- Freeradius-Users - lists.freeradius.org

Re: RADSEC testing with FR 3.1
by Alex Sharaz 09 Dec '16

09 Dec '16

o.k back to 3.0 [Sorry Alan B, finger trouble sent the partial message before] I'm using a local CA authority with appropriate root and intermediate certs Root Cert is *Certificate Information:**Common Name:* University of York Root CA I *Organization:* University of York*Organization Unit:* IT Services *Locality:* York*State:* North Yorkshire*Country:* GB*Valid From:* September 13, 2015*Valid To:* October 13, 2035*Issuer:* University of York Root CA I, University of York*Serial Number:* ..... Intermediate Cert is *Certificate Information:**Common Name:* University of York Intermediate CA I*Organization:* University of York*Organization Unit:* IT Services *Locality:* York*State:* North Yorkshire*Country:* GB*Valid From:* September 13, 2015*Valid To:* October 13, 2035*Issuer:* University of York Root CA I, University of York*Serial Number:* .... and the cert is *Certificate Information:**Common Name:* radsec.york.ac.uk*Organization:* University of York*Organization Unit:* IT Services*Locality:* York*State:* North Yorkshire*Country:* GB*Valid From:* November 10, 2015*Valid To:* December 6, 2017*Issuer:* University of York Intermediate CA I, University of York*Serial Number:* ..... Sending server In /etc/freeradius/sites-enabled/tls I have home_server prodn2.sharaz.info { ipv6addr = 2a03:b0c0:1:a1::a9f:8001 port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { certdir = ${confdir}/certs/UoY/radsec-certs private_key_password = "< secret key>" private_key_file = ${certdir}/radsecyorkacuk.key # If ca_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. certificate_file = ${certdir}/certAndCAs.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate # ca_file = ......... dh_file = ${confdir}/certs/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" } } On the receiving server in /etc/freeradius/sites-enabled/tls I've got listen { ipv6addr = * port = 2083 # # TCP and TLS sockets can accept Access-Request and # Accounting-Request on the same socket. # # auth = only Access-Request # acct = only Accounting-Request # auth+acct = both # type = auth+acct # For now, only TCP transport is allowed. proto = tcp # Send packets to the default virtual server virtual_server = eduroam clients = radsec ..... tls { private_key_password = "A key" private_key_file = ${certdir}/UoY/radsec-certs/radsecyorkacuk.key # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If ca_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. # File contents = cp cert.pem certAndCAs.peml;cat radsecIntermediateCA.pem>>certAndCAs.pem; # cat radsecRootCA>>certAndCAs.pem certificate_file = ${certdir}/UoY/radsec-certs/certAndCAs.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. #ca_file = ${cadir}/UoY/radsec-certs/radsecRoot.pem dh_file = ${certdir}/dh fragment_size = 8192 cipher_list = "DEFAULT" cache { lifetime = 24 } require_client_cert = yes } } clients radsec { client dn0.sharaz.info { ipv6addr = 2a01:348:6:59d::2 proto = tls secret = radsec } ..... When I run eapol_test , on the receiving server I get Fri Dec 9 10:49:55 2016 : Debug: ... new connection request on TCP socket Fri Dec 9 10:49:55 2016 : Debug: Listening on auth+acct from client (2a01:348:6:59d::2, 60616) -> (::, 2083, virtual-server=eduroam) Fri Dec 9 10:49:55 2016 : Debug: Waking up in 0.4 seconds. Fri Dec 9 10:49:55 2016 : Debug: (0) Initiating new EAP-TLS session Fri Dec 9 10:49:55 2016 : Debug: (0) Setting verify mode to require certificate from client Fri Dec 9 10:49:55 2016 : Debug: (0) Reading from socket 18 READ FROM SSL 291 00: 16 03 01 01 1e 01 00 01 1a 03 03 28 e9 b0 c4 4e ..... Fri Dec 9 10:49:55 2016 : Debug: (0) (other): before/accept initialization Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_accept: before/accept initialization Fri Dec 9 10:49:55 2016 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Fri Dec 9 10:49:55 2016 : Debug: (0) <<< recv TLS 1.2 [length 011e] Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_accept: unknown state Fri Dec 9 10:49:55 2016 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Fri Dec 9 10:49:55 2016 : Debug: (0) >>> send TLS 1.2 [length 003e] Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_accept: unknown state Fri Dec 9 10:49:55 2016 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Fri Dec 9 10:49:55 2016 : Debug: (0) >>> send TLS 1.2 [length 0fb3] Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_accept: unknown state Fri Dec 9 10:49:55 2016 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Fri Dec 9 10:49:55 2016 : Debug: (0) >>> send TLS 1.2 [length 014d] Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_accept: unknown state Fri Dec 9 10:49:55 2016 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Fri Dec 9 10:49:55 2016 : Debug: (0) >>> send TLS 1.2 [length 002e] Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_accept: unknown state Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_accept: unknown state Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_accept: Need to read more data: unknown state Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_accept: Need to read more data: unknown state Fri Dec 9 10:49:55 2016 : Debug: (0) In SSL Handshake Phase Fri Dec 9 10:49:55 2016 : Debug: (0) In SSL Accept mode Fri Dec 9 10:49:55 2016 : Debug: (0) Writing to socket 18 Fri Dec 9 10:49:55 2016 : Debug: Waking up in 0.4 seconds. READ FROM SSL 7 00: 15 03 03 00 02 02 30 Fri Dec 9 10:49:55 2016 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Fri Dec 9 10:49:55 2016 : Debug: (0) <<< recv TLS 1.2 [length 0002] Fri Dec 9 10:49:55 2016 : ERROR: (0) TLS Alert read:fatal:unknown CA Fri Dec 9 10:49:55 2016 : ERROR: (0) TLS_accept: Failed in unknown state Fri Dec 9 10:49:55 2016 : ERROR: (0) Failed in __FUNCTION__ (SSL_read) Fri Dec 9 10:49:55 2016 : ERROR: (0) s3_pkt.c[1472]:error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca Fri Dec 9 10:49:55 2016 : ERROR: (0) s3_pkt.c[1210]:error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure Fri Dec 9 10:49:55 2016 : ERROR: (0) System call (I/O) error (-1) Fri Dec 9 10:49:55 2016 : Debug: (0) FAILED in TLS handshake receive Fri Dec 9 10:49:55 2016 : Debug: Closing TLS socket from client port 60616 Fri Dec 9 10:49:55 2016 : Debug: Client has closed connection Fri Dec 9 10:49:55 2016 : Info: ... shutting down socket auth+acct from client (2a01:348:6:59d::2, 60616) -> (::, 2083, virtual-server=eduroam) Fri Dec 9 10:49:55 2016 : Debug: Waking up in 2.9 seconds. On the sending server it says Fri Dec 9 10:49:55 2016 : Debug: (4) proxy: Trying to allocate ID (0/2) Fri Dec 9 10:49:55 2016 : Debug: (4) proxy: Trying to open a new listener to the home server Fri Dec 9 10:49:55 2016 : Debug: Trying SSL to port 2083 Fri Dec 9 10:49:55 2016 : Debug: Requiring Server certificate Fri Dec 9 10:49:55 2016 : Debug: (0) (other): before/connect initialization Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_connect: before/connect initialization Fri Dec 9 10:49:55 2016 : Debug: (0) >>> send TLS 1.2 [length 011e] Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_connect: unknown state Fri Dec 9 10:49:55 2016 : Debug: (0) <<< recv TLS 1.2 [length 003e] Fri Dec 9 10:49:55 2016 : Debug: (0) TLS_connect: SSLv3 read server hello A Fri Dec 9 10:49:55 2016 : Debug: (0) <<< recv TLS 1.2 [length 0fb3] Fri Dec 9 10:49:55 2016 : Debug: (0) Creating attributes from certificate OIDs Fri Dec 9 10:49:55 2016 : ERROR: (0) SSL says error 19 : self signed certificate in certificate chain Fri Dec 9 10:49:55 2016 : Debug: (0) >>> send TLS 1.2 [length 0002] Fri Dec 9 10:49:55 2016 : ERROR: (0) TLS Alert write:fatal:unknown CA Fri Dec 9 10:49:55 2016 : Error: tls: TLS_connect: Error in SSLv3 read server certificate B Fri Dec 9 10:49:55 2016 : Error: tls: TLS_connect: Error in SSLv3 read server certificate B Fri Dec 9 10:49:55 2016 : Error: tls: Failed in __FUNCTION__ (SSL_connect): s3_clnt.c[1186]:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Fri Dec 9 10:49:55 2016 : Error: tls: System call (I/O) error (-1) Fri Dec 9 10:49:55 2016 : Error: Failed starting SSL to new proxy socket 'proxy (::, 0) -> home_server (2a03:b0c0:1:a1::a9f:8001, 2083)' Fri Dec 9 10:49:55 2016 : Proxy: (4) Failed to insert request into the proxy list

2 3

LDAP filter by OU Group
by Albert K 09 Dec '16

09 Dec '16

Hi, I need some help to assign VLAN to users from a particular OU of Active Directory. It does not seems to work. The code below is the post-auth in the inner-tunnel. At the moment, the filter does not work as always get assigned the VLAN 40. What else should i do to get the filtering to work?. Thanks. post-auth { ldap if (LDAP-Group == "OU=hod,,dc=mycompay,dc=com") { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "30" } } else { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "40" } } }

6 12

RE: RADSEC testing with FR 3.1
by Alan Buxey 08 Dec '16

08 Dec '16

I'll have a quick check but sure I didn't have to do anything weird to get it working alan

1 0

RADSEC testing with FR 3.1
by Alex Sharaz 08 Dec '16

08 Dec '16

Now I did some radsec stuff in 2013 with radsecproxy but those brain cells have long gone, and I need to use FR for this So As advised given up on FR 4.0 Built 2 servers running FR 3.1 Copied TLS example into /etc/freeradius/sites-enabled at both end. Wrapped listen statement with server {...} to get it to run Defined sending client IPv6 address at end supposed to be connecting to Added home_server/pool/realm at sending end Built eapol_test so I could fire an eap_peap request at the other end. Run both serevers with radiusd -d /etc/freeradius -fxxxx -l /var/log/radius.log>/var/log/radius.log (yes its -fxxx because that's what it tells me to do if you want to use tls) run eapol_test -c /usr/local/etc/sharaz-peap.conf -a 127.0.0.1 -s testing123 receiving end gets Thu Dec 8 14:24:56 2016 : Info : Ready to process requests Thu Dec 8 14:25:00 2016 : Debug : ... new connection request on TCP socket Thu Dec 8 14:25:00 2016 : Debug : Listening on auth+acct from client (2a01:348:6:59d::2, 56193) -> (::, 2083, virtual-server=sharaz-tls) Thu Dec 8 14:25:00 2016 : Debug : tls - Closing TLS socket from client port 56193 Thu Dec 8 14:25:00 2016 : Debug : tls - Client has closed connection Thu Dec 8 14:25:00 2016 : Info : ... shutting down socket auth+acct from client (2a01:348:6:59d::2, 56193) -> (::, 2083, virtual-server=sharaz-tls) Sender seems to have Thu Dec 8 14:41:53 2016 : Debug : No matches Thu Dec 8 14:41:53 2016 : Info : (1) sql - Need 2 more connections to reach min connections (3) Thu Dec 8 14:41:53 2016 : Debug : Trying SSL to port 2083 Thu Dec 8 14:41:53 2016 : Debug : tls - Requiring Server certificate Thu Dec 8 14:41:53 2016 : Error : tls - System call (I/O) error (0) Thu Dec 8 14:41:53 2016 : Error : Failed starting SSL to new proxy socket 'proxy (::, 0) -> home_server (2a03:b0c0:1:a1::a9f:8001, 2083)' Thu Dec 8 14:41:53 2016 : Proxy : (1) Failed to insert request into the proxy list Thu Dec 8 14:41:53 2016 : Debug : Thread 5 waiting to be assigned a request So how do I enable enough debugging to figure out what's gone wrong at the System Call I/O error log message point ?

2 2

Re: Freeradius and check connection to DB
by vanish 08 Dec '16

08 Dec '16

Thanks for your answer. Install freeradius 3.0.12 and iODBC. Read docs at http://networkradius.com/doc/3.0.10 Can't understand - how work multiple sql instances in v3? In freeradius v2 it works clear for me: - Create in sql.conf: sql sql_instance1 { ... } sql sql_instance2 { ... } - Use: On virtual server1: authorize { sql_instance1 } accounting { sql_instance1 } On virtual server2: authorize { sql_instance2 } accounting { sql_instance2 } But in 3-d version i can't understand how it works. Where i can find more detail info about this in v3 with examples?

2 2

Authenticate by users file for RADIUS service operation check
by Seiichirou Hiraoka 08 Dec '16

08 Dec '16

Hello folks, I am using FreeRADIUS 3.0.4 on CentOS 7.2. In order to check the service operation of RADIUS, we are trying to authenticate with the users file, but proxy request is made. The setting is as follows. - /etc/raddb/proxy.conf realm "~^subdomain\.domain\.com$" { authhost = LOCAL accthost = LOCAL } home_server server1 { .... } home_server server2 { .... } home_server_pool server { type = fail-over home_server = server1 home_server = server2 } realm DEFAULT { pool = server nostrip } - /etc/raddb/users test(a)test.com Auth-Type := PAP , Cleartext-Password := "test" or test(a)test.com Auth-Type := Local , Cleartext-Password := "test" or test(a)test.com Cleartext-Password := "test" ... ----- When radtest command is executed with radiusd -X, the following result is obtained. # radtest test(a)test.com test localhost 0 testing123 Sending Access-Request Id 3 from 0.0.0.0:48661 to 127.0.0.1:1812 User-Name = 'test(a)test.com' User-Password = 'test' NAS-IP-Address = X.X.X.X NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Reject Id 3 from 127.0.0.1:1812 to 127.0.0.1:48661 length 36 Reply-Message = 'Request Denied' (0) -: Expected Access-Accept got Access-Reject The following log is output to the console. (snip) (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : Looking up realm "test.com" for User-Name = "test(a)test.com" (0) suffix : Found realm "DEFAULT" (0) suffix : Adding Realm = "DEFAULT" (0) suffix : Proxying request from user test(a)test.com to realm DEFAULT (0) suffix : Preparing to proxy authentication request to realm "DEFAULT" (0) [suffix] = updated (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) files : users: Matched entry test(a)test.com at line 1 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 59404 (0) Proxying request to home server X.X.X.X port 1812 timeout 30.000000 (0) Sending Access-Request packet to host X.X.X.X port 1812, id=85, length=0 (snip) ----- My question is how to authenticate users file without proxying ? Best regards!

1 0

Framed-IP-Address not inserted in mysql
by Bernd 07 Dec '16

07 Dec '16

Hi, running FreeRADIUS Version 3.0.4 (built for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36) from stock packages on a CentOS 7 machine. I have the problem that I see Framed-IP-Address entries in radacct log files: Wed Dec 7 15:11:57 2016 Acct-Session-Id = '0004xxxx' Framed-Protocol = PPP Framed-IP-Address = 10.2.3.4 User-Name = 'user(a)example.com' Acct-Session-Time = 111 Acct-Input-Octets = 3499 Acct-Output-Octets = 5252 Acct-Input-Packets = 45 Acct-Output-Packets = 57 Acct-Status-Type = Stop Service-Type = Framed-User Acct-Delay-Time = 0 NAS-IP-Address = 12.13.14.15 Event-Timestamp = 'Dec 7 2016 15:11:57 CET' Acct-Unique-Session-Id = '297cb70bcbc4a02b1d1xyz123' Timestamp = 1481119917 but they're *not* being inserted into the MySQL database (field is empty, tcpdump shows that clearly a '' is being transmitted to MySQL): INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('0004xxxx', '297cb70bcbc4a02b1d1xyz123', 'user(a)example.com', '', '12.13.14.15', '', '', FROM_UNIXTIME(1481119920), FROM_UNIXTIME(1481119920), NULL, '0', '', '', '', '0', '0', '', '', '', 'Framed-User', 'PPP', '') Help very much appreciated. Best, Bernd

2 1

RE: Set up /dev/null (no auth) proxy server on NULL realm
by Alan Buxey 07 Dec '16

07 Dec '16

I told you exactly what to do in my first reply (simple bit of unlang in the authorize section) alan

2 1

Set up /dev/null (no auth) proxy server on NULL realm
by Seiichirou Hiraoka 06 Dec '16

06 Dec '16

Hello folks, I use freeradius 3.0.4 on CentOS 7.2 (RPM) And I want to set up /dev/null (without auth) proxy server on NULL realm. Now, I set up my proxy.conf as follow. ----- realm NULL { authhost = 127.0.0.1:1645 accthost = 127.0.0.1:1646 secret = dummy } ----- No service exist in 127.0.0.1:1645, 1646. When user try to auth without realm (NULL realm), all authentication going to fail. I have some question. 1) Is my setting correct ? 2) Is there a way to set the timeout? (I want to set timeout to 0) 3) Any other advice? Best regards,

2 4

Calculating data usage between interim and stop packets.
by Anuruddha Premalal 05 Dec '16

05 Dec '16

Hi All, I'm trying to get users actual usage between accounting updates. With the folowing method, 1. Extended the python *preacct* method and filterout only interim updates and accounting stop packets. 2. Get the current usage recorded(inputoctets, outputoctets) from the mysql databse for the accounting sessionid group by date and take the latest value. 3. Take the difference between received input and output octets and the valus in the database *tx*= new_input_octets - old_input_octets *rx*= new_output_octets - old_output_octets 3. Send a paylod to a message queue pnly if *tx, rx* values are positive. I am trying to use this method to avoid periodic database polling to perform this operation. The issue is - at point 2 sometimes(intermittently) it returns an empty record set even the session has already been started (already received an accounting start). Is freeradius clearing the existing accouting record from the database as soon as it receives an accounting interim paccket - is there a way to insert my logic before that happens? Thanks & Best Regards, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122 <071%20721%203122>E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

2 2