- Freeradius-Users - lists.freeradius.org

Proxy CoA
by Cassiano Peixoto 29 Jul '15

29 Jul '15

Hi, I've been running a freeradius proxy with mpd in the same machine. My mpd is configured to use my localhost freeradius proxy/ And i have a central freeradius server where my freeradius proxy is consulting the users. Everything is working fine. So my env is: Server1: Server2 mpd ----------->>> freeradius server freeradius proxy I have a doubt how i could do if something has changed on my freeradius on server2 like a value in a table. I'd like my server1 check server2 some time and if something has changed send a COA packet to mpd to make the change. To let it more clear: I have in my server2 the attribute Mikrotik-Rate-Limit. If this attribute change for any reason my server1 should know. But unfortunately i don't have access to server2 to change any freeradius configuration. My server1 should check server2 and compare the last attribute with the new one. If it has changed send a CoA to mpd. I thought something like this in my post-auth section on my freeradius proxy on server1, but didn't work: update control { Tmp-String-0 = "%{request:Mikrotik-Rate-Limit}" Tmp-String-1 = "%{Mikrotik-Rate-Limit}" } if ("%{Tmp-String-0}" != "%{Tmp-String-1}") { update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Mikrotik-Rate-Limit += "%{request:Mikrotik-Rate-Limit}" } } Anyone could help me please? Thanks

1 0

Handling multiple customers with one radius instance
by Manfred Wolf 29 Jul '15

29 Jul '15

Hello everyone, we want to install one central freeradius that handles requests from multiple customers. Nearly all the handling for those customers is the same. Even the database should be the same. Just the namespace for each customer's users should be different, so that for example customer1 and customer2 can both have a joe user. We're currently using the default sql user database, but this one doesn't seem to support this directly. On the other hand, we want radiusclient1.customer1 and radiusclient2.customer1 to be handled identically. Is there a special module that could help us achieving this or what would be the best way to solve this kind of problem? We have searched around and come across a few possible ways tho we are not sure if they are good or would work at all. Anyway, those are: 1. Somehow check for the client IP using sql queries. Tho this way it might be hard if not impossible to that vpnserver1.customer1 and vpnserver2.customer2 both belong to customer1 2. Something with using realms. If it is possible with virtual servers to force customers in realms and then later check in the database for those realms to determine the customers. 3. A custom unlang or similar script that would filter the clients by our needs Kind regards, Manfred -- CosmoKey GmbH & Co. KG, Amtsgericht Bielefeld HRA 16201, vertreten durch ihre Geschäftsführerin die CosmoKey Beteiligungs GmbH, Amtsgericht Bielefeld HRB 41522, diese vertreten durch ihren Geschäftsführer Herrn Dominic Adenuga Walther-Rathenau-Str. 39 33602 Bielefeld Germany Telefon: 0151-43144121 Telefax: 0521-69983 Email: info(a)cosmokey.de CosmoKey GmbH & Co. KG USt-ID: DE296278210 CosmoKey GmbH USt-ID: DE296278201

2 4

how to set allowed Called-Station-SSID for user in his LDAP configuration?
by Zeus Panchenko 28 Jul '15

28 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, how is it correct to set allowed Called-Station-SSID (the only SSID user allowed to connect to) for user who is configured via LDAP (without SSID issue, users are configured and authenticated/authorized successfully, my question relates *only* to SSID related configuration)? I hoped I can use attribute radiusCheckItem like this radiusCheckItem: Called-Station-SSID == AllowedSsidName but I have no evicence in debug, it is checked :( as well as anything configured via radiusCheckedItem is ignored, perhaps I need to say to FR to do that but I do not understand how to yet? is it in mods-enabled/ldap update section (like control:...)? in FR v.2.x in file users I used this configuration: - ---[ quotation start ]------------------------------------------- DEFAULT Ldap-Group == "wifi-AllowedSsidName", Called-Station-SSID == "AllowedSsidName", Simultaneous-Use := '1', User-Profile := "cn=wifi-AllowedSsidName,ou=rad-profiles,dc=xyz" Reply-Message := "%{User-Name}, SSID: %{Called-Station-SSID} access was permited to you.", Fall-Through = no - ---[ quotation end ]------------------------------------------- but how to get it confiured for v.3.x? for v.3.x have I to use users file too? if not, then how is it correct to get that logic configured in LDAP? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlW3dxoACgkQr3jpPg/3oyqvUACgl/c6blTfwpn+3fRIzhspAKyO YIkAn0sXia4m84vzIDiVKNE6PIxqV/UG =S2nH -----END PGP SIGNATURE-----

2 3

unavailable database makes freeradius 3.0.9 server unresponsive
by Michal Tomaszewski 28 Jul '15

28 Jul '15

Hello, We found a problem in freeradius 3.0.9 when database (mysql as well as redis) is not working for a while. Server: Ubuntu 14.04, fresh install of freeradius 3.0.9 compiled from sources using default settings. When database is going down server hangs on first processed request and stops processing any further requests. There is no connection timeout nor any other timeout to database request. In freeradius 2.x when database was not available server responded with Reject until database was on. In freeradius 3.0.9 server stops responding to any requests, even when database comes up. Below there is an example with redis module. The same problem we have when mysql server goes down. After redis is stopped: Fri Jul 24 17:44:34 2015 : Debug: (1) policy usercache.authorize { Fri Jul 24 17:44:34 2015 : Debug: (1) update request { Fri Jul 24 17:44:34 2015 : Debug: rlm_redis (redis): Reserved connection (3) Fri Jul 24 17:44:34 2015 : Debug: rlm_redis (redis): executing the query: "exists map/usercache/id/" Fri Jul 24 17:44:34 2015 : ERROR: (1) Server closed the connection Fri Jul 24 17:44:34 2015 : Debug: rlm_redis (redis): Reconnecting (3) Fri Jul 24 17:44:34 2015 : Error: rlm_redis (redis): Problems with redisConnect('10.113.13.245', 6379), Connection refused There are no other messages on screen when in radius -XXX mode. There is no timeout for such operation thus server stops processing any requests. When redis goes up few seconds later it does not enable processing requests. When radiusd works as a service in the log we have: Fri Jul 24 17:50:00 2015 : Info: Ready to process requests ****** First radiusclient requests Fri Jul 24 17:50:21 2015 : Info: rlm_redis (redis): 0 of 5 connections in use. Need more spares Fri Jul 24 17:50:21 2015 : Info: rlm_redis (redis): Opening additional connection (5), 1 of 27 pending slots used Fri Jul 24 17:50:21 2015 : Info: rlm_sql (sql): 0 of 5 connections in use. Need more spares Fri Jul 24 17:50:21 2015 : Info: rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used Fri Jul 24 17:50:21 2015 : Auth: (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test8/test] (from client stage-client port 0) Fri Jul 24 17:50:33 2015 : Info: rlm_redis (redis): Closing connection (3): Hit idle_timeout, was idle for 34 seconds Fri Jul 24 17:50:33 2015 : Info: rlm_redis (redis): Closing connection (4): Hit idle_timeout, was idle for 33 seconds ****** REDIS STOP + 2 radiusclient requests Fri Jul 24 17:50:33 2015 : ERROR: (1) ERROR: Server closed the connection Fri Jul 24 17:50:33 2015 : Error: rlm_redis (redis): Problems with redisConnect('10.113.13.245', 6379), Connection refused Fri Jul 24 17:50:38 2015 : Error: (1) Ignoring duplicate packet from client stage-client port 57494 - ID: 197 due to unfinished request in component authorize module Fri Jul 24 17:50:43 2015 : Error: (1) Ignoring duplicate packet from client stage-client port 57494 - ID: 197 due to unfinished request in component authorize module Fri Jul 24 17:50:57 2015 : Error: (2) Ignoring duplicate packet from client stage-client port 42331 - ID: 188 due to unfinished request in component authorize module Fri Jul 24 17:51:02 2015 : Error: (2) Ignoring duplicate packet from client stage-client port 42331 - ID: 188 due to unfinished request in component authorize module Fri Jul 24 17:51:11 2015 : Error: Unresponsive child for request 1, in component authorize module Fri Jul 24 17:51:30 2015 : Error: Unresponsive child for request 2, in component authorize module ****** REDIS START + 1 radiusclient request Fri Jul 24 17:52:24 2015 : Error: (3) Ignoring duplicate packet from client stage-client port 51752 - ID: 89 due to unfinished request in component authorize module Fri Jul 24 17:52:29 2015 : Error: (3) Ignoring duplicate packet from client stage-client port 51752 - ID: 89 due to unfinished request in component authorize module Fri Jul 24 17:52:57 2015 : Error: Unresponsive child for request 3, in component authorize module How to reproduce the issue: 1. Make a request to the freeradius server using radiusclient. 2. Stop the database server. 3. Make another connection to the freeradius server using radiusclient. (the client request will time-out...) 4. Start the database server. 5. All following radiusclient requests will time out. Can anybody suggest what shall be reconfigured in order to keep freeradius responding and properly get Access-reject response when database is unavailable? Mike ________________________________________ Uwaga: Tre?? niniejszej wiadomo?ci mo?e by? poufna i obj?ta zakazem jej ujawniania. Je?li czytelnik tej wiadomo?ci nie jest jej zamierzonym adresatem, pracownikiem lub po?rednikiem upowa?nionym do jej przekazania adresatowi, informujemy ?e wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomo?ci jest zabronione. Je?li otrzyma?e? t? wiadomo?? omy?kowo, prosz? bezzw?ocznie odes?a? j? nadawcy, a sam? wiadomo?? usun?? z komputera. Dzi?kujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

4 8

3.0.9: eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed
by Mohamed Lrhazi 27 Jul '15

27 Jul '15

Hello, Any idea why 3.0.9 would reject an ldap user with the above error, while 3.0.8 would successfully authenticate them? The two servers have the same config files. I looked at the debug output and could not see a difference.. just an error: for the same user, hence same password hash fetched from same LDAP server: 3.0.9 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Expiring EAP session with state 0x776c1e12716407f0 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Finished EAP session with state 0xb5c7569eb4cb5280 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Previous EAP request found for state 0xb5c7569eb4cb5280, released from the list Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Peer sent packet with method EAP MD5 (4) Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Calling submodule eap_md5 to process data Sat Jul 25 12:47:51 2015 : Debug: (1088) eap_md5: Cleartext-Password is required for EAP-MD5 authentication Sat Jul 25 12:47:51 2015 : ERROR: (1088) eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Sending EAP Failure (code 4) ID 12 length 4 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Failed in EAP select Sat Jul 25 12:47:51 2015 : Debug: (1088) modsingle[authenticate]: returned from eap (rlm_eap) for request 1088 Sat Jul 25 12:47:51 2015 : Debug: (1088) [eap] = invalid Sat Jul 25 12:47:51 2015 : Debug: (1088) } # authenticate = invalid Sat Jul 25 12:47:51 2015 : Debug: (1088) Failed to authenticate the user 3.0.8: Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Expiring EAP session with state 0x6843779268417367 Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Finished EAP session with state 0xa5b14de2a4bd57e0 Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Previous EAP request found for state 0xa5b14de2a4bd57e0, released from the list Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Peer sent method MSCHAPv2 (26) Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: EAP MSCHAPv2 (26) Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Calling eap_mschapv2 to process EAP data Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Freeing handler Sat Jul 25 12:52:12 2015 : Debug: (2534) modsingle[authenticate]: returned from eap (rlm_eap) for request 2534 Sat Jul 25 12:52:12 2015 : Debug: (2534) [eap] = ok Sat Jul 25 12:52:12 2015 : Debug: (2534) } # authenticate = ok Thanks, Mohamed.

5 17

"rlm_sql_mysql"
by Randeep 27 Jul '15

27 Jul '15

Hi, We are installing freeradius version 3.0.8 from the source. But we are getting the following error. I can see that the particular so file is not there in the system. Should I install it using yum? But yum list the package for 2.11!! can I install the library when configuring/compiling by giving some options? Mon Jul 27 19:49:43 2015 : Debug: Loading library using absolute path "rlm_sql_mysql" Mon Jul 27 19:49:43 2015 : Debug: Library file not found Mon Jul 27 19:49:43 2015 : Debug: Falling back to linker search path(s) Mon Jul 27 19:49:43 2015 : Debug: Defaults : /lib:/usr/lib Mon Jul 27 19:49:43 2015 : Error: Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Mon Jul 27 19:49:43 2015 : Error: Make sure it (and all its dependent libraries!) are in the search path of your system's ld Mon Jul 27 19:49:43 2015 : Error: /usr/local/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" Regards, Randeep

2 2

Re: How to differentiate between vpn user and appliance user?
by D C 27 Jul '15

27 Jul '15

On Fri, Jul 24, 2015 at 8:02 AM, D C <dc12078(a)gmail.com> wrote: > I recently configured a radius server with openldap backend to handle > central auth for all my network equipment. The ldap module is using > "radiusGroupName" as my groupmembership_attribute. > > I've configured post-auth and the users file in such a way that I can log > into devices with my ldap credentials ONLY if I am a member of one of 2 > groups. My reply-item attributes are stored in ldap within the group, and > all that is working great. Valid users who are not members of these > defined groups get rejected. perfect. > > Now the tricky part. I have a third ldap group that i want to use in > order to assign vpn access to people. so some users may be members of only > the vpn group, and some maybe members of the superadmin group as well as > the vpn group. This causes two problems. > > 1) If I add allow the vpn group, then vpn users will be able to login to > network equipment which is definitely not desired. > > 2) I don't currently have any way to determine within radius if a user is > trying to login to the vpn, or if they are trying to ssh to my firewall. > > > I'm not really sure what I should do to work around this. My only idea > I've come up with (which I don't like), is to have my firewall set a > different NAS-ip for the vpn users. If that is different, then I imagine I > can probably write some login in post-auth to handle it. Is there a better > way to do this. > > > The radius configuration on my firewall will let me set the nas-ip, > auth-type, which source ip to communicate with, and which destination port > the radius server is listening on. I've not yet looked into how the > virtual servers work in radius, so maybe I can setup a different port and > config for my vpn users to auth against.. > > > Using FreeRadius 2.1.12. > Sorry for re posting, I just realized I never set a subject...

3 11

freeradius 2.1.12 - EAP Trouble - files is used with LEAP, not PEAP, and AD/mschap is used with PEAP, not LEAP
by freerad 27 Jul '15

27 Jul '15

# freeradius -v freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 24 2014 at 14:57:57 Copyright (C) 1999-2011 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. /etc/freeradius/files contains: *testuser Cleartext-Password := "password"* # radexample with user "testuser" and password "password" - as it exists in /etc/freeradius/users works: # radexample login: testuser Password: password "testuser" RADIUS Authentication OK (log01.txt) but # ./rad_eap_test -H 10.160.4.50 -P 1812 -S testing123 -u testuser -p password -m IEEE8021X -e PEAP -2 MSCHAPV2 -v access-reject; 1 fails (log02.txt), but I wanted to have it handled by "files". but with LEAP it works: # ./rad_eap_test -H 10.160.4.50 -P 1812 -S testing123 -u testuser -p password -m IEEE8021X -e LEAP -2 MSCHAPV2 -v access-accept; 0 RADIUS message: code=2 (Access-Accept) identifier=3 length=149 Attribute 26 (Vendor-Specific) length=59 Value: 00 00 00 09 01 35 6c 65 61 70 3a 73 65 73 73 69 6f 6e 2d 6b 65 79 3d 82 68 87 56 16 2a 3d 5a 79 ae c4 db ee d3 2c db 38 83 9a 9f 81 a7 70 03 55 00 c4 b1 cb 45 78 ea ce 63 Attribute 79 (EAP-Message) length=42 Value: 02 04 00 28 11 01 00 18 24 16 99 a0 97 e6 72 86 eb 2d 2e 97 5a ef 9c c7 e2 00 cf b4 95 8a fa 42 74 65 73 74 75 73 65 72 Attribute 80 (Message-Authenticator) length=18 Value: e2 d3 98 f4 75 a9 44 6b 04 e2 d8 ef 6b 54 4f b1 Attribute 1 (User-Name) length=10 Value: 'testuser' (log03.txt). And - with AD User, LEAP does not work # ./rad_eap_test -H 10.160.4.50 -P 1812 -S testing123 -u wlan_test -p test -m IEEE8021X -e LEAP -2 MSCHAPV2 -v access-reject; 1 (log04.txt) while with AD User PEAP is working: # ./rad_eap_test -H 10.160.4.50 -P 1812 -S testing123 -u wlan_test -p test -m IEEE8021X -e PEAP -2 MSCHAPV2 -v access-accept; 0 RADIUS message: code=2 (Access-Accept) identifier=9 length=171 Attribute 26 (Vendor-Specific) length=58 Value: 00 00 01 37 11 34 81 3f 5f f6 c1 df a3 6f 6e bc 39 89 09 c8 5f da bd a7 e4 86 45 0e a9 b7 b1 e9 0d 88 1a 4c 15 d7 9a 8a db 25 87 bd 4f b2 33 11 e6 b2 0b 68 b1 c6 7f 91 Attribute 26 (Vendor-Specific) length=58 Value: 00 00 01 37 10 34 89 ca ed f6 a0 75 fc 03 b8 91 24 91 ab a0 ba ae 25 72 b0 66 6d b0 69 b0 72 43 83 61 c2 30 fc 4c 62 9f 44 5c 23 00 c3 1b 40 d3 cf 12 3c 55 4d dd 4a 93 Attribute 79 (EAP-Message) length=6 Value: 03 09 00 04 Attribute 80 (Message-Authenticator) length=18 Value: e9 5f 92 1a 6f 01 26 29 b2 b3 9c 87 61 e8 e3 ca Attribute 1 (User-Name) length=11 Value: 'wlan_test' What is wrong here? I want to handle first files, then mschap/ntlm_auth Authentication. Any help is appreciated. Thomas

3 5

eapol_test with TLS fails (nothing sent to freeradius)
by freerad 27 Jul '15

27 Jul '15

This command fails with timout: config file: rad_eap_test.txt network={ ssid="eduroam" key_mgmt=IEEE8021X eap=TLS ca_cert="ca.pem" identity="wlan_test" password="test" client_cert="client.pem" private_key="client.key" } Openssl verify is ok: # openssl verify -CAfile ca.pem client.pem client.pem: OK # bin/eapol_test -crad_eap_test.txt -a10.160.4.50 -p1812 -stesting123 -test -M70:6f:6c:69:73:68 Reading configuration file 'rad_eap_test.txt' Line: 1 - start of a new network block ssid - hexdump_ascii(len=7): 65 64 75 72 6f 61 6d eduroam key_mgmt: 0x8 eap methods - hexdump(len=16): 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 ca_cert - hexdump_ascii(len=6): 63 61 2e 70 65 6d ca.pem identity - hexdump_ascii(len=9): 77 6c 61 6e 5f 74 65 73 74 wlan_test client_cert - hexdump_ascii(len=10): 63 6c 69 65 6e 74 2e 70 65 6d client.pem private_key - hexdump_ascii(len=10): 63 6c 69 65 6e 74 2e 6b 65 79 client.key Priority group 0 id=0 ssid='eduroam' Authentication server 10.160.4.50:1812 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: KEY_RX entering state NO_KEY_RECEIVE EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL test timed out MPPE keys OK: 0 mismatch: 1 FAILURE Any help is appreciated. Thomas

3 6

Buy third party ssl-cert
by Benjamin Rechsteiner 26 Jul '15

26 Jul '15

Hi list, Can someone advise me, where can i buy a third party ssl-cert which is trusted by all windows clients? Cannot provide a self-sign ca-cert to the client ( bring you own device). Server: Debian 8 with Freeradius 2.2.5 and Windows Server 2008 R2 Best regards Beni -- Benjamin Rechsteiner Administrator benjamin.rechsteiner(a)automatic-server.com 0041 78 676 35 32

2 1