- Freeradius-Users - lists.freeradius.org

Re: 4.0.x Release Date
by Philipp Trenz 20 Sep '16

20 Sep '16

Hi, thanks for answering. The main functionality I need is RadSec I'm not very shure on which version it is practical to use. The other things I'll get to work I think. Maybe you can get me a hint which version, or which not, to use? Thank you much! Am Montag, 19. September 2016, 19:19:52 CEST schrieb freeradius-users- request(a)lists.freeradius.org: > > Message: 1 > Date: Mon, 19 Sep 2016 12:51:15 +0000 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 4.0.x Release Date > Message-ID: > <DB5PR04MB111196F42778A4E93A555AD1A7F40(a)DB5PR04MB1111.eurprd04.prod.outlo ok > .com> > > Content-Type: text/plain; charset="iso-8859-1" > > hi, > > >More precice I'm standing before the questions to wait for the next > >release while using 3.0.x or 4.0.x. It will be no complex > >infrastructure, just LDAP, PEAP w. MS-CHAPv2 and unsing the proxy. > > a common question. if you want latest features, then 3.1.x will do the > MSCHAPv2 stuff for you much better with winbind native and the LDAP > stuff is much better too. > > *currently* there is little difference with 3.1.x and 4.0.x config BUT that > is set to change massively. (I'd prefer the big changes just go to 4.1.x > and 4.0.x becomes what it is now.....) > > (so whilst docs may say one thing, it may be best to wait for main > developers to have a clear answer!) > > alan > > > > ------------------------------ > > Message: 2 > Date: Mon, 19 Sep 2016 08:59:24 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 4.0.x Release Date > Message-ID: <CBE58A41-403B-46AE-8E14-4C87C7C8C561(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Sep 19, 2016, at 8:51 AM, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> wrote: > > *currently* there is little difference with 3.1.x and 4.0.x config BUT > > that is set to change massively. (I'd prefer the big changes just go to > > 4.1.x and 4.0.x becomes what it is now.....) > Major releases are for changes which break configurations. We don't do > that in a minor release. > > We can't release version 3.2. OS vendors refuse to upgrade for years, and > we just don't have enough people to to support 4-5 "stable" releases > > (so whilst docs may say one thing, it may be best to wait for main > > developers to have a clear answer!) > > Use 3.0. > > If you know what you're doing, and you *need* the functionality in 3.1, > then use 3.1. > > Otherwise, wait for 4.0. > > Alan DeKok. > > > > > ------------------------------ > > Message: 3 > Date: Mon, 19 Sep 2016 13:02:49 +0000 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 4.0.x Release Date > Message-ID: > <DB5PR04MB1111641E8D515F21292200D6A7F40(a)DB5PR04MB1111.eurprd04.prod.outlo ok > .com> > > Content-Type: text/plain; charset="iso-8859-1" > > hi, > > so the key message is > > "Use 3.0, unless you know what you're doing, and you *need* the > functionality in 3.1, then use 3.1. Otherwise, wait for 4.0" > > - so if people are aware of 3.1.x extra functionality, thats okay - but what > about bugs/issues found in 3.1.x ? > > alan > > > > > ------------------------------ > > Message: 4 > Date: Mon, 19 Sep 2016 09:20:59 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 4.0.x Release Date > Message-ID: <CC6CEE2D-FE14-4769-BF8A-8F8818B5E856(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Sep 19, 2016, at 9:02 AM, Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> wrote: > > so the key message is > > > > "Use 3.0, unless you know what you're doing, and you *need* the > > functionality in 3.1, then use 3.1. Otherwise, wait for 4.0" > > Yes. > > > - so if people are aware of 3.1.x extra functionality, thats okay - but > > what about bugs/issues found in 3.1.x ? > Submit a patch. > > We can commit to maintaining 3.0, and doing development on 4.0. Adding > another release is just too much. > > So... anyone needing a fix in 3.1 should submit a fix. :( > > Alan DeKok. > --

2 1

LDAP failure and Freeradius
by Clayton Knorr 19 Sep '16

19 Sep '16

So, when the ldap module can't bind to the ldap server, it fails to start. I found something in the archives about how to fix this but it was for freeradius 2.x. I'm using it for EAP authentication. I want freeradius to still start and fall back on other forms of authentication like file. Do I need an option in one of the files in policy.d?

2 1

Re: (freeradius 3) I'm trying to integrate freeradius with active directory in cenos 7.
by Marcelo Martinez 19 Sep '16

19 Sep '16

Thanks, I saw this link and tryied these steps... ntlm_auth --request-nt-key --domain=TEST.UY --username=administrator --password=xxxx could not obtain winbind separator! Reading winbind reply failed! (0x01) : (0x0) I already joined the Active Directory domain with the procedure previously posted, I need to start from here and not undo my working configuration. Any help please? On Fri, Sep 16, 2016 at 6:34 PM, Marcelo Martinez < marcelo.martinez(a)nexa.com.uy> wrote: > Thanks, > > I saw this link and tryied these steps... > > ntlm_auth --request-nt-key --domain=TEST.UY --username=administrator > --password=xxxx > could not obtain winbind separator! > Reading winbind reply failed! (0x01) > : (0x0) > > > I already joined the Active Directory domain with the procedure previously > posted, I need to start from here and not undo my working configuration. > > Any help please? > > > On Fri, Sep 16, 2016 at 6:01 PM, Alan DeKok-2 [via FreeRADIUS] < > ml-node+s1045715n5742599h53(a)n5.nabble.com> wrote: > >> On Sep 16, 2016, at 4:47 PM, Marcelo Martinez <[hidden email] >> <http:///user/SendEmail.jtp?type=node&node=5742599&i=0>> wrote: >> > I'm trying to integrate freeradius with active directory in cenos 7. >> >> Follow my guide. it WILL work: >> >> http://deployingradius.com/documents/configuration/active_directory.html >> >> Alan DeKok. >> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >> /users.html >> >> ------------------------------ >> If you reply to this email, your message will be added to the discussion >> below: >> http://freeradius.1045715.n5.nabble.com/freeradius-3-I-m-try >> ing-to-integrate-freeradius-with-active-directory-in- >> cenos-7-tp5742598p5742599.html >> To unsubscribe from FreeRADIUS, click here >> <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsu…> >> . >> NAML >> <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macr…> >> > >

4 7

acctuniqueid
by Aurélio de Souza Ribeiro Neto 19 Sep '16

19 Sep '16

Hello All, I'm using FreeRadius 2.2.9. I'm experiencing some problems with acctuniqueid. My users allways come from the same NAS, and I have this errors: Error: [sql] Couldn't insert SQL accounting START record - Duplicate entry '8805551441c487d8' for key 'acctuniqueid' My acct_unique sesssion is: acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } I think if I put additional clause like timestamp or something like this, I can solve my problem. Any suggestion? Aurelio

3 5

4.0.x Release Date
by Philipp Trenz 19 Sep '16

19 Sep '16

Hi FR-Team, I started configuring an FR Server and asked here which version I should choose. I got adviced to take 3.1.x and update to the upcoming 3.2 release. Now I read that this release will be skipped and next will be 4.0.x. Thats why I want to ask when the release will come up and how stable the 4.0.x branch is, is it stable enough to run it on a wide field? When will be the 4.0.x release? More precice I'm standing before the questions to wait for the next release while using 3.0.x or 4.0.x. It will be no complex infrastructure, just LDAP, PEAP w. MS-CHAPv2 and unsing the proxy. What's your advice? Thanks! --

3 5

LDAP distinguished name escaping
by Rob Johnson [rbj] 19 Sep '16

19 Sep '16

Hi all, I am pretty new to freeradius so please bear with me. Version 3.0.11 I am using the python module to return a DN based off the caller IP: def authorize(p): print "*** authorize ***" ip = getValue(p,'NAS-IP-Address') if ip == xxx.xxx.xxx.xxx: LDAPBaseDN = 'OU=MIS,OU=Auth,DC=ldap,DC=xx,DC=xx,DC=xx else: LDAPBaseDN = 'OU=Radius,OU=Auth,DC=ldap,DC=xx,DC=xx,DC=xx #LDAPBaseDN = 'OURadius' radiusd.radlog(radiusd.L_INFO, '*** radlog call in authorize ***') reply = (('Tmp-String-0',LDAPBaseDN),) return (radiusd.RLM_MODULE_OK, reply, None) This works and returns: *** authorize *** *** radlog call in authorize *** rlm_python:authorize: 'reply:Tmp-String-0' = 'OU=Radius,OU=Auth,DC=ldap,DC=xx,DC=xx,DC=xx' (0) [python] = ok But the problem lies in the ldap module by where I am trying to access the value in order to formulate my base_dn value: base_dn = "%{reply:Tmp-String-0}" The DN is escaped and obviously the the ldap bind fails due to the escaping: ldap: EXPAND %{reply:Tmp-String-0} (0) ldap: --> OU\3dRadius\2cOU\3dAuth\2cDC\3dldap\2cDC\3dxx\2cDC\3dxx\2cDC\3dxx (0) ldap: Performing search in "OU\3dRadius\2cOU\3dAuth\2cDC\3dldap\2cDC\3dxx\2cDC\3dxx\2cDC\3dxx" with filter "(CN=radius)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: ERROR: Failed performing search: Invalid DN syntax I have tried using the ldap unescape method but to no joy. Please can someone help? Thanks, Rob -------------------------------------------------------------------- Un o'r 4 prifysgol uchaf yn y DU a'r gorau yng Nghymru am fodlonrwydd myfyrwyr (Arolwg Cenedlaethol y Myfyrwyr 2016) www.aber.ac.uk Top 4 UK university and best in Wales for student satisfaction (National Student Survey 2016) www.aber.ac.uk

4 6

(freeradius 3) I'm trying to integrate freeradius with active directory in cenos 7.
by Marcelo Martinez 16 Sep '16

16 Sep '16

Hello, I'm trying to integrate freeradius with active directory in cenos 7. The steps I did to join the client to AD domain here: yum install realm realm discover 10.8.10.109 test.uy type: kerberos realm-name: TEST.UY domain-name: test.uy configured: no server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common yum -y install oddjob oddjobmkhomedir sssd adcli sambacommon yum install -y krb5workstation hostnamectl set-hostname prueba realm join -U Administrator test.uy ssh administrator@test.uy@localhost [administrator@test.uy@prueba ~]$ Done! Now I need help to install and configure freeradius and delegate authentication with active directory users. >From here, is there a guide to configure freeradius / active directory authentication? I tryied with different guides but I can't do the job yet... Thanks in advance.-

2 1

Troubleshooting EAP-TLS with External Certificates
by Matthew West 16 Sep '16

16 Sep '16

Hello FreeRADIUS Users, Thank you for taking my question. I am in the process of troubleshooting the EAP-TLS process using the following version of FreeRADIUS: radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu openssl: openssl-1.0.1e-48.el6_8.1.x86_64 I've gotten successful authentication using PAP through a switch with a test user, so the service is available and the client switch is communicating correctly. FreeRADIUS starts just fine, has the correct client, EAP loads, and points to the correct certs. I also have a client certificate in the certificate directory. Server certificate (star.companyname.net) was issued by GoDaddy and my (client) certificate was issued by VeriSign. I am pointing to the GoDaddy CA bundle for the server, but am not sure where to put the 'user' certificate chain (or does the whole chain need to be in the user cert)? Am I interpreting the error correctly? That the client cert appears to be self signed? radius -X OUTPUT: ==================== ... radiusd: #### Loading Clients #### client ***-CORP-SW1 { ipaddr = 10.x.x.123 require_message_authenticator = no secret = "xxxxxx" } ... ... Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } ... ... Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/star.XXX.net.key" certificate_file = "/etc/raddb/certs/star.XXX.net.crt" CA_file = "/etc/raddb/certs/gd_bundle-g2.crt" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } ... ... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ... When a request is made, I receive the following output: ... # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "Matthew West", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 20 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 11fa], Certificate --> verify error:num=19:self signed certificate in certificate chain [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> Matthew West attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 39 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 39 Sending Access-Reject of id 104 to 10.***.***.123 port 1645 EAP-Message = 0x04140004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 30 ID 95 with timestamp +227 Cleaning up request 31 ID 96 with timestamp +227 Cleaning up request 32 ID 97 with timestamp +227 Cleaning up request 33 ID 98 with timestamp +227 Cleaning up request 34 ID 99 with timestamp +227 Cleaning up request 35 ID 100 with timestamp +227 Cleaning up request 36 ID 101 with timestamp +227 Cleaning up request 37 ID 102 with timestamp +227 Cleaning up request 38 ID 103 with timestamp +227 Waking up in 1.0 seconds. Cleaning up request 39 ID 104 with timestamp +227 Ready to process requests. ... Any help appreciated. Thank You, Matthew

8 32

Metrics and timings
by Louis Munro 16 Sep '16

16 Sep '16

Hello, I am curious to know what people use, if anything, to collect metrics about the various database calls that FreeRADIUS does. E.g. How fast is that LDAP server, or that SQL database? Sure you can measure some of that from the database side itself, and radsniff can give you some idea of the latency for your requests, but what do you do if you make multiple calls to a series of servers, some of which you may not have access to (cough.. AD server )? I have in the past written a wrapper for ntlm_auth that was logging the times (and sent them to a statsd server) but that process is now going away -- which is a good thing -- and that case does not cover metrics for FR's own modules. Ideally I'd like to be able to point to a slowdown in one submodule (redis, ldap, sql, winbind etc.) to explain why the total latency has increased. Short of adding metrics to each module I want them from (something I have played with using a statsd client library) is there a recommended way of getting that information? Especially if I want historical data to be able to compare against for anomaly detection or capacity planning? Any suggestions are welcome and appreciated. -- Louis Munro lmunro(a)inverse.ca <mailto:lmunro@inverse.ca> :: www.inverse.ca <http://www.inverse.ca/> +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu <http://www.sogo.nu/>) and PacketFence (www.packetfence.org <http://www.packetfence.org/>)

3 4

Help troubleshooting No EAP session matching...
by Dave Aldwinckle 16 Sep '16

16 Sep '16

Hi List, During periods of high load, we are seeing many messages like the following: radiusd[28187]: rlm_eap: No EAP session matching the State variable. I understand the meaning of the message, but I need some assistance on how to go about locating the source of the problem. During peak times, we have about 8K wireless logins per minute, for extended periods. We have 6 wireless controllers, from which the Access-Requests are sent. Due to the high load, I am unable to run the server with -X, because it gets crushed while running single threaded. I can use radmin, but I'm not sure what to set the debug condition to. I don't see any errors about child processes being hung, or winbind/ntlm_auth taking too long. Some values which may be relevant: radiusd.conf: max_request_time = 30 radiusd.conf: cleanup_delay = 5 radiusd.conf: max_requests = 8000000 #about 30K wireless users at peak * 256 ~= 8million radiusd.conf: start_servers = 5 radiusd.conf: max_servers = 32 radiusd.conf: min_spare_servers = 3 radiusd.conf: max_spare_servers = 10 radiusd.conf: # max_queue_size = 65536 (unsure why this is commented out) mods-enabled/eap: timer_expire = 60 mods-enabled/eap: cache = disabled $ openssl speed rsa2048 Doing 2048 bit private rsa's for 10s: 5263 2048 bit private RSA's in 10.01s Doing 2048 bit public rsa's for 10s: 176233 2048 bit public RSA's in 10.00s OpenSSL 1.0.1e-fips 11 Feb 2013 built on: Mon May 2 06:13:20 EDT 2016 options:bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM sign verify sign/s verify/s rsa 2048 bits 0.001902s 0.000057s 525.8 17623.3 So, a couple questions: 1. Is there a way to get more info along with the message "rlm_eap: No EAP session matching the State variable." ? - eg. Which NAS it came from, calling-station-id, etc. 2. Are the aforementioned values OK? Any advice would be appreciated. Regards, Dave

4 16