July 2023 - Freeradius-Users - lists.freeradius.org

odd messages in radius.log
by Matt H 25 Jul '23

25 Jul '23

Hello - I'm seeing an odd message in /var/log/radius/radius.log - freeradius 3.0.20 Fri Jul 21 11:07:24 2023 : ERROR: (106416) eap_peap: ERROR: TLS Alert read:fatal:unknown CA I would expect that EAP would be failing; it's not, apparently, as users are able to connect and auth (WPA2-Enterprise). I've checked our certs (radius.companyname.crt, pem, etc) and they're up to date. When I run openssl x509 -noout -text -in <file>, everything looks good except that the first cert in the chain has FALSE rather than TRUE for this setting: X509v3 Basic Constraints: critical CA:FALSE Not sure whether or not this is a red herring. Either way, it hasn't changed since the first of June (with no new certs and no other changes ) and the error didn't start showing up in radius.log about the first of July. I haven't provided a full radiusd -X output bc it's a production machine, but can do if necessary. thanks/mh -- Death before dishonour, Nothing before coffee

2 2

question about DHCP-DHCP-Server-Identifier
by Levi Baber 23 Jul '23

23 Jul '23

I'm currently testing my configuration for freeradius as a dhcp server - I'm not yet utilizing any of the radius services - just dhcp. I have multiple vlans (each vlan is an independent network). In my test config, I have two networks defined in raddb/mods-config/files/dhcp under the 'network' section, and I am calling the dhcp_network section from raddb/sites-enabled/dhcp. Everything seems to be working fine with the example options, except it seems I need to set DHCP-DHCP-Server-Identifier somewhere to ensure requests come to the server correctly. Otherwise, I just continue to see discover/offer repeatedly in the debug log. I've currently got it set in the network section of raddb/mods-config/files/dhcp - that seems fine. I've also tried adding it under both DHCP-Discover and DHCP-Request in an 'update reply' - that also worked. If I set DHCP-DHCP-Server-Identifier to my server IP, it all seems to work as expected. I'm confused because: A. this wasn't part of the example options, so I assumed it would not be need to be added B. DHCP-DHCP-Server-Identifier is already defined under "update control" in both DHCP-Discover and DHCP-Request sections of raddb/sites-enabled/dhcp C. comments in raddb/sites-available/dhcp said to use either dhcp_common or dhcp_network - but not both. I noticed the option difference between raddb/policy.d/dhcp and raddb/mods-config/files/dhcp was DHCP-DHCP-Server-Identifier, and adding it has fixed my problem. Basically I just want to be sure I'm not doing something dumb by adding it where I have it, and that I'm correctly understanding how the config files are intended to work. Thank you -- <https://boonecsd.org> 500 7th Street <https://www.google.com/maps/dir//42.0623769,-93.8859242/@42.0624429,-93.886…> | Boone, IA 50036 <https://www.google.com/maps/dir//42.0623769,-93.8859242/@42.0624429,-93.886…> | tel (515) 433-0750 | fax (515) 433-0753Website <https://boonecsd.org> | Twitter <https://twitter.com/BooneSchools> | Facebook <https://www.facebook.com/Boone-Community-School-District-111182762280156> | BooneTV <http://www.boonetv.com/>

2 1

802.1x with GoDaddy Certificates EAP-TTLS
by Torsten Wilms 22 Jul '23

22 Jul '23

I have a little question. I am not sure but does clients need to resolve AAA Server via DNS and need to reach AAA Server if I use EAP-TTLS with GoDaddy x509 Certificates to verify the certificate on e.g. Mobile Devices or does the client need in any other case to reach some endpoint to validate the certificates common name? I have a AAA Server in a separate Network installed which is only reachable for the authenticator (Wireless Controller). The Clients communicate with the AccessPoint. A hand full devices like Android are not able to connect the wireless because of certificate validation error. The other devices has no problems. You see the certificate of the server and after accept, the connection will be established. The AAA Server sends the full chain like RootCA, Intermediate and server certificate. BR. Torsten

6 17

Building freeradius against mariadb client library
by Bill Schoolfield 21 Jul '23

21 Jul '23

We deploy freeradius with our application for a on premise joint solution. We build freeradius from source and include the source and binaries in a installation package. We use rlm_perl and rlm_sql modules With all the issues with Redhat (IBM) we are presently trying to build a new release for Debian 12. It doesn't appear (we could be completely wrong here) that the mysql client libraries are available. I do see mention of them online in a package named default-libmysqlclient-dev but a package search using dpkg-query reveals nothing by that name. I either need the appropriate packages for Debian, or I need to alter the build to use the mariadb library and includes. Perhaps modifying configure.ac to use mariadb_config? What is the solution here?

2 6

Unable to start freerad with sudo
by Stanislav Lorenc 20 Jul '23

20 Jul '23

Hi, I can`t start freerad with sudo under lxc Under debug mode server is started: sudo -u www-data /usr/sbin/freeradius -f -X Listening on auth address * port 5000 bound to server test_local_pppoe_services Listening on acct address * port 1813 bound to server test_local_pppoe_services Listening on proxy address * port 52599 Ready to process requests but in the service command server failed sudo -u www-data /usr/sbin/freeradius -f radiusd: ERROR - Cannot initialize supplementary group list for user freerad: Operation not permitted sudo -u www-data /usr/sbin/service freeradius start Failed to start freeradius.service: Access denied See system logs and 'systemctl status freeradius.service' for details. I went through all the logs, but I can't find anywhere if the problem is in radius, systemd, lxc or apparmor. Thanks for tips Regards SL

7 10

FR behavior when DB not available
by Anatoliy 20 Jul '23

20 Jul '23

Hi Alan ,team, I am testing scenario when main DB is temporary not available. I set rule in iptables to block all connections to DB. In this situation freeradius should return Accept with some parameters to NAS. authorize section is looks like sql { fail = 1 notfound = 2 } if ( fail ) { update { reply:Class = "outage" control:Auth-Type := Accept reply:Reply-Message := "DB Failed" reply:Acct-Interim-Interval := 600 } } This part works fine, but in traffic dump I see that radius replay with big delay , some times upto 20-30 seconds. In log a lot messages like Mon Jul 17 06:12:23 2023 : Error: Unresponsive child for request 288, in component <core> module Mon Jul 17 06:12:26 2023 : Error: rlm_sql_unixodbc: SQL down 08S01 [Oracle][ODBC][Ora]ORA-03113: end-of-file on communication channel Process ID: 151372 Session ID: 97 Serial number: 5095 Mon Jul 17 06:12:34 2023 : Error: rlm_sql_unixodbc: Connection failed I am trying to tune some parameters for sql connection, but this does not help. pool section retry_delay = 120 lifetime = 30 max_retries = 2 uses = 0 in radius.conf max_request_time = 5 and kernel (for faster detection that tcp session is broken) net.ipv4.tcp_retries2 = 2 net.ipv4.tcp_keepalive_intvl=5 net.ipv4.tcp_keepalive_probes=3 net.ipv4.tcp_keepalive_time=15 Can you recommend which params to change to prevent freeradius stuck on sql connection to DB ? Is it possible to prevent FR trying to connect to DB for some time (i think it is param retry_delay ) for all threads ?

6 15

EAP Failure Code 4
by Paul Bone 18 Jul '23

18 Jul '23

Hi I have a network of Unifi Access Points using WPA2 Enterprise and Freeradius. We often get times when Access Points appear to just stop allow connections and a reboot will fix the issue. I have just run a packet capture when this problem is occurring and notice that the radius server replies with Access-Reject Code 3 and EAP Failure Code 4. Any advice on the best place to start looking as to what might be causing these issues? Thanks Paul Bone

3 8

update disconnect
by Anatoliy 16 Jul '23

16 Jul '23

In accounting section I have configuration like sql { fail = 1 } if ( !fail ) { if (&Class) { if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { update disconnect { Acct-Session-Id := "%{Acct-Session-Id}" } } } } We check that DB is working and if Class attribute eq outage(this set when DB not accessible) freeradius should send DM message to NAS to disconnect this subscriber. We tested this with freeradius 3.2.0 and it works fine, but after upgrading to 3.2.3 we got error Here is part of debug log (1128) [sql] = ok (1128) if ( !fail ) { (1128) if ( !fail ) -> TRUE (1128) if ( !fail ) { (1128) if (&Class) { (1128) if (&Class) -> TRUE (1128) if (&Class) { (1128) if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { (1128) if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") -> TRUE (1128) if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { (1128) update disconnect { (1128) ERROR: You can only do 'update coa' when processing a packet which was received from the network (1128) } # update disconnect = invalid (1128) } # if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") = invalid (1128) } # if (&Class) = invalid (1128) } # if ( !fail ) = invalid (1128) } # accounting = invalid (1128) Finished internally proxied request. (1128) Clearing existing &reply: attributes (1128) Found Post-Proxy-Type Fail-Accounting Can you help to understand how to fix this ?

2 7

rate linit connections to DB
by Anatoliy 15 Jul '23

15 Jul '23

Hi Alan, team. I saw in logs messages like this Thu Jul 13 02:23:40 2023 : Warning: rlm_sql (mysql): Cannot open a new connection due to rate limit after failure Why we limiting connections and how we can control this ? Unable to find anything on doc

2 2

RPM packages and certs dir
by Gerald Vogt 14 Jul '23

14 Jul '23

Hi! It seems all the files for the test/bootstrap certs in raddb/certs are packed into the RPM file. The README.md in the certs directory specifically suggest to use "make destroycerts" to remove all the test certificates before starting with the real ones. Of course, that doesn't really help because with the next update the new rpm will restore all those config files which are missing: # rpm -V freeradius-config-3.2.3-1.el9.x86_64 missing c /etc/raddb/certs/01.pem missing c /etc/raddb/certs/02.pem missing c /etc/raddb/certs/ca.crl missing c /etc/raddb/certs/ca.der missing c /etc/raddb/certs/ca.key SM5....T. c /etc/raddb/certs/ca.pem missing c /etc/raddb/certs/client.crt missing c /etc/raddb/certs/client.csr missing c /etc/raddb/certs/client.key missing c /etc/raddb/certs/client.p12 missing c /etc/raddb/certs/client.pem missing c /etc/raddb/certs/dh missing c /etc/raddb/certs/index.txt missing c /etc/raddb/certs/index.txt.attr missing c /etc/raddb/certs/index.txt.attr.old missing c /etc/raddb/certs/index.txt.old missing c /etc/raddb/certs/serial missing c /etc/raddb/certs/serial.old missing c /etc/raddb/certs/server.crt missing c /etc/raddb/certs/server.csr missing c /etc/raddb/certs/server.key missing c /etc/raddb/certs/server.p12 missing c /etc/raddb/certs/server.pem missing c /etc/raddb/certs/user(a)example.org.p12 missing c /etc/raddb/certs/user(a)example.org.pem S.5....T. c /etc/raddb/clients.conf ... So technically, those files shouldn't be included in the RPM file, but instead, I guess the bootstrap script should run during the %post section in the spec file unless it's not all in the original state... Regards, Gerald

2 1