September 2023 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

LDAPS - where to start from?
by little-nemo＠virgilio.it 23 Nov '23

23 Nov '23

Hello, members. I followed the upgrading suggestion. Now working on Freeradius 3.2.1 (on Debian 11.5). I'm also using some personalized templates of the Eduroam/GARR consortium. Trying to setup LDAP filtering. To get an idea on how to do it, I read the tread "LDAP groups and how to filter" (https://lists.freeradius.org/pipermail/freeradius-users/2020-February/09743…) Is it still up to date? Is it a feasible solution? I'm still not understanding if this solution also requires the memberof/membership settings in the mods-available/ldap module. Does it? Now my main concern is the LDAPS binding, which is not working. Debug last rows: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldaps://dc1.testuni.it:636 rlm_ldap (ldap): Bind with CN=reader-freeradius,OU=ServiceUsers,OU=ServicePeople,DC=testuni,DC=it to ldaps://dc1.testuni.it:636 failed: Can't contact LDAP server rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" I tried to bind, manually, using the general command: ldapsearch -D ${identity} -w ${password} -H ${server} -b 'CN=user,${base_dn}' and it worked. In mods-available/ldap, at line 77, I read the suggestion: ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}' which did not work (the "-h" parameter is not supported anymore?). I don't think that this is the exact command used by freeradius, so the cause is elsewhere, likely in my configuration files. What am I supposed to check? Do you need the full debug? Thanks in advance, Pietro

3 11

Will radiusd reload certificates on hup command?
by James Fan 31 Oct '23

31 Oct '23

Assuming that the FreeRADIUS configuration files have changed, will the hup command make the server reload its certificates, keys, etc.? Thanks.

3 4

Problems to authenticate against an Azure AD -Ldap
by Uwe Faber 02 Oct '23

02 Oct '23

Hi folks, i hopw you can help after reading thousends articles and making hundred of trials with the freeradius with no succes. Here ist the situation, we have an Azure AD and for this an ldap server front-end. So i could connect to the AD over the ldap. for testing reason i implementet an Local openldap server and testet ist with the eapol test and it works without problems, but if i change the ldap connection to the azure/ldap i got the following error: 5) ldap_khs: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (5) ldap_khs: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) regards Uwe

5 17

FreeRADIUS on mac
by Robert Fernandez 30 Sep '23

30 Sep '23

Has anyone gotten FreeRADIUS 3.2.3 to compile on Macintosh. When I run “make” it errors on the line: configure: error: failed linking to libcrypto. Use --with-openssl-lib-dir=<path>, or --with-openssl=no (builds without OpenSSL)

2 1

Quick question about FreeRADIUS and timezones
by Stefan Paetow 29 Sep '23

29 Sep '23

Hi, I know this is probably something really obvious but… Does FreeRADIUS log in UTC or the local timezone? Is there anything specific in terms of settings (in radiusd.conf) to make FreeRADIUS log in UTC by default if it does not? I’ve looked at the date {} module and I note that both the ‘date’ and the ‘wispr2date’ xlats have the option to output things in UTC… would that be the only thing where this can be tweaked? With kind regards Stefan Paetow Federated Roaming Technical Specialist eduroam(UK), Jisc email/teams: stefan.paetow(a)jisc.ac.uk gpg: 0x3FCE5142 For eduroam support, please contact the eduroam team via help(a)jisc.ac.uk and mark it for eduroam’s attention. On Wednesdays and Fridays, I am not available between 12:00 and 15:00. jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB Tel: 020 3697 5800.

2 2

Lockout by IP number?
by Ann Cantelow 28 Sep '23

28 Sep '23

Hello, I am looking to implement a lockout for excessive login tries. I have been following advice offered at https://wiki.freeradius.org/guide/lockout , and thank you very much for that. Is there a variable like '%{User-Name}' for IP number? I would like to do a lockout based on IP number as well as User-Name. I see the IP is listed in the radius log, but I haven't been able to find an attribute that I figure will give this information. I've looked in the dictionary files, but maybe I've somehow missed it. My radius version is 2.1.12 on RHEL6, and client nastype is cisco. Radius upgrade to version 3 is planned. Radius log example lines showing ip numbers: ... Wed Sep 27 11:29:13 2023 : Auth: Login incorrect: [edc] (from client [clientname] port 212271104 cli 62.122.184.231) Wed Sep 27 11:29:14 2023 : Auth: Login incorrect: [edc] (from client [clientname] port 86839296 cli 62.122.184.231) Wed Sep 27 11:29:16 2023 : Auth: Login incorrect: [qazwsx] (from client [clientname] port 241688576 cli 62.122.184.231) Wed Sep 27 11:29:17 2023 : Auth: Login incorrect: [qazwsx] (from client [clientname] port 166244352 cli 62.122.184.231) ... Many thanks, Ann Cantelow

4 4

Simple question (Request Duration)
by Andy Arp 27 Sep '23

27 Sep '23

Is there a builtin value i can emit to linelog that will indicate how long a given request has taken from start to finish? -- Thanks, Andy Arp

3 3

dhcp v6
by Charles Hedrick 27 Sep '23

27 Sep '23

I see there's support for DHCP v6, but I don't see any usable documentation or examples. The sample site file doesn't return any information. Does anyone have either documentaiton or a working configuration file that returns info, prerably from sql, though I can presumably combined with v4 info for that.

2 1

Freeradius+pbkdf2
by Andre Luis Forigato 27 Sep '23

27 Sep '23

Hello, My users' passwords are stored in ldap using pbkdf2 encryption, until Freeradius v2 all users were successfully authenticated, when migrating to the Freeradius 3.2.3 version users are unable to authenticate using pbkdf2 encryption. What could have happened? Is there any way to resolve this problem? Thank you very much. Att, André Luis Forigato RNP

2 1

EAP-TTLS Diameter usage
by Härtl, Calvin 21 Sep '23

21 Sep '23

Hi all, first of all, thank you for your help so far! I do have another question regarding EAP-TTLS. According to eap ttls | FreeRADIUS Documentation (networkradius.com)<https://networkradius.com/doc/3.0.10/raddb/mods-available/eap/ttls.html> and RFC5281 (RFC 5281: Extensible Authentication Protocol Tunneled Transport Layer Security Authenticated Protocol Version 0 (EAP-TTLSv0) (rfc-editor.org)<https://www.rfc-editor.org/rfc/rfc5281.html#page-15>), Diameter is being used in this protocol to allow the usage of AVPs. But is there another reason why EAP-TTLS uses Diameter packages? I am asking, since I checked some PEAP packages with Wireshark and these packages, while not using Diameter, still have AVPs incorporated in them. I also can not find any sources that state why Diameter was specifically chosen for EAP-TTLS. Was there another advantage that Diameter offers in the case of EAP-TTLS? I.e. client roaming capabilities, failover, etc.? Kind regards, Calvin

2 1

SQL: radpostauth empty fields
by Stephane Bourque 20 Sep '23

20 Sep '23

Hi, We are using FreeRadius with SQL and everything is working fine right now. We are using PostgreSQL. We are noticing all empty fields in the radpostauth DB, namely callingstationid and calledstationid. All of our sites have the following: post-auth { update { &reply: += &session-state: } sql06 exec remove_reply_message_if_eap Post-Auth-Type REJECT { eap06 remove_reply_message_if_eap } Post-Auth-Type Challenge { } } I am assuming this is where something is missing to update these fields. I am not finding information of what we would need to add or modify in order to populate the fields. Is there a link you can point me to or an explanation on how to solve this problem? We have not modified the basic SQL queries or DB schemas. Thank you. -- *Stephane Bourque* *CEO & Founder* *Arilia Wireless Inc.* *"Everything connected"* stephane.bourque(a)arilia.com +1(778)558-3524 *www.arilia.com <http://www.arilia.com>*

3 4

Send logs from the linelog module to stdout
by work vlpl 20 Sep '23

20 Sep '23

Hi, I am running radiusd in Docker container. In configuration radiusd.conf I had set the user and group variable to drop permission after the start. Radiusd process is started with `-fl stdout` to redirect radiusd process logs to stdout and let Docker collect necessary logs. But in the linelog module if I will use /dev/stdout as filename radiusd seems can't open it for writing. Also, Docker requires `tty=true`, or permissions to /dev/stdout granted only to root. May I ask if there is an option that I am missing, to redirect linelog output to stdout? Best regards, Valdimir

3 4

EAP-PEAP Issue with new Android device
by dlux＠lux-it-systeme.de 19 Sep '23

19 Sep '23

Hi, while trying to setup a new Android device an issue started to appear: Short Story: Authentication fails in the (i guess) P1 phase of EAP-PEAP with a message: certificate expired. Long Story: The radius server is using LetsEncrypt Server certs for ist TLS configuration. That setups works with every device i know of in this network. A new Android device however seems to behave weird with it. Logging Freeradius with the -X flag results with the log below. The device is set to not validate the server cert and use EAP-PEAP for P1 and MSCHAPv2 for P2. kp@<domain-stripped> is the anonymous identity. The last message seems rather short (TLS Length 7) which doesn't sound right. I know there is an issue with the domain detection because its only checking for ntdomain. Thats work for another day. Thank you in advance, Daniel Lux ``` (298) Received Access-Request Id 166 from 10.2.254.253:60831 to 10.0.0.248:1812 length 208 (298) User-Name = "kp@<domain-stripped>" (298) NAS-IP-Address = 10.2.254.253 (298) NAS-Port = 0 (298) NAS-Identifier = "10.2.254.253" (298) NAS-Port-Type = Wireless-802.11 (298) Calling-Station-Id = "843E1D87F5BF" (298) Called-Station-Id = "204C03033278" (298) Service-Type = Framed-User (298) Framed-MTU = 1100 (298) EAP-Message = 0x0201001b016b70407261747367796d6e617369756d2d70652e6465 (298) Aruba-Essid-Name = "RatseNetL" (298) Aruba-Location-Id = "AP18" (298) Aruba-AP-Group = "OS-Trakt" (298) Message-Authenticator = 0xd4fead8cee934d4d691b8e1218e4220d (298) # Executing section authorize from file /etc/freeradius/sites-enabled/default (298) authorize { (298) [preprocess] = ok (298) ntdomain: Checking for prefix before "\" (298) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (298) ntdomain: No such realm "NULL" (298) [ntdomain] = noop (298) update control { (298) &Proxy-To-Realm := LOCAL (298) } # update control = noop (298) [chap] = noop (298) [mschap] = noop (298) [digest] = noop (298) eap: Peer sent EAP Response (code 2) ID 1 length 27 (298) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (298) [eap] = ok (298) } # authorize = ok (298) Found Auth-Type = eap (298) # Executing group from file /etc/freeradius/sites-enabled/default (298) authenticate { (298) eap: Peer sent packet with method EAP Identity (1) (298) eap: Calling submodule eap_peap to process data (298) eap_peap: Initiating new EAP-TLS session (298) eap_peap: [eaptls start] = request (298) eap: Sending EAP Request (code 1) ID 2 length 6 (298) eap: EAP session adding &reply:State = 0xe37f3d5de37d24b2 (298) [eap] = handled (298) } # authenticate = handled (298) Using Post-Auth-Type Challenge (298) Post-Auth-Type sub-section not found. Ignoring. (298) # Executing group from file /etc/freeradius/sites-enabled/default (298) Sent Access-Challenge Id 166 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (298) EAP-Message = 0x010200061920 (298) Message-Authenticator = 0x00000000000000000000000000000000 (298) State = 0xe37f3d5de37d24b242773e627ff3f802 (298) Finished request (299) Received Access-Request Id 47 from 10.2.254.253:60831 to 10.0.0.248:1812 length 340 (299) User-Name = "kp@<domain-stripped>" (299) NAS-IP-Address = 10.2.254.253 (299) NAS-Port = 0 (299) NAS-Identifier = "10.2.254.253" (299) NAS-Port-Type = Wireless-802.11 (299) Calling-Station-Id = "843E1D87F5BF" (299) Called-Station-Id = "204C03033278" (299) Service-Type = Framed-User (299) Framed-MTU = 1100 (299) EAP-Message = 0x0202008d198000000083160301007e0100007a03039cd3aa393b421414e62481d34c86e861 c1dd382868b4f29944d0c04c62ae43ec00001ec02bc02fc02cc030cca9cca8c009c013c00ac0 14009c009d002f0035000a0100003300170000ff01000100000a00080006001d00170018000b 00020100000d (299) State = 0xe37f3d5de37d24b242773e627ff3f802 (299) Aruba-Essid-Name = "RatseNetL" (299) Aruba-Location-Id = "AP18" (299) Aruba-AP-Group = "OS-Trakt" (299) Message-Authenticator = 0x6761200777d3cba4c291bc097f235982 (299) session-state: No cached attributes (299) # Executing section authorize from file /etc/freeradius/sites-enabled/default (299) authorize { (299) [preprocess] = ok (299) ntdomain: Checking for prefix before "\" (299) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (299) ntdomain: No such realm "NULL" (299) [ntdomain] = noop (299) update control { (299) &Proxy-To-Realm := LOCAL (299) } # update control = noop (299) [chap] = noop (299) [mschap] = noop (299) [digest] = noop (299) eap: Peer sent EAP Response (code 2) ID 2 length 141 (299) eap: Continuing tunnel setup (299) [eap] = ok (299) } # authorize = ok (299) Found Auth-Type = eap (299) # Executing group from file /etc/freeradius/sites-enabled/default (299) authenticate { (299) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (299) eap: Finished EAP session with state 0xe37f3d5de37d24b2 (299) eap: Previous EAP request found for state 0xe37f3d5de37d24b2, released from the list (299) eap: Peer sent packet with method EAP PEAP (25) (299) eap: Calling submodule eap_peap to process data (299) eap_peap: Continuing EAP-TLS (299) eap_peap: Peer indicated complete TLS record size will be 131 bytes (299) eap_peap: Got complete TLS record (131 bytes) (299) eap_peap: [eaptls verify] = length included (299) eap_peap: (other): before/accept initialization (299) eap_peap: TLS_accept: before/accept initialization (299) eap_peap: <<< recv TLS 1.2 [length 007e] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 0039] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 149f] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 014d] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 0004] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: TLS_accept: unknown state (299) eap_peap: TLS_accept: unknown state (299) eap_peap: TLS_accept: Need to read more data: unknown state (299) eap_peap: TLS_accept: Need to read more data: unknown state (299) eap_peap: In SSL Handshake Phase (299) eap_peap: In SSL Accept mode (299) eap_peap: [eaptls process] = handled (299) eap: Sending EAP Request (code 1) ID 3 length 1004 (299) eap: EAP session adding &reply:State = 0xe37f3d5de27c24b2 (299) [eap] = handled (299) } # authenticate = handled (299) Using Post-Auth-Type Challenge (299) Post-Auth-Type sub-section not found. Ignoring. (299) # Executing group from file /etc/freeradius/sites-enabled/default (299) Sent Access-Challenge Id 47 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (299) EAP-Message = 0x010303ec19c00000163d16030300390200003503032221981d91de057e15a5d627e7d85254 fb02778827cee35a6895f65d00e6180c00c02f00000dff01000100000b000403000102160303 149f0b00149b001498000a1130820a0d308208f5a00302010202120314c38ef6206d2a5d13b5 c8cb45752f9f (299) Message-Authenticator = 0x00000000000000000000000000000000 (299) State = 0xe37f3d5de27c24b242773e627ff3f802 (299) Finished request (240) Cleaning up request packet ID 111 with timestamp +10 (241) Cleaning up request packet ID 60 with timestamp +10 (300) Received Access-Request Id 62 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (300) User-Name = "kp@<domain-stripped>" (300) NAS-IP-Address = 10.2.254.253 (300) NAS-Port = 0 (300) NAS-Identifier = "10.2.254.253" (300) NAS-Port-Type = Wireless-802.11 (300) Calling-Station-Id = "843E1D87F5BF" (300) Called-Station-Id = "204C03033278" (300) Service-Type = Framed-User (300) Framed-MTU = 1100 (300) EAP-Message = 0x020300061900 (300) State = 0xe37f3d5de27c24b242773e627ff3f802 (300) Aruba-Essid-Name = "RatseNetL" (300) Aruba-Location-Id = "AP18" (300) Aruba-AP-Group = "OS-Trakt" (300) Message-Authenticator = 0x808be1cbe0d6892e798f1d3413c760b5 (300) session-state: No cached attributes (300) # Executing section authorize from file /etc/freeradius/sites-enabled/default (300) authorize { (300) [preprocess] = ok (300) ntdomain: Checking for prefix before "\" (300) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (300) ntdomain: No such realm "NULL" (300) [ntdomain] = noop (300) update control { (300) &Proxy-To-Realm := LOCAL (300) } # update control = noop (300) [chap] = noop (300) [mschap] = noop (300) [digest] = noop (300) eap: Peer sent EAP Response (code 2) ID 3 length 6 (300) eap: Continuing tunnel setup (300) [eap] = ok (300) } # authorize = ok (300) Found Auth-Type = eap (300) # Executing group from file /etc/freeradius/sites-enabled/default (300) authenticate { (300) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (300) eap: Finished EAP session with state 0xe37f3d5de27c24b2 (300) eap: Previous EAP request found for state 0xe37f3d5de27c24b2, released from the list (300) eap: Peer sent packet with method EAP PEAP (25) (300) eap: Calling submodule eap_peap to process data (300) eap_peap: Continuing EAP-TLS (300) eap_peap: Peer ACKed our handshake fragment (300) eap_peap: [eaptls verify] = request (300) eap_peap: [eaptls process] = handled (300) eap: Sending EAP Request (code 1) ID 4 length 1000 (300) eap: EAP session adding &reply:State = 0xe37f3d5de17b24b2 (300) [eap] = handled (300) } # authenticate = handled (300) Using Post-Auth-Type Challenge (300) Post-Auth-Type sub-section not found. Ignoring. (300) # Executing group from file /etc/freeradius/sites-enabled/default (300) Sent Access-Challenge Id 62 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (300) EAP-Message = 0x010403e8194069756d2d70652e6465821b686170726f78792e7261747367796d6e61736975 6d2d70652e64658218686f6d652e7261747367796d6e617369756d2d70652e64658218696d61 702e7261747367796d6e617369756d2d70652e6465821d696e666f62726574742e7261747367 796d6e617369 (300) Message-Authenticator = 0x00000000000000000000000000000000 (300) State = 0xe37f3d5de17b24b242773e627ff3f802 (300) Finished request (242) Cleaning up request packet ID 16 with timestamp +10 (301) Received Access-Request Id 64 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (301) User-Name = "kp@<domain-stripped>" (301) NAS-IP-Address = 10.2.254.253 (301) NAS-Port = 0 (301) NAS-Identifier = "10.2.254.253" (301) NAS-Port-Type = Wireless-802.11 (301) Calling-Station-Id = "843E1D87F5BF" (301) Called-Station-Id = "204C03033278" (301) Service-Type = Framed-User (301) Framed-MTU = 1100 (301) EAP-Message = 0x020400061900 (301) State = 0xe37f3d5de17b24b242773e627ff3f802 (301) Aruba-Essid-Name = "RatseNetL" (301) Aruba-Location-Id = "AP18" (301) Aruba-AP-Group = "OS-Trakt" (301) Message-Authenticator = 0x87340687e4ff778e7567a60a6fad3440 (301) session-state: No cached attributes (301) # Executing section authorize from file /etc/freeradius/sites-enabled/default (301) authorize { (301) [preprocess] = ok (301) ntdomain: Checking for prefix before "\" (301) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (301) ntdomain: No such realm "NULL" (301) [ntdomain] = noop (301) update control { (301) &Proxy-To-Realm := LOCAL (301) } # update control = noop (301) [chap] = noop (301) [mschap] = noop (301) [digest] = noop (301) eap: Peer sent EAP Response (code 2) ID 4 length 6 (301) eap: Continuing tunnel setup (301) [eap] = ok (301) } # authorize = ok (301) Found Auth-Type = eap (301) # Executing group from file /etc/freeradius/sites-enabled/default (301) authenticate { (301) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (301) eap: Finished EAP session with state 0xe37f3d5de17b24b2 (301) eap: Previous EAP request found for state 0xe37f3d5de17b24b2, released from the list (301) eap: Peer sent packet with method EAP PEAP (25) (301) eap: Calling submodule eap_peap to process data (301) eap_peap: Continuing EAP-TLS (301) eap_peap: Peer ACKed our handshake fragment (301) eap_peap: [eaptls verify] = request (301) eap_peap: [eaptls process] = handled (301) eap: Sending EAP Request (code 1) ID 5 length 1000 (301) eap: EAP session adding &reply:State = 0xe37f3d5de07a24b2 (301) [eap] = handled (301) } # authenticate = handled (301) Using Post-Auth-Type Challenge (301) Post-Auth-Type sub-section not found. Ignoring. (301) # Executing group from file /etc/freeradius/sites-enabled/default (301) Sent Access-Challenge Id 64 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (301) EAP-Message = 0x010503e81940796d6e617369756d2d70652e64658223776c616e2d636f6e74726f6c6c6572 2e7261747367796d6e617369756d2d70652e646582177777772e7261747367796d6e61736975 6d2d70652e6465821a7a61626269782e7261747367796d6e617369756d2d70652e6465301306 03551d20040c (301) Message-Authenticator = 0x00000000000000000000000000000000 (301) State = 0xe37f3d5de07a24b242773e627ff3f802 (301) Finished request (302) Received Access-Request Id 52 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (302) User-Name = "kp@<domain-stripped>" (302) NAS-IP-Address = 10.2.254.253 (302) NAS-Port = 0 (302) NAS-Identifier = "10.2.254.253" (302) NAS-Port-Type = Wireless-802.11 (302) Calling-Station-Id = "843E1D87F5BF" (302) Called-Station-Id = "204C03033278" (302) Service-Type = Framed-User (302) Framed-MTU = 1100 (302) EAP-Message = 0x020500061900 (302) State = 0xe37f3d5de07a24b242773e627ff3f802 (302) Aruba-Essid-Name = "RatseNetL" (302) Aruba-Location-Id = "AP18" (302) Aruba-AP-Group = "OS-Trakt" (302) Message-Authenticator = 0xa55c00579b9ed3c4554238f83309a7be (302) session-state: No cached attributes (302) # Executing section authorize from file /etc/freeradius/sites-enabled/default (302) authorize { (302) [preprocess] = ok (302) ntdomain: Checking for prefix before "\" (302) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (302) ntdomain: No such realm "NULL" (302) [ntdomain] = noop (302) update control { (302) &Proxy-To-Realm := LOCAL (302) } # update control = noop (302) [chap] = noop (302) [mschap] = noop (302) [digest] = noop (302) eap: Peer sent EAP Response (code 2) ID 5 length 6 (302) eap: Continuing tunnel setup (302) [eap] = ok (302) } # authorize = ok (302) Found Auth-Type = eap (302) # Executing group from file /etc/freeradius/sites-enabled/default (302) authenticate { (302) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (302) eap: Finished EAP session with state 0xe37f3d5de07a24b2 (302) eap: Previous EAP request found for state 0xe37f3d5de07a24b2, released from the list (302) eap: Peer sent packet with method EAP PEAP (25) (302) eap: Calling submodule eap_peap to process data (302) eap_peap: Continuing EAP-TLS (302) eap_peap: Peer ACKed our handshake fragment (302) eap_peap: [eaptls verify] = request (302) eap_peap: [eaptls process] = handled (302) eap: Sending EAP Request (code 1) ID 6 length 1000 (302) eap: EAP session adding &reply:State = 0xe37f3d5de77924b2 (302) [eap] = handled (302) } # authenticate = handled (302) Using Post-Auth-Type Challenge (302) Post-Auth-Type sub-section not found. Ignoring. (302) # Executing group from file /etc/freeradius/sites-enabled/default (302) Sent Access-Challenge Id 52 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (302) EAP-Message = 0x010603e819400b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34 c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f8 30175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60 677566b3f118 (302) Message-Authenticator = 0x00000000000000000000000000000000 (302) State = 0xe37f3d5de77924b242773e627ff3f802 (302) Finished request (243) Cleaning up request packet ID 156 with timestamp +10 Waking up in 0.9 seconds. (303) Received Access-Request Id 130 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (303) User-Name = "kp@<domain-stripped>" (303) NAS-IP-Address = 10.2.254.253 (303) NAS-Port = 0 (303) NAS-Identifier = "10.2.254.253" (303) NAS-Port-Type = Wireless-802.11 (303) Calling-Station-Id = "843E1D87F5BF" (303) Called-Station-Id = "204C03033278" (303) Service-Type = Framed-User (303) Framed-MTU = 1100 (303) EAP-Message = 0x020600061900 (303) State = 0xe37f3d5de77924b242773e627ff3f802 (303) Aruba-Essid-Name = "RatseNetL" (303) Aruba-Location-Id = "AP18" (303) Aruba-AP-Group = "OS-Trakt" (303) Message-Authenticator = 0x718692290105f2acae5e8598d3db3aad (303) session-state: No cached attributes (303) # Executing section authorize from file /etc/freeradius/sites-enabled/default (303) authorize { (303) [preprocess] = ok (303) ntdomain: Checking for prefix before "\" (303) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (303) ntdomain: No such realm "NULL" (303) [ntdomain] = noop (303) update control { (303) &Proxy-To-Realm := LOCAL (303) } # update control = noop (303) [chap] = noop (303) [mschap] = noop (303) [digest] = noop (303) eap: Peer sent EAP Response (code 2) ID 6 length 6 (303) eap: Continuing tunnel setup (303) [eap] = ok (303) } # authorize = ok (303) Found Auth-Type = eap (303) # Executing group from file /etc/freeradius/sites-enabled/default (303) authenticate { (303) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (303) eap: Finished EAP session with state 0xe37f3d5de77924b2 (303) eap: Previous EAP request found for state 0xe37f3d5de77924b2, released from the list (303) eap: Peer sent packet with method EAP PEAP (25) (303) eap: Calling submodule eap_peap to process data (303) eap_peap: Continuing EAP-TLS (303) eap_peap: Peer ACKed our handshake fragment (303) eap_peap: [eaptls verify] = request (303) eap_peap: [eaptls process] = handled (303) eap: Sending EAP Request (code 1) ID 7 length 1000 (303) eap: EAP session adding &reply:State = 0xe37f3d5de67824b2 (303) [eap] = handled (303) } # authenticate = handled (303) Using Post-Auth-Type Challenge (303) Post-Auth-Type sub-section not found. Ignoring. (303) # Executing group from file /etc/freeradius/sites-enabled/default (303) Sent Access-Challenge Id 130 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (303) EAP-Message = 0x010703e8194002010202104001772137d4e942b8ee76aa3c640ab7300d06092a864886f70d 01010b0500303f31243022060355040a131b4469676974616c205369676e6174757265205472 75737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3231 303132303139 (303) Message-Authenticator = 0x00000000000000000000000000000000 (303) State = 0xe37f3d5de67824b242773e627ff3f802 (303) Finished request Waking up in 0.8 seconds. (304) Received Access-Request Id 7 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (304) User-Name = "kp@<domain-stripped>" (304) NAS-IP-Address = 10.2.254.253 (304) NAS-Port = 0 (304) NAS-Identifier = "10.2.254.253" (304) NAS-Port-Type = Wireless-802.11 (304) Calling-Station-Id = "843E1D87F5BF" (304) Called-Station-Id = "204C03033278" (304) Service-Type = Framed-User (304) Framed-MTU = 1100 (304) EAP-Message = 0x020700061900 (304) State = 0xe37f3d5de67824b242773e627ff3f802 (304) Aruba-Essid-Name = "RatseNetL" (304) Aruba-Location-Id = "AP18" (304) Aruba-AP-Group = "OS-Trakt" (304) Message-Authenticator = 0x2c0fc1bf87744bffe4e874075c9484f0 (304) session-state: No cached attributes (304) # Executing section authorize from file /etc/freeradius/sites-enabled/default (304) authorize { (304) [preprocess] = ok (304) ntdomain: Checking for prefix before "\" (304) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (304) ntdomain: No such realm "NULL" (304) [ntdomain] = noop (304) update control { (304) &Proxy-To-Realm := LOCAL (304) } # update control = noop (304) [chap] = noop (304) [mschap] = noop (304) [digest] = noop (304) eap: Peer sent EAP Response (code 2) ID 7 length 6 (304) eap: Continuing tunnel setup (304) [eap] = ok (304) } # authorize = ok (304) Found Auth-Type = eap (304) # Executing group from file /etc/freeradius/sites-enabled/default (304) authenticate { (304) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (304) eap: Finished EAP session with state 0xe37f3d5de67824b2 (304) eap: Previous EAP request found for state 0xe37f3d5de67824b2, released from the list (304) eap: Peer sent packet with method EAP PEAP (25) (304) eap: Calling submodule eap_peap to process data (304) eap_peap: Continuing EAP-TLS (304) eap_peap: Peer ACKed our handshake fragment (304) eap_peap: [eaptls verify] = request (304) eap_peap: [eaptls process] = handled (304) eap: Sending EAP Request (code 1) ID 8 length 729 (304) eap: EAP session adding &reply:State = 0xe37f3d5de57724b2 (304) [eap] = handled (304) } # authenticate = handled (304) Using Post-Auth-Type Challenge (304) Post-Auth-Type sub-section not found. Ignoring. (304) # Executing group from file /etc/freeradius/sites-enabled/default (304) Sent Access-Challenge Id 7 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (304) EAP-Message = 0x010802d919007970742e6f7267303c0603551d1f043530333031a02fa02d862b687474703a 2f2f63726c2e6964656e74727573742e636f6d2f445354524f4f544341583343524c2e63726c 301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a8648 86f70d01010b (304) Message-Authenticator = 0x00000000000000000000000000000000 (304) State = 0xe37f3d5de57724b242773e627ff3f802 (304) Finished request Waking up in 0.8 seconds. (305) Received Access-Request Id 157 from 10.2.254.253:60831 to 10.0.0.248:1812 length 216 (305) User-Name = "kp@<domain-stripped>" (305) NAS-IP-Address = 10.2.254.253 (305) NAS-Port = 0 (305) NAS-Identifier = "10.2.254.253" (305) NAS-Port-Type = Wireless-802.11 (305) Calling-Station-Id = "843E1D87F5BF" (305) Called-Station-Id = "204C03033278" (305) Service-Type = Framed-User (305) Framed-MTU = 1100 (305) EAP-Message = 0x020800111980000000071503030002022d (305) State = 0xe37f3d5de57724b242773e627ff3f802 (305) Aruba-Essid-Name = "RatseNetL" (305) Aruba-Location-Id = "AP18" (305) Aruba-AP-Group = "OS-Trakt" (305) Message-Authenticator = 0x2db17bbdf81f36dcb1577a0066f224d2 (305) session-state: No cached attributes (305) # Executing section authorize from file /etc/freeradius/sites-enabled/default (305) authorize { (305) [preprocess] = ok (305) ntdomain: Checking for prefix before "\" (305) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (305) ntdomain: No such realm "NULL" (305) [ntdomain] = noop (305) update control { (305) &Proxy-To-Realm := LOCAL (305) } # update control = noop (305) [chap] = noop (305) [mschap] = noop (305) [digest] = noop (305) eap: Peer sent EAP Response (code 2) ID 8 length 17 (305) eap: Continuing tunnel setup (305) [eap] = ok (305) } # authorize = ok (305) Found Auth-Type = eap (305) # Executing group from file /etc/freeradius/sites-enabled/default (305) authenticate { (305) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (305) eap: Finished EAP session with state 0xe37f3d5de57724b2 (305) eap: Previous EAP request found for state 0xe37f3d5de57724b2, released from the list (305) eap: Peer sent packet with method EAP PEAP (25) (305) eap: Calling submodule eap_peap to process data (305) eap_peap: Continuing EAP-TLS (305) eap_peap: Peer indicated complete TLS record size will be 7 bytes (305) eap_peap: Got complete TLS record (7 bytes) (305) eap_peap: [eaptls verify] = length included (305) eap_peap: <<< recv TLS 1.2 [length 0002] (305) eap_peap: ERROR: TLS Alert read:fatal:certificate expired (305) eap_peap: ERROR: TLS_accept: Failed in error (305) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) (305) eap_peap: ERROR: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired (305) eap_peap: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure (305) eap_peap: ERROR: System call (I/O) error (-1) (305) eap_peap: ERROR: TLS receive handshake failed during operation (305) eap_peap: ERROR: [eaptls process] = fail (305) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (305) eap: Sending EAP Failure (code 4) ID 8 length 4 (305) eap: Failed in EAP select (305) [eap] = invalid (305) } # authenticate = invalid (305) Failed to authenticate the user (305) Using Post-Auth-Type Reject (305) Post-Auth-Type sub-section not found. Ignoring. (305) # Executing group from file /etc/freeradius/sites-enabled/default (305) Login incorrect (eap_peap: TLS Alert read:fatal:certificate expired): [kp@<domain-stripped>/<via Auth-Type = eap>] (from client wlan_controller port 0 cli 843E1D87F5BF) (305) Delaying response for 1.000000 seconds ```

2 1

Problem with datetime and mysql
by ANGEL LUIS MATEO MARTINEZ 19 Sep '23

19 Sep '23

Hello, I have a running freeradius with Ubuntu 18.04 and freeradius 3.0.19. In this system I'm using mysql to store accounting records in a MySQL database (radacct). To achieve this, I'm using the buffered-sql site. This is working fine. Now I'm developing a new updated system with Ubuntu 22.04 and freeradius 3.0.26. I'm trying to configure this same MySQL database. I'm using the same database. Although the store in the database is working, I have a problem with datetime stored in acctstarttime, aactupdatetime and acctstoptime columns. The problem is that the datetime stored is 1 hour ahead of my current time. I have both SO configured with the same timezone. In my case, it's Europe/Madrid (CEST, GMT+2 now). I have also the same queries.conf file in both systems. I'm using the queries.conf distributed with the freeradius 3.0.26 22.04 package. In this file: ... event_timestamp_epoch = "%{%{integer:Event-Timestamp}:-%l}" # event_timestamp is the SQL snippet for converting an epoch timestamp # to an SQL date. event_timestamp = "FROM_UNIXTIME(${event_timestamp_epoch})" ... start { # # Insert a new record into the sessions table # query = "\ INSERT INTO ${....acct_table1} \ (${...column_list}) \ VALUES \ ('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', \ '%{NAS-IP-Address}', \ '%{%{NAS-Port-ID}:-%{NAS-Port}}', \ '%{NAS-Port-Type}', \ ${....event_timestamp}, \ ${....event_timestamp}, \ NULL, \ '0', \ '%{Acct-Authentic}', \ '%{Connect-Info}', \ '', \ '0', \ '0', \ '%{Called-Station-Id}', \ '%{Calling-Station-Id}', \ '', \ '%{Service-Type}', \ '%{Framed-Protocol}', \ '%{Framed-IP-Address}', \ '%{Framed-IPv6-Address}', \ '%{Framed-IPv6-Prefix}', \ '%{Framed-Interface-Id}', \ '%{Delegated-IPv6-Prefix}' \ ${....class.packet_xlat})" ... With this configuration, I have this Start record in my old system: Fri Sep 15 09:33:10 2023 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 15728730 NAS-Port-Type = Virtual User-Name = "XXXXX(a)um.es" Calling-Station-Id = "155.54.67.5" Called-Station-Id = "155.54.213.7" MS-CHAP-Domain = "um.es" Acct-Session-Id = "81a00056" Framed-IP-Address = 155.54.192.37 Acct-Authentic = RADIUS Event-Timestamp = "Sep 15 2023 09:33:10 CEST" Acct-Status-Type = Start NAS-Identifier = "MikroTik-Pruebas" Acct-Delay-Time = 0 Mikrotik-Realm = "um.es" NAS-IP-Address = 155.54.213.7 Huntgroup-Name = "vpn" X-Atica-Service = "vpn" X-Atica-Service-Filter = "vpn" Stripped-User-Name = "XXXXX" Realm = "um.es" Timestamp = 1694763190 and the corresponding insert query in the database is: use dbradiuslog; SET timestamp=1694763191; INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('81a00056', 'eb9b9fe238b5a46ac0e6be64acd6ec58', 'XXXXX(a)um.es', 'um.es', '155.54.213.7', '15728730', 'Virtual', FROM_UNIXTIME(1694763190), FROM_UNIXTIME(1694763190), NULL, '0', 'RADIUS', '', '', '0', '0', '155.54.213.7', '155.54.67.5', '', 'Framed-User', 'PPP', '155.54.192.37', '', '', '', '' ); where the 1694763191 timestamp is "Fri Sep 15 2023 09:33:11 GMT+0200" and 1694763190 is "Fri Sep 15 2023 09:33:10 GMT+0200" and datetimes are correct. But in the updated system I have this detail entry: Fri Sep 15 09:35:47 2023 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 15728731 NAS-Port-Type = Virtual User-Name = "XXXXX(a)um.es" Calling-Station-Id = "155.54.67.5" Called-Station-Id = "155.54.213.7" MS-CHAP-Domain = "um.es" Acct-Session-Id = "81a00057" Framed-IP-Address = 155.54.194.50 Acct-Authentic = RADIUS Event-Timestamp = "Sep 15 2023 09:35:47 CEST" Acct-Status-Type = Start NAS-Identifier = "MikroTik-Pruebas" Acct-Delay-Time = 0 Mikrotik-Realm = "um.es" NAS-IP-Address = 155.54.213.7 Huntgroup-Name = "vpn" X-Atica-Service = "vpn" X-Atica-Service-Filter = "vpn" Stripped-User-Name = "XXXXX" Realm = "um.es" Timestamp = 1694763347 and the insert query is: use dbradiuslog; SET timestamp=1694763348; INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('81a00057', '186c6d4ebe375d3178097fe46f3bdaae', 'XXXXX(a)um.es', 'um.es', '155.54.213.7', '15728731', 'Virtual', FROM_UNIXTIME(1694766947), FROM_UNIXTIME(1694766947), NULL, '0', 'RADIUS', '', '', '0', '0', '155.54.213.7', '155.54.67.5', '', 'Framed-User', 'PPP', '155.54.194.50', '', '', '', '' ); in this case, the first 1694763348 datetime (the used in SET) corresponds to "Fri Sep 15 2023 09:35:48 GMT+0200" (it's fine), but the 1694766947 used in FROM_UNIX(1694766947) corresponds to "Fri Sep 15 2023 10:35:47 GMT+0200" which is wrong. The date stored in the database is wrong too. It seems that there is a problem somewhere in the transformation from the Event-Timestamp entry in the detail to the epoch used in the SQL query. Any help with this? Thank you.

2 4

MySQL Client Issue
by Selahattin CILEK 18 Sep '23

18 Sep '23

I have been installing FreeRADIUS 3 on pfSense for about out 5 years and it always came bundled with some version of *mysql57-client* (this or that minor version) and it always worked well with *mysql57-server* (again, this or that minor version), which FreeRADIUS connected to. To give you a context, the last time I installed was about a month ago and the versions were as follows: pfSense -> 2.6.0 (FreeBSD 1.3-STABLE) FreeRADIUS -> 3.0.25 MySQL Client -> 5.736 But the guys at pfSense decided to skip version 13 of FreeBSD and build version 2.7.0 on FreeBSDversion 14. The 2.7.0 version of pfSense comes with *freeradius3-3.2.2* and *mysql80-client-8.0.32_2* . Of course, I could just install *mysql80-client-8.0.32_2* and modify my SQL code a little bit and it would still work. But the problem is that I have Syslog-NG installed on the system and it too connects to the same MySQL instance and though it has been upgraded to version 4.20, it still uses the old *mysql57-client. * So is there a way to get FreeRADIUS 3.2.2 to work with the old MySQL client, you know, using the good old "libdbi" driver? * * -- This email has been checked for viruses by Avast antivirus software. www.avast.com

4 12

When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work
by 平林哲 15 Sep '23

15 Sep '23

Hi! When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work. Register a user in ActiveDirectory with the password "pass\"word@2022", the following LDAP settings. === # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\"word@2022" base_dn = 'dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' === When attempting to start the RADIUS service in this state, a syntax error occurred. ===== # /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 /usr/local/etc/raddb/mods-enabled/ldap1[4]: Syntax error: Expected comma after 'pass\\': word@2022" Errors reading or parsing /usr/local/etc/raddb/radiusd.conf ===== We also tried several patterns and summarised the results. Password | Configration | Result -------------------|-----------------------|------- pass"word@2022 | "pass\"word@2022" | OK pass\"word@2022 | "pass\\"word@2022" | Syntax error pass\\"word@2022 | "pass\\\"word@2022" | OK pass\\\"word@2022 | "pass\\\\"word@2022" | Syntax error As mentioned above, a Syntax Error occurs when '\' is an even number in the configuration. After investigating the cause of this, it appears that there is a problem with the determination of '˶' in the following section. === /* * Convert backslash-quote to quote, but * leave everything else alone. */ if (p[1] == quote) { /* convert '\'' --> ' */ p++; } else { if (buflen < 2) { fr_strerror_printf("Truncated input"); return T_INVALID; } *(s++) = *(p++); } *(s++) = *(p++); } === This problem was solved by changing the above section as follows. === } else { /* * Convert backslash-quote to quote, but * leave everything else alone. */ if (p[1] == quote) { /* convert '\'' --> ' */ if (p[2] != '\0') { p++; } } *(s++) = *(p++); } === Is this the right approach? Any advice would be appreciated.

4 24

Windows and TLS 1.0 / TLS 1.1
by Alan DeKok 11 Sep '23

11 Sep '23

Microsoft is disabled TLS 1.0 and TLS 1.1 in newer versions of Windows. This shouldn't affect most people. However, if you're running a very old RADIUS server (e.g. 5+ years), then it's time to upgrade. Your users will not be able to get online. https://www.theregister.com/2023/09/04/tls_windows_deprecation/ Alan DeKok.

2 2

How to cleanly shut down a PEAP TLS tunnel
by Joe Garcia 11 Sep '23

11 Sep '23

I've got a client that tries to shut down the TLS tunnel used for PEAP after running through the full authentication process and getting the Access-Accept/Success at the end. However the Access-Accept/Success comes in without a State attribute, and if the TLS Close-Alert (appropriately wrapped in several layers of outer protocols) is sent that way then FreeRADIUS reports: (18) eap: ERROR: EAP requires the State attribute to work, but no State exists in the Access-Request packet. (18) eap: ERROR: The RADIUS client is broken. No amount of changing FreeRADIUS will fix the RADIUS client. (18) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request If OTOH I use the State value from the last message preceding the Access-Accept/Success I get: (37) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x57f74ed950ff57da (37) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request What's the correct way to perform a clean shutdown of the TLS tunnel after completing the PEAP authentication process? Or do you just leave it hanging? Although no two diagrams seem to be able to agree on what happens at this point, one example is this: https://mrncciew.files.wordpress.com/2014/08/eap-peap-20.png which tears down the tunnel at step 15 and then the client gets the Access-Accept/Success at step 16/17, while with FreeRADIUS I'm getting the Access-Accept/Success before the TLS tunnel is torn down and then one of the two errors above with an attempt to tear down the tunnel. JG.

2 2

Is Radius Authorization bound to Radius Authentication?
by little-nemo＠virgilio.it 08 Sep '23

08 Sep '23

Dear members, I managed to autenticate users through MschapV2/ntlm_auth vs Active Directory (reference#1 https://networkradius.com/articles/2021/02/04/active-directory-with-FreeRAD…, reference#2 https://networkradius.com/articles/2021/09/29/configure-authentication-with…) Freeradius version: 3.0.21. Then I read "Authentication systems and protocol compatibility https://networkradius.com/articles/2021/10/08/authentication-system-and-pro…" and "Authenticating Users with LDAP https://freeradius.org/documentation/freeradius-server/3.2.4/concepts/modul…", so now I wonder whether I could also use LDAP(S) for the Authorization phase-only. The doubt comes from the presence of the "identity" in mods-available/ldap. Is that Identity used for the binding to AD? I guess so. Thus, username/password of the user trying to authenticate are not involved in the LDAP binding. Am I wrong? Is it worth to spend additional time to study how to setup LDAP Authorization? The primary goal is to read group membership but in future other needs may arise. Thanks in advance for your time. Pietro

2 1

freeradius windows machine authentication
by Härtl, Calvin 04 Sep '23

04 Sep '23

Hi all, first of all thanks for your great help in my past questions! Sadly, I have yet another one, that I can not quite figure out. Maybe I missed something, I don’t know. I tried looking for past list-threads, to no avail. When my Windows client connects to the WiFi and subsequently to the FreeRADIUS server, it first authenticates via machine authentication (host/HOSTNAME.MYDOMAIN.COM) This fails and the client cannot connect to the WiFi: (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) eap_mschapv2: authenticate { (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: Client is using MS-CHAPv2 (6) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (6) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (6) mschap: --> --username=host/HOSTNAME.DOMAIN.COM (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (6) mschap: --> --challenge=ef98e59da6aea4aa (6) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (6) mschap: --> --nt-response=1e7106295666480efb781446f97f618e57e09017da042590 (6) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (6) mschap: External script failed (6) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) eap_mschapv2: [mschap] = reject (6) eap_mschapv2: } # authenticate = reject However, if I manually configure the WiFi on my Windows device to only use user authentication, it works flawlessly (as expected): (14) eap_mschapv2: authenticate { (14) mschap: Creating challenge hash with username: calvin.haertl (14) mschap: Client is using MS-CHAPv2 (14) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (14) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (14) mschap: --> --username=MYUSERNAME (14) mschap: Creating challenge hash with username: MYUSERNAME (14) mschap: Program returned code (0) (14) mschap: Adding MS-CHAPv2 MPPE keys (14) eap_mschapv2: [mschap] = ok (14) eap_mschapv2: } # authenticate = ok (14) eap_mschapv2: MSCHAP Success (14) eap: Sending EAP Request (code 1) ID 9 length 51 My FreeRADIUS server is connected to our Active Directory via SAMBA and winbind, and I checked that the users can authenticate via radtest. Is FreeRADIUS natively capable of doing machine authentication via AD, do I have to configure some additional files or are there any modules that I can install to do this for me? Kind regards, Calvin

4 5

Observing a common error in Freeradius with Postgres but not justification why it happens
by Ibrahim Al Mahfooz 02 Sep '23

02 Sep '23

Hello all, We have implemented freeradius 3.2.3 with Postgresql 12.15 to store accounting packets i.e start, interim-update, stop for reporting purposes. We customized the queries files to store fewer columns than the original schema since this is what we need. The following columns are customized in the accounting queries and same columns in postgres radacct table: radacctid, acctsessionid, acctuniqueid, acctstarttime, acctudpatetime, acctstoptime, callingstationid, framedipaddress, imei, 3gpplocation. Also the following indexes are in radacct table: 1. radacct_active_session_idx (this is the original from FR schema of postgresql) 2. framedipaddress, starttime, stoptime, updatetime (This one we added to use upon need in our read queries on report generation) Currently, from postgres dashboard we observe around 300-400 write/update transactions. The issue we noticed a couple of days ago is there were a lot of messages in radius log stating "Error: xxx requests have been waiting in the processing queue for x seconds. Check that all databases are running properly!" And sometimes we see another warning stating "Warning: Please check the configuration file. The value for 'max_requests' is probably set too low. " Based on the above observed messages, we tuned two matters: 1. the postgresql db by changing the default shared_buffer from 128MB to 8GB since we have plenty of RAM in the server, and this clearly reflected in the performance and removed around 98% of the above error messages. However we sometimes see the same error message showing up in peak hours and KPI of radius is impacted per the NAS report. After tuning the Postgres, we used pgbench and the following is what we get: [postgres@postgresql-syslog01 ~]$ pgbench -c 10 -j 2 -t 1000 my_benchmark_test_db starting vacuum...end. transaction type: <builtin: TPC-B (sort of)> scaling factor: 1 query mode: simple number of clients: 10 number of threads: 2 number of transactions per client: 1000 number of transactions actually processed: 10000/10000 latency average = 10.931 ms tps = 914.869517 (including connections establishing) tps = 915.175572 (excluding connections establishing) 2. In radiusd.conf we have the following, and we tuned max request to 32000, start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_request_time = 30 max_requests = 32000 Radius server specs: We have 4 sockets 1.87Ghz and RAM 8GB In Linux top command, load average is almost always : 0.17, 0.14, 0.13 Postgres server specs: 8 sockets 2.5Ghz and RAM 16GB In Linux top command, load average is around most of the time : 0.59, 0.50, 0.45 The questions to summarize are : 1. Is ~900 TPS and 10ms acceptable DB performance for accounting? 2. In the max_requests setting, what does the clients mean here, does it mean NAS client or SQL connections based on max requests? how to size it? 3. What could be the culprit given the fact all the servers are relaxed? Really appreciate your guidance here Best,

3 10