- Freeradius-Users - lists.freeradius.org

Post-Proxy-Type Reject handling
by Julius Plenz 13 Nov '13

13 Nov '13

Hi, I'm a little bit confused by the change introduced in commit 4b9d325515 ("Set Post-Proxy-Type Reject if the request was rejected by the proxy server") from 19 Dec 2012. I think most users, including me, expect that a Reject reply received from a remote RADIUS server is automatically forwarded by the mediating RADIUS server to the client. But it seems this patch changes the default behaviour. What I'm seeing is that such a Reject reply will be silently discarded and *not* forwarded to the client. This may break a few setups. Sadly, the Post-Proxy-Type "Reject" is not even mentioned anywhere in the example config files. Especially I would suggest adding a hint akin to the "Fail" case in "raddb/sites-available/default". What is the correct move to make FreeRADIUS behave like pre-2.2.1, i.e. just forwarding the proxy reply? I'm guessing I should duplicate my "post-proxy" modules again inside a Post-Proxy-Type Reject {} stanza? Thank you, Julius

4 9

Question about how to find unfinished requests
by John Douglass 13 Nov '13

13 Nov '13

I am trying to debug an issue on my servers with the following configuration: freeradius 2.2.0 -> proxy to AD server running radius for auth -> return auth (yes/no) then my server appends the necessary vlan attributes from its local DB I am seeing a number of these messages: Nov 11 17:57:31 dvlanc radiusd[17781]: Received conflicting packet from client resnet4-WiSM-A port 32770 - ID: 18 due to unfinished request 928878. Giving up on old request. Nov 11 17:57:35 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 205 due to unfinished request 929613. Giving up on old request. Nov 11 17:57:37 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 36 due to unfinished request 929843. Giving up on old request. Nov 11 17:57:41 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 205 due to unfinished request 930139. Giving up on old request. Nov 11 17:57:41 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 216 due to unfinished request 929934. Giving up on old request. Nov 11 17:57:44 dvlanc radiusd[17781]: Received conflicting packet from client resnet4-WiSM-A port 32770 - ID: 253 due to unfinished request 929666. Giving up on old request. Nov 11 17:57:44 dvlanc radiusd[17781]: Received conflicting packet from client Rich-core-WiSM-B port 32770 - ID: 36 due to unfinished request 930099. Giving up on old request. How do I view "into the beast" to find the start of these requests? For example, I see no way to locate the stream of events for request 928878 so that I can narrow down where the problem is. My gut says it's located down the chain at the AD server (accessed via the radius protocol) taking too long but I have to prove it before I can get some action. Would tcpdump/tshark/etc be the way to attempt to follow these authentications or is there a better way with some enhanced logging parameters? If we know the request numbers, how do you pair those with any internal logging (via maybe radmin). It would be useful if, say, all log messages like Nov 11 17:57:21 dvlanc radiusd[17781]: Login OK: [mbaker66] (from client Rich-core-WiSM-B port 13 cli e0-c9-7a-55-9b-f5) Nov 11 17:57:21 dvlanc radiusd[17781]: Login OK: [fpeterson99] (from client resnet4-WiSM-A port 13 cli a8-96-8a-f3-5f-5b) Nov 11 17:57:21 dvlanc radiusd[17781]: Login OK: [gabriwal3] (from client resnet4-WiSM-A port 13 cli 3c-d0-f8-61-f3-27) included the request numbers in their logging output (or actually ANY log messages should include the request number it is involved in). We are having some major problems as the freeradius server gets hit with load between classes and starts losing auth. We are attempting to remove the dependence upon samba by going with configuring a proxy to AD over radius for authentication rather than rely upon an ntlm_auth. Thanks for any input/advice.

5 5

Problem with using MySQL for radius clients
by Mik J 10 Nov '13

10 Nov '13

Hello, I know that by default you configure your radius clients in the file /etc/raddb/clients.conf However I would like them to be entered in MySQL I have modified the file /etc/raddb/sites-enabled/default and I expect the Freeradius server to check the clients in MySQL instead of clients.conf authorize { sql #files } And added an input into the nas table INSERT INTO nas VALUES (NULL , '192.168.0.1', 'myNAS', 'other', NULL , 'mysecret', NULL , NULL , 'RADIUS Client' ); Unfortunately this doesn't work because 1) $ radtest testuser passsecret 127.0.0.1 1812 testing123 <= works and testing123 is what is specified in clients.conf 2) $ radtest testuser passsecret 127.0.0.1 1812 mysecret <= doesn't work and what's specified in the nas table Since I have commented "files" I would also expect the freeradius server not to check clients.conf Could someone point out my misunderstanding ? Thank you

3 5

Populate an array with several accounts from radcheck.
by Alexander Silveröhrt 09 Nov '13

09 Nov '13

Hiya, I have a problem with the time it takes to initiate the DBI connection in a pre_auth script hook using rlm_perl. This is the time recorded for some parts in the code. rlm_perl: DEBUG: Time between DBI initialization start and DBI initialization stop was: 0.013145! rlm_perl: DEBUG: Time between SQL Query LIKE start and SQL Query LIKE stop was: 0.001079! rlm_perl: DEBUG: Time between SCRIPT start and SCRIPT stop was: 0.014898! I was hoping to be able to cut off a lot of time by using freeradius already open MYSQL connection and make a SQL QUERY in ulang and populate an ARRAY with the result from a SQL LIKE query. And from that QUERY then use the SQL result in the ARRAY attribute inside the perl script instead of letting the script do a database query? Today in the perl hook the query is and it should be the same when using ulang. $sth = $dbh->prepare("SELECT DISTINCT username FROM radcheck where username LIKE '$SUBSCRIBER_ACCOUNT%'"); where $SUBSCRIBER_ACCOUNT% is the received USERNAME. The SQL result could be anything from 1 account to 8 accounts for instance +----+----------------------------------------+-----------+----+--------+ | id | username | attribute | op | value | +----+----------------------------------------+-----------+----+--------+ | 17 | 10.33.1.4_GigabitEthernet0/0/2 CH_VoIP | Auth-Type | := | Accept | | 18 | 10.33.1.4_GigabitEthernet0/0/2 CH_IPTV | Auth-Type | := | Accept | | 19 | 10.33.1.4_GigabitEthernet0/0/2 | Auth-Type | := | Accept | +----+----------------------------------------+-----------+----+--------+ We have tried several ways and tried to find any references in the manual to populate ARRAYs to be able to do this but when we try the resulting variable only contains one account? And also where should we put the query to be able to use the SQL result in the pre-auth script.? Should it be in servers sites-available/sitename before the perl call? I hope someone can help. Thanks Alex ********* DISCLAIMER ********* This message and any attachment are confidential and may be privileged or otherwise protected from disclosure and may include proprietary information. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person

2 1

Help
by Wederson Rodrigues 09 Nov '13

09 Nov '13

Hi guys, I need to release the authentication (no username and password) for certain realm (anything @ domain1 connect with any username and password. domain2 users continue normally. Is it possible? -- []'s ----------------------------------------- .'. Wederson Rodrigues .'. (CeBoLaRk) VIP - Vilhena Internet Provider Gerente de T.I. http://www.vipvilhena.com.br MSN: cebolark(a)hotmail.com SKYPE: cebolark EMAIL: wederson(a)vipvilhena.com.br INOC VOIP: 28240*100 Celular: 0xx69 8437-0186 Fixo: 0xx69 3322-2244 -----------------------------------------

2 1

chain certificate problem
by Thierry Chich 08 Nov '13

08 Nov '13

Hello, I have a problem with the certificate I use for my eap-peap. It seems that the certificate is not recognized. What I know: 1) the chain is complete : radius:/etc/freeradius/certs# c_rehash certificatAP/ ... radius:/etc/freeradius/certs# openssl verify -CApath certificatAP/ certificatAP/certificat20sept2014.pem certificatAP/certificat20sept2014.pem: OK 2) it is a problem of certificate: windows accept to connect if I ask him to not vaidate the certificate server. With other os than windows, I have more details. OSX is claiming that my certificate is not verified. It is not OS related. 3) The root certificate is accepted in both OS. What the point ? Should I have all the intermediate certificate in the store of my clients ? Is it a way to present the whole chain to the client, the same way it can be done by http servers ? Regards, -- Thierry CHICH

4 6

fr 3.0.0 - peap problem
by Polish 08 Nov '13

08 Nov '13

Hello all, I want to test new features of freeradius 3.0.0 from tarball, but I don't be able run successfull PEAP - MS-CHAPv2 authentization. Testing environment: freeradius 3.0.0 local user in users file (cleartext password: ferda Cleartext-Password := "hello") testing certificates generated by bootstrap Result in debug log: (12) eap_peap : Tunneled authentication was successful. (12) eap_peap : SUCCESS (12) eap : New EAP session, adding 'State' attribute to reply 0xbb50c041b359d9c3 (12) [eap] = handled (12) } # authenticate = handled ... 13) # Executing group from file /etc/freeradius/sites-enabled/default (13) authenticate { (13) eap : Expiring EAP session with state 0xbb50c041b359d9c3 (13) eap : Finished EAP session with state 0xbb50c041b359d9c3 (13) eap : Previous EAP request found for state 0xbb50c041b359d9c3, released from the list (13) eap : Peer sent PEAP (25) (13) eap : EAP PEAP (25) (13) eap : Calling eap_peap to process EAP data (13) eap_peap : processing EAP-TLS (13) eap_peap : eaptls_verify returned 7 (13) eap_peap : Done initial handshake (13) eap_peap : eaptls_process returned 7 (13) eap_peap : FR_TLS_OK (13) eap_peap : Session established. Decoding tunneled attributes. (13) eap_peap : Peap state send tlv success (13) eap_peap : EAP type NAK (3) (13) eap_peap : We sent a success, but received something weird in return. SSL: Removing session 370322346fc943fdb1aad36f4480d755e0cbe3cea31c375242d599bc8f16ad4e from the cache (13) ERROR: eap : Failed continuing EAP PEAP (25) session. EAP sub-module failed (13) eap : Failed in EAP select (13) [eap] = invalid (13) } # authenticate = invalid (13) Failed to authenticate the user. radtest results: # test of inner-tunnel root@ferda:/etc/freeradius# radtest ferda hello localhost:18120 0 testing123 Sending Access-Request of id 124 from 0.0.0.0 port 51463 to 127.0.0.1 port 18120 User-Name = 'ferda' User-Password = 'hello' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 rad_recv: Access-Accept packet from host 127.0.0.1 port 18120, id=124, length=20 root@ferda:/etc/freeradius# radtest -t mschap ferda hello localhost:18120 0 testing123 Sending Access-Request of id 207 from 0.0.0.0 port 56629 to 127.0.0.1 port 18120 User-Name = 'ferda' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0xcf018e925195d3d9 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000c1dbccbde8a3f351c6abf211ec362574a0791cbeb4d5e93a rad_recv: Access-Accept packet from host 127.0.0.1 port 18120, id=207, length=84 MS-CHAP-MPPE-Keys = 0xfda95fbeca288d44ac0782e2de2337dee40e54ee732c1af5 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed # test on default port root@ferda:/etc/freeradius# radtest ferda hello localhost 0 testing123 Sending Access-Request of id 34 from 0.0.0.0 port 58221 to 127.0.0.1 port 1812 User-Name = 'ferda' User-Password = 'hello' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=34, length=20 root@ferda:/etc/freeradius# radtest -t mschap ferda hello localhost 0 testing123 Sending Access-Request of id 58 from 0.0.0.0 port 50981 to 127.0.0.1 port 1812 User-Name = 'ferda' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x3391672449586edb MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000cd40eb3770183e9a6ee3cc67da194680f1abb095c7561f41 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=58, length=84 MS-CHAP-MPPE-Keys = 0xfda95fbeca288d44ac0782e2de2337dee40e54ee732c1af5 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed I don't know where is problem. Thanks for tips and advises. Best regards Pavel Polacek

4 7

validate server certificate fails
by Khapare Joshi 08 Nov '13

08 Nov '13

I have tested selfsing certificate, it works. I had to copy the ca.cert into windows client. Pretty much what this link describes. http://kirkkosinski.com/2012/10/securing-wi-fi-with-peap-and-freeradius-on-… Now, i have signed certificate from our CA added into eap.conf then imported ca.pem into windows machine. 7 machine and try to authenticate, it always fails. but If I check off the validate server certificate on M$$$$$client machine it works. I have following in my eap.conf tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/myhost.example.key certificate_file = ${certdir}/myhost.example.crt CA_file = ${certdir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } freeradius version is freeradius-2.1.10-5.el6.x86_64 and Red Hat Enterprise Linux Server release 6.1 This M$ is giving me nightmare :) any idea on this would be great

2 2

SERVICE PROVISIONING USING AAA
by Russell Mike 08 Nov '13

08 Nov '13

Dear Community i need help, i do work with an ISP has wireless network across the country build up using more than 5000 wireless devices using Motorola/Cambium Canopy microwave radios. Currently, if a customer did not pay the subscription until the last day of the month. A agent from customer support department disconnect the customer manually by disabling SM's (subscriber Module) interface. 1.) i have been requested to come up with some kind of solution where this must happen automatically (connection/disconnection). because we have grow enough and it is actually difficult to handle this manually. if [[ disconnection]]; then customer should be redirected to a static web page, where he is told the reason of disconnection that his subscription has expired. 2.) i did research about it and came up with the solution to setup Freeradius v2.2.0. 3.) FR has been configure properly, i have tested with Cisco & Chilli NAS using MySQL Database users. AAA functionality works as expected, Max-All-Sessions, Session-Timeout etc.. etc.. etc.. WORKS !! 4.) i know Cambium AP can also act as NAS and support EAP method as well. But i am unable to understand the logic that how it can archive the above mentioned requirement - PROVISIONING SERVICE USING AAA 5.) i have also setup open-ldap servers as replication model on *CentOS 6x, UB 12.4LTS & FreeBSD Unix*, because i learnt that these are the components are the answer to our requirements. But i am not so much clear how LDAP can be used to authenticate SM's. i have little idea from my research that i can use Session-Timeout attribute so that SM needs to authenticate everyday. This is here the confusion is. i can figure out using MSSQL query from our CRM database that who has not paid. But what should happen if customer did not paid? user should be deleted from LDAP? so that SM is unable to authenticate by FR ? Am i correct that LDAP can be used in such scenario ? i know many admins are using such techniques. Thats why seeking help & their advice. if someone has little time just to help me understanding how to put components together, will very very grateful. all component has been setup but could not understand how it would work together. Thanks / RM--

2 1

Per nas simultaneous-use limit
by ST Wong (ITSC) 08 Nov '13

08 Nov '13

Hi all, We want to per user limit login to 4 for particular NAS. I added following in users: DEFAULT Huntgroup-Name == "broadband", Simultaneous-Use := 4 Fall-Through = Yes And in huntgroups: broadband NAS-IP-Address == 192.168.192.201 broadband NAS-IP-Address == 192.168.192.204 Is seems the limit of 4 is for all users in the same NAS instead of particular users. We're using 2.2.0. Would anyone advise? Thanks lot. Rgds, /st

2 2