- Freeradius-Users - lists.freeradius.org

A new CRL processing
by vincent viard 29 Oct '14

29 Oct '14

Hi, I just want to know if the following statement is always true: "You will still need to restart FreeRADIUS after downloading a new CRL" Thanks Vince

4 3

802.1X Radius with Yubikey
by Philip Wege 29 Oct '14

29 Oct '14

Hi All Has anyone managed to get yubikeys to work with wireless network access using yubikeys ? I'm trying to get 802.1x to work with yubikeys using freeraduis 3, local user in the users file and the yubikey module. I'm constantly running into the same error which is shown below: yubikey : No cleartext password in the request. Can't do Yubikey authentication Default eap type is peap and default eap type under peap is gtc and gtc auth type is pap I'm testing with a user defined in the users file and I'm trying authorize and authenticate as shown below in the inner tunnel: Authorize : eap if (ok || updated) { yubikey files } else { reject ( This is so that if no yubikey is submitted along with password radius should reject the auth * this works in default when authing vpn access under the yubikey authorize * ) } Authenticate : Auth-Type PAP { yubikey pap } I have tried defining a separate auth type like suggested in a previous mailing list post but startup kept on failing with error unknown auth type for eap_gtc yubikey when trying to do this: Auth-Type yubikey { yubikey pap }

2 2

server.thread.start not triggered on startup
by Nikolai Kondrashov 29 Oct '14

29 Oct '14

Hi everyone, I see that the v3.0.x code doesn't fire the server.thread.start trigger on startup (in thread_pool_init), but only during runtime (in thread_pool_manage). Is this done to avoid a burst of triggers on startup for installations with large thread number? Something else? Thank you. Nick

2 1

Fwd: FR 3.0.x Head + coova chilli + mysql Volume Limit
by Abdullah 29 Oct '14

29 Oct '14

Remaining 2 logs

1 0

reaped processes still timing out in rad_waitpid
by Louis Munro 28 Oct '14

28 Oct '14

Hello, I have hit upon a case where some ntlm_auth processes would return (and write the NT_KEY to the connecting pipe) but FR still complains that it failed and denies authentication (this is on 2.2.5). This manifests in the logs like the following: Tue Oct 28 11:10:15 2014 : Auth: Login incorrect (mschap: External script says NT_KEY: 4BCE6CA72058BA7EE500D1A68A8771C0): [tstRad9] (from client 155.98.204.47 port 0 cli 02-00-00-00-00-01 via TLS tunnel) Since this is actually the output for a valid and successful authentication, it appears that the exit code is the real issue. That exit code is either that of the process itself or 2 if rad_waitpid times out while waiting for the child. After adding some debugging statements and recompiling I found that there were cases where reap_children would reap a child process but the pid would not be found in thread_pool.waiters. This only happened when there were a significant number of auths per seconds and still not consistently. Some head scratching ensued and a colleague then suggested there may be a race condition between rad_fork (where it calls fr_hash_table_insert) and reap_children (where it calls fr_hash_table_finddata). So I wrote a quick patch which I submit to your consideration. It adds the pid to the hash table if not found. In our (admittedly limited) tests this has fixed the issue. No more ntlm_auth waiting ten seconds before timing out. I don't claim for this patch to be perfect. For one thing it causes an error to be logged by rad_fork (" Failed to store PID, creating what will be a zombie process") when the pid is added to the hash table in reap_children. There may be better ways to do this, perhaps simply with better locking in rad_fork. This is only meant as a fix while the issue is discussed and improved upon. Regards, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 1

Radius management tool (RadiusClock)
by Shawn Wiley 28 Oct '14

28 Oct '14

Has anyone played with this or know of anything better? http://www.ane-solutions.com/getting-started RADIUSClock is a web based interface to configure, monitor and report on freeRADIUS server. It is available as a virtual appliance packaged with * CENTOS 5.5 * MySQL server 5.5.8 * freeradius server 2.1.10 * jdk1.6.0_23 * apache tomcat 7.0.6 * A web application "rclock" to configure RADIUS and generate reports. Features * Easy setup & configuration, No installation is required. * Simple user interface to configure clients, users, groups, radreply, radgroupcheck, radgroupreply * RADIUS Reports - Auth, Acct, Sessions, Summary, Auth Trend, Unique Users/Endpoints/IP Addr/NADs and Usage Summary * Dashboard - Provides Summary, Auth Trend chart, Top 10 Users/NADs * Automatic Data Management for reports. * Highly customizable UI based on user roles ________________________________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), Euronext or any of their subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired. ________________________________________________________

2 1

FreeBSD+FreeRadius 10k subscribers
by Antonio Nunnes 28 Oct '14

28 Oct '14

I have on average 5k a day online subscribers. My freeradius and mysql-server: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz 2*4GB DDR3 1333MHz 3*1TB SAMSUNG BLUE in RAID 0 Mysql: mysql Ver 14.14 Distrib 5.5.40, for FreeBSD10.1 (amd64) using 5.2 My problem : My radacct now has 17 million lines, while the freeradius starts closing sessions begins to lock the table radacct and processing mysql rises too. I thought I'd share the radacct in radacct __% Y_% M has any better solutions? Sorry my bad english, Antonio Nunness

2 1

remove blank space in realm
by Rando Nakarmi 28 Oct '14

28 Oct '14

how to I remove blanks from the realm ? like, 'fiscal.edu ' after the edu Login incorrect (Home Server says so): [fiscal(a)fiscal.edu /<no User-Password attribute> After adding this I get : if ("%{request:User-Name}" =~ /^(.+)(a)(.+)\\s$/) { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } } Login incorrect (mschap: External script says Logon failure (0xc000006d)): fiscal/<via Auth-Type = EAP>] (from client TLS tunnel) i get / after username still no luck!!!

2 1

OS and Freeradius
by Service Technique AreA 28 Oct '14

28 Oct '14

Hello, I have a server with freeradius v1.x I took a test server to test an OS update with a new version of freeradius. The stable version of freeradius is 2.2.5? What OS do you recommend? Ubuntu 14.04 LTS or Debian 7? 32 or 64 bit? Is it more difficult to move from version 1 to version 2.2.5? I use Freeradius to a Hotspot system. I Wi-Fi routers with integrated Chillispot (dd-wrt) and routers are connected to the box of customers Kind regards

3 3

EAP-TLS fails with 'TLS Alert read:fatal:bad certificate'
by Tabor Kelly 28 Oct '14

28 Oct '14

I'm trying to setup an EAP-TLS network with freeradius-server-2.2.5. I am using the example simple configuration with the username bob, password hello, and the sample server/client certificates that were generated in /usr/local/etc/raddb/certs. Authentication is failing with the following output: rad_recv: Access-Request packet from host 127.0.0.1 port 35906, id=101, length=188 User-Name = "bob" Called-Station-Id = "00-1A-EF-41-E2-2E:UBUNTU-TABOR" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "34-23-87-00-14-3F" Connect-Info = "CONNECT 11Mbps 802.11b" Acct-Session-Id = "544EC2A6-00000015" Framed-MTU = 1400 EAP-Message = 0x0250000d0d001503010002022a State = 0x45e158e041b155dbff559d4ce378d770 Message-Authenticator = 0xd1b7786e651558d6c517f695892a9827 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 80 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry bob at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Just to clarify: does this mean that freeradius didn't like the certificate that the client sent? Thank you, Tabor

2 1