- Freeradius-Users - lists.freeradius.org

nas id in radacct table
by Benoit 15 Apr '14

15 Apr '14

Hello everyone, I'd like to make some statistics about the connections and my nas clients. The problem is my clients using hotspots and having their IP changing constantly. I managed to keep my nas table updated with a heartbeat system. But the problem is that the connections in radacct seem to save the IP of the nas as the reference to the nas table. That's not good for me as those IPs keep changing. I can't track which connection comes from which client. This might have to do with the fact that there's no 'id' field for the nas when we use the file to set them up. I am using the database and the 'id' field is my best chance to keep good track of my connections. Am I missing a reference that can identify the NAS used for a connection, and other than the nas IP? Do you guys know a workaround for me? Even modifying the code a little bit so that I can save the NAS (database) id in the radacct table would not bother me but I would appreciate some help to locate this part of the code if it comes to this. Thank you in advance. Benoit

4 8

Lists server HTTP service down?
by Stefan Paetow 15 Apr '14

15 Apr '14

Hi, Just checking... Is the FreeRADIUS Mailman interface dead? http://lists.freeradius.org/mailman/listinfo/freeradius-users just times out? It's possible I missed an announcement stating this... just checking. Stefan

3 2

Re: FreeRADIUS auditory and performance
by Rui Ribeiro 15 Apr '14

15 Apr '14

Hi Antonio, SNMP is not supported at the moment directly by freeradius. You can get some data activating the status "virtual server" in sites-enabled and then doing echo "Message-Authenticator = 0x00,FreeRADIUS-Statistics-Type = 31" | radclient localhost:18121 status adminsecret You may eventually connect that to your snmp agent in your linux, I remember seeing some page about it. Regards > Message: 6 > Date: Mon, 14 Apr 2014 13:32:45 +0200 > From: Antonio Fern?ndez P?rez <antoniofernandez(a)fabergroup.es> > To: freeradius-users <freeradius-users(a)lists.freeradius.org> > Subject: FreeRADIUS auditory and performance > Message-ID: > < > CANz54jr6pKAt3m3oboYqA8kw32JPHmxteckQXYCd0OQ0dTUrEQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi everybody, > > I would like to know how can I do this on my server: Check FreeRADIUS > performance and authentication capacity. > > I have read about radperf but I can't download it from its web page. On the > other hand, I would like to know how can I monitor FreeRADIUS with SNMP ( > It's very interesting to know how many users are connected, how many > requests has received the server ...). > > I hope your advices. > > Thanks in advance. Regards, > > Antonio. >

1 0

Assert failed - FR 2.2.4 OS X Lion
by Alex Sharaz 12 Apr '14

12 Apr '14

Run FR 2.2.4 on os x lion Periodically I get :- Thu Apr 10 08:35:47 2014 : Info: WARNING: Child is hung for request 1312 in component authorize module auth_log. Thu Apr 10 08:36:04 2014 : Info: WARNING: Child is hung for request 1312 in component authorize module auth_log. Thu Apr 10 08:36:29 2014 : Info: WARNING: Child is hung for request 1312 in component authorize module auth_log. Thu Apr 10 08:37:08 2014 : Info: WARNING: Child is hung for request 1312 in component authorize module auth_log. Thu Apr 10 08:38:45 2014 : Error: ASSERT FAILED event.c[543]: request->child_state == REQUEST_DONE Thu Apr 10 18:53:43 2014 : Info: Starting - reading configuration fi Rgds A

4 7

FR 3 to AD via ldap
by Bc. Radovan Matisko 12 Apr '14

12 Apr '14

Hi, Im trying to use FR 3 to connect to remote AD via ldap module, tried playing with parameters but with no luck. Idk what i miss. I use own certificates. PEAP with MSCHAPv2. I config. ldap module : server = "pegasus.fri.uniza.sk" port = 636 base_dn = "dc=fri,dc=uniza,dc=sk" user { base_dn = "ou=People,dc=fri,dc=uniza,dc=sk" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' } options { chase_referrals = yes rebind = yes } tls { ca_path = ${certdir} ca_file = ${certdir}/cacert.cer certificate_file = ${certdir}/friradius.cer private_key_file = ${certdir}/friradius.key require_cert = "demand" } In sites-available/default and inner-tunnel I just added : authorize { ldap } In eap I config >eap { default_eap_type = peap tls { tls = tls-common } ttls { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" }In mschap >mschap { use_mppe = no require_encryption = yes require_strong = yes passchange { }}Also added realm to proxy >realm fri.uniza.sk {}Its starting all-right : "Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 47617 Ready to process requests." But when I try radtest :radtest -t mschap matisko(a)fri.uniza.sk <password>localhost 0 testing123rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=213, length=20Debug is : (1) suffix : Looking up realm "fri.uniza.sk" for User-Name = "hajtmanek(a)fri.uniza.sk"(1) suffix : Found realm "fri.uniza.sk"(1) suffix : Adding Stripped-User-Name = "hajtmanek"(1) suffix : Adding Realm = "fri.uniza.sk"(1) suffix : Authentication realm is LOCAL.(1) [suffix] = ok(1) eap : No EAP-Message, not doing EAP(1) [eap] = noop(1) [files] = nooprlm_ldap (ldap): Reserved connection (4)(1) ldap : EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})(1) ldap : --> (uid=hajtmanek)(1) ldap : EXPAND ou=People,dc=fri,dc=uniza,dc=sk(1) ldap : --> ou=People,dc=fri,dc=uniza,dc=sk(1) ldap : Performing search in 'ou=People,dc=fri,dc=uniza,dc=sk' with filter '(uid=hajtmanek)', scope 'sub'(1) ldap : Waiting for search result...(1) ERROR: ldap : Failed performing search: Please set 'chas e_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details.(1) ERROR: ldap : Server said: 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1.rlm_ldap (ldap): Released connection (4)rlm_ldap (ldap): Opening additional connection (5)rlm_ldap (ldap): Connecting to pegasus.fri.uniza.sk:636TLS: warning: cacertdir not implemented for gnutlsrlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successful(1) [ldap] = fail(1) } # authorize = fail(1) Invalid user (ldap: Failed performing search: Please set 'chase_referrals=yes' and 'rebind=yes'. See the ldap module configuration for details.): [hajtmanek/pokus123] (from client localhost port 0)(1) Using Post-Auth-Type RejectBinding is succesfull, referals and rebind are changed. SSL handshake I think is ok (according to wireshark :) ).

2 2

Can freeRADIUS originate CoA Acks?
by Chavez, Andres ((HP Networking - Roseville)) 12 Apr '14

12 Apr '14

The short: I know freeRADIUS can originate CoA packets. I configured this and is working perfectly. However, I am in need of freeRADIUS (acting as proxy) to originate CoA Acks when it receives a CoA packet destined for the NAS. The long: I have a Cisco ACS and a non-Cisco NAS. The NAS does not support CoA. However, ACS is sending CoA packets to the NAS and the NAS must act accordingly (this is a requirement.) In order to meet these requirement, I placed freeRADIUS as a proxy between the NAS and ACS. This is what I already have working: 1. freeRADIUS intercepts Accept packets and modifies before sending to NAS. 2. freeRADIUS intercepts CoA packets and sends SOAP commands to NAS to perform actions in the CoA attributes. 3. freeRADIUS forwards CoA packet to NAS (which NAS ignores.) 4. NAS reacts to SOAP commands as expected. The problem is that since the NAS ignores the CoA packet, it never sends a CoA Ack. As a consequence, ACS's status is outdated since it does not know that the parameters in the CoA yielded results. What I need is a way to have freeRADIUS (acting as proxy) to send a CoA Ack when it intercepts the CoA packet (preferably after the SOAP commands are executed, but not required.) Can this be achieved with freeRADIUS? Or is there an external script I can run to generate and send such a packet to ACS? Thanx in advance. Andre

3 2

radperf - was Re: Assert failed - FR 2.2.4 OS X Lion
by Rui Ribeiro 11 Apr '14

11 Apr '14

Hi Arran, Do you still make available radperf to the public at large? The webpage where it lives no longer works. Regards, Rui > Message: 6 > > > > > Might just be able to reproduce it with radperf and a > > > > update request { > > Tmp-String-0 := `sleep 30` > > } > > > > Probably a bad path through the state machine. > > > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > > FreeRADIUS Development Team > > > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

2 1

Statement on OpenSSL security bug
by Alan DeKok 11 Apr '14

11 Apr '14

We've released a statement on the OpenSSL security issue: http://freeradius.org/security.html In short, Version 2 is not vulnerable. Version 3 using EAP or incoming RadSec is not vulnerable. Version 3 using outgoing RadSec is vulnerable. i.e. proxying over RadSec to a home server. But everyone using OpenSSL for anything *other* than RADIUS should assume that all secrets have been compromised. e.g. HTTPS user credentials, cookies, keys, passwords, etc. Thanks to Jouni Malinen for providing test cases and more detailed information about the bug. Alan DeKok.

3 4

3.0.2: rlm_sql_null duplicating its statements
by Stefan Winter 11 Apr '14

11 Apr '14

Hi, I'm in the process of getting my first 3.0.2 instance to production level. Now that I've moved eduroam accounting handling into production (rlm_sql_null instance), I see something that looks like a concurrent write of sorts to me. I have this in my file: UPDATE radacct_eduroam SET FramedIPAddress = '10.36.10.174', AcctSessionTime = '586', AcctInputOctets = '0' << 32 | '59700', AcctOutputOctets = '0' << 32 | '83072' WHERE AcctSessionId = '53424d00/00:0a:5b:3a:b5:90/224195' AND UserName = '' AND NASIPAddress= '10.199.21.8'UPDATE radacct_eduroam SET FramedIPAddress = '10.36.10.174', AcctSessionTime = '586', AcctInputOctets = '0' << 32 | '59700', AcctOutputOctets = '0' << 32 | '83072' WHERE AcctSessionId = '53424d00/00:0a:5b:3a:b5:90/224195' AND UserName = '' AND NASIPAddress= '10.199.21.8'; ; That's right - an UPDATE statement is written twice in one line, and not separated by semicolon. The semicolon sits in its own newline. Unsurprisingly, when played back with radsqlrelay, the statement fails with the "trailing garbage" that is the second UPDATE. The UPDATE statement itself as per config is NOT duplicated of course. I also see plenty of other UPDATEs coming from the same line of config which are not-replicated as they should be. So some race condition maybe? Greetings, Stefan -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

5 34

thread pool and requests queueing
by Eugene Grosbein 11 Apr '14

11 Apr '14

Hi! What may be a reason for freeradius idle thread does not processing new request from the queue immediately? thread pool { start_servers = 256 max_servers = 256 min_spare_servers = 256 max_spare_servers = 256 max_queue_size = 262144 max_requests_per_server = 0 } As you see, I have lots of threads and my logs show they are mostly idle (each thread logs its internal OS pthread id when post_auth is started). However, this what happens here: 1. freeradius obtains new request R and successfully queues it. I added radlog() call to event.c, received_request() just before "return 1;" to make sure. 2. Eventually, some thread starts to process this request but between moment 1 and this moment this thread processes 2-3 another requests. So, the request R was waiting in the queue meantime in spite of presence many other idle threads. This is big problem for us as sometimes my perl code NEEDS to insert 2 seconds delay before it returns RLM_MODULE_NOTFOUND to the dhcp module so that DHCPNAK is sent with 2 seconds delay. This way we keep broken DHCP clients from abusing our DHCP relays with tons of requests per second. These broken clients keep repeating DHCPDISCOVER/DHCPREQUEST at high rate if they get DHCPNAK quickly and we cannot get rid of them all. With this delay, they patiently wait for answer this giving us some kind of "request throttling". How can I force radiusd to use some idle thread at once to minimize queueing delay? Eugene

2 5