- Freeradius-Users - lists.freeradius.org

Poodle and EAP?
by Stefan Winter 20 Oct '14

20 Oct '14

Hi, catching up after being out of office when "Poodle" arrived. I'm wondering if FreeRADIUS is strictly enforcing TLS 1.0+ when negotiating a PEAP/TTLS tunnel. And if not, how to make it so :-) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

5 7

radius server stopped receiving request
by Khapare Joshi 20 Oct '14

20 Oct '14

Hi, I have two freeradius server. Both of them were working well until. But one the server stopped receiving auth request. I stopped the radius server and run in debug mode, radiusd -X then all I get is below: Request are coming but looks it is expanding the detail file then sends the Sending Accounting-Response of id 26 to 192.168.1.1 port 32770 and nothing else. How do I fix this so my second server start processing users request and authenticate them :? # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok expand: %{Acct-Session-Time} -> 8 expand: %{Acct-Delay-Time} -> 0 expand: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0} -> 1413805547 - 8 - 0 expand: %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} -> 1413805539 ++[request] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 192.168.1.1,NAS-IP-Address = 192.168.1.1,Acct-Session-Id = "5444f5e2/dc:86:d8:23:03:0d/290270",User-Name = "carpæ"' [acct_unique] Acct-Unique-Session-ID = "f1f7ece2e5e57147". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "carlol", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "carol" [suffix] Adding Realm = "NULL" [suffix] Accounting realm is LOCAL. ++[suffix] returns ok [files] acct_users: Matched entry DEFAULT at line 22 [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: %{Framed-IP-Address:-%{NAS-IP-Address}} -> 192.168.5.2 ++[files] returns ok # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> 192.168.1.1 [detail] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.1/detail-20141020 [detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.1/detail-20141020 [detail] expand: %t -> Mon Oct 20 11:45:47 2014 ++[detail] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> carol attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 26 to 192.168.1.1 port 32770 Finished request 62. Cleaning up request 62 ID 26 with timestamp +5 Going to the next request Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.1.1 port 32770, id=27, length=264 User-Name = "jebish" NAS-Port = 1 NAS-IP-Address = 192.168.1.1 Framed-IP-Address = 192.168.5.9 NAS-Identifier = "hinet-wlc00-hbio" Airespace-Wlan-Id = 300 Acct-Session-Id = "5444f5ca/88:1f:a1:1b:f8:44/290236" NAS-Port-Type = Wireless-802.11 Cisco-AVPair = "audit-session-id=82d0a5f800051d5a5444f5c7" Acct-Authentic = RADIUS Event-Timestamp = "Oct 20 2014 11:45:47 GMT" Acct-Status-Type = Interim-Update Acct-Input-Octets = 41102 Acct-Input-Gigawords = 0 Acct-Output-Octets = 55255 Acct-Output-Gigawords = 0 Acct-Input-Packets = 213 Acct-Output-Packets = 191 Acct-Session-Time = 32 Acct-Delay-Time = 0 Calling-Station-Id = "192.168.2.71" Called-Station-Id = "192.168.1.1" # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok expand: %{Acct-Session-Time} -> 32 expand: %{Acct-Delay-Time} -> 0 expand: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0} -> 1413805547 - 32 - 0 expand: %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} -> 1413805515 ++[request] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 192.168.1.1,NAS-IP-Address = 192.168.1.1,Acct-Session-Id = "5444f5ca/88:1f:a1:1b:f8:44/290236",User-Name = "jebish"' [acct_unique] Acct-Unique-Session-ID = "ae16dee06152c99c". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "jebish", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "jebish" [suffix] Adding Realm = "NULL" [suffix] Accounting realm is LOCAL. ++[suffix] returns ok [files] acct_users: Matched entry DEFAULT at line 22 [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: %{Framed-IP-Address:-%{NAS-IP-Address}} -> 192.168.3.74 ++[files] returns ok # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> 192.168.1.1 [detail] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.1/detail-20141020 [detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.1/detail-20141020 [detail] expand: %t -> Mon Oct 20 11:45:47 2014 ++[detail] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> jenny attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 27 to 192.168.1.1 port 32770 Finished request 63. Cleaning up request 63 ID 27 with timestamp +5 Going to the next request Ready to process requests

2 2

RFC5607 support on Freeradius
by Frank Wei 20 Oct '14

20 Oct '14

Hi all, Does anybody know if RFC5607 is supported by Freeradius ? We need the new attributes "Framed-Management-Protocol"," Management-Transport-Protection", "Management-Policy-Id" and "Management-Privilege-Level" support. Also does the "Freeradius client (version1.1.6) supports those new attributes? If not is that easy to add them? Best Regards, The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

3 4

IP address allocation based on certificate attributes
by janet long 18 Oct '14

18 Oct '14

My use case is using EAP-TLS, and clients authenticating using X509 certificates. I know that certificate authentication is bread and butter for Radius, but I have a more granular requirement. The user certificates are setup according to different countries, and cities etc where the users are based, e.g. within the Subject field is an attribute C=GB or C=US etc. I need to be able to allocate US users to one range of IP addresses, and UK users to another range of IP addresses - based solely on those attributes. Is this possible? Can it be done in configuration, or would it require coding? Many thanks Janet

2 2

LDAP - bind as user - howto?
by Matej Žerovnik 18 Oct '14

18 Oct '14

Hey! I'm having troubles setting authentication over LDAP in 'bind as user' mode. I only want to authenticate user against LDAP(ldap bind with user/pass provided by the user) and if login is successful, then radius returns Access-Accept. I'm using radius 2.1.12. In modules/ldap I have the following: server = "ldaps.example.com" port = "636" basedn = "dc=example,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 password_attribute = userPassword set_auth_type = yes In sites-available/defaults I have: authorize { preprocess } authenticate { Auth-Type LDAP { ldap } } The rest of the modules are empty. In hints file I have: DEFAULT Ldap-UserDN := "uid=%{User-Name},ou=test,dc=example,dc=com", Auth-Type := LDAP When I try to login, the login fails... In debug log I see the following: # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok ++[files] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject I guess it matches the hint, but it doesn't try to bind to ldap. If I put DEFAULT Ldap-UserDN := "uid=testuser,ou=test,dc=example,dc=com", Auth-Type := LDAP in users file and uncomment files in authorize section, login is successfu. How do I make radius use template provided in hints file and pass it on to authenticate modul, so it tries to login to ldap? Is this even the right way of doing it? I didn't find many posts, that tried to do that. Everybody usually search ldap for USERDN attribute in authorize section with ldap module. Thanks, Matej -- --- Matej Zerovnik

4 9

Re: Beginner help
by KAVYA PRABHAKAR 17 Oct '14

17 Oct '14

Hi, Thanks for the reply. I am using freeradius v3.0.3 Now TLS connection is established. I get following error after 29.4seconds and sockets will be closed. waking up in 29.4 seconds. Reached idle timeout on socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Waking up in 2.9 seconds. ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) I have changed idle_timeout period to 0 from 30.(in tls and default file) According to my understanding 0 means infinite. So sockets and connection has to be up for infinite amount of time. Please Correct me if I am wrong! When server gets a radius request it will go and check in client.conf and I have the entry there as well. Users file also has username and password information. If I send radius request I get password incorrect error. Should I modify any other files along with this. Thanks, Kavya

1 0

Re: Freeradius-Users Digest, Vol 114, Issue 50
by KAVYA PRABHAKAR 16 Oct '14

16 Oct '14

Hi, Thanks for the reply. Now TLS connection is established. I get following error after 33seconds and sockets will be closed. waking up in 29.4 seconds. Reached idle timeout on socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Waking up in 2.9 seconds. ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) I have changed idle_timeout period to 0 from 30.(in tls and default file) According to my understanding 0 means infinite. So sockets and conenction has to be up for infinite amount of time. Please Correct me if I am wrong! Thanks, Kavya On Thu, Oct 16, 2014 at 3:30 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Beginner help (A.L.M.Buxey(a)lboro.ac.uk) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 16 Oct 2014 08:48:30 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Beginner help > Message-ID: <20141016084830.GA25352(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I generated .csr using openssl command and used this csr to generate > CA > > signed certificate. I installed this CA signed certificate under > trusted > > root of server. But when I run freeradius in debug mode, I get the > > following error: > > eap.conf (2.x) or mods-enabled/eap files give clear documentation > on the cert files etc required. the FreeRADIUS system comes with fully > documented > information about certificate generation and requirements > > > but your error looks like the client is using the wrong CA when talking to > the RADIUS > server > > please use the history feature of the users mailing list to see exactly > this same issue > talked about many many times over the past years > > alan > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 114, Issue 50 > ************************************************* >

1 0

IP addresses were not assigned
by Akira Yata 16 Oct '14

16 Oct '14

Hi all! I had a problem with freeradius. When some users were attempting to connect PPPoE session,logiin was OK ,But IP addresses were not assigned(I cnfirmed it on NAS) what is the cause of this problem? NOTE:I have deleted username/password in [] fields. [root@radius maint]# tail -n 100 /var/log/radius/radius.log Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:00 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:00 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:01 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:01 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:01 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:01 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098855, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:04 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:04 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:04 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098855, but no Login record Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:06 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:06 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:06 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:07 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:07 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:07 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:07 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:07 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:08 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:08 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:08 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:08 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:09 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:10 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:10 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:10 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:10 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:11 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:11 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098855 cli #ERX-310#E16#103) Fri Oct 10 15:07:11 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:11 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:11 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:12 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:12 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:13 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:13 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:13 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:13 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:13 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:13 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:13 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:15 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:15 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:15 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:15 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:16 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:16 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:16 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:16 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:16 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:16 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Thanks and Regards

2 1

Re: Beginner help
by KAVYA PRABHAKAR 16 Oct '14

16 Oct '14

Hi, Thanks for the help. I am able to open 2083 tcp port. I have a RADIUS client which sends request to freeradius server. Before sending request to server, it creates a TCP\TLS connection with it. TCP connection is getting established and during TLS handhsake, server throws following error: (0) <<< TLS 1.0 Handshake [length 025c], Certificate --> verify error:num=18:self signed certificate (0) ERROR: SSL says error 18 : self signed certificate (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca (0) ERROR: SSL says: TLS Alert write:fatal:unknown CA (0) ERROR: SSL says: TLS_accept: error in SSLv3 read client certificate B (0) ERROR: SSL says: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. (0) FAILED in TLS handshake receive Closing TLS socket from client port 1645 Client has closed connection ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Waking up in 2.9 seconds. ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Looking at the debugs I think server expects client certificate information as well. Does it work on MTLS? (mutual TLS). I am using self signed certificate generated by ubuntu(where server is installed) and using the same in tls file. The same certificate is put under trusted root in client as well. Thanks, Kavya

2 1

Re: Beginner help
by KAVYA PRABHAKAR 16 Oct '14

16 Oct '14

Hi, I generated .csr using openssl command and used this csr to generate CA signed certificate. I installed this CA signed certificate under trusted root of server. But when I run freeradius in debug mode, I get the following error: (0) <<< TLS 1.0 Handshake [length 0208], Certificate --> verify error:num=20:unable to get local issuer certificate (0) ERROR: SSL says error 20 : unable to get local issuer certificate (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca (0) ERROR: SSL says: TLS Alert write:fatal:unknown CA (0) ERROR: SSL says: TLS_accept: error in SSLv3 read client certificate B (0) ERROR: SSL says: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. (0) FAILED in TLS handshake receive Closing TLS socket from client port 1645 Client has closed connection ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Debug says "fatal unknown_ca". I think I should be adding CA information somewhere in the server. Could anybody please guide me on the same. I would like to know where am I going wrong. Thanks, Kavya On Thu, Oct 16, 2014 at 8:26 AM, KAVYA PRABHAKAR < kavyamelinmaneprabhakar(a)gmail.com> wrote: > Hi, > > Thanks for the help. > I am able to open 2083 tcp port. > I have a RADIUS client which sends request to freeradius server. Before > sending request to server, it creates a TCP\TLS connection with it. > TCP connection is getting established and during TLS handhsake, server > throws following error: > > (0) <<< TLS 1.0 Handshake [length 025c], Certificate > --> verify error:num=18:self signed certificate > (0) ERROR: SSL says error 18 : self signed certificate > (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca > (0) ERROR: SSL says: TLS Alert write:fatal:unknown CA > (0) ERROR: SSL says: TLS_accept: error in SSLv3 read client > certificate B > (0) ERROR: SSL says: error:140890B2:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > SSL: SSL_read failed in a system call (-1), TLS session fails. > (0) FAILED in TLS handshake receive > Closing TLS socket from client port 1645 > Client has closed connection > ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, > 2083, virtual-server=default) > Waking up in 2.9 seconds. > ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, > virtual-server=default) > > Looking at the debugs I think server expects client certificate > information as well. Does it work on MTLS? (mutual TLS). > I am using self signed certificate generated by ubuntu(where server is > installed) and using the same in tls file. > The same certificate is put under trusted root in client as well. > > > Thanks, > Kavya >

2 1