- Freeradius-Users - lists.freeradius.org

AW: iOS mysterious issues on Freeradius 3.0.14
by Stabla, Daniel 23 Mar '17

23 Mar '17

Hello, we are expieriencing the same issues in our network. We were able to reproduce the problems and it's totally the fault of iOS. If a user is walking through the building and iOS is roaming through the various access points, than in some point the wifi client software on iOS is running into a memory overflow or something, after 6-7 incomplete logins because of poor signal strength. After reaching this point, either the wifi must be disabled for few seconds and then it works or the device must be restarted. Our other clients doesn't have these issues. Kind regards. D. Stabla -----Ursprüngliche Nachricht----- Von: Freeradius-Users [mailto:freeradius-users-bounces+dstabla=materna.de@lists.freeradius.org] Im Auftrag von Stefan Winter Gesendet: Donnerstag, 23. März 2017 08:21 An: freeradius-users(a)lists.freeradius.org <mailto:freeradius-users@lists.freeradius.org> Betreff: Re: iOS mysterious issues on Freeradius 3.0.14 Hi, I was seeing something /very/ similar to the below TLS error recently and that was because the expected *server name* I configured in the client didn't match what my server was actually sending. Despite the usual suspects like typos in client config, you may also want to check for wildcard names in certs, or things that are not hostnames (spaces...) - clients sometimes choke on harmlessly looking things. Greetings, Stefan Winter Am 22.03.2017 um 21:54 schrieb John Tobin: > The log snip below, shows test on os x Sierra, Windows 7 works, I have not > had the time to test win 10. > So free Radiusd works, this is just an apple os x problem, server cert is > self signed, dot1xprofiler is my profile app, and has both the signed cert > [server.pem] and client cert [client.p12] generated by the make in > /etc/raddb/certs. > > On 3/22/17, 16:37, "John Tobin" <jtobin(a)po-box.esu.edu <mailto:jtobin@po-box.esu.edu>> wrote: > >> Ah, you mean like this: [ERROR: TLS is down a bit, I took the entire >> transaction out of the logŠ] >> >> (86) Received Access-Request Id 196 from 10.99.7.190:1645 >> <http://10.99.7.190:1645/> to 10.99.7.21:1812 <http://10.99.7.21:1812/> >> length 153 >> (86)User-Name = "tobi1" >> (86)Framed-MTU = 1400 >> (86)Called-Station-Id = "0022.90bd.9500" >> (86)Calling-Station-Id = "0025.4b8e.15b9" >> (86)Service-Type = Login-User >> (86)Message-Authenticator = 0x5f033b48ec2f2a210b5e0ce5379cdf49 >> (86)EAP-Message = 0x0205001119800000000715030100020100 >> (86)NAS-Port-Type = Wireless-802.11 >> (86)NAS-Port = 394 >> (86)NAS-Port-Id = "394" >> (86)State = 0xe046c6d9e243dfdaa11e15be1d36d7b4 >> (86)NAS-IP-Address = 10.99.7.190 >> (86)NAS-Identifier = "ap" >> (86) session-state: No cached attributes >> (86) # Executing section authorize from file >> /etc/raddb/sites-enabled/default >> (86)authorize { >> (86)policy filter_username { >> (86)if (&User-Name) { >> (86)if (&User-Name)-> TRUE >> (86)if (&User-Name){ >> (86)if (&User-Name =~ / /) { >> (86)if (&User-Name =~ / /)-> FALSE >> (86)if (&User-Name =~ /@[^@]*@/ ) { >> (86)if (&User-Name =~ /@[^@]*@/ )-> FALSE >> (86)if (&User-Name =~ /\.\./ ) { >> (86)if (&User-Name =~ /\.\./ )-> FALSE >> (86)if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) <mailto:/@%28.+%29%5C.%28.+%29$/%29%29>{ >> (86)if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) <mailto:/@%28.+%29%5C.%28.+%29$/%29%29> >> -> FALSE >> (86)if (&User-Name =~ /\.$/){ >> (86)if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) <mailto:/@%28.+%29%5C.%28.+%29$/%29%29> >> -> FALSE >> (86)if (&User-Name =~ /\.$/){ >> (86)if (&User-Name =~ /\.$/)-> FALSE >> (86)if (&User-Name =~ /(a)\./ <mailto:/@%5C./>){ >> (86)if (&User-Name =~ /(a)\./ <mailto:/@%5C./>)-> FALSE >> (86)} # if (&User-Name)= notfound >> (86)} # policy filter_username = notfound >> (86)[preprocess] = ok >> (86)[chap] = noop >> (86)[mschap] = noop >> (86)[digest] = noop >> (86) suffix: Checking for suffix after "@" >> (86) suffix: No '@' in User-Name = "tobi1", looking up realm NULL >> (86) suffix: No such realm "NULL" >> (86)[suffix] = noop >> (86) eap: Peer sent EAP Response (code 2) ID 5 length 17 >> (86) eap: Continuing tunnel setup >> (86)[eap] = ok >> (86)} # authorize = ok >> (86) Found Auth-Type = eap >> (86) # Executing group from file /etc/raddb/sites-enabled/default >> (86)authenticate { >> (86) eap: Expiring EAP session with state 0xe046c6d9e243dfda >> (86) eap: Finished EAP session with state 0xe046c6d9e243dfda >> (86) eap: Previous EAP request found for state 0xe046c6d9e243dfda, >> released from the list >> (86) eap: Peer sent packet with method EAP PEAP (25) >> (86) eap: Calling submodule eap_peap to process data >> (86) eap_peap: Continuing EAP-TLS >> (86) eap_peap: Peer indicated complete TLS record size will be 7 bytes >> (86) eap_peap: Got complete TLS record (7 bytes) >> (86) eap_peap: [eaptls verify] = length included >> (86) eap_peap: <<< recv TLS 1.0 Alert [length 0002], warning close_notify >> (86) eap_peap: ERROR: TLS_accept: Failed in unknown state >> (86) eap_peap: ERROR: SSL says: error:140940E5:SSL >> routines:ssl3_read_bytes:ssl handshake failure >> (86) eap_peap: ERROR: SSL_read failed in a system call (-1), TLS session >> failed >> (86) eap_peap: ERROR: TLS receive handshake failed during operation >> (86) eap_peap: ERROR: [eaptls process] = fail >> (86) eap: ERROR: Failed continuing EAP PEAP (25) session.EAP sub-module >> failed >> (86) eap: Sending EAP Failure (code 4) ID 5 length 4 >> (86) eap: Failed in EAP select >> (86)[eap] = invalid >> (86)} # authenticate = invalid >> (86) Failed to authenticate the user >> (86) Using Post-Auth-Type Reject >> (86) # Executing group from file /etc/raddb/sites-enabled/default >> (86)Post-Auth-Type REJECT { >> (86) attr_filter.access_reject: EXPAND %{User-Name} >> (86) attr_filter.access_reject:--> tobi1 >> (86) attr_filter.access_reject: Matched entry DEFAULT at line 11 >> (86)[attr_filter.access_reject] = updated >> (86)[eap] = noop >> (86)policy remove_reply_message_if_eap { >> (86)if (&reply:EAP-Message && &reply:Reply-Message) { >> (86)if (&reply:EAP-Message && &reply:Reply-Message)-> FALSE >> (86)else { >> (86)[noop] = noop >> (86)} # else = noop >> (86)} # policy remove_reply_message_if_eap = noop >> (86)} # Post-Auth-Type REJECT = updated >> (86)} # policy remove_reply_message_if_eap = noop >> (86)} # Post-Auth-Type REJECT = updated >> (86) Delaying response for 1.000000 seconds >> Waking up in 0.3 seconds. >> Waking up in 0.6 seconds. >> (86) Sending delayed response >> (86) Sent Access-Reject Id 196 from 10.99.7.21:1812 >> <http://10.99.7.21:1812/> to 10.99.7.190:1645 <http://10.99.7.190:1645/> >> length 44 >> (86)EAP-Message = 0x04050004 >> (86)Message-Authenticator = 0x00000000000000000000000000000000 >> Waking up in 3.7 seconds. >> Š.. >> Waking up in 0.1 seconds. >> (86) Cleaning up request packet ID 196 with timestamp +1294629 >> Ready to process requests >> Ready to process requests >> Signalled to terminate >> Exiting normally >> rlm_ldap (ldap): Removing connection pool >> rlm_ldap (ldap): Closing connection (12) >> rlm_ldap (ldap): Closing connection (11) >> rlm_ldap (ldap): Closing connection (10) >> tls: Freeing cached session VPs >> >> >> >> On 3/22/17, 13:20, "Freeradius-Users on behalf of Brian Julin" >> <freeradius-users-bounces+jtobin=po-box.esu.edu(a)lists.freeradius.org on >> behalf of BJulin(a)clarku.edu <mailto:BJulin@clarku.edu>> wrote: >> >>> >>> >>> >>> >>>> This is not easy research, since the error messages you receive no one >>> else seems to see. >>>> My problem may be that apple devices are no longer accepting self >>>> signed >>> certs, but I have also looked at os x upgrades [home brew/openssl >>> problems] for openssl. >>> >>> If the OS is rejecting the cert (or visa versa), you'll see something >>> like: >>> >>> Error: TLS Alert fatal: blah blah blah >>> >>> The original poster was getting all the way through MS-CHAP inner >>> authentication, >>> so it was could not have been a certificate issue since the TLS tunnel >>> had successfully >>> established. >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >> > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

1 0

conflicting packet error
by Sami Jorl 23 Mar '17

23 Mar '17

Hi, I sometimes see the following errors in FreeRadius logs: Received conflicting packet from client nas_test port 15089 - ID: 75 due to unfinished request. Giving up on old request. In this mailing list I read some comments about it and found out it is caused by slow database which is not able to handle requests on time. I enabled logging slow queries and noticed there are no queries taking more than 2 seconds. so what is exactly causing it? does adjusting nas timeout/retry or FreeRadius settings fix it? Thanks Sam

4 6

online users and LNS users are not equal and fluctuating
by iQalalwa 21 Mar '17

21 Mar '17

Dear Sir, I have FreeRADIUS Version 2.2.0, I have 3 Clients (3 LNS Cisco routers) and I am facing problem that online users are not stable in radius. Details: LNS01(Cisco), LNS02(Cisco): handle same users found in freeradiusdb. BUT in radius, LNS03 is not handling same number of users found in LNS03(Cisco). they are fluctuating all time. configuration of cisco LNSs are same. and I don't know from where the problem comes from. note: on LNS03(cisco) the users are stable but the problem in radius online users. please help.

3 3

buffered sql is blocking
by Sami Jorl 21 Mar '17

21 Mar '17

Hi, After switching to buffered sql I noticed FreeRadius is still blocked if I lock the sql tables. So FreeRadius doesn't accept new requests and doesn't save them to the detail file until the tables are unlocked. AND all requests are timed out in NAS. Isn't the whole purpose of using this module to accept requests as fast as possible even when database is busy? Thanks Sam

2 1

None
by Jörn Volkhausen 21 Mar '17

21 Mar '17

unsubscribe sokazoeh volkhausen.joern(a)gmx.de

1 0

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

Originate DHCP lease query from FreeRadius
by Waqas Toor 19 Mar '17

19 Mar '17

Hi Gents, At the time of access request I need to do DHCP lease query to the DHCP server (external ) to get the MAC address of the device. I need to know if there is a module that does that ( originate a lease query to dhcp server) or I have to write external script to be called as pre-auth hook. Regards, Waqas Toor

2 3

FreeRadius 3.0.12 crash on ubuntu
by Olaf Dreyer 17 Mar '17

17 Mar '17

Hi! I am running FreeRadius 3.0.12 on Ubuntu 14.04.5 LTS with freeradius 3.0.12-ppa1~trusty libssl1.0.0:amd64 1.0.1f-1ubuntu2.22 The Radius server is used mainly as AAA server for a bunch of Cisco WLCs with a few hundred Cisco WLAN APs behind. We are doing EAP-TLS, the devices only have to present their certificates. Additionally it is used for authentication of admin users on Cisco devices, here we use the ntlm_auth module. But i think this is not relevant. The server crashes now quite frequently, the error always looks like this: Mar 16 22:44:03 server kernel: [2614480.407628] freeradius[13294]: segfault at 44 ip 00007f21f1317f55 sp 00007f21e4ae5828 error 4 in libssl.so.1.0.0[7f21f12dc000+55000] So, this looks like the crash was related to libssl. in general EAP-TLS works fine, several thousand authentications per day, but then freeradius crashes with the above error. Might be some certificate which openssl 1.0.1f does not understand? Maybe this is a TLSv1.2 certificate? Or should this be already fixed? Regards, Olaf

2 2

TTLS+PAP with Windows
by Herman Øie Kolden 16 Mar '17

16 Mar '17

Hello! I am running FreeRADIUS 2.2.5 on Debian 8.7 (Jessie). The RADIUS server is using TTLS+PAP. I am trying to find a good way to authenticate the server to Windows clients. With macOS, Linux, Android etc., I am using a custom self signed CA certificate. On these devices it is possible to specify that this certificate is only usable for a specific SSID. However, for Windows I have found no way to accomplish this. To make it work, I have to install the CA certificate in the "Trusted Root CA" store. This is rather inconvenient. If I (against all odds) lose the private key, the attacker could use it to issue certificates for web pages, and the Windows clients would accept them. One of the options I have considered is make FreeRADIUS present multiple certificates simultaneously: an LE certificate for Windows and the self signed CA certficiate for other clients. As Windows clients already trust LE, they should also accept the server certificate. 1) Is it possible to use LE certificates with FreeRADIUS? 2) Is it possible to make the server present multiple certificates? The reason for wanting multiple certificates, is that a complete switch to LE would require reconfiguring all the non-Windows clients that use the CA certificate. Naturally, all thoughts concerning EAP and Windows are also welcome. Thanks in advance! -- Herman Øie Kolden Trondheim, Norway

9 21

Sending Access-Challenge instead of Access-Accept using MS-CHAPv2
by Lasse Odden 16 Mar '17

16 Mar '17

Hello! This is my first post in the maillist (that have solved all of my earlier problems), but now I'm not sure if my error is my mistake, Cisco's mistake or FreeRADIUS's mistake. I've set up a two-factor athentication against our Cisco AnyConnect VPN with access-challenge (this works when I use PAP between Cisco and FreeRADIUS). But with the username and password being sent between the Cisco and the FreeRADIUS-server in cleartext I enabled "Password management" on the Cisco ASA, so it sends the password with MS-CHAPv2. The authentication of the user works with MS-CHAPv2. To make the FreeRADIUS send an challenge after the authentication of the user I did this in sites-enabled/default: authenticate { .... Auth-Type MS-CHAP { mschap challenge } .... } The Cisco ASA recieves the Challenge and promts for and challenge. When I type in the correct challenge the FreeRADIUS sends an Access-Accept, but the Cisco ASA won't allow it. My question is if this is allowed by the standard or is it a bug on Cisco's side? Regards, Lasse Odden

3 6