- Freeradius-Users - lists.freeradius.org

Attribute MS-CHAP-Error
by nicolas.clo＠ricoh-industrie.fr 21 Jan '14

21 Jan '14

Hi all, Before Freeradius 3, I could sucessfully log the attribute Module-Failure-Message to catch many errors of ntlm_auth. In Freeradius 3 , if a user must change his password, the Module-Failure-Message return nothing (it doesn't yet exist ) Maybe it's with the new support of Change password in module mschap ??! My question is, how I can catch this error ? I try with the attribute MS-CHAP-Error but it the same result In log below, attribute doesn't yet exist when I try to catch him (16) log_mschap_error log_mschap_error { (16) ? if (MS-CHAP-Error =~ /.*Password expired.*/i) (16) ERROR: Failed retrieving values required to evaluate condition (16) } # log_mschap_error log_mschap_error = updated (16) } # Post-Auth-Type REJECT = updated } # server inner-tunnel (16) eap_peap : Got tunneled reply code 3 MS-CHAP-Error = '\tE=648 R=0 C=6833f9aa49b2f6bcc7dd53241f906cc7 V=3 M=Password Expired' EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 (16) eap_peap : Got tunneled reply RADIUS code 3 MS-CHAP-Error = '\tE=648 R=0 C=6833f9aa49b2f6bcc7dd53241f906cc7 V=3 M=Password Expired' EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Thanks.

3 2

RadPerf testing tool not avaliable
by Álex Llorens Piqueras 21 Jan '14

21 Jan '14

Good morning everyone, Is there any possibility to get RadPerf program so we can test it against our new freeradius server? I've looked in the official page, but the current form to get this tool its not working. It would be really good if we can get access to it, so we won't need to create a new one from scratch using radclient. And another question, for the ones that have used it. Is the tool compatible with the new 3.x branch or only with the 2.x.x and below? Thanks for your time, Alex

2 1

Re: Very pleased with 2.2.4
by Rui Ribeiro 20 Jan '14

20 Jan '14

Message: 1 Date: Mon, 20 Jan 2014 09:32:11 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Very pleased with 2.2.4 Message-ID: <52DD336B.5090303(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Hi Alan, the first one about failed connections stopped to appear after I installed 2.2.4, and now we have the second about deadlock. Truth indeed the DB is still on a share MySQL server, and will be moved to a dedicated one in a couple of weeks. Regards Rui Ribeiro wrote: > I?d like to congratulate you for the excellent work in freeradius and > the last 2.2.4 update. > Finally our freeradius doesnt stop work every x hours, and instead logs > an error and resumes working. > > Now instead of giving every couple of hours the errors: > > Thu Nov 7 18:32:09 2013 : Error: rlm_sql (sql): Failed to connect DB > handle #1 Those messages indicate issues with the database. They should be fixed, rather than ignored. > It just says: > > at Jan 18 09:22:26 2014 : Error: [sql] Couldn't insert SQL accounting > START record - Deadlock found when trying to get lock; try restarting > transaction Those messages indicate problems with the database. As Arran said, nothing changed to account for this. I'd suggest ensuring that your database is fast enough to handle the load. Alan DeKok. On 20 January 2014 16:12, <freeradius-users-request(a)lists.freeradius.org>wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Very pleased with 2.2.4 (Alan DeKok) > 2. Re: mschap Freeradius 3 (Arran Cudbard-Bell) > 3. RE: Re: mschap Freeradius 3 (nicolas.clo(a)ricoh-industrie.fr) > 4. Re: Core dump on start of FR3.0.1 (Alan DeKok) > 5. undefined reference to 'pthread_' (Marco Marino) > 6. RE: Core dump on start of FR3.0.1 (Palmer J.D.F.) > 7. Re: undefined reference to 'pthread_' (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 20 Jan 2014 09:32:11 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Very pleased with 2.2.4 > Message-ID: <52DD336B.5090303(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Rui Ribeiro wrote: > > I?d like to congratulate you for the excellent work in freeradius and > > the last 2.2.4 update. > > Finally our freeradius doesnt stop work every x hours, and instead logs > > an error and resumes working. > > > > Now instead of giving every couple of hours the errors: > > > > Thu Nov 7 18:32:09 2013 : Error: rlm_sql (sql): Failed to connect DB > > handle #1 > > Those messages indicate issues with the database. They should be > fixed, rather than ignored. > > > It just says: > > > > at Jan 18 09:22:26 2014 : Error: [sql] Couldn't insert SQL accounting > > START record - Deadlock found when trying to get lock; try restarting > > transaction > > Those messages indicate problems with the database. As Arran said, > nothing changed to account for this. > > I'd suggest ensuring that your database is fast enough to handle the > load. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Mon, 20 Jan 2014 14:42:30 +0000 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: mschap Freeradius 3 > Message-ID: <F877BA52-7537-4034-B9B1-1F9EA89EB617(a)freeradius.org> > Content-Type: text/plain; charset="iso-8859-1" > > > On 20 Jan 2014, at 14:22, nicolas.clo(a)ricoh-industrie.fr wrote: > > > It seems to miss the dollar's value at end. > > What do you mean by that... > > Ready to process requests > rad_recv: Access-Request packet from host 127.0.0.1 port 54106, id=127, > length=38 > User-Name = 'host/foo.boo.moo' > (0) # Executing section authorize from file > /usr/local/freeradius/etc/raddb/sites-enabled/default > (0) authorize { > (0) update request { > (0) expand: "%{mschap:User-Name}" -> 'foo$' > (0) Tmp-String-0 := "foo$" > (0) } # update request = noop > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > >

1 0

mschap Freeradius 3
by nicolas.clo＠ricoh-industrie.fr 20 Jan '14

20 Jan '14

Hi List, I'm encountered an error after upgrading Freeradius V2.2.4 to v3.0.2 User authentication works great but host not: host authentication in Freeradius 2: [mschapv2] +group MS-CHAP { [mschap] Creating challenge hash with username: host/T410_58.ricoh-industrie.fr [mschap] Client is using MS-CHAPv2 for host/T410_58.ricoh-industrie.fr, we need NT-Password [mschap] expand: --username=%{mschap:User-Name} -> --username=T410_58$ Freeradius 3 : (47) mschap : Creating challenge hash with username: host/T410_58.ricoh-industrie.fr (47) mschap : Client is using MS-CHAPv2 for host/T410_58.ricoh-industrie.fr, we need NT-Password (47) mschap : Executing: "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" (47) mschap : expand: "--username=%{mschap:User-Name}" -> '--username=T410_58.rico$' It seems to do not split correctly mschap User-Name. Any ideas ? Thanks. Nicolas.

2 4

Very pleased with 2.2.4
by Rui Ribeiro 20 Jan '14

20 Jan '14

Good day to all, I´d like to congratulate you for the excellent work in freeradius and the last 2.2.4 update. Finally our freeradius doesnt stop work every x hours, and instead logs an error and resumes working. Now instead of giving every couple of hours the errors: Thu Nov 7 18:32:09 2013 : Error: rlm_sql (sql): Failed to connect DB handle #1 Thu Nov 7 18:32:10 2013 : Error: rlm_sql (sql): There are no DB handles to use! skipped 20, tried to connect 0 It just says: at Jan 18 09:22:26 2014 : Error: [sql] Couldn't insert SQL accounting START record - Deadlock found when trying to get lock; try restarting transaction Sat Jan 18 10:29:24 2014 : Error: [sql] Couldn't update SQL accounting STOP record - Deadlock found when trying to get lock; try restarting transaction Sat Jan 18 10:29:24 2014 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Thank you

3 2

Possible little extension to dictionnary.h3c
by Mathieu Simon (Lists) 20 Jan '14

20 Jan '14

G'day While trying to figure out how I could tuck the admin auth to our FreeRADIUS for some of our 3Com 2928 switches which seemingly were made by H3C and thus behave a little different from standard 3Com comware devices. (HP has relabeled them, now known as HP 1910 series) After some searching I came across a forum post on HP's pages where a user mentioned how he got it working.* Thankfully he included his modified dictionnary.h3c which adds a single H3C-specific Hw_Exec_Privilege attribute which seems to do the trick for those boxes. Although it seems to work for me, if it's not completely wrong what about taking that little change upstream for the benefit of others? I've tested this on a old FR 2.1.12 on Debian, but it seems the H3C dict hasn't changed for some time and thus the patch should also apply on 2.x and 3.x branches. --- dictionary.h3c 2014-01-19 23:08:05.016784021 +0100 +++ dictionary.h3c.new 2014-01-19 23:09:48.832375719 +0100 @@ -18,4 +18,11 @@ ATTRIBUTE H3C-Ip-Host-Addr 60 string ATTRIBUTE H3C-Product-ID 255 string +ATTRIBUTE Hw_Exec_Privilege 29 integer + +VALUE Hw_Exec_Privilege H3C-Visitor 0 +VALUE Hw_Exec_Privilege H3C-Monitor 1 +VALUE Hw_Exec_Privilege H3C-Manager 2 +VALUE Hw_Exec_Privilege H3C-Administrator 3 + END-VENDOR H3C -- Mathieu Simon * For correct references: http://h30499.www3.hp.com/t5/Web-and-Unmanaged/V1910-radius-server-Level-pr…

2 2

EAP - TLS 1.2 Support
by Cholleti, Hanumantha 19 Jan '14

19 Jan '14

Hi Wondering if FreeRadius supports EAP TLS 1.2 authentication; our understanding is, if we have the OpenSSL version that supports the TLS 1.2 ciphers and FreeRadius EAP module is configured with the TLS 1.2 cipher, it should support. ISSUE: ===== Modem fails to do EAP TLS 1.2 authentication. Same modem successfully authenticates if it sends the SSL protocol of TLS 1.0 Want to make sure our FreeRadius configuration for EAP TLS 1.2 is correct. FreeRadius Version Details: ==================== Sat Jan 18 20:02:05 2014 : Info: radiusd: FreeRADIUS Version 3.0.0, for host x86_64-redhat-linux-gnu, built on Nov 19 2013 at 13:23:31 Sat Jan 18 20:02:05 2014 : Debug: Server was built with: Sat Jan 18 20:02:05 2014 : Debug: accounting Sat Jan 18 20:02:05 2014 : Debug: authentication Sat Jan 18 20:02:05 2014 : Debug: ascend binary attributes Sat Jan 18 20:02:05 2014 : Debug: coa Sat Jan 18 20:02:05 2014 : Debug: control-socket Sat Jan 18 20:02:05 2014 : Debug: detail Sat Jan 18 20:02:05 2014 : Debug: dhcp Sat Jan 18 20:02:05 2014 : Debug: dynamic clients Sat Jan 18 20:02:05 2014 : Debug: proxy Sat Jan 18 20:02:05 2014 : Debug: regex-pcre Sat Jan 18 20:02:05 2014 : Debug: session-management Sat Jan 18 20:02:05 2014 : Debug: stats Sat Jan 18 20:02:05 2014 : Debug: tcp Sat Jan 18 20:02:05 2014 : Debug: threads Sat Jan 18 20:02:05 2014 : Debug: tls Sat Jan 18 20:02:05 2014 : Debug: unlang Sat Jan 18 20:02:05 2014 : Debug: vmps Sat Jan 18 20:02:05 2014 : Debug: Server core libs: Sat Jan 18 20:02:05 2014 : Debug: talloc : 2.0.* Sat Jan 18 20:02:05 2014 : Debug: ssl : OpenSSL 1.0.0-fips 29 Mar 2010 SSL Version Details ============== OpenSSL 1.0.1e-fips 11 Feb 2013 OpenSSL ciphers: ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA:KRB5-DES-CBC3-SHA:KRB5-DES-CBC3-MD5:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:IDEA-CBC-SHA:PSK-AES128-CBC-SHA:KRB5-IDEA-CBC-SHA:KRB5-IDEA-CBC-MD5:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:KRB5-RC4-SHA:KRB5-RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:KRB5-DES-CBC-SHA:KRB5-DES-CBC-MD5:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-KRB5-RC2-CBC-SHA:EXP-KRB5-DES-CBC-SHA:EXP-KRB5-RC2-CBC-MD5:EXP-KRB5-DES-CBC-MD5:EXP-RC4-MD5:EXP-KRB5-RC4-SHA:EXP-KRB5-RC4-MD5 CONFIGURATION: ============== Sorry if we missed any additional documentation, for EAP TLS 1.2 authentication, we updated our eap configuration cipher: cipher_list = "AES256-SHA256" When the modem sends the protocol as TLS 1.0 - it authenticates successfully with the cipher_list "AES256-SHA256:AES128-SHA" or cipher_list set to "DEFAULT"; But, when modem sends the protocol as TLS 2.0; the authentication fails in EAP module, with following error: ERROR from radius log ================= With cipher set to (AES256-SHA256), we see following error in the log: (3) eap : EAP TLS (13) (3) eap : Calling eap_tls to process EAP data (3) eap_tls : Authenticate (3) eap_tls : processing EAP-TLS TLS Length 50 (3) eap_tls : Length Included (3) eap_tls : eaptls_verify returned 11 (3) eap_tls : (other): before/accept initialization (3) eap_tls : TLS_accept: before/accept initialization (3) eap_tls : <<< TLS 1.0 Handshake [length 002d], ClientHello (3) eap_tls : >>> TLS 1.0 Alert [length 0002], fatal handshake_failure [1m[31m(3) ERROR: eap_tls : SSL says: TLS Alert write:fatal:handshake failure[0m [1m[31m(3) ERROR: eap_tls : SSL says: TLS_accept: error in SSLv3 read client hello C[0m [1m[31m(3) ERROR: eap_tls : SSL says: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher[0m [31mSSL: SSL_read failed in a system call (-1), TLS session fails.[0m TLS receive handshake failed during operation (3) eap_tls : eaptls_process returned 4 [1m[31m(3) ERROR: eap : Failed continuing EAP TLS (13) session. EAP sub-module failed[0m (3) eap : Failed in EAP select (3) [eap] = invalid (3) } # Auth-Type eap = invalid (3) Failed to authenticate the user. Attached is the complete log with -X option. Access-Request - Packet Capture Detail - EAP Message: ========================================== Here is the Access-Request packet capture from modem showing the SSL protocol as TLS 1.2, along with the Cipher's being sent (0x003d - AES256-SHA256, and 0x002f - AES128-SHA) AVP: l=64 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 1 Length: 62 Type: TLS EAP (EAP-TLS) (13) EAP-TLS Flags: 0x80 1... .... = Length Included: True .0.. .... = More Fragments: False ..0. .... = Start: False EAP-TLS Length: 52 Secure Sockets Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 47 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 43 Version: TLS 1.2 (0x0303) Random gmt_unix_time: Jan 17, 2014 10:28:34.000000000 Pacific Standard Time random_bytes: 5aece723603b9f8864bfd0c80e592377f01f0b4cc787511d... Session ID Length: 0 Cipher Suites Length: 4 Cipher Suites (2 suites) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) Please let us know if you need any additional information. Thanks -Hanu

3 4

Error in freeradius3 first time running
by Mehdi Ravanbakhsh 19 Jan '14

19 Jan '14

Hi all i am install freeradius3 in freebsd [ embeded engine (NanoBSD) ]: and i get this error in first run : [root@router]~# radiusd -X radiusd: FreeRADIUS Version 3.0.0, for host amd64-portbld-freebsd10.0, built on Jan 19 2014 at 01:32:29 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including dictionary file /usr/local/etc/raddb/dictionary Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.dhcp[208]: Type "tlv" can only be for "format=1,1". can anyone help me

2 1

Freeradius init script error
by Nicolas CLO 19 Jan '14

19 Jan '14

Hi list, Since I have updated Freeradius to v 2.2.4, the init script reports a failed start. It tell me that address is already in use but start correctly. There is no port 1812 open when Freeradius is shutdown. The init script is the same than older version. Thanks Nicolas.

5 12

regarding rlm perl scripts
by Bishal Pun 19 Jan '14

19 Jan '14

Hello all, I am using freeradius 2.1.6 on Freebsd server with mysql + LDAP server. Is is possible to send reply attribute based on sql group? If yes then how can I do? thank you

2 2