- Freeradius-Users - lists.freeradius.org

2.1 to 2.2 update question
by PENZ Robert 18 Jan '16

18 Jan '16

Hi! I know that it's an old version but anyway I hope someone can help me. The problem is with EAP-TLS and the freeradius upgrade von RHEL6 from 2.2.6 freeradius-2.1.12-6.el6.x86_64 to freeradius-2.2.6-4.el6.x86_64 last fall. The same configuration works on a freeradius 2.1.12 (and 2.2.0, but not 2.2.1 we compiled for testing). The error happens at the first packet, there is no TLS stuff. It looks like this on the 2.1.12. rad_recv: Access-Request packet from host 10.12.138.222 port 59774, id=0, length=165 User-Name = "DVT-DVT0060.tirol.local" Calling-Station-Id = "5C-26-0A-6E-84-2E" Framed-MTU = 1400 NAS-Port-Type = Ethernet NAS-Port-Id = "2:22" NAS-Port = 1022 NAS-IP-Address = 10.12.138.222 Connect-Info = "CONNECT 1000Mbs" Service-Type = Login-User EAP-Message = 0x0200001c014456542d445654303036302e7469726f6c2e6c6f63616c Message-Authenticator = 0xca7712ac53f23d4f869fc36646c0b841 ... ++? if (!EAP-Message) -> FALSE ++- entering else else {...} [eap] EAP packet type response id 0 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation +++[eap] returns updated ++- else else returns updated Found Auth-Type = EAP # Executing group from file /etc/raddb-fallback//sites-enabled/default +- entering group EAP {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled ++? if (invalid) .... Sending Access-Challenge of id 0 to 10.12.138.222 port 59774 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5ec0911e5ed0403ee357f922ace544a Finished request 0. ..... On 2.2.6 I looks like this: rad_recv: Access-Request packet from host 127.0.0.1 port 33977, id=0, length=175 User-Name = "host/DVT-3N14N4J.tirol.local" Calling-Station-Id = "00-24-E8-3A-FA-66" Framed-MTU = 1400 NAS-Port-Type = Ethernet NAS-Port-Id = "2:22" NAS-Port = 1022 NAS-IP-Address = 127.0.0.1 Connect-Info = "CONNECT 1000Mbs" Service-Type = Login-User EAP-Message = 0x0200002101686f73742f4456542d334e31344e344a2e7469726f6c2e6c6f63616c Message-Authenticator = 0x904a22572d739d5a070b01dc941d1daa ++? if (!EAP-Message) -> FALSE ++else else { [eap] EAP packet type response id 0 length 33 [eap] No EAP Start, assuming it's an on-going EAP conversation +++[eap] = updated ++} # else else = updated +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb//sites-enabled/default +group EAP { [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] = handled ++? if (ok) ? Evaluating (ok) -> FALSE ++? if (ok) -> FALSE ++else else { +++? if (EAP-Type == "NAK") ? Evaluating (EAP-Type == "NAK") -> FALSE +++? if (EAP-Type == "NAK") -> FALSE +++else else { ++++update control { ++++} # update control = noop +++} # else else = noop ++} # else else = noop ++? if (handled && (Response-Packet-Type == Access-Challenge)) ? Evaluating (handled ) -> FALSE ?? Skipping (Response-Packet-Type == Access-Challenge) ++? if (handled && (Response-Packet-Type == Access-Challenge)) -> FALSE +} # group EAP = noop Failed to authenticate the user. Login incorrect: [host/DVT-3N14N4J.tirol.local/<via Auth-Type = EAP>] (from client macau03_local port 1022 cli 0024e83afa66) Using Post-Auth-Type REJECT ..... Sending delayed reject for request 0 Sending Access-Reject of id 0 to 127.0.0.1 port 33977 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xca5a2b60ca5b268f8efac2a79a6aa6aa We did check at which version the problem got introduced and found that 2.2.0 worked 2.2.1 did not anymore. The relevant config looks this way authenticate { ..... Auth-Type EAP { eap { handled = 1 invalid = 1 } if (ok) { if ("%{TLS-Client-Cert-Subject}" !~ /\/CN=%{sql:SELECT subject8021x FROM tdevices WHERE mac = '%{Calling-Station-Id}'}/i) { update control { MACAU-Reason := "Cert-Subject <%{TLS-Client-Cert-Subject}> entspricht nicht dem Hinterlegten --> Remediation Netz" } handled } # hat das EAP worked, need to overright the vlan, depending on the switch type elsif ("%{reply:Tunnel-Private-Group-ID}") { update reply { Tunnel-Private-Group-ID := "%{sql:SELECT ..... " } } elsif ("%{reply:Extreme-Netlogin-Extended-Vlan}") { update reply { Extreme-Netlogin-Extended-Vlan := "%{sql:SELECT ....." } } elsif ("%{reply:Xylan-Auth-Group}") { update reply { Xylan-Auth-Group := "%{sql:SELECT ...." } } # store that 802.1x worked update control { MACAU-Reason := "802.1x <%{TLS-Client-Cert-Subject}> authentifiziert" } # Delete Entries the switches don't like # <Warn:AAA.RADIUS.vsaUnknownVend> radDecodeVsa :Unknown vendor 311 16 # <Warn:AAA.RADIUS.vsaUnknownVend> radDecodeVsa :Unknown vendor 311 17 update reply { MS-MPPE-Recv-Key !* ANY MS-MPPE-Send-Key !* ANY } } else { # EAP did not work if (EAP-Type == "NAK") { update control { MACAU-Reason := "Nicht unterstuetzter EAP Typ --> Client Fehlkonfiguration" } } else { update control { MACAU-Reason := "Zertifikat ungueltig (z.b. revoked/abgelaufen)" } } } We also found out that just putting "eap" without {} and Auth-Type EAP just before that code block works - but then the rest of the code is not executed. Where should I put the set/update of the attributes in the newer versions of freeradius? Regards, Robert

3 2

Empty packet, socket not ready message
by Alex Sharaz 18 Jan '16

18 Jan '16

Hi, We've just upgraded one of our outward facing freeradius servers to Ubuntu 14.04. After the upgrade I rebuilt FR 2.2.9 and while tings are working, I'm now getting a lot of Error: Empty packey: socket not ready messages debug trace shows Thu Jan 14 13:45:54 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> as1129@york .ac.uk Thu Jan 14 13:45:54 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jan 14 13:45:54 2016 : Info: ++[attr_filter.access_reject] = updated Thu Jan 14 13:45:54 2016 : Info: +} # group REJECT = updated Thu Jan 14 13:45:54 2016 : Info: Delaying reject of request 67 for 1 seconds Thu Jan 14 13:45:54 2016 : Debug: Going to the next request Thu Jan 14 13:45:54 2016 : Debug: Thread 3 waiting to be assigned a request Thu Jan 14 13:45:55 2016 : Info: Sending delayed reject for request 23 Thu Jan 14 13:45:55 2016 : Info: Sending delayed reject for request 24 Thu Jan 14 13:45:55 2016 : Info: Sending duplicate proxied request to home server 194.83.56.233 por t 1812 - ID: 120 Thu Jan 14 13:45:55 2016 : Error: Empty packet: Socket is not ready. Thu Jan 14 13:45:55 2016 : Info: Sending duplicate proxied request to home server 194.83.56.233 por t 1812 - ID: 7 Thu Jan 14 13:45:55 2016 : Error: Empty packet: Socket is not ready. Thu Jan 14 13:45:55 2016 : Info: Sending delayed reject for request 39 Thu Jan 14 13:45:55 2016 : Info: Sending delayed reject for request 41 Sending Access-Accept of id 237 to 194.82.174.185 port 29981 or Thu Jan 14 13:45:51 2016 : Info: } # server eduroam Thu Jan 14 13:45:51 2016 : Info: Finished request 9. Thu Jan 14 13:45:51 2016 : Debug: Going to the next request Thu Jan 14 13:45:51 2016 : Debug: Thread 1 waiting to be assigned a request Thu Jan 14 13:45:51 2016 : Error: Empty packet: Socket is not ready. Thu Jan 14 13:45:51 2016 : Debug: Waking up in 0.3 seconds. Thu Jan 14 13:45:51 2016 : Debug: Waking up in 0.2 seconds. or Jan 14 13:45:50 2016 : Debug: rlm_perl: Added pair Proxy-State = 0x3236 Thu Jan 14 13:45:50 2016 : Debug: rlm_perl: Added pair State = 0x382b03450000013700010200c253f60c00 000000000000000000000000000004162412a2 Thu Jan 14 13:45:50 2016 : Debug: rlm_perl: Added pair NAS-Identifier = aruba0 Thu Jan 14 13:45:50 2016 : Debug: rlm_perl: Added pair NAS-IP-Address = 144.32.64.18 Thu Jan 14 13:45:50 2016 : Debug: rlm_perl: Added pair User-Name = hyuai(a)hyms.ac.uk Thu Jan 14 13:45:50 2016 : Debug: rlm_perl: Added pair Message-Authenticator = 0x82e775ee97b58da33b 734bd29026433c Thu Jan 14 13:45:50 2016 : Debug: rlm_perl: Added pair Calling-Station-Id = CC-3A-61-B4-4C-5D Thu Jan 14 13:45:50 2016 : Info: ++[perl] = ok Thu Jan 14 13:45:50 2016 : Info: +} # group pre-proxy = updated Thu Jan 14 13:45:50 2016 : Info: Proxying request 4 to home server 194.83.56.233 port 1812 Thu Jan 14 13:45:50 2016 : Debug: Going to the next request Thu Jan 14 13:45:50 2016 : Debug: Thread 1 waiting to be assigned a request Thu Jan 14 13:45:50 2016 : Error: Empty packet: Socket is not ready. Thu Jan 14 13:45:50 2016 : Debug: Waking up in 0.2 seconds. Any other info reuired to find out why this is now happening? Rgds Alex

5 10

Freeradius 3.0.10 sigsegv
by Luca Palazzo 18 Jan '16

18 Jan '16

Hi, we are experiencing a lot of segmentation fault in freeradius 3.0.10. It seems to be something in proxy because we have other freeradius server running without problem. Those one (other two servers) with proxy enabled crash with the same backtrace. Hosts configuration and backtrace follows. Any idea? Thanks in advance Luca Freeradius version is: freeradius: FreeRADIUS Version 3.0.10, for host x86_64-pc-linux-gnu, built on Dec 15 2015 at 10:46:38 The proxy.conf is: proxy server { default_fallback = yes } home_server radius.radius.net { type = auth+acct ipaddr = xxxx port = 1812 secret = "password" status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server radius2.radius.net { type = auth+acct ipaddr = xxx port = 1812 secret = "password" status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server_pool EDUROAM-IT { type = fail-over home_server = radius.radius.net home_server = radius2.radius.net } realm unict.it { # nostrip } realm NULL { nostrip } realm LOCAL { nostrip } realm DEFAULT { pool = EDUROAM-IT nostrip type = radius } eduroam virtual server is: server eduroam { authorize { auth_log suffix if ((control:Proxy-To-Realm == "DEFAULT") && (User-Name =~ /.*@.*.unict.it$/)) { update control { Proxy-To-Realm := NULL } } eap } authenticate { Auth-Type EAP { eap } } preacct { # detail suffix if ((control:Proxy-To-Realm == "DEFAULT") && (User-Name =~ /.*@.*.unict.it$/)) { update control { Proxy-To-Realm := NULL } } } accounting { sql } post-auth { reply_log Post-Auth-Type REJECT { # reply_log } } pre-proxy { attr_filter.pre-proxy pre_proxy_log } post-proxy { post_proxy_log attr_filter.post-proxy } } Here is the backtrace (the same for both of servers): #0 0x00007ffff7bc77a0 in paircompare (request=request@entry=0xa531c0, req_list=0xa53470, check=check@entry=0xa54ce0, rep_list=rep_list@entry=0x0) at src/main/pair.c:536 #1 0x00007ffff7bb95d7 in cond_cmp_values (request=0xa531c0, lhs_type=<optimized out>, lhs=<optimized out>, lhs_len=<optimized out>, rhs_type=PW_TYPE_STRING, rhs=0x7fffffffd2d0, rhs_len=8, c=<optimized out>, c=<optimized out>) at src/main/evaluate.c:315 #2 0x00007ffff7bb992a in cond_normalise_and_cmp (request=0x0, c=0x8bd4a0, lhs_type=PW_TYPE_INVALID, lhs_enumv=0x7ffff7bd4230, lhs_enumv@entry=0x0, lhs=0x0, lhs_len=1, lhs_len@entry=0) at src/main/evaluate.c:544 #3 0x00007ffff7bba3ac in radius_evaluate_map (request=request@entry=0xa531c0, modreturn=modreturn@entry=10, depth=depth@entry=0, c=c@entry=0x8bd4a0) at src/main/evaluate.c:612 #4 0x00007ffff7bba4a0 in radius_evaluate_cond (request=0xa531c0, modreturn=10, depth=0, c=0x8bd4a0) at src/main/evaluate.c:708 #5 0x0000000000425228 in modcall_recurse (request=0xa531c0, component=22, depth=22, entry=0x7fffffffdec8, do_next_sibling=false) at src/main/modcall.c:479 #6 0x0000000000424fa9 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7fffffffdeb0, c=<optimized out>, result=0x7fffffffd724, do_next_sibling=true) at src/main/modcall.c:408 #7 0x00000000004252c4 in modcall_recurse (request=0xa531c0, component=22, depth=22, entry=0x7fffffffdeb0, do_next_sibling=false) at src/main/modcall.c:785 #8 0x0000000000424fa9 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7fffffffde98, c=<optimized out>, result=0x7fffffffd9c4, do_next_sibling=true) at src/main/modcall.c:408 #9 0x00000000004252c4 in modcall_recurse (request=0xa531c0, component=22, depth=22, entry=0x7fffffffde98, do_next_sibling=false) at src/main/modcall.c:785 #10 0x0000000000424fa9 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7fffffffde80, c=<optimized out>, result=0x7fffffffdc64, do_next_sibling=true) at src/main/modcall.c:408 #11 0x00000000004252c4 in modcall_recurse (request=0xa531c0, component=22, component@entry=MOD_AUTHORIZE, depth=22, depth@entry=0, entry=0x7fffffffde80, do_next_sibling=false, do_next_sibling@entry=true) at src/main/modcall.c:785 #12 0x0000000000426416 in modcall (component=component@entry=MOD_AUTHORIZE, c=c@entry=0x9c22b0, request=request@entry=0xa531c0) at src/main/modcall.c:1130 #13 0x00000000004210dd in indexed_modcall (comp=MOD_AUTHORIZE, idx=<optimized out>, request=0xa531c0) at src/main/modules.c:1009 #14 0x0000000000410911 in rad_authenticate (request=0xa531c0) at src/main/auth.c:490 #15 0x000000000043409a in request_running (request=0xa531c0, action=<optimized out>) at src/main/process.c:1527 #16 0x0000000000430126 in request_queue_or_run (request=request@entry=0xa531c0, process=process@entry=0x433ee0 <request_running>) at src/main/process.c:1015 #17 0x0000000000431815 in request_receive (ctx=ctx@entry=0xa52a40, listener=listener@entry=0x9ef500, packet=0xa52aa0, client=client@entry=0x972b20, fun=fun@entry=0x4104b0 <rad_authenticate>) at src/main/process.c:1782 #18 0x000000000041bd5e in auth_socket_recv (listener=0x9ef500) at src/main/listen.c:1568 ---Type <return> to continue, or q <return> to quit--- #19 0x000000000042e72e in event_socket_handler (xel=<optimized out>, fd=<optimized out>, ctx=<optimized out>) at src/main/process.c:4556 #20 0x00007ffff7994025 in fr_event_loop (el=0x8e4640) at src/lib/event.c:641 #21 0x0000000000435531 in radius_event_process () at src/main/process.c:5621 #22 0x000000000040f7cc in main (argc=<optimized out>, argv=0x7fffffffecc8) at src/main/radiusd.c:579

4 15

does freeradius support key-wrap
by Michael Martinez 18 Jan '16

18 Jan '16

Hi, Is Freeradius key-wrap compliant? I don't see any recent dialogue on this. I only see some discussion from 2009, in which Alan DeKok states that Freeradius does not yet support the IETF key-wrap document. Implying that perhaps it would be added at some point. But I don't see anything currently in the literature to say whether newer versions do, or do not. -Mike -- ---

2 1

freeradius 3.0.4 can't contact LDAP server
by Blangille Denis 17 Jan '16

17 Jan '16

hello I'm using freeradius 3.0.4 on CentOS 7 with a LDAP server, ApacheDS M20. I have configure radius.conf, clients.conf and ldap file module. The debug command radiusd -XC returns the configuration is good. But it returns : rlm_ldap: Falling back to build time libldapversion info. Query for LDAP_OPT_API_INFO returned -1. rlm_ldap: libldap vendor: OpenLDAP version: 20439. and the server can't contact LDAP server at the starting. I'm test with a ldapsearch command with the same information and i have no error. A solution is possible to make a contact between the servers ? Thanks. Denis Blangille

2 1

Does Freeradius support RFC 3576 (dynamic authorization)?
by Michael Martinez 17 Jan '16

17 Jan '16

Hi, do recent (>= 2.1.12) versions have support for RFC 3576? The website makes some vague statement about being "compatible" with it, but doesn't actually say whether it will *do* dynamic authorization. -Mike -- ---

3 2

Multilogin accounting Problem
by Arash Shams 16 Jan '16

16 Jan '16

Hello for example i have a daily service with 4gb bandwidth . i logged in 3 devices with same username (simultaneous-use) now i have 12 gb service means each device gets 4 gb instead of all of them have 4 gb together how can i solve this problem ? FreeRADIUS Version 3.1.0 with mysql and mikrotik as nas . thank you

2 1

Disabling log entries for rejected users
by Michał B 15 Jan '16

15 Jan '16

Hi guys, I use freeradius for authenticating DHCP/PPPoE clients connected to Mikrotik routers. Freeradius uses users files, not SQL database. If I disable some user in my management software, the "Accept" entry in proper "users" file is not generated. The access request for such user is logged: Jan 13 09:22:13 radsrv freeradius[2152]: Login incorrect (rlm_chap: Clear text password not available): [blockeduser/<CHAP-Password>] (from client mikrotik-main port 0 cli 194.182.13.200) After adding rejects for blocked users, for example: blockeduser Auth-Type := Reject The message still appears in the log file: Jan 13 09:26:14 radsrv freeradius[2152]: Login incorrect: [blockeduser/<CHAP-Password>] (from client mikrotik-main port 0 cli 194.182.13.200) How can I disable log etries for blocked/rejected users? Regards!

5 8

Accounting with external script
by mclaut＠mclaut.com 15 Jan '16

15 Jan '16

Hi ! Sorry, but I can not find the answer to the question - what the external (for example php script) should return to the radius server at accounting? What attributes? I'm use - FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Sep 22 2015 at 15:27:25 In Radius log: Fri Jan 15 20:59:12 2016 : Info: Ready to process requests. rad_recv: Accounting-Request packet from host 1.1.4.4 port 62311, id=8, length=32 Acct-Status-Type = Start Acct-Session-Id = "8768" Fri Jan 15 20:59:54 2016 : Info: # Executing section preacct from file /etc/raddb/sites-enabled/mclaut_default_exec Fri Jan 15 20:59:54 2016 : Info: +group preacct { Fri Jan 15 20:59:54 2016 : Info: ++[preprocess] = ok Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{hex:Attribute} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Acct-Session-Id} -> 8768 Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Acct-Authentic} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Acct-Status-Type} -> Start Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{NAS-IP-Address} -> 1.1.4.4 Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{User-Name} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{NAS-Port} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Framed-Protocol} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %{Framed-IP-Address} -> Fri Jan 15 20:59:54 2016 : Info: [bill_acc] expand: %S -> 2016-01-15 20:59:54 Fri Jan 15 20:59:54 2016 : Debug: Exec output: Fri Jan 15 20:59:54 2016 : Info: [bill_acc] Exec: program returned: 0 Fri Jan 15 20:59:54 2016 : Info: ++[bill_acc] = ok Fri Jan 15 20:59:54 2016 : Info: +} # group preacct = ok Fri Jan 15 20:59:54 2016 : Info: WARNING: Empty accounting section. Using default return values. Fri Jan 15 20:59:54 2016 : Info: Finished request 5. Fri Jan 15 20:59:54 2016 : Info: Cleaning up request 5 ID 8 with timestamp +125 Fri Jan 15 20:59:54 2016 : Debug: Going to the next request Fri Jan 15 20:59:54 2016 : Info: Ready to process requests. I do not understand - WARNING: Empty accounting section. Using default return values. But, answer from script: Fri Jan 15 20:59:54 2016 : Debug: Exec output: Fri Jan 15 20:59:54 2016 : Info: [bill_acc] Exec: program returned: 0 Fri Jan 15 20:59:54 2016 : Info: ++[bill_acc] = ok Fri Jan 15 20:59:54 2016 : Info: +} # group preacct = ok And NAS don't recieve any answers from Radius Server.... Tell me please, what am I doing wrong? Thank you in advance

2 1

MAC expiry
by Max .M 15 Jan '16

15 Jan '16

Hi all, I currently have MAC authentication with Freeradius and MAC stored into Mysql db. It works well :) Is it possible to enable MAC auth expiry ? E.G : A user can authenticate using MAC auth for 1 week but must auth again at day 8. Thanks !

2 4