- Freeradius-Users - lists.freeradius.org

Tweaking LDAP parameters
by David Hartburn 13 Apr '16

13 Apr '16

Hi, Yesterday, I moved a fair chunk of our on-site wireless to FreeRADIUS as we migrate from our NPS servers. I have had a number of complaints of users being forced to reauthenticate (prompted for their password again) on odd occasions throughout the day. Logs show a login incorrect: Tue Apr 12 15:06:47 2016 : Auth: (264236) Login OK: [xxx(a)kent.ac.uk] (from client cwlc-tlb port 2 cli a8:66:7f:12:a9:b9) .....output cut...... Tue Apr 12 15:14:48 2016 : Warning: rlm_ldap (ldap): 2 of 2 connections in use. You probably need to increase "spare" Tue Apr 12 15:14:48 2016 : Error: rlm_ldap (ldap): Cannot open new connection, connection spawning already in progress Tue Apr 12 15:14:48 2016 : Auth: (281194) Invalid user: [xxx(a)kent.ac.uk] (from client cwlc-tlb port 2 cli a8:66:7f:12:a9:b9 via TLS tunnel) Tue Apr 12 15:14:48 2016 : Auth: (281195) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [xxx(a)kent.ac.uk] (from client cwlc-tlb port 2 cli a8:66:7f:12:a9:b9) Tue Apr 12 15:14:48 2016 : Info: rlm_ldap (ldap): Deleting connection (40122) Tue Apr 12 15:14:48 2016 : Info: rlm_ldap (ldap): 2 of 2 connections in use. Need more spares It looks like it is rejecting the auth because it can not make the LDAP connection to validate the user. Two questions on this. First, is it possible to allow clients a couple of attempts to retry their authentication before completely rejecting and forcing them to enter their password again? Second, are there any rules of thumb regarding setting min, max and spare for LDAP connections? At the moment I have: pool { start = 16 min = 8 max = ${thread[pool].max_servers} spare = 16 uses = 0 lifetime = 0 idle_timeout = 0 } When starting with radiusd -x, that gives: rlm_ldap (ldap): Initialising connection pool pool { start = 16 min = 8 max = 32 spare = 16 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 1 spread = no } Comments in the file suggests it is not sensible to push max any higher. Is it sensible to set spare to 32, or is that setting it the wrong way round? Thanks Dave Hartburn

6 15

problem fetching ldap attribute in inner tunnel
by Anirudh Malhotra 13 Apr '16

13 Apr '16

Hi everyone, I am doing PEAP with GTC authenticate my LDAP clients, I fetch some attribute in LDAP module and is store it in session-state and later check them in outer post-auth. I am facing this problem in which when client is re-authenticating and the Phase2 is skipped with 'Skipping Phase2 because of session resumption', for expediting the process. The LDAP attribute value is not fetched and hence post-auth doesn't get that value which then fails the authentication(configured like that by me, Set of rules which check value of the attribute and fails by default if none condition is matched or attribute is not fetched) Though I am able to fetch the attribute from elsewhere(running xlat) but I don't want to run it for every user, As I am running EAP-TLS, PAP also in my setup. BR, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 3

rfc6929 "tlv" type question
by Vereecke, Katrien (Nokia - BE) 12 Apr '16

12 Apr '16

Hello, The RFC6929 states that "tagged" attributes must not be used in the extended-space, in stead "tlv" data types should be used. ( 6.4 Design Guidelines for the New Types ... "tagged" attributes MUST NOT be defined in the Extended-Type space. The "tlv" data type should be used instead to group attributes.) With the extended format, can we indicate in the dictionary that certain attributes belong to different tlv attributes, similar as the tagged functionality before? e.g BEGIN-VENDOR Alcatel-IPD format=Extended-Vendor-Specific-3 ATTRIBUTE Alcatel-IPD-Ext-3-TestAttr-40 40 tlv ATTRIBUTE Alcatel-IPD-Ext-3-TestAttr-50 50 tlv ATTRIBUTE Alcatel-IPD-Ext-3-TestAttr-1 1 integer => I want to indicate that this attribute Alcatel-IPD-Ext-3-TestAttr-1 is aswell part of Alcatel-IPD-Ext-3-TestAttr-40 and Alcatel-IPD-Ext-3-TestAttr-50 without having to duplicate and give another attribute name?? END-VENDOR Alcatel-IPD Similar as with the "tags" we want to be able to indicate that the same attribute can be received in the access-accept but with different tag. How can we achieve this behavior with the tlv extended attribute type without having to define different attribute-names for 40.1 and 50.1? Thanks, kind regards, Katrien.

2 2

Constant Authentication error
by Yusuf Siddiqui 12 Apr '16

12 Apr '16

Hi All After fixing several errors now i see my Radius up and running but i am unable to debug the error which i am getting . I tried all combinations and inserted proper cleartext password,please help. Tue Apr 12 03:30:53 2016 : Debug: (2) } # authorize (ok) Tue Apr 12 03:30:53 2016 : Debug: (2) Using 'Auth-Type = CHAP' for authenticate {...} Tue Apr 12 03:30:53 2016 : Debug: (2) Running Auth-Type CHAP from file /usr/local/etc/raddb/sites-enabled/default Tue Apr 12 03:30:53 2016 : Debug: (2) Auth-Type CHAP { Tue Apr 12 03:30:53 2016 : Debug: (2) modsingle[authenticate]: calling chap (chap) for request 2 Tue Apr 12 03:30:53 2016 : ERROR: (2) chap - &control:Cleartext-Password is required for authentication Tue Apr 12 03:30:53 2016 : Debug: (2) modsingle[authenticate]: returned from chap (chap) for request 2 Tue Apr 12 03:30:53 2016 : Debug: (2) chap (fail) Tue Apr 12 03:30:53 2016 : Debug: (2) } # Auth-Type CHAP (fail) Tue Apr 12 03:30:53 2016 : Debug: (2) Failed to authenticate the user Tue Apr 12 03:30:53 2016 : Debug: (2) Using Post-Auth-Type Reject Tue Apr 12 03:30:53 2016 : Debug: (2) Post-Auth-Type sub-section not found. Ignoring. Tue Apr 12 03:30:53 2016 : Debug: (2) Delaying response for 1.000000 seconds Tue Apr 12 03:30:53 2016 : Debug: Waking up in 0.3 seconds. Tue Apr 12 03:30:54 2016 : Debug: Waking up in 0.6 seconds. Tue Apr 12 03:30:54 2016 : Debug: (2) - Sending delayed response Tue Apr 12 03:30:54 2016 : Debug: (2) - Sent Access-Reject Id 7 from 10.112.0.150:1812 to 122.177.189.189:2919 via enp2s0 length 20 Tue Apr 12 03:30:54 2016 : Debug: Waking up in 3.9 seconds. Tue Apr 12 03:30:58 2016 : Debug: (2) Cleaning up request packet ID 7 with timestamp +164 Tue Apr 12 03:30:58 2016 : Info: Ready to process requests Regards Yusuf Siddiqui *__________________________________________________________________________________________________________________________________________________________________* This communication & accompanying documents ("this e-mail") contains confidential and/or privileged information for exclusive use of the individual to whom it is addressed. If you are not the intended recipient, please immediately notify the company & delete this e-mail. Any unauthorized use or disclosure of this e-mail is strictly prohibited. Representations in this e-mail are subject to contract. As an e-mail user please be cautious of the technical & other vulnerabilities of the internet which may result in malicious and/or unauthorized access to / use / alteration of e-mails/e-mail IDs. Thank you. *_______________________________________________________________________________________________________________________________________________________________*

1 1

freeradius 3.0.4 CentOS 7.2 AD
by Hubert Kupper 11 Apr '16

11 Apr '16

Hello, we have freeradius 3.0.4 on a centos 7.2 machine with ldap authentication against edirectory running for a long time. Now we want to authenticate against AD. We followed the intructions on http://deployingradius.com/documents/configuration/active_directory.html ntlm_auth returns: NT_STATUS_OK: Success (0x0). Radiusd -X returns the following error: /etc/raddb/mods-config/files/authorize[1]: Parse error (check) for entry DEFAULT: Unknown value 'ntlm_auth' for attribute 'Auth-Type' What is the reason? Regards, Hubert

3 5

Re: Forward Accounting Packets to Fortiage - need help
by Eby Mani 11 Apr '16

11 Apr '16

it started working after "use_tunneled_reply = yes". Thank you very much. -------------------------------------------- On Fri, 8/4/16, Alan DeKok <aland(a)deployingradius.com> wrote: Subject: Re: Forward Accounting Packets to Fortiage - need help To: "Eby Mani" <eby_km(a)yahoo.com> Cc: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Friday, 8 April, 2016, 11:31 PM >That is a common problem, and typically because you're running rules in the first few packets that aren't run for the last one. >e.g. you may have use_tunneled_reply = no. > > Alan DeKok.

1 0

rlm_perl does not honor start_servers?
by Igor Novgorodov 11 Apr '16

11 Apr '16

Hello! I've got latest 3.0.11 FreeRADIUS and Perl authorization module under rlm_perl. The server is relatively highly loaded (around 1000 access-requests per sec). And although i have "start_servers = 256" and "min_spare_servers = 256" in the thread pool configuration, FreeRADIUS does not initialize those threads until the requests start to hit the daemon. After some requests in parallel it spawns all required 256 threads and then this number stays constant. The problem is that the thread creation in rlm_perl seems to be quite expensive timewise (or i may be doing something wrong?). It is clearly seen by testing with radclient - after daemon restart it is capable of only 30 req/s. Then, when all the threads come alive - it goes up to 1k req/s and more. So unless i warm up the server with a few thousand test queries to create all threads - it gets overwhelmed for several minutes when the real load shows up, which causes a lot of warnings in the logs and massive retransmits from NASes (there are about 900 of them with lots of clients each), which is nasty. So the question is - this behavior is expected? I can, of course, warm up server after each restart but it seems irrational for me. Thanks!

9 22

Re: does freeradius support key-wrap
by Michael Martinez 10 Apr '16

10 Apr '16

Ok, I have more context for my question: Does Freeradius support something similar to Cisco's use of key-wrap as defined in https://tools.ietf.org/html/draft-zorn-radius-keywrap-18 ? In their implementation they define a way to securely transmit cryptographic keying material (such as from an EAP conversation) between NAS and Radius server using a a keywrap around the keying material to protect encryption key distribution. Supposedly this "protects" a man-in-the-middle from grabbing the EAP keys? I'm not sure how this increases security because you can't do anything with the public keys anyway. But I suppose it's a "stronger" way of encrypting that information as opposed to the standard hash that's currently done. The reason I'm asking, I'm doing some contract work for a university. The bosses want to know, presumably because they have some compliance requirements they need to satisfy. I see a few past discussion of this from the mailing list, but no clear answer on whether freeradius does this. -- --- Michael Martinez http://www.michael--martinez.com

2 2

rlm_python
by Arran Cudbard-Bell 09 Apr '16

09 Apr '16

Spent some time poking at it in v3.1.x. It seems to work OK with multiple threads now, and i've reworked the code to use separate interpreters for each module instance for cleanliness. I don't see any of the crashes previously observed when using multiple rlm_python instances. If heavy users of python in v3.0.x could try v3.1.x it would be appreciated. As v3.0.x was marked as THREAD_UNSAFE, you should see substantial performance improvements in v3.1.x. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 8

Re: Forward Accounting Packets to Fortiage - need help
by Eby Mani 08 Apr '16

08 Apr '16

Thanks, i should have provided more details earlier. freeRadius is configured with mysql and users are authenticated using EAP - PEAP without certificates. Once users are authenticated thru radius, ip address is released thru another dhcp server. Issue 1, When Users are getting authenticated, freeradius isn't sending Class attribute of the usergroup/user in Access-Accept message. Only User-Name is sent to NAS. NAS is configured to forward RADIUS accounting packets to Fortigate, where fortigate gets only authenticated username and ip address from NAS. As freeRadius is not sending Class attributes in Access-Accept. NAS isn't sending any Class info to Fortigate. Without usergroup info in Class attribute, can't provide RSSO based access to various networks. While troubleshooting NAS it was found freeradius is sending Class attribute information in Access-Challenge message !!. . Further troubleshooting on radius server revealed the following; 1, radtest from the server return class attributes of user/usergroup. 2, when running server in debug mode and authenticating from NAS, it doesn't. Is this the default behaviour ?. How do i tell freeradius to send Class attribute of usergroup in Access-Accept ?. Issue 2, freeradius is not sending accounting copies to Fortigate. Having Added "realm {}" in proxy.conf, added "detailfile = ${radacctdir}/detail" in detail file and included "update control {}" in preacct section of copy-acct-to-home-server file and linked the same to sites-enabled folder. I'm not sure if i have missed anything. One might ask why send accounting again, Fortigate can have only one RSSO Agent, thus sending accounting packets from multiple NAS is not possible. Also I'm planning to use some old gear that doesn't support sending accounting to another server. Sending accounting copies from freeradius will eliminate various admin overheads. Attached config files. Eby -------------------------------------------- On Thu, 7/4/16, Alan DeKok <aland(a)deployingradius.com> wrote: Subject: Re: Forward Accounting Packets to Fortiage - need help To: "Eby Mani" <eby_km(a)yahoo.com>, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thursday, 7 April, 2016, 4:42 PM On Apr 7, 2016, at 11:37 AM, Eby Mani via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > Thanks Alan, the NAS and Fortigate does RADIUS. > > The easiest way for me is to configure NAS to forward RADIUS accounting packets to Fortigate. But my freeRadius is not sending Class attributes in Access-Accept to NAS client, thus NAS client isn't sending any Class info to Fortigate. > > However freeRadius is sending Class attributes in Access-Challenge to NAS !!!. > > Is there a command to include Class attributes in Access-Accept ?. Configure the server to send it. As always, run the server in debug mode, and READ IT. Also, describe what you're doing. In detail. Your questions are nearly content free. We're not mind readers. We don't know what you've configured. You don't say if you're using EAP or another authentication method. Any answer to help you depends on knowing what you're actually doing. Since we don't know what you're doing, we can't really help you. Alan DeKok.

2 1