- Freeradius-Users - lists.freeradius.org

HA scenario = failure
by Rob Walker 09 Feb '15

09 Feb '15

Hello, I'm a freerad newb, trying to get my HP Procurve 2910al working with 2 freerad servers (setup identically) and windows/linux endpoints. I've tested this setup successfully against each individual freerad server ok. As soon as I test stopping one of the free radius server hosts so that the 2910al is forced to try the other freerad server (testing a HA scenario) - authentication fails. I can only guess that it's something the switch is mishandling? If someone could advise on the below outputs it would be appreciated, it seems the packet length is much less when it doesn't work? Thanks *WORKS* # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "examiner", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 222 to 192.168.20.5 port 1812 MS-MPPE-Recv-Key = 0x5ed30fd859b49a49dd16e772a30e330d3573a5630212036937d8f2d MS-MPPE-Send-Key = 0x72687c7646048677b9bc3d82e25efbfeefeb6a5fad3ad0bc50a87c2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "examiner" Finished request 8. Going to the next request *FAILS* # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "examiner", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry examiner at line 50 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 213 to 192.168.20.5 port 1812 EAP-Message = 0x01060016041053527f160f5a194e8608d8bced20ec12 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa8a53daca8a339aa1a93d90a4cd655f7 Finished request 20. Going to the next request

3 4

CHAP Issues
by Dan Goscomb 09 Feb '15

09 Feb '15

Hi All We are getting seemingly random CHAP authentication issues. These are known good passwords configured on test routers, however we still get the same authentication failed. Has anyone else seen such things? A debug output for one such request is here. The password that the module pulls out to compare against is 100% what we are using. rad_recv: Access-Request packet from host 217.196.224.5 port 1645, id=92, length=148 Framed-Protocol = PPP User-Name = "264247.313093(a)hs.hsoworld.com" CHAP-Password = 0x022714dafa245ec52463c2afc25ea7dbe2 Calling-Station-Id = "BBEU17129208" Connect-Info = "6631000/444000" NAS-Port-Type = ISDN NAS-Port = 21378 NAS-Port-Id = "Uniq-Sess-ID1378" Service-Type = Framed-User NAS-IP-Address = 217.196.224.5 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{NAS-IP-Address} -> 217.196.224.5 ++[preprocess] = ok [chap] Setting 'Auth-Type := CHAP' ++[chap] = ok ++[mschap] = noop [suffix] Looking up realm "hs.hsoworld.com" for User-Name = "264247.313093(a)hs.hsoworld.com" [suffix] Found realm "hs.hsoworld.com" [suffix] Adding Stripped-User-Name = "264247.313093" [suffix] Adding Realm = "hs.hsoworld.com" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[unix] = notfound [files] users: Matched entry DEFAULT at line 425 ++[files] = ok [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql] expand: %{Stripped-User-Name:-%{User-Name:-none}} -> 264247.313093 [sql] sql_set_user escaped user --> '264247.313093' rlm_sql (sql): Reserving sql socket id: 5 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '264247.313093' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '264247.313093' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = '264247.313093' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'hsodefault' ORDER BY id [sql] User found in group hsodefault [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'hsodefault' ORDER BY id rlm_sql (sql): Released sql socket id: 5 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = ok Found Auth-Type = CHAP # Executing group from file /etc/raddb/sites-enabled/default +group CHAP { [chap] login attempt by "264247.313093" with CHAP password [chap] Using clear text password "Gr03ven0r" for user 264247.313093 authentication. [chap] Password check failed ++[chap] = reject +} # group CHAP = reject Failed to authenticate the user. Login incorrect (rlm_chap: Wrong user password): [264247.313093(a)hs.hsoworld.com] (from client lns00.hex.uk port 21378 cli BBEU17129208) Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated _____________________________________________________________________ This e-mail and all attachments have been scanned by the hSo virus scanning service powered by Symantec and no known viruses were detected.

3 3

EAP-PEAP with "special" users
by Jonathan Gazeley 06 Feb '15

06 Feb '15

I've inherited a manky old RADIUS server and I'm trying to get to grips with it. In short, it is using EAP-PEAP/MSCHAPv2 to authenticate users against Active Directory. This is all working fine. I want to add some test user accounts that can be authenticated through EAP but use a flat file rather than ntlm_auth. What's the recommended way of handling this without harming the performance of the majority of the users who will not appear in the users file? Thanks, Jonathan

2 3

Freeradius3.0.3, Oracle database and UnixODBC
by Puzzel 06 Feb '15

06 Feb '15

Hi, I'm trying to integrate Freeradius and Oracle database. I'm using UnixODBC for this. My Oracle client and ISQL is working (connecting to oracle database) but when i try to start radius i have logs: rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib '/usr/lib/oracle/11.2/client/lib/libsqora.so.11.1' : ????: undefined symbol: get_vtable rlm_sql_unixodbc: SQL down 08003 [unixODBC][Driver Manager]Connnection does not exist rlm_sql_unixodbc: Can't allocate the statement rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (oracle_eduroam): Opening connection failed (0) rlm_sql (oracle_eduroam): Removing connection pool This configuration works fine on FR2.

4 7

Multiple authentication for same user.
by Krishnan V R 06 Feb '15

06 Feb '15

Hi, I have freeradius and coova chilli(version 1.3.0) running in one machine and webserver running in a other machine. For the same user, Is it possible to give separate access for webserver and separate access for the internet. i.e I need a mechanism of two types of authentication for the same user. one authentication for the webserver access and the other authentication for the internet access. Thanks in advance for any suggestions. Thanks Krishnan

3 4

Re: What else should radmin do?
by Rui Ribeiro 05 Feb '15

05 Feb '15

Hi Alan, It would be interesting to make radmin work as non-root. At least in Debian 7 and 8, it has not work since 2.2.2 at least; I am using 3.0.7 from git atm. Despite the non privileged user being in the correct groups, and the socket being rw for the correct group, radmin blocks, and never gives back the prompt. . rt_sigaction(SIGPIPE, {SIG_IGN, [PIPE], SA_RESTORER|SA_RESTART, 0x7f0e60614180}, {SIG_DFL, [], 0}, 8) = 0 socket(PF_LOCAL, SOCK_STREAM, 0) = 3 connect(3, {sa_family=AF_LOCAL, sun_path="/var/run/freeradius/freeradius.sock"}, 37) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 read(3, "", 8) = 0 radius2:~$ id -Gn rui rui adm sudo audio plugdev radius freerad radius2:/var/run/freeradius$ ls -la total 4 drwxr-xr-x 2 freerad freerad 80 Feb 3 20:14 . drwxr-xr-x 18 root root 640 Jan 27 17:49 .. -rw-r--r-- 1 freerad freerad 6 Feb 3 20:14 freeradius.pid srw-rw---- 1 freerad freerad 0 Feb 3 20:14 freeradius.sock -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 3

Custom attributes
by Flamur Rogova 04 Feb '15

04 Feb '15

Hi, I want to use custom attribute of integer type, to hold user's total amount of consumed bytes, something like this ATTRIBUTE Total-Used-Bytes 3003 integer What is bit width of custom integer attributes, 32 or 64 bit ? I need it to store 64 counters. Br/Flamur

2 1

What else should radmin do?
by Alan DeKok 04 Feb '15

04 Feb '15

I’ve pushed some changes to radmin, which will be in the 3.0.7 release. The changes make radmin work a little better, in that it now makes a distinction between STDOUT and STDERR. Also, when a command fails, radmin will exit with an error: $ radmin -e “help” … $ echo $? 0 Versus: $ radmin -e “no such command” … $ echo $? 1 These changes were made possible by updating the underlying framework used by radmin and the server. The result of these framework changes is that we can now exchange *anything* safely between the server and radmin. So… what would be useful to exchange? We can’t do configuration changes, as the server can’t write to /etc/raddb. But we could do test packets, for example. $ radmin “send packet X pretending to be from NAS 192.0.2.1” And get a response. This means it would be possible to perform better tests on live systems. Any other ideas? Alan DeKok.

3 6

Re: Disconnect message!
by Kos 04 Feb '15

04 Feb '15

I found this awesome Java API(https://github.com/GideonLeGrange/mikrotik-java) and make possible to disconnect the user through. Thanks all for your answers.

1 0

Expiration Feature / Session-Timeout Problem
by Sven 04 Feb '15

04 Feb '15

Hello, i try to use the Expiration Feature to get control over the Password lifetime of our Users. The idea was to set a date maybe 90 Day from last Passwordchange. This worked well, Users got denied but ive tested this feature only with a few Days ahead from now. Now i found out that if i set this to more than a Month from now that some of our Devices rejects the Access while i can see in the Radius Log that they where supplied with a Access-Accept. I guess that some of our older Devices got Problems with the releated Session-Timeout value which is in the Access-Accept reply too. Is there a way to not send Session-Timeout Data to these or all Devices ? In my setup i dont think that i need this because my goal is not to Disconnect a User, only to block him from logging in. Maybe there is a better solution to get this "feature" :) Im not sure if the Expiration Feature is the right thing for this task. Kind Regards, Sven

3 3