- Freeradius-Users - lists.freeradius.org

Is it possible to do Auth, Accounting and COA over single client initiated RADSEC session?
by Smc Kms 27 Jun '14

27 Jun '14

Dear FreeRadius users and developers. I'm working on a project where we need client devices to connect to our FreeRadius server over the internet using a single RADSEC connection that each client device would initiate. We would like all radius traffic to go over this single connection including Auth, Accounting, and COA messages. I have been working with the TLS configuration and see that it supports Auth+Acct only, and so far I have not figured out how to get COA messages to go back down the same connection. Is this already supported by FreeRadius, and how would I configure my server to support it? If this is not currently supported, is this a feature that is in consideration for future development? I would be thankful for any advice. Kind Regards Craig. --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

3 5

segfault in 2.2.5 comparing Client-IP-Address
by Harald Terkelsen 27 Jun '14

27 Jun '14

Hi, When we changed a check from "if (<some other checks> || NAS-IP-Address == xxx.xxx.xxx.xxx)" to "if (<some other checks> || Client-IP-Address == xxx.xxx.xxx.xxx)", Freeradius 2.2.5 segfaults. gdb: ? Evaluating (NAS-IP-Address == xxx.xxx.xxx.xxx ) -> FALSE expand: %{Client-IP-Address} -> Program received signal SIGSEGV, Segmentation fault. paircmp (one=0x7ffff8454760, two=0x0) at valuepair.c:2036 2036 compare = ntohl(two->vp_ipaddr) - ntohl(one->vp_ipaddr); It looks like the segfault happens when Freeradius receives a request from a NAS using IPv6. We did not see the segfault when the Client-IP-Address was an IPv4 address in the tests we did. Same problem with Packet-Src-IP-Address. Regards, Harald Terkelsen Oslo and Akershus University College of Applied Sciences

1 0

RADIUS, anycast, and high availability
by Jason Healy 27 Jun '14

27 Jun '14

Hello all, We’re looking into using anycast and a group of servers for some of our stateless services (like DNS and NTP) to increase availability, as anycast “automatically” routes traffic to one machine in a group. I’m wondering if RADIUS is a good candidate for this as well. Being UDP-based is a good start, but I don’t know if the servers will get annoyed if (say) multiple packets in an EAP conversation don’t go to the same server. DNS is much simpler as its usually single-shot (request -> reply). Basically: has anyone else tried it? Or is this a Bad Idea and I just stick to regular multi-server with failover on the NAS? Thanks, Jason

6 8

Is it possible to set asterisk's VoIP authentication to be based on EAP-SIM auth of freeradius?
by Muhammad Hasan 27 Jun '14

27 Jun '14

Hi all, I want to make initial VoIP authentication process from asterisk server to be based on EAP-SIM authentication of Freeradius server (so it will be not necessary to insert account datas in the asterisk database). Is there any way of doing that from Freeradius? Or at least, is there any way to sync the EAP-SIM data on Freeradius to asterisk server? thank you -- Best Regards,

2 4

Troubleshoot Error
by Angelo C. De Guzman 26 Jun '14

26 Jun '14

Hi, I'm basically new to freeradius. Please help to isolate this problem. Shown below are the logs for radiusd -X. I'm getting the warning below. It looks like I'm having config issues and cannot find where to start. I just did a local check if Authentciation will be accepted. echo "User-Name=testing,User-Password=testing,Framed-Protocol=PPP " | /usr/local/bin/radclient localhost:1812 auth testing123 Radiusd -X debug Received Access-Request Id 252 from 127.0.0.1:60268 to 127.0.0.1:1812 length 53 User-Name = 'testing' User-Password = 'testing' Framed-Protocol = PPP (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) if (User-Name != "%{tolower:%{User-Name}}") (1) EXPAND %{tolower:%{User-Name}} (1) --> testing (1) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) if (User-Name =~ / /) (1) if (User-Name =~ / /) -> FALSE (1) if (User-Name =~ /@.*@/ ) (1) if (User-Name =~ /@.*@/ ) -> FALSE (1) if (User-Name =~ /\\.\\./ ) (1) if (User-Name =~ /\\.\\./ ) -> FALSE (1) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (1) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (1) if (User-Name =~ /\\.$/) (1) if (User-Name =~ /\\.$/) -> FALSE (1) if (User-Name =~ /(a)\\./) (1) if (User-Name =~ /(a)\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "testing", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) files : users: Matched entry DEFAULT at line 181 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (1) WARNING: pap : Authentication will fail unless a "known good" password is available. (1) [pap] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user. (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject : EXPAND %{User-Name} (1) attr_filter.access_reject : --> testing (1) attr_filter.access_reject : Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (1) [eap] = noop (1) remove_reply_message_if_eap remove_reply_message_if_eap { (1) if (reply:EAP-Message && reply:Reply-Message) (1) if (reply:EAP-Message && reply:Reply-Message) -> FALSE (1) else else { (1) [noop] = noop (1) } # else else = noop (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response Sending Access-Reject Id 252 from 127.0.0.1:1812 to 127.0.0.1:60268 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 252 with timestamp +1643 Ready to process requests. Thanks, Gie

2 2

RE: Certificate push for eap-tls clients
by Franks Andy (RLZ) IT Systems Engineer 25 Jun '14

25 Jun '14

Hi, Thanks for the messages back. I'd forgotten about insertion of the CA into the certificate chain with openssl, which is helpful. I guess it would be useful to experiment with using a certificate tool, web server and autogenerated html page via php or something to give the user a one-time link if they are put into the "remuneration" vlan by freeradius. No idea how you start packaging up profiles but maybe the CAT tool is useful there. Seems to always be a case of "use the commercial or brew your own" with what I'm doing at the moment! Cheers Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Matthew Newton Sent: 25 June 2014 15:25 To: FreeRadius users mailing list Subject: Re: Certificate push for eap-tls clients Hi, On Wed, Jun 25, 2014 at 12:21:48PM +0100, Franks Andy (RLZ) IT Systems Engineer wrote: > Unfortunately we don't run an openssl / tinyca etc based CA, it's AD > based and I have no control over that, and we also need to stick with > TLS rather than another method of PEAP like mschapv2. As you say you're AD based, just in case you didn't realise: if your clients are all Windows and joined to the domain, then CA management is automatic and they will have a client cert on them that you can just use to authenticate, so the domain manages that side for you and you don't need to worry about it. Of course, if some clients aren't domain joined then you do still have the cert deployment issue, which is the usual issue with EAP-TLS. As Alan said, you probably want to look at some other deployment system. FreeRADIUS isn't that. Remember you can still make an intermediate signing cert with e.g. OpenSSL, sign it with the domain CA, then use that to generate all certs for non-domain members, if you don't/can't use the AD cert services directly. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Certificate push for eap-tls clients
by Franks Andy (RLZ) IT Systems Engineer 25 Jun '14

25 Jun '14

Hi All, I've had a look around and couldn't find much information about how to do this, so thought I'd maybe try my luck here! In a demonstration of clearpass (Aruba radius product) one nice thing it did was send certificates direct to clients (or made a webpage available with a cert download link). Does anyone know whether this is possible in some way with a freeradius based radius system? Unfortunately we don't run an openssl / tinyca etc based CA, it's AD based and I have no control over that, and we also need to stick with TLS rather than another method of PEAP like mschapv2. I'm not aware of an exposed api, apart from the obvious web based, interactive one that exists with an MS CA. Anything else presumably couldn't be controlled via linux anyway.. Any ideas? Thanks Andy

3 2

authentication : double login because of not expired cookie
by Pieter Vernooij 25 Jun '14

25 Jun '14

Experts, For a project I'm involved in, I've successfully setup Radius authentication (using OTP) between a web application (which includes an Apache webserver and mod_radius_auth) and an (external) Radius server. (Relevant: I've set cookie expiry time to a time interval of 8 hours, as choosing a shorter time interval caused problems in the behavior of my web application.) However, I have some difficulties with Radius cookie-expiry behavior. When a user closes the webapplication (after a successful login), and tries to login again with his username + token (having a cookie on his system which has not been expired yet): - the web browser either gives a 401 error page or - asks for re-authentication (asking for credentials again..) (exact behavior is browser dependent). After such message, the user can login again. It seems that the older cookie is then discarded / invalided. This is rather user unfriendly. Does anyone has an idea how to deal with this? Best would be to have the cookie deleted from my system after the user logs off or closes the browser. Is turning to mod_auth_xradius a possible solution ? Or can I tweak something on Apache level? Thanks you ever so much and greetings from the Netherlands, Pieter cheers, Pieter

1 0

Need to auth all instead of proxy for 1 realm
by azander 23 Jun '14

23 Jun '14

Greetings, I am running FreeRadius 2.2.x (Working on upgrading to 3.x.x) but ran into a near emergency situation. One of my customer's radius servers died. I need to auth-all their customers, but not any of the other proxied radius users. Is there a relatively simple way to do this? I cannot seem to find it in the docs. -- William

2 2

SQL syntax error in DHCP + Freeradius 3.x
by Marcelo Gondim 23 Jun '14

23 Jun '14

Hi all, When I try to connect via dhclient, I receive this syntax error on radiusd -X: rlm_sql (sql): Executing query: 'SELECT framedipaddress FROM radippool WHERE pool_name = 'local' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'DHCP-08:00:27:93:ff:5d'), (callingstationid <> '08:00:27:93:ff:5d'), expiry_time LIMIT 1 OR UPDATE' rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'OR UPDATE' at line 1 ) ERROR: dhcp_sqlippool : database query error on 'SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 OR UPDATE' My allocate_find in mods-config/sql/ippool-dhcp/mysql/queries.conf: allocate_find = "\ SELECT framedipaddress \ FROM ${ippool_table} \ WHERE pool_name = '%{control:Pool-Name}' \ AND (expiry_time < NOW() OR expiry_time IS NULL) \ ORDER BY \ (username <> '%{User-Name}'), \ (callingstationid <> '%{Calling-Station-Id}'), \ expiry_time \ LIMIT 1 \ OR UPDATE" I´m using FreeBSD 10-STABLE with mysql 5.5 and Freeradius 3.0.3 Cheers, Gondim

2 1