- Freeradius-Users - lists.freeradius.org

FreeRadius and OpenSSL 1.0.2
by Dave Duchscher 24 Mar '15

24 Mar '15

I am testing FreeRadius with OpenSSL 1.0.2 and noticed a strange issue. TTLS-MSCHAPv2 fails. PEAP and TTLS-(PAP, CHAP, MSCHAPv1) all work. The error that stands out is 'Invalid ACK received: 0'. I get this on both 2.2.6 and 3.0.7. 2.2.6 Mon Mar 23 08:40:09 2015 : Info: [ttls] Authenticate Mon Mar 23 08:40:09 2015 : Info: [ttls] processing EAP-TLS Mon Mar 23 08:40:09 2015 : Info: [ttls] Received TLS ACK Mon Mar 23 08:40:09 2015 : Info: [ttls] ACK default Mon Mar 23 08:40:09 2015 : Error: [ttls] Invalid ACK received: 0 Mon Mar 23 08:40:09 2015 : Info: [ttls] eaptls_verify returned 4 Mon Mar 23 08:40:09 2015 : Info: [ttls] eaptls_process returned 4 3.0.7 Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: Authenticate Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: processing EAP-TLS Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: Received TLS ACK Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: Received TLS ACK Mon Mar 23 09:14:26 2015 : ERROR: (21) eap_ttls: Invalid ACK received: 0 Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: eaptls_verify returned 0 Mon Mar 23 09:14:26 2015 : Debug: (21) eap_ttls: eaptls_process returned 0 Mon Mar 23 09:14:26 2015 : ERROR: (21) eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed Downgrading openssl to 1.0.1 and the issue goes away. 2.2.6 Mon Mar 23 08:50:40 2015 : Info: [ttls] Authenticate Mon Mar 23 08:50:40 2015 : Info: [ttls] processing EAP-TLS Mon Mar 23 08:50:40 2015 : Info: [ttls] Received TLS ACK Mon Mar 23 08:50:40 2015 : Info: [ttls] ACK handshake is finished Mon Mar 23 08:50:40 2015 : Info: [ttls] eaptls_verify returned 3 Mon Mar 23 08:50:40 2015 : Info: [ttls] eaptls_process returned 3 3.0.7 Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: Authenticate Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: processing EAP-TLS Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: Received TLS ACK Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: Received TLS ACK Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: ACK handshake is finished Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: eaptls_verify returned 3 Mon Mar 23 09:17:54 2015 : Debug: (29) eap_ttls: eaptls_process returned 3 This was tested with the default configuration and adding a user to the users file. The OS was FreeBSD 10.1. I assuming this a problem with the FreeBSD's OpenSSL 1.0.2 port but wanted to ask if anybody else has seen issues with the latest OpenSSL version? -- Dave

2 2

$FREERADIUS_OPTIONS in Freeradius startup
by Clement Ogedengbe 24 Mar '15

24 Mar '15

How do I use $FREERADIUS_OPTIONS in /etc/init.d/freeradius start/stop daemon script, to pass arguments such as config directort or logging to particular file/directory Best Regards Clement -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 19 March 2015 00:35 To: FreeRadius users mailing list Subject: Re: Crash > On 17 Mar 2015, at 17:23, Ben Gatewood <Ben.Gatewood(a)essensys.co.uk> wrote: > > This one: > > FreeRADIUS Version 3.0.8 (git #46056c1) Thanks, could you add a ticket in the issue tracker with the backtrace and any debug logging you have before the crash. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2

can EAP-PEAP-GTC use email pop3 server to authenticate?
by d tbsky 24 Mar '15

24 Mar '15

hi: I am using freeradius 3.0.1 at scientific linux 7.0. I want to use our pop3 server as database for wireless wpa authentication. (the eap-peap-mschapv2 works fine with our Active Directory. but for some reason we need another method). I try to test the idea as two parts: 1. setup a "test1" user at /etc/raddb/users like this test1 Cleartext-Password := "testtest" and use EAP-PEAP-GTC at windows client to test it, it works fine. 2. write a perl script to authenticate via pop3 server. I use "radtest 'user@domain' my-pop3-password 127.0.0.1:18120 0 testing123" to test, it works fine. the modification part of my inner-tunnel config is like below: authorize { pop3 if (ok || updated) { update control { Auth-Type := POP3 } } } Auth-Type POP3 { pop3 } 3. I can not combine above to the final result. I can not use EAP-PEAP-GTC from windows to authenticate via pop3 server. when I debug the perl script, I found no password input when using "EAP-PEAP-GTC". I try modify many settings but still can not get it work. so I wonder if my concept is wrong. is that possible to use EAP-PEAP-GTC against a pop3 server, or we need a cleartext-password file when using EAP-PEAP-GTC? I try to make the perl script dump %RED_REQUEST as below when using EAP-PEAP-GTC: $VAR1 = { 'User-Name' => 'xxx@xxxxxx', 'EAP-Message' => '0x020f00060306', 'Realm' => 'xxxxxxxxx', 'State' => '0x2dec2f402de335af33348f2ebbe6e91d', 'Stripped-User-Name' => 'xxxx', 'EAP-Type' => 'NAK', 'FreeRADIUS-Proxied-To' => '127.0.0.1' thanks a lot for help!! Regards, tbskyd

2 10

FreeRADIUS 3.x roadmap ?
by "RESTOUX, Loïc" 23 Mar '15

23 Mar '15

Hi, I found a roadmap of the 2.x branch of FreeRADIUS on the wiki. Is there something similar for the 3.x branches ? More specifically, I need to know if you're going to release the 3.0.8 version in the next weeks. Regards, -- LRS This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

5 6

EAP-TLS with check on DB possible?
by Stefano Zanmarchi 21 Mar '15

21 Mar '15

Hi, a newbie question before I start setting up Freeradius with EAP-TLS. Is it possible to configure Freeradius to make a double check when it receives an authentication request? I'd like it not only to check if the client certificate is valid but also if the user is in a DB "authorized_users" table. Thank you very much for your indications, Stefano

3 2

freeradius logging question
by Alex Sharaz 20 Mar '15

20 Mar '15

Hi, In common with (probably) every other freeradius user, my radius.log file shows logging of the form ..... Fri Mar 20 13:44:07 2015 : Auth: Login OK: [jah534(a)york.ac.uk] (from client arubal2 port 0 cli 78-4B-87-C0-81-97 via TLS tunnel) Fri Mar 20 13:44:07 2015 : Auth: Login OK: [@york.ac.uk] (from client arubal2 port 0 cli 78-4B-87-C0-81-97) Fri Mar 20 13:44:07 2015 : Auth: Login OK: [6C-F3-7F-C2-15-F0] (from client ce1sw4 port 29 cli 6C-F3-7F-C2-15-F0) ..... The above shows a local eduroam user log entry ( outer-tunnel user-name of @york.ac.uk ,inner tunnel username of jah534(a)york.ac.uk) and a mac auth entry from a switch. >From our point of view, the record with jah534(a)york.ac.uk is useful.... the @york.ac.uk record isn't. Is it possible to selectively disable what appears in the radius.log file ( e.g. modifying sites-enabled/default so that if RADIUS attribute EAP-Message exists don't add an entry to radius.log. This would allow our mac-auths to be logged as well as the TLS tunnel entries (as they are generated in sites-enabled/inner-tunnel) but discard the [@york.ac.uk] entries Rgds Alex

2 2

Re: Performance Problems ntlm_auth <-> Active Directory under heavy load
by Matthew Newton 19 Mar '15

19 Mar '15

Hi, [Please keep replies on-list] On Thu, Mar 19, 2015 at 12:58:40PM +0000, tom greisch wrote: > >Looks to me like you may have hit a different bug in winbind. Try > >running ntlm_auth from the command line and see if it gives the > >same problem. > > if i use ntlm_auth from the command line a Backtrace is not > logged. A Backtrace Log is also not generated if Freeradius does > only few "sporadic" User Authentications. If the Count of > Authentication increases i get a a lot of Backtraces logged. There are plenty of people running in this configuration, and this is the first I've heard of winbind/ntlm_auth crashing and producing backtraces. So it's likely something is odd about your setup. Have you tried Debian stable - it's possible there is a bug in the Samba version in Jessie. > ntlm_auth in freeradius not that ntlm_auth is the cause... sorry > my english is really not perfect but i hope you understand what > i mean... Your English is good. > >No, it doesn't say that, and you shouldn't do that. It will kill > >performance. Use ntlm_auth if you can't use the new patches (which > >aren't released yet anyway). > yes of course i know that i will lose Performance but is it not > better than a lot of Backtrace Logs or core dumps.. I think you should try a different version of Samba. Other people don't see that. They _do_ see performance issues with too many auths/second, which is, I believe, from the way people have to use ntlm_auth at present, which isn't really a Samba issue. Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

1 0

freeradius2 + iODBC + Informix
by vanish 19 Mar '15

19 Mar '15

Greeting, Fajar A. Nugraha-2, Alan DeKok-2. After yours answers i tried to rebuild freeradius with unixodbc module. 1. Install unixodbc and unixodbc-dev 2. Download 2.1.12 package: freeradius_2.1.12+dfsg-1.2ubuntu8.debian.tar.gz freeradius_2.1.12+dfsg-1.2ubuntu8.dsc freeradius_2.1.12+dfsg.orig.tar.bz2 2. Edit debian/rules : --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ !! --without-rlm_sql_iodbc \ !! --with-rlm_sql_unixodbc \ --with-system-libtool 3. Build package: dpkg-buildpackage -d -rfakeroot 4. Install deb packet: dpkg -i freeradius_2.1.12+dfsg-1.2ubuntu8_amd64.deb 5. Change sql.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "unixodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ 6. freeradius -X showed me: rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql_unixodbc: Connection failed rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. 7. On test.server.ru i used tcpdump utils to see incoming packets from my machine with freeradius - but the entering packets was not detected. Please, help me find the mistake. -- ============================================ С уважением, Богучарский Иван Владимирович. Начальник СУТС ОРЭТС и ШПД ЗАО "Коламбия-Телеком". тел. 8-937-084-25-89.

7 10

questions about 3.0.7 under load using file listen server
by adrian.p.smith＠bt.com 19 Mar '15

19 Mar '15

We are running 3.0.7 and writing packets to a file to be read by a detail server. We find that, when the server is under a lot of client load the detail server stops working. When the load reduces, the detail server resumes sending packets. Is this a deliberate design? We didn't see that with earlier versions. Perhaps there is some config we can adjust? Thanks in advance. Adrian

2 1

pre-proxy ?
by Olivier CALVANO 19 Mar '15

19 Mar '15

Hi I am new in Freeradius and i am search a small help. - I receive a Radius Access request of the radius of my supplier. this Radius have the ip address 192.168.10.100 - Based on the realm, i forward the request to my customer. i want add in the process a action before sent the request to my customer. Actually i have: in proxy.conf home_server rad-auth-primaire-1.customer_realm.myrealm { type = auth ipaddr = 172.16.1.1 port = 1812 secret = password require_message_authenticator = yes response_window = 20 zombie_period = 40 status_check = status-server check_interval = 20 num_answers_to_alive = 3 } home_server_pool pool-auth.customer_realm.myrealm { type = fail-over home_server = rad-auth-primaire-1.customer_realm.myrealm home_server = rad-auth-secondaire-1.customer_realm.myrealm } realm "~(customer_realm.myrealm)" { auth_pool = pool-auth.customer_realm.myrealm nostrip } i want add this action: Before sent the access request to my customer, i want that my radius answer to the radius server of my supplier a Access-Accept with a: Tunnel-Server-Endpoint:0 = "172.17.10.250" With this information, my supplier sent the tunnel to 172.17.10.250, it's a Cisco router, when i receive the tunnel he sent a access request to my radius and i want that my radius forward the request to the radius server of my customer with a : NAS-IP-Address = 172.17.10.250 It's possible ? CPE Customer ==> My_Cisco_172.17.10.250 ==> Cisco of my Customer (replied in radius tunnel end point) I don't know what file i modify for this, policy.conf ? other ? very very new ;=) thanks for your help Olivier

2 8