- Freeradius-Users - lists.freeradius.org

FR3.1.x head fails to build on RHEL 6.6
by Peter Lambrechtsen 06 Dec '15

06 Dec '15

Hello After downloading the head version of FR3.1.x it first complained that gcc was lacking C11, so I downloaded the devtoolset-2 rpms from RedHat devtoolset-2-gcc-4.8.2-15.1.el6.x86_64.rpm devtoolset-2-gcc-c++-4.8.2-15.1.el6.x86_64.rpm devtoolset-2-runtime-2.1-4.el6.noarch.rpm devtoolset-2-libstdc++-devel-4.8.2-15.1.el6.x86_64.rpm Now the configure succeeds with /opt/rh/devtoolset-2/root/usr/bin in the path, but when starting the make it fails to compile debug.c CC src/lib/debug.c /tmp/ccuawyBs.s: Assembler messages: /tmp/ccuawyBs.s:581: Error: expecting string instruction after `rep' make: *** [build/objs/src/lib/debug.lo] Error 1 Any idea what other dependencies I would need to upgrade (make?) to build on RHEL?

2 1

Freeradius EAP-TLS - every 2nd (even) attempt unsuccessfull
by gracian＠centrum.cz 05 Dec '15

05 Dec '15

Hello all, First, our environment configuration is: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu configured for EAP-TLS Cisco WLC 2504 Windows 7/8.1 clients Problem: every 1st (odd) connection to WiFi network is without any problem and part of client's certificate contain "TLS-Client-Cert-Common-Name := 'mib(a)example.com'", which I check using check-eap-tls via part below, is visible: server check-eap-tls { authorize { update config { Auth-Type := Accept } if ("%{TLS-Client-Cert-Common-Name}" =~ /^[A-z.]*(a)example\.ccom$/) { update config { Auth-Type := Accept } } else { update config { Auth-Type := Reject } update reply { Reply-Message := "Your certificate is not valid." } } ... ... ... When I try to disconnect from wifi and connect again with the same client, connection fails. I noticed that debug output differ for successfull and unsuccessfull attempt in part below. --------------------------------------------------------------- Successfull attempt log --------------------------------------------------------------- (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0x3190079e31930a29 (1) eap : Finished EAP session with state 0x3190079e31930a29 (1) eap : Previous EAP request found for state 0x3190079e31930a29, released from the list (1) eap : Peer sent method TLS (13) (1) eap : EAP TLS (13) (1) eap : Calling eap_tls to process EAP data (1) eap_tls : Authenticate (1) eap_tls : processing EAP-TLS TLS Length 129 (1) eap_tls : Length Included (1) eap_tls : eaptls_verify returned 11 (1) eap_tls : (other): before/accept initialization (1) eap_tls : TLS_accept: before/accept initialization (1) eap_tls : <<< TLS 1.0 Handshake [length 007c], ClientHello SSL: Client requested cached session b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e reading pairlist file /var/log/radius/tlscache/b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e.vps Couldn't open /var/log/radius/tlscache/b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e.vps for reading: No such file or directory SSL: could not load persisted VPs for session b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e (1) eap_tls : TLS_accept: SSLv3 read client hello A (1) eap_tls : >>> TLS 1.0 Handshake [length 0059], ServerHello (1) eap_tls : TLS_accept: SSLv3 write server hello A (1) eap_tls : >>> TLS 1.0 Handshake [length 0909], Certificate (1) eap_tls : TLS_accept: SSLv3 write certificate A (1) eap_tls : >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (1) eap_tls : TLS_accept: SSLv3 write key exchange A (1) eap_tls : >>> TLS 1.0 Handshake [length 00b2], CertificateRequest (1) eap_tls : TLS_accept: SSLv3 write certificate request A (1) eap_tls : TLS_accept: SSLv3 flush data (1) eap_tls : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode ------------------------------------------------ Unsuccessfull attempt log ------------------------------------------------ (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0x55a42e6f55a72377 (1) eap : Finished EAP session with state 0x55a42e6f55a72377 (1) eap : Previous EAP request found for state 0x55a42e6f55a72377, released from the list (1) eap : Peer sent method TLS (13) (1) eap : EAP TLS (13) (1) eap : Calling eap_tls to process EAP data (1) eap_tls : Authenticate (1) eap_tls : processing EAP-TLS TLS Length 129 (1) eap_tls : Length Included (1) eap_tls : eaptls_verify returned 11 (1) eap_tls : (other): before/accept initialization (1) eap_tls : TLS_accept: before/accept initialization (1) eap_tls : <<< TLS 1.0 Handshake [length 007c], ClientHello SSL: Client requested cached session b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e reading pairlist file /var/log/radius/tlscache/b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e.vps SSL: Successfully restored session b76a6cf7f480f98fd8814048c4d959e55dd67c0e180edb92d885511c89beb44e (1) eap_tls : TLS_accept: SSLv3 read client hello A (1) eap_tls : >>> TLS 1.0 Handshake [length 0051], ServerHello (1) eap_tls : TLS_accept: SSLv3 write server hello A (1) eap_tls : >>> TLS 1.0 ChangeCipherSpec [length 0001] (1) eap_tls : TLS_accept: SSLv3 write change cipher spec A (1) eap_tls : >>> TLS 1.0 Handshake [length 0010], Finished (1) eap_tls : TLS_accept: SSLv3 write finished A (1) eap_tls : TLS_accept: SSLv3 flush data (1) eap_tls : TLS_accept: Need to read more data: SSLv3 read finished A In SSL Handshake Phase In SSL Accept mode I have noticed that during unsuccessfull attempt is in the log this part (2) eap : EAP TLS (13) (2) eap : Calling eap_tls to process EAP data (2) eap_tls : Authenticate (2) eap_tls : processing EAP-TLS TLS Length 59 (2) eap_tls : Length Included and this in successfull log: (2) eap : EAP TLS (13) (2) eap : Calling eap_tls to process EAP data (2) eap_tls : Authenticate (2) eap_tls : processing EAP-TLS (2) eap_tls : Received TLS ACK (2) eap_tls : Received TLS ACK (2) eap_tls : ACK handshake fragment handler (2) eap_tls : eaptls_verify returned 1 (2) eap_tls : eaptls_process returned 13 (2) eap : New EAP session, adding 'State' attribute to reply 0x3190079e33950a29 (2) [eap] = handled Sorry, but I'm new in Freeradius environment and I surely overlook something easy to solve, but in this moment I would kindly ask you, community for a help. It looks to me like a problem with skip some certificate check or caching, but maybe I'm completely wrong. Thank you for you help Gracian

2 8

Disconnect user session on data counter
by Anirudh Malhotra 04 Dec '15

04 Dec '15

Hi everyone, I am new to this list and using freeradius so please bear with me, if I ask anything silly. I am using freeradius 2.1.12, I have successfully configured data counter and user's are not able to start new sessions/authenticate when data limit is reached. But what I am not able to do is disconnect active sessions when the data limit is reached. So if anybody could help me with it. Thanks a lot in advance. BR, Anirudh Malhotra

2 5

Freeradius stops processing and ready to process requests loops
by Greg Antic 04 Dec '15

04 Dec '15

Hi Everyone, We have been running Freeradius 2.x for many months on Ubuntu 14.04 LTS on a few servers. Our Ubuntu boxes were set to auto update and have been doing auto updates for 1-2 years without incident however this weeks updates appear to have broken Freeradius. Freeradius just stopped processing radius requests. When I ran in debug mode the "Ready to process requests." Just keeps looping down the page when radius packets come into the server and nothing is displayed, the radius log remains empty as well. If I run a tcpdump I see the radius packets coming in. We have 4 servers which exhibit the same symptoms. This morning the server auto updated and broke Freeradius again. Below are the packages that are being installed. Has anyone experienced this or could someone advise how else to debug Freeradius to see why it won't process requests as a result of these updates? Start-Date: 2015-12-04 06:38:00 Install: linux-headers-3.13.0-71:amd64 (3.13.0-71.114, automatic), linux-image-extra-3.13.0-71-generic:amd64 (3.13.0-71.114, automatic), linux-image-3.13.0-71-generic:amd64 (3.13.0-71.114, automatic), linux-headers-3.13.0-71-generic:amd64 (3.13.0-71.114, automatic) Upgrade: linux-headers-generic:amd64 (3.13.0.68.74, 3.13.0.71.77), libgnutls-openssl27:amd64 (2.12.23-12ubuntu2.2, 2.12.23-12ubuntu2.3), linux-image-server:amd64 (3.13.0.68.74, 3.13.0.71.77), linux-server:amd64 (3.13.0.68.74, 3.13.0.71.77), linux-headers-server:amd64 (3.13.0.68.74, 3.13.0.71.77), libgnutls26:amd64 (2.12.23-12ubuntu2.2, 2.12.23-12ubuntu2.3), linux-image-generic:amd64 (3.13.0.68.74, 3.13.0.71.77), linux-generic:amd64 (3.13.0.68.74, 3.13.0.71.77) Listening on authentication address 192.168.10.195 port 1812 Listening on accounting address 192.168.10.195 port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address 192.168.10.195 port 1814 Ready to process requests. Ready to process requests. Ready to process requests. Ready to process requests. Ready to process requests. Ready to process requests. Ready to process requests. Thank you, Greg **************************************************************** The views expressed in this email are, unless otherwise stated, those of the author and not those of Smart Technology Centre or its management. The information in this email is confidential and is intended solely for the addressee. Access to this email by any other party is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted in reliance on this, is prohibited and may be unlawful. Whilst all reasonable steps are taken to ensure the accuracy and integrity of information and data transmitted electronically and to preserve the confidentiality thereof, no liability or responsibility whatsoever is accepted if information or data is, for whatever reason, corrupted or does not reach its intended destination. ***************************************************

3 5

Pre-allocation and association with framedipaddress and username in radius.radippool and effect if entry missing after a successful authentication
by Sophie Loewenthal 03 Dec '15

03 Dec '15

Hi, We preallocate IP addresses with usernames into radius.radippool. Our provisioning script runs every 5 mins, extracting new usernames from our application and then associates a framedipaddress with the new username in the correct pool based on their APN set in our application. The SQL in ippool.conf has been modified, so for example, allocate-clear : has the username = '' removed from the query because we want to keep the username/ipaddress associated. alocat-find: has AND username = '%{User-Name}' Please find a copy of ippool.conf incldued below. This modified SQL should not return an IP address if the username is not associated with a framedipaddress even if the user is in radius.radcheck. How should radius respond if a user authenticates correctly and is in radcheck table, but did not have a username+framedipaddress in radius.radippool? Should I expect to see a message in the logs like: Wed Dec 2 10:37:59 2015 : Info: IP Allocation FAILED from proximus-carli (did proximus.trimbletl.com cli 327711110064161 port 23333 user 344544001217220) Wed Dec 2 10:44:42 2015 : Info: IP Allocation FAILED from vodafone (did vodafone.trimbletl.com cli 31600044278 port 824256 user 344466031488608) Sophie # grep -v ^# ippool.conf allocate-clear = "UPDATE ${ippool_table} /* allocate-clear */ \ SET nasipaddress = '', pool_key = 0, \ callingstationid = '', calledstationid = '', \ expiry_time = NULL, 3GPP_Imsi = '' \ WHERE pool_key = '${pool-key}'" allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{control:Pool-Name}' \ AND username = '%{User-Name}' LIMIT 1" pool-check = "SELECT id FROM ${ippool_table} /* pool-check */ \ WHERE pool_name='%{control:Pool-Name}' LIMIT 1" allocate-update = "UPDATE ${ippool_table} /* allocate-update */ \ SET nasipaddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ callingstationid = '%{Calling-Station-Id}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND, \ 3GPP_Imsi = '%{3GPP-IMSI}', calledstationid = '%{Called-Station-Id}' \ WHERE framedipaddress = '%I' AND username = '%{User-Name}'" start-update = "UPDATE ${ippool_table} /* start-update */ \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}' \ AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" stop-clear = "UPDATE ${ippool_table} /* stop-clear */ \ SET nasipaddress = '', pool_key = 0, callingstationid = '', \ expiry_time = NULL, 3GPP_Imsi = '', calledstationid = '' \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' \ AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" alive-update = "UPDATE ${ippool_table} /* alive-update */ \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' \ AND username = '%{User-Name}' \ AND callingstationid = '%{Calling-Station-Id}' \ AND framedipaddress = '%{Framed-IP-Address}'" on-clear = "UPDATE ${ippool_table} /* on-clear */ \ SET nasipaddress = '', pool_key = 0, callingstationid = '', \ expiry_time = NULL, 3GPP_Imsi = '', calledstationid = '' \ WHERE nasipaddress = '%{Nas-IP-Address}'" off-clear = "UPDATE ${ippool_table} /* off-clear */ \ SET nasipaddress = '', pool_key = 0, callingstationid = '', \ expiry_time = NULL, 3GPP_Imsi = '', calledstationid = '' \ WHERE nasipaddress = '%{Nas-IP-Address}'"

2 1

RE: finding out which section we're in
by Franks Andy (IT Technical Architecture Manager) 03 Dec '15

03 Dec '15

Thanks Alan and Arran. I'll try this or separate this policies out, whichever works i guess! Thanks again Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of Arran Cudbard-Bell [a.cudbardb(a)freeradius.org] Sent: 02 December 2015 18:35 To: FreeRadius users mailing list Subject: Re: finding out which section we're in > On Dec 2, 2015, at 1:04 PM, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Sorry, realise this request is a bit ambiguous - to state things better, I have policy.d unlang "scripts" which are called both in authorize, accounting and so on (same script), and in the script I want to say if (section==authorize) { stuff } elseif (section==accounting) { stuff } %{Request-Processing-Stage} -Arran

3 2

RE: finding out which section we're in
by Franks Andy (IT Technical Architecture Manager) 02 Dec '15

02 Dec '15

Sorry, realise this request is a bit ambiguous - to state things better, I have policy.d unlang "scripts" which are called both in authorize, accounting and so on (same script), and in the script I want to say if (section==authorize) { stuff } elseif (section==accounting) { stuff } Thanks Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Franks Andy (IT Technical Architecture Manager) Sent: 02 December 2015 17:59 To: freeradius-users(a)lists.freeradius.org Subject: finding out which section we're in Hi all, Very quick question hopefully. Is there a way of (in unlang) finding out which section we're in? I have policies called from authorize, accounting etc which do similar things, but it would be nice to do something different based on "section". I've had a look at the runtime variables and dictionaries but can't anything obvious. Thanks Andy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Fwd: authentication Failure
by Ryta Kashemire 02 Dec '15

02 Dec '15

Hello So i have setup freeradius on CentOS Linux release 7.1.1503 (Core) added a client to clients.conf *client (ip-of-client) { secret = (Secret) shortname = (Shortname) nas_type = cisco* and added a user in users *user Auth-Type := System Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15"* i have user and group set to radiusd in raduisd.conf and radiusd is the owner and group for raddb and all files in the raddb However, when i run a radtest...bellow is my out put *[root@xxx]# radtest username password localhost 0 testing123Sending Access-Request Id 224 from 0.0.0.0:40961 <http://0.0.0.0:40961> to 127.0.0.1:1812 <http://127.0.0.1:1812> User-Name = 'username' User-Password = 'password' NAS-IP-Address = (ip of server host) NAS-Port = 0 Message-Authenticator = 0x00Received Access-Reject Id 224 from 127.0.0.1:1812 <http://127.0.0.1:1812> to 127.0.0.1:40961 <http://127.0.0.1:40961> length 20(0) -: Expected Access-Accept got Access-Reject[root@xxx]# * Could someone please point me in the right direction to were the problem could be.. Awaiting your timely response Regards Ritah

3 4

finding out which section we're in
by Franks Andy (IT Technical Architecture Manager) 02 Dec '15

02 Dec '15

Hi all, Very quick question hopefully. Is there a way of (in unlang) finding out which section we're in? I have policies called from authorize, accounting etc which do similar things, but it would be nice to do something different based on "section". I've had a look at the runtime variables and dictionaries but can't anything obvious. Thanks Andy

1 0

Re: authentication Failure
by Ryta Kashemire 02 Dec '15

02 Dec '15

Also when i run radiusd -x then try to authenticate, i get this error in the radiusd -x output *(0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type(0) WARNING: pap : Authentication will fail unless a "known good" password is available* Iam very sure about my password but i think it is something to do with the Auth-type i set Patiently waiting for all your feed back :-) Ritah On Wed, Dec 2, 2015 at 5:30 PM, Ryta Kashemire <rytaluv(a)gmail.com> wrote: > Hello > > So i have setup freeradius on CentOS Linux release 7.1.1503 (Core) > > added a client to clients.conf > > > > > *client (ip-of-client) { secret = (Secret) > shortname = (Shortname) nas_type = cisco* > > and added a user in users > > > > *user Auth-Type := System Service-Type = NAS-Prompt-User, cisco-avpair = > "shell:priv-lvl=15"* > > i have user and group set to radiusd in raduisd.conf and radiusd is the > owner and group for raddb and all files in the raddb > > > However, when i run a radtest...bellow is my out put > > > > > > > > > > > > > > *[root@xxx]# radtest username password localhost 0 testing123Sending > Access-Request Id 224 from 0.0.0.0:40961 <http://0.0.0.0:40961> to > 127.0.0.1:1812 <http://127.0.0.1:1812> User-Name = 'username' > User-Password = 'password' NAS-IP-Address = (ip of server > host) NAS-Port = 0 Message-Authenticator = 0x00Received > Access-Reject Id 224 from 127.0.0.1:1812 <http://127.0.0.1:1812> to > 127.0.0.1:40961 <http://127.0.0.1:40961> length 20(0) -: Expected > Access-Accept got Access-Reject[root@xxx]# * > Could someone please point me in the right direction to were the problem > could be.. > > > Awaiting your timely response > > Regards > Ritah > > > > > >

1 0