July 2023 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

DPSK in 3.2
by Alan DeKok 22 Aug '23

22 Aug '23

I've just pushed patches to make DPSK work in 3.2. The module configuration is available on GitHub: https://github.com/FreeRADIUS/freeradius-server/blob/v3.2.x/raddb/mods-avai… The work isn't quite done yet, but the module works. The one remaining piece is to cache the identity associated with the PSK. As background, some AP vendors permit dynamic PSKs for WiFi access. This uses WPA-PSK, but the PSK is permitted to be different for different users on the same SSID. There are some issues with DPSK. In short, don't use it. It usually requires the server to try all possible PSKs before finding one that works. This process can be ver very slow. i.e. a reasonable modern system can do 100,000 of these PSK tests per second. So if you have 100,000 individual PSKs, then it can only handle one packet per second before the CPU maxes out. If you have 100 PSKs, then you're limited to 1000 packets per second. And that's doing nothing other than PSK checks. So the numbers are likely to be much lower than that in practice. To help with this performance issue, the module can cache PSK entries in memory. The first time it finds an unknown MAC, it has to brute-force the PSK. But once the PSK is found, the module caches the MAC+SSID+PSK. The next time it receives a packet for that MAC+SSID, the module finds the cache entry, and uses it. We've made it as good as possible considering the limitations of DPSK. But we still recommend that people don't use it. The DPSK functionality is simply broken, and there is really no way to make it efficient. Please see the module configuration for more details. Alan DeKok.

2 2

Certificate chain untrusted
by Maciej Kowalka 10 Aug '23

10 Aug '23

Hi, I've got configures freeradius 3.2 with eap tls, and working certificates, users can be authorized to network but I get warnings every time : Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /C=PL/ST=MyState/O=MyOrg/CN=Intermediate CA (TLS) untrusted certificate with depth [0] subject name /C=PL/ST=MyState/O=MyOrg/CN=client Is there solution to this or so I have to ignore it, and live with it? Maciej

5 23

help with changing to use named instance of sql module
by Matt Zagrabelny 31 Jul '23

31 Jul '23

Greetings FR-users, Running freeradius 3.0.21+dfsg-2.2+deb11u1. The default FR configs (obviously!) work wonderfully. Thank you for making a robust system. I am attempting to deviate from those defaults and am hitting a snag. I would like to use multiple databases (within the sql module), thus I am attempting to change: sql { } to sql foo { } After successfully adding "foo", I can then add "bar". >From running -X it appears that I am connecting to "foo" correctly: (0) foo: EXPAND %{User-Name} (0) foo: --> mzagrabe (0) foo: SQL-User-Name set to 'mzagrabe' rlm_sql (foo): Reserved connection (0) (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_check WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) foo: User found in radcheck table (0) foo: Conditional check items matched, merging assignment check items (0) foo: Crypt-Password := "REDACTED" (0) foo: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) foo: --> SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id (0) foo: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radius_reply WHERE Username = 'mzagrabe' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (foo): Reserved connection (1) rlm_sql (foo): Released connection (1) Need 6 more connections to reach 10 spares rlm_sql (foo): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='foo' host='foo-dev.example.com' user='radius_user' password='REDACTED' application_name='FreeRADIUS 3.0.21 - radiusd (foo)' Connected to database 'foo' on 'foo-dev.example.com' server version 130011, protocol version 3, backend PID 1378924 (0) foo: EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) foo: --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) foo: Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) foo: User found in the group table (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_check WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Conditional check items matched (0) foo: Group "network-admin": Merging assignment check items (0) foo: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = '%{foo-SQL-Group}' ORDER BY id (0) foo: --> SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id (0) foo: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radius_group_reply WHERE GroupName = 'network-admin' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) foo: Group "network-admin": Merging reply items rlm_sql (foo): Released connection (0) (0) [foo] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) if ("%{client:group}" == 'two-factor-authentication-group') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'two-factor-authentication-group') -> FALSE (0) else { (0) update control { (0) Proxy-To-Realm := 'default-authentication-realm' (0) } # update control = noop (0) } # else = noop (0) } # authorize = updated (0) Starting proxy to home server 10.0.0.1 port 1812 (0) server default { (0) } The above -X output is generally the same output as the working default sql configuration output. However, the default working sql configuration does not match the following -X output when I change the configs to use "sql foo {". I am not seeing correct behavior in the post-auth section of sites-enabled/default: [...] (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if ("%{client:group}" == 'network-infrastructure') { (0) EXPAND %{client:group} (0) --> network-infrastructure (0) if ("%{client:group}" == 'network-infrastructure') -> TRUE (0) if ("%{client:group}" == 'network-infrastructure') { (0) if (foo:SQL-Group == 'network-admin') { (0) if (foo:SQL-Group == 'network-admin') -> FALSE (0) else { I am expecting the last FALSE to be TRUE, as in the -X output with the default sql configuration: (0) if (SQL-Group == 'network-admin') { (0) sql_groupcmp (0) EXPAND %{User-Name} (0) --> mzagrabe (0) SQL-User-Name set to 'mzagrabe' rlm_sql (sql): Reserved connection (5) rlm_sql (sql): Reserved connection (6) rlm_sql (sql): Released connection (6) (0) EXPAND SELECT GroupName FROM radius_user_group WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) --> SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority (0) Executing select query: SELECT GroupName FROM radius_user_group WHERE UserName='mzagrabe' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 1 (0) sql_groupcmp finished: User is a member of group network-admin rlm_sql (sql): Released connection (5) (0) if (SQL-Group == 'network-admin') -> TRUE Here is what I have added to the top of my post-auth section: post-auth { if ("%{client:group}" == 'network-infrastructure') { if (foo:SQL-Group == 'network-admin') { update reply { APC-Service-Type = Admin # Set user type for Eaton UPS's Service-Type = Administrative-User } } else { reject } } I have also tried changing (in the same post-auth section) the -sql to -foo but it was not successful. Any hints or ideas about where to look next would be very appreciated. Thank you for your time! -m

2 2

Fetch ACL attributes from LDAP groups
by João Miguel Regateiro 31 Jul '23

31 Jul '23

Hello, I have a freeradius connected to openldap and i am testing applying ACL's fetched from LDAP attributes. The attributes are custom from ldap with the syntax as shown in the configuration below. With the following configurations i have managed to fetch the attributes from the user. mods-available/ldap update { control:Password-With-Header += 'userPassword' ... reply:DACL +="acl-entry-001, acl-entry-002 ... acl-entry-255" } dictionary ATTRIBUTE DACL 3000 string sites-available/default foreach &reply:DACL { update reply { cisco-avpair += "%{Foreach-Variable-0}" } Now I am attempting to do the same, but fetching the attributes from the User groups(to avoid writing the same ACL's on different users). I have done some research and tests, but have not managed to fetch any attribute from the groups. For example, I know that the group acl-admins has these attributes. If the user logging in has memberships acl-admins and network-admins. I want to fetch all the attributes "acl-entry-001, acl-entry-002 ... acl-entry-255" from the acl-admins to be able to update the reply with the foreach shown above. Could you provide some guidance in this matter? Best regards, Miguel

1 0

@ \ and " characters in password in freeradius
by Mesut GULNAZ 28 Jul '23

28 Jul '23

isn't it possible to use "@", "\" and " in the password in freeradius? -- İyi çalışmalar... Mesut GÜLNAZ

2 3

Help to increment freeradius wait timeout in
by Kamal Majaiti 28 Jul '23

28 Jul '23

Problem: Good morning, I am trying to perform a 2FA after a correct validation with MSCHAP against active directory, the postauth executes a script that sends an email with a link to confirm and authorize access, when the link is clicked, access is authorized based on data meanwhile the script with a while waits for the access to be confirmed but freeradius doesn't wait and gives me the following error: (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17681 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output Debug output: (0) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (0) mschap: --> --username=xxx (0) mschap: mschap1: 76 (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (0) mschap: --> --challenge=7698262ed349f8f8 (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (0) mschap: --> --nt-response=d3ad349cc72bd9f1e9e835f73294102da06097b5f6158d4c (0) mschap: Program returned code (0) and output 'NT_KEY: D0ACA7FDF078A8FEBD326F3E18523349' (0) mschap: adding MS-CHAPv1 MPPE keys (0) [mschap] = ok (0) } # authenticate = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) update control { (0) Session-Timeout := 7200 (0) Executing: /bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}: (0) EXPAND %{User-Name} (0) --> xxx Child PID 17593 is taking too much time: forcing failure and killing child. (0) ERROR: Failed to read from child output (0) } # update control = fail (0) } # post-auth = fail (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> xxx (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop Config section: # Post-Authentication once we KNOW that the user has been authenticated, there are additional steps we can take.and get timeout error. post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY Session-Timeout := 7200 } } update { &reply: += &session-state: } -sql exec update control { Session-Timeout := 7200 Auth-Type := `/bin/bash /etc/freeradius/3.0/otp/enviar2FA.sh %{User-Name}` } remove_reply_message_if_eap Post-Auth-Type REJECT { # log failed authentications in SQL, too. -sql attr_filter.access_reject # Insert EAP-Failure message if the request was # rejected by policy instead of because of an # authentication failure eap # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap } # # Filter access challenges. # Post-Auth-Type Challenge { # remove_reply_message_if_eap # attr_filter.access_challenge.post-auth } Post-Auth-Type Client-Lost { } if (EAP-Key-Name && &reply:EAP-Session-Id) { update reply { &EAP-Key-Name := &reply:EAP-Session-Id } } } Regards, Kamal

2 1

Can't include a Dictionary referenced in radiusd.conf
by Scott Reeve 27 Jul '23

27 Jul '23

Created a new Ubuntu server VM (Ubuntu 22.04.2 LTS) and did 'apt get' for freeradius. All was fine until I tried to pull in a standard dictionary file like I've done many times in the past. It's the Mellanox dictionary file: VENDOR Mellanox 33049 BEGIN-VENDOR Mellanox ATTRIBUTE Local-User-Name 1 string END-VENDOR Mellanox It never complained about lack of braces before, but now I get this: including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/3.0/sites-enabled/defaultincluding configuration file /root/mellanoxDictionary/root/mellanoxDictionary[11]: Expecting section start brace '{' after "VENDOR Mellanox"Errors reading or parsing /etc/freeradius/3.0/radiusd.conf Having the same message/error with another dictionary that I also have had no problem with in the past - only recently. (h3cDictionary). I added this line to the bottom of /etc/freeradius/3.0/radiusd.conf: $INCLUDE /root/mellanoxDictionary This has worked fine for years for me, but either the latest Ubuntu and/or the latest FreeRadius somehow do things a bit differently, it seems. Any suggestions?

2 1

Allow update statement to fail
by nabble＠felix.world 26 Jul '23

26 Jul '23

Hi there, is there a way to allow the update statement to fail and just proceed? For example if you want to update a attribute which is "just" for logging pruposes in the authorize section and the update statement failed it returnes 'failed' and stops processing other stuff and resulting in a failed authentication. In the documentation there is the option to rewrite return codes for modules but it seems that the update statement is not really a module or do i missunderstood something here? And i can't find a way in the documentation how to do it. As an example, is there a way to let the following authorize section be processed until the end even if the first update statement is not allowed? I know that it’s not allowed to update the outer request in that context. Just for illustration authorize { update { &outer.request:MyLogAttr := "It would nice to have it in the log but it's ok if not" } eap auth_log } Best regards, lineconnect

1 0

odd messages in radius.log
by Matt H 25 Jul '23

25 Jul '23

Hello - I'm seeing an odd message in /var/log/radius/radius.log - freeradius 3.0.20 Fri Jul 21 11:07:24 2023 : ERROR: (106416) eap_peap: ERROR: TLS Alert read:fatal:unknown CA I would expect that EAP would be failing; it's not, apparently, as users are able to connect and auth (WPA2-Enterprise). I've checked our certs (radius.companyname.crt, pem, etc) and they're up to date. When I run openssl x509 -noout -text -in <file>, everything looks good except that the first cert in the chain has FALSE rather than TRUE for this setting: X509v3 Basic Constraints: critical CA:FALSE Not sure whether or not this is a red herring. Either way, it hasn't changed since the first of June (with no new certs and no other changes ) and the error didn't start showing up in radius.log about the first of July. I haven't provided a full radiusd -X output bc it's a production machine, but can do if necessary. thanks/mh -- Death before dishonour, Nothing before coffee

2 2

question about DHCP-DHCP-Server-Identifier
by Levi Baber 23 Jul '23

23 Jul '23

I'm currently testing my configuration for freeradius as a dhcp server - I'm not yet utilizing any of the radius services - just dhcp. I have multiple vlans (each vlan is an independent network). In my test config, I have two networks defined in raddb/mods-config/files/dhcp under the 'network' section, and I am calling the dhcp_network section from raddb/sites-enabled/dhcp. Everything seems to be working fine with the example options, except it seems I need to set DHCP-DHCP-Server-Identifier somewhere to ensure requests come to the server correctly. Otherwise, I just continue to see discover/offer repeatedly in the debug log. I've currently got it set in the network section of raddb/mods-config/files/dhcp - that seems fine. I've also tried adding it under both DHCP-Discover and DHCP-Request in an 'update reply' - that also worked. If I set DHCP-DHCP-Server-Identifier to my server IP, it all seems to work as expected. I'm confused because: A. this wasn't part of the example options, so I assumed it would not be need to be added B. DHCP-DHCP-Server-Identifier is already defined under "update control" in both DHCP-Discover and DHCP-Request sections of raddb/sites-enabled/dhcp C. comments in raddb/sites-available/dhcp said to use either dhcp_common or dhcp_network - but not both. I noticed the option difference between raddb/policy.d/dhcp and raddb/mods-config/files/dhcp was DHCP-DHCP-Server-Identifier, and adding it has fixed my problem. Basically I just want to be sure I'm not doing something dumb by adding it where I have it, and that I'm correctly understanding how the config files are intended to work. Thank you -- <https://boonecsd.org> 500 7th Street <https://www.google.com/maps/dir//42.0623769,-93.8859242/@42.0624429,-93.886…> | Boone, IA 50036 <https://www.google.com/maps/dir//42.0623769,-93.8859242/@42.0624429,-93.886…> | tel (515) 433-0750 | fax (515) 433-0753Website <https://boonecsd.org> | Twitter <https://twitter.com/BooneSchools> | Facebook <https://www.facebook.com/Boone-Community-School-District-111182762280156> | BooneTV <http://www.boonetv.com/>

2 1

802.1x with GoDaddy Certificates EAP-TTLS
by Torsten Wilms 22 Jul '23

22 Jul '23

I have a little question. I am not sure but does clients need to resolve AAA Server via DNS and need to reach AAA Server if I use EAP-TTLS with GoDaddy x509 Certificates to verify the certificate on e.g. Mobile Devices or does the client need in any other case to reach some endpoint to validate the certificates common name? I have a AAA Server in a separate Network installed which is only reachable for the authenticator (Wireless Controller). The Clients communicate with the AccessPoint. A hand full devices like Android are not able to connect the wireless because of certificate validation error. The other devices has no problems. You see the certificate of the server and after accept, the connection will be established. The AAA Server sends the full chain like RootCA, Intermediate and server certificate. BR. Torsten

6 17

Building freeradius against mariadb client library
by Bill Schoolfield 21 Jul '23

21 Jul '23

We deploy freeradius with our application for a on premise joint solution. We build freeradius from source and include the source and binaries in a installation package. We use rlm_perl and rlm_sql modules With all the issues with Redhat (IBM) we are presently trying to build a new release for Debian 12. It doesn't appear (we could be completely wrong here) that the mysql client libraries are available. I do see mention of them online in a package named default-libmysqlclient-dev but a package search using dpkg-query reveals nothing by that name. I either need the appropriate packages for Debian, or I need to alter the build to use the mariadb library and includes. Perhaps modifying configure.ac to use mariadb_config? What is the solution here?

2 6

Unable to start freerad with sudo
by Stanislav Lorenc 20 Jul '23

20 Jul '23

Hi, I can`t start freerad with sudo under lxc Under debug mode server is started: sudo -u www-data /usr/sbin/freeradius -f -X Listening on auth address * port 5000 bound to server test_local_pppoe_services Listening on acct address * port 1813 bound to server test_local_pppoe_services Listening on proxy address * port 52599 Ready to process requests but in the service command server failed sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details. I went through all the logs, but I can't find anywhere if the problem is in radius, systemd, lxc or apparmor. Thanks for tips Regards SL

7 10

FR behavior when DB not available
by Anatoliy 20 Jul '23

20 Jul '23

Hi Alan ,team, I am testing scenario when main DB is temporary not available. I set rule in iptables to block all connections to DB. In this situation freeradius should return Accept with some parameters to NAS. authorize section is looks like sql { fail = 1 notfound = 2 } if ( fail ) { update { reply:Class = "outage" control:Auth-Type := Accept reply:Reply-Message := "DB Failed" reply:Acct-Interim-Interval := 600 } } This part works fine, but in traffic dump I see that radius replay with big delay , some times upto 20-30 seconds. In log a lot messages like Mon Jul 17 06:12:23 2023 : Error: Unresponsive child for request 288, in component <core> module Mon Jul 17 06:12:26 2023 : Error: rlm_sql_unixodbc: SQL down 08S01 [Oracle][ODBC][Ora]ORA-03113: end-of-file on communication channel Process ID: 151372 Session ID: 97 Serial number: 5095 Mon Jul 17 06:12:34 2023 : Error: rlm_sql_unixodbc: Connection failed I am trying to tune some parameters for sql connection, but this does not help. pool section retry_delay = 120 lifetime = 30 max_retries = 2 uses = 0 in radius.conf max_request_time = 5 and kernel (for faster detection that tcp session is broken) net.ipv4.tcp_retries2 = 2 net.ipv4.tcp_keepalive_intvl=5 net.ipv4.tcp_keepalive_probes=3 net.ipv4.tcp_keepalive_time=15 Can you recommend which params to change to prevent freeradius stuck on sql connection to DB ? Is it possible to prevent FR trying to connect to DB for some time (i think it is param retry_delay ) for all threads ?

6 15

EAP Failure Code 4
by Paul Bone 18 Jul '23

18 Jul '23

Hi I have a network of Unifi Access Points using WPA2 Enterprise and Freeradius. We often get times when Access Points appear to just stop allow connections and a reboot will fix the issue. I have just run a packet capture when this problem is occurring and notice that the radius server replies with Access-Reject Code 3 and EAP Failure Code 4. Any advice on the best place to start looking as to what might be causing these issues? Thanks Paul Bone

3 8

update disconnect
by Anatoliy 16 Jul '23

16 Jul '23

In accounting section I have configuration like sql { fail = 1 } if ( !fail ) { if (&Class) { if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { update disconnect { Acct-Session-Id := "%{Acct-Session-Id}" } } } } We check that DB is working and if Class attribute eq outage(this set when DB not accessible) freeradius should send DM message to NAS to disconnect this subscriber. We tested this with freeradius 3.2.0 and it works fine, but after upgrading to 3.2.3 we got error Here is part of debug log (1128) [sql] = ok (1128) if ( !fail ) { (1128) if ( !fail ) -> TRUE (1128) if ( !fail ) { (1128) if (&Class) { (1128) if (&Class) -> TRUE (1128) if (&Class) { (1128) if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { (1128) if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") -> TRUE (1128) if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { (1128) update disconnect { (1128) ERROR: You can only do 'update coa' when processing a packet which was received from the network (1128) } # update disconnect = invalid (1128) } # if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") = invalid (1128) } # if (&Class) = invalid (1128) } # if ( !fail ) = invalid (1128) } # accounting = invalid (1128) Finished internally proxied request. (1128) Clearing existing &reply: attributes (1128) Found Post-Proxy-Type Fail-Accounting Can you help to understand how to fix this ?

2 7

rate linit connections to DB
by Anatoliy 15 Jul '23

15 Jul '23

Hi Alan, team. I saw in logs messages like this Thu Jul 13 02:23:40 2023 : Warning: rlm_sql (mysql): Cannot open a new connection due to rate limit after failure Why we limiting connections and how we can control this ? Unable to find anything on doc

2 2

RPM packages and certs dir
by Gerald Vogt 14 Jul '23

14 Jul '23

Hi! It seems all the files for the test/bootstrap certs in raddb/certs are packed into the RPM file. The README.md in the certs directory specifically suggest to use "make destroycerts" to remove all the test certificates before starting with the real ones. Of course, that doesn't really help because with the next update the new rpm will restore all those config files which are missing: # rpm -V freeradius-config-3.2.3-1.el9.x86_64 missing c /etc/raddb/certs/01.pem missing c /etc/raddb/certs/02.pem missing c /etc/raddb/certs/ca.crl missing c /etc/raddb/certs/ca.der missing c /etc/raddb/certs/ca.key SM5....T. c /etc/raddb/certs/ca.pem missing c /etc/raddb/certs/client.crt missing c /etc/raddb/certs/client.csr missing c /etc/raddb/certs/client.key missing c /etc/raddb/certs/client.p12 missing c /etc/raddb/certs/client.pem missing c /etc/raddb/certs/dh missing c /etc/raddb/certs/index.txt missing c /etc/raddb/certs/index.txt.attr missing c /etc/raddb/certs/index.txt.attr.old missing c /etc/raddb/certs/index.txt.old missing c /etc/raddb/certs/serial missing c /etc/raddb/certs/serial.old missing c /etc/raddb/certs/server.crt missing c /etc/raddb/certs/server.csr missing c /etc/raddb/certs/server.key missing c /etc/raddb/certs/server.p12 missing c /etc/raddb/certs/server.pem missing c /etc/raddb/certs/user(a)example.org.p12 missing c /etc/raddb/certs/user(a)example.org.pem S.5....T. c /etc/raddb/clients.conf ... So technically, those files shouldn't be included in the RPM file, but instead, I guess the bootstrap script should run during the %post section in the spec file unless it's not all in the original state... Regards, Gerald

2 1

update disconnect and order of operations
by Anatoliy 14 Jul '23

14 Jul '23

Hi team, How update disconnect work in accounting section ? For example we have accounting configuration like this sql { fail = 1 } if ( !fail ) { if (&Class) { if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { update disconnect { Acct-Session-Id := "%{Acct-Session-Id}" } } } } linelog if we receive accounting pack with Class=outage and DB accessible , we should send disconnect message for this session. But, what happens if NAS is busy , or packet will be lost , so we did not receive reply ? Will freeradius wait for some timeout before continue to linelog directive or sending and processing disconnect message will be executed in parallel and we process the linelog without any delay?

3 6

EAP-MSCHAPv2 and AD Authentication w/o ntlm_auth
by BOUILLOUD Corentin 11 Jul '23

11 Jul '23

Hi everyone, nice to meet you, I would like to use Kerberos instead of ntlm_auth to authenticate AD users with FreeRADIUS. I configured 'mschap' module to directly use winbind daemon directly and, If I understood samba documentation properly, winbindd can't authenticate users himself. It uses 'pam_winbind' module that we can configure to use Kerberos. Could you confirm me that it is correct and/or possible in another way ? mods-enabled/mschap # # An alternative to using ntlm_auth is to connect to the # winbind daemon directly for authentication. This option # is likely to be faster and may be useful on busy systems, # but is less well tested. # # Using this option requires libwbclient from Samba 4.2.1 # or later to be installed. Make sure that ntlm_auth above is # commented out. # winbind_username = "%{mschap:User-Name}" winbind_domain = "%{mschap:NT-Domain}" https://www.samba.org/samba/docs/current/man-html/winbindd.8.html The service provided by winbindd is called `winbind' and can be used to resolve user and group information from a Windows NT server. The service can also provide authentication services via an associated PAM module. https://www.samba.org/samba/docs/current/man-html/pam_winbind.8.html krb5_auth pam_winbind can authenticate using Kerberos when winbindd is talking to an Active Directory domain controller. Kerberos authentication must be enabled with this parameter. ======================================================== This message has been scanned for malware. This message and any attachments (the "message") are confidential, intended solely for the addressees, and may contain legally privileged information. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither our company or any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified. ========================================================= Ce message a ete verifie et ne contient pas de programme malveillant. Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et susceptibles de contenir des informations couvertes par le secret professionnel. Ce message est etabli a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Notre societe et ses filiales declinent toute responsabilite au titre de ce message s'il a ete altere, deforme falsifie. O =========================================================

2 2