- Freeradius-Users - lists.freeradius.org

EAP-TLS context uninitialized
by Franks Andy (IT Technical Architecture Manager) 05 Jan '16

05 Jan '16

Hi all, I've a problem with FR3.1.0 git#f4d5ff6. This is on our test "wireless" radius server, and I'm looking to commission the configuration onto more production systems once it's certified. Basically the only changes are a newer version of FR, and some tidying of the config. The older version is git #390f216. When sending the same clients to both, very often the newer one complains with this issue and rejects the user: (85) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (85) Auth-Type eap { (85) eap: Peer sent packet with method EAP TLS (13) (85) eap: Calling submodule eap_tls to process data (85) eap_tls: Continuing EAP-TLS (85) eap_tls: Peer indicated complete TLS record size will be 131 bytes (85) eap_tls: Got complete TLS record, with length (131 bytes) (85) eap_tls: [eap-tls verify] = ok (85) eap_tls: before/accept initialization (85) eap_tls: TLS Accept: before/accept initialization (85) eap_tls: <<< recv handshake [length 126], client_hello tls: TLS Accept: Error in SSLv3 read client hello C tls: TLS Accept: Error in SSLv3 read client hello C (85) eap_tls: ERROR: TLS says: error:140D9115:SSL routines:SSL_GET_PREV_SESSION:session id context uninitialized (85) eap_tls: ERROR: TLS_read failed in a system call (-1), TLS session failed (85) eap_tls: ERROR: TLS receive handshake failed during operation (85) eap_tls: ERROR: [eap-tls process] = fail (85) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (85) eap: Sending EAP Failure (code 4) ID 45 length 4 (85) eap: Failed in EAP select The confusing thing is it's not consistent - sometimes it will be ok, I've not yet worked out the pattern: (75) Auth-Type eap { (75) eap: Peer sent packet with method EAP TLS (13) (75) eap: Calling submodule eap_tls to process data (75) eap_tls: Continuing EAP-TLS (75) eap_tls: Peer indicated complete TLS record size will be 133 bytes (75) eap_tls: Got complete TLS record, with length (133 bytes) (75) eap_tls: [eap-tls verify] = ok (75) eap_tls: before/accept initialization (75) eap_tls: TLS Accept: before/accept initialization (75) eap_tls: <<< recv handshake [length 128], client_hello (75) eap_tls: TLS Accept: SSLv3 read client hello A (75) eap_tls: >>> send handshake [length 89], server_hello (75) eap_tls: TLS Accept: SSLv3 write server hello A (75) eap_tls: >>> send handshake [length 2344], certificate (75) eap_tls: TLS Accept: SSLv3 write certificate A (75) eap_tls: >>> send handshake [length 331], server_key_exchange (75) eap_tls: TLS Accept: SSLv3 write key exchange A (75) eap_tls: >>> send handshake [length 104], certificate_request (75) eap_tls: TLS Accept: SSLv3 write certificate request A (75) eap_tls: TLS Accept: SSLv3 flush data (75) eap_tls: TLS Accept: Need to read more data: SSLv3 read client certificate A (75) eap_tls: TLS Accept: Need to read more data: SSLv3 read client certificate A (75) eap_tls: In TLS handshake phase (75) eap_tls: In TLS accept mode (75) eap_tls: [eap-tls process] = handled (75) eap: Sending EAP Request (code 1) ID 71 length 1090 (75) [eap] = handled (75) } # Auth-Type eap = handled It doesn't happen on the older version (at all) and that has very similar config. Is there any known reason why this should be coming up? The NAS and clients are identical during each test, the older version is fine, the newer not. The host machines were built at the same time, so the dev libraries compiled against are likely the same versions. I'm stumped! Is it worth me moving to a newer build and trying again - any known issues? Thanks! Andy

2 1

Assigning Users to Groups Dynamically
by J Kephart 01 Jan '16

01 Jan '16

Hi! I've been looking through the wiki, but thus far, I've not found anything that describes what I'd like to be able to do. We manage on-site hardware for our clients, and that hardware includes routers, gateways, switches, etc. What I'd like to be able to do is assign a user to a group dynamically, based on some identifying parameter received in the access request, and then have the group's attributes passed back in the access accept packet. So, for example, if any user wants to connect to Vendor A's gateway, we might have a group defined for that type of device containing: vendor_a_gateway Idle-Timeout = 900 vendor_a_gateway VSA_1 = xxx vendor_a_gateway VSA_2 = xxx vendor_a_gateway VSA_3 = xxx Likewise, for Vendor B, we might have the following: vendor_b_switch Idle-Timeout = 600 vendor_b_switch VSA_1 = xxx vendor_b_switch VSA_2 = xxx vendor_b_switch VSA_3 = xxx Ultimately, then, if a user logs on to a device that we can categorize as being Vendor A's gateway, we'd automatically associate that user with the group "vendor_a_gateway", and so on. In that way, we hope to limit the number of attributes we need to manage for each user, instead having a short list of groups with attributes that can be assigned on the fly. I don't know if I've explained this in a way that makes sense (I hope it makes sense to someone!), but I wonder if there's a way to do what I've described. Hopefully, Jim

3 5

Proxying with radsec/TLS, Access-Reject leads to "spoofed proxy reply"
by Susan Barnes 01 Jan '16

01 Jan '16

Hello, I am playing with radsec. I have set up a proxy-connection between our staging server and an additional testserver to act as homeserver. Both servers are v3.0.10. What I have managed so far is: The staging-server can contact the homeserver and establish a TLS-secured connection. The staging server sends a request to the homeserver and the homeserver will process it. The homeserver replies. If the homeserver rejects the Request, the staging-server will not accept the reply, but discards it with "Ignoring spoofed proxy reply. Signature is invalid" If the homeserver sends an Access-Accept, the staging-server will accept the reply. I have tried the proxy setup without radsec/TLS. In that case both Accept and Reject work. On the homeserver's side I have: client radiustest { ipaddr = $STAGING proto = tls secret = radsec } On the staging-server's side I have: home_server radiusdevel { ipaddr = $HOME port = 2083 type = auth secret = radsec proto = tcp status_check = none tls { ... } } In debug output I first see on HOME: (0) SSL Connection Established on STAGING: (0) (other): SSL negotiation finished successfully I assume, that means that I set up the TLS-part correctly. Then I see on STAGING: Listening on proxy (STAGING, 46303) -> home_server (HOME, 2083) Waking up in 0.2 seconds. (0) Proxying request to home server HOME port 2083 (TLS) timeout 10.000000 (0) Sent Access-Request Id 239 from STAGING:46303 to HOME:2083 length 137 on HOME (0) tls_recv: Access-Request packet from host STAGING port 46303, id=239, length=137 (0) <running>: Received Access-Request Id 239 from STAGING:46303 to HOME:2083 length 137 (0) Sent Access-Reject Id 239 from HOME:2083 to STAGING:46303 length 49 And then on STAGING: "Ignoring spoofed proxy reply. Signature is invalid" 10 seconds later: (0) No proxy response, giving up on request and marking it done (0) ERROR: Failing proxied request for user "radtest(a)testrealm.de", due to lack of any response from home server HOME port 2083 I have poked around with gdb on the staging server a bit. Within rad_verify() at the point of calc_replydigest() we get to the point of "Received %s packet from home server %s port %d with invalid Response Authenticator! (Shared secret is incorrect.)", (did not appear anywhere in the Debug Output). Does anyone have an idea what the problem could be? Regards and Thanks Susan -- S.Barnes Cologne University IT/Networking Dept.

3 5

FreeRADIUS allows connections locally, but not remotely
by Ernie Dunbar 01 Jan '16

01 Jan '16

Hi everyone. I have a difficult problem that appears to have come out of the blue. After rebooting the Debian Wheezy server that hosts our RADIUS authentication this morning, suddenly FreeRADIUS v2.1.12+dfsg-1.2 is no longer working. I can successfully test the connection locally using 'radtest' like this: # /usr/bin/radtest customer password localhost:1812 5 localsecret -4 127.0.0.1 Sending Access-Request of id 218 to 127.0.0.1 port 1812 User-Name = "customer" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 5 Message-Authenticator = 0x00000000000000000000000000000000 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=218, length=38 Framed-Protocol = PPP Service-Type = Framed-User Framed-Compression = Van-Jacobson-TCP-IP I get the rad_recv response right away. When I test it from the same machine, but *saying* I'm connecting remotely, it apparently times out: www:/etc/freeradius# /usr/bin/radtest customer password localhost:1812 5 remotesecret -4 XXX.XXX.XXX.254 Sending Access-Request of id 34 to 127.0.0.1 port 1812 User-Name = "customer" User-Password = "password" NAS-IP-Address = XXX.XXX.XXX.254 NAS-Port = 5 Message-Authenticator = 0x00000000000000000000000000000000 Framed-Protocol = PPP Sending Access-Request of id 34 to 127.0.0.1 port 1812 User-Name = "customer" User-Password = "password" NAS-IP-Address = XXX.XXX.XXX.254 NAS-Port = 5 Message-Authenticator = 0x00000000000000000000000000000000 Framed-Protocol = PPP ^C The connection evidently times out and radtest retries, at which point I hit Ctrl-C. I get the same results when I actually test the connection from a remote site as when I pretend to make the connection from a remote site with -4 XXX.XXX.XXX.254. I can't really test *from* that site, since it's a Cisco AS5300. The only thing I can think of that *might* have changed was the Debian package version, but I can't even confirm that really, and it's in the old stable branch, which I believe is no longer supported with new patches. Nothing has changed in the FreeRADIUS configuration since about 2010. Any assistance would be appreciated!

3 9

Radius assigned IP for WPA2 Clients.
by Marc Beaumont 31 Dec '15

31 Dec '15

Hi, I'm in process of setting up a Xirrus Wifi access point to authenticate using a Freeradius Server. At the moment, I can get it to authenticate okay, but the client once connected always get it's IP from the DHCP server on the network. Is there a way to force it to use what I put in Framed-IP-Address as a the moment it ignores this? Marc Beaumont Network Admin / Linux Specialist Comms365 Limited e: marc.beaumont(a)comms365.com ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud http://www.intycascade.com/products/symantec/ ______________________________________________________________________

2 2

prepaid volume quota with cisco nas
by riki 31 Dec '15

31 Dec '15

Hello, i am working with Cisco NAS, it supports enforcing volume based quota. On first authorizations, i am expected to send QV value. When user runs out of quota, NAS wants to reauthorize. No problem on NAS side [1]. I am on freeradius-3.0.4 from Centos 7 repositories. Accounting is on PostgresSQL backend, acctinputoctets and acctoutputoctets are updated every 5 minutes. I can use following query for sqlcounter check on last session end expire it hourly: query = "\ SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) FROM radacct \ WHERE UserName='%{%k}' AND AcctStartTime::ABSTIME::INT4 + AcctSessionTime \ > '%b'" I want to limit session volume for 5MB per every hour (if achieved in 20 minutes, do not authorize for next 40 minutes). Counters are cumulative for session so i have identified so far these options: 1. reset session when quota reached with CoA update/disconnect, it will causes new session every hour if quota is depleted and my query works. 2. i can use a trigger for update on radacct table which will insert delta of old and new value with timestamp to kind of "stats" table and use this one for sqlcounter query, counting data for last 12 5-minute intervals or so. 3. modify radacct table/update query to do the same as point 2. If you have some other ideas, please let me know. >From the future upgrade compatibility point of view, the 2 looks best. [1] http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/isg/configuration/xe-3s/as… Thanks for feedback r.

4 6

home_server status_check and radsec
by Mark Moseley 30 Dec '15

30 Dec '15

I'm still fairly new to freeradius so be gentle :) I'm setting up radsec and I had a question on home_server failover. Since the home_server is by necessity set to 'tcp', radiusd errors out with a message that 'status_check' must be set to 'none', if you try to set it to anything. Does that mean it's not possible to do failover with radsec proxies? I've got a home_server pool set up with two nodes. When I take down the first-listed home_server with tcpdump running, the freeradius on the 'client' side just keeps trying to hit the now-disabled server and never attempts the secondary. Presumably I'm missing something but google is no help so far. I can paste configs but I wanted to see first if it was known to just not be possible. Version is 3.0.4 (on Centos 7.1). The 3.0.4 -> 3.0.10 changelogs didn't have anything promising that sounded like this. Thanks!

2 4

RE: CoA config
by Franks Andy (IT Technical Architecture Manager) 30 Dec '15

30 Dec '15

I'm doing CoAs with FR..? Check out sites-available/originate-coa or radclient docs. Hope that's what you were after.. :-) -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Jorge Pereira Sent: 30 December 2015 14:35 To: FreeRadius users mailing list Subject: Re: CoA config this feature isn't available. -- Jorge Pereira On Wed, Dec 30, 2015 at 5:32 AM, Anirudh Malhotra <8zero2ops(a)gmail.com> wrote: > Can the NAS CoA config be done in NAS sql table? Or do i have to use file > only. > > BR, > Anirudh Malhotra > 8zero2 > Mail: 8zero2.in(a)gmail.com > Facebook: www.facebook.com/8zero2 > Twitter: @8zero2_in > Blog: blog.8zero2.in > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

CoA config
by Anirudh Malhotra 30 Dec '15

30 Dec '15

Can the NAS CoA config be done in NAS sql table? Or do i have to use file only. BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 2

Errors authenticating certain users.
by Migo Pod 29 Dec '15

29 Dec '15

Hello List, A few years ago I inherited a FreeRADIUS environment, and it has been more or less trouble free for the whole time. In mid-December, however, we started getting reports of authentication failures from computers that were joined to our Active Directory environment and only those computers. Previously we've been having no issues authenticating people with username. AD\username. and username@realm, but on around the 16th people with the AD\username format started getting authentication failures. We're running RHEL6 with the distro supplied freeradius binary (freeradius-2.2.6-6.el6_7.x86_64) and haven't made any changes to anything besides system updates in over a year, and it has been working perfectly up until now. Here's a relevant log snippet that appears to describe the issue, but I have no idea where to start looking for a solution. +group authorize { ++[preprocess] = ok ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "podia-user", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 1 length 18 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry DEFAULT at line 50 ++[files] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Identity (AD\podia-user) does not match User-Name (podia-user). Authentication failed. [eap] Failed in handler ++[eap] = invalid +} # group authenticate = invalid Thanks in advance for any advice, -mat houser

3 8