- Freeradius-Users - lists.freeradius.org

Having a consistent Event-Timestamp format
by Anuruddha Premalal 13 Oct '16

13 Oct '16

Hi All, I'm using the 'Event-Timestamp' in the python module it's printed as follows. *Oct 12 2016 13:59:27 UTC* However the timestamp format present in the MySQL databse is *2006-01-02 15:04:00* Is it possible to enforce the same format as MySQL across the board?, I wasn't able to locate related documentation on this. PS : Freeradius version 3.0.8 Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

3 2

Additional double quotations in python tuples
by Anuruddha Premalal 13 Oct '16

13 Oct '16

Hi All, I'm experimenting with the python extension on freeradius 3.0.8 and faced the following issues. When I print the parameter 'p' of the authenticate(p), while executing * radtest test1 testing123 localhost 10 testing123* the output is seen as below, ('User-Name', '"test1"') ('User-Password', '"testing123"') ('NAS-IP-Address', '172.31.35.101') ('NAS-Port', '10') ('Message-Authenticator', '0x9a76d539575fdc05d187013433f49981') ('Event-Timestamp', '"Oct 13 2016 06:00:51 UTC"') Notice that there are some unwanted double quotations around *User-Name , User-Password *and *Event-Timestamp.* I could remove these unwanted strings but it's going to add some over head to the authentication process. Can I get rid of this unwantd double quatation without incuring any processing cost on python side? PS : These double quotations are also present in accounting packets as well. Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

2 1

freeradius-3.0.12 strange no-shared-cipher problem
by Alexander Sergeyev 13 Oct '16

13 Oct '16

Hi, I'm using a freeradius instance for 802.1x authentication with eap-tls. While everything works fine for my linux (and android) client machines, a windows 10 client is not going past tls client hello. From the freeradius server I'm getting this: Debug: eap_tls: Continuing EAP-TLS Debug: eap_tls: Peer sent flags --L Debug: eap_tls: Peer indicated complete TLS record size will be 174 bytes Debug: eap_tls: Got complete TLS record (174 bytes) Debug: eap_tls: [eaptls verify] = length included Debug: eap_tls: (other): before/accept initialization Debug: eap_tls: TLS_accept: before/accept initialization Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Debug: eap_tls: <<< recv TLS 1.2 [length 00a9] Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Debug: eap_tls: >>> send TLS 1.2 [length 0002] ERROR: eap_tls: TLS Alert write:fatal:handshake failure Error: tls: TLS_accept: Error in error Error: tls: TLS_accept: Error in error ERROR: eap_tls: Failed in __FUNCTION__ (SSL_read): s3_srvr.c[1418]:error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher ERROR: eap_tls: System call (I/O) error (-1) ERROR: eap_tls: TLS receive handshake failed during operation ERROR: eap_tls: [eaptls process] = fail The problem is that there is a shared cipher. Using a successfull server hello in a linux client connection, I can see what configuration is selected and clearly supported by the server. And the same configuration is actually proposed by the windows client too. Text dumps of tls hellos follow. Versions are: freeradius 3.0.12 and openssl 1.0.2j. Have anyone encountered similar problems? The client hello from windows includes some additional tls extensions -- could it be the cause? Here are text dumps of client hellos: linux client: 802.1X Authentication Version: 802.1X-2004 (2) Type: EAP Packet (0) Length: 304 Extensible Authentication Protocol Code: Response (2) Id: 181 Length: 304 Type: TLS EAP (EAP-TLS) (13) EAP-TLS Flags: 0x00 0... .... = Length Included: False .0.. .... = More Fragments: False ..0. .... = Start: False Secure Sockets Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 293 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 289 Version: TLS 1.2 (0x0303) Random GMT Unix Time: May 18, 2087 18:43:39.000000000 MSK Random Bytes: a8052b4f8ba5439503d03da61ea2eaad449c9c3a3e9f2ac6... Session ID Length: 0 Cipher Suites Length: 172 Cipher Suites (86 suites) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Cipher Suite: TLS_DH_DSS_WITH_AES_256_GCM_SHA384 (0x00a5) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 (0x00a3) Cipher Suite: TLS_DH_RSA_WITH_AES_256_GCM_SHA384 (0x00a1) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009f) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (0x006b) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 (0x006a) Cipher Suite: TLS_DH_RSA_WITH_AES_256_CBC_SHA256 (0x0069) Cipher Suite: TLS_DH_DSS_WITH_AES_256_CBC_SHA256 (0x0068) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_DH_RSA_WITH_AES_256_CBC_SHA (0x0037) Cipher Suite: TLS_DH_DSS_WITH_AES_256_CBC_SHA (0x0036) Cipher Suite: TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA (0x0088) Cipher Suite: TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA (0x0087) Cipher Suite: TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA (0x0086) Cipher Suite: TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA (0x0085) Cipher Suite: TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 (0xc032) Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02e) Cipher Suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 (0xc02a) Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 (0xc026) Cipher Suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA (0xc00f) Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA (0xc005) Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x0084) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Cipher Suite: TLS_DH_DSS_WITH_AES_128_GCM_SHA256 (0x00a4) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 (0x00a2) Cipher Suite: TLS_DH_RSA_WITH_AES_128_GCM_SHA256 (0x00a0) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (0x0067) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 (0x0040) Cipher Suite: TLS_DH_RSA_WITH_AES_128_CBC_SHA256 (0x003f) Cipher Suite: TLS_DH_DSS_WITH_AES_128_CBC_SHA256 (0x003e) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_DH_RSA_WITH_AES_128_CBC_SHA (0x0031) Cipher Suite: TLS_DH_DSS_WITH_AES_128_CBC_SHA (0x0030) Cipher Suite: TLS_DHE_RSA_WITH_SEED_CBC_SHA (0x009a) Cipher Suite: TLS_DHE_DSS_WITH_SEED_CBC_SHA (0x0099) Cipher Suite: TLS_DH_RSA_WITH_SEED_CBC_SHA (0x0098) Cipher Suite: TLS_DH_DSS_WITH_SEED_CBC_SHA (0x0097) Cipher Suite: TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA (0x0045) Cipher Suite: TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA (0x0044) Cipher Suite: TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA (0x0043) Cipher Suite: TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA (0x0042) Cipher Suite: TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 (0xc031) Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02d) Cipher Suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 (0xc029) Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 (0xc025) Cipher Suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA (0xc00e) Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA (0xc004) Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_SEED_CBC_SHA (0x0096) Cipher Suite: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x0041) Cipher Suite: TLS_RSA_WITH_IDEA_CBC_SHA (0x0007) Cipher Suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011) Cipher Suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xc007) Cipher Suite: TLS_ECDH_RSA_WITH_RC4_128_SHA (0xc00c) Cipher Suite: TLS_ECDH_ECDSA_WITH_RC4_128_SHA (0xc002) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012) Cipher Suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc008) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA (0x0010) Cipher Suite: TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA (0x000d) Cipher Suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA (0xc00d) Cipher Suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc003) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) Extensions Length: 76 Extension: ec_point_formats Type: ec_point_formats (0x000b) Length: 4 EC point formats Length: 3 Elliptic curves point formats (3) EC point format: uncompressed (0) EC point format: ansiX962_compressed_prime (1) EC point format: ansiX962_compressed_char2 (2) Extension: elliptic_curves Type: elliptic_curves (0x000a) Length: 28 Elliptic Curves Length: 26 Elliptic curves (13 curves) Elliptic curve: secp256r1 (0x0017) Elliptic curve: secp521r1 (0x0019) Elliptic curve: brainpoolP512r1 (0x001c) Elliptic curve: brainpoolP384r1 (0x001b) Elliptic curve: secp384r1 (0x0018) Elliptic curve: brainpoolP256r1 (0x001a) Elliptic curve: secp256k1 (0x0016) Elliptic curve: sect571r1 (0x000e) Elliptic curve: sect571k1 (0x000d) Elliptic curve: sect409k1 (0x000b) Elliptic curve: sect409r1 (0x000c) Elliptic curve: sect283k1 (0x0009) Elliptic curve: sect283r1 (0x000a) Extension: signature_algorithms Type: signature_algorithms (0x000d) Length: 32 Signature Hash Algorithms Length: 30 Signature Hash Algorithms (15 algorithms) Signature Hash Algorithm: 0x0601 Signature Hash Algorithm Hash: SHA512 (6) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0602 Signature Hash Algorithm Hash: SHA512 (6) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0603 Signature Hash Algorithm Hash: SHA512 (6) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0501 Signature Hash Algorithm Hash: SHA384 (5) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0502 Signature Hash Algorithm Hash: SHA384 (5) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0503 Signature Hash Algorithm Hash: SHA384 (5) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0401 Signature Hash Algorithm Hash: SHA256 (4) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0402 Signature Hash Algorithm Hash: SHA256 (4) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0403 Signature Hash Algorithm Hash: SHA256 (4) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0301 Signature Hash Algorithm Hash: SHA224 (3) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0302 Signature Hash Algorithm Hash: SHA224 (3) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0303 Signature Hash Algorithm Hash: SHA224 (3) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0201 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0202 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0203 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: ECDSA (3) windows client: 802.1X Authentication Version: 802.1X-2001 (1) Type: EAP Packet (0) Length: 184 Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 184 Type: TLS EAP (EAP-TLS) (13) EAP-TLS Flags: 0x80 1... .... = Length Included: True .0.. .... = More Fragments: False ..0. .... = Start: False EAP-TLS Length: 174 Secure Sockets Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 169 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 165 Version: TLS 1.2 (0x0303) Random GMT Unix Time: Oct 12, 2016 22:32:27.000000000 MSK Random Bytes: cfee7182be38061f0202a3b3ec374724eec7a7eea20270ad... Session ID Length: 0 Cipher Suites Length: 60 Cipher Suites (30 suites) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x009f) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d) Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 (0x006a) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 (0x0040) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) Extensions Length: 64 Extension: status_request Type: status_request (0x0005) Length: 5 Certificate Status Type: OCSP (1) Responder ID list Length: 0 Request Extensions Length: 0 Extension: elliptic_curves Type: elliptic_curves (0x000a) Length: 8 Elliptic Curves Length: 6 Elliptic curves (3 curves) Elliptic curve: Unknown (0x001d) Elliptic curve: secp256r1 (0x0017) Elliptic curve: secp384r1 (0x0018) Extension: ec_point_formats Type: ec_point_formats (0x000b) Length: 2 EC point formats Length: 1 Elliptic curves point formats (1) EC point format: uncompressed (0) Extension: signature_algorithms Type: signature_algorithms (0x000d) Length: 20 Signature Hash Algorithms Length: 18 Signature Hash Algorithms (9 algorithms) Signature Hash Algorithm: 0x0401 Signature Hash Algorithm Hash: SHA256 (4) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0501 Signature Hash Algorithm Hash: SHA384 (5) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0201 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0403 Signature Hash Algorithm Hash: SHA256 (4) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0503 Signature Hash Algorithm Hash: SHA384 (5) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0203 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0202 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0601 Signature Hash Algorithm Hash: SHA512 (6) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0603 Signature Hash Algorithm Hash: SHA512 (6) Signature Hash Algorithm Signature: ECDSA (3) Extension: SessionTicket TLS Type: SessionTicket TLS (0x0023) Length: 0 Data (0 bytes) Extension: Extended Master Secret Type: Extended Master Secret (0x0017) Length: 0 Extension: renegotiation_info Type: renegotiation_info (0xff01) Length: 1 Renegotiation Info extension Renegotiation info extension length: 0 After the client-hello from the windows system NAS replies with 802.1x failure; for the linux client here is server hello: 802.1X Authentication Version: 802.1X-2001 (1) Type: EAP Packet (0) Length: 558 Extensible Authentication Protocol Code: Request (1) Id: 183 Length: 558 Type: TLS EAP (EAP-TLS) (13) EAP-TLS Flags: 0x80 1... .... = Length Included: True .0.. .... = More Fragments: False ..0. .... = Start: False EAP-TLS Length: 1562 [2 EAP-TLS Fragments (1562 bytes): #6(1014), #8(548)] [Frame: 6, payload: 0-1013 (1014 bytes)] [Frame: 8, payload: 1014-1561 (548 bytes)] [Fragment Count: 2] [Reassembled EAP-TLS Length: 1562] Secure Sockets Layer TLSv1.2 Record Layer: Handshake Protocol: Server Hello Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 57 Handshake Protocol: Server Hello Handshake Type: Server Hello (2) Length: 53 Version: TLS 1.2 (0x0303) Random GMT Unix Time: Jun 23, 2069 22:43:44.000000000 MSK Random Bytes: f55c140ff16bab468b8f5d2f21e3cc8237090f9eebf23476... Session ID Length: 0 Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c) Compression Method: null (0) Extensions Length: 13 Extension: renegotiation_info Type: renegotiation_info (0xff01) Length: 1 Renegotiation Info extension Renegotiation info extension length: 0 Extension: ec_point_formats Type: ec_point_formats (0x000b) Length: 4 EC point formats Length: 3 Elliptic curves point formats (3) EC point format: uncompressed (0) EC point format: ansiX962_compressed_prime (1) EC point format: ansiX962_compressed_char2 (2) TLSv1.2 Record Layer: Handshake Protocol: Certificate Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 1155 Handshake Protocol: Certificate Handshake Type: Certificate (11) Length: 1151 Certificates Length: 1148 Certificates (1148 bytes) REDACTED TLSv1.2 Record Layer: Handshake Protocol: Server Key Exchange Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 247 Handshake Protocol: Server Key Exchange Handshake Type: Server Key Exchange (12) Length: 243 EC Diffie-Hellman Server Params Curve Type: named_curve (0x03) Named Curve: secp384r1 (0x0018) Pubkey Length: 97 Pubkey: 0409c1e40a860e38d72cc95fe4bed9bc01b2874f79fa74d3... Signature Hash Algorithm: 0x0603 Signature Hash Algorithm Hash: SHA512 (6) Signature Hash Algorithm Signature: ECDSA (3) Signature Length: 138 Signature: 30818702414f82bf2dc1f20e19ca281784a1023607d4ae4f... TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 83 Handshake Protocol: Certificate Request Handshake Type: Certificate Request (13) Length: 75 Certificate types count: 3 Certificate types (3 types) Certificate type: RSA Sign (1) Certificate type: DSS Sign (2) Certificate type: ECDSA Sign (64) Signature Hash Algorithms Length: 30 Signature Hash Algorithms (15 algorithms) Signature Hash Algorithm: 0x0601 Signature Hash Algorithm Hash: SHA512 (6) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0602 Signature Hash Algorithm Hash: SHA512 (6) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0603 Signature Hash Algorithm Hash: SHA512 (6) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0501 Signature Hash Algorithm Hash: SHA384 (5) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0502 Signature Hash Algorithm Hash: SHA384 (5) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0503 Signature Hash Algorithm Hash: SHA384 (5) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0401 Signature Hash Algorithm Hash: SHA256 (4) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0402 Signature Hash Algorithm Hash: SHA256 (4) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0403 Signature Hash Algorithm Hash: SHA256 (4) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0301 Signature Hash Algorithm Hash: SHA224 (3) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0302 Signature Hash Algorithm Hash: SHA224 (3) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0303 Signature Hash Algorithm Hash: SHA224 (3) Signature Hash Algorithm Signature: ECDSA (3) Signature Hash Algorithm: 0x0201 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: RSA (1) Signature Hash Algorithm: 0x0202 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: DSA (2) Signature Hash Algorithm: 0x0203 Signature Hash Algorithm Hash: SHA1 (2) Signature Hash Algorithm Signature: ECDSA (3) Distinguished Names Length: 37 REDACTED Handshake Protocol: Server Hello Done Handshake Type: Server Hello Done (14) Length: 0

1 0

Freeradius + Cisco Anyconnect group policy
by Pico Aeterna 12 Oct '16

12 Oct '16

reeradius + Cisco Anyconnect group policy Greetings, I recently just deployed a freeradius server to authenticate our Cisco Anyconnect VPN users against pam/google's OTP. My configs are in place and everything is working fine however recently we've taken on a few contractors that I would like to restrict to a specific tunnel-group/split-tunnel. I dont mind creating SSH accounts for them just as long as they have the correct split-tunnel/group policy assigned. Currently my test user can log into both tunnel-groups. Currently in users.conf my auth default type is "DEFAULT Auth-Type := PAM" Can this be done via /etc/group + pam or do I need to add these users to users.conf and then apply the attributes "ASA-Group-Policy" and "ASA-IPsec-Split-Tunnel-List" to them? Should I see the policy/tunnel-group name being sent from my ASA to my radius server? This is currently what I see via raddb -XXX when I connect using either tunnel-group. Received Accounting-Request Id 174 from x.x.x.x:1026 to x.x.x.x:1813 length 135 User-Name = 'username' NAS-Port = 122380288 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x Called-Station-Id = 'x.x.x.x' Calling-Station-Id = 'x.x.x.x' Acct-Status-Type = Start Acct-Delay-Time = 2 Acct-Session-Id = 'B5F00188' Acct-Authentic = RADIUS NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = 'x.x.x.x' NAS-IP-Address = x.x.x.x Does anyone currently have this implemented or a sample config I can review, or am I going about it in the wrong way? radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Mar 5 2015 at 23:41:36

2 1

Re: FRS-3.0.4 Questions about radiusd.conf
by John Kristoff 12 Oct '16

12 Oct '16

On Wed, 12 Oct 2016 15:16:07 +0000 Mark Williams <martialstudy(a)hotmail.com> wrote: > I have some questions about the max_queue_size and > max_requests_per_server which can be set in radiusd.conf . > Max_queue_size is commented out by default; does that mean the > default is infinity? According to the documentation here: <http://networkradius.com/doc/current/raddb/radiusd.html> The default is 65536. > Also, what are the thoughts of the community on > max_requests_per_server? Do most of you leave that value at 0 > (=infinity) or set it to some value and force the server to reset > resources every so often? Inline comments suggest it's not normally > needed. It should be fine to leave at the default as I believe most installations do. I suppose it might be a defensive mechanism if you're afraid of running into a potential leak, but I think you may more likely suffer some performance-related penalty when or if it has to spend time clean restarting threads. It should be safe and is probably best to leave at the default of zero unless you have a really good, specific reason to change it. John

1 0

FRS-3.0.4 Questions about radiusd.conf
by Mark Williams 12 Oct '16

12 Oct '16

I have some questions about the max_queue_size and max_requests_per_server which can be set in radiusd.conf . Max_queue_size is commented out by default; does that mean the default is infinity? Also, what are the thoughts of the community on max_requests_per_server? Do most of you leave that value at 0 (=infinity) or set it to some value and force the server to reset resources every so often? Inline comments suggest it's not normally needed.

1 0

radiusd halts when LDAP bind fails.
by Scott McLane Gardner 12 Oct '16

12 Oct '16

Hi list. I am trying to troubleshoot my radiusd occasionally halts when failing to bind with the LDAP server. I would prefer it to maybe wait a minute and restart rather than halting. Is this usual behavior? The wiki for rlm_ldap says: set the uses, lifetime and idle_timeout settings in the pool section of the LDAP module to zero But I have already set this value. I realize this means the server can't contact the LDAP server to do the auth, but I would prefer the service to be more resilient if possible. Preferably without having to do some cron or nagios scripting magic. (I'm open to it, but I wonder if there's a native handler for this?) Usually LDAP and radiusd are fine even very shortly after halting. https://directory.uark.edu/people/sgardne Senior Network Engineer University of Arkansas, ITS-NET

7 9

External, non-RADIUS databases
by J Kephart 11 Oct '16

11 Oct '16

I have two different FR deployments, one running a MySQL database, the other Postgres. Those are working as they should. The requirement we have is that, on each of them, we need to be able to connect a captive portal server so that we can query a non-radius database for a specific boolean value that will determine whether or not radius will execute a set of instructions. Is the process for this as simple as defining the main (radius) instance, and then a second instance for the external database (e.g., sql sqlinstance1 { ... }, sql sqlinstance2 { ... }), with the appropriate connection information for both, and then changing the sql stuff in auth... and accounting sections to use sqlinstance1 for radius queries, and sqlinstance2 for the external database? If I'm reading the docs on rlm_mysql correctly, I'm thinking it is, but I just want to confirm it, as we've not done anything beyond a basic deployment as yet. Thanks for any advice! Jim

3 5

Problems with CA using PEAP/TTLS
by dump＠gmx.info 11 Oct '16

11 Oct '16

Dear list. I'm using freeradius 2.2.5 on debian for authentication of wireless access. The problem is that authenticating clients (I'm using PEAP/TTLS) works only if the CA-certificate is ignored by the client side. When trying to authenticate the clients using the CA in Network-Manager the authentication fails. The server certificate of freeradius is correctly signed and the public CA is selected at the clients (linux using Network-Manager). Is there a possibility to catch the server certificate on the client side after the transfer to the client. And then checking this server certificate signature against the locally installed CA-certificate by hand? For example using tcpdump? Many thanks in advance Jens

3 2

multiotp web service on CentOS 7 and Apache
by Skrebetz, Pete 11 Oct '16

11 Oct '16

The documentation for how to configure the webserver so that it's not only displaying multiotp.webserver.php but actually working through to the backend is pretty sparse. Has anyone else set this up on Linux? I copied the entire multiotp directory to /var/www/html, but the web front end never seemed to actually add users. Thanks, Pete

1 0