July 2021 - Freeradius-Users - lists.freeradius.org

Multiple Calling of SQL Statements
by Selahattin CILEK 28 Jul '21

28 Jul '21

I want FreeRADIUS 3.0.22 (I can't update now, sorry.) to reject anonymous logins *a**nd* log every successful login to the database. To that end, I wrote three MySQL stored procedures. 1. is_login_allowed -> Checks if the user in the database and has not exceeded his quota etc. 2. log_login -> Logs a successful login to the database. 3. log_mac -> Logs the MAC address of the user's device. Of course, I thought, the most reasonable place to achieve my goal was to place my sproc calls in the inner tunnel, since we always get the real user name there, at least that is my thinking. Here is the site script for my inner tunnel: server inner-tunnel-ttls { listen { ipaddr = 127.0.0.1 port = 18127 type = auth } authorize { * # Custom Script** ** if ("%{sql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) {** ** reject** ** }** ** else {** ** "%{sql: CALL log_login('%{User-Name}', '%{Calling-Station-Id}', '%{NAS-IP-Address}')}"** ** "%{sql: CALL log_mac('%{Calling-Station-Id}', '%{User-Name}')}"** ** }* eap { ok = return } sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } session { sql } post-auth { update outer.reply { User-Name += &request:User-Name Class += &reply:Class Idle-Timeout += &reply:Idle-Timeout Acct-Interim-Interval += &reply:Acct-Interim-Interval } if (1) { update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY } update { &outer.session-state: += &reply: } } Post-Auth-Type REJECT { -sql attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { eap } } It is simple, isn't it? And it should work, right? It *does* work. The problem is that for each successful login, I see 4 entries in the database, which suggests that the sproc is called 4 times simultaneously or in quick succession. Can anyone explain to me why this is happening and is there a way I can fix this? Thank you in advance... SCilek -- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

2 4

Accommodating miss behaving NAS?
by David Herselman 28 Jul '21

28 Jul '21

Hi, We have a legacy ADSL system whereby the Telco handles PPPoE termination of the circuits, proxying authentication and accounting records through to us. We have several instances where the NASs appear to be miss-behaving and looking for recommendations around this. Authorization and authentication appears to be working as intended, accounting is also initially as expected in that we receive accounting start, interim updates and then an accounting stop. We however then continue to receive interim update accounting records where the utilisation is not added to the radacct table. We do have a request logged with the Telco regarding this behaviour, but our legacy FR v1 system would continue to associate accounting data and my understanding of the mods-config/sql/main/mysql/queries.conf file is that the following query should still continue to update the closed session as well (pretty sure the following is unmodified): # # Update an existing session and calculate the interval # between the last data we received for the session and this # update. This can be used to find stale sessions. # query = "\ UPDATE ${....acct_table1} \ SET \ acctupdatetime = (@acctupdatetime_old:=acctupdatetime), \ acctupdatetime = FROM_UNIXTIME(\ %{integer:Event-Timestamp}), \ acctinterval = %{integer:Event-Timestamp} - \ UNIX_TIMESTAMP(@acctupdatetime_old), \ framedipaddress = '%{Framed-IP-Address}', \ acctsessiontime = %{%{Acct-Session-Time}:-NULL}, \ acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' \ << 32 | '%{%{Acct-Input-Octets}:-0}', \ acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' \ << 32 | '%{%{Acct-Output-Octets}:-0}' \ WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" FR 3.0.17+dfsg-1.1 appears to only update accounting up until the stop being received, ignoring subsequent updates: [admin@unix-01 ~]# mysql -u root -p**************** radius -e 'SELECT username,acctstarttime,acctstoptime,framedipaddress,callingstationid,acctinputoctets,acctoutputoctets FROM radacct WHERE acctuniqueid="50decbeb537ebe5860a8fdf11221017f"'; +------------------------------+---------------------+---------------------+-----------------+------------------+-----------------+------------------+ | username | acctstarttime | acctstoptime | framedipaddress | callingstationid | acctinputoctets | acctoutputoctets | +------------------------------+---------------------+---------------------+-----------------+------------------+-----------------+------------------+ | user60d1(a)realm.company.co.za<mailto:user60d1@realm.company.co.za> | 2021-07-24 11:11:08 | 2021-07-25 18:50:23 | 41.247.86.6 | 0112223333 | 199564666 | 321290299 | +------------------------------+---------------------+---------------------+-----------------+------------------+-----------------+------------------+ [admin@unix-01 ~]# grep '50decbeb537ebe5860a8fdf11221017f' /var/log/freeradius/radacct/*/*; /var/log/freeradius/radacct/196.43.3.76/detail-20210724: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # start /var/log/freeradius/radacct/196.43.3.76/detail-20210724: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update /var/log/freeradius/radacct/196.43.3.76/detail-20210724: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update /var/log/freeradius/radacct/196.43.3.76/detail-20210725: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update /var/log/freeradius/radacct/196.43.3.76/detail-20210725: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # stop /var/log/freeradius/radacct/196.43.3.77/detail-20210725: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update /var/log/freeradius/radacct/196.43.3.77/detail-20210725: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update Herewith the relevant accounting packets for Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f". Green entries above are the 'start', 'interim-updates' and then a 'stop'. The red entries above are interim-updates we receive after the stop and the purple is the in/out counters as per the stop packet having been received: Sat Jul 24 11:11:13 2021 X-Ascend-Xmit-Rate = 20480000 Acct-Authentic = RADIUS NAS-IP-Address = 196.43.47.51 Attr-26.1431.7 = 0x4144534c Framed-Protocol = PPP Attr-26.1431.3 = 0x494e5445524e4554 NAS-Port-Type = PPPoEoQinQ Acct-Status-Type = Start Calling-Station-Id = "0112223333" NAS-Port = 2686963842 User-Name = "user60d1(a)realm.company.co.za" Class = 0x4e31 X-Ascend-Data-Rate = 20480000 Acct-Delay-Time = 0 Framed-IP-Address = 41.247.86.6 NAS-Port-Id = "10/2/1:125.130" Acct-Session-Time = 5 Attr-26.1431.4 = 0x00005000 Acct-Session-Id = "B74D8B03E91BB460FBD922" Service-Type = Framed-User Telkom-Access-Type = "DSL" Proxy-State = 0x3739 Event-Timestamp = "Jul 24 2021 11:11:13 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627117873 Sat Jul 24 17:10:26 2021 NAS-Port = 2686963842 Attr-26.1431.7 = 0x4144534c X-Ascend-Xmit-Rate = 20480000 Calling-Station-Id = "0112223333" Class = 0x4e31 NAS-Port-Type = PPPoEoQinQ Framed-IP-Address = 41.247.86.6 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port-Id = "10/2/1:125.130" Acct-Input-Gigawords = 0 NAS-IP-Address = 196.43.47.51 Acct-Output-Octets = 65339784 Acct-Output-Packets = 138132 Acct-Input-Packets = 145488 User-Name = "user60d1(a)realm.company.co.za" Acct-Authentic = RADIUS Acct-Session-Time = 21558 Attr-26.1431.3 = 0x494e5445524e4554 Acct-Status-Type = Interim-Update Acct-Input-Octets = 33612675 Acct-Session-Id = "B74D8B03E91BB460FBD922" Acct-Delay-Time = 0 Acct-Output-Gigawords = 0 Attr-26.1431.4 = 0x00005000 X-Ascend-Data-Rate = 20480000 Telkom-Access-Type = "DSL" Proxy-State = 0x313936 Event-Timestamp = "Jul 24 2021 17:10:26 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627139426 Sat Jul 24 23:13:24 2021 Acct-Input-Gigawords = 0 NAS-Port-Id = "10/2/1:125.130" Acct-Output-Octets = 124192829 Attr-26.1431.7 = 0x4144534c Acct-Delay-Time = 0 X-Ascend-Xmit-Rate = 20480000 X-Ascend-Data-Rate = 20480000 Attr-26.1431.4 = 0x00005000 Acct-Input-Packets = 295296 NAS-Port = 2686963842 Acct-Input-Octets = 86715171 User-Name = "user60d1(a)realm.company.co.za" Acct-Status-Type = Interim-Update NAS-IP-Address = 196.43.47.51 Acct-Output-Packets = 271352 Attr-26.1431.3 = 0x494e5445524e4554 Framed-Protocol = PPP Class = 0x4e31 Framed-IP-Address = 41.247.86.6 Service-Type = Framed-User Acct-Output-Gigawords = 0 Calling-Station-Id = "0112223333" Acct-Authentic = RADIUS NAS-Port-Type = PPPoEoQinQ Acct-Session-Time = 43336 Acct-Session-Id = "B74D8B03E91BB460FBD922" Telkom-Access-Type = "DSL" Proxy-State = 0x3634 Event-Timestamp = "Jul 24 2021 23:13:24 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627161204 Sun Jul 25 05:15:19 2021 Acct-Input-Octets = 118004756 Attr-26.1431.4 = 0x00005000 Acct-Status-Type = Interim-Update Acct-Input-Packets = 425898 X-Ascend-Xmit-Rate = 20480000 User-Name = "user60d1(a)realm.company.co.za" Framed-Protocol = PPP NAS-Port = 2686963842 Attr-26.1431.7 = 0x4144534c Class = 0x4e31 NAS-Port-Type = PPPoEoQinQ Acct-Output-Octets = 179007110 Framed-IP-Address = 41.247.86.6 Acct-Output-Packets = 390444 Service-Type = Framed-User X-Ascend-Data-Rate = 20480000 Acct-Session-Id = "B74D8B03E91BB460FBD922" Acct-Session-Time = 65052 Acct-Output-Gigawords = 0 NAS-IP-Address = 196.43.47.51 Calling-Station-Id = "0112223333" Acct-Delay-Time = 0 Attr-26.1431.3 = 0x494e5445524e4554 Acct-Input-Gigawords = 0 Acct-Authentic = RADIUS NAS-Port-Id = "10/2/1:125.130" Telkom-Access-Type = "DSL" Proxy-State = 0x323432 Event-Timestamp = "Jul 25 2021 05:15:19 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627182919 Sun Jul 25 18:50:23 2021 Calling-Station-Id = "0112223333" Acct-Terminate-Cause = Lost-Carrier Acct-Output-Octets = 321290299 NAS-Port-Type = PPPoEoQinQ Acct-Authentic = RADIUS Acct-Input-Packets = 798410 Attr-26.1431.3 = 0x494e5445524e4554 Acct-Status-Type = Stop Acct-Input-Gigawords = 0 Framed-Protocol = PPP NAS-Port = 2686963842 X-Ascend-Data-Rate = 20480000 Attr-26.1431.7 = 0x4144534c Acct-Delay-Time = 0 User-Name = "user60d1(a)realm.company.co.za" Attr-26.1431.4 = 0x00005000 Class = 0x4e31 NAS-Port-Id = "10/2/1:125.130" Service-Type = Framed-User Acct-Session-Id = "B74D8B03E91BB460FBD922" NAS-IP-Address = 196.43.47.51 Acct-Input-Octets = 199564666 Acct-Session-Time = 113955 Acct-Output-Gigawords = 0 Framed-IP-Address = 41.247.86.6 X-Ascend-Xmit-Rate = 20480000 Acct-Output-Packets = 742386 Telkom-Access-Type = "DSL" Proxy-State = 0x323235 Event-Timestamp = "Jul 25 2021 18:50:23 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627231823 Sun Jul 25 11:16:58 2021 NAS-Port-Id = "10/2/1:125.130" Acct-Status-Type = Interim-Update NAS-IP-Address = 196.43.47.51 Class = 0x4e31 X-Ascend-Data-Rate = 20480000 Acct-Input-Packets = 600825 Attr-26.1431.4 = 0x00005000 X-Ascend-Xmit-Rate = 20480000 Framed-IP-Address = 41.247.86.6 Acct-Session-Id = "B74D8B03E91BB460FBD922" Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Delay-Time = 0 User-Name = "user60d1(a)realm.company.co.za" Framed-Protocol = PPP Acct-Session-Time = 86751 Attr-26.1431.7 = 0x4144534c Service-Type = Framed-User Calling-Station-Id = "0112223333" Attr-26.1431.3 = 0x494e5445524e4554 Acct-Input-Octets = 155655292 Acct-Output-Octets = 243066595 NAS-Port-Type = PPPoEoQinQ NAS-Port = 2686963842 Acct-Output-Packets = 557229 Acct-Authentic = RADIUS Telkom-Access-Type = "DSL" Proxy-State = 0x3439 Event-Timestamp = "Jul 25 2021 11:16:58 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627204618 Sun Jul 25 17:14:09 2021 Acct-Delay-Time = 0 NAS-Port-Id = "10/2/1:125.130" Acct-Output-Packets = 708535 Service-Type = Framed-User Calling-Station-Id = "0112223333" Acct-Session-Id = "B74D8B03E91BB460FBD922" X-Ascend-Data-Rate = 20480000 Class = 0x4e31 Acct-Authentic = RADIUS Framed-IP-Address = 41.247.86.6 NAS-Port = 2686963842 User-Name = "user60d1(a)realm.company.co.za" Acct-Output-Octets = 305092740 Acct-Session-Time = 108182 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Attr-26.1431.4 = 0x00005000 Framed-Protocol = PPP Acct-Status-Type = Interim-Update Acct-Input-Packets = 761669 Attr-26.1431.7 = 0x4144534c Attr-26.1431.3 = 0x494e5445524e4554 NAS-Port-Type = PPPoEoQinQ Acct-Input-Octets = 190814584 NAS-IP-Address = 196.43.47.51 X-Ascend-Xmit-Rate = 20480000 Telkom-Access-Type = "DSL" Proxy-State = 0x3133 Event-Timestamp = "Jul 25 2021 17:14:09 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627226049 Regards David Herselman

2 1

Package server updates and 3.0.23-2
by Matthew Newton 28 Jul '21

28 Jul '21

As a few people noticed, in certain circumstances there can be a segfault with version 3.0.23. We have released new packages which fix this issue. https://packages.networkradius.com/ There have also been changes to the packages server. It was not previously possible for us to host more than one version of the packages due to limitations in the repository software being used. This has now been fixed. As a consequence of this, those on Ubuntu and Debian may receive a warning about the "Suite" changing. This is harmless and will need to be accepted. The package instructions on the web site have been updated to remove usage of gnupg (thanks to those who pointed out that this method is now deprecated). Finally a note that the package URLs will be changing soon. However we will continue to keep redirects from the old location so that existing repo configurations will not need to be updated. -- Matthew

4 6

Some new features in the v3.0.x branch
by Alan DeKok 27 Jul '21

27 Jul '21

There are some interesting new features available now in the v3.0.x branch. Initial documentation is here: https://github.com/FreeRADIUS/freeradius-server/tree/v3.0.x/raddb/certs/rea… In short, it's now trivial to have one EAP module serve multiple realms, each with their own certificate chain. I've also added Server Name Indication (SNI) for RadSec. This allows for the same kind of realm selection in RadSec. SNI also allows tools like haproxy to accept many TLS connections, and then forward "realm A" to home server A (over TCP), and "realm B" to home server B. This configuration allows for increased scalability and load balancing. Any questions or comments? Alan DeKok.

2 2

RV: Freeradius does not save avpair sent by ASR1002 - Delegated-IPv6-Prefix
by Gustavo Saracho 27 Jul '21

27 Jul '21

Hi! I have the following scenario. An ASR1002 with software version 03.13.10.S. The ASR has configured the IPv6 prefixes to assign to the clients, and once it assigns them it sends the avpairs to a Freeradius. The problem is that in the packet capture you can see that the ASR sends it to the avpair in the "accounting-request" packet to the freeradius, but the freeradius does not store it. What I mean by freeradius not storing, is that after a query is made from a platform to freeradius to see what ipv6 is assigned to each client and does not show it. This on another router, an ASR9000 works fine, the issue may be is in the ASR1002. this is a packet capture on freeradius. The problem is that I don't know if it is something to set in the ASR1002 to store it in freeradius or if it is freeradius itself. RADIUS Protocol Code: Accounting-Request (4) Packet identifier: 0xa7 (167) Length: 560 Authenticator: 991cd55b999e09f0aae58fadfba325e1 Attribute Value Pairs AVP: t=Acct-Session-Id(44) l=20 val=0/1/0/640_007BB7FE AVP: t=Vendor-Specific(26) l=24 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=26 vnd=ciscoSystems(9) AVP: t=Framed-Protocol(7) l=6 val=PPP(1) AVP: t=Framed-IPv6-Prefix(97) l=20 val=2001:X:X::/64 AVP: t=Framed-Interface-Id(96) l=10 val=218d36286581b516 AVP: t=Framed-IP-Address(8) l=6 val=X.X.X.153 AVP: t=Delegated-IPv6-Prefix(123) l=20 val=2001:X:X:X::/64 AVP: t=User-Name(1) l=10 val=dsl99902 AVP: t=Vendor-Specific(26) l=35 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=31 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=31 vnd=ciscoSystems(9) AVP: t=Acct-Session-Time(46) l=6 val=321 AVP: t=Acct-Input-Octets(42) l=6 val=2736962 AVP: t=Acct-Output-Octets(43) l=6 val=2746557 AVP: t=Vendor-Specific(26) l=38 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=39 vnd=ciscoSystems(9) AVP: t=Acct-Input-Packets(47) l=6 val=6797 AVP: t=Acct-Output-Packets(48) l=6 val=6902 AVP: t=Vendor-Specific(26) l=36 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=37 vnd=ciscoSystems(9) AVP: t=Acct-Authentic(45) l=6 val=RADIUS(1) AVP: t=Acct-Status-Type(40) l=6 val=Interim-Update(3) AVP: t=Calling-Station-Id(31) l=14 val=c0c9e3af6747 AVP: t=NAS-Port-Type(61) l=6 val=Ethernet(15) AVP: t=NAS-Port(5) l=6 val=134218368 AVP: t=NAS-Port-Id(87) l=11 val=0/1/0/640 AVP: t=Vendor-Specific(26) l=41 vnd=ciscoSystems(9) AVP: t=Class(25) l=3 val=30 AVP: t=Service-Type(6) l=6 val=Framed(2) AVP: t=NAS-IP-Address(4) l=6 val=X.X.X.207 AVP: t=PMIP6-Home-HN-Prefix(151) l=10 val=[invalid reserved byte for IPv6 prefix] AVP: t=Acct-Delay-Time(41) l=6 val=0 **Config in ASR1002:** aaa authentication login default group tacacs+ local enable line aaa authentication ppp ADSL group radius local aaa authentication ppp viaTACACS group tacacs+ local aaa authentication ppp NINGUNO none aaa authorization console aaa authorization exec default group tacacs+ local if-authenticated aaa authorization network ADSL group radius local if-authenticated aaa authorization network viaTACACS group tacacs+ local if-authenticated aaa authorization network NINGUNO none aaa authorization configuration IA_PD group radius aaa accounting send counters ipv6 aaa accounting delay-start all aaa accounting update periodic 3 aaa accounting include auth-profile delegated-ipv6-prefix aaa accounting commands 15 default action-type start-stop group tacacs+ ! aaa accounting network ADSL action-type start-stop periodic interval 5 group radius ! ipv6 dhcp pool DHCPv6Local prefix-delegation pool ClientesDinamicos lifetime 7200 300 address prefix 2001:X:X::/64 lifetime 7200 300 dns-server 2001:X:X::65 dns-server 2001:X:X::66 sntp address 2001:X:X:X::1 accounting ADSL ! interface Virtual-Template46 description Servicio PPPoE con IPv6 ip unnumbered Loopback0 ipv6 enable no ipv6 nd prefix framed-ipv6-prefix ipv6 nd other-config-flag ipv6 nd router-preference High no ipv6 nd ra suppress ipv6 nd ra lifetime 7200 ipv6 nd ra interval 5 ipv6 dhcp server DHCPv6Local peer default ip address pool LNS1-POOL peer default ipv6 pool LinksPE-CE ppp authentication pap ADSL ppp authorization ADSL ppp accounting ADSL ppp ipcp dns X.X.X.65 X.X.X.65 ppp ipv6cp address unique ! **pool LNS1-POOL and pool LinksPE-CE are defined in the config.** **this is an example of the queries to the freeradius database, in the avpair of delegatedipv6prefix nothing is returned:** <DATA> <ROW> <radacctid>913607839</radacctid> <acctsessionid>0/1/0/640_004EB3C1</acctsessionid> <acctuniqueid>7a73d0dd85554bbb30a9ce57b3804b46</acctuniqueid> <username>dsl99902</username> <realm></realm> <nasipaddress>X.X.X.207</nasipaddress> <nasportid>0/1/0/640</nasportid> <nasporttype>Ethernet</nasporttype> <acctstarttime>2021-05-18 10:33:15</acctstarttime> <acctupdatetime>2021-05-19 13:14:56</acctupdatetime> <acctstoptime>NULL</acctstoptime> <acctinterval>62</acctinterval> <acctsessiontime>96101</acctsessiontime> <acctauthentic>RADIUS</acctauthentic> <connectinfo_start></connectinfo_start> <connectinfo_stop></connectinfo_stop> <acctinputoctets>2341181058</acctinputoctets> <acctoutputoctets>2496301024</acctoutputoctets> <calledstationid></calledstationid> <callingstationid>c47154448e08</callingstationid> <acctterminatecause></acctterminatecause> <servicetype>Framed-User</servicetype> <framedprotocol>PPP</framedprotocol> <framedipaddress>X.X.X.172</framedipaddress> <framedipv6address></framedipv6address> <framedipv6prefix>2001:X:X::/64</framedipv6prefix> <framedinterfaceid>0:3b61:0:3b58</framedinterfaceid> <delegatedipv6prefix></delegatedipv6prefix> </ROW> </DATA> if someone can give me some help or guide me where I can focus my analysis, I would appreciate it. Best Regards!

2 1

TLS problem after upgrade to 3.0.23
by mohamed almeshal 27 Jul '21

27 Jul '21

dear savers ... I have a server that run 3.0.21 I do apt-get upgrade by mistake and discover it update the freeradius to 3.0.23-2 now I'm in this stiuation all the the time (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase ... cleaning up socket auth+acct from client (45.247.114.183, 51231) -> (*, 2083, virtual-server=default) (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Application data. (0) FAILED in TLS handshake receive even I used the same config it's keep refuse to handshake what is the solution for that

3 2

Re: Freeradius-Users Digest, Vol 195, Issue 41
by mohamed almeshal 27 Jul '21

27 Jul '21

Waking up in 0.1 seconds. ... new connection request on TCP socket Listening on auth+acct from client (105.196.196.165, 48321) -> (*, 2083, virtual-server=default) (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (5) Cleaning up request packet ID 1 with timestamp +2 (6) Cleaning up request packet ID 2 with timestamp +2 Waking up in 0.8 seconds. (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Application data. (0) FAILED in TLS handshake receive Closing TLS socket from client port 48321 Client has closed connection ... shutting down socket auth+acct from client (105.196.196.165, 48321) -> (*, 2083, virtual-server=default) Waking up in 0.6 seconds. detail (/var/log/freeradius/radacct/decoupled-accounting/detail-*:*): Polling for detail file detail (/var/log/freeradius/radacct/decoupled-accounting/detail-*:*): Detail listener state unopened waiting 0.905778 sec ... cleaning up socket auth+acct from client (105.196.196.165, 40317) -> (*, 2083, virtual-server=default) Waking up in 1.7 seconds. ... new connection request on TCP socket Listening on auth+acct from client (105.196.196.165, 53800) -> (*, 2083, virtual-server=default) Waking up in 0.8 seconds. here is the debug for the situation these are TLS in default file listen { type = auth+acct ipaddr = * port = 2083 proto = tcp limit { max_connections = 500 lifetime = 0 idle_timeout = 30 } tls { private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh fragment_size = 8192 cipher_list = "DEFAULT" cipher_server_preference = yes tls_min_version = "1.2" tls_max_version = "1.3" cache { enable = yes lifetime = 24 # hours } require_client_cert = yes } clients = radsec }

2 1

RE: Package server updates and 3.0.23-2From Subject Received Size Categories
by Caines, Max 26 Jul '21

26 Jul '21

Hi I've just installed 3.0.23-2 on Centos 7, over 3.0.21, and I'm now getting both SIGSEGV and SIGABRT every few minutes. I enclose a couple of examples. Is it me, or is there still a problem? Thanks Max Max Caines | Digital Architect (Networks) | Digital Services | University of Wolverhampton | 01902 322245 | 07976 841874 For contact details and general information on IT Services please visit http://www.wlv.ac.uk/its This email, together with any attachment, is for the exclusive and confidential use of the addressee(s) and may contain legally privileged information. If you receive this email in error, please visit http://www.wlv.ac.uk/ITS-disclaimer . Please consider the environment before printing this e-mail. -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+max.caines=wlv.ac.uk(a)lists.freeradius.org> On Behalf Of Matthew Newton Sent: 26 July 2021 15:14 To: freeradius-users(a)lists.freeradius.org Subject: Re: Package server updates and 3.0.23-2 On 25/07/2021 21:31, Stefan Paetow via Freeradius-Users wrote: > It seems that your URL change is not working (or is now broken): > > https://url6.mailanyone.net/v1/?m=1m81Qe-00039c-4B&i=57e1b682&c=b-oNo8XYQqu…: [Errno 14] HTTP Error 404 - Not Found Good catch, thanks. Looks like it's the silly case where RHEL (not CentOS) sends "7Server" rather than just "7" for the version. > Hmmmmm... Could you fix it, pretty please? Try now. -- Matthew - List info/subscribe/unsubscribe? See https://url6.mailanyone.net/v1/?m=1m81Qe-00039c-4B&i=57e1b682&c=padCAfhcXdN… ------------------------------------ This email has been scanned for spam & viruses. If you believe this email should have been stopped by our filters, click the following link to report it (https://portal.mailanyone.net/index.html#/outer/reportspam?token=dXNlcj1tYX…)

2 2

Re: Enable Elastic search with freeradius
by CHANDAN BR 26 Jul '21

26 Jul '21

I want to use elastic search instead of mysql database. to store user related data, My i know how to do this?

2 1

Enable SNMP in Freeradius
by luke devon 25 Jul '21

25 Jul '21

Hi, I want to monitor SNMP radius server including all the information passes by the MIB. May I know how to enable the SNMP function in the Freeradius server and where can I download latest MIB of it ? ThanksLuke.

3 2