- Freeradius-Users - lists.freeradius.org

RadSec Dynamic Server Discovery
by Sebastian Hagedorn 12 Jan '16

12 Jan '16

Hi, just as information, we explored using the RadSec module of Freeradius 3.0.10 for Eduroam, but while we got it to work locally after the recent fix, the German Eduroam hub insists we use radsecproxy instead. The main reason they give is that Freeradius lacks support for Dynamic Server Discovery. While that feature isn't yet actively used, it's on the roadmap, so that institutions won't have to proxy via central hubs anymore, but can discover the right proxy for each realm dynamically via NAPTR/SRV records. They also claim that it's less secure to expose the RADIUS servers directly, but I don't really buy that argument. We will go forward with radsecproxy for the time being, but if Freeradius gains support for Dynamic Server Discovery in the future, we will definitely look into that. -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

3 3

FreeRadius exec module not working
by Arash Shams 12 Jan '16

12 Jan '16

Hello i have a simple curl command get 2 arguments and send sms with them so i create a bash script "sendsms.sh" and create a exec module with that exec sendwelsms { wait = no program = "/root/sendsms.sh '%{User-Name} %{Huntgroup-Name}'" input_pairs = request shell_escape = yes output = file } i passed %{User-Name} as $1 and %{Huntgroup-Name} as $2 to that script . i put sendwelsms to end of postscript at accounting section and i want to every time a user logged this script executed now its not working any suggestion ?

3 3

Sql log
by Lucas Diaz 11 Jan '16

11 Jan '16

I'm trying to enable sql queries to a log file. I'm using freeradius 3.10 and the only thing I read I need to do is to uncomment the line "logfile = ${logdir}/sqllog.sql" on the file "/usr/local/etc/raddb/mods-enabled/sql", but it's not working. Is that OK? Thanks. -- *LUCAS DIAZ | DPTO. REDES* _______________________________________________________ Istilart 255 | Tel.: 02983 513040 C.P. B7500EGE | Tres Arroyos | Bs As | Argentina * *www.eternet.cc <http://www.eternet.cc/> | *ETERNET SISTEMAS *

9 14

How is radius.seq file used?
by dev 11 Jan '16

11 Jan '16

Hi all, I'm trying to debug a custom openLDAP module I forked based on the pw-radius contrib module (Ubuntu 14.04 recently migrated from 12.04). I'm using libfreeradius-client2 (v1.1.6-7). What seems to be happening is the ldap daemon creates the radius.seq file without read/write permissions by the freeradius daemon. I suspect this is causing slapd to segfault: slapd[13868]: segfault at 0 ip 00007fc6f521dcd2 sp 00007fc6eeff6e38 error 4 in libfreeradius-client.so.2.0.0[7fc6f5216000+c000] From what I've read, this file is only needed for Radius Accounting. I'm using RADIUS for authenticating One Time Passwords generated on a software token so would like to try disabling radius.seq to see fi the problem goes away. How can I disable radius.seq? Thanks!

2 1

ldap_mac config in 3.x
by Anthony Cheng 11 Jan '16

11 Jan '16

Hi all, Currently looking to migrate a FreeRADIUS from 2.1.12 to 3.0.10. Does 3.x still support ldap_mac config. in the ldap configuration? I see no reference to it or mention that it was removed.

2 1

3.0.10: decrypting RSA private key failure
by Stefan Winter 11 Jan '16

11 Jan '16

Hi, now this is strange. I'm in the middle of a certificate rollover. I have protected the old (1024 bit RSA) and new (4096 bit RSA) key with the same passphrase. Using "openssl rsa" on the FreeRADIUS box, I can decrypt both keys. When starting FreeRADIUS with the old cert+key, it starts up. When trying with the new cert+key: # Instantiating module "eap-staff" from file /usr/local/freeradius/config/raddb/mods-enabled/eap-staff # Linked to sub-module rlm_eap_tls tls { tls = "tls-staff" } tls-config tls-staff { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/freeradius/config/raddb/certs/STAFF-CA/" pem_file_type = yes private_key_file = "/usr/local/freeradius/config/raddb/staff/cert-srv.key" certificate_file = "/usr/local/freeradius/config/raddb/staff/cert-srv.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/freeradius/config/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1300 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 name = "eduroam-staff" max_entries = 128 persist_dir = "/var/log/radius/tlscache-eduroam-staff" } verify { } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } } tls: Failed reading private key file /usr/local/freeradius/config/raddb/staff/cert-srv.key:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch rlm_eap_tls: Failed initializing SSL context rlm_eap (eap-staff): Failed to initialise rlm_eap_tls /usr/local/freeradius/config/raddb/mods-enabled/eap-staff[1]: Instantiation failed for module "eap-staff" Huh? The passphrase is identical, I'm pointing it to the correct filename, openssl can decode it - but FreeRADIUS can't? Looking at the encrypted private keys, I do see a small difference: OLD: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,EC24580B720DE947 [...] -----END RSA PRIVATE KEY----- NEW: -----BEGIN ENCRYPTED PRIVATE KEY----- [...] -----END ENCRYPTED PRIVATE KEY----- Both decode into: -----BEGIN RSA PRIVATE KEY----- [...] -----END RSA PRIVATE KEY----- openssl can handle both. Any clue why FreeRADIUS doesn't? This is a 3.0.10 installation. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 4

My Hotspot is passing some sites without authentication
by mohammed farouk 11 Jan '16

11 Jan '16

Weird issue since users once connected to the Coovachilli and not login login yet to correct freeradius credential they still can brows google and watch youtube. Freeradius can't feel there is packet flow to count or to block from the "freeradius -X" google keeps hopping between lots of IP's which skips the blocked ones and passes another one which not blocked, hotspot creates the following iptables: iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -i eth1 -j DROP -A INPUT -d 10.42.0.1/32 -i tun0 -p icmp -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p udp -m udp --dport 53 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p udp -m udp --dport 67:68 -j ACCEPT -A INPUT -d 255.255.255.255/32 -i tun0 -p udp -m udp --dport 67:68 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 10000 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 8080 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 4990 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -p tcp -m tcp --dport 3990 -j ACCEPT -A INPUT -d 10.42.0.1/32 -i tun0 -j DROP -A FORWARD -i tun0 -o eth0 -j ACCEPT -A FORWARD -i tun0 ! -o eth0 -j DROP -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -o tun0 -j ACCEPT -A FORWARD -i tun0 -j ACCEPT -A FORWARD -o eth1 -j DROP -A FORWARD -i eth1 -j DROP *Best regards,* *Mohammed Farouk* *+20(0)1144767555* *goo.gl/WWUQrB <http://goo.gl/WWUQrB>*

2 1

Server certificate renewal
by douglas eseng 11 Jan '16

11 Jan '16

Not strictly freeradius issue, perhaps those on the list have insight on the issue. Using freeradius for PEAP authentication, server cert is signed by private CA. We don't use profile to install the CA cert onto iOS devices. After renewal of server cert, existing iOS devices ask user to again trust the cert. Is this normal behaviour? Since it was a renewal, would have thought it is recognized as the same cert and remain trusted. Anyone know once user trusted the cert, what digest/fingerprint of the cert does IOS remember? Unable to find info on this from Apple's site. Thanks.

5 5

Question on anonymous identity
by Mathieu Simon (Lists) 11 Jan '16

11 Jan '16

Hi, A question surfaced recently while I was reworking a configuration: By building 3.0 from source I saw that the upcoming 3.0.11 will be actively logging that anonymous identities should be used* to protect identities. I'm not with eduroam, but try to keep an eye on what participating institutions and others recommend. I see they generally tell users to set one (where possible). The profile data from cat.eduroam.org also contains one. We always recommended students to set an anonymous identity and profiles/config tools given to them would set it for them, but it wasn't actively enforced. If the device wasn't configured for sending an anonymous identity it would still let the device in, if inner-tunnel authentication and authorization requirements passed.** So, what is the current take: Would you / Do you (recommend) enforcing the use of an anonymous identity, resulting in Access-Reject? Do most enduser wireless devices finally support setting an anonymous identity these days? Thanks in advance Mathieu * https://github.com/FreeRADIUS/freeradius-server/commit/ec5cb167dd1de6d3c8e7…

3 4

Re: Logging (was: Freeradius-Users Digest, Vol 129, Issue 3)
by Stefan Paetow 08 Jan '16

08 Jan '16

>Yes, 'detail' is included in the accounting section. Ok, that's not going to log then. It will only log when it gets accounting packets. Look at the 'default' server. In the post-auth section you'll see a reply_log entry that is commented out by default. If you uncomment this, it will start logging entries as per the 'reply_log' line log that is defined in the 'detail.log' module in mods-available. However, note that this will *not* be a single-line entry (which is what's recommended by the eduroam operator in the UK). Look at https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/raddb/modules/l inelog for the current linelog for v2.x. If you're on 3.x, go to https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai lable/linelog - This will come in handy when doing what the Confluence page you found says. >Log file enclosed in ZIP format. Don't do that. Archives are stripped. A simple freeradius -X output capture is useful. >I found this website which may help to enable logging, looks like logging >functionality is different between 2.1.10 and 2.1.12. >http://confluence.diamond.ac.uk/pages/viewpage.action?pageId=22252353 Ahhh... My history comes back to haunt me... ;-) You may want to set up two of the three line logs defined on that page: eduroam_log and inner_auth_log. To log to the *log* directory, do *not* set 'filename' to 'syslog'. Instead set it to whatever you wanted the filename to be... "${logdir}/linelog" is the default in linelog. Tweak that appropriately for the inner_auth_log (if you want to log authentication of your own users separately). Then, like the page says, call 'eduroam_log' in the post-auth section, or, better yet, in the post-proxy section of your eduroam server, since post-proxy gets hit by an incoming reply from a home organisation before post-auth does (and post-auth also gets hit by your own users after their authentication reply returns from the inner-tunnel server). Also, like the page says, call 'inner_auth_log' from the post-auth section of your inner-tunnel. Stop your server. Start it in debug mode. Then hit it with an authentication request (for your own user). You should with any luck get an entry in your inner-tunnel authentication log. Then, if you have a test subject from another institution, get them to authenticate through eduroam and see what happens. Like Alan and others have pointed out, the module files are liberally commented so that it is easier to understand the operation of the server (and what the options do). Of course, if you strip out all comments for a bare-bones configuration, then yes, it becomes distinctly more difficult (or you spend a lot of time on Github to understand what each file does). :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Networkshop44, University of Manchester. Save the date: 22-24 March, 2016. #NWS44 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200. >

1 0