- Freeradius-Users - lists.freeradius.org

"device-traffic-class=voice" from FreeRADIUS?
by craig 18 Apr '16

18 Apr '16

Hi, I'm looking to setup "freeradius-3.0.4-6.el7.x86_64" on Centos 7 with 802.1x auth over LAN. The challenge is that I'd like to use Cisco phones and laptops behind those phones. The doco I've been reading (designed for Cisco ACS) suggest that the radius server needs to respond with a "RADIUS Access-Accept" message containing "device-traffic-class=voice". ref: http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec… Any way I can do this with FreeRADIUS? Regards, Craig

2 2

RE: fix ip address to an user
by Angel Elena 17 Apr '16

17 Apr '16

ok, thanks ------------------------------ Ángel Elena craem(a)craem.net ------------------------------ -------- Mensaje original -------- De: Alan DeKok <aland(a)deployingradius.com> Fecha: 17/04/2016 15:34 (GMT+01:00) Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Asunto: Re: fix ip address to an user On Apr 17, 2016, at 4:13 AM, Angel Elena <craem(a)craem.net> wrote: > For solve this problem, now, I delete 1.1.1.1 from radippool and assign to framed-ip-address. > > Is the unique via to set this configuration ? any attribute or config or idea to set fixed ip address ? Your changes are correct. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

fix ip address to an user
by Angel Elena 17 Apr '16

17 Apr '16

Hi, good moorning. I have a freeradius server 2.1.12 in a debian environment. This server is configured with sqlradippool and works fine... all ip's are defined in radippool table. For a new setup, with some users, i need "reserve" an ip address... i need, ex: user.detail assign 1.1.1.1. Actually, if user.detail is logged off and another user login, this ip is assigned to a new user. For solve this problem, now, I delete 1.1.1.1 from radippool and assign to framed-ip-address. Is the unique via to set this configuration ? any attribute or config or idea to set fixed ip address ? Thanks -------------------------------- Ángel Elena Medina _o) craem(a)craem.net / \\ http://blog.craem.net _(___V @craem_ --------------------------------

2 1

Memory leak parsing/relaying from detail files?
by Nathan Ward 16 Apr '16

16 Apr '16

Hi, I am working through debugging a memory leak I am hitting, and I think I have found the culprit. The trigger appears to be a malformed NAS-IPv6-Address attribute coming from a Cisco ASR9000, and I will certainly contact the vendor, however it occurs to me that we should work to solve this in FreeRADIUS as well. We use reliable proxied accounting with the detail file reader, however we write everything to a file and read from that file rather than writing only if the backend server pool has no reachable members. We are running 3.0.11, based on the 3.0.4 Redhat RPMs which we have forward ported. The ASR9000 sends a NAS-IPv6-Address attribute as follows: 0000 5f 16 1a 10 97 8c 00 00 00 00 00 00 00 00 00 00 _............... 0010 00 00 00 00 00 00 …… This has a length field of 0x16, while the standard defines this as always 0x12 - an IPv6 address is 16 bytes, plus two bytes for the type/len. I’m not sure what the ASR9000 thinks is going on.. but I guess that’s not in scope for this memory leak per se. FreeRADIUS interprets this as being not a valid NAS-IPv6-Address, so internally treats it as Attr-95 rather than NAS-IPv6-Address, which is the behaviour I’d expect. This gets written to a detail file, and some time later the detail file reader calls through to dict_unknown_afrom_fields, which allocates some memory that seems to never get freed. Running in valgrind, once for 5 mins, once for 25 mins, we note that the following call stack shows up as much larger after 25 mins. Here it is after about 5 mins: ==31363== 1,379,332 bytes in 5,653 blocks are definitely lost in loss record 1,935 of 1,937 ==31363== at 0x4C29BFD: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==31363== by 0x5B0CA20: __talloc_with_prefix (talloc.c:615) ==31363== by 0x5B0CA20: __talloc (talloc.c:655) ==31363== by 0x5B0CA20: _talloc_named_const (talloc.c:812) ==31363== by 0x5B0CA20: _talloc_zero (talloc.c:2206) ==31363== by 0x50786DE: dict_unknown_afrom_fields (dict.c:2826) ==31363== by 0x508573F: data2vp (radius.c:3794) ==31363== by 0x507F1B1: fr_pair_from_unkown (pair.c:1267) ==31363== by 0x507F1B1: fr_pair_make_unknown (pair.c:1365) ==31363== by 0x507F1B1: fr_pair_make (pair.c:1439) ==31363== by 0x507F807: fr_pair_list_afrom_str (pair.c:1865) ==31363== by 0x146B18: detail_poll (detail.c:735) ==31363== by 0x147028: detail_handler_thread (detail.c:1085) ==31363== by 0x67BBDF4: start_thread (pthread_create.c:308) ==31363== by 0x6F431AC: clone (clone.S:113) Again after about 25 mins: ==10362== 7,163,840 bytes in 29,360 blocks are definitely lost in loss record 1,943 of 1,944 ==10362== at 0x4C29BFD: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==10362== by 0x5B0CA20: __talloc_with_prefix (talloc.c:615) ==10362== by 0x5B0CA20: __talloc (talloc.c:655) ==10362== by 0x5B0CA20: _talloc_named_const (talloc.c:812) ==10362== by 0x5B0CA20: _talloc_zero (talloc.c:2206) ==10362== by 0x50786DE: dict_unknown_afrom_fields (dict.c:2826) ==10362== by 0x508573F: data2vp (radius.c:3794) ==10362== by 0x507F1B1: fr_pair_from_unkown (pair.c:1267) ==10362== by 0x507F1B1: fr_pair_make_unknown (pair.c:1365) ==10362== by 0x507F1B1: fr_pair_make (pair.c:1439) ==10362== by 0x507F807: fr_pair_list_afrom_str (pair.c:1865) ==10362== by 0x146B18: detail_poll (detail.c:735) ==10362== by 0x147028: detail_handler_thread (detail.c:1085) ==10362== by 0x67BBDF4: start_thread (pthread_create.c:308) ==10362== by 0x6F431AC: clone (clone.S:113) I have set up GDB to print out a backtrace whenever dict_unknown_afrom_fields is called with fr_pair_from_unkown 2 frames up the stack. We get this: #0 dict_unknown_afrom_fields (ctx=ctx@entry=0x0, attr=95, vendor=0) at src/lib/dict.c:2822 #1 0x00007fee4f416740 in data2vp (ctx=ctx@entry=0x0, packet=packet@entry=0x0, original=original@entry=0x0, secret=secret@entry=0x0, da=<optimized out>, start=<optimized out>, attrlen=20, packetlen=20, pvp=pvp@entry=0x7fee42bec848) at src/lib/radius.c:3794 #2 0x00007fee4f4101b2 in fr_pair_from_unkown (da=<optimized out>, vp=0x7fee340e3690) at src/lib/pair.c:1267 #3 fr_pair_make_unknown (op=<optimized out>, value=0x7fee42bec9d0 "Attr-95", attribute=0x7fee42bec9d0 "Attr-95", ctx=0x7fee5079c3f0) at src/lib/pair.c:1365 #4 fr_pair_make (ctx=ctx@entry=0x7fee5079c3f0, vps=vps@entry=0x0, attribute=attribute@entry=0x7fee42bec9d0 "Attr-95", value=value@entry=0x7fee42becad0 "0x1a108834", '0' <repeats 32 times>, op=<optimized out>) at src/lib/pair.c:1439 #5 0x00007fee4f410808 in fr_pair_list_afrom_str (ctx=ctx@entry=0x7fee5079c3f0, buffer=buffer@entry=0x7fee42bed570 "\tAttr-95 = 0x1a108834", '0' <repeats 32 times>, "\n", list=list@entry=0x7fee42becf48) at src/lib/pair.c:1865 #6 0x00007fee4facdb19 in detail_poll (listener=listener@entry=0x7fee5079c2a0) at src/main/detail.c:735 #7 0x00007fee4face029 in detail_handler_thread (arg=0x7fee5079c2a0) at src/main/detail.c:1085 #8 0x00007fee4dcd7df5 in start_thread (arg=0x7fee42bee700) at pthread_create.c:308 #9 0x00007fee4d5881ad in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113 Note Attr-95 - this is in every one of these backtraces that I looked at. I have attempted to filter out both Attr-95 and NAS-IPv6-Address at the start of my accounting section before it is written to the detail file - we don’t use this attribute so don’t care. I do this with the following: if (Attr-95) { update request { Attr-95 !* ANY } } But if (Attr-95) always returns false. I tried the same logic with NAS-IPv6-Address and get the same result, same trying this in preacct. Preacct has had no configuration changed from the standard “default” site config. Here is a trimmed output - let me know if you want the full thing, and I will get some test circuits set up which don’t have customer data: (469) Tue Mar 8 15:33:39 2016: Debug: Received Accounting-Request Id 141 from 103.241.56.176:51487 to 10.55.86.12:1813 length 1100 .. trimmed .. (469) Tue Mar 8 15:33:39 2016: Debug: Attr-95 = 0x1a10983400000000000000000000000000000000 .. trimmed .. (469) Tue Mar 8 15:33:39 2016: Debug: # Executing section preacct from file /etc/raddb/sites-enabled/trustpower-frontend .. trimmed .. (469) Tue Mar 8 15:33:40 2016: Debug: # Executing section accounting from file /etc/raddb/sites-enabled/trustpower-frontend (469) Tue Mar 8 15:33:40 2016: Debug: accounting { (469) Tue Mar 8 15:33:40 2016: Debug: if (Attr-95) { (469) Tue Mar 8 15:33:40 2016: Debug: if (Attr-95) -> FALSE I have two questions: 1) Can I filter this out in some way that I am unaware of as a short term fix? 2) I would like to figure out this memory leak myself and submit a patch, but I’m not sure how this part of the code works. I *think* that this should be freed after being proxied to the backend server - so, perhaps in process.c somewhere after a packet is sent, it should have any vp das that have is_unknown set to true freed? I’m not clear to me what impact that would have on other bits of code. -- Nathan Ward

3 6

rlm_sql logging results
by Laura Steynes 16 Apr '16

16 Apr '16

Hello, I am new-ish to freeradius, sort of stumped with resolving this - When a user goes to log on the logs start with Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): Closing connection (131): Hit idle_timeout, was idle for 3600 seconds Mon Apr 11 02:41:33 2016 : Warning: rlm_sql (sql): You probably need to lower "min" Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): Closing connection (132): Hit idle_timeout, was idle for 3600 seconds Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): Opening additional connection (133), 1 of 32 pending slots used Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): 0 of 1 connections in use. Need more spares Mon Apr 11 02:41:33 2016 : Info: rlm_sql (sql): Opening additional connection (134), 1 of 31 pending slots used Mon Apr 11 02:41:33 2016 : Auth: (62) Login OK: [xxxxxx] (from client xxxxxxx port 0) now I have lowered min, I lowered it to several values including yet this still logs. I have tried more spares, more start/max servers, less servers, nothing I do seems to make this thing happy and my boss does not like seeing logs fill up with error type messages because he sees it as my failures, and rightly so I guess. My settings I think are related, and if I forgot some, please kindly ask and ye shall receive. radiusd.conf extract - start_servers = 5 max_servers = 32 min_spare_servers = 10 max_spare_servers = 15 max_requests_per_server = 0 auto_limit_acct = no from sql mod start = ${thread[pool].start_servers} # Minimum number of connections to keep open min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 90 We do not have a very busy radius, its for VPN and its rare everyone logs in at once, we have currently two access servers, but soon will have one on other states, so could be five in total by mid year. Are my radiusd,c.onf settings overkill and this is why the logs fill up with these errors? Would anyone have more suitable settings advice? Thank you. Lozza

2 4

mod_auth_radius not asking for username/password
by Süleyman Kuran 16 Apr '16

16 Apr '16

Hi there, I am on Centos 7 httpd 2.4 mod_auth_radius 1.5.8 My virtual host file is as follows: apache is not asking for username/password after 1 failed radius auth attempt. After 1 failed auth, Unauthorized page appears and if I refresh the page (F5) previous failed credentials are sent to the radius server without popping up a window asking for username/password. If login is OK the page is authorized. But if not, the user will have to wait for the popup window until the session is timed out. if apache is configured for basic auth with htpasswd file. It asks for the password after failed login as expected. Nothing is logged in apache error log. Is anybody having an idea about whats going on? <VirtualHost _default_:443> AddRadiusAuth freeradius_ip:1812 my_secret 5:3 AddRadiusCookieValid 60 <Location /> AuthType Basic AuthName "Please login" AuthBasicProvider radius AuthRadiusCookieValid 60 AuthRadiusActive On AuthRadiusAuthoritative on #AuthUserFile "/var/www/passwd" Require valid-user Order allow,deny Allow from all </Location> </VirtualHost>

3 12

radacct MySQL table only gets filled with the last session values for a given user ( no history logging )
by oatech 16 Apr '16

16 Apr '16

Client : Windows 10 NAS : Cisco SB WAP121 RADIUS Server : Debian 8 / FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu, Authentication : PEAP/MSCHAPv2 While the /varl/log/freeradius/radacct/192.168.1.2/detail-20160324 files gets filled with correct data values for each user session : sudo cat /var/log/freeradius/radacct/192.168.1.2/detail-20160324 | grep Acct-Input-Octets Acct-Input-Octets = 43976 Acct-Input-Octets = 845 Acct-Input-Octets = 394240 Acct-Input-Octets = 371260 Acct-Input-Octets = 24927 the radacct MySQL table only gets filled with the last session values for a given user ( 24927 here ). There is no history logging : mysql> select radacct.username, radacct.nasipaddress, radacct.acctstarttime, radacct.acctstoptime, radacct.acctinputoctets, radacct.acctoutputoctets from radacct; +-----------+---------------+---------------------+---------------------+-----------------+------------------+ | username | nasipaddress | acctstarttime | acctstoptime | acctinputoctets | acctoutputoctets | +-----------+---------------+---------------------+---------------------+-----------------+------------------+ | User1 | 192.168.1.2 | 2016-03-24 08:44:46 | 2016-03-24 08:44:23 | 24927 | 20814 | | User2 | 192.168.1.2 | 2016-03-24 08:40:33 | 2016-03-24 08:42:22 | 0 | 0 | +-----------+---------------+---------------------+---------------------+-----------------+------------------+ 2 rows in set (0.00 sec) 2 rows in set (0.00 sec) Is this the normal expected behaviour ? I highy doubt it. I must have done something wrong, but I'm using a very standard Freeradius/MySQL install. Any help would be greatly appreciated :-) --- L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast. https://www.avast.com/antivirus

3 2

openwrt, freeradius
by Mildok 15 Apr '16

15 Apr '16

First - sorry for my English. OpenWrt Chaos Calmer 15.05.1 freeradius 2.2.8-2 Installed: freeradius2 freeradius2-common freeradius2-democerts freeradius2-mod-chap freeradius2-mod-eap freeradius2-mod-eap-mschapv2 freeradius2-mod-eap-peap freeradius2-mod-eap-tls freeradius2-mod-eap-ttls freeradius2-mod-exec freeradius2-mod-files freeradius2-mod-mschap freeradius2-mod-pap freeradius2-mod-radutmp freeradius2-mod-realm freeradius2-utils Problem: All working, but I want use MAC-address based authentication. I append "rewrite.calling_station_id" in "authorize {" section in "/etc/freeradius2/sites/default". That i get: authorize { rewrite.calling_station_id eap { ok = return } files pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } eap } accounting { exec } session { radutmp } But I get error: Module: Checking authorize {...} for more modules to load /etc/freeradius2/sites/default[92]: Failed to find "rewrite.calling_station_id" in the "modules" section. I solve this error. In /etc/freeradius2/radiusd.conf, I uncomment: #$INCLUDE policy.conf After it I get this errors: Module: Checking authorize {...} for more modules to load Module: Loading virtual module rewrite.calling_station_id /etc/freeradius2/policy.conf[250]: Failed to find "updated" in the "modules" section. /etc/freeradius2/policy.conf[250]: Failed to parse "updated" entry. /etc/freeradius2/policy.conf[246]: Failed to parse "if" subsection. /etc/freeradius2/sites/default[69]: Errors parsing authorize section. And now I dont know what can I do. -- ilya Gafarov

5 16

SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS
by Arran Cudbard-Bell 15 Apr '16

15 Apr '16

Anyone see an issue with disabling TLS renegotiation by default? As far as I can tell it's not explicitly required by any EAP flavour. Not mentioned in EAP-TLS RFC, which is what most methods base their TLS wrapper on. Would seem to protect against 3SHAKE. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1

freeradius configuration as a proxy
by Alberto Pineda 15 Apr '16

15 Apr '16

Dear all, I am working in a proof-of-concept and I need to configure a freeradius server as a proxy. It should redirect all the queries to another server. I have installed FreeRADIUS Version 2.1.12 in a Ubuntu 14.04. First of all, I have created a client in clients.conf file: client X.X.X.0/24{ secret = my-secret shortname = private-network-2 } As the proxy server should redirect all the queries to the home server, in proxy.conf file I have only configured the realm DEFAULT as follows realm DEFAULT{ authhost = X.X.X.X:1812 accthost = X.X.X.X:1813 secret = home-server-secret nostrip } I have added nostrip option because the queries should reach the home server with the realm. The problem is that the queries reach the home server but without the realm. Could you help me with this? Does anybodoy know what I am doing wrong? Thank you in advance for your help. Best regards,

2 1