- Freeradius-Users - lists.freeradius.org

RFC5607 support on Freeradius
by Frank Wei 20 Oct '14

20 Oct '14

Hi all, Does anybody know if RFC5607 is supported by Freeradius ? We need the new attributes "Framed-Management-Protocol"," Management-Transport-Protection", "Management-Policy-Id" and "Management-Privilege-Level" support. Also does the "Freeradius client (version1.1.6) supports those new attributes? If not is that easy to add them? Best Regards, The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

3 4

IP address allocation based on certificate attributes
by janet long 18 Oct '14

18 Oct '14

My use case is using EAP-TLS, and clients authenticating using X509 certificates. I know that certificate authentication is bread and butter for Radius, but I have a more granular requirement. The user certificates are setup according to different countries, and cities etc where the users are based, e.g. within the Subject field is an attribute C=GB or C=US etc. I need to be able to allocate US users to one range of IP addresses, and UK users to another range of IP addresses - based solely on those attributes. Is this possible? Can it be done in configuration, or would it require coding? Many thanks Janet

2 2

LDAP - bind as user - howto?
by Matej Žerovnik 18 Oct '14

18 Oct '14

Hey! I'm having troubles setting authentication over LDAP in 'bind as user' mode. I only want to authenticate user against LDAP(ldap bind with user/pass provided by the user) and if login is successful, then radius returns Access-Accept. I'm using radius 2.1.12. In modules/ldap I have the following: server = "ldaps.example.com" port = "636" basedn = "dc=example,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 password_attribute = userPassword set_auth_type = yes In sites-available/defaults I have: authorize { preprocess } authenticate { Auth-Type LDAP { ldap } } The rest of the modules are empty. In hints file I have: DEFAULT Ldap-UserDN := "uid=%{User-Name},ou=test,dc=example,dc=com", Auth-Type := LDAP When I try to login, the login fails... In debug log I see the following: # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] hints: Matched DEFAULT at 36 ++[preprocess] returns ok ++[files] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject I guess it matches the hint, but it doesn't try to bind to ldap. If I put DEFAULT Ldap-UserDN := "uid=testuser,ou=test,dc=example,dc=com", Auth-Type := LDAP in users file and uncomment files in authorize section, login is successfu. How do I make radius use template provided in hints file and pass it on to authenticate modul, so it tries to login to ldap? Is this even the right way of doing it? I didn't find many posts, that tried to do that. Everybody usually search ldap for USERDN attribute in authorize section with ldap module. Thanks, Matej -- --- Matej Zerovnik

4 9

Re: Beginner help
by KAVYA PRABHAKAR 17 Oct '14

17 Oct '14

Hi, Thanks for the reply. I am using freeradius v3.0.3 Now TLS connection is established. I get following error after 29.4seconds and sockets will be closed. waking up in 29.4 seconds. Reached idle timeout on socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Waking up in 2.9 seconds. ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) I have changed idle_timeout period to 0 from 30.(in tls and default file) According to my understanding 0 means infinite. So sockets and connection has to be up for infinite amount of time. Please Correct me if I am wrong! When server gets a radius request it will go and check in client.conf and I have the entry there as well. Users file also has username and password information. If I send radius request I get password incorrect error. Should I modify any other files along with this. Thanks, Kavya

1 0

Re: Freeradius-Users Digest, Vol 114, Issue 50
by KAVYA PRABHAKAR 16 Oct '14

16 Oct '14

Hi, Thanks for the reply. Now TLS connection is established. I get following error after 33seconds and sockets will be closed. waking up in 29.4 seconds. Reached idle timeout on socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Waking up in 2.9 seconds. ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) I have changed idle_timeout period to 0 from 30.(in tls and default file) According to my understanding 0 means infinite. So sockets and conenction has to be up for infinite amount of time. Please Correct me if I am wrong! Thanks, Kavya On Thu, Oct 16, 2014 at 3:30 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Beginner help (A.L.M.Buxey(a)lboro.ac.uk) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 16 Oct 2014 08:48:30 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Beginner help > Message-ID: <20141016084830.GA25352(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I generated .csr using openssl command and used this csr to generate > CA > > signed certificate. I installed this CA signed certificate under > trusted > > root of server. But when I run freeradius in debug mode, I get the > > following error: > > eap.conf (2.x) or mods-enabled/eap files give clear documentation > on the cert files etc required. the FreeRADIUS system comes with fully > documented > information about certificate generation and requirements > > > but your error looks like the client is using the wrong CA when talking to > the RADIUS > server > > please use the history feature of the users mailing list to see exactly > this same issue > talked about many many times over the past years > > alan > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 114, Issue 50 > ************************************************* >

1 0

IP addresses were not assigned
by Akira Yata 16 Oct '14

16 Oct '14

Hi all! I had a problem with freeradius. When some users were attempting to connect PPPoE session,logiin was OK ,But IP addresses were not assigned(I cnfirmed it on NAS) what is the cause of this problem? NOTE:I have deleted username/password in [] fields. [root@radius maint]# tail -n 100 /var/log/radius/radius.log Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:00 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:00 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:00 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:01 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:01 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:01 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:01 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098855, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:02 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:03 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:04 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:04 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:04 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098855, but no Login record Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:05 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:06 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:06 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:06 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:06 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:07 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:07 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:07 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:07 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:07 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:08 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:08 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:08 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:08 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:09 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:09 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:10 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:10 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:10 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:10 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:11 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:11 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098855 cli #ERX-310#E16#103) Fri Oct 10 15:07:11 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:11 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:11 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:12 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:12 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:12 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:13 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:13 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:13 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:13 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:13 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:13 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:13 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:15 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:15 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:15 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:15 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:15 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 352321536 cli #ERX-310#E15#0) Fri Oct 10 15:07:16 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098854 cli #ERX-310#E16#102) Fri Oct 10 15:07:16 2014 : Auth: Login OK: [] (from client 10.0.5.200 port 369098752 cli #ERX-310#E16#0) Fri Oct 10 15:07:16 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Fri Oct 10 15:07:16 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 369098854, but no Login record Fri Oct 10 15:07:16 2014 : Error: rlm_radutmp: Logout for NAS 10.0.5.200 port 352321536, but no Login record Fri Oct 10 15:07:16 2014 : Error: rlm_radutmp: Logout entry for NAS 10.0.5.200 port 369098752 has wrong ID Thanks and Regards

2 1

Re: Beginner help
by KAVYA PRABHAKAR 16 Oct '14

16 Oct '14

Hi, Thanks for the help. I am able to open 2083 tcp port. I have a RADIUS client which sends request to freeradius server. Before sending request to server, it creates a TCP\TLS connection with it. TCP connection is getting established and during TLS handhsake, server throws following error: (0) <<< TLS 1.0 Handshake [length 025c], Certificate --> verify error:num=18:self signed certificate (0) ERROR: SSL says error 18 : self signed certificate (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca (0) ERROR: SSL says: TLS Alert write:fatal:unknown CA (0) ERROR: SSL says: TLS_accept: error in SSLv3 read client certificate B (0) ERROR: SSL says: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. (0) FAILED in TLS handshake receive Closing TLS socket from client port 1645 Client has closed connection ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Waking up in 2.9 seconds. ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Looking at the debugs I think server expects client certificate information as well. Does it work on MTLS? (mutual TLS). I am using self signed certificate generated by ubuntu(where server is installed) and using the same in tls file. The same certificate is put under trusted root in client as well. Thanks, Kavya

2 1

Re: Beginner help
by KAVYA PRABHAKAR 16 Oct '14

16 Oct '14

Hi, I generated .csr using openssl command and used this csr to generate CA signed certificate. I installed this CA signed certificate under trusted root of server. But when I run freeradius in debug mode, I get the following error: (0) <<< TLS 1.0 Handshake [length 0208], Certificate --> verify error:num=20:unable to get local issuer certificate (0) ERROR: SSL says error 20 : unable to get local issuer certificate (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca (0) ERROR: SSL says: TLS Alert write:fatal:unknown CA (0) ERROR: SSL says: TLS_accept: error in SSLv3 read client certificate B (0) ERROR: SSL says: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. (0) FAILED in TLS handshake receive Closing TLS socket from client port 1645 Client has closed connection ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, 2083, virtual-server=default) Debug says "fatal unknown_ca". I think I should be adding CA information somewhere in the server. Could anybody please guide me on the same. I would like to know where am I going wrong. Thanks, Kavya On Thu, Oct 16, 2014 at 8:26 AM, KAVYA PRABHAKAR < kavyamelinmaneprabhakar(a)gmail.com> wrote: > Hi, > > Thanks for the help. > I am able to open 2083 tcp port. > I have a RADIUS client which sends request to freeradius server. Before > sending request to server, it creates a TCP\TLS connection with it. > TCP connection is getting established and during TLS handhsake, server > throws following error: > > (0) <<< TLS 1.0 Handshake [length 025c], Certificate > --> verify error:num=18:self signed certificate > (0) ERROR: SSL says error 18 : self signed certificate > (0) >>> TLS 1.0 Alert [length 0002], fatal unknown_ca > (0) ERROR: SSL says: TLS Alert write:fatal:unknown CA > (0) ERROR: SSL says: TLS_accept: error in SSLv3 read client > certificate B > (0) ERROR: SSL says: error:140890B2:SSL > routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned > SSL: SSL_read failed in a system call (-1), TLS session fails. > (0) FAILED in TLS handshake receive > Closing TLS socket from client port 1645 > Client has closed connection > ... shutting down socket auth from client (10.253.6.11, 1645) -> (*, > 2083, virtual-server=default) > Waking up in 2.9 seconds. > ... cleaning up socket auth from client (10.253.6.11, 1645) -> (*, 2083, > virtual-server=default) > > Looking at the debugs I think server expects client certificate > information as well. Does it work on MTLS? (mutual TLS). > I am using self signed certificate generated by ubuntu(where server is > installed) and using the same in tls file. > The same certificate is put under trusted root in client as well. > > > Thanks, > Kavya >

2 1

Cache module to save user password?
by Enrique Sainz Baixauli 15 Oct '14

15 Oct '14

Hello there, I have a freeradius server for testing running v3.0.3, and I had a config where the server read the user details from an LDAP server and cached it to avoid future searches for the same user. I am pretty sure it used to work when I finally configured it, and without any changes or updates it just stopped working. Now, I can test any of the users in the database and it will send Access-Accept the first time I test, but if I try again while the entry in the cache is still there it will pop put "no known-good password for that user". My config for the auth section is as follows: update control { Cache-Status-Only := yes } cache if (notfound) { ldap update control { Cache-Status-Only := no } cache } While the update section of the cache module config is as follows: control:LDAP-Group += control:LDAP-Group control:Password-With-Header += control:Password-With-Header (although I also tried with control:User-Password instead of Password-With-Header) So the thing is that, when the cache module finds an entry for the user, it reads it (with Cache-Status-Only := yes, might that be the problem?) but then it doesn't find a known-good password for that user. If it had read the cache entry, I understand that it should be there. Any help is appreciated. And any additional info will be provided if needed :) Best regards, Enrique Sainz

1 0

Two questions SYSLOG (level of detail written and forwarding to a SIEM)
by Shawn Wiley 14 Oct '14

14 Oct '14

I have two questions. Please point me in the right direction if the answer is documented somewhere and I've missed it. First some background. I am running Red Hat Enterprise Linux 2.6.32-279.11.1.el6.x86_64 #1 SMP Sat Sep 22 07:10:26 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux Installed Package Name : freeradius Arch : x86_64 Version : 2.1.12 Release : 4.el6_3 I would like to feed logs into a SIEM (ArcSight). Has anyone done it? Is the procedure documented anywhere? It looks like I just parse the syslog output and feed that into the SIEM but I'd like some advice from anyone who has done it. Second Question The current syslog output is not very verbose but when I run Radiusd in -X mode I see a ton of data. I'd like to log close to what the -X outputs to my syslog file. From what I've read there's a module that will allow me to log that level of detail but I'm not sure I'm 100% familiar with the module concept. Do I just $INCLUDE modulename in the radius.conf file and then go into the module itself and make the configuration changes there? Ultimately I'd like my syslog file to show who tried to authenticate USERNAME, the IP address they initiated the auth request from USER's IP, successful authentication or fail/reject. Thanks in advance. Shawn L. Wiley, CISSP - Information and Application Security Architecture ________________________________________________________ This message may contain confidential information and is intended for specific recipients unless explicitly noted otherwise. If you have reason to believe you are not an intended recipient of this message, please delete it and notify the sender. This message may not represent the opinion of Intercontinental Exchange, Inc. (ICE), Euronext or any of their subsidiaries or affiliates, and does not constitute a contract or guarantee. Unencrypted electronic mail is not secure and the recipient of this message is expected to provide safeguards from viruses and pursue alternate means of communication where privacy or a binding message is desired. ________________________________________________________

2 1