- Freeradius-Users - lists.freeradius.org

DHCP module and external DHCP relay
by Eugene Grosbein 04 Apr '14

04 Apr '14

Hi! We use FreeRADIUS 2.2.0 as DHCP server with rlm_perl to connect to external database to run stored procedure there that returns IP/mask/DNS etc for option82-enabled requests. The database is pretty fast and serves hundreds of parallel requests in 1 second or less. FreeRADIUS receives all DHCP requests from external high loaded DHCP relay and threats them all as coming from single DHCP client. Our perl script does extensive logging through direct syslog connection and I see that there is great delay between the moment of DHCP request arrival as shown by tcpdump and the moment when post_auth perl function is invoked by FreeRADIUS. This delay is about 6 seconds and some DHCP clients do not wait for so long. Is it possible to eliminate these delays? Here are lines from radiusd log: Request 14280134 has been waiting in the processing queue for 6 seconds. Check that all databases are running properly! Discarding duplicate request from client dhcp port 67 - ID: 1381353109 due to unfinished request 14280311 Again, our database processes most request in less than 1 second and very seldom in 2 seconds but mentioned problem is persistent. Eugene Grosbein

2 11

Re: Freeradius-Users Digest, Vol 108, Issue 17
by Rui Ribeiro 04 Apr '14

04 Apr '14

This is very important. You either place your DHCPs in your multiple broadcast domains, or do your L4 routing with dhcp-helpers (which of course is the right way to do it). Even then you have to be careful how you are doing your routing. There is no other way. Be also careful with your NATs, many protocols are broken by NAT. Regards, Rui Ribeiro http://pt.linkedin.com/pub/rui-ribeiro/16/ab8/434/ > Message: 3 > Date: Thu, 03 Apr 2014 12:26:51 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius DHCP IP pool and not correct port for DHCP > Message-ID: <533D8BCB.3000403(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Thomas Bru wrote: > > You're true and your explanations are very usefull. > > That's good. > > > The IAD has no problem because it did what I programmed. > > But there are not solution to this source-nat problem. > > There is. DHCP traffic MUST NOT be NATed. The NAT gateway must > either (a) block the DHCP traffic, or (b) implement a DHCP relay. > > Alan DeKok. > >

1 0

Re: Freeradius-Users Digest, Vol 108, Issue 18
by Rui Ribeiro 04 Apr '14

04 Apr '14

Why not define networks/VLANs for the APs? The control network should be in an firewalled netblock anyway for security reasons. Regards, Rui Ribeiro > > Message: 3 > Date: Fri, 4 Apr 2014 00:26:19 +0200 > From: Benoit <goony(a)hotmail.fr> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: update NAS > Message-ID: <DUB124-W62743D37C6A0D2C4389E5CA6C0(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > > I've been looking up how to reload my SQL NAS list without having to > restart the service, and found this command: > > kill -1 `cat /var/run/freeradius/freeradius.pid` > > I checked and the freeradius.pid file is there, and if I run the command > it seems to work since no error returns. But it does not seem to affect the > freeradius process and my updated clients list is still not recognized. > > Is this the way to proceed? What can I be missing? > > > Anyways I was wondering, if I restart the freeradius service, will the > current connections (and/or their accounting) be lost or affected? Or is it > just a problem if someone tries to connect exactly when the service > restarts? > > Benoit > > >

1 0

Subject: Re: AW: freeradius EAP TLS / Windows 8 Client was Re: Freeradius-Users Digest, Vol 108, Issue 18
by Rui Ribeiro 04 Apr '14

04 Apr '14

As far as I remember Windows 8 is far more picky with configurations/certificates than the previous versions. It took a while and a couple of tries to get the certificate right. Rui > Message: 1 > Date: Thu, 03 Apr 2014 22:11:18 +0200 > From: Alain P?an <alain.pean(a)lpn.cnrs.fr> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: AW: freeradius EAP TLS / Windows 8 Client > Message-ID: <533DC066.1040706(a)lpn.cnrs.fr> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Le 03/04/2014 19:39, kai.zemke(a)hauni.com a ?crit : > > While i was investigating i also found this bugs about windows 8 and > cisco APs. > > But they all apply to setups with a centralized access point management. > I have only autonomous standalone access points. > > So from my point of view... this bug does not apply to my setup. > > I already read the report of such a behaviour with windows 8 and a > Netgear wireless access point (wnap300). If you have another wireless > AP available, for example aruba, you should try with it. Another test is > to try PKIP instead of WPA2 on your AP ssid. > >

1 0

eDirectory question :-)
by stefan.paetow＠diamond.ac.uk 03 Apr '14

03 Apr '14

Hi, Quick question... does the FreeRADIUS rlm_ldap module have to be built explicitly with eDirectory to support it or does it support it as standard? AFAIK eDirectory does standard LDAP/LDAPS anyway, doesn't it? Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

2 2

Querying freeRADIUS from Java
by Estefania figueroa buitrago 03 Apr '14

03 Apr '14

Hello guys, I just started to use freeRADIUS. The server is running and working with mySQL just like in this tutorial: http://wiki.freeradius.org/guide/SQL-HOWTO What I want to do is really simple. I want to be able to query the server from Java just like radtest does and get response information, for example: Framed-IP-Address = 2.3.4.1 Framed-IP-Netmask = 255.255.255.255 Framed-Routing = Broadcast-Listen Framed-Route = "2.3.4.0 255.255.255.248" Idle-Timeout = 900 Service-Type = Framed-User Framed-Protocol = PPP to be processed later also in Java. Is there a way to do this and keep it as simple as possible? I have an application server written in Java (Mobicents) and I only need to obtain authentication information from freeRADIUS to process it later. Sorry if my cuestion isn't pertinent, but I haven't find anything in the wiki. If there is no way to do this, I would be very grateful if you could show another way to do it. Greetings, Estefanía

4 3

update NAS
by Benoit 03 Apr '14

03 Apr '14

Hi, I've been looking up how to reload my SQL NAS list without having to restart the service, and found this command: kill -1 `cat /var/run/freeradius/freeradius.pid` I checked and the freeradius.pid file is there, and if I run the command it seems to work since no error returns. But it does not seem to affect the freeradius process and my updated clients list is still not recognized. Is this the way to proceed? What can I be missing? Anyways I was wondering, if I restart the freeradius service, will the current connections (and/or their accounting) be lost or affected? Or is it just a problem if someone tries to connect exactly when the service restarts? Benoit

2 1

freeradius EAP TLS / Windows 8 Client
by kai.zemke＠hauni.com 03 Apr '14

03 Apr '14

Hi everyone, we have a strange problem going on here. We have a Windows 8 Client that tries to join our WLAN using EAP TLS Auth. The Server writes to its logfiles that everything seems to be ok and he is willing to give this system a: ACCESS-ACCEPT Thu Apr 3 06:05:55 2014 : Auth: Login OK: [host/KP4101] (from client kc1034 port 807 cli 5C-51-4F-D9-5E-6D) In a traffic dump I can see the following packages to the end of the conversation: PacketNo Length Info 17 825 Access-Request 18 1132 Access-Challenge <<<< In this Packet is EAP-TLS Length of 1626 mentioned but its size is only 1024, shouldn't the server send the missing 602 bytes in response to the next request instead of the Access-Accept? 19 219 Access-Request 20 232 Access-Accept Because on the other side we have the client on there are the following log entries: 0086 [5060] 03-11 08:41:37:364: >> Received Request (Code: 1) packet: Id: 11, Length: 1024, Type: 13, TLS blob length: 1626. Flags: LM <<<< The client receives the 1024 bytes from packet no. 18, I assume and he is aware of the fact that the TLS blob is 1626 bytes. 0087 [5060] 03-11 08:41:37:364: EapTlsCMakeMessage, state(3) flags (0x1400) 0090 [5060] 03-11 08:41:37:364: << Sending Response (Code: 2) packet: Id: 11, Length: 6, Type: 13, TLS blob length: 0. Flags: <<<< The client is responding 0093 [5060] 03-11 08:41:37:379: >> Received Success (Code: 3) packet: Id: 11, Length: 4, Type: 0, TLS blob length: 0. Flags: <<<< The client receives a Success ( Access-Accept ), but aren't we expecting 602 Bytes here? 0094 [5060] 03-11 08:41:37:379: EapTlsCMakeMessage, state(3) flags (0x1410) 0095 [5060] 03-11 08:41:37:379: Code 3 unexpected in state SentFinished <<<< The client wonders about something ( 602 missing bytes?) and cancels the whole authentication process to restart it again 5 seconds later. 0096 [5060] 03-11 08:41:37:379: EapTlsEnd 0097 [5060] 03-11 08:41:37:379: EapTlsEnd(host/kp5975.hauni.koerber.de) This process loops for about 5 minutes than the client seems to be feed up and stops its joining efforts. In my lab I have a Cisco Access Point with a brand new IOS Version 15.2(4)JB4. Freeradius comes in its version 2.1.1 and the client runs Windows8 we also have a Windows8.1 client but the problem is the same. Can anyone bring a clarification to this? The exact same setup is working with Windows7 clients without any problems. Regards from Hamburg/Germany Kai

4 6

Re: Freeradius DHCP IP pool and not correct port for DHCP
by Thomas Bru 03 Apr '14

03 Apr '14

Hello Alan You're true and your explanations are very usefull. The IAD has no problem because it did what I programmed. But there are not solution to this source-nat problem. The problem will always appear on the DHCP renewal and I can't do any thing on this IAD. I will used the DHCP request sended at 87,5% of the lease time for workaround this. Thanks you for your explanations and your help. Thomas >> When the renewal DHCP packets are send using unicast, my client try to >> reach FreeRadius. he send DHCP request using his IP address with source >> port 68 and the freeradius IP Address with destinatio port 67. >> My IAD source pat the flow using a dynamic random port. > That is not how DHCP works. > DHCP clients use a source port of 68. DHCP relays use a source port of 67. > Your IAD (whatever that is) is broken. Replace it with something that does DHCP properly. >> I don't understand why Freeradius will not reply to the initial source >> port ? > Because DHCP is insane. The replies do *not* cause the src/dst ports to be swapped, as with every other UDP protocol. >>> 3) This packet trace is not evidently the first requests, but a renewal? >> You're true, i see the problem only on the renewal (When 50% of the >> lease time have been reached). > Then look at the packet traces to see how the first request is different from the renewal. Alan DeKok.

2 1

Re: Accounting and octets - a silly one! was Re: Freeradius-Users Digest, Vol 108, Issue 13
by Rui Ribeiro 03 Apr '14

03 Apr '14

Octets means bytes, and in fact it also the most used french word in lieu of byte. Historically, and very long long ago, the point is that byte was not always 8 bits - there were very old mainframes with 9 bits. Regards, Message: 5 > Date: Thu, 3 Apr 2014 11:28:11 +0200 > From: Chris Knipe <savage(a)savage.za.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Accounting and octets - a silly one! > Message-ID: > < > CA+4TWFuaf9UCZbNZqPHQAZmQkoUc-5k2OoRKfL3aD7ybrVavhA(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Thanks all for clearing it up - as I said, really stilly question :-) > > I must have pulled some old stuff off google then that referenced > octets as *possibly* being bits... > > On Thu, Apr 3, 2014 at 11:05 AM, Arran Cudbard-Bell > <a.cudbardb(a)freeradius.org> wrote: > > > > On 3 Apr 2014, at 09:36, Chaigneau, Nicolas < > nicolas.chaigneau(a)capgemini.com> wrote: > > > >> > >> "octets" means "bytes". > > > > Yes, in modern systems they are synonymous. > > > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > > FreeRADIUS Development Team > > > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > -- > > Regards, > Chris Knipe > > >

2 1