- Freeradius-Users - lists.freeradius.org

FreeRADIUS & security
by Paul Gunman 20 Jul '15

20 Jul '15

Hello, I would like to know whether FreeRADIUS user SNMPv3 and allow IP filtering for access through SSH. Moreover, is there anything related to PCI compliance? Thanks, P.

3 2

real world radsec example
by Alex Sharaz 20 Jul '15

20 Jul '15

Hi, Has anyone got a real world RADSEC example between two FR 3.0.[89] servers they would be prepared to share ? Having a bit of trouble getting this to work. I've successfully got FR 2.2.7 -> radsecproxy 1.6.x -> FR 3.0.9 working ( tested using radtest -> FR 2.2.7 ) but am having a bit of a problem either going from FR 3.x-> radsec proxy or FR 3.x <--> 3.X On the server I'm running radtest on I get Mon Jul 20 14:03:14 2015 : Debug: (0) proxy: Trying to open a new listener to the home server Mon Jul 20 14:03:14 2015 : Debug: Opening new proxy socket 'proxy (0.0.0.0, 0) -> home_server (199.30.91.51, 2083)' Mon Jul 20 14:03:14 2015 : Debug: Trying SSL to port 2083 Mon Jul 20 14:03:14 2015 : Debug: Requiring Server certificate Mon Jul 20 14:03:14 2015 : Debug: (0) (other): before/connect initialization Mon Jul 20 14:03:14 2015 : Debug: (0) TLS_connect: before/connect initialization Mon Jul 20 14:03:14 2015 : Debug: (0) >>> TLS 1.2 [length 011e] Mon Jul 20 14:03:14 2015 : Debug: (0) TLS_connect: unknown state Mon Jul 20 14:03:15 2015 : Debug: (0) <<< TLS 1.0 Handshake [length 0031], ServerHello Mon Jul 20 14:03:15 2015 : Debug: (0) TLS_connect: SSLv3 read server hello A Mon Jul 20 14:03:15 2015 : Debug: (0) <<< TLS 1.0 Handshake [length 11ed], Certificate Mon Jul 20 14:03:15 2015 : Debug: (0) TLS Verify creating certificate attributes Mon Jul 20 14:03:15 2015 : ERROR: (0) SSL says error 19 : self signed certificate in certificate chain Mon Jul 20 14:03:15 2015 : Debug: (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca Mon Jul 20 14:03:15 2015 : ERROR: (0) TLS Alert write:fatal:unknown CA Mon Jul 20 14:03:15 2015 : Error: tls: TLS_connect: Error in SSLv3 read server certificate B Mon Jul 20 14:03:15 2015 : Error: tls: TLS_connect: Error in SSLv3 read server certificate B Mon Jul 20 14:03:15 2015 : Error: tls: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Mon Jul 20 14:03:15 2015 : Error: Failed starting SSL to 'proxy (0.0.0.0, 0) -> home_server (199.30.91.51, 2083)' and I really can't see why I'm getting the unknown CA error. Certainly shouldn't be a self signed cert anywhere. A

2 3

Should this be here?
by Alex Sharaz 20 Jul '15

20 Jul '15

Hi, I've just built and installed 3.0.9 In debug mode, when it fires up I get ..... Mon Jul 20 13:35:39 2015 : Debug: } Mon Jul 20 13:35:39 2015 : Debug: } Mon Jul 20 13:35:39 2015 : Debug: Loading library using absolute path "/usr/local/lib/proto_acct.so " Mon Jul 20 13:35:39 2015 : Debug: Failed with error: /usr/local/lib/proto_acct.so: cannot open shar ed object file: No such file or directory Mon Jul 20 13:35:39 2015 : Debug: Library file not found Mon Jul 20 13:35:39 2015 : Debug: Loading library using linker search path(s) Mon Jul 20 13:35:39 2015 : Debug: Defaults : /lib:/usr/lib Mon Jul 20 13:35:39 2015 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Jul 20 13:35:39 2015 : Debug: listen { ........ and .... Mon Jul 20 13:35:39 2015 : Debug: Loading library using linker search path(s) Mon Jul 20 13:35:39 2015 : Debug: Defaults : /lib:/usr/lib Mon Jul 20 13:35:39 2015 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Jul 20 13:35:39 2015 : Debug: listen { Mon Jul 20 13:35:39 2015 : Debug: type = "auth" Mon Jul 20 13:35:39 2015 : Debug: ipv6addr = :: Mon Jul 20 13:35:39 2015 : Debug: port = 0 Mon Jul 20 13:35:39 2015 : Debug: limit { Mon Jul 20 13:35:39 2015 : Debug: max_connections = 16 Mon Jul 20 13:35:39 2015 : Debug: lifetime = 0 Mon Jul 20 13:35:39 2015 : Debug: idle_timeout = 30 Mon Jul 20 13:35:39 2015 : Debug: } Mon Jul 20 13:35:39 2015 : Debug: } ..... proto_auth.so and proto_acct.so certainly don't exist. Should they? A

4 11

Simultaneous-Use x Inactive sessions
by Renato Sousa 20 Jul '15

20 Jul '15

Hello everyone, I am implementing a FR 3.0.8 using control simultaneous sessions (Simultaneous-Use: = 2). Some sessions are accumulating without the Acct-Status-Type Stop and are being counted as active session. How to periodically remove the BD these inactive sessions? Best Regards, Renato

2 3

3.0.9: Failed to parse log section
by Lai Fu Keung 20 Jul '15

20 Jul '15

Hi, In v3.0.9, I uncomment the "request" log in radius.log requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log When running radiusd, it give me error, "radiusd: Error: Failed to parse log {} section". Commenting back the line gives no error. What is the problem? It was OK with v3.0.8. Fu

1 0

Centos 7 with Freeradius 3.0.4 : smsotp supported ?
by usersurweb 19 Jul '15

19 Jul '15

Hi I am new to this forum. I have been using FreeRadius 2.1 (CentOs 6) with smsotp for a long time. Now I am trying to upgrade to FreeRadius 3.0.4 (CentOs7) but I can't build Smsotp module. After ./configure command, there is no make file created to build the module. Any help to build the module would be appreciated. Thanks. Regards. Pras.

5 11

(no subject)
by ankita therese 17 Jul '15

17 Jul '15

Hi, I'm having trouble getting FreeRADIUS to recognize the group of a user using sql. I'm running version 3.0.8, and as far as I can tell, everything runs smoothly up to the authorize_group_check_query. It executes, but after this, on debugging with radiusd -XX, authentication breaks off with Debug: (0) sql: ... falling-through to profile processing Debug: rlm_sql (sql): Released connection (4) The output of radiusd -X is as follows. Group attribute values are not verified or added to reply. I tried increasing minimum no of sql connections, but that just makes radius tell me i have too many idle connections and need to reduce min. (0) Received Access-Request Id 153 from 127.0.0.1:49747 to 127.0.1.1:1812 length 85 (0) User-Name = 'mynewuser' (0) User-Password = 'password' (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0x32010b83ba8a72dd523a231e353d1a1b (0) Framed-Protocol = PPP (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "mynewuser", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry DEFAULT at line 182 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> mynewuser (0) sql: SQL-User-Name set to 'mynewuser' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mynewuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mynewuser' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := 'password' (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mynewuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mynewuser' ORDER BY id (0) sql: User found in radreply table, merging reply items (0) sql: Reply-Message = 'OK' (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'mynewuser' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'mynewuser' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'student' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'student' ORDER BY id rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND %{User-Name} (0) sql: --> mynewuser (0) sql: SQL-User-Name set to 'mynewuser' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mynewuser', 'password', 'Access-Accept', '2015-07-12 20:57:34') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mynewuser', 'password', 'Access-Accept', '2015-07-12 20:57:34') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 153 from 127.0.1.1:1812 to 127.0.0.1:49747 length 0 (0) Framed-Protocol = PPP (0) Framed-Compression = Van-Jacobson-TCP-IP (0) Reply-Message = 'OK' (0) Finished request Thank you

3 3

Freeradius 3.0.4 - CentOS7 - no SQL log will be create
by Andre Schwarzer 16 Jul '15

16 Jul '15

Hello, When i activate the SQL log, still no log file is created. Am I doing something wrong or is it a bug? The following parameters are active logfile = /var/log/radius/sqllog.SQL driver = "rlm_sql_mysql" and is test logfile = /var/log/radius/sqllog.SQL driver = "rlm_sql_null" but with the second Settings i get a reject from the SQL Server. With the first all works fine, but no log was created. Regardes Andre

2 1

Freeradius 3.0 - SQL - spare connections?
by Andre Schwarzer 16 Jul '15

16 Jul '15

Hello, have installed a new freeradius 3.0, bevor i worked with the Version 1. I see in my Test´s, in the radius.log the Messages below. I don´t know what are spare Connections, what they do and for what the radius use this. Additional i don´t know why i get this messeges with the Default Settings. Can some one explain me the usage of the spare Connections, best by an example. Wed Jul 15 13:34:25 2015 : Info: rlm_sql (sql): 0 of 5 connections in use. Need more spares Wed Jul 15 13:34:25 2015 : Info: rlm_sql (sql): Opening additional connection (12) Regardes

4 6

Dynamic proxies??
by Peter Lambrechtsen 16 Jul '15

16 Jul '15

I suspect the answer will be "patches welcome" but... Has anyone ever thought of having a similar module as dynamic clients where you can pull proxies for external realms from an external source using unlang such as sql or ldap?? I have an interesting use case where I am looking to replace an existing radius proxy server with FreeRadius that has a lot of downstream proxies. So far the the best option I have is to copy the proxies.conf across all the instances and HUP the config whenever a new realm is added or removed and wondered if there was a smarter way to do it. Cheers Peter

3 5