- Freeradius-Users - lists.freeradius.org

Re: Freeradius integration with EJBCA
by Jitendra 18 Aug '16

18 Aug '16

Hello All, I have installed Ejbca and have it up and running for creating end entity certificates. However i am now unsure on how to configure eap-tls for freeradius with respect to the crl/certs produced by ejbca. Can anyone give me any pointers or a place where i can find some instructions? Regards, Jit On Wed, 17 Aug 2016 at 2:24 PM, Jitendra <jkilambi(a)gmail.com> wrote: > Hello All, > > I have installed Ejbca and have it up and running for creating end entity > certificates. However i am now unsure on how to configure eap-tls for > freeradius with respect to the crl/certs produced by ejbca. Can anyone give > me any pointers or a place where i can find some instructions? > > Regards, > Jit > -- > Kind Regards, > Jitendra > -- Kind Regards, Jitendra

4 5

Some Errors
by Oscar Jofre 18 Aug '16

18 Aug '16

Hi, I have some errors I don't know how to fix. I'm using freeradius 3.0.10 with lots of mikrotiks-hotspots connected and working apparently perfect. I'm adjusting to send on nasipaddress a unique IP for each mikrtoik-hotspot client. But now this is how looks raddact form 3 different hotspot-clients (each one on different ubications ) radacctid acctsessionid acctuniqueid username groupname realm nasipaddress nasportid nasporttype acctstarttime acctupdatetime acctstoptime acctinterval acctsessiontime acctauthentic connectinfo_start connectinfo_stop acctinputoctets acctoutputoctets calledstationid callingstationid acctterminatecause servicetype framedprotocol framedipaddress 16212900 80b0bb84 078cf7cca5b2a613beee2af0316de662 SwB_336391_ins_837_D8:1D:72:9C:35:49 192.168.32.4 bridge-hs Wireless-802.11 "2016-08-17 16:58:12" "2016-08-17 16:58:12" NULL NULL 0 0 0 606B051E73E5 D8:1D:72:9C:35:49 10.1.115.164 16212899 80b0017e 687f7a16adc44bbad5743f50c86e95f3 SwB_720082_ins_126_F4:31:C3:51:12:69 192.168.1.33 bridge-hs Wireless-802.11 "2016-08-17 16:58:09" "2016-08-17 16:58:09" NULL NULL 0 0 0 573205E971AE F4:31:C3:51:12:69 10.1.100.10 16212897 80500074 ca131c5822c708388105edc55430eb18 SwB_667778_ins_1441_58:7F:57:C3:97:E9 192.168.3.34 bridge-hs Wireless-802.11 "2016-08-17 16:58:05" "2016-08-17 16:58:05" NULL NULL 0 0 0 6431052C6C1E 58:7F:57:C3:97:E9 10.1.102.11 I don't know if it can be seen correctly. The Errors I'm getting during August: 1) 41.800 Error lines on log Fri Aug 12 22:54:32 2016 : ERROR: (47435677) detail: ERROR: Couldn't open file /var/log/radius/radacct/81.35.84.203/detail-20160812: Too many different filenames It only happens form 19:00 or 20:00 until 00:00:04 or so .. Seems a limitation of Centos 7 ? 2) 24.981 Error lines on log Mon Aug 15 17:41:21 2016 : Error: (48439939) Discarding duplicate request from client 0.0.0.0/0 port 60621 - ID: 195 due to delayed response This error appears 5 times from 1 to 15 August and from 15 august until now (24.981) lots of times evey hour ! Don't know how to find the client or radius request from ID 195 ... I didn't change anything from radius configuration so don't know why starts this error now. 3) 8.545 Errors lines on log Wed Aug 17 05:57:24 2016 : Error: Received conflicting packet from client 0.0.0.0/0 port 59102 - ID: 8 due to unfinished request. Giving up on old request. Wich are the keys parameters to identify each request differents ? In my configuration I'm working to identify each hotspot-client with a different nasipaddress but I don't know if it is enough . Thanks for the help ! Still difficult for me to understand everything from radius communication.

2 1

check-eap-tls
by Thomas Massip 17 Aug '16

17 Aug '16

Hi all, I try to use the virtual server 'check-eap-tls', but when I start FreeRadius with '-radiusd -XXXX' I have this error : Wed Aug 17 16:18:39 2016 : Error: /opt/fr3/etc/raddb/sites-enabled/check-eap-tls[63]: Parse error in condition Wed Aug 17 16:18:39 2016 : Error: /opt/fr3/etc/raddb/sites-enabled/check-eap-tls[63]: ("host/%{TLS-Client-Cert-Common-Name}" == &User-Name) { Wed Aug 17 16:18:39 2016 : Error: /opt/fr3/etc/raddb/sites-enabled/check-eap-tls[63]: ^ Cannot use attribute reference on right side of condition I dont understand this error because in mods-enable eap.conf, I un-commented virtual_server = check-eap-tls So normaly, he had acces to this attribute no ? Thanks for ur helps Regards, Thomas

3 3

Dynamic VLAN with LDAP group
by Thomas Massip 17 Aug '16

17 Aug '16

Hi all, I know this subject is redondant but I don't arrive to do what I want.. So actually i arrive to do Dynamic VLAN with LDAP user, exemple of LDAP user entry : dn: uid=thomas,cn=test,ou=groups,dc=domaintest,dc=lan objectClass: person objectClass: radiusprofile objectClass: shadowAccount objectClass: posixAccount objectClass: inetOrgPerson cn: thomas massip uid: thomas sn: thomas givenName: Thomas uidNumber: 10003 gidNumber: 1500 loginShell: /bin/bash homeDirectory: /ahome/thomas userPassword: 1B4EDB9F184199B74F58553DC77CD8E5 radiusTunnelType: VLAN radiusTunnelMediumType: 6 radiusTunnelprivateGroupId: 100 When I do that this is Ok, my user go on vlan 100. But now, I want do same but not with user, with GROUPS so i try: dn: cn=test, ou=groups, dc=domaintest,dc=lan objectClass: top objectClass: posixGroup objectClass: radiusprofile cn: test gidNumber: 1500 description: groupe de test vlan memberUid: 10003 radiusTunnelType: VLAN radiusTunnelMediumType: 6 radiusTunnelprivateGroupId: 100 where memberUid: 10003 = dn: uid=thomas,cn=test,ou=groups,dc=domaintest,dc=lan objectClass: person objectClass: radiusprofile objectClass: shadowAccount objectClass: posixAccount objectClass: inetOrgPerson cn: thomas massip uid: thomas sn: thomas givenName: Thomas uidNumber: 10003 gidNumber: 1500 loginShell: /bin/bash homeDirectory: /ahome/thomas userPassword: 1B4EDB9F184199B74F58553DC77CD8E5 But, this solution doesn't work. I know I can use file users with (I test and it's work) : DEFAULT Ldap-Group == "cn=test,ou=groups,dc=domaintest,dc=lan" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = "100" #Reply-Message = "Cette methode marche, tu est dans le 100" But I really want to stock all information on LDAP not on file users. So i try to do an update reply on module LDAP subsection 'group' but that doesn't work too (I think it's the good solution but I miss something). So if anyone can help me to return VLAN attribute with the LDAP groups Thanks all and sry for the bad english Regards, Thomas.

2 1

Re: Freeradius-Users Digest, Vol 136, Issue 21
by Philipp Trenz 16 Aug '16

16 Aug '16

Hi Alan, thanks for these tips. 3.0.4 was at the repo of RHEL7, so I used it. But with your advice I'll compile the latest 3.1.X version. Mr Paffrath at the DFN, responsible for the Radius servers, is just in vacation. So I try to collect as much information as possible to question him, when he's back. With RadSec I'm not shure what I need, it should just function with the DFN servers ;) I'll see ... Greetings! Am 2016-08-15 12:00, schrieb freeradius-users-request(a)lists.freeradius.org: Message: 2 Date: Mon, 15 Aug 2016 09:32:19 +0000 From: A.L.M.Buxey(a)lboro.ac.uk To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: FR3 RadSec for Eduroam (esp. Germany & DFN servers) Message-ID: <20160815093219.GB10649(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > I heared of different voices. At > https://wiki.geant.org/display/H2eduroam/freeradius3-flr it says FR3 > can replace third party software like RadSecProxy, but I also heared > that the implementation does not work that fine. documentation is always historical.... that was probably based on early implementations..... > At the moment it's going to be FreeRADIUS 3.0.4 on a RHEL7.2, but > also could go up to the latest stable release, if this would fix > issues. 3.0.4 is old and creaky, containing many random bugs. I would recommend that you use the recent 3.1.x - thus getting yourself ready for the 3.2.x stable release and having all latest features but not bleeding edge 4.x stuff. if you must have 3.0.x then use 3.0.11 (or 3.0.12 when that slips out) - but be aware that it'll be legacy release when 3.2 arrives. what RADSEC features do you want? if you chat with your NRO in DFN they'll give you their advice....as there are other things they may expect or wnat you to do.... alan

2 2

Module summary documents
by Arran Cudbard-Bell 16 Aug '16

16 Aug '16

I’ve just added short descriptions for the (many) modules and drivers we ship with the server in the form of a README.md file in each module directory. If anyone wants to expand on what’s already there for their favourite modules, please feel free… The summary descriptions will be used to generate the JSON data for the new website’s module information API, and also as the description field in any automatically generated packages. If you end up with several paragraphs of more descriptive text, feel free to add a ## Description heading. We’ll figure out some way to use it in future… Probably in an accordion fold down on the website. Thanks, -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 3

hello
by Roberto Rios 15 Aug '16

15 Aug '16

hi. I have a fresh install of freeradius on Centos7. I have been trying to connect via ldap to active directory for a few days now, but I still get this error: . . . . # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap Mon Aug 15 10:54:30 2016 : Debug: ldap { Mon Aug 15 10:54:30 2016 : Debug: server = "xx.xx.xx." Mon Aug 15 10:54:30 2016 : Debug: port = 389 Mon Aug 15 10:54:30 2016 : Debug: password = "xxxxxx2016" Mon Aug 15 10:54:30 2016 : Debug: identity = "cn=xxxxx,dc=xxxxx,dc=xxx" Mon Aug 15 10:54:30 2016 : Debug: user { Mon Aug 15 10:54:30 2016 : Debug: filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Mon Aug 15 10:54:30 2016 : Debug: scope = "sub" Mon Aug 15 10:54:30 2016 : Debug: base_dn = "xxxxxx,dc=xxx" Mon Aug 15 10:54:30 2016 : Debug: access_positive = yes Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: group { Mon Aug 15 10:54:30 2016 : Debug: filter = "(objectClass=posixGroup)" Mon Aug 15 10:54:30 2016 : Debug: scope = "sub" Mon Aug 15 10:54:30 2016 : Debug: base_dn = "dc=xxxxx,dc=xxx" Mon Aug 15 10:54:30 2016 : Debug: name_attribute = "cn" Mon Aug 15 10:54:30 2016 : Debug: membership_attribute = "memberOf" Mon Aug 15 10:54:30 2016 : Debug: cacheable_name = no Mon Aug 15 10:54:30 2016 : Debug: cacheable_dn = no Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: client { Mon Aug 15 10:54:30 2016 : Debug: filter = "(objectClass=frClient)" Mon Aug 15 10:54:30 2016 : Debug: scope = "sub" Mon Aug 15 10:54:30 2016 : Debug: base_dn = "dc=xxxxxx,dc=xxx" Mon Aug 15 10:54:30 2016 : Debug: attribute { Mon Aug 15 10:54:30 2016 : Debug: identifier = "radiusClientIdentifier" Mon Aug 15 10:54:30 2016 : Debug: shortname = "cn" Mon Aug 15 10:54:30 2016 : Debug: secret = "radiusClientSecret" Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: profile { Mon Aug 15 10:54:30 2016 : Debug: filter = "(&)" Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: options { Mon Aug 15 10:54:30 2016 : Debug: ldap_debug = 40 Mon Aug 15 10:54:30 2016 : Debug: chase_referrals = yes Mon Aug 15 10:54:30 2016 : Debug: rebind = yes Mon Aug 15 10:54:30 2016 : Debug: net_timeout = 1 Mon Aug 15 10:54:30 2016 : Debug: res_timeout = 20 Mon Aug 15 10:54:30 2016 : Debug: srv_timelimit = 20 Mon Aug 15 10:54:30 2016 : Debug: idle = 60 Mon Aug 15 10:54:30 2016 : Debug: probes = 3 Mon Aug 15 10:54:30 2016 : Debug: interval = 3 Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: tls { Mon Aug 15 10:54:30 2016 : Debug: start_tls = no Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Warning: rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 Mon Aug 15 10:54:30 2016 : Info: rlm_ldap: libldap vendor: OpenLDAP version: 20439 Mon Aug 15 10:54:30 2016 : Debug: accounting { Mon Aug 15 10:54:30 2016 : Debug: reference = "%{tolower:type.%{Acct-Status-Type}}" Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: post-auth { Mon Aug 15 10:54:30 2016 : Debug: reference = "." Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Using local pool section Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): No pool reference found in "ldap.pool" Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Initialising connection pool Mon Aug 15 10:54:30 2016 : Debug: pool { Mon Aug 15 10:54:30 2016 : Debug: start = 5 Mon Aug 15 10:54:30 2016 : Debug: min = 4 Mon Aug 15 10:54:30 2016 : Debug: max = 32 Mon Aug 15 10:54:30 2016 : Debug: spare = 3 Mon Aug 15 10:54:30 2016 : Debug: uses = 0 Mon Aug 15 10:54:30 2016 : Debug: lifetime = 0 Mon Aug 15 10:54:30 2016 : Debug: cleanup_interval = 30 Mon Aug 15 10:54:30 2016 : Debug: idle_timeout = 60 Mon Aug 15 10:54:30 2016 : Debug: retry_delay = 1 Mon Aug 15 10:54:30 2016 : Debug: spread = no Mon Aug 15 10:54:30 2016 : Debug: } Mon Aug 15 10:54:30 2016 : Info: rlm_ldap (ldap): Opening additional connection (0) Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Connecting to xx.x.xx.x:389 Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap: New libldap handle 0x7f4a86f06d20 Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Waiting for bind result... Mon Aug 15 10:54:30 2016 : Error: rlm_ldap (ldap): Bind credentials incorrect: Invalid credentials Mon Aug 15 10:54:30 2016 : Error: rlm_ldap (ldap): Server said: 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1. Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap: Closing libldap handle 0x7f4a86f06d20 Mon Aug 15 10:54:30 2016 : Error: rlm_ldap (ldap): Opening connection failed (0) Mon Aug 15 10:54:30 2016 : Debug: rlm_ldap (ldap): Removing connection pool Mon Aug 15 10:54:30 2016 : Error: /etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap" What I found in google is that it might be a bad pass (52e), but password is correct and account is active.

3 3

FR3 RadSec for Eduroam (esp. Germany & DFN servers)
by Philipp Trenz 15 Aug '16

15 Aug '16

Hi there, my name is Philipp Trenz, I'm student at the University of Applied Science Harz and work there at the datacenter. I'm charged with updating the EDUROAM wifi auth infrastructure and searching for experiences with the RadSec implementation in FreeRadius3 in cooperation with the radius-servers of the German DFN or in general. I heared of different voices. At https://wiki.geant.org/display/H2eduroam/freeradius3-flr it says FR3 can replace third party software like RadSecProxy, but I also heared that the implementation does not work that fine. At the moment it's going to be FreeRADIUS 3.0.4 on a RHEL7.2, but also could go up to the latest stable release, if this would fix issues. I'd be very glad to hear some of your experiences! Best regards, Philipp Trenz

5 13

rlm_smsotp
by Arran Cudbard-Bell 15 Aug '16

15 Aug '16

Is this actually used by anyone, anymore? I hunted pretty hard, but couldn’t find a download link for smsotpd… Seems like it’d be better just to use a rest service for modern deployments. If no one speaks up, i’m going to remove rlm_smsotp from the v4.0.x branch. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2

Running out of file descriptors
by Jens Rantil 15 Aug '16

15 Aug '16

Hi, I've been running 2.1.10+dfsg-3ubuntu0.12.04.2 for ~165 days now on a low-volume machine (~20-30 authentication requests per day). FreeRadius delegates authentication requests to the PAM (which uses Yubico's PAM module). Yesterday, FreeRadius suddenly stopped working. Looking into the issue I noticed that FreeRadius failed to reload configuration with Error: Unable to open file "/etc/freeradius/proxy.conf": Too many open files Inspecting open files for the process showed me there were ~1012 open /dev/urandom: root@tink-auth-vpn-production:/var/log# lsof|grep freerad|grep /dev/urandom|wc -l 1012 Looks like a classic file resource leak. After restarting the process, no new /dev/urandom file resources are open. Making two authentication requests opens up two /dev/urandom. I'm fairly new to FreeRadius. Should I expect /dev/urandom file descriptors to be pooled between requests? Or should they be closed between requests? Anyone with input whether this is a bug in FreeRadius or simply a misconfiguration on my part? Also, let me know if you'd like me to debug this further. Thanks, Jens -- Jens Rantil Backend Developer @ Tink Tink AB, Wallingatan 5, 111 60 Stockholm, Sweden For urgent matters you can reach me at +46-708-84 18 32.

3 3