<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Courier;
panose-1:2 7 4 9 2 2 5 2 4 4;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"MS Sans Serif";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="PT" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">I have selinux in permissive mode so it should doesn’t interfere with traffic
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">Running the command you told me to result is ok. I seems to be a radiator bug.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">Can it be linux limits? I added the following lines do my security.conf file:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">* soft nofile 70000<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">* hard nofile 80000<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">These are very high limits for our number of users<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:6.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060">Fernando Reis</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:#002060">IT Services</span></b><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:#404040"> |
</span><b><span lang="EN-US" style="font-size:9.0pt;font-family:"Calibri",sans-serif;color:#002060">Polytechnic Institute of Castelo Branco<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Calibri",sans-serif;color:#404040">Av. Pedro Álvares Cabral n.º 12 6000-084 Castelo Branco - Portugal
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Calibri",sans-serif;color:#404040">T +351 272 339 600 | F +351 272 339 601 | @ fereis@ipcb.pt</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#404040"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Frank Danielson [mailto:FDanielson@csky.com]
<br>
<b>Sent:</b> 17 de março de 2017 19:45<br>
<b>To:</b> Fernando Reis <fereis@ipcb.pt><br>
<b>Cc:</b> radiator@lists.open.com.au<br>
<b>Subject:</b> Re: [RADIATOR] AuthDNSROAM DNS SRV Lookup Failure<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Fernando-<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Try checking the /var/log/audit/audit.log file to see if selinux is denying the traffic. That has bitten me more than once. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Also try to do the lookup with Net::DNS outside of Radiator. This lookup yielded both the NAPTR and SRV records.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Courier">perl -e 'use Net::DNS;<br>
my $res = Net::DNS::Resolver->new; <br>
my $reply = $res->query("</span><a href="http://id.fccn.pt"><span lang="EN-US" style="font-family:Courier">id.fccn.pt</span></a><span lang="EN-US" style="font-family:Courier">", "NAPTR");<br>
foreach $rr ($reply->answer) {<br>
$rr->print;<br>
if ($rr->service eq "x-eduroam:radius.tls"){<br>
my $reply = $res->query($rr->replacement, "SRV");<br>
foreach $rr ($reply->answer) {$rr->print;}}}'</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Courier"><br>
</span><a href="http://id.fccn.pt"><span lang="EN-US" style="font-family:Courier">id.fccn.pt</span></a><span lang="EN-US" style="font-family:Courier">.</span><span class="apple-tab-span"><span lang="EN-US" style="font-family:Courier"><o:p></o:p></span></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Courier">84181<span class="apple-tab-span">
</span>IN<span class="apple-tab-span"><o:p></o:p></span></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Courier">NAPTR<span class="apple-tab-span">
</span>( 100 10 s x-eduroam:radius.tls ""<br>
_radsec._</span><a href="http://tcp.fccn.pt"><span style="font-family:Courier">tcp.fccn.pt</span></a><span style="font-family:Courier">. )<br>
_radsec._</span><a href="http://tcp.fccn.pt"><span style="font-family:Courier">tcp.fccn.pt</span></a><span style="font-family:Courier">.<span class="apple-tab-span"><o:p></o:p></span></span></p>
<p class="MsoNormal"><span style="font-family:Courier">84181<span class="apple-tab-span">
</span>IN<span class="apple-tab-span"><o:p></o:p></span></span></p>
<p class="MsoNormal"><span style="font-family:Courier">SRV<span class="apple-tab-span">
</span>0 0 2083 </span><a href="http://radius01.fccn.pt"><span style="font-family:Courier">radius01.fccn.pt</span></a><span style="font-family:Courier">.<br>
</span><span lang="EN-US" style="font-family:Courier">_radsec._</span><a href="http://tcp.fccn.pt"><span lang="EN-US" style="font-family:Courier">tcp.fccn.pt</span></a><span lang="EN-US" style="font-family:Courier">.<span class="apple-tab-span"><o:p></o:p></span></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Courier">84181<span class="apple-tab-span">
</span>IN<span class="apple-tab-span"><o:p></o:p></span></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Courier">SRV<span class="apple-tab-span">
</span>0 10 2083 </span><a href="http://radius02.fccn.pt"><span lang="EN-US" style="font-family:Courier">radius02.fccn.pt</span></a><span lang="EN-US" style="font-family:Courier">.</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span class="apple-style-span"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#002E7A">ClearSky Technologies, Inc.</span></b></span><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span class="apple-style-span"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#262626">Frank Danielson |</span></b></span><span class="apple-style-span"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D"> </span></b></span><span class="apple-style-span"><b><i><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#31849B">Chief
Technology Officer</span></i></b></span><span lang="EN-US" style="font-size:10.5pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Wingdings;color:#404040">*</span><span lang="EN-US" style="font-size:7.5pt;font-family:"MS Sans Serif",serif;color:#595959"> </span><a href="applewebdata://B42CE82B-00AD-4466-A1C0-45CE1FB8AEBB/notifications@csky.com"><span lang="EN-US" style="font-size:7.5pt;font-family:"MS Sans Serif",serif">fdanielson@csky.com</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span lang="EN-US">On Mar 17, 2017, at 2:06 PM, Fernando Reis <</span><a href="mailto:fereis@ipcb.pt"><span lang="EN-US">fereis@ipcb.pt</span></a><span lang="EN-US">> wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Hello,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">We are in the process of implementing radsec on our server but when using authby DNSROAM the SRV lookup always fail:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Radiator logs:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Fri Mar 17 15:56:20 2017: DEBUG: Handling with Radius::AuthDNSROAM<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Fri Mar 17 15:56:20 2017: DEBUG: Resolver doing NAPTR lookup for<span class="apple-converted-space"> </span></span><a href="http://id.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">id.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Fri Mar 17 15:56:20 2017: DEBUG: AuthBy DNSROAM result: IGNORE, Discovering RadSec servers<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Fri Mar 17 15:56:20 2017: DEBUG: Resolver found NAPTR record for realm<span class="apple-converted-space"> </span></span><a href="http://id.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">id.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">:<span class="apple-converted-space"> </span></span><a href="http://id.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">id.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">.
73857 IN NAPTR ( 100 10 s x-eduroam:radius.tls ""<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> _radsec._</span><a href="http://tcp.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">tcp.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">.
)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Fri Mar 17 15:56:20 2017: DEBUG: Resolver doing SRV lookup for _radsec._</span><a href="http://tcp.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">tcp.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">,
Protocol radius Transport tcp UseTLS 1 Order 100 Preference 10<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Fri Mar 17 15:56:25 2017: INFO: Resolver: No reply from DNS for SRV request for realm<span class="apple-converted-space"> </span></span><a href="http://id.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">id.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Fri Mar 17 15:56:25 2017: DEBUG: AuthBy DNSROAM: No hardwired Route, no discovered Route, using DEFAULT Route for<span class="apple-converted-space"> </span></span><a href="http://id.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">id.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">When we do a tcpdump on the radius server we see that the dns server responds to the request but the radius sends (final line) port unreachable and the resolving
of the SRV request fails:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Tcpdump radius (193.137.66.131) > dns (193.137.66.129):<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">12:37:13.937148 IP 193.137.66.131.40586 > 193.137.66.129.53: 63986+ NAPTR?<span class="apple-converted-space"> </span></span><a href="http://id.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">id.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">.
(28)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">12:37:13.937383 IP 193.137.66.129.53 > 193.137.66.131.40586: 63986 1/0/6 NAPTR (268)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">12:37:13.945746 IP 193.137.66.131.40586 > 193.137.66.129.53: 37804+ SRV? _radsec._</span><a href="http://tcp.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">tcp.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">.
(38)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">12:37:13.946034 IP 193.137.66.129.53 > 193.137.66.131.40586: 37804 2/0/4 SRV<span class="apple-converted-space"> </span></span><a href="http://radius01.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">radius01.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">.:2083
0 0, SRV<span class="apple-converted-space"> </span></span><a href="http://radius02.fccn.pt/"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#954F72">radius02.fccn.pt</span></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">.:2083
0 10 (198)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">12:37:13.946058 IP 193.137.66.131 > 193.137.66.129: ICMP 193.137.66.131 udp port 40586 unreachable, length 234<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">I’ve installed all the necessary modules: Net::DNS + Socket6 + IO::Socket::INET6 for this to work but it always fails.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Anyone has an idea how to solve this?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>