- Freeradius-Users - lists.freeradius.org

iOS 9.3.1 and windows 10 when password is changed
by Stefano Zanmarchi 26 Apr '16

26 Apr '16

I can't get both windows 10 and iOS 9.3.1 supplicants prompt the user for a new password when the cached password isn't valid anymore. Setting "send_error = yes" in mods-enabled/eap was working fine with windows 10. Sadly "send_error = yes" now causes iOS 9.3.1 not to prompt the user for a new password, while iOS<9.3.1 always did (regardlessly of how send_error is set). Has anyone faced this problem yet? Thanks, Stefano

2 3

MongoDB module
by Pavel Derendyaev 26 Apr '16

26 Apr '16

Hi. Is there plans to develop MongoDB module? -- Best regards, Pavel Derendyaev

2 4

rlm_ippool - max_timeout
by Óscar Remírez de Ganuza Satrústegui 26 Apr '16

26 Apr '16

Good morning, We are using freeradius rlm_ippool to asign IPs in some VPN service. As our NAS (VPN server) do not support sending accounting packets to our radius, our assigned IPs do not get released properly with accounting-stop packets. So we have to release them "manually". In our previous freeradius (2.1.9) we used "rlm_ippool_tool -r db.ippool db.ipindex" to release them periodically. But with our actual freeradius (3.0.10) we are suffering some kind of corruption on db files if we used the tool "rlm_ippool_tool -r". With "kind of corruption" I meant that we are seeing that the pool size is getting smaller and smaller through time. [2] Very weird. So we tried some other ways to release the assigned IPs. We set maximum_timeout attribute on the ippool to 86400 seconds (1 day), in order to make the entries not active after a day, but it is not working either. We are not seeing any "active" (active:1) IP changing to "not active" (active:0). How is this timeout suppose to work? Reading the doc [3], it just says: "# maximum-timeout: If not zero specifies the maximum time in seconds an entry may be active." How is an active entry going to change its status from active:1 to active:0 ? How is it tracking how much time it is active? Does the module rlm_ippool needs to be called also in a special way? Or is it just releasing the IPs when it needs them because the pool is full? Or maybe we have just misunderstood the real use of this max_timeout attribute. Thank you very much for your help. Regards, [1] http://lists.freeradius.org/pipermail/freeradius-users/2014-September/07383… [2] We check the ippool status using: "rlm_ippool_tool -v db.ippool db.ipindex |wc -l" [3] http://wiki.freeradius.org/modules/Rlm_ippool *Oscar Remírez de Ganuza Satrústegui* IT Services Universidad de Navarra Tel. +34 948425600 x803130 http://www.unav.edu/web/it/

2 2

OCSP stapling in v3.1.x
by Arran Cudbard-Bell 25 Apr '16

25 Apr '16

v3.1.x now supports OCSP stapling (for the server cert). By default (when stapling is enabled) it'll query the OCSP server every time a TLS client includes the TLS stapling extension, but as with OCSP verification in v3.1.x, the results (and now OCSP response) can be cached. This should work both for EAP-TLS based methods (TLS, PEAP, TTLS) and for RADSEC. FR OCSP common code adds TLS-OCSP-Next-Update when nextUpdate time is provided, which you can use to set the correct expiry time in rlm_cache. More important for OCSP stapling than for client cert verification. Also fixed up raddb/certs to generate an OCSP responder cert with the correct extensions. openssl ocsp -index ./certs/index.txt -port 8888 -CA ./certs/ca.pem -rsigner ./certs/ocsp.pem -rkey ./certs/ocsp.key If you want to try it out... AFAICT there's no support in OSX, and there's no toggle (but possibly support?) in Windows 10, but wpa_supplicant definitely supports it: # ocsp: Whether to use/require OCSP to check server certificate # 0 = do not use OCSP stapling (TLS certificate status extension) # 1 = try to use OCSP stapling, but not require response # 2 = require valid OCSP stapling response # 3 = require valid OCSP stapling response for all not-trusted # certificates in the server certificate chain Currently the OCSP server's responses are validated using the same ca_file and ca_path as everything else. If anyone feels strongly that we should initialize a different X509_STORE for validating the staple and client cert OCSP responses, and can see that being used in the wild, then let me know and we can add it. -Arran (3,1) eap_tls - Handshake state - before/accept initialization (3,1) eap_tls - Handshake state - Server before/accept initialization (3,1) eap_tls - <<< recv handshake [length 307], client_hello (3,1) eap_tls - Using responder URL "http://127.0.0.1:8888/" (3,1) eap_tls - OCSP response valid from: (3,1) eap_tls - Apr 25 21:46:39 2016 GMT (3,1) eap_tls - Update time not provided. Not adding &TLS-OCSP-Next-Update (3,1) eap_tls - Cert status: good (3,1) eap_tls - Certificate is valid (3,1) eap_tls - Serializing OCSP response (3,1) eap_tls - &TLS-OCSP-Response := ... (3,1) eap_tls - Adding OCSP stapling extension CTRL-EVENT-EAP-PEER-CERT depth=1 subject='/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.org/CN=Example Certificate Authority' hash=bd3c25ffa2f6bbd0d7745a1c78b9fd230edae367bb5d1723b6022b21694eecab EAP: Status notification: remote certificate verification (param=success) TLS: tls_verify_cb - preverify_ok=1 err=0 (ok) ca_cert_verify=1 depth=0 buf='/C=FR/ST=Radius/O=Example Inc./CN=Example Server Certificate/emailAddress=admin(a)example.org' CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/C=FR/ST=Radius/O=Example Inc./CN=Example Server Certificate/emailAddress=admin(a)example.org' hash=e0d60e48d4750ec264f2dffac96bc62c7a0ce36cf4a5610dc3fd9ed213a36634 EAP: Status notification: remote certificate verification (param=success) SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server certificate A OpenSSL: RX ver=0x0 content_type=256 (TLS header info/) OpenSSL: Message - hexdump(len=5): 16 03 03 06 1c OpenSSL: RX ver=0x303 content_type=22 (handshake/certificate status) ... OpenSSL: OCSP Response OCSP Response Data: OCSP Response Status: successful (0x0) Response Type: Basic OCSP Response Version: 1 (0x0) Responder Id: C = FR, ST = Radius, O = Example Inc., CN = Example OCSP Responder Certificate, emailAddress = admin(a)example.org Produced At: Apr 25 21:46:39 2016 GMT Responses: Certificate ID: Hash Algorithm: sha1 Issuer Name Hash: 2B9F8F4A12CAA123868F7B710F2BC60E92821AC5 Issuer Key Hash: AAB3E9B947C2A991C16779B84375D237B77CB5A9 Serial Number: 01 Cert Status: good This Update: Apr 25 21:46:39 2016 GMT Response Extensions: OCSP Nonce: 0408ED50078B41A040B6 ... OpenSSL: OCSP response verification succeeded OpenSSL: OCSP status for server certificate: good SSL: (where=0x1001 ret=0x1)

1 0

rlm_sql_oracle
by Ejaz 25 Apr '16

25 Apr '16

Hello alan/all Radius -X shows below error, When I tried to enable rlm_sql_oracle to connect my oracle database which is on remote servers. Would any one please help. rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_oracle: Oracle logon failed: 'ORA-12505: TNS:listener does not currently know of SID given in connect descriptor ' rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /usr/local/freeradius3/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" root@ruh02saaa02:~# second concern, I wanted to stop accounting completely, since I wanted to use radius only for authentication and accounting.. Thanks in advance. Ejaz

2 1

Is it possible to execute check-eap-tls before checking ocsp?
by Mitsuhiro Nakamura 25 Apr '16

25 Apr '16

Hi, all Is it possible to execute check-eap-tls before checking ocsp? and Is it possible to skip ocsp checking if check-eap-tls fail? I'm using FreeRADIUS v3.0.11 regards, mitsuhiro nakamura

4 9

Simultaneous-Use and sql
by Laurens Vets 24 Apr '16

24 Apr '16

Hello list, I'm trying to enable "Simultaneous-Use := 1" for all our users. Currently, usernames and passwords are in the radcheck table and authentication works without issues. The DB also contains the DHCP ip pool. I did the following: 1. Enabled "sql" in session in sites-available/default 2. Uncommented "simul_count_query" query in mods-config/sql/main/mysql/queries.conf And from https://github.com/FreeRADIUS/freeradius-server/blob/master/doc/configurati… I get: INSERT INTO radgroupcheck (GroupName, Attribute, op, Value) values("dialup", "Simultaneous-Use", ":=", "1"); Does that mean I have to assign all my users to a group ('dialup') or can I use Simultaneous-Use somewhere else so that the default for all users is 1 for instance?

2 2

user defined in mysql table radcheck fails wtih "No "known good password", and radpostauth updated successfully but still empty
by Dustin S 22 Apr '16

22 Apr '16

Using freeradius 3 (even though most online help is for version 2) since this is the version that I first got "radtest" to work in. Running it in ubuntu 14.04.4 LTS. I entered a user "bob" into the "freeradius/users" file and radtest bob hello1 localhost 1812 testing1 works fine. I then entered "bobsql" into the database (after adding "sql" to all the places in freeradius/sites-available/default and adding the new mysql user login & database info to freeradius/mods-available/sql) | id | username | attribute | value | op | +----+----------+-----------+----------+----+ | 4 | bobsql | Password | hello1 | := | but the command radtest bobsql hello1 localhost 1812 testing1 gives the "freeradius -X" output: (23) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type I removed and re-entered "bobsql" to make sure I didn't accidentally add non-visible characters to the username or password. The strange part is that it says it successfully logged the error to the "radpostauth" table: (23) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: SQL query returned: success (23) sql: 1 record(s) updated But when I looked at this table it was still empty. I even logged in as "radius" and tested this command to make sure it wasn't being blocked by insufficient user permissions. Dustin p.s.: Here is the area of "freeradius -X" output around the problem area: (23) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bobsql' ORDER BY id (23) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bobsql' ORDER BY id rlm_sql (sql): Released connection (16) rlm_sql (sql): Need 1 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (17), 1 of 30 pending slots used (23) [sql] = notfound (23) [expiration] = noop (23) [logintime] = noop (23) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (23) pap: WARNING: Authentication will fail unless a "known good" password is available (23) [pap] = noop (23) } # authorize = ok (23) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (23) Failed to authenticate the user (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/sites-enabled/default (23) Post-Auth-Type REJECT { (23) sql: EXPAND .query (23) sql: --> .query (23) sql: Using query template 'query' rlm_sql (sql): Reserved connection (15) (23) sql: EXPAND %{User-Name} (23) sql: --> bobsql (23) sql: SQL-User-Name set to 'bobsql' (23) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (23) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: SQL query returned: success (23) sql: 1 record(s) updated rlm_sql (sql): Released connection (15) (23) [sql] = ok Here's the entire output of "freeradius -X": (22) Cleaning up request packet ID 198 with timestamp +2275 Ready to process requests (23) Received Access-Request Id 40 from 127.0.0.1:41089 to 127.0.0.1:1812 length 76 (23) User-Name = "bobsql" (23) User-Password = "hello1" (23) NAS-IP-Address = 192.168.0.166 (23) NAS-Port = 1812 (23) Message-Authenticator = 0xa745b8c6f1030fe8a5914f73096859ae (23) # Executing section authorize from file /etc/freeradius/sites-enabled/default (23) authorize { (23) policy filter_username { (23) if (&User-Name) { (23) if (&User-Name) -> TRUE (23) if (&User-Name) { (23) if (&User-Name =~ / /) { (23) if (&User-Name =~ / /) -> FALSE (23) if (&User-Name =~ /@[^@]*@/ ) { (23) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (23) if (&User-Name =~ /\.\./ ) { (23) if (&User-Name =~ /\.\./ ) -> FALSE (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (23) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (23) if (&User-Name =~ /\.$/) { (23) if (&User-Name =~ /\.$/) -> FALSE (23) if (&User-Name =~ /(a)\./) { (23) if (&User-Name =~ /(a)\./) -> FALSE (23) } # if (&User-Name) = notfound (23) } # policy filter_username = notfound (23) [preprocess] = ok (23) [chap] = noop (23) [mschap] = noop (23) [digest] = noop (23) suffix: Checking for suffix after "@" (23) suffix: No '@' in User-Name = "bobsql", looking up realm NULL (23) suffix: No such realm "NULL" (23) [suffix] = noop (23) eap: No EAP-Message, not doing EAP (23) [eap] = noop (23) [files] = noop (23) sql: EXPAND %{User-Name} (23) sql: --> bobsql (23) sql: SQL-User-Name set to 'bobsql' rlm_sql (sql): Reserved connection (16) (23) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (23) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bobsql' ORDER BY id (23) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bobsql' ORDER BY id rlm_sql (sql): Released connection (16) rlm_sql (sql): Need 1 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (17), 1 of 30 pending slots used (23) [sql] = notfound (23) [expiration] = noop (23) [logintime] = noop (23) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (23) pap: WARNING: Authentication will fail unless a "known good" password is available (23) [pap] = noop (23) } # authorize = ok (23) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (23) Failed to authenticate the user (23) Using Post-Auth-Type Reject (23) # Executing group from file /etc/freeradius/sites-enabled/default (23) Post-Auth-Type REJECT { (23) sql: EXPAND .query (23) sql: --> .query (23) sql: Using query template 'query' rlm_sql (sql): Reserved connection (15) (23) sql: EXPAND %{User-Name} (23) sql: --> bobsql (23) sql: SQL-User-Name set to 'bobsql' (23) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (23) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'bobsql', 'hello1', 'Access-Reject', '2016-04-19 12:43:09') (23) sql: SQL query returned: success (23) sql: 1 record(s) updated rlm_sql (sql): Released connection (15) (23) [sql] = ok (23) attr_filter.access_reject: EXPAND %{User-Name} (23) attr_filter.access_reject: --> bobsql (23) attr_filter.access_reject: Matched entry DEFAULT at line 11 (23) [attr_filter.access_reject] = updated (23) [eap] = noop (23) policy remove_reply_message_if_eap { (23) if (&reply:EAP-Message && &reply:Reply-Message) { (23) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (23) else { (23) [noop] = noop (23) } # else = noop (23) } # policy remove_reply_message_if_eap = noop (23) } # Post-Auth-Type REJECT = updated (23) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (23) Sending delayed response (23) Sent Access-Reject Id 40 from 127.0.0.1:1812 to 127.0.0.1:41089 length 20 Waking up in 3.9 seconds. (23) Cleaning up request packet ID 40 with timestamp +2281

3 5

Correlating Access-Requests and Replys
by Christian Strauf 22 Apr '16

22 Apr '16

Hi all, we're trying to use an ELK stack (Elasticsearch, Logstash & Kibana) to monitor the performance of our FreeRADIUS 3.0.11 servers which rely on a number of external servers (database, directory etc.). We'd basically like to figure out the elapsed time between first Access-Request and the final Access-Accept (or Access-Reject for that matter). A prerequisite for this is that we can actually correlate Access-Requests and replies by the RADIUS server. I searched a little and found a post by Alan DeKok from 2012 on a very similar matter. The problem is that there's nothing much you can use to correlate an Access-Request reliably to the answers by the RADIUS server. Alan suggested adding a reply item to the reply: update reply { FreeRADIUS-Correlation-Id = "%{Packet-Src-IP-Address}-%{Packet-Src-Port}... } I like the idea (you can probably even update the original request with that FreeRADIUS-Correlation-Id before logging it), however, I need some help with the "..." part of the above config snippet. Src IP and src port unfortunately aren't unique enough (the same NAS sends all requests from the same source port). I looked through dictionary.freeradius.internal to find some suitable attribute that isn't part of the original request and that would add some uniqueness but I don't see anything useful. Do you guys happen to know a suitable way of creating such a FreeRADIUS-Correlationa-Id that's unique for an Access-Request-...-Access-Accept exchange? I'm not sure whether the NAS will also include the attribute in all its later request packets. Do you happen to know if this is the case? The approach with a correlation ID has one more disadvantage: according to RFC 2865, Access-Reject messages mustn't include such attributes. So this leaves us with the problem how to correlate rejects. This leads me to this question: FreeRADIUS obviously keeps track internally which reply correlates to which request. Is there any way to include some hint to this correlation via a FreeRADIUS-internal attribute which in turn could be logged in auth-detail or reply-detail files? Any help would be highly appreciated. Kind regards, Christian Strauf -- Dipl.-Math. Christian Strauf Clausthal University of Techn. E-Mail: strauf(a)rz.tu-clausthal.de Rechenzentrum Web: www.rz.tu-clausthal.de Erzstraße 51 Tel.: +49-5323-72-2086 Fax: -992086 D-38678 Clausthal-Zellerfeld

6 22

cross compilation of freeradius-server-3.0.10 fails at link of radeapclient, undefined references
by Aaron Wegner 22 Apr '16

22 Apr '16

When I start the build of FreeRADIUS it fails with an error because it can't execute jlibtool. If I use the native compiler rather than the cross compiler to build jlibtool the build proceeds. $ gcc scripts/jlibtool.c -o build/make/jlibtool However it breaks again when it tries to link build/bin/local/radeapclient (sorry my mail client is adding newlines to long single lines). LTIB> build/make/jlibtool --silent --mode=link gcc -o build/bin/local/radeapclient -rpath /spare1/aaron/0339/ltib/rpm/BUILD/freeradius-server-3.0.10/build/lib/local//.libs --shared -L/spare1/aaron/0339/ltib/rootfs/usr/lib -Wl,-rpath,/spare1/aaron/0339/ltib/rootfs/usr/lib build/objs/src/modules/rlm_eap/radeapclient.lo build/objs/src/main/files.lo build/objs/src/main/threads.lo build/objs/src/main/version.lo build/objs/src/main/cb.lo build/objs/src/main/tls.lo build/lib/local/libfreeradius-radius.la build/lib/local/libfreeradius-server.la build/lib/local/libfreeradius-eap.la -lcrypto -lssl -ltalloc -lpcre -lcap -lnsl -lresolv -ldl -lpthread -lcrypto -lssl However, if I change the command to the following it works. LTIB> gcc -o build/bin/local/radeapclient -Wl,-rpath /spare1/aaron/0339/ltib/rpm/BUILD/freeradius-server-3.0.10/build/lib/local//.libs --shared -L/spare1/aaron/0339/ltib/rootfs/usr/lib -Wl,-rpath,/spare1/aaron/0339/ltib/rootfs/usr/lib -L/spare1/aaron/0339/ltib/rpm/BUILD/freeradius-server-3.0.10/build/lib/local//.libs build/objs/src/modules/rlm_eap/radeapclient.o build/objs/src/main/files.o build/objs/src/main/threads.o build/objs/src/main/version.o build/objs/src/main/cb.o build/objs/src/main/tls.o -lfreeradius-radius -lfreeradius-server -lfreeradius-eap -lcrypto -lssl -ltalloc -lpcre -lcap -lnsl -lresolv -ldl -lpthread -lcrypto -lssl Now the build stops right away at the next link, build/bin/radeapclient. The problem is tedious to work around issuing calls to gcc because after that link it stops at: build/bin/local/smbencrypt build/bin/smbencrypt build/bin/local/dhcpclient build/bin/dhcpclient ...and so on. Don't know how may of these there are. I'm attaching the original failed command with the -Wl,--verbose flag added to the link to this email so that it's not formatted funny. Any help would be appreciated, I'm new to jlibtool and have no clue what's going on. The linker seems to be finding the shared objects and I check the shared objects for the undefined references it is complaining about and they seem to be in libfreeradius-radius.so, for instance: $ nm --defined-only -o build/lib/local//.libs/libfreeradius-radius.so | grep fr_pair_value_strcpy build/lib/local//.libs/libfreeradius-radius.so:000210ac T fr_pair_value_strcpy So I'm at a loss for why this link is failing. Thanks, Aaron

2 2