- Freeradius-Users - lists.freeradius.org

Help for configuration 3.0.11
by Philipp Trenz 29 Sep '16

29 Sep '16

Hi freeradius-list, I'm trying to configure v3.0.11 and have some problems to understand how freeradius requests the configuration. The plan is to process requests via PEAP/MS-CHAPv2 to check MD4-Hashes against NT-Password-Attribute at a LDAP database. As I understand, PEAP gets processed within the outer default-virtual server and this passes the inner MS-CHAPv2 to inner-tunnel. Now I'm not shure if it has to be processed through the mschap-module or through ldap-module. If mschap-module where or when does freeradius get the NT-Password from LDAP? Does the mschap-module trigger the ldap-module? In details I want to upgrade a working 2.0.0 configuration to 3.0.11 (and then update to the upcoming 3.0.12 release). Another point I'm struggeling are the mappings of the LDAP attributes. I have the old ldap.attrmap, but don't know how to bring checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem to the new configuration. changing the NT-Password is more simple ;) Later on some requests should get proxied via RadSec depending on their REALM, but for now having the above working would make me quite happy. I'm very thankful for your help! Thanks!

3 2

missing.auth.so
by Ejaz 28 Sep '16

28 Sep '16

While running radiusd -X, I have following error. Would you please help.. # Loading post-auth { ...} I # server inner tunnel server default { # from file fusr/locat/freeradius3 etc/raddbisites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading accounting (...) # Loading post auth f...} 1 # server default radiusd: #### Opening IP addresses -,.d Por-Is #### listen f type = "auth" ipaddr . 172.1.40.14 port , 18120 listen type - "auth' ipaddr * port = 0 limit { max_connections lifetime 0 idletimeout = 30 Failed inding to auth a..ress 4- port 1812 bound to server .e au t: EADDRINUSE: Ad.ress a ready in use iusr/local/freeradlus3/etc/raddb/-enabledidefault[59]: Error binding to port for 0.0.0.0 port 1812 EXIT(1) CALLED src r'2.53]. ,,- error was: 1d.,0.1: radiusd: fatal: /usr/local/freeradius3/libi.roto <http://auth.so:> auth.so: o.en failed: No such Thanks, Mohammed Ejaz Asst. Operation Director of Systems. Cyberia SAUDI ARABIA P.O.Box: 301079, Riyadh 11372 Phone: (+966) 11 464 7114 Ext. 140 Mobile: (+966) 562311787 Fax: (+966) 11 465 4735 Website: http://www.cyberia.net.sa

3 4

AnyEvent::Hiredis module crashes when redis connection failed
by feroze waris 28 Sep '16

28 Sep '16

Hi All I am using Freeradius 2.2.1 server with AnyEvent::Hiredis module to connect to redis server. When my redis server stops or unreachable freeradius crashes with the following error rlm_perl: perl_embed:: module = /usr/local/etc/raddb/example.pl , func = accounting exit status= ac does not have a struct associated with it at /usr/local/share/perl5/AnyEvent/Hiredis.pm line 84. I also tried exception handling using Trycatch to catch the error but it is not working because radius already crashes before replying with error. Regards Feroze

2 2

PEAP/TTLS
by Peter Lesko 27 Sep '16

27 Sep '16

I'm having a similar issue to the one described here: http://freeradius.1045715.n5.nabble.com/PEAP-TTLS-and-Client-certificates-t… Currently, I can auth with just a signed cert, or just username/password I would like to enforce both, but I have been unable to determine the correct keywords/config after reading many forum posts, in addition to the comments provided in the default configuration I have attempted to add this config line to enforce signed certs in sites-available/default: EAP-TLS-Require-Client-Cert = yes This causes freeradius not to start for me though, and I'm pretty certain I have tried putting that in each block present in the file As for requiring user/password auth, I have tried: DEFAULT EAP-Type == EAP-Type-TLS, Auth-Type := Reject Which causes freeradius to fail to load DEFAULT EAP-Type == EAP-TLS, Auth-Type := Reject Which still allows EAP-TLS only DEFAULT EAP-Type != PEAP, Auth-Type := Reject Which still allows EAP-TLS only as well Please advise Thanks in advance, -Pete

4 5

accounting packet loss
by liran kessel 27 Sep '16

27 Sep '16

Hi In the past I have asked regarding this message that appears in the radius log Tue Sep 27 17:01:06 2016 : Error: Received conflicting packet from client XXXXXX port 33542 - ID: 47 due to unfinished request 885176866. Giving up on old request. and you explained that this is a problem probably because of my Mysql that is not managing to write quickly enough to the DB, and I understand that. However after changes we have made to other processes that run on the MySQL we have reached the point that we are only loosing messages for 2 or 3 seconds every 15 minutes when our scheduled processing runs. What I want to do is try and configure the radius to have a large enough cache to be able to handle this short spikes without losing messages, as I don’t have shortage in RAM. I have played around with the following parameters in the radiusd.conf file but they don’t see to be helping . max_requests max_request_time cleanup_delay we are not sending a reply ack to the GGSN for any message so cleanup delay as I understand it isn’t critical. is there a solution for me to “force” freeradius to be able to handle the MySQL problem without dropping messages? Thanks in Advance. Liran Kessel

5 7

Release of 3.0.12
by Alan DeKok 27 Sep '16

27 Sep '16

A belated request for last-minute tests of 3.0.12. I've pushed some changes to complain about OpenSSL. They work for me, but another check would be useful. If all is OK, I'll release 3.0.12 on Monday. For real this time. Alan DeKok.

5 10

Android and iOS and session-timeout with EAP
by Clayton Knorr 26 Sep '16

26 Sep '16

Does anybody know if Android and iOS just automatically try to reauthenticate after an hour or so (using PEAP or similar) regardless of what the session-timeout value is set to? I have been adjusting the value and I can see that the value is being sent in the reply. It seems like Windows is staying connected without reauthenticating early but Android and iOS do.

4 5

squid proxy login after freeradius login ( like SSO)
by Kouata Modibo 26 Sep '16

26 Sep '16

Hi, I'm using FreeRADIUS Version 2.2.5. I use ttls/chap for authentification. Users must use login/password to authentificate. After freeradius validation, they have to authentificate against proxy squid. freeradius and squid proxy are using the same database for authentification. now I would like to do SSO. In other word, when I user authentificate against freeradius, freeradius must request the squid proxy for user authentification for web browsing. can you help me ? thank you sande7kouata(a)gmail.com

2 1

Can't get rid of OpenSSL-message
by Philipp Trenz 26 Sep '16

26 Sep '16

Hi there, I newly compiled 3.0.12 for the upcoming release, but I can't get rid of the issue messages of openssl. openssl is already patched, allow_vulnerable_openssl = 'CVE-2016-6304' and allow_vulnerable_openssl = 'CVE-2014-0160' are added at the end of security {}. Running freeradius on a CentOS 7. Is this a bug or am I missing something? Thanks for help! radiusd -X last output: Debugger not attached Refusing to start with libssl version OpenSSL 1.0.1e-fips 11 Feb 2013 0x1000105f (1.0.1e release) (in range 1.0.1 dev - 1.0.1f release) Security advisory CVE-2014-0160 (Heartbleed) For more information see http://heartbleed.com Once you have verified libssl has been correctly patched, set security.allow_vulnerable_openssl = 'CVE-2014-0160' Refusing to start with libssl version OpenSSL 1.0.1e-fips 11 Feb 2013 0x1000105f (1.0.1e release) (in range 1.0.1 release - 1.0.1t rele) Security advisory CVE-2016-6304 (OCSP status request extension) For more information see https://www.openssl.org/news/secadv/20160922.txt Once you have verified libssl has been correctly patched, set security.allow_vulnerable_openssl = 'CVE-2016-6304'

3 2

Exercising Challenge/Response code path in pam client?
by Richard Perrin 24 Sep '16

24 Sep '16

Hi, I'm seeking a simple as possible config for freeradius server (version 2.1.12+dfsg-1.2ubuntu8.1 in Ubuntu 14.04) that would allow me to exercise the Challenge/Response path in the pam client (packaged as libpam-radius-auth-1.3.17). I see PW_ACCESS_CHALLENGE in several modules, but I haven't made the leap on how to configure the server to have pam-radius-auth (currently successfully authenticating against the server) receive an Access-Challenge instead of Accept/Reject. My end goal is verification of the client side code, rather than a production server deployment. Could you please provide me with guidance? Thanks Alan, and others, for both these pieces of software. - Richard Perrin

2 7