- Freeradius-Users - lists.freeradius.org

Custom Reply Message
by Andrés Gómez 24 Jul '15

24 Jul '15

Hi everybody. Sorry, I know it is a basic question, I know the reply message are configurable in the module files, and other files. But I can't find this one that I receive when I use the Simultaneous-use attribute: # radtest 999 999 localhost 10 password Sending Access-Request of id 48 to 127.0.0.1 port 1812 User-Name = "999" User-Password = "999" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=48, length=68 Reply-Message = "\r\nYou are already logged in - access denied\r\n\n" I want to change that Reply-Message = "\r\nYou are already logged in - access denied\r\n\n" . But I have found everywhere and I can't find its config file. How can I do it? Regards -- *C. Andrés Gómez R.*

5 6

Building 3.0.9 package
by Alex Sharaz 23 Jul '15

23 Jul '15

Hi, Just tried building a package of 3.0.9 on Ununtu 14.04 ... sort of worked. Looked at the freeradius wiki and did tar zxf freeradius-server-3.0.9.tar.gz cd freeradius-server-3.0.9 dpkg-buildpackage -b -uc # # Did a whole batch of apt-get install <package names here till dpkg-buildpackage worked # dpkg -i ../*freeradius*_3.0.9*.deb At this point, amongst other things I get :- Unpacking freeradius-dhcp (3.0.9+git) ... dpkg: error processing archive ../freeradius-dhcp_3.0.9+git_amd64.deb (--install): trying to overwrite '/usr/lib/freeradius/proto_dhcp.so', which is also in package freeradius 3.0.9+git ..... Setting up libfreeradius-dev (3.0.9+git) ... Setting up freeradius (3.0.9+git) ... * Checking FreeRADIUS daemon configuration... [fail] invoke-rc.d: initscript freeradius, action "restart" failed. Setting up freeradius-utils (3.0.9+git) ... Processing triggers for ureadahead (0.100.0-16) ... Lots more fail messages. all relating to the one above I guess. Looking radius.log I get Thu Jul 23 14:04:34 2015 : Info: Debugger not attached Thu Jul 23 14:04:34 2015 : Error: /etc/freeradius/mods-enabled/dhcp[18]: Failed to link to module 'rlm_dhcp': /usr/lib/freeradius/rlm_dhcp.so: cannot open shared object file: No such file or directory .. which is right, there isn't an rlm_dhcp.so present in /usr/lib/freeradius If I go into /etc/freeradius/mods-enabled and remove the dhcp symbolic link then I can start freeradius. Can't seem to find why the rlm_dhcp module wasn't build though ...not that I need it, but that's not the point. Anyone built 3.0.9 package on Ubuntu 14.04? Rgds A

2 2

Freeradius 2.1.12 CoA configuration
by mohammed farouk 23 Jul '15

23 Jul '15

Dear All, Please advise me for the correct configuration for the CoA disconnect, i am having missing something when i execute the command : echo "User-Name='sunny',Acct-Session-Id=55af81be0000000b" | radclient -c '1' -n '3' -r '3' -t '3' -x '127.0.0.1:3799' 'disconnect' 'testing123' 2>&1 in the sites-available/originating-coa update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" } is this correct? the debugging: rad_recv: Disconnect-Request packet from host 127.0.0.1 port 49510, id=113, length=45 User-Name = "sunny" Acct-Session-Id = "55af81be0000000b" server coa { # Executing section recv-coa from file /etc/freeradius/sites-available/coa +- entering group recv-coa {...} ++[ok] returns ok # Executing section send-coa from file /etc/freeradius/sites-available/coa +- entering group send-coa {...} ++[ok] returns ok } # server coa Sending Disconnect-ACK of id 113 to 127.0.0.1 port 49510 Finished request 0. but the user still connect and it didn't disconnect it, what exactly i need to do ? I appreciate your help *Best regards,* *Mohammed Farouk*

3 2

LDAP authentification with passwords containing special characters
by Norbert Kunth 23 Jul '15

23 Jul '15

Hi everybody, we use freeradius 2.1.1 and try to authenticate users via LDAP. But there seems to be an issue if we use special characters (such as #). #XxuwBw. is the correct user password If the users connects I can see the following messages: [...] [ldap] Added User-Password = #XxuwBw. in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... rlm_ldap: userPassword -> Password # "XxuwBw." [ldap] looking for reply items in directory... rlm_ldap: Failed to create the pair: Failed to find IP address for XxuwBw. At this point something has removed the # and changed the password to XxuwBw. Subsequently the authentication fails: [...] [chap] Using clear text password "XxuwBw." for user ABCDE authentication. [chap] Password check failed Are there any restrictions regarding the characters allowed? Best regards Norbert

2 2

Knowing the proxy's actual response in rlm_perl's post_proxy function
by Harm van Tilborg 22 Jul '15

22 Jul '15

Hey there, This is kind-of a repost of this question: http://lists.freeradius.org/pipermail/freeradius-users/2006-October/013579.… So here we go: I'm currently running FreeRADIUS version 2.2.7 and using rlm_perl. In the authorize section, I manually set the proxy where to forward the request to, like this: $RAD_CHECK{'Proxy-To-Realm'} = 'my_realm'. Now in the post_proxy section of this same Perl script, I'd like to know the proxy's response, i.e. whether it's rejected or accepted. When looking at all the environment variables available in the Perl environment (i.e. %RAD_CONFIG %RAD_REQUEST %RAD_REPLY %RAD_CHECK %RAD_REQUEST_PROXY %RAD_REQUEST_PROXY_REPLY) I cannot find any indication that these contain the information I'm looking for. Yes, the attributes replied from the proxy are there, but not the actual access decision. Is there any way to get the actual access decision? -- Kind regards, Harm van Tilborg

2 2

Migrating from Mikrotik NAS to FreeBSD
by Cassiano Peixoto 22 Jul '15

22 Jul '15

Hi guys, I've been using Mikrotik as NAS for years, but i think now it's time to make some changes, and im thinking to replace it with FreeBSD+MPD consulting my freeradius. The problem is i still have to keep some mikrotik NAS in my network and i can't change mikrotik database attributes. I'd like to migrate transparently. I have in my freeradius database mikrotik attributes like Mikrotik-Rate-Limit. But MPD uses mpd-limit attribute. So my question is, what is the best way to replace Mikrotik-Rate-Limit with mpd-limit in a radius request? When an user connect via pppoe+mpd it will look for mpd-limit attribute on freeradius database, that doesn't exist, but it have to get the info from Mikrotik-Rate-Limit values, and send it back to pppoe+mpd with the right values got from Mikrotik-Rate-Limit Attribute. Has anyone done something like this before? Thanks.

2 7

eap-tls with a cisco phone
by Christian Bösch 22 Jul '15

22 Jul '15

Hi, I’m trying to authenticate a Cisco IP Phone with 802.1X EAP-TLS. I added the Cisco root certs to the CA file and the CN name from the phone’s cert to the users file. But it doesn’t work. Maybe anybody can give me a hint? Thanks, Chris — eap.conf — default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 tls { certdir = ${confdir}/user-certs cadir = ${confdir}/user-certs private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.crt CA_file = ${confdir}/certs/allcas.crt dh_file = ${confdir}/certs/dh random_file = ${confdir}/certs/random fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" #cache { #enable = yes #lifetime = 12 # hours #max_entries = 255 #} } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes #virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes #virtual_server = "inner-tunnel" } mschapv2 { } — debug output: rad_recv: Access-Request packet from host 111.222.333.444 port 1645, id=196, length=286 User-Name = "CP-7841-SEPDCEB94CF21FA" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9216 Called-Station-Id = "84-80-2D-47-CC-0D" Calling-Station-Id = "DC-EB-94-CF-21-FA" EAP-Message = 0x0201001c0143502d373834312d534550444345423934434632314641 Message-Authenticator = 0x6e734e719fdd0b92819587a021164920 Cisco-AVPair = "audit-session-id=C1AB9E16000003C10E2DC71C" Cisco-AVPair = "method=dot1x" NAS-IP-Address = 111.222.333.444 NAS-Port = 60000 NAS-Port-Id = "GigabitEthernet117/2/0/13" NAS-Port-Type = Ethernet server v_dot1x { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail.log -> /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail.log expands to /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] expand: %t -> Mon Jul 20 09:52:54 2015 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "CP-7841-SEPDCEB94CF21FA", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "CP-7841-SEPDCEB94CF21FA" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap-v_dot1x] EAP packet type response id 1 length 28 [eap-v_dot1x] No EAP Start, assuming it's an on-going EAP conversation ++[eap-v_dot1x] returns updated rlm_dbm: try open database file: /usr/local/etc/raddb/users-dot1x_dbm rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add CP-7841-SEPDCEB94CF21FA to user list sm_parse_user: start parsing: user: CP-7841-SEPDCEB94CF21FA parse buffer: <<>> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Cisco-AVPair = "device-traffic-class=voice", Cisco-AVPair += "subscriber:service-name=PHONES">> rlm_dbm: recod parsed rlm_dbm: Reply found Remove CP-7841-SEPDCEB94CF21FA from user list ++[users-dot1x] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = eap-v_dot1x # Executing group from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authenticate {...} [eap-v_dot1x] EAP Identity [eap-v_dot1x] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap-v_dot1x] returns handled } # server v_dot1x Sending Access-Challenge of id 196 to 111.222.333.444 port 1645 Cisco-AVPair = "device-traffic-class=voice" Cisco-AVPair += "subscriber:service-name=PHONES" EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x77057cce7707711b016ba7ac0a5a3d56 Finished request 462. Going to the next request Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 111.222.333.444 port 1645, id=197, length=400 User-Name = "CP-7841-SEPDCEB94CF21FA" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9216 Called-Station-Id = "84-80-2D-47-CC-0D" Calling-Station-Id = "DC-EB-94-CF-21-FA" EAP-Message = 0x0202007c0d8000000072160301006d01000069030356539e2e932132392e6c3258b6c47c4cddf0a003025e7f3c1f10a5343859e06100000ac030c02f0035002f00ff01000036000b000403000102000a000a00080019001800170013000d001c001a0000040105010601030102010101020204030503060303030203 Message-Authenticator = 0x18e2f1ae2927b7a72c339b23a9c4dc55 Cisco-AVPair = "audit-session-id=C1AB9E16000003C10E2DC71C" Cisco-AVPair = "method=dot1x" NAS-IP-Address = 111.222.333.444 NAS-Port = 60000 NAS-Port-Id = "GigabitEthernet117/2/0/13" NAS-Port-Type = Ethernet State = 0x77057cce7707711b016ba7ac0a5a3d56 server v_dot1x { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail.log -> /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail.log expands to /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] expand: %t -> Mon Jul 20 09:52:55 2015 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "CP-7841-SEPDCEB94CF21FA", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "CP-7841-SEPDCEB94CF21FA" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap-v_dot1x] EAP packet type response id 2 length 124 [eap-v_dot1x] No EAP Start, assuming it's an on-going EAP conversation ++[eap-v_dot1x] returns updated rlm_dbm: try open database file: /usr/local/etc/raddb/users-dot1x_dbm rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add CP-7841-SEPDCEB94CF21FA to user list sm_parse_user: start parsing: user: CP-7841-SEPDCEB94CF21FA parse buffer: <<>> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Cisco-AVPair = "device-traffic-class=voice", Cisco-AVPair += "subscriber:service-name=PHONES">> rlm_dbm: recod parsed rlm_dbm: Reply found Remove CP-7841-SEPDCEB94CF21FA from user list ++[users-dot1x] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = eap-v_dot1x # Executing group from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authenticate {...} [eap-v_dot1x] Request found, released from the list [eap-v_dot1x] EAP/tls [eap-v_dot1x] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 114 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 006d], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 121f], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0207], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap-v_dot1x] returns handled } # server v_dot1x Sending Access-Challenge of id 197 to 111.222.333.444 port 1645 Cisco-AVPair = "device-traffic-class=voice" Cisco-AVPair += "subscriber:service-name=PHONES" EAP-Message = 0x010304000dc00000146616030100310200002d030155aca8d7e81b8b3da4c459be39a8dde18295a38a91bea822ec2cfcb78fa0822a000035000005ff01000100160301121f0b00121b0012180004f6308204f2308203daa003020102021023c7cef71fc211363fa31e717c9041e2300d06092a864886f70d01010505003036310b3009060355040613024e4c310f300d060355040a1306544552454e41311630140603550403130d544552454e412053534c204341301e170d3132313231303030303030305a170d3135313231303233353935395a3079310b300906035504061302415431323030060355040a1329566f7261726c6265726720556e69 EAP-Message = 0x76657273697479206f66204170706c69656420536369656e636573311d301b060355040b1314496e666f726d6174696f6e205365727669636573311730150603550403130e656475726f616d2e6668762e617430820122300d06092a864886f70d01010105000382010f003082010a0282010100b8a1cd6fb3a2c64e4a7c3a29878251f475c356197216a9a0d64e6398307f32ec33f9a84023a5befde1346fc273ff4d1bd10b3f7a694fc3181a7d3a042ec3f5c427653b2e2c274e574c90104d8b843f10d8eb1ea2bf50b773bd9a77d763a6d15b4cd3e7d486a1c23ad515d2b3ab82b87bd89cfc42ee7fade1c3c7ba56d7111fdc7e0d0ab7f320a949e8 EAP-Message = 0xe25d905dba11fab8b46a50b79ba2bf96d5946f6ecbe27b098b6b9db9e6d9eb6d4c70498b463e0f9ed841d353fd1c5241d1b1d53bfaabadd6f3f318af047b090ecd4bdc2e66922e437fe91e241f0943b5fa16cbc27d60cb54e3120fcc0917e0c2fd13247eb33d09d22ebdafad9eb7e705ecc2e77866a4c90203010001a38201b7308201b3301f0603551d230418301680140cbd93680cf3deaba3496b2b375747ea90e3b9ed301d0603551d0e041604146ec40797cfbd94fb36d92f764970563218f4d65a300e0603551d0f0101ff0404030205a0300c0603551d130101ff04023000301d0603551d250416301406082b0601050507030106082b060105 EAP-Message = 0x0507030230180603551d200411300f300d060b2b06010401b2310102021d303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c2e7463732e746572656e612e6f72672f544552454e4153534c43412e63726c306d06082b060105050701010461305f303506082b060105050730028629687474703a2f2f6372742e7463732e746572656e612e6f72672f544552454e4153534c43412e637274302606082b06010505073001861a687474703a2f2f6f6373702e7463732e746572656e612e6f7267306f0603551d1104683066820e656475726f616d2e6668762e6174820f656475726f616d312e6668762e6174820f656475726f61 EAP-Message = 0x6d322e6668762e6174821872 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x77057cce7606711b016ba7ac0a5a3d56 Finished request 463. Going to the next request Waking up in 0.1 seconds. rad_recv: Access-Request packet from host 111.222.333.444 port 1645, id=198, length=282 User-Name = "CP-7841-SEPDCEB94CF21FA" Service-Type = Framed-User Cisco-AVPair = "service-type=Framed" Framed-MTU = 9216 Called-Station-Id = "84-80-2D-47-CC-0D" Calling-Station-Id = "DC-EB-94-CF-21-FA" EAP-Message = 0x020300060d00 Message-Authenticator = 0x33e76f51ba9e31652e48e06e41fa52dd Cisco-AVPair = "audit-session-id=C1AB9E16000003C10E2DC71C" Cisco-AVPair = "method=dot1x" NAS-IP-Address = 111.222.333.444 NAS-Port = 60000 NAS-Port-Id = "GigabitEthernet117/2/0/13" NAS-Port-Type = Ethernet State = 0x77057cce7606711b016ba7ac0a5a3d56 server v_dot1x { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail.log -> /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail.log expands to /var/log/radacct/111.222.333.444/auth-detail.log [auth_log] expand: %t -> Mon Jul 20 09:52:55 2015 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "CP-7841-SEPDCEB94CF21FA", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "CP-7841-SEPDCEB94CF21FA" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap-v_dot1x] EAP packet type response id 3 length 6 [eap-v_dot1x] No EAP Start, assuming it's an on-going EAP conversation ++[eap-v_dot1x] returns updated rlm_dbm: try open database file: /usr/local/etc/raddb/users-dot1x_dbm rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add CP-7841-SEPDCEB94CF21FA to user list sm_parse_user: start parsing: user: CP-7841-SEPDCEB94CF21FA parse buffer: <<>> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Cisco-AVPair = "device-traffic-class=voice", Cisco-AVPair += "subscriber:service-name=PHONES">> rlm_dbm: recod parsed rlm_dbm: Reply found Remove CP-7841-SEPDCEB94CF21FA from user list ++[users-dot1x] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = eap-v_dot1x # Executing group from file /usr/local/etc/raddb/sites-enabled/v_dot1x +- entering group authenticate {...} [eap-v_dot1x] Request found, released from the list [eap-v_dot1x] EAP/tls [eap-v_dot1x] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap-v_dot1x] returns handled } # server v_dot1x Sending Access-Challenge of id 198 to 111.222.333.444 port 1645 Cisco-AVPair = "device-traffic-class=voice" Cisco-AVPair += "subscriber:service-name=PHONES" EAP-Message = 0x010404000dc0000014666164697573312d656475726f616d2e75636c762e6e65748218726164697573322d656475726f616d2e75636c762e6e6574300d06092a864886f70d010105050003820101004289ca0d398d3b5945da6a7c12bf1920a2d63b412da2f57719e5174b9c72d8fb85ab3882caa212b2b3f4bfb324264d438100aecff461287ed584de2830549266e64ae6e0238b21e98a6e7fa3807c5571a280d2dea3f5a6275377438b39b89a962071dc78f5e5eb6c8bd42e489a9ee590c66a7d8d9f26271007433e9b2c986e1d438a6b5c933f4c4302c8a562654bb62f00d27970cb819d9e1396eabe9b5496cfbe7224254527d137987300d929bf EAP-Message = 0xd9b6693867ee7e6834347fb7b988c0520c90b8b9e9ed17100118f16880d09d3f95ddcf3a91e8ea44874edec2772001baaab3f8e8b4fb0b2ee338f3a0b7ed3b4d8665cf6e11ac7b05848c9444b973b060ab2600049c3082049830820380a00302010202104bc814032f07fa6aa4f0da29df6179ba300d06092a864886f70d0101050500308197310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d31 EAP-Message = 0x1f301d0603550403131655544e2d5553455246697273742d4861726477617265301e170d3039303531383030303030305a170d3230303533303130343833385a3036310b3009060355040613024e4c310f300d060355040a1306544552454e41311630140603550403130d544552454e412053534c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c3e348c42f5cc1cba999fd1ba2835d8a3dad3ad0e2a4431f4d0efe352530a5691bc4e8e5c18f547ee16aa29a5c5cde3dfc02ce96b85f8f835bcc604090f8e4b63a259c5f1451ecb1e7af9e50a13155c702bdac528a7f358e82fa84ad15fea27f83103a55 EAP-Message = 0x53942c01167494546328a3f25b293d94888020e214592119b4a498e160e6f2eba2808343e0ad68f379198b6843513f8a9b41850c358c5db5f1b6e5a7c383b56b236fd4a5eb50e594f14a5fee274b141215244c0dcf628db70021ad3a320f580b5f1e9bd1df9d8ea91935502f41a9ad3bc6e045b253397f21bf221a875c34ae526f077da20b4e9f2b79a67d13ddf57f837c2f5a5d77787891a014bf7d0203010001a382013e3082013a301f0603551d23041830168014a1725f261b289843955d0737d585969d4bd2c345301d0603551d0e041604140cbd93680cf3deaba3496b2b375747ea90e3b9ed300e0603551d0f0101ff04040302010630120603 EAP-Message = 0x551d130101ff040830060101 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x77057cce7501711b016ba7ac0a5a3d56 Finished request 464. Going to the next request

2 2

Re: Freeradius-Users Digest, Vol 122, Issue 104
by firing neurons 22 Jul '15

22 Jul '15

What is the best way to allow radiusd? Will I have to add cutom policy for each type of access that is blocked? Or is there a quick way that doesn't involve disabling SElinux? Message: 1 Date: Thu, 25 Jun 2015 13:34:14 +0000 From: Ben Gatewood <Ben.Gatewood(a)essensys.co.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: radiusd not starting at boot. Message-ID: <4B8DA7A1-2801-4D0C-8FC7-1749BFB031EF(a)essensys.co.uk> Content-Type: text/plain; charset="utf-8" "SELinux is preventing radiusd from read access on the file /etc/raddb/dictionary" On 25/06/2015 14:28, "firing neurons" <firingneurons(a)mail.com> wrote: > I am using 3.0.8. > > The result of service radiusd status: > > Redirecting to /bin/systemctl status -l radiusd.service > ● radiusd.service - FreeRADIUS high performance RADIUS server. > Loaded: loaded (/usr/lib/systemd/system/ > radiusd.service; enabled; > vendor preset: disabled) > Active: failed (Result: exit-code) since Fri 2015-06-26 00:08:14 > IST; 5h 24min left > Process: 819 ExecStartPre=/usr/sbin/radiusd -C (code=exited, > status=1/FAILURE) > Process: 794 ExecStartPre=/bin/chown -R radiusd.radiusd > /var/run/radiusd (code=exited, status=0/SUCCESS) > Jun 26 00:08:11 localhost.localdomain systemd[1]: Starting FreeRADIUS > high performance RADIUS server.... > Jun 26 00:08:14 localhost.localdomain systemd[1]: radiusd.service: > control process exited, code=exited status=1 > Jun 26 00:08:14 localhost.localdomain systemd[1]: Failed to start > FreeRADIUS high performance RADIUS server.. > Jun 26 00:08:14 localhost.localdomain systemd[1]: Unit radiusd.service > entered failed state. > Jun 26 00:08:14 localhost.localdomain systemd[1]: radiusd.service > failed. > > result of service radiusd start: > Redirecting to /bin/systemctl start radiusd.service > Job for radiusd.service failed. See "systemctl status radiusd.service" > and "journalctl -xe" for details. > [cleardot.gif] > result of journalctl -xe: > > >Jun 25 18:50:56 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from read access on the file /etc/raddb/dictionary. For >complete SELin >ux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 >Jun 25 18:50:56 localhost.localdomain python[2449]: SELinux is preventing >radius >d from read access on the file /etc/raddb/dictionary. > > ***** Plugin >restorecon (99 >.5 confidence) suggests ************************ > > If you want to fix >the label >. > /etc/raddb/dictionary >defaul >t label should be radiusd_etc_t. > Then you can run >restorecon. > Do > # /sbin/restorecon -v >/etc/r >addb/dictionary > > ***** Plugin >catchall (1.49 > confidence) suggests ************************** > > If you believe that >radiusd >should be allowed read access on the dictionary file by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:50:56 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from read access on the file /etc/raddb/clients.conf. For >complete SEL >inux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 >Jun 25 18:50:56 localhost.localdomain python[2449]: SELinux is preventing >radius >d from read access on the file /etc/raddb/clients.conf. > > ***** Plugin >restorecon (99 >.5 confidence) suggests ************************ > > If you want to fix >the label >. > >/etc/raddb/clients.conf defa >ult label should be radiusd_etc_t. > Then you can run >restorecon. > Do > # /sbin/restorecon -v >/etc/r >addb/clients.conf > > ***** Plugin >catchall (1.49 > confidence) suggests ************************** > > If you believe that >radiusd >should be allowed read access on the clients.conf file by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:50:56 localhost.localdomain polkitd[660]: Unregistered >Authentication >Agent for unix-process:2678:78843 (system bus name :1.64, object path >/org/freed >esktop/PolicyKit1/AuthenticationAgent, locale en_IN.UTF-8) (disconnected >from bu >s) >Jun 25 18:51:00 localhost.localdomain polkitd[660]: Registered >Authentication Ag >ent for unix-process:2863:79253 (system bus name :1.65 >[/usr/bin/pkttyagent --no >tify-fd 5 --fallback], object path >/org/freedesktop/PolicyKit1/AuthenticationAge >nt, locale en_IN.UTF-8) >Jun 25 18:51:00 localhost.localdomain systemd[1]: Starting FreeRADIUS >high perfo >rmance RADIUS server.... >-- Subject: Unit radiusd.service has begun start-up >-- Defined-By: systemd >-- Support: [1]http://lists.freedesktop.org/mailman/listinfo/systemd-devel >-- >-- Unit radiusd.service has begun starting up. >Jun 25 18:51:00 localhost.localdomain audit[2886]: <audit-1400> avc: >denied { >sys_ptrace } for pid=2886 comm="radiusd" capability=19 >scontext=system_u:syste >m_r:radiusd_t:s0 tcontext=system_u:system_r:radiusd_t:s0 >tclass=capability permi >ssive=0 >Jun 25 18:51:00 localhost.localdomain kernel: ptrace of pid 2885 was >attempted b >y: radiusd (pid 2886) >Jun 25 18:51:00 localhost.localdomain audit[2885]: <audit-1400> avc: >denied { >read } for pid=2885 comm="radiusd" name="dictionary" dev="dm-1" >ino=1711521 sco >ntext=system_u:system_r:radiusd_t:s0 >tcontext=unconfined_u:object_r:user_home_t: >s0 tclass=file permissive=0 >Jun 25 18:51:00 localhost.localdomain audit[2885]: <audit-1400> avc: >denied { >read } for pid=2885 comm="radiusd" name="clients.conf" dev="dm-1" >ino=1711520 s >context=system_u:system_r:radiusd_t:s0 >tcontext=unconfined_u:object_r:user_home_ >t:s0 tclass=file permissive=0 >Jun 25 18:51:00 localhost.localdomain systemd[1]: radiusd.service: >control proce >ss exited, code=exited status=1 >Jun 25 18:51:00 localhost.localdomain systemd[1]: Failed to start >FreeRADIUS hig >h performance RADIUS server.. >-- Subject: Unit radiusd.service has failed >-- Defined-By: systemd >-- Support: [2]http://lists.freedesktop.org/mailman/listinfo/systemd-devel >-- >-- Unit radiusd.service has failed. >-- >-- The result is failed. >Jun 25 18:51:00 localhost.localdomain systemd[1]: Unit radiusd.service >entered f >ailed state. >Jun 25 18:51:00 localhost.localdomain systemd[1]: radiusd.service failed. >Jun 25 18:51:00 localhost.localdomain audit[1]: <audit-1130> pid=1 uid=0 >auid=42 >94967295 ses=4294967295 subj=system_u:system_r:init_t:s0 >msg='unit=radiusd comm= >"systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? >res=failed >' >Jun 25 18:51:00 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from using the sys_ptrace capability. For complete SELinux >messages. r >un sealert -l cac781eb-1cae-4673-b684-6308a2c7ff2b >Jun 25 18:51:00 localhost.localdomain python[2449]: SELinux is preventing >radius >d from using the sys_ptrace capability. > > ***** Plugin >catchall (100. > confidence) suggests ************************** > > If you believe that >radiusd >should have the sys_ptrace capability by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:51:00 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from read access on the file /etc/raddb/dictionary. For >complete SELin >ux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 >Jun 25 18:51:00 localhost.localdomain python[2449]: SELinux is preventing >radius >d from read access on the file /etc/raddb/dictionary. > > ***** Plugin >restorecon (99 >.5 confidence) suggests ************************ > > If you want to fix >the label >. > /etc/raddb/dictionary >defaul >t label should be radiusd_etc_t. > Then you can run >restorecon. > Do > # /sbin/restorecon -v >/etc/r >addb/dictionary > > ***** Plugin >catchall (1.49 > confidence) suggests ************************** > > If you believe that >radiusd >should be allowed read access on the dictionary file by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:51:00 localhost.localdomain setroubleshoot[2449]: SELinux is >preventin >g radiusd from read access on the file /etc/raddb/clients.conf. For >complete SEL >inux messages. run sealert -l 35e3131e-b329-4326-add0-6fde9b762f14 >Jun 25 18:51:00 localhost.localdomain python[2449]: SELinux is preventing >radius >d from read access on the file /etc/raddb/clients.conf. > > ***** Plugin >restorecon (99 >.5 confidence) suggests ************************ > > If you want to fix >the label >. > >/etc/raddb/clients.conf defa >ult label should be radiusd_etc_t. > Then you can run >restorecon. > Do > # /sbin/restorecon -v >/etc/r >addb/clients.conf > > ***** Plugin >catchall (1.49 > confidence) suggests ************************** > > If you believe that >radiusd >should be allowed read access on the clients.conf file by default. > Then you should >report this >as a bug. > You can generate a >local pol >icy module to allow this access. > Do > allow this access for >now by > executing: > # grep radiusd >/var/log/audi >t/audit.log | audit2allow -M mypol > # semodule -i mypol.pp > >Jun 25 18:51:01 localhost.localdomain polkitd[660]: Unregistered >Authentication >Agent for unix-process:2863:79253 (system bus name :1.65, object path >/org/freed >esktop/PolicyKit1/AuthenticationAgent, locale en_IN.UTF-8) (disconnected >from bu >s) >- >List info/subscribe/unsubscribe? See >[3]http://www.freeradius.org/list/users.html ------------------------------ References 1. http://lists.freedesktop.org/mailman/listinfo/systemd-devel 2. http://lists.freedesktop.org/mailman/listinfo/systemd-devel 3. http://www.freeradius.org/list/users.html

3 2

configure freeRADIUS with a CHAP "access-challenge" message
by Arul Sundaramoorthy 22 Jul '15

22 Jul '15

Hi, Can anyone please let me know How to configure freeRADIUS server so it replies with a CHAP "access-challenge" message on "access-request" from a client? I am new to the freeradius tool. so it will better if anyone provide the document for above request. Thanks, Arnold

3 2

Re: udp sockets and proxy servers
by Sergey Komarov 22 Jul '15

22 Jul '15

Hello Arran, Alan and colleagues! > Hmmm, well that's problematic. Could you open a GitHub issue. > > -Arran > Ok, done. I opened issue at Github: "FreeRadius 3.0.9 tries to open more and more sockets for proxy server until crash" #1155 I understand thats FR is free software but I hope may be someone helps we with a patch or advise should I try to build 3.1.x or other versions to get CoA proxy stable with lots of home servers. Thank you in advance for your help! Best Regards, Serge Komaroff > > > I'm tring to run 3.0.9 configuration with about ~1500 clients and home > > > servers (as I have about 1500 WLCs in the network and I try to proxy > CoA > > > packet to WLCs via radius). > > > > > > Radius server tries to open as many sockets as possible doing like > that: > > > > > > Info: ... adding new socket proxy address * port 46527 > > > Info: ... adding new socket proxy address * port 38003 > > > > > > It happens slowly or fast and it depends of load as I see it... And > then > > > after about 256 sockets server quits from running with error: > > > > Is that with TLS? Or TCP? We didn't predict that people would use 256 > > or more clients with CoA and TCP. > > > > But it *should* work for UDP. There's no reason for it to open many > > proxy sockets. It just needs one or two. > > > > Alan DeKok. > > > > Hello Alan! The case is that I'm using UDP only, no any TLS now, just > common pap/sql and Acc Req/Accept/CoA Proxy... SQL sockets is ok and no > overflow there (it even close some connections to DB when don't need it). > > But it looks like FR tries to create as many sockets as home servers and it > happen slowly - depends on load. When I limit to 200 home servers - it > stopped to create sockets at number about 153... In case it overcome 256 it > drops soon with that error... > > > Best Regards, Serge Komaroff >

1 0