- Freeradius-Users - lists.freeradius.org

just two questions
by Chris Knipe 12 Jun '14

12 Jun '14

Hi All, >From the radmin command, I can see the following radmin> stats socket 10.255.251.2 1812 requests 645589 responses 641483 accepts 359013 rejects 282470 challenges 0 dup 0 invalid 0 malformed 0 bad_authenticator 0 dropped 3110 unknown_types 0 last_packet 1402555332 elapsed.1us 0 elapsed.10us 0 elapsed.100us 0 elapsed.1ms 0 elapsed.10ms 229378 elapsed.100ms 384248 elapsed.1s 27768 elapsed.10s 86 Now given my specific application that I use Radius for, the elapsed times are OK for the majority of requests (the sub 100ms range is fine). I just have a quick question and a thought perhaps. Under what circumstances will FR "drop" a request (i.e. dropped 3110). Also, would it be possible to be able to get stats for the thread pool through radmin as well? I've been experiencing very weird, intermittent and seemingly random timeouts from FR, and after increasing (doubling) the size of my thread pool, most of my issues seemed to have gone away. Surely, those kind of stats in terms of the thread pool will not only be very helpful, but it will be absolutely beneficial in terms of debugging performance issues? Also as a last note, maybe something like a "slow query" log option can be added as well, where we can log auth/acct requests to a while in instances where FR takes longer than a specific amount of time to process? Say, if it takes longer than 100ms to process a request, log the request to a specific file? Not only will it again help to troubleshoot and isolate performance issues, but it could possibly also mean that the entire server does not need to be run in debug mode to identify requests which takes long to process. Just a thought, and just my 2c :-) Thanks, Chris.

3 3

Accented words
by Javier Granda 12 Jun '14

12 Jun '14

I'm running a radius server with multiple eap modules, depending on the CommonName will be redirected to one or another module, the CommonName is like this: "<APELLIDO>, <NOMBRE> (AUTENTICACIÓN)," the problem is that it seems that FR does not recognize the accented literal "AUTENTICACIÓN". The log says "Evaluating (User-Name == "<APELLIDO>, <NOMBRE> (AUTENTICACI") -> FALSE". Any idea how to fix it?

2 1

MSCHAPV2 authenticate including the suffix
by Dean Goldhill 12 Jun '14

12 Jun '14

Hello, I am using an SQL backend. The usernames are stored with the full username including a suffix 'user(a)domain.com I am trying to use TTLS/PEAP with MSCHAPV2 So I want freeradius to authenticate the full username, not the stripped username. I want it to match 'user(a)domain.com<mailto:user@domain.com>' not 'user' When trying to authenticate, it says: [mschap] ERROR: User-Name (user(a)domain.com<mailto:user@domain.com>) is not the same as MS-CHAP Name (user) from EAP-MSCHAPv2. If I set the username in the database to just 'user' and send that through in the supplicant, it works. But I want it to work with the full username including the suffix in the database. Is this possible? Thanks for your help Dean.

3 6

Radcheck gives Accept but still moves onto Radgroupcheck
by Brent Wilkinson 12 Jun '14

12 Jun '14

I am setting up a new Radius server or a mikrotik hotspot system. I am getting a wierd issue that I have not been able to solve or find hints to what to do to fix it. I have setup the system with mysql. I see the radcheck happen and show it retrieved a record. ( I have verified the sql statments do actually pull something). I am not sending any reply so nothing is found in that table. At this point from what I understand in reading how the sql module works at this point it should send back a Access-Accept. Unfortunatly it does not and continues to do group checks and I end up with a reject. Hoping someone can give me a idea of what I need to look at or what I can read up more on to track the issue I am having down. Here is the debug: rad_recv: Access-Request packet from host 76.8.212.170 port 36910, id=78, length=189 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C:4B:D6:A5:CD:BF" Called-Station-Id = "10631" NAS-Port-Id = "ether2" User-Name = "1" NAS-Port = 2152726611 Acct-Session-Id = "80500053" Framed-IP-Address = 10.69.103.254 Mikrotik-Host-IP = 10.69.103.254 CHAP-Challenge = 0x95b4afa9e0e37e62da70a83197931d11 CHAP-Password = 0x21b4c5ed3e3175b1b7672103936286b74e Service-Type = Login-User WISPr-Logoff-URL = "http://10.69.100.1/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.99.163 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "1" with CHAP password [chap] Using clear text password "1" for user 1 authentication. [chap] chap user 1 authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> 1 [sql_log] expand: %{%{User-Name}:-DEFAULT} -> 1 [sql_log] sql_set_user escaped user --> '1' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('1', 'Chap-Password', 'Access-Accept', '2014-06-11 18:42:31'); [sql_log] expand: /var/log/freeradius/radacct/sql-relay -> /var/log/freeradius/radacct/sql-relay [sql_log] Couldn't open file /var/log/freeradius/radacct/sql-relay: No such file or directory ++[sql_log] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> 1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 78 to 76.8.212.170 port 36910 Waking up in 4.9 seconds. Cleaning up request 0 ID 78 with timestamp +6 Ready to process requests. Thanks Brent

3 2

Segmentation fault (core dumped), 3.0.3
by Miha 11 Jun '14

11 Jun '14

Hi, I have installed the newest freeradius server (3.0.3) on centos 6.4. I am trying to start it but getting: name = "radiusd" Segmentation fault (core dumped) Jun 11 09:42:42 localhost kernel: radiusd[6162]: segfault at 19b ip 00000034d6802a3e sp 00007fffedf28180 error 4 in libtalloc.so.2.0.7[34d6800000+a000] Jun 11 09:42:42 localhost abrtd: Directory 'ccpp-2014-06-11-09:42:42-6162' creation detected Jun 11 09:42:42 localhost abrt[6163]: Saved core dump of pid 6162 (/usr/local/sbin/radiusd) to /var/spool/abrt/ccpp-2014-06-11-09:42:42-6162 (2945024 bytes) Jun 11 09:42:42 localhost abrtd: Executable '/usr/local/sbin/radiusd' doesn't belong to any package and ProcessUnpackaged is set to 'no' Jun 11 09:42:42 localhost abrtd: 'post-create' on '/var/spool/abrt/ccpp-2014-06-11-09:42:42-6162' exited with 1 Jun 11 09:42:42 localhost abrtd: Deleting problem directory '/var/spool/abrt/ccpp-2014-06-11-09:42:42-6162' Could some just point me to right direction what is wrong? tnx miha

2 2

use_tunneled_reply in PEAP or TTLS tunnels
by Herwin Weststrate 11 Jun '14

11 Jun '14

Hi all, I was playing around a bit with the option use_tunneled_reply today. The description given in the config is as follows: > The reply attributes sent to the NAS are usually > based on the name of the user 'outside' of the > tunnel (usually 'anonymous'). If you want to send > the reply attributes based on the user name inside > of the tunnel, then set this configuration entry to > 'yes', and the reply to the NAS will be taken from > the reply to the tunneled request. The last part (and the reply to the NAS will be taken from the reply to the tunneled request) makes me expect that all attributes from the reply of the home server are copied to the outer reply. In this case it would be the various attributes to change a VLAN (Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-Id). Looking at the reply, I only see the User-Name attribute updated to my inner user. The relevant code uses the method pairfilter, which is described as "Move pairs of a matching attribute number, vendor number and tag from the the input list to the output list." Basicly, this means that only values that are already present are overwritten. Not exactly what I was expecting. Is this a bug in the code, or is the problem just that the documentation could use a little clarification? -- Herwin Weststrate www.quarantainenet.nl

3 3

dynamic-clients with TLS
by Stefanos Boglou 11 Jun '14

11 Jun '14

Is it possible to use dynamic-clients with TLS? It does not seem to work. Dynamic-clients without TLS works and TLS itself seems to work. My NAS devices are over the internet and they get dynamic IPs from the ISPs but i use TLS for that added piece of security. Thanks, Stefanos

3 5

post-auth section in FR v2.1.12 - Re: Freeradius-Users Digest, Vol 110, Issue 39
by Rui Ribeiro 10 Jun '14

10 Jun '14

Hi Grabriel, You are missing in your update reply Service-Type := "Framed-User" Are you following v1.x recipes? BTW, upgrade to 2.2.4 at least, 2.1.12 is very old, and full of bugs specially when using mschap. Regards > > Message: 4 > Date: Tue, 10 Jun 2014 17:50:17 +0200 > From: gabriel_skupien <gabriel_skupien(a)o2.pl> > To: freeradius-users(a)lists.freeradius.org > Subject: post-auth section in FR v2.1.12 > Message-ID: <5c9f5cb4.6195ba31.53972939.95a05(a)o2.pl> > Content-Type: text/plain; charset="UTF-8" > > I am using EAP-TLS and I am trying to use post-auth section to dynamically > assign (based on the ldap group membership) vlan ID to the user. Leaving > the LDAP part away for testing purposes and concentrating just on the > post-auth section - I cannot make FR to override VLAN ID in post-auth > section. Here is the config: > > post-auth { > update reply { > Tunnel-Type := VLAN > Tunnel-Medium-Type := IEEE-802 > Tunnel-Private-Group-Id := "36" > } > exec > Post-Auth-Type REJECT { > attr_filter.access_reject > } > } > > And nothing happens here: > > .... > # Executing section post-auth from file > /etc/freeradius/sites-enabled/default > +- entering group post-auth {...} > ++[reply] returns noop > ++[exec] returns noop > Sending Access-Challenge of id 127 to X.X.X.X port 32769 > Tunnel-Private-Group-Id:0 = "36" > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Type:0 = VLAN > EAP-Message = 0x03040004 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd55884fdd75c9555353e80afe21cb577 > Finished request 6. > .... > But it finally ends with this: > ..... > Sending Access-Accept of id 128 to X.X.X.X port 32769 > Tunnel-Private-Group-Id:0 = "84" > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Type:0 = VLAN > Cisco-AVPair += "XXX" > EAP-Message = 0xXXXX > Message-Authenticator = 0x00000000000000000000000000000000 > User-Name = "XXXX" > Finished request 7. > > Hence, 3 questions: > 1) Does FR v2.1.12 support post-auth section? > 2) Can you explain the aim of "Sending Access-Challenge" ? > 2) Where is the best place to authorize users in LDAP while using EAP-TLS? > Is it post-auth? > > ps. it works fine while authorizing users based on LDAP in the authorize > section but we prefer to postpone this task to post-auth. In that way we > can achieve to goals: > -use ldap group membership for vlan assignments and > -significantly reduce LDAP load > > jinx > > H

1 0

Performance - was Re: LDAP Groups to Freeradius and then Ruckus Wireless?
by Rui Ribeiro 10 Jun '14

10 Jun '14

Hi Arran, To be fair, I have read a lot of performance problems in FreeRadius, and I have yet to see any. We have been running here for more than a year now, Debian 7/FreeRadius from 2.1.12 to 2.2.5, MySQL, detail files and AD authentication, roaming/proxying too, in a virtual machine with 64 bits, 1GB RAM and 2 CPUs, 3500 daily EDUROAM users, and I have yet to see the CPU loads go up more than 0.05-0.10. Even when I have major events that bring down the wifi intra-structure, like yesterdays where a switch went crazy, I hardly register an heavy load. What are your mileage, guys? Regards, Rui Ribeiro Regards, > > Message: 4 > Date: Tue, 10 Jun 2014 07:09:30 +0100 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: LDAP Groups to Freeradius and then Ruckus Wireless? > Message-ID: <B5471695-B7D2-4970-B4C8-6A4905489FCC(a)freeradius.org> > Content-Type: text/plain; charset="us-ascii" > > > On 10 Jun 2014, at 06:36, Fajar A. Nugraha <list(a)fajar.net> wrote: > > > On Mon, Jun 9, 2014 at 9:43 PM, Arran Cudbard-Bell > > <a.cudbardb(a)freeradius.org> wrote: > ...... > > > Would it make sense to enable the flag on all bundled package recipes? > > IIRC 2.x debian/rules has it (official debian/ubuntu package has it as > > well), but 3.0.x doesn't. Haven't checked others though. > > No, there's a noticeable performance impact. One of the other users said > it was as much as 15%. > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > ************************************************* >

4 3

I must have NT domain hack configured wrong.
by Matthew Berry 09 Jun '14

09 Jun '14

>From a fresh installation of Freeradius 2 on Ubuntu 13.10 Server, with a single test user added to the users file, and with mschap turned on, I've successfully received an access-accept response when testing with radtest both on the inner tunnel port 18120 and the regular 1812 port using mschap [1]. The test user is setup to mirror a user on a test windows laptop, using the HOSTNAME\username convention. On my first attempt to connect the laptop, I receive the below error about the inner username matching neither the outer username nor the eap identity. Info: [files] users: Matched entry HOSTNAME\me at line 93 ... Info: [peap] Identity - HOSTNAME\me ... ERROR: User-Name (HOSTNAME\me) is not the same as MS-CHAP Name (me) from EAP-MSCHAPv2 So from what I've read this has been addressed by adding the with_ntdomain_hack flag in the mschap module to 'yes'. However, as shown in the referenced pastebins [2][3], it appears to have no effect. There is one other place in the configuration where with_ntdomian_hack is present, which is in the preprocess module, however it specifically says in the comments not to use it. Based on observations, it seems to strip the "HOSTNAME\\" from the username (but not the eap identity). I must have done something wrong when I enabled the with_ntdomain_hack in the mschap configuration, as from my understanding that should have caused Freeradius to account for the way Windows performs the authentication. Is there something further I need to do? Server: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 24 2014 at 15:09:01 (ubuntu package version 2.1.12+dfsg-1.2ubuntu5.1 ) End-Host: Windows 7 host, which is not part of a domain, with hostname of HOSTNAME, with a user named 'me', who has a password 'PASSWORD' End-Host Network Profile: Server validation turned off since test certs are being used, "Use windows username/password" is on. NAS: Tomato 1.28 [1] radtest log: http://pastebin.com/S5Kb1ggd [2] with_ntdomain_hack off: http://pastebin.com/CnFcXWAX [2] with_nt_domain_hack on: http://pastebin.com/KS8AJPbc -Matt

3 2