- Freeradius-Users - lists.freeradius.org

attr_filter: remove everything, except the avps1,avp2,..
by Jorge Pereira 24 Sep '15

24 Sep '15

Hi, Always when I need to remove some avp from a list, I do something like. update <list> { <avp1> !* ANY <avp2> !* ANY ....... } But, I would like to know if exist some way to do in an inverted match. something like "remove everything, except the avps1,avp2,..." -- Jorge Pereira

3 2

AW: google authenticator and commercial otp
by the2nd 24 Sep '15

24 Sep '15

In a few months you may use OTPme (http://www.otpme.org) The current version does not support OATH tokens but the next version will. I successfully tested HOTP and TOTP tokens like the yubikey or google authenticator. Freeradius integration is done via rlm_python. If you want to keep otpd and want to write your own freeradius module you may have a look at the otpme module. It should be a good starting point. Regards the2nd <div>-------- Ursprüngliche Nachricht --------</div><div>Von: Michael A Hawkins <mhawkins.consultant(a)gmail.com> </div><div>Datum:09.23.2015 18:39 (GMT+01:00) </div><div>An: freeradius-users(a)lists.freeradius.org </div><div>Betreff: google authenticator and commercial otp </div><div> </div>Alan said, "There are a number of commercial ones which work. The google authenticator also works." Commercial means I usually (almost always) can't use my own tokens sourced from my own token supplier. I liked it that otpd allowed me to source tokens from wherever I wanted. All I needed was a supplier with a cost effective token and a supplier willing to supply me with the seeds too. Commercial suppliers usually lock you into their tokens, their servers, their solution or all of the above. google authenticator doesn't fit in my wallet. I've always believed that the least likely item to be lost or misplaced by a user is their own wallet. Cell phones, not so much. A users wallet contains stuff that is far more important than a cell phone. Cell phones get lost, stolen far more often than wallets. If rlm_otp is to be removed. Against which module would I rewrite otpd so that it could continue to work with freeradius? From googling, it looks like alot of other otpd solutions out there use a perl module to interact with freeradius. Is that the only way? Is there a better way? Thanks again, Mike - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

google authenticator and commercial otp
by Michael A Hawkins 23 Sep '15

23 Sep '15

Alan said, "There are a number of commercial ones which work. The google authenticator also works." Commercial means I usually (almost always) can't use my own tokens sourced from my own token supplier. I liked it that otpd allowed me to source tokens from wherever I wanted. All I needed was a supplier with a cost effective token and a supplier willing to supply me with the seeds too. Commercial suppliers usually lock you into their tokens, their servers, their solution or all of the above. google authenticator doesn't fit in my wallet. I've always believed that the least likely item to be lost or misplaced by a user is their own wallet. Cell phones, not so much. A users wallet contains stuff that is far more important than a cell phone. Cell phones get lost, stolen far more often than wallets. If rlm_otp is to be removed. Against which module would I rewrite otpd so that it could continue to work with freeradius? From googling, it looks like alot of other otpd solutions out there use a perl module to interact with freeradius. Is that the only way? Is there a better way? Thanks again, Mike

2 1

otpd - resurrecting
by Michael A Hawkins 23 Sep '15

23 Sep '15

A: Adam Bishop - version - radiusd: FreeRADIUS Version 2.2.0 - while I think that later versions are always a good thing. I don't think the FreeRadius version is the culprit. Thanks for the pointer on debugging with GDB. A: Stefan Paetow - SElinux is off, thanks for su --shell=/bin/bash -l radiusd otptest (!!). A: Alan DeKok - I get it. Don't bother, go find another otp, I am not a serious programmer. Well, I already use multiple other otp's and write code in multiple languages for multiple platforms. So if someone can recommend an otpd package that is GPLv2, supports any OATH compliant token and will work with FreeRadius after rlm_otp is removed, I am interested. Meanwhile, I've written enough C to fix otpd several times in the past and probably won't give up just yet. Or to put it the question another way, what otp package are you recommending for use with FreeRadius? Thanks to all for the rapid and detailed responses. I have some work to do. PS: I used the phrase "mess with" as a colloqialism for "seriously applied proper programming and maintenance techniques to adjust the package to compile, link, make and install without error or warning under Fedora". Now back to fixing my first LINUX segfault. Cheers! /Mike

2 1

Set proxy port in Freeradius 3.0.4
by Brad 23 Sep '15

23 Sep '15

Hi All, I have seen previous discussions about proxy port 1814 for previous versions 1x and 2x. With the latest 3 version the proxy seems to use ephemeral ports instead of 1814. In etc/raddb/sites-available/default I added a listen for proxy: listen { ippaddr = * port = 1814 type = proxy limit { } } But got an error about adding the proxy listen in a virtual server area. Can someone please direct on the appropriate file location to place the listen or set the proxy port? Thanks, Brad

2 3

otpd - resurrecting it
by Michael A Hawkins 23 Sep '15

23 Sep '15

I am trying to resurrect otpd, a GPL fork is here "https://code.google.com/p/otpd/. I like this thing because it allows me to run my own OTP service with OATH compliant event based tokens of almost any kind. I never got any time based tokens working and I don't really care. Years ago, I got otpd working by running it as radiusd so that FreeRadius could interact with it. This required setting all rights on all otpd related files and /var/run/otpd/socket to be owned and perm'd for radiusd. I don't know enough about LINUX to know why radiusd had to run otpd but I do remember that no matter what I did, if radiusd did not have rights to /var/run/otpd/socket then FreeRadius was always denied permission when attempting to interact with otpd. Compiling the otpd code was also a challenge because I mostly run Fedora and C files, ./configure and make files all had to be messed with. But I managed. The problem I face now though is that if I do everything I originally did as above I get all the way to authenticating and freeradius always fails the authentication and otpd seg faults. otptest executable works just fine (while running as user otpd, I haven't worked out how to use radiusd while running otptest. I always get... [root@HP-LAB-1 otpd]# su -l radiusd otptest This account is currently not available. I can use tokens and confirm that otpd is working with otptest if and only if I use root while otpd itself is running as root. The major changes that I used to make to FreeRadius configuration was: 4. Now edit the /etc/raddb/sites-available/default file and add a single line with text “otp” inside of both the authorize and authenticate sections. 5. Now add the same “otp” entries into the same sections found in the file /etc/raddb/sites_enabled/inner-tunnel. 6. Restart radiusd with “service radiusd restart”. I added otp to default and inner-tunnel like below (right underneath the heading: authorize { otp ... } authenticate { otp ... } Executing radtest... [mhawkins@HP-LAB-1 bNAC]$ radtest test1 885115 localhost 10 testing123 Sending Access-Request of id 84 to 127.0.0.1 port 1812 User-Name = "test1" User-Password = "885115" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=84, length=20 Debug from freeradius looks like... rad_recv: Access-Request packet from host 127.0.0.1 port 37633, id=84, length=75 User-Name = "test1" User-Password = "885115" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 Message-Authenticator = 0x54ce669945c80bffd886fce32b90a76a # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} rlm_otp: otp_pwe_present: password attributes 2, 2 ++[otp] returns ok ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = otp # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} rlm_otp: otp_pwe_present: password attributes 2, 2 ++[otp] returns fail Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 84 to 127.0.0.1 port 37633 Waking up in 4.9 seconds. Cleaning up request 6 ID 84 with timestamp +858 Ready to process requests. All of the above results in otpd still running. But if I run radtest once more... otpd segfaults and leaves the /var/run/otpd/socket inaccessible by radiusd. I can see that otpd passes the authentication but freeradius doesn't see it. Sep 22 22:16:59 HP-LAB-1 otpd[9352]: accept_thread: plugin accept fd=8 Sep 22 22:16:59 HP-LAB-1 otpd[9352]: work_thread(140561874147072,8): handling plugin request for [test1] Sep 22 22:16:59 HP-LAB-1 otpd[9352]: verify: user [test1] authentication succeeded So I don't know why FreeRadius is failing the authentication and I don't know why otpd is segfaulting (this is the first time I've ever had to work on an executable that does that). Any help or hints on how to solve or troubleshoot this would be *VERY* much appreciated. /Mike Hawkins

4 3

dynamic home server
by Jorge Pereira 23 Sep '15

23 Sep '15

Hi, Someone know if is possible to setup a home-serverpool dynamically?

2 2

rlm_python failing
by Andrew Parisio 22 Sep '15

22 Sep '15

We use rlm_python and AWS DynamoDB as a backend, and over the weekend there were some problems with DynamoDB: http://venturebeat.com/2015/09/20/amazons-aws-outage-takes-down-netflix-red…. During this time we saw lots of dynamo errors, but we also started to see a lot of freeradius problems: Sun Sep 20 09:22:18 2015 : WARNING: (27733) WARNING: Module rlm_python became unblocked for request 27733 Sun Sep 20 09:22:37 2015 : Error: Unresponsive child for request 27751, in component accounting module python During this timeframe I see a few things in my statistics: * Our python code taking as long as 4,500 seconds to respond to requests (freeradius is configured to 30 seconds max per request) [image: Inline image 1] * Accounting requests went from 100/5minutes to 17,000/5minutes (as devices were resending accounting packets because they didn't get a response) [image: Inline image 4] These errors kept accumulating and eventually our server wasn't sending any incoming requests to python (and it didn't recover when dynamo recovered), which I know because the python code should have created external logs that don't exist during this time period. This morning I turned on debugging on a node and this is what I see: Mon Sep 21 18:14:46 2015 : Debug: (870048) accounting { Mon Sep 21 18:14:46 2015 : Debug: (870048) modsingle[accounting]: calling python (rlm_python) for request 870048 Mon Sep 21 18:14:46 2015 : Debug: (870048) python: Using thread state 0x7f1058000cc0 Mon Sep 21 18:14:46 2015 : Debug: (870048) modsingle[accounting]: returned from python (rlm_python) for request 870048 Mon Sep 21 18:14:46 2015 : Debug: (870048) [python] = fail Mon Sep 21 18:14:46 2015 : Debug: (870048) } # accounting = fail Mon Sep 21 18:14:46 2015 : Debug: (870048) Not sending reply to client. The first line in our python accounting module is to radlog() so I know if the request hit our code, and that wasn't even happening so it seems as though FreeRADIUS+rlm_python had failed in some way. Restarting freeradius resolved the problem. I'm fairly certain the long request time problem is because the default timeout for the dynamo SDK is none (wait forever). I'm working on setting a boto timeout to prevent the long response time from happening again, but at the moment I'm concerned about how freeradius was failing to even call python after a while. Aside from the boto timeout issue how would we go about debugging the freeradius+python problem to make sure it doesn't happen in the future? Thanks! Andrew

4 6

RadPerf failover test
by Daniel M. 22 Sep '15

22 Sep '15

Hi all, is there a way to use two ip adresses in radperf so that you can check fail-over/load-balance of two freeradius servers? Or is there another way to test it? Regards, Daniel

2 2

Unexpected response - Freeradius 3.0.10
by Michal Tomaszewski 22 Sep '15

22 Sep '15

Hello, Freeradius – last build from repo – reject response adds unexpected values when SQL is not available. Default configuration straight from repo, SQL enabled, empty mysql database. When I call: echo "User-Name=service-check,User-Password=somepassword,Framed-Protocol=PPP " | radclient -x -r 1 -t 2 server_address:1812 auth testing123 I get: Sending Access-Request of id 118 to server_address port 1812 User-Name = "service-check" User-Password = " somepassword " Framed-Protocol = PPP rad_recv: Access-Reject packet from host server_address port 1812, id=118, length=20 When SQL server is down calling the same: echo "User-Name=service-check,User-Password=somepassword,Framed-Protocol=PPP " | radclient -x -r 1 -t 2 server_address:1812 auth testing123 Gives: Sending Access-Request of id 239 to server_address 8 port 1812 User-Name = "service-check" User-Password = " somepassword" Framed-Protocol = PPP rad_recv: Access-Reject packet from host server_address port 1812, id=239, length=32 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP It seems that response adds Framed-Protocol and Framed-Compression responses when SQL is not available. In debug there is: Mon Sep 21 19:57:11 2015 : Debug: (2) Post-Auth-Type REJECT { Mon Sep 21 19:57:11 2015 : Debug: (2) modsingle[post-auth]: calling sql (rlm_sql) for request 2 Mon Sep 21 19:57:11 2015 : Debug: .query Mon Sep 21 19:57:11 2015 : Debug: Parsed xlat tree: Mon Sep 21 19:57:11 2015 : Debug: literal --> .query Mon Sep 21 19:57:11 2015 : Debug: (2) sql: EXPAND .query Mon Sep 21 19:57:11 2015 : Debug: (2) sql: --> .query Mon Sep 21 19:57:11 2015 : Debug: (2) sql: Using query template 'query' Mon Sep 21 19:57:11 2015 : Debug: rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" Mon Sep 21 19:57:11 2015 : Info: rlm_sql (sql): Opening additional connection (3), 1 of 32 pending slots used Mon Sep 21 19:57:11 2015 : Debug: rlm_sql_mysql: Starting connect to MySQL server Mon Sep 21 19:57:11 2015 : Error: rlm_sql_mysql: Couldn't connect to MySQL server radius@127.0.0.1:Radius-DB Mon Sep 21 19:57:11 2015 : Error: rlm_sql_mysql: MySQL error: Can't connect to MySQL server on '127.0.0.1' (111) Mon Sep 21 19:57:11 2015 : Debug: rlm_sql_mysql: Socket destructor called, closing socket Mon Sep 21 19:57:11 2015 : Error: rlm_sql (sql): Opening connection failed (3) Mon Sep 21 19:57:11 2015 : Debug: (2) modsingle[post-auth]: returned from sql (rlm_sql) for request 2 Mon Sep 21 19:57:11 2015 : Debug: (2) [sql] = fail Mon Sep 21 19:57:11 2015 : Debug: (2) } # Post-Auth-Type REJECT = fail Mon Sep 21 19:57:11 2015 : Debug: (2) Delaying response for 1.000000 seconds Mon Sep 21 19:57:11 2015 : Debug: Waking up in 0.3 seconds. Mon Sep 21 19:57:11 2015 : Debug: Waking up in 0.6 seconds. Mon Sep 21 19:57:12 2015 : Debug: (2) <REQUEST_RESPONSE_DELAY>: Sending delayed response Mon Sep 21 19:57:12 2015 : Debug: (2) <REQUEST_RESPONSE_DELAY>: Sent Access-Reject Id 100 from 10.10.10.10:1812 to EXT_ADDRESS:59005 length 32 Mon Sep 21 19:57:12 2015 : Debug: (2) <REQUEST_RESPONSE_DELAY>: Framed-Protocol = PPP Mon Sep 21 19:57:12 2015 : Debug: (2) <REQUEST_RESPONSE_DELAY>: Framed-Compression = Van-Jacobson-TCP-IP Mon Sep 21 19:57:12 2015 : Debug: Waking up in 3.9 seconds. Mon Sep 21 19:57:16 2015 : Debug: (2) <REQUEST_RESPONSE_DELAY>: Cleaning up request packet ID 100 with timestamp +19 Mon Sep 21 19:57:16 2015 : Info: Ready to process requests Is this response correct? Regards, Mike ________________________________________ Uwaga: Treść niniejszej wiadomości może być poufna i objęta zakazem jej ujawniania. Jeśli czytelnik tej wiadomości nie jest jej zamierzonym adresatem, pracownikiem lub pośrednikiem upoważnionym do jej przekazania adresatowi, informujemy że wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomości jest zabronione. Jeśli otrzymałeś tę wiadomość omyłkowo, proszę bezzwłocznie odesłać ją nadawcy, a samą wiadomość usunąć z komputera. Dziękujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

2 4