November 2022 - Freeradius-Users - lists.freeradius.org

Radutmp is empty
by Sébastien 65 16 Nov '22

16 Nov '22

Hi there, The radutmp file is still empty. The radwho command does not return any user... The radlast command is empty... I don't use MySQL. Here is the configuration I use for radutmp : /etc/freeradius/3.0/sites-available/default authorize { ... files ... accounting { ... radutmp ... session { ... radutmp ... I use NTRadPing to perform tests, the Radius server accepts my Authentication request without error... How to activate the logs ? Thanks

2 5

Use rest module differently for each site
by Matthew McTague 15 Nov '22

15 Nov '22

Hi there, I'm using FreeRADIUS 3.2.1 on AlmaLinux 8.6, from the NetworkRADIUS repo. I want to use the rest module for multiple sites, default and dhcp. I ideally want to change uri and data, which will contain different information for a BNG's RADIUS requests vs a DHCP relay sending DHCP requests to FreeRADIUS. Is there a way to duplicate the rest module, or configure additional sections with custom naming? I realise I could probably use a custom dictionary attribute, but I'd rather avoid this if possible. I'm confident there will be a better way to achieve this. Warm Regards, .[cid:vg-email_e752d47f-182a-48d0-8808-3796b2df8d4a.png]<https://www.vetta.nz> .[cid:058_line_9bae9502-1e3a-48a3-ba5e-34ed9cd44185.png] Matthew McTague Head of Infrastructure [cid:bea-finalist-email_2ddba0ed-b9bb-4ab9-b680-84aa7f54077f.png] [cid:bea-winner-banner-email_590096c3-05a6-4c98-b071-1c4d748c3534.png] . D +64 3 222 6013<tel:+64%203%20222%206013> | P +64 3 684 5770 E matthew.mctague(a)vetta.nz<mailto:matthew.mctague@vetta.nz> | W www.vetta.nz<https://www.vetta.nz> Vetta Group Ltd and its subsidiaries accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company, its subsidiaries, partners or contractors. .

2 2

FreeRadius and Circuit-ID
by filip.m.nikolic＠roamingnetworks.rs 14 Nov '22

14 Nov '22

Dear, All We are playing around with a scenario for subscriber attachment based on circuit-id and remote-id and ignoring PAP/CHAP. Idea is that you do not need to authenticate a user, just grant him access based on the fixed port in the access node. We struggle in the right configuration, so we are wondering if someone play with that and if someone can help us? Thanks in advance, <http://www.roamingnetworks.com/> <https://www.facebook.com/roamingnetworks/> <https://www.linkedin.com/company/roaming-networks/> <https://www.instagram.com/roaming_networks/> Filip Nikolić LEAD ENGINEER FOR TRANSPORT NETWORK DEVELOPMENT NOC Back Office <tel:+381648907383> +381648907383 <mailto:filip.m.nikolic@roamingnetworks.rs> filip.m.nikolic(a)roamingnetworks.rs <https://goo.gl/maps/g9UJK4ZZtfKtWzct8> OBLAKOVSKA 51, 11000 BELGRADE, SERBIA <http://www.roamingnetworks.com/> www.roamingnetworks.com Odricanje od odgovornosti: Ova elektronska poruka i njeni prilozi namenjeni su osobama na koje je adresirana i može biti poverljive prirode. Ako ova elektronska poruka nije upućena Vama, molimo Vas da nas odmah o tome obavestite a predmetnu elektronsku poruku i sve njene eventualne priloge izbrišete sa svog računara. Ovu elektronsku poruku nemojte kopirati niti njen sadržaj otkrivati trećim licima. Kršenje pravila o poverljivosti informacija zakonski je kažnjivo. Disclaimer: This email and any attachments to it are intended solely for the use of the individual to whom it is addressed and its content may be confidential. If you are not the intended recipient of this email, please contact us immediately. You must neither take any action based upon its contents, nor copy or show it to anyone. Any violation of confidentiality is punishable by law.

2 3

How to investigate failed Android authentication (EAP-TLS) on WiFi reconnection
by Dario Barbon 11 Nov '22

11 Nov '22

Hello, I've a Linux Ubuntu 18.04 server with Freeradius 3.0.16 on x86_64 virtual machine. Freeradius is used only to provide Android devices authentication (EAP-TLS); the authentication works. The WiFi network was installed by my client: it is a geographical distributed WiFi with a controller and 10 access points. Sometimes, when one smartphone moves out of WiFi network area and then come back, the connection to WiFi fails. I can reconnect only after a WiFi off / on from Android network settings. I want to investigate this behaviour; I've found these recurring errors inside last month log files: ERROR: rlm_eap (EAP): No EAP session matching state 0x3d4e1475385119b8 ERROR: TLS Alert write:fatal:protocol version ERROR: TLS Alert read : fatal:unknown CA ERROR: (658258) eap_tls: ERROR: TLS Alert read : fatal : internal error ERROR: (644636) eap_tls: ERROR: TLS Alert read : fatal:bad certificate ERROR: (639156) eap: ERROR: rlm_eap (EAP): Aborting! More than 50 roundtrips made in session with state 0xfd858905cfb18490 ERROR: (367333) eap_tls: ERROR: TLS Alert write:fatal:protocol version Could you please suggest a debug checklist / debug process to help me understand why this behaviour happen? Thanks. Dario Barbon

3 3

How I can enable debug logs for home server status check
by work vlpl 09 Nov '22

09 Nov '22

Hello, I am not sure if this is a potential issue or not so let me first ask how the home server if it is marked as dead can become alive? I have a configuration like this home_server <>__1812 { type = auth ipaddr = ip port = 1812 secret = <> response_window = 20 zombie_period = 40 # revive_interval = 120 status_check = request username = ping password = test check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 65536 } I've tried to uncomment or comment revive_interval but in both cases, I don't see in debug log (-fxxl) any messages about the home server status check. Also in my pool of home servers I have only 1 server, I know this is a weird config, but this is all that I have. In debug logs, I see a message like this (3600) ERROR: Failed to find live home server: Cancelling proxy (3600) Clearing existing &reply: attributes (3600) Found Post-Proxy-Type Fail-Authentication How I can enable debug messages about home server status checks? (I've tried to use more x i.e. -fxxxxx..., not helping) And manual request with radclient and credentials ping/test returns Access-Reject. So I expect that server should be marked as alive. Best regards, Vladimir

3 6

change of CA
by Burn Zero 09 Nov '22

09 Nov '22

Hi, Currently we have laptops(windows 10) which authenticate via FreeRADIUS using EAP-TLS. Now, I am going to change the CA and the laptops will get the new cert from the new CA(which will be used for authentication) and the old cert will be deleted. I have prepared to accept both old and new CA certs in the FreeRADIUS. We also have cache enabled in the eap module - Will this affect the connectivity of laptops since the cached attributes contain the old cert details from the old CA? Thank you.

2 1

3GPP Rel 8 support
by Bernard Murphy 08 Nov '22

08 Nov '22

Could anyone confirm whether they have successfully deployed freeradius for use with 3GPP Rel 8 dictionaries ? I have a need to deploy a 3GPP Rel 8 compatible radius server for use as authentication in a mobile network operators 4G private APN network configuration. I am trying to understand if anyone else has achieved this successfully previously. Regards Bernie This email transmission and any attachments to it are strictly confidential and are intended solely for the person or organisation to whom it is addressed. Its contents may contain legal professional or other privileged information. If you are not the intended recipient, please notify us immediately and delete it, without retaining it, copying it, disclosing its contents to anyone or acting upon it. You must ensure that you have appropriate virus protection before you open or detach any documents from this transmission. We accept no responsibility for viruses. We may monitor replies to emails for operational or lawful business reasons. The views or opinions expressed in this email are the author's own and may not, unless expressly stated to the contrary, reflect the views or opinions of Wales & West Utilities Limited, its affiliates or subsidiaries. Unless expressly stated to the contrary, neither Wales & West Utilities Limited, its affiliates or subsidiaries, their respective directors, officers or employees make any representation about, or accept any liability for, the accuracy or completeness of such views or opinions. Wales & West Utilities Limited Registered office: Wales & West House, Spooner Close, Celtic Springs, Coedkernew, NEWPORT NP10 8FZ Registered in England and Wales No 5046791

2 1

Getting ISO 8601 timestamp via rlm_linelog
by Coy Hile 07 Nov '22

07 Nov '22

Good afternoon, I’ve configured the linelog module to log when users get access to devices and what access level they are granted. eg: Access-Accept = ‘{Time: %T, . . . }’ Is there a way to get an ISO-8601 timestamp? Our telemetry/log management team would prefer that they don’t need to configure a custom timestamp handler in our log aggregation tool thanks, -- Coy Hile coy.hile(a)coyhile.com

2 1

Ignoring Duplicate packet perl module error
by Imdad Hasan 07 Nov '22

07 Nov '22

Hi All, *Ignoring duplicate packet from client 192.168.56.1 port 51091 - ID: 52 due to unfinished request in component authorize module perl* - Getting this error when test with 1k Auth requests with the *perl module* only.. no other load and complexity in perl module, just accepting all requests with " return RLM_MODULE_OK; ".. How can I avoid this error?

2 1

Difference between Received conflicting packet and Ignoring duplicate packet
by norbert.kunth＠now-it.de 03 Nov '22

03 Nov '22

Hi Freeradius-Users, we recently updated from 2.1.1 to 3.0.25 (we use still 3.0.25 because it is build in our SLES distribution). Freeradius uses LDAP to check users. If many users login at a time we see some error messages. To track this down we installed an internal test system that can send a lot of requests to the radius server (with radtest). We do see some problems, but the messages (and the behavior) are not the same. If we fire 60 requests in a short time from the test system to the servers, the server loggs: Thu Nov 3 13:35:11 2022 : Error: (159) Ignoring duplicate packet from client test port 46673 - ID: 65 due to unfinished request in component <core> module <queue> This seems not very bad: every user is still accepted via LDAP But in real the message is different: Thu Nov 3 00:59:25 2022 : Error: Received conflicting packet from client nas port 40634 - ID: 90 due to unfinished request in module ldap. Giving up on old request. Thu Nov 3 00:59:25 2022 : WARNING: (338542) WARNING: Module rlm_ldap became unblocked Thu Nov 3 00:59:25 2022 : Auth: (338542) Invalid user: [user024] (from client nas port 0) We think, we have a timing issue with our LDAP. But why is the log message so different? Best regards Norbert --

2 2