- Freeradius-Users - lists.freeradius.org

Use Mozilla's intermediate cipher suites set by default.
by Nick Lowe 19 Nov '14

19 Nov '14

Alan and Arran, Please may I suggest that you consider changing the default cipher suites configuration in FreeRADIUS 2.x and 3.x to use Mozilla's intermediate compatibility (default) set to encourage the use of better cipher suites that use ECDHE, GCM and PFS? See https://wiki.mozilla.org/Security/Server_Side_TLS This is: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA This is fully compatible all the way back to Windows XP where 3DES will be used. It also brings FreeRADIUS in to compliance with the very likely upcoming: https://datatracker.ietf.org/doc/draft-ietf-tls-prohibiting-rc4/ Cheers, Nick

3 11

mac address in data vlan - drop
by Bilik.AA＠lsrgroup.ru 19 Nov '14

19 Nov '14

Hello everybody! I faced such issue. When I connect CiscoPhone and a computer through it to my cisco switch port, authentication goes well (voice vlan for phone and data vlan for computer), but when I plug a computer off from Cisco Phone and plug in again, authentication is ok too but on port I see that: 1 a000xxxxxxxxxxxx DYNAMIC Drop 100 001exxxxxxxxxxxx STATIC Fa0/35 So computer can’t get access to local network. Port settings are following: --------------------------------------------------------- switchport mode access switchport nonegotiate switchport voice vlan 100 no logging event link-status authentication host-mode multi-domain authentication port-control auto authentication violation replace mab storm-control broadcast level pps 100 spanning-tree portfast spanning-tree bpduguard enable --------------------------------------------------------- How it can be fixed? (I work with freeradius-server-2.2.5 now) Thanks in advance, Alex Bilik С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image003.png@01D003E7.42ED21B0]

2 1

Version 2.2.6 has been released.
by Alan DeKok 18 Nov '14

18 Nov '14

We're happy to announce the release of Version 2.2.6. It has only minor changes from Version 2.2.5. ----------------- Feature improvements * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. Bug Fixes * Fix redundant-load-balance blocks to try other modules in the group if one fails. * Fix potential read into uninitialised memory in rlm_pap when normalising octet type attributes containing password hashes. This is very unlikely to happen in the wild. * Don't stop decoding DHCP options if we find a padding option. * Define sig_t on systems which don't have it. Closes #765 * When clients are loaded from SQL, allow them to be tied to a virtual server. * Prevent race conditions between fork and wait for child. Patch from James Rouzier. * Allow UTF-8 characters in SQL. * Back-port udpfromto fixes from v3

1 0

Update 3.0.4 to 3.0.x syntax surprises / bugs?
by Stefan Winter 17 Nov '14

17 Nov '14

Hi, some things to note: 1) one of my client definitions has an opening parenthesis in its secret (no closing), which is not a problem for 3.0.4, but in current 3.0.x I get: /usr/local/freeradius/config/raddb/clients.conf[655]: Parse error after "sdfsre": unexpected token "(" Errors reading or parsing /usr/local/freeradius/config/raddb/radiusd.conf sdfsre are the characters of the secret preceding the ( . Should such a secret now be surrounded by quotes, or is that more like a bug? 2) When running, I see that SQL queries are getting executed correctly (I see the retrieved AVPs), but the section still bails out with Query Error (and the exact same config works fine in 3.0.4). Here's a sample: rlm_sql (sql-commonauth): Reserved connection (4) (35) sql-commonauth: EXPAND (SELECT id, username, attribute, value, op FROM %{control:RESTENA-SQL-Table} WHERE username='%{SQL-User-Name}') (35) sql-commonauth: --> (SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='xxxcensoredxxx') rlm_sql (sql-commonauth): Executing query: '(SELECT id, username, attribute, value, op FROM check_imap_ssha1 WHERE username='xxxcensoredxxx')' (35) sql-commonauth: User found in radcheck table (35) sql-commonauth: Conditional check items matched, merging assignment check items (35) sql-commonauth: RESTENA-SSHA1-Password := 'XXXV4iX9qSO8BcMxDJ6P0FNINVALIDQ1MGo1ZmNuZXJoVzWXXX==' (35) sql-commonauth: ERROR: SQL query error rlm_sql (sql-commonauth): Released connection (4) (I changed username and retrieved hash in the mail) I couldn't continue testing 3.0.x with that situation, so I'm back to 3.0.4 for now. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 4

Freeradius v2 Style Auth Log for V3 How to
by Akash 17 Nov '14

17 Nov '14

I'm using Freeradius-3.0.4, and see lots of following messages in 'radius.log' file whenever user connects/disconnects. Info: rlm_sql (sql): Closing connection (18): Hit idle_timeout, was idle for 300 second Warning: rlm_sql (sql): You probably need to lower "min" Info: rlm_sql (sql): 0 of 2 connections in use. Need more spares Info: rlm_sql (sql): Opening additional connection (21) Is there way to disable such messages, and only output Login OK, Login Failure messages, same like in version 2. Thanks

2 1

3.0.5 segmentation fault
by Lai Fu Keung 17 Nov '14

17 Nov '14

Hi, I would like to report a segmentation fault in using v3.0.5. My server syslog has the following message: Nov 14 18:18:33 machine-a kernel: radiusd[7198]: segfault at 108 ip 00007f63a5a3c023 sp 00007f639e4a9c80 error 4 in libfreeradius-server.so[7f63a5a2e000+23000] The daemon has been running for 5 days before segmentation fault and was running fine. There was no error message on radius.log except a "login OK" message right at Nov 14 18:18:33 segmentation fault time. The authentication fell back to secondary server. Hope the information is enough to trace the source of the problem. Thanks in advance. Lai

2 1

Configuring ssl-admin to include windows OIDs in the server cert
by Jasvinder S. Bahra 17 Nov '14

17 Nov '14

Hi, I've used the ssl-admin tool to generate a certificate authority certificate, a server certificate and multiple client certificates - all used to setup a FreeRadius EAP-TLS WPA2 Enterprise secured wireless network. Android devices connect to the network without any problems, but windows devices connections requests never even get passed to the freeradius daemon. After looking around on the internet as well as asking some questions on this list, I understand I have to embed the XP Extensions OIDs into the server certificate (something I have to do when actually creating the server certificate). I've found information on how to do this using the openssl command, but as i'm using the ssl-admin tool to handle certificate creation, I need to make it do the same. Has anyone had any experience in doing this? Regards, Jazz

2 1

Freeradius Active Directory Authentication using ntlm_auth
by Shyju Kanaprath 16 Nov '14

16 Nov '14

Hi All, I'm trying to configure Freeradius Active Directory Authentication using ntlm_auth.When I run from the shell I could get the positive response. ntlm_auth --username shyju --passwordPassword:NT_STATUS_OK: Success (0x0) But when I test with the radtest authentication does not work. Please Find below the logs. Client - Sideradtest shyju password localhost 0 testing123 Sending Access-Request of id 125 to 127.0.0.1 port 1812 User-Name = "shyju" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=125, length=20 Server-Side rad_recv: Access-Request packet from host 127.0.0.1 port 60581, id=253, length=131 User-Name = "shyju" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x0156cd3b06a063bf8c9dee41dca40c37 MS-CHAP-Challenge = 0x3b41e041947f5126 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000003d43a50a42ac1c73b4beeab62bfba628013e7764d8651047# Executing section authorize from file /etc/freeradius/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'++[mschap] returns ok++[digest] returns noop[suffix] No '@' in User-Name = "shyju", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] No EAP-Message, not doing EAP++[eap] returns noop++[files] returns noop++[expiration] returns noop++[logintime] returns noop[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.++[pap] returns noopFound Auth-Type = MSCHAP# Executing group from file /etc/freeradius/sites-enabled/default+- entering group MS-CHAP {...}[mschap] Told to do MS-CHAPv1 with NT-Password[mschap] expand: %{Stripped-User-Name} ->[mschap] ... expanding second conditional[mschap] expand: %{User-Name} -> shyju[mschap] expand: %{%{User-Name}:-None} -> shyju[mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=shyju[mschap] No NT-Domain was found in the User-Name.[mschap] expand: %{mschap:NT-Domain} ->[mschap] ... expanding second conditional[mschap] expand: --domain=%{%{mschap:NT-Domain}:-DOMAIN.LOCAL} -> --domain=DOMAIN.LOCAL[mschap] mschap1: 3b[mschap] expand: %{mschap:Challenge} -> 3b41e041947f5126[mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=3b41e041947f5126[mschap] expand: %{mschap:NT-Response} -> 3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047[mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047Exec-Program output: Reading winbind reply failed! (0xc0000001)Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001)Exec-Program: returned: 1[mschap] External script failed.[mschap] MS-CHAP-Response is incorrect.++[mschap] returns rejectFailed to authenticate the user.Using Post-Auth-Type Reject# Executing group from file /etc/freeradius/sites-enabled/default+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> shyjuattr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 2 for 1 secondsGoing to the next requestWaking up in 0.8 seconds.Sending delayed reject for request 2Sending Access-Reject of id 253 to 127.0.0.1 port 60581 MS-CHAP-Error = "\000E=691 R=1"Waking up in 4.9 seconds.Cleaning up request 2 ID 253 with timestamp +73Ready to process requests. _______ Regards, Shyju

4 7

Redundant expansions?
by Alan DeKok 15 Nov '14

15 Nov '14

So.. should redundant expansions go into 3.0.5? They would work like this: instantiate { ... redundant-load-balance my_sql { sql1 sql2 sql3 } } You can already use "my_sql" in the "authorize" section, which is nice. This feature would allow you to use "my_sql" in expansions: update reply { Filter-Id := "%{my_sql:SELECT ...}" } The server core will automatically find *one* of the listed modules (sql1, sql2, or sql3), and call it. This feature has long been requested,and it's finally in the "master" branch. The question is whether it should go into the 3.0.5 release. Since the connection pools now support a "retry_delay" parameter, the cost of querying a "down" SQL server is essentially zero. In v2, the server would usually try to reconnect to SQL for evcery request. In v3, the "retry_delay" makes the "redundant-load-balance" blocks more useful. SQL servers which are down are effectively remove from the redundant list, until "retry_delay" seconds have passed. These changes increase the performance of the server, and make problems much less notable. Alan DeKok.

2 2

Plans for the next few releases
by Alan DeKok 14 Nov '14

14 Nov '14

We're continuing to develop the server, so I'd like to clarify the policy around releases. Version 2.2.x: Long term stable release. No new features. Minor bug fixes. The goal is long-term stability. We will maintain it 2-3 years. Version 3.0.x: Version 3 stable release Minor new features Focus on bug fixes and stability Will maintain it for 4-5 years Version 3.1: unstable new development Major new features Major re-architecture of the server core Which version should you use? That depends on what you have now, and what you need: * basic RADIUS and running 1.x: UPGRADE NOW * basic RADIUS and running version 2: should use 2.2.x * need better "unlang", error checking, SNMP triggers, RadSec: 3.0.x * experimental new work: bleeding edge 3.1. Arran and I have started announcing new features to this list, as the features are implemented. We'll keep doing that for the 3.1 branch. And probably stop doing new features in 3.0. We've had issues with 3.0 stability (sorry). A good part of that was problems with talloc. The documentation says one thing, but the code does something else. So that made life difficult for a while. The work of the last few months has made 3.0.4 very stable. The bug fixes for 3.0.5 are minor, and ensure that all of the "corner cases" are handled correctly. Now that we have a stable version of 3.0, we can start re-working the "master" branch for 3.1. We have a long list of new features, many of which require re-architecture. We don't want to break 3.0, so those features require a new version. Alan DeKok.

2 3