- Freeradius-Users - lists.freeradius.org

Freeradius 2.1.10 EAP-MD5 problem
by Nabil Benbelgacem 05 Jan '15

05 Jan '15

Hi all of you. First, i wish you a happy new year ! :) Well, i have a little problem with freeradius. I have installed it on Ubuntu Server 12.04 LTS. Here is my project. I want to make a radius server where users can use an username and password to logon on access points. But nothing more and nothing less. I have configured the radius server for EAP-MD5 authentification but when i try to test the configuration with freeradius -XXX, i get this message at the end : Fri Jan 2 18:13:27 2015 : Info: FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Feb 24 2014 at 15:16:51 Fri Jan 2 18:13:27 2015 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Fri Jan 2 18:13:27 2015 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Jan 2 18:13:27 2015 : Info: PARTICULAR PURPOSE. Fri Jan 2 18:13:27 2015 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Jan 2 18:13:27 2015 : Info: GNU General Public License v2. Fri Jan 2 18:13:27 2015 : Info: Starting - reading configuration files ... Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/radiusd.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/proxy.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/clients.conf Fri Jan 2 18:13:27 2015 : Debug: including files in directory /etc/freeradius/modules/ Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/ntlm_auth Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/linelog Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/radutmp Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/otp Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/realm Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/acct_unique Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/checkval Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/unix Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/logintime Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/expr Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/digest Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/detail.log Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/pam Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/files Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/attr_filter Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/inner-eap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/etc_group Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/sradutmp Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/exec Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/preprocess Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/ippool Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/echo Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/counter Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/krb5 Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/perl Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/opendirectory Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/mschap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/wimax Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/policy Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/ldap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/sql_log Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/mac2ip Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/passwd Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/smsotp Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/chap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/pap Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/expiration Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/cui Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/detail Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/dynamic_clients Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/always Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/eap.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sql.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sql/mysql/dialup.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/policy.conf Fri Jan 2 18:13:27 2015 : Debug: including files in directory /etc/freeradius/sites-enabled/ Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sites-enabled/default Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sql.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sql/mysql/dialup.conf Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Fri Jan 2 18:13:27 2015 : Debug: including configuration file /etc/freeradius/sites-enabled/control-socket Fri Jan 2 18:13:27 2015 : Debug: main { Fri Jan 2 18:13:27 2015 : Debug: user = "freerad" Fri Jan 2 18:13:27 2015 : Debug: group = "freerad" Fri Jan 2 18:13:27 2015 : Debug: allow_core_dumps = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: including dictionary file /etc/freeradius/dictionary Fri Jan 2 18:13:27 2015 : Debug: main { Fri Jan 2 18:13:27 2015 : Debug: prefix = "/usr" Fri Jan 2 18:13:27 2015 : Debug: localstatedir = "/var" Fri Jan 2 18:13:27 2015 : Debug: logdir = "/var/log/freeradius" Fri Jan 2 18:13:27 2015 : Debug: libdir = "/usr/lib/freeradius" Fri Jan 2 18:13:27 2015 : Debug: radacctdir = "/var/log/freeradius/radacct" Fri Jan 2 18:13:27 2015 : Debug: hostname_lookups = no Fri Jan 2 18:13:27 2015 : Debug: max_request_time = 30 Fri Jan 2 18:13:27 2015 : Debug: cleanup_delay = 5 Fri Jan 2 18:13:27 2015 : Debug: max_requests = 1024 Fri Jan 2 18:13:27 2015 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Fri Jan 2 18:13:27 2015 : Debug: checkrad = "/usr/sbin/checkrad" Fri Jan 2 18:13:27 2015 : Debug: debug_level = 0 Fri Jan 2 18:13:27 2015 : Debug: proxy_requests = yes Fri Jan 2 18:13:27 2015 : Debug: log { Fri Jan 2 18:13:27 2015 : Debug: stripped_names = no Fri Jan 2 18:13:27 2015 : Debug: auth = no Fri Jan 2 18:13:27 2015 : Debug: auth_badpass = no Fri Jan 2 18:13:27 2015 : Debug: auth_goodpass = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: security { Fri Jan 2 18:13:27 2015 : Debug: max_attributes = 200 Fri Jan 2 18:13:27 2015 : Debug: reject_delay = 1 Fri Jan 2 18:13:27 2015 : Debug: status_server = yes Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri Jan 2 18:13:27 2015 : Debug: proxy server { Fri Jan 2 18:13:27 2015 : Debug: retry_delay = 5 Fri Jan 2 18:13:27 2015 : Debug: retry_count = 3 Fri Jan 2 18:13:27 2015 : Debug: default_fallback = no Fri Jan 2 18:13:27 2015 : Debug: dead_time = 120 Fri Jan 2 18:13:27 2015 : Debug: wake_all_if_all_dead = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: home_server localhost { Fri Jan 2 18:13:27 2015 : Debug: ipaddr = 127.0.0.1 Fri Jan 2 18:13:27 2015 : Debug: port = 1812 Fri Jan 2 18:13:27 2015 : Debug: type = "auth" Fri Jan 2 18:13:27 2015 : Debug: secret = "testing123" Fri Jan 2 18:13:27 2015 : Debug: response_window = 20 Fri Jan 2 18:13:27 2015 : Debug: max_outstanding = 65536 Fri Jan 2 18:13:27 2015 : Debug: require_message_authenticator = yes Fri Jan 2 18:13:27 2015 : Debug: zombie_period = 40 Fri Jan 2 18:13:27 2015 : Debug: status_check = "status-server" Fri Jan 2 18:13:27 2015 : Debug: ping_interval = 30 Fri Jan 2 18:13:27 2015 : Debug: check_interval = 30 Fri Jan 2 18:13:27 2015 : Debug: num_answers_to_alive = 3 Fri Jan 2 18:13:27 2015 : Debug: num_pings_to_alive = 3 Fri Jan 2 18:13:27 2015 : Debug: revive_interval = 120 Fri Jan 2 18:13:27 2015 : Debug: status_check_timeout = 4 Fri Jan 2 18:13:27 2015 : Debug: irt = 2 Fri Jan 2 18:13:27 2015 : Debug: mrt = 16 Fri Jan 2 18:13:27 2015 : Debug: mrc = 5 Fri Jan 2 18:13:27 2015 : Debug: mrd = 30 Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: home_server_pool my_auth_failover { Fri Jan 2 18:13:27 2015 : Debug: type = fail-over Fri Jan 2 18:13:27 2015 : Debug: home_server = localhost Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: realm example.com { Fri Jan 2 18:13:27 2015 : Debug: auth_pool = my_auth_failover Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: realm LOCAL { Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: radiusd: #### Loading Clients #### Fri Jan 2 18:13:27 2015 : Debug: client localhost { Fri Jan 2 18:13:27 2015 : Debug: ipaddr = 127.0.0.1 Fri Jan 2 18:13:27 2015 : Debug: require_message_authenticator = no Fri Jan 2 18:13:27 2015 : Debug: secret = "cht1000" Fri Jan 2 18:13:27 2015 : Debug: nastype = "other" Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: client 192.168.100.15 { Fri Jan 2 18:13:27 2015 : Debug: require_message_authenticator = no Fri Jan 2 18:13:27 2015 : Debug: secret = "cht1000" Fri Jan 2 18:13:27 2015 : Debug: shortname = "TP-Link" Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: radiusd: #### Instantiating modules #### Fri Jan 2 18:13:27 2015 : Debug: instantiate { Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_exec, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_exec Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "exec" from file /etc/freeradius/modules/exec Fri Jan 2 18:13:27 2015 : Debug: exec { Fri Jan 2 18:13:27 2015 : Debug: wait = no Fri Jan 2 18:13:27 2015 : Debug: input_pairs = "request" Fri Jan 2 18:13:27 2015 : Debug: shell_escape = yes Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_expr, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_expr Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_expiration, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_expiration Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration Fri Jan 2 18:13:27 2015 : Debug: expiration { Fri Jan 2 18:13:27 2015 : Debug: reply-message = "Password Has Expired " Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_logintime, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_logintime Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime Fri Jan 2 18:13:27 2015 : Debug: logintime { Fri Jan 2 18:13:27 2015 : Debug: reply-message = "You are calling outside your allowed timespan " Fri Jan 2 18:13:27 2015 : Debug: minimum-timeout = 60 Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: radiusd: #### Loading Virtual Servers #### Fri Jan 2 18:13:27 2015 : Debug: server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel Fri Jan 2 18:13:27 2015 : Debug: modules { Fri Jan 2 18:13:27 2015 : Debug: Module: Checking authenticate {...} for more modules to load Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_pap, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_pap Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "pap" from file /etc/freeradius/modules/pap Fri Jan 2 18:13:27 2015 : Debug: pap { Fri Jan 2 18:13:27 2015 : Debug: encryption_scheme = "auto" Fri Jan 2 18:13:27 2015 : Debug: auto_header = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_chap, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_chap Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_mschap, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_mschap Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap Fri Jan 2 18:13:27 2015 : Debug: mschap { Fri Jan 2 18:13:27 2015 : Debug: use_mppe = yes Fri Jan 2 18:13:27 2015 : Debug: require_encryption = no Fri Jan 2 18:13:27 2015 : Debug: require_strong = no Fri Jan 2 18:13:27 2015 : Debug: with_ntdomain_hack = no Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_unix, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_unix Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "unix" from file /etc/freeradius/modules/unix Fri Jan 2 18:13:27 2015 : Debug: unix { Fri Jan 2 18:13:27 2015 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: (Loaded rlm_eap, checking if it's valid) Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to module rlm_eap Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating module "eap" from file /etc/freeradius/eap.conf Fri Jan 2 18:13:27 2015 : Debug: eap { Fri Jan 2 18:13:27 2015 : Debug: default_eap_type = "md5" Fri Jan 2 18:13:27 2015 : Debug: timer_expire = 60 Fri Jan 2 18:13:27 2015 : Debug: ignore_unknown_eap_types = no Fri Jan 2 18:13:27 2015 : Debug: cisco_accounting_username_bug = no Fri Jan 2 18:13:27 2015 : Debug: max_sessions = 4096 Fri Jan 2 18:13:27 2015 : Debug: } Fri Jan 2 18:13:27 2015 : Debug: Module: Linked to sub-module rlm_eap_md5 Fri Jan 2 18:13:27 2015 : Debug: Module: Instantiating eap-md5 Fri Jan 2 18:13:27 2015 : Error: rlm_eap: Unknown EAP type cache Fri Jan 2 18:13:27 2015 : Error: /etc/freeradius/eap.conf[17]: Instantiation failed for module "eap" Fri Jan 2 18:13:27 2015 : Error: /etc/freeradius/sites-enabled/inner-tunnel[236]: Failed to load module "eap". Fri Jan 2 18:13:27 2015 : Error: /etc/freeradius/sites-enabled/inner-tunnel[189]: Errors parsing authenticate section. My configuration is the next : Freeradius Database : MySQL 2 NIC connected and configured. DHCP service ON and working for eth1. The access points are configured with WPA2 Enterprise security and i have given the radius server IP with the shared key. I have already tested the basic configuration of freeradius before testing with EAP-MD5 and it worked. If someone can help me about this... That'll help me a lot. Thanks in advance.

4 7

Radius Server and Radsecproxy Certificate problem
by Ankit Prajapati 04 Jan '15

04 Jan '15

I am trying to setup radsec using freeradius version 3.0.3. I have generated self-signed certificate on my freeradius server using openssl commands . I have generated CA ,client ,server. , and using same certificate for radsecProxy. 1) Running radsec on Access Point using following command: ./radsecproxy -f -c radsecproxy.conf 2) Running Radius sever on Ubuntu Machine using following command : radiusd -fxx -l stdout Now Radius Server and RadSec able to listen on port 2083 , but not able to make successful connection using TLS. Getting following error on Radsec: Jan 4 16:44:34 2015: tlsconnect: TLS: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Jan 4 16:44:36 2015: connecttcphostlist: trying to open TCP connection to 192.168.11.2 port 2083 Jan 4 16:44:36 2015: connecttcphostlist: TCP connection to 192.168.11.2 port 2083 up Jan 4 16:44:36 2015: verify error: num=19:self signed certificate in certificate chain:depth=1: Test Certificate Authority and on Radius Server getting following error: (0) Requiring client certificate (0) Initiate (0) (other): before/accept initialization (0) TLS_accept: before/accept initialization (0) <<< TLS 1.0 Handshake [length 00de], ClientHello (0) TLS_accept: SSLv3 read client hello A (0) >>> TLS 1.0 Handshake [length 003e], ServerHello (0) TLS_accept: SSLv3 write server hello A (0) >>> TLS 1.0 Handshake [length 08dd], Certificate (0) TLS_accept: SSLv3 write certificate A (0) >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (0) TLS_accept: SSLv3 write key exchange A (0) >>> TLS 1.0 Handshake [length 00a9], CertificateRequest (0) TLS_accept: SSLv3 write certificate request A (0) TLS_accept: SSLv3 flush data (0) TLS_accept: Need to read more data: SSLv3 read client certificate A (0) TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (0) <<< TLS 1.0 Alert [length 0002], fatal unknown_ca (0) ERROR: TLS Alert read:fatal:unknown CA (0) ERROR: TLS_accept: Failed in SSLv3 read client certificate A (0) ERROR: SSL says: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. (0) FAILED in TLS handshake receive Closing TLS socket from client port 46788 Client has closed connection ... shutting down socket auth from client (192.168.11.1, 46788) -> (*, 2083, virtual-server=default) Waking up in 0.9 seconds. How to resolve this ? -Regards Ankit

2 1

Publishing an EAP-TLS WPA2 Enterprise Setup Guide on the Wiki
by Jasvinder S. Bahra 03 Jan '15

03 Jan '15

Everyone, I've put together a step-by-step guide showing how to setup FreeRadius to provide a WPA2 Enterprise (EAP-TLS) secure wifi network. In addition, the guide shows how to get various clients onto the network (windows, android and apple devices). I would like to create a page on the official freeradius wiki for my guide, and place a link to it on the HOWTO (http://wiki.freeradius.org/guide/HOWTO) page. Does anyone know how I can gain permission to do so? (assuming permission is required) Or do I need to join the freeradius-developer list and ask there? If the guide would have to be vetted before hand - who would have to give the okay? (again, if required) If anyone can answer these questions, I would appreciate it. Regards, Jazz

5 5

Default Max-Daily-Session setting and per user setting
by Matej Žerovnik 02 Jan '15

02 Jan '15

Hello! I want to set up default Max-Daily-Session limit for all users to 1h and also have the ability to set up per-user Max-Daily-Session. How can I achieve that? I know I can set per-user limit in radcheck mysql table, but how can I set the default limit that will not overwrite per-user setting? Thanks, Matej -- --- Matej Zerovnik

3 4

Client derived CoA/DM home servers
by Arran Cudbard-Bell 02 Jan '15

02 Jan '15

In v3.0.x CoA/DM home servers may now be specified as part of a client definition. Previously a coa home_server could be associated with a client using the coa_server config pair to specify the name of a coa home_server or pool. This functionality is extended, so that if coa_server is specified as a config section a new coa home_server is created, and inherits pairs from the client definition. For example: client localhost { coa_server { port = 1700 zombie_period = 50 coa { irt = 10 } } ipaddr = 127.0.0.1 secret = testing123 } would add a home_server with the ipaddr 127.0.0.1 and the secret testing123 on port 1700, If no port is specified 3799 is used. An empty coa_server section may also be used if no values need to be altered. client localhost { coa_server { } ipaddr = 127.0.0.1 secret = testing123 } and values from the client definition can be overridden. client localhost { coa_server { secret = 123testing } ipaddr = 127.0.0.1 secret = testing123 } The coa_server section isn't restricted to clients.conf and should work fine with rlm_ldap and rlm_couchbase too. If there's demand for it a global knob can be added so that coa home_server definitions are added automatically for all clients. Client derived home_servers will conflict with home_servers defined in proxy.conf if two share the same type/port/ipaddr, but they won't conflict on name as they're unnamed. This also means they can't be referenced in pools. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

What exactly does it mean Socket Destructor failed
by Robert Graham 02 Jan '15

02 Jan '15

I have the proper access to log into the SQL server and I can remotely log into it through tsql and with the MS SQL linux instructions, and perform queries, but I cannot get freeradius for the life of me able to connect....it keeps erroring out with socket destructor called. rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to database "gensql" rlm_sql (sql): Initialising connection pool pool { start = 15 min = 10 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0) rlm_sql_unixodbc: Connection failed rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" [root@localhost raddb]# Robert Graham Network Engineer U-Haul International 2727 N. Central Ave Phoenix, AZ 85004

3 3

PAP and NT-hashed password
by sb 02 Jan '15

02 Jan '15

Hello! I'm trying to authenticate users from LDAP with FreeRadius by PAP protocol. Passwords are stored in LDAP in NT-hash. It's not my idea, I just have to do it. When I do radtest -t pap .... I see from freeradius -X: [pap] login attempt with password "n*******W" [pap] Using clear text password "1D******************************9B" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [user/n***********W] (from client localhost port 0) Using Post-Auth-Type Reject So, FreeRadius compares my clear-text password with NT-hash taken from LDAP. Of course they are mismatched and I got a reject. If I'm using this hash as a password, it works. At same time if I use mschap, it works well: radtest -t mschap ... +- entering group MS-CHAP {...} [mschap] Found LM-Password [mschap] Found NT-Password [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] returns ok So the question is: how to force PAP to create NT-hash from the given password and compare hash and hash. but not the password and hash? Thank you!

4 14

Authentication fails. Used freeradius 2.2.5, coova-chilli 1.3.0 mysql
by Krishnan V R 31 Dec '14

31 Dec '14

Hi, I am using freeradius version 2.2.5, coova-chilli version 1.3.0 and mysql. The user login and password information were stored in the sql. The authentication fails for the valid user. The complete freeradius log is given below. Please help. radiusd: FreeRADIUS Version 2.2.5, for host x86_64-unknown-linux-gnu, built on Dec 24 2014 at 04:59:14 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/cache including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radrelay including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/redis including configuration file /usr/local/etc/raddb/modules/rediswho including configuration file /usr/local/etc/raddb/modules/replicate including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/soh including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/sqlippool.conf including configuration file /usr/local/etc/raddb/sql/postgresql/ippool.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "welcome" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ?»?? modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/huntgroups reading pairlist file /usr/local/etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /usr/local/etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "azsxikol" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /usr/local/etc/raddb/users reading pairlist file /usr/local/etc/raddb/acct_users reading pairlist file /usr/local/etc/raddb/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Instantiating module "sradutmp" from file /usr/local/etc/raddb/modules/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 420 callerid = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 58839 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 45156, id=38, length=286 ChilliSpot-Version = "1.3.0" User-Name = "woi" CHAP-Challenge = 0x57a121d3c0fa04419ad858b70deb782e CHAP-Password = 0x0000000000000000000000000000000000 Service-Type = Login-User Acct-Session-Id = "54a3bb0e00000001" Framed-IP-Address = 10.1.0.5 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" Calling-Station-Id = "BC-77-37-81-1A-0A" Called-Station-Id = "AC-7F-3E-E7-0F-91" NAS-IP-Address = 10.1.0.1 NAS-Identifier = "nas01" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova," WISPr-Location-Name = "My_HotSpot" WISPr-Logoff-URL = "http://10.1.0.1:3990/logoff" Message-Authenticator = 0x4c69e8ee7c3a71417c17ecdb86182f61 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok [chap] Setting 'Auth-Type := CHAP' ++[chap] = ok ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "woi", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop [sql] expand: %{User-Name} -> woi [sql] sql_set_user escaped user --> 'woi' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'woi' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'woi' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'woi' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'woi' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'woi' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'woi' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'crew' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'crew' ORDER BY id [sql] User found in group crew [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'crew' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'crew' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = ok Found Auth-Type = CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group CHAP { [chap] login attempt by "woi" with CHAP password [chap] Using clear text password "welcome" for user woi authentication. [chap] Password check failed ++[chap] = reject +} # group CHAP = reject Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> woi attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 38 to 127.0.0.1 port 45156 Waking up in 4.9 seconds. Cleaning up request 0 ID 38 with timestamp +100 Ready to process requests. Best Regards Krishnan

4 5

FreeRadius 3 crashing when roaming accounting info
by Rui Ribeiro 31 Dec '14

31 Dec '14

Hi all, I had yesterday to disable the sufix instruction when roaming accounting because it was making it crash. This server in particular is using the latest code from git FR 3 as per yesterday. Will this affect the new release? I have not yet had the time to test this in particular, will try my best to send more data later on Regards -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

2 1

freeradius problem - ephemeral RSA key generation
by Kapetanakis Giannis 31 Dec '14

31 Dec '14

Hi, I had a specific problem running freeradius 2.2.5/2.2.6 in OpenBSD. rlm_eap_tls: Couldn't set ephemeral RSA key rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" After playing around with the source I've managed to make it work by doing: --- ./src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c Tue Nov 18 21:56:52 2014 +++ /root/rlm_eap_tls.c Wed Dec 31 10:55:43 2014 @@ -203,10 +203,16 @@ RSA *rsa; rsa = RSA_generate_key(512, RSA_F4, NULL, NULL); - - if (!SSL_CTX_set_tmp_rsa(ctx, rsa)) { - radlog(L_ERR, "rlm_eap_tls: Couldn't set ephemeral RSA key"); + if (rsa == NULL) { + radlog(L_ERR, "rlm_eap_tls: Couldn't generate RSA key"); return -1; + } + + if (SSL_CTX_need_tmp_RSA(ctx)) { + if (!SSL_CTX_set_tmp_rsa(ctx, rsa)) { + radlog(L_ERR, "rlm_eap_tls: Couldn't set ephemeral RSA key"); + return -1; + } } RSA_free(rsa); Maybe a check for SSL_CTX_need_tmp_RSA should be added before calling SSL_CTX_set_tmp_rsa? You can also read the relevant thread in OpenBSD mailing list here http://marc.info/?l=openbsd-misc&m=141996016020120&w=2 thanks for any comments on this, Giannis -------- Forwarded Message -------- Subject: Re: freeradius problem - ephemeral RSA key generation Date: Wed, 31 Dec 2014 10:39:17 +0200 To: misc(a)openbsd.org On 31/12/14 04:37, Joel Sing wrote: > On Wednesday 31 December 2014, Kapetanakis Giannis wrote: >> Hi, >> >> After upgrading to latest snapshot I have problems with freeradius 2.2.5 >> package not starting. >> >> Especially the problem occurs in loading of module eap-tls >> >> rlm_eap_tls: Couldn't set ephemeral RSA key >> rlm_eap: Failed to initialize type tls >> /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" >> >> I've tried installing version 2.2.6 but I have the same problem. >> >> The program fails at: >> src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c >> >> /* >> * Generate ephemeral RSA keys. >> */ >> static int generate_eph_rsa_key(SSL_CTX *ctx) >> { >> RSA *rsa; >> >> rsa = RSA_generate_key(512, RSA_F4, NULL, NULL); >> >> if (!SSL_CTX_set_tmp_rsa(ctx, rsa)) { >> radlog(L_ERR, "rlm_eap_tls: Couldn't set ephemeral RSA key"); >> return -1; >> } >> >> RSA_free(rsa); >> return 0; >> } >> >> is this related to freeradius or something with OpenBSD ssl libraries? > Support for ephemeral RSA keys was removed from LibreSSL, since it should only > be needed for export ciphers (no longer supported) or otherwise violating > RFCs (as at first glance FreeRADIUS appears to do above). > > Since you're already looking at the code, does it set SSL_OP_EPHEMERAL_RSA > anywhere? If not, the above function is probably a noop. At the very least it > is likely buggy since they are supposed to call SSL_CTX_need_tmp_RSA() to see > if the temporary RSA key should be set, before calling SSL_CTX_set_tmp_rsa(). > Well I've already made it working last night by adding a check for SSL_CTX_need_tmp_RSA before calling SSL_CTX_set_tmp_rsa So if I get it right, since I'm using HIGH ciphersuite I will never need an ephemeral RSA key correct? Is there a case were that SSL_CTX_need_tmp_RSA() will be true? SSL_OP_EPHEMERAL_RSA is not defined anywhere. G

2 1