September 2023 - Freeradius-Users - lists.freeradius.org

How to cleanly shut down a PEAP TLS tunnel
by Joe Garcia 11 Sep '23

11 Sep '23

I've got a client that tries to shut down the TLS tunnel used for PEAP after running through the full authentication process and getting the Access-Accept/Success at the end. However the Access-Accept/Success comes in without a State attribute, and if the TLS Close-Alert (appropriately wrapped in several layers of outer protocols) is sent that way then FreeRADIUS reports: (18) eap: ERROR: EAP requires the State attribute to work, but no State exists in the Access-Request packet. (18) eap: ERROR: The RADIUS client is broken. No amount of changing FreeRADIUS will fix the RADIUS client. (18) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request If OTOH I use the State value from the last message preceding the Access-Accept/Success I get: (37) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x57f74ed950ff57da (37) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request What's the correct way to perform a clean shutdown of the TLS tunnel after completing the PEAP authentication process? Or do you just leave it hanging? Although no two diagrams seem to be able to agree on what happens at this point, one example is this: https://mrncciew.files.wordpress.com/2014/08/eap-peap-20.png which tears down the tunnel at step 15 and then the client gets the Access-Accept/Success at step 16/17, while with FreeRADIUS I'm getting the Access-Accept/Success before the TLS tunnel is torn down and then one of the two errors above with an attempt to tear down the tunnel. JG.

2 2

Is Radius Authorization bound to Radius Authentication?
by little-nemo＠virgilio.it 08 Sep '23

08 Sep '23

Dear members, I managed to autenticate users through MschapV2/ntlm_auth vs Active Directory (reference#1 https://networkradius.com/articles/2021/02/04/active-directory-with-FreeRAD…, reference#2 https://networkradius.com/articles/2021/09/29/configure-authentication-with…) Freeradius version: 3.0.21. Then I read "Authentication systems and protocol compatibility https://networkradius.com/articles/2021/10/08/authentication-system-and-pro…" and "Authenticating Users with LDAP https://freeradius.org/documentation/freeradius-server/3.2.4/concepts/modul…", so now I wonder whether I could also use LDAP(S) for the Authorization phase-only. The doubt comes from the presence of the "identity" in mods-available/ldap. Is that Identity used for the binding to AD? I guess so. Thus, username/password of the user trying to authenticate are not involved in the LDAP binding. Am I wrong? Is it worth to spend additional time to study how to setup LDAP Authorization? The primary goal is to read group membership but in future other needs may arise. Thanks in advance for your time. Pietro

2 1

freeradius windows machine authentication
by Härtl, Calvin 04 Sep '23

04 Sep '23

Hi all, first of all thanks for your great help in my past questions! Sadly, I have yet another one, that I can not quite figure out. Maybe I missed something, I don’t know. I tried looking for past list-threads, to no avail. When my Windows client connects to the WiFi and subsequently to the FreeRADIUS server, it first authenticates via machine authentication (host/HOSTNAME.MYDOMAIN.COM) This fails and the client cannot connect to the WiFi: (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) eap_mschapv2: authenticate { (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: Client is using MS-CHAPv2 (6) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (6) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (6) mschap: --> --username=host/HOSTNAME.DOMAIN.COM (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (6) mschap: --> --challenge=ef98e59da6aea4aa (6) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (6) mschap: --> --nt-response=1e7106295666480efb781446f97f618e57e09017da042590 (6) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (6) mschap: External script failed (6) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) eap_mschapv2: [mschap] = reject (6) eap_mschapv2: } # authenticate = reject However, if I manually configure the WiFi on my Windows device to only use user authentication, it works flawlessly (as expected): (14) eap_mschapv2: authenticate { (14) mschap: Creating challenge hash with username: calvin.haertl (14) mschap: Client is using MS-CHAPv2 (14) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (14) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (14) mschap: --> --username=MYUSERNAME (14) mschap: Creating challenge hash with username: MYUSERNAME (14) mschap: Program returned code (0) (14) mschap: Adding MS-CHAPv2 MPPE keys (14) eap_mschapv2: [mschap] = ok (14) eap_mschapv2: } # authenticate = ok (14) eap_mschapv2: MSCHAP Success (14) eap: Sending EAP Request (code 1) ID 9 length 51 My FreeRADIUS server is connected to our Active Directory via SAMBA and winbind, and I checked that the users can authenticate via radtest. Is FreeRADIUS natively capable of doing machine authentication via AD, do I have to configure some additional files or are there any modules that I can install to do this for me? Kind regards, Calvin

4 5

Observing a common error in Freeradius with Postgres but not justification why it happens
by Ibrahim Al Mahfooz 02 Sep '23

02 Sep '23

Hello all, We have implemented freeradius 3.2.3 with Postgresql 12.15 to store accounting packets i.e start, interim-update, stop for reporting purposes. We customized the queries files to store fewer columns than the original schema since this is what we need. The following columns are customized in the accounting queries and same columns in postgres radacct table: radacctid, acctsessionid, acctuniqueid, acctstarttime, acctudpatetime, acctstoptime, callingstationid, framedipaddress, imei, 3gpplocation. Also the following indexes are in radacct table: 1. radacct_active_session_idx (this is the original from FR schema of postgresql) 2. framedipaddress, starttime, stoptime, updatetime (This one we added to use upon need in our read queries on report generation) Currently, from postgres dashboard we observe around 300-400 write/update transactions. The issue we noticed a couple of days ago is there were a lot of messages in radius log stating "Error: xxx requests have been waiting in the processing queue for x seconds. Check that all databases are running properly!" And sometimes we see another warning stating "Warning: Please check the configuration file. The value for 'max_requests' is probably set too low. " Based on the above observed messages, we tuned two matters: 1. the postgresql db by changing the default shared_buffer from 128MB to 8GB since we have plenty of RAM in the server, and this clearly reflected in the performance and removed around 98% of the above error messages. However we sometimes see the same error message showing up in peak hours and KPI of radius is impacted per the NAS report. After tuning the Postgres, we used pgbench and the following is what we get: [postgres@postgresql-syslog01 ~]$ pgbench -c 10 -j 2 -t 1000 my_benchmark_test_db starting vacuum...end. transaction type: <builtin: TPC-B (sort of)> scaling factor: 1 query mode: simple number of clients: 10 number of threads: 2 number of transactions per client: 1000 number of transactions actually processed: 10000/10000 latency average = 10.931 ms tps = 914.869517 (including connections establishing) tps = 915.175572 (excluding connections establishing) 2. In radiusd.conf we have the following, and we tuned max request to 32000, start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_request_time = 30 max_requests = 32000 Radius server specs: We have 4 sockets 1.87Ghz and RAM 8GB In Linux top command, load average is almost always : 0.17, 0.14, 0.13 Postgres server specs: 8 sockets 2.5Ghz and RAM 16GB In Linux top command, load average is around most of the time : 0.59, 0.50, 0.45 The questions to summarize are : 1. Is ~900 TPS and 10ms acceptable DB performance for accounting? 2. In the max_requests setting, what does the clients mean here, does it mean NAS client or SQL connections based on max requests? how to size it? 3. What could be the culprit given the fact all the servers are relaxed? Really appreciate your guidance here Best,

3 10