- Freeradius-Users - lists.freeradius.org

Freeradius 2.1.12-6 test issue
by Clive Allen 19 Nov '14

19 Nov '14

3 3

RE: mac address in data vlan - drop
by Alan Buxey 19 Nov '14

19 Nov '14

Cisco issue. Freeradius is sending back access-accept. Your issue sounds familiar to something I've seen with pass through before. Verify the behaviour with a change to the auth type on the switch eg multi-host alan

1 0

Use Mozilla's intermediate cipher suites set by default.
by Nick Lowe 19 Nov '14

19 Nov '14

Alan and Arran, Please may I suggest that you consider changing the default cipher suites configuration in FreeRADIUS 2.x and 3.x to use Mozilla's intermediate compatibility (default) set to encourage the use of better cipher suites that use ECDHE, GCM and PFS? See https://wiki.mozilla.org/Security/Server_Side_TLS This is: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA This is fully compatible all the way back to Windows XP where 3DES will be used. It also brings FreeRADIUS in to compliance with the very likely upcoming: https://datatracker.ietf.org/doc/draft-ietf-tls-prohibiting-rc4/ Cheers, Nick

3 11

mac address in data vlan - drop
by Bilik.AA＠lsrgroup.ru 19 Nov '14

19 Nov '14

Hello everybody! I faced such issue. When I connect CiscoPhone and a computer through it to my cisco switch port, authentication goes well (voice vlan for phone and data vlan for computer), but when I plug a computer off from Cisco Phone and plug in again, authentication is ok too but on port I see that: 1 a000xxxxxxxxxxxx DYNAMIC Drop 100 001exxxxxxxxxxxx STATIC Fa0/35 So computer can’t get access to local network. Port settings are following: --------------------------------------------------------- switchport mode access switchport nonegotiate switchport voice vlan 100 no logging event link-status authentication host-mode multi-domain authentication port-control auto authentication violation replace mab storm-control broadcast level pps 100 spanning-tree portfast spanning-tree bpduguard enable --------------------------------------------------------- How it can be fixed? (I work with freeradius-server-2.2.5 now) Thanks in advance, Alex Bilik С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image003.png@01D003E7.42ED21B0]

2 1

Version 2.2.6 has been released.
by Alan DeKok 18 Nov '14

18 Nov '14

We're happy to announce the release of Version 2.2.6. It has only minor changes from Version 2.2.5. ----------------- Feature improvements * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. Bug Fixes * Fix redundant-load-balance blocks to try other modules in the group if one fails. * Fix potential read into uninitialised memory in rlm_pap when normalising octet type attributes containing password hashes. This is very unlikely to happen in the wild. * Don't stop decoding DHCP options if we find a padding option. * Define sig_t on systems which don't have it. Closes #765 * When clients are loaded from SQL, allow them to be tied to a virtual server. * Prevent race conditions between fork and wait for child. Patch from James Rouzier. * Allow UTF-8 characters in SQL. * Back-port udpfromto fixes from v3

1 0

Update 3.0.4 to 3.0.x syntax surprises / bugs?
by Stefan Winter 17 Nov '14

17 Nov '14

Hi, some things to note: 1) one of my client definitions has an opening parenthesis in its secret (no closing), which is not a problem for 3.0.4, but in current 3.0.x I get: /usr/local/freeradius/config/raddb/clients.conf[655]: Parse error after "sdfsre": unexpected token "(" Errors reading or parsing /usr/local/freeradius/config/raddb/radiusd.conf sdfsre are the characters of the secret preceding the ( . Should such a secret now be surrounded by quotes, or is that more like a bug? 2) When running, I see that SQL queries are getting executed correctly (I see the retrieved AVPs), but the section still bails out with Query Error (and the exact same config works fine in 3.0.4). Here's a sample: rlm_sql (sql-commonauth): Reserved connection (4) (35) sql-commonauth: EXPAND (SELECT id, username, attribute, value, op FROM %{control:RESTENA-SQL-Table} WHERE username='%{SQL-User-Name}') (35) sql-commonauth: --> (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='xxxcensoredxxx') rlm_sql (sql-commonauth): Executing query: '(SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='xxxcensoredxxx')' (35) sql-commonauth: User found in radcheck table (35) sql-commonauth: Conditional check items matched, merging assignment check items (35) sql-commonauth: RESTENA-SSHA1-Password := 'XXXV4iX9qSO8BcMxDJ6P0FNINVALIDQ1MGo1ZmNuZXJoVzWXXX==' (35) sql-commonauth: ERROR: SQL query error rlm_sql (sql-commonauth): Released connection (4) (I changed username and retrieved hash in the mail) I couldn't continue testing 3.0.x with that situation, so I'm back to 3.0.4 for now. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 4

Freeradius v2 Style Auth Log for V3 How to
by Akash 17 Nov '14

17 Nov '14

I'm using Freeradius-3.0.4, and see lots of following messages in 'radius.log' file whenever user connects/disconnects. Info: rlm_sql (sql): Closing connection (18): Hit idle_timeout, was idle for 300 second Warning: rlm_sql (sql): You probably need to lower "min" Info: rlm_sql (sql): 0 of 2 connections in use. Need more spares Info: rlm_sql (sql): Opening additional connection (21) Is there way to disable such messages, and only output Login OK, Login Failure messages, same like in version 2. Thanks

2 1

3.0.5 segmentation fault
by Lai Fu Keung 17 Nov '14

17 Nov '14

Hi, I would like to report a segmentation fault in using v3.0.5. My server syslog has the following message: Nov 14 18:18:33 machine-a kernel: radiusd[7198]: segfault at 108 ip 00007f63a5a3c023 sp 00007f639e4a9c80 error 4 in libfreeradius-server.so[7f63a5a2e000+23000] The daemon has been running for 5 days before segmentation fault and was running fine. There was no error message on radius.log except a "login OK" message right at Nov 14 18:18:33 segmentation fault time. The authentication fell back to secondary server. Hope the information is enough to trace the source of the problem. Thanks in advance. Lai

2 1

Configuring ssl-admin to include windows OIDs in the server cert
by Jasvinder S. Bahra 17 Nov '14

17 Nov '14

Hi, I've used the ssl-admin tool to generate a certificate authority certificate, a server certificate and multiple client certificates - all used to setup a FreeRadius EAP-TLS WPA2 Enterprise secured wireless network. Android devices connect to the network without any problems, but windows devices connections requests never even get passed to the freeradius daemon. After looking around on the internet as well as asking some questions on this list, I understand I have to embed the XP Extensions OIDs into the server certificate (something I have to do when actually creating the server certificate). I've found information on how to do this using the openssl command, but as i'm using the ssl-admin tool to handle certificate creation, I need to make it do the same. Has anyone had any experience in doing this? Regards, Jazz

2 1

Freeradius Active Directory Authentication using ntlm_auth
by Shyju Kanaprath 16 Nov '14

16 Nov '14

Hi All, I'm trying to configure Freeradius Active Directory Authentication using ntlm_auth.When I run from the shell I could get the positive response. ntlm_auth --username shyju --passwordPassword:NT_STATUS_OK: Success (0x0) But when I test with the radtest authentication does not work. Please Find below the logs. Client - Sideradtest shyju password localhost 0 testing123 Sending Access-Request of id 125 to 127.0.0.1 port 1812 User-Name = "shyju" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=125, length=20 Server-Side rad_recv: Access-Request packet from host 127.0.0.1 port 60581, id=253, length=131 User-Name = "shyju" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x0156cd3b06a063bf8c9dee41dca40c37 MS-CHAP-Challenge = 0x3b41e041947f5126 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000003d43a50a42ac1c73b4beeab62bfba628013e7764d8651047# Executing section authorize from file /etc/freeradius/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'++[mschap] returns ok++[digest] returns noop[suffix] No '@' in User-Name = "shyju", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] No EAP-Message, not doing EAP++[eap] returns noop++[files] returns noop++[expiration] returns noop++[logintime] returns noop[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.++[pap] returns noopFound Auth-Type = MSCHAP# Executing group from file /etc/freeradius/sites-enabled/default+- entering group MS-CHAP {...}[mschap] Told to do MS-CHAPv1 with NT-Password[mschap] expand: %{Stripped-User-Name} ->[mschap] ... expanding second conditional[mschap] expand: %{User-Name} -> shyju[mschap] expand: %{%{User-Name}:-None} -> shyju[mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=shyju[mschap] No NT-Domain was found in the User-Name.[mschap] expand: %{mschap:NT-Domain} ->[mschap] ... expanding second conditional[mschap] expand: --domain=%{%{mschap:NT-Domain}:-DOMAIN.LOCAL} -> --domain=DOMAIN.LOCAL[mschap] mschap1: 3b[mschap] expand: %{mschap:Challenge} -> 3b41e041947f5126[mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=3b41e041947f5126[mschap] expand: %{mschap:NT-Response} -> 3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047[mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047Exec-Program output: Reading winbind reply failed! (0xc0000001)Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001)Exec-Program: returned: 1[mschap] External script failed.[mschap] MS-CHAP-Response is incorrect.++[mschap] returns rejectFailed to authenticate the user.Using Post-Auth-Type Reject# Executing group from file /etc/freeradius/sites-enabled/default+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> shyjuattr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 2 for 1 secondsGoing to the next requestWaking up in 0.8 seconds.Sending delayed reject for request 2Sending Access-Reject of id 253 to 127.0.0.1 port 60581 MS-CHAP-Error = "\000E=691 R=1"Waking up in 4.9 seconds.Cleaning up request 2 ID 253 with timestamp +73Ready to process requests. _______ Regards, Shyju

4 7