November 2022 - Freeradius-Users - lists.freeradius.org

Control socket directory doesn't exist after systemd stopping service
by Matthew McTague 30 Nov '22

30 Nov '22

Hi all, I have a weird bug where the control socket directory `/var/run/radiusd` gets deleted after `systemctl stop radiusd`, and `radiusd -X` doesn't re-create it. I'm using the Rocky repo as there's no AlmaLinux repo available, although I'm expecting this would be compatible. Extra information is below in case it's needed for context. Excerpt from radiusd -X output: radiusd: #### Opening IP addresses and Ports #### listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" mode = "rw" peercred = yes } Failed creating control socket "/var/run/radiusd/radiusd.sock": Failed binding to /var/run/radiusd/radiusd.sock: No such file or directory The directory doesn't exist: # ls -lah /var/run/radiusd ls: cannot access '/var/run/radiusd': No such file or directory # cat /etc/os-release NAME="AlmaLinux" VERSION="8.6 (Sky Tiger)" ID="almalinux" ID_LIKE="rhel centos fedora" VERSION_ID="8.6" PLATFORM_ID="platform:el8" PRETTY_NAME="AlmaLinux 8.6 (Sky Tiger)" ANSI_COLOR="0;34" CPE_NAME="cpe:/o:almalinux:almalinux:8::baseos" HOME_URL=https://almalinux.org/ DOCUMENTATION_URL=https://wiki.almalinux.org/ BUG_REPORT_URL=https://bugs.almalinux.org/ ALMALINUX_MANTISBT_PROJECT="AlmaLinux-8" ALMALINUX_MANTISBT_PROJECT_VERSION="8.6" # yum list freeradius Last metadata expiration check: 2:53:04 ago on Wed 30 Nov 2022 06:40:50 NZDT. Installed Packages freeradius.x86_64 3.2.1-1.el8 @networkradius # cat /etc/yum.repos.d/networkradius.repo [networkradius] name=NetworkRADIUS-$releasever baseurl=http://packages.networkradius.com/freeradius-3.2/rocky/$releasever/ enabled=1 gpgcheck=1 gpgkey=https://packages.networkradius.com/pgp/packages%40networkradius.com I tried radiusd -X with strace attached, showed the same thing, excerpt below: write(1, "listen {\n", 9listen { ) = 9 write(1, " \ttype = \"control\"\n", 19 type = "control" ) = 19 write(1, " listen {\n", 10 listen { ) = 10 write(1, " \tsocket = \"/var/run/radiusd/rad"..., 43 socket = "/var/run/radiusd/radiusd.sock" ) = 43 write(1, " \tmode = \"rw\"\n", 14 mode = "rw" ) = 14 write(1, " \tpeercred = yes\n", 17 peercred = yes ) = 17 write(1, " }\n", 3 } ) = 3 socket(AF_UNIX, SOCK_STREAM, 0) = 22 stat("/var/run/radiusd/radiusd.sock", 0x7fff5e30c580) = -1 ENOENT (No such file or directory) bind(22, {sa_family=AF_UNIX, sun_path="/var/run/radiusd/radiusd.sock"}, 31) = -1 ENOENT (No such file or directory) futex(0x7fe3b3ac0840, FUTEX_WAKE_PRIVATE, 2147483647) = 0 close(22) = 0 write(1, "\33[31mFailed creating control soc"..., 148Failed creating control socket "/var/run/radiusd/radiusd.sock": Failed binding to /var/run/radiusd/radiusd.sock: No such file or directory ) = 148 write(2, "Debugger detected, raising SIGTR"..., 35Debugger detected, raising SIGTRAP ) = 35 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [], 8) = 0 getpid() = 154664 gettid() = 154664 tgkill(154664, 154664, SIGTRAP) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGTRAP {si_signo=SIGTRAP, si_code=SI_TKILL, si_pid=154664, si_uid=0} --- +++ killed by SIGTRAP (core dumped) +++ Trace/breakpoint trap (core dumped) If I enable the dnf module for freeradius from the AlmaLinux appstream repo, I get an older version. I list duplicates from the networkradius repo first as a baseline. # dnf --showduplicates list freeradius Last metadata expiration check: 0:04:02 ago on Wed 30 Nov 2022 09:45:47 NZDT. Installed Packages freeradius.x86_64 3.2.1-1.el8 @networkradius Available Packages freeradius.x86_64 3.2.0-1.el8 networkradius freeradius.x86_64 3.2.1-1.el8 networkradius # dnf module list freeradius Last metadata expiration check: 0:00:58 ago on Wed 30 Nov 2022 09:45:47 NZDT. AlmaLinux 8 - AppStream Name Stream Profiles Summary freeradius 3.0 [d][x] server [d] High-performance and highly configurable free RADIUS server Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled # dnf module enable freeradius Last metadata expiration check: 0:01:12 ago on Wed 30 Nov 2022 09:45:47 NZDT. Dependencies resolved. ============================================================================================================================================================= Package Architecture Version Repository Size ============================================================================================================================================================= Enabling module streams: freeradius 3.0 Transaction Summary ============================================================================================================================================================= Is this ok [y/N]: y Complete! # dnf --showduplicates list freeradius Last metadata expiration check: 0:01:19 ago on Wed 30 Nov 2022 09:45:47 NZDT. Installed Packages freeradius.x86_64 3.2.1-1.el8 @networkradius Available Packages freeradius.x86_64 3.0.20-12.module_el8.6.0+2865+fd6928c8 appstream Warm Regards, .[cid:vg-email_e752d47f-182a-48d0-8808-3796b2df8d4a.png]<https://www.vetta.nz> .[cid:058_line_9bae9502-1e3a-48a3-ba5e-34ed9cd44185.png] Matthew McTague Head of Infrastructure [cid:bea-finalist-email_2ddba0ed-b9bb-4ab9-b680-84aa7f54077f.png] [cid:bea-winner-banner-email_590096c3-05a6-4c98-b071-1c4d748c3534.png] . D +64 3 222 6013<tel:+64%203%20222%206013> | P +64 3 684 5770 E matthew.mctague(a)vetta.nz<mailto:matthew.mctague@vetta.nz> | W www.vetta.nz<https://www.vetta.nz> ? Christmas/New Year Holiday Period ? During the period from 22rd December to 9th January, our offices will be closed, with our teams available via our after-hours service methods, focused on service continuity and restoration only. For more details, click here<https://vetta.link/xmas22email> . Vetta Group Ltd and its subsidiaries accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company, its subsidiaries, partners or contractors. .

3 5

Robust Proxy Accounting problem after switch from 2.2.10 to 3.2.1
by Martin Zaharinov 29 Nov '22

29 Nov '22

Hi all i try to switch from freeradius 2.2.10 to 3.2.1 After fix all configs and dictionary go to this problem real radius server not respons : 10.10.10.1 is proxy radius 192.168.10.1 is real radius server. with freeradius 2.2.10 with old config real radius respons on query. but after switch to freeradius 3.2.1 radius stop respons on query. May be i make wrong config or ? See log : Wed Nov 23 20:08:23 2022 : Debug: } Wed Nov 23 20:08:23 2022 : Debug: Listening on acct address * port 1813 Wed Nov 23 20:08:23 2022 : Debug: Listening on detail file /var/log/freeradius/radacct/detail.example.com/detail-*:* as server home.example.com Wed Nov 23 20:08:23 2022 : Info: Ready to process requests Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - User-Name = "test_bgbras" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-Identifier = "demo-bng" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-IP-Address = 10.10.10.1 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-Port = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-Port-Id = "vlan100" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - NAS-Port-Type = Virtual Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Service-Type = Framed-User Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Framed-Protocol = PPP Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Calling-Station-Id = "f6:cb:f6:40:1f:a0" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Called-Station-Id = "1a:27:b5:27:bb:53" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Class = 0x6375693d746573745f6267627261732c73753d3934323033392c736b3d686c3677777564716138396d2c626b69643d32323534303038392c626b7269643d332c6d763d3532393135313830303939372c6d743d3630353333342c676d743d3630343830302c73703d312c73723d2c61633d312c75693d3934323033392c6363693d3138382c63633d47656e6572616c2c61733d312c636f3d2c64623d3130323430302c75623d3130323430302c63626b69643d3232353430303930 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Status-Type = Start Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Authentic = RADIUS Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Session-Id = "16fecbef21f8c2cf" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Session-Time = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Input-Octets = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Output-Octets = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Input-Packets = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Output-Packets = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Input-Gigawords = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Output-Gigawords = 0 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Framed-IP-Address = 10.0.0.3 Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Event-Timestamp = "Nov 23 2022 19:59:44 IST" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Trying to read VP from line - Acct-Unique-Session-Id = "319ef2e5f83ff3c6e82f09959978097b" Wed Nov 23 20:08:23 2022 : Debug: detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): Read packet from /var/log/freeradius/radacct/detail.example.com/detail.work User-Name = "test_bgbras" NAS-Identifier = "demo-bng" NAS-IP-Address = 10.10.10.1 NAS-Port = 0 NAS-Port-Id = "vlan100" NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "f6:cb:f6:40:1f:a0" Called-Station-Id = "1a:27:b5:27:bb:53" Class = 0x6375693d746573745f6267627261732c73753d3934323033392c736b3d686c3677777564716138396d2c626b69643d32323534303038392c626b7269643d332c6d763d3532393135313830303939372c6d743d3630353333342c676d743d3630343830302c73703d312c73723d2c61633d312c75693d3934323033392c6363693d3138382c63633d47656e6572616c2c61733d312c636f3d2c64623d3130323430302c75623d3130323430302c63626b69643d3232353430303930 Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Session-Id = "16fecbef21f8c2cf" Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Framed-IP-Address = 10.0.0.3 Event-Timestamp = "Nov 23 2022 19:59:44 IST" Acct-Unique-Session-Id = "319ef2e5f83ff3c6e82f09959978097b" Packet-Original-Timestamp = "Nov 23 2022 19:59:44 IST" Acct-Delay-Time = 519 Packet-Transmit-Counter = 1 Wed Nov 23 20:08:23 2022 : Debug: (0) Empty preacct section in virtual server "home.example.com". Using default return values. Wed Nov 23 20:08:23 2022 : Debug: (0) # Executing section accounting from file /etc/freeradius/sites-enabled/robust-proxy-accounting Wed Nov 23 20:08:23 2022 : Debug: (0) accounting { Wed Nov 23 20:08:23 2022 : Debug: (0) update control { Wed Nov 23 20:08:23 2022 : Debug: (0) &Proxy-To-Realm := 'acct_realm.example.com' Wed Nov 23 20:08:23 2022 : Debug: (0) } # update control = noop Wed Nov 23 20:08:23 2022 : Debug: (0) } # accounting = noop Wed Nov 23 20:08:23 2022 : Debug: Using home pool acct for realm acct_realm.example.com Wed Nov 23 20:08:23 2022 : Debug: (0) Starting proxy to home server 192.168.10.1 port 1813 Wed Nov 23 20:08:23 2022 : Debug: (0) server home.example.com { Wed Nov 23 20:08:23 2022 : Debug: (0) Empty pre-proxy section in virtual server "home.example.com". Using default return values. Wed Nov 23 20:08:23 2022 : Debug: (0) } Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: Trying to allocate ID (0/2) Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: Trying to open a new listener to the home server Wed Nov 23 20:08:23 2022 : Debug: Opened new proxy socket 'proxy address 10.10.10.1 port 48401' Wed Nov 23 20:08:23 2022 : Debug: Listening on proxy address 10.10.10.1 port 48401 Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: Trying to allocate ID (1/2) Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: request is now in proxy hash Wed Nov 23 20:08:23 2022 : Debug: (0) proxy: allocating destination 192.168.10.1 port 1813 - Id 122 Wed Nov 23 20:08:23 2022 : Debug: (0) Proxying request to home server 192.168.10.1 port 1813 timeout 6.000000 Wed Nov 23 20:08:23 2022 : Debug: Waking up in 0.3 seconds. Wed Nov 23 20:08:23 2022 : Debug: Ignoring spoofed proxy reply. Signature is invalid Wed Nov 23 20:08:23 2022 : Debug: Waking up in 0.1 seconds. Wed Nov 23 20:08:24 2022 : Debug: (0) Expecting proxy response no later than 5.666547 seconds from now Wed Nov 23 20:08:24 2022 : Debug: Waking up in 5.6 seconds. Wed Nov 23 20:08:29 2022 : Debug: (0) No proxy response, giving up on request and marking it done Wed Nov 23 20:08:29 2022 : Proxy: Marking home server 192.168.10.1 port 1813 as zombie (it has not responded in 6.000000 seconds). Wed Nov 23 20:08:29 2022 : Debug: (1) proxy: Trying to allocate ID (0/2) Wed Nov 23 20:08:29 2022 : Debug: (1) proxy: request is now in proxy hash Wed Nov 23 20:08:29 2022 : Debug: (1) proxy: allocating destination 192.168.10.1 port 1813 - Id 198 Wed Nov 23 20:08:29 2022 : Debug: PING: Waiting 4 seconds for response to ping Wed Nov 23 20:08:29 2022 : Debug: (1) Sent Accounting-Request Id 198 from 10.10.10.1:48401 to 192.168.10.1:1813 length 98 Wed Nov 23 20:08:29 2022 : Debug: (1) User-Name := "test_user_status_check" Wed Nov 23 20:08:29 2022 : Debug: (1) Acct-Status-Type := Stop Wed Nov 23 20:08:29 2022 : Debug: (1) Acct-Session-Id := "00000000" Wed Nov 23 20:08:29 2022 : Debug: (1) Event-Timestamp := "Nov 23 2022 20:08:29 IST" Wed Nov 23 20:08:29 2022 : Debug: (1) NAS-Identifier := "Status Check 0. Are you alive?" Wed Nov 23 20:08:29 2022 : Debug: PING: Next status packet in 30 seconds Wed Nov 23 20:08:29 2022 : ERROR: (0) Failing proxied request for user "test_bgbras", due to lack of any response from home server 192.168.10.1 port 1813 Wed Nov 23 20:08:29 2022 : Debug: (0) Clearing existing &reply: attributes Wed Nov 23 20:08:29 2022 : Debug: (0) Found Post-Proxy-Type Fail-Accounting Wed Nov 23 20:08:29 2022 : Debug: (0) server home.example.com { Wed Nov 23 20:08:29 2022 : Debug: (0) # Executing group from file /etc/freeradius/sites-enabled/robust-proxy-accounting Wed Nov 23 20:08:29 2022 : Debug: (0) Post-Proxy-Type Fail-Accounting { Wed Nov 23 20:08:29 2022 : Debug: (0) modsingle[post-proxy]: calling detail.example.com (rlm_detail) Wed Nov 23 20:08:29 2022 : Debug: /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H:%G Wed Nov 23 20:08:29 2022 : Debug: Parsed xlat tree: Wed Nov 23 20:08:29 2022 : Debug: literal --> /var/log/freeradius/radacct/detail.example.com/detail- Wed Nov 23 20:08:29 2022 : Debug: percent --> Y Wed Nov 23 20:08:29 2022 : Debug: percent --> m Wed Nov 23 20:08:29 2022 : Debug: percent --> d Wed Nov 23 20:08:29 2022 : Debug: literal --> : Wed Nov 23 20:08:29 2022 : Debug: percent --> H Wed Nov 23 20:08:29 2022 : Debug: literal --> : Wed Nov 23 20:08:29 2022 : Debug: percent --> G Wed Nov 23 20:08:29 2022 : Debug: (0) detail.example.com: EXPAND /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H:%G Wed Nov 23 20:08:29 2022 : Debug: (0) detail.example.com: --> /var/log/freeradius/radacct/detail.example.com/detail-20221123:20:08 Wed Nov 23 20:08:29 2022 : Debug: (0) detail.example.com: /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H:%G expands to /var/log/freeradius/radacct/detail.example.com/detail-20221123:20:08 Wed Nov 23 20:08:29 2022 : WARNING: (0) detail.example.com: Suppressing infinite loop Wed Nov 23 20:08:29 2022 : Debug: (0) modsingle[post-proxy]: returned from detail.example.com (rlm_detail) Wed Nov 23 20:08:29 2022 : Debug: (0) [detail.example.com] = noop Wed Nov 23 20:08:29 2022 : Debug: (0) } # Post-Proxy-Type Fail-Accounting = noop Wed Nov 23 20:08:29 2022 : Debug: (0) } Wed Nov 23 20:08:29 2022 : Debug: (0) detail (/var/log/freeradius/radacct/detail.example.com/detail-*:*): No response to request. Will retry in 30 seconds Wed Nov 23 20:08:29 2022 : Debug: (0) Finished request Wed Nov 23 20:08:29 2022 : Debug: (0) Cleaning up request packet ID 0 with timestamp +0 due to done Wed Nov 23 20:08:29 2022 : Debug: Waking up in 3.9 seconds. Wed Nov 23 20:08:29 2022 : Debug: Ignoring spoofed proxy reply. Signature is invalid Wed Nov 23 20:08:29 2022 : Debug: Waking up in 3.8 seconds. Wed Nov 23 20:08:33 2022 : Error: No response to status check 1 ID 198 for home server 192.168.10.1 port 1813 Wed Nov 23 20:08:33 2022 : Debug: Waking up in 25.3 seconds. Best regards, Martin

2 16

Allow all MAC address
by Pascal Legrand 29 Nov '22

29 Nov '22

Hello, I use freeradius to limit the access to our network by filtering MAC address: XXXXXXXXXXXX Cleartext-Password := "XXXXXXXXXXXX", Machine-Name := "COMPUTER_1" When we receive new computers, we use the FOG software to deploy a clean image on all new computers. The problem is that we have not yet set up Freeradius to allow these news computers to access our network. My question is the following: is it possible to authorize punctually all MAC addresses to access the network while we recover them to configure Freeradius? The idea would be to add a line like : ALL_MAC_ADDRESS Cleartext-Password := "ALL_MAC_ADDRESS", Machine-Name := "NEW_MACHINE" Does Freeradius allow regular expressions in its configuration file? If yes, what should be the form of this regular expression? Thank you in advance for your help. Pascal

4 4

eap_peap error messages
by Stefan Paetow 24 Nov '22

24 Nov '22

Hi Alan et al, Just a quick question – when eap_peap encounters a TLS error, is that available in the Module-Error-Message? i.e. let’s take this example: (2) eap_peap: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error (2) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (2) eap_peap: ERROR: System call (I/O) error (-1) Would the three ‘ERROR:’ messages be in &request:Module-Failure-Message (or &session-state: Module-Failure-Message)? I can’t particularly With kind regards Stefan Paetow Federated Roaming Technical Specialist eduroam(UK), Jisc email/teams: stefan.paetow(a)jisc.ac.uk gpg: 0x3FCE5142 On Mondays and Wednesdays, I am not available between 12:00 and 15:00. For eduroam support, please contact us via help(a)jisc.ac.uk and mark it for the eduroam team’s attention. jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

2 2

oauth2 proxy mode
by Laurent Estevez 24 Nov '22

24 Nov '22

Hi, Do you have any feedback on oauth2* authentication and freeradius 3. I would like to connect MS Azure on a freeRaius standard package installation with this mode, but I am having problems implementing this module (error run freeradius service) Thanks in advance, * source : https://github.com/jimdigriz/freeradius-oauth2-perl

4 5

Is there something like a post-dhcp section?
by Hermann.Lauer＠uni-heidelberg.de 23 Nov '22

23 Nov '22

Hello All, is something like a post-dhcp section in the virtual dhcp server possible, i.e. executed after the packet type specific DHCP-Request or DHCP-Request section are finished, the reply is setup and the server had decided what to do with the request? Sorry if I missed that in the documentation. Thanks and greetings Hermann

2 1

Radius and port 77
by Pascal Legrand 23 Nov '22

23 Nov '22

Hello, i'm using radius authentication (freeradius) on alcatel switchs and i can see in freeradius logs this kind of message : Login OK: [XXXXXXXXXXXX/XXXXXXXXXXXX] (from client Switch port 77 cli XXXXXXXXXXXX) Does someone could explain me what means "port 77" As much I understand this notation : Login OK: [XXXXXXXXXXXX/XXXXXXXXXXXX] (from client Switch port 1021) As much i cant understand "port 77" Thanks for your help Pascal

2 1

Cannot increase open file descriptors above 1024
by Ibrahemoo Ghost 18 Nov '22

18 Nov '22

I use FreeRADIUS Version 3.0.20 as both proxy and (auth/acct) server. I have more than 80 realms with over 180 clients connected. Every one of them is redirecting to a different site file with separate sql module to a seperate database in the same db server. My problem is with this large amount of databases and tables i hit the fixed limit of 1024 open file descriptors and the radius.log file shows: mysql error: can't create unix socket (24) I double checked with: ls /proc/${freeradius_pid}/fd | wc -l it prints 1024 that's why I am sure its problem with the open files limit I tried to increase it manually but with no luck at all. Whenever I increase it the freeradius server stops working. So is there something I can do to increase the file descriptors limit ? Or am I doing something wrong?

4 11

Use “fast reconnect” to speed up repeat authentication requests
by uj2.hahn＠posteo.de 18 Nov '22

18 Nov '22

Hi, Alan and team! In your article https://networkradius.com/articles/2020/12/10/design-blueprint-for-universi… you describe the fast reconnect approach for universities. I was going to give it try but haven't found any docs describing how to do that. Or is this a solution you offer on a commercial base? Thanks for your help Regards Uwe

2 1

MSCHAP No logon servers are currently available (again, but solved)
by uj2.hahn＠posteo.de 16 Nov '22

16 Nov '22

Hi, all! I refer to this older thread with same subject: https://lists.freeradius.org/pipermail/freeradius-users/2021-August/100519.… I run into a similar issue and like to share the way I solved it: I implemented a Freeradius/AD solution some years ago in a school. (Win10 clients, MS server/AD in Azure cloud) This had been working fine all the time, but after the school installed some Microsoft updates to their clients Freeradius stopped working. No authorization was possible. I debugged it down to above error message when I run ntlm_auth manually (saw same message in FR debug log). Somehow the communication between Ubuntu based FR server and Windows server/AD was broken now. My guess was the the updated Windows environment needs an improved communication protocol with higher security level. So I upgraded Ubuntu to version 22.04 LTS to get a more recent Samba version (4.15.9). But this didn't help. I modified smb.conf as described in https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_D… , but this didn't help neither. Also a reboot of the FR Ubuntu server didn't help. But then I rejoined FR server to domain: net join -U admin (will prompt for password). The FR server has been part of the domain for years. But somehow this got broken. Not sure which of the actions above was root cause, but the "net join" command was finally the key. So don't forget it even though think you did it earlier already . Just to help others in case they run in same issue. Regards Uwe

2 1