secret is the same as query result with cleartext secret: SELECT id, nasname, shortname, type, DES_DECRYPT(secret), server FROM nas; +----+-------------------+-------------+-------+---------------------+--------+ | id | nasname | shortname | type | DES_DECRYPT(secret) | server | +----+-------------------+-------------+-------+---------------------+--------+ | 6 | 10.255.246.120/32 | client test | other | test | NULL | +----+-------------------+-------------+-------+---------------------+--------+ The same situation is with encrypted column Value in radcheck or radgroupcheck table. It looks that when some columns are encrypted and in the query is used DES_DECRYPT() function, freeradius has problem to fill the value from encypted columns into internal variables. For example in debug from freeradius is (encrypted column Value in radcheck table): [pap] Using clear text password "" - it looks that freeradius do not take DES_DECRYPT(Value) from radcheck table. Thank you for answer, Petr Linke

2 3

Install Freeradius in Centos7 with Perl support
by Fabian Borot 13 Apr '17

13 Apr '17

Hi I installed freeradius-server-3.0.13 on centos7 from http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf THE FREERADIUS TECHNICAL GUIDE HAPTER NTRODUCTION WHAT ... networkradius.com Copyright (C) 2014 Network RADIUS SARL 1 of 58 THE FREERADIUS TECHNICAL GUIDE CHAPTER 1 - INTRODUCTION WHAT IS FREERADIUS? Chapter 1 - Introduction I proceedd with the regular, configure, make, make install steps but I saw a lot of warnings about messing dependencies and as I was noticing them I added them to a yum install list, see below yum install net-snmp net-snmp-utils libtalloc-devel unixODBC-devel unixODBC openssl openssl-devel perl-ExtUtils-CBuilder perl-ExtUtils-MakeMaker wireshark mysql-devel libmemcached libmemcached-devel libpcap-devel perl-devel python-devel freeradius-perl freeradius-python freeradius-unixODBC -y but I still cant get the perl module as shown below when doing the config part === configuring in src/modules/rlm_perl (/usr/src/freeradius-server-3.0.13/src/modules/rlm_perl) checking whether perl executable path has been provided... no checking for perl... /bin/perl Can't locate ExtUtils/Embed.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .). BEGIN failed--compilation aborted. Can't locate ExtUtils/Embed.pm in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .). BEGIN failed--compilation aborted. checking for perl.h... no checking for perl.h in /usr/local/include/... no checking for perl.h in /opt/include/... no configure: WARNING: silently not building rlm_perl. configure: WARNING: FAILURE: rlm_perl requires: EXTERN.h EXTERN.h libperl.so libperl.so. please advise... thank you fborot

3 6

RADIUS OTP auth with Apache
by Scholz, Dieter 12 Apr '17

12 Apr '17

Hello, at the moment I'm facing the problem to implement a OTP (one time password) auth solution for Apache httpd. The webserver should act as a proxy for several internal sites (it runs Debian Stretch). The OTP software solution I use is LINOTP. Freeradius is my radius server (default package from Debian Jessie - runs on another host). I have no problem authentication on the command line. Using radtest everything works as expected. But I have problems with the Apache radius auth config. I tested several configurations. At the moment the configuration that runs best is the libapache2-mod-auth-radius variant (Stretch package). It works fine when connecting using an icognito browser tab. But if I use a standard browser tab everytime I close and reopen the browser the first auth attempt fails. Looking at the log I found that the auth cookie is not deleted when closing the browser. The docs state it should be deleted when the browser exits. So when the browser is restarted the first auth attempt is using the stale cookie information and fails. This is a bit unconvenient. I couldn't find an answer (but a similar unanswered question) for this problem when searching the mailing list. Here's my Apache config: <VirtualHost *:80> DocumentRoot /var/www/btw ProxyPass / http://<IP>/ ProxyPassReverse / http://<IP>/ LogLevel debug <Proxy *> Order allow,deny Allow from all </Proxy> AddRadiusAuth <IP>:1812 <SECRET> 5:3 AddRadiusCookieValid 5 <Location /> AuthType Basic AuthName "<A_NAME>" AuthBasicProvider radius AuthRadiusActive On AuthRadiusCookieValid 5 AuthRadiusAuthoritative on require valid-user </Location> </VirtualHost> I tried a different variant for the auth problem using PAM and the PAM radius module but only reached a situation that the first auth attempt works but each new request triggered a new login dialog box. So here are my questions: - Is there a solution for the cookie not getting deleted when using the libapache2-mod-auth-radius module? - Is there another way to auth against a radius server (or the linotp server) that works? At the moment I'm stuck so any help is appreciated. Thanks. Regards, Dieter

3 3

freeradius dependencies to build from source
by Konstantin Knaab-Hinrichs 12 Apr '17

12 Apr '17

Hi, I'd like to build FreeRADIUS for Debian from source. Official FreeRADIUS-Wiki: https://wiki.freeradius.org/building/Debian-and-Ubuntu says that I should install dependencies first. They only state libssl-dev Are there more dependencies? Are the dependencies mentioned in "hard dependencies" some lines under the compilation instructions for make enough or are there more? Yours, Konstantin

2 1

authentication
by Ejaz 12 Apr '17

12 Apr '17

Hello How to make sure that FreeRadius is sending back the request to NAS/router after successfully authentication. Please help by giving clue. Thanks, Mohammed Ejaz Asst. Operation Director of Systems. Cyberia SAUDI ARABIA P.O.Box: 301079, Riyadh 11372 Phone: (+966) 11 464 7114 Ext. 140 Mobile: (+966) 562311787 Fax: (+966) 11 465 4735 Website: http://www.cyberia.net.sa

2 1

As freeradius validates the client certificate on an EAP-TLS connection and OCSP
by Miguel Hinojosa 11 Apr '17

11 Apr '17

We are documenting the architecture and configuration of freeradius 3.0.11 deployed. We need confirmation on two doubts about EAP-TLS connection. After documenting SSL Chain Verification and reviewing the Red Hat Certificate System document, we want you to confirm that we are in the correct assumption. https://access.redhat.com/documentation/en-US/Red_Hat_ Certificate_System/8.0/html/Deployment_Guide/Introduction_ to_Public_Key_Cryptography-Certificates_and_Authentication.html# Certificates_and_Authentication-How_CA_Certificates_Establish_Trust Configuration: - CA del server (/etc/pki/CApath.client) donde tenemos 1x rootCA.pem y 1x issuingCA-1.pem (issued by rootca.pem) - server.pem issued by issuingCA-1.pem - client cert issued by other issuingCA-2.pem (not on local CA of freeradius server) - issuingCA-2.pem issued by same rootCA.pem (same keyid too) --- When the mentioned client with cert-client-issued-by-issuingCA-2.pem try connecting to radius: *Case 1: client sends issuingCA-2.pem certificate during ssl negotiation. Although radius does not have it in your local CA, radius will be able to complete the chain according to the ssl-chain-verification documentation, the client's certificate is signed by issuingCA-2 and signed by rootCA.pem that it does, correct? *Case 2: client does not send the issuingCA-2.pem certificate, it will not be able to complete the chain and should deny the connection, right? --- I understand that the OCSP server, if you send the certificate of the intermediate CA will verify it as it does with the certificate of the client. But when freeradius checks the client's certificate via OCSP, does it verify during the same connection (request) the certificate of the intermediate CA? Or is that done only at the checkpoint of the CRL? == **eap config eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} tls-config tls-common { private_key_password = private_key_file = ${certdir}/private/server.key certificate_file = ${certdir}/certs/server.pem dh_file = ${certdir}/private/dh ca_path = ${cadir} cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes max_entries = 255 } verify { skip_if_ocsp_ok = yes tmpdir = /var/tmp/radiusd/verify client = "/usr/bin/openssl verify -CApath ${..ca_path} -crl_check_all %{TLS-Client-Cert-Filename}" } ocsp { enable = yes timeout = 4 softfail = yes } } tls { tls = tls-common virtual_server = check-eap-tls } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } mschapv2 { } } Thanks Best regards

2 3

Framed-Pool precedence over Framed-IP-Address
by HugLeo 11 Apr '17

11 Apr '17

2 2

Configuring FreeRADIUS with apache
by Arun Maha 11 Apr '17

11 Apr '17

Hi, How to configure freeRadius server with Apache on poky linux distribution. I compiled FreeRADIUS from source. I found I have to install mod_auth_radius.c module. But when I use apxs to convert .C to .so I am getting "apxs: Error: not found!." I am new to freeRadius any helpful suggestions/links were to begin can be helpful. FreeRADIUS version : 3.0.13 Thanks, ARUNKUMAR

2 1

freeradius with sqlite3 solving database lock issue
by Antonio Silva 10 Apr '17

10 Apr '17

Hi, What are the best options to configure sqlite3 sql with freeradius? i'm having some lock errors followed by "ERROR: Hit reconnection limit" I tried to set the pool to only 1 server, since its a file db, but them i got the error "max connections2 when connecting two users at the same time. Right now i use: .... thread pool { start_servers = 5 max_servers = 25 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 1024 auto_limit_acct = yes } sql { driver = "rlm_sql_sqlite" sqlite { filename = "radius.db" busy_timeout = 200 } dialect = "sqlite" delete_stale_sessions = yes pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } ... The errors are: Feb 12 17:41:08 PC radiusd[18187]: (2038) Login OK: [402(a)cm.com/<CHAP-Password>] (from client nas01 port 17 cli 30-10-E4-66-1A-CF) Feb 12 17:41:58 PC radiusd[18187]: (2042) ERROR: Error fetching row Feb 12 17:41:58 PC radiusd[18187]: (2042) ERROR: rlm_sql_sqlite: database is locked Feb 12 17:41:58 PC radiusd[18187]: (2042) ERROR: SQL query failed: server error Feb 12 17:41:58 PC radiusd[18187]: (2041) Login OK: [402(a)cm.com/<CHAP-Password>] (from client nas01 port 14 cli F4-37-B7-E0-66-DF) Feb 12 17:41:59 PC radiusd[18187]: (2042) sql: ERROR: Error fetching row Feb 12 17:41:59 PC radiusd[18187]: (2042) sql: ERROR: rlm_sql_sqlite: database is locked ... Feb 12 17:56:39 PC radiusd[18187]: (2125) sql: ERROR: Hit reconnection limit You can check the entire log in http://pastebin.com/fXuZVU93 Thanks, -- Saludos / Regards / Cumprimentos, António silva

2 9