November 2024 - Freeradius-Users - lists.freeradius.org

FreeRADIUS 4: DHCP v4: ERROR: Expansion "network" needs to be resolved before it is used
by Dima Ermakov 11 Nov '24

11 Nov '24

Hi, I am trying to test FreeRADIUS 4 on RockyLinux 9.4 built from commit c01f1dbb733966ac51f7d2bacb6343fc04450024 I know that this software is not supposed to be used in production (and I don't do it, it is testing only for now). I tried to configure a simple DHCPv4 service which uses the "files" module to assign per-network properties. The processing fails with expansion of "key" in files: """ files files_dhcp_network { # # moddir:: Search for files in a subdirectory of mods-config which # matches this instance of the files module. # moddir = ${modconfdir}/files_dhcp # # key:: The default key attribute to use for matches. # # The content of this attribute is used to match the `name` of the entry. # key = 'network' # # filename:: The old `users` style file is now located here. # filename = ${moddir}/dhcp_config } """ with error: files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used. Here is a part of my ${moddir}/dhcp_config (inspired by https://www.freeradius.org/documentation/freeradius-server/3.2.7/howto/prot… ): """ network IP-Pool.Name := "local" Domain-Name := "example.org", Subnet-Mask := 255.255.255.0, Router-Address := 172.16.1.1, Domain-Name-Server := 192.168.20.2, Fall-Through := yes network Network-Subnet < 172.25.1.0/24 IP-Pool.Name := "pool-172.25.1.0/24", Subnet-Mask := 255.255.255.0, Broadcast-Address := 172.25.1.255 """ Could you, please, if possible point me to what should be corrected? Here is the debug output of a test request: [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -v Info : radiusd - FreeRADIUS version 4.0.65535 (git #), for host x86_64-redhat-linux-gnu, built on Sep 25 2013 at 00:00:00 Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -X Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf Including files in directory "/etc/raddb/template.d/" including configuration file /etc/raddb/template.d/default including configuration file /etc/raddb/clients.conf Including files in directory "/etc/raddb/global.d/" including configuration file /etc/raddb/global.d/ldap including configuration file /etc/raddb/global.d/python Including files in directory "/etc/raddb/mods-enabled/" including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/files_dhcp Including files in directory "/etc/raddb/policy.d/" including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalisation including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/time including configuration file /etc/raddb/policy.d/vendor /etc/raddb/policy.d/vendor[8]: Using deprecated syntax. Please use new the new 'foreach' syntax. Including files in directory "/etc/raddb/sites-enabled/" including configuration file /etc/raddb/sites-enabled/dhcp Loaded module process_dhcpv4 Parsing initial logging configuration. main { prefix = /usr log { destination = file syslog_facility = daemon local_state_dir = "/usr/var" logdir = "/usr/var/log" file = /var/log/radius/radius.log suppress_secrets = no } } Parsing security rules to bootstrap UID / GID / chroot / etc. main { log { } security { allow_core_dumps = no allow_vulnerable_openssl = no openssl_fips_mode = no } name = radiusd local_state_dir = "/usr/var" run_dir = /var/run/radiusd } Parsing main configuration main { server dhcp { namespace = dhcpv4 Loaded module proto_dhcpv4 listen { type = Discover type = Request type = Inform type = Release type = Decline transport = udp Loaded module proto_dhcpv4_udp udp { ipaddr = 0.0.0.0 interface = ens224 port = 67 client_port = 68 broadcast = yes networks { } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 priority { Discover = normal Request = normal Decline = normal Release = normal Inform = normal Lease-Query = low Bulk-Lease-Query = low } } } } log { colourise = yes } security { } sbin_dir = "/usr/sbin" logdir = /var/log/radius radacctdir = /var/log/radius/radacct reverse_lookups = no hostname_lookups = yes max_request_time = 30 pidfile = /var/run/radiusd/radiusd.pid debug_level = 0 max_requests = 16384 resources { } thread pool { num_networks = 1 Dynamically determined thread.workers = 2 num_workers = 2 openssl_async_pool_init = 64 openssl_async_pool_max = 1024 } migrate { rewrite_update = false forbid_update = false } } Switching to configured log settings log debug { destination = null timestamp = yes colourise = no } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> require_message_authenticator = auto limit_proxy_state = auto proto = * limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> require_message_authenticator = no limit_proxy_state = auto limit { max_connections = 16 lifetime = 0 idle_timeout = 30s } } Debugger not attached Configuration version: A2E989E4-D5C6-4963-A1D1-083575FFAC4D systemd watchdog is disabled pre-suid-down capabilities: =ep trigger { ... } subsection not found, triggers will be disabled #### Instantiating libraries #### #### Bootstrapping process modules #### #### Bootstrapping protocol modules #### #### Instantiating libraries #### #### Bootstrapping static modules #### modules { static { Loaded module rlm_always always reject { rcode = reject } always fail { rcode = fail } always ok { rcode = ok } always handled { rcode = handled } always invalid { rcode = invalid } always disallow { rcode = disallow } always notfound { rcode = notfound } always noop { rcode = noop } always updated { rcode = updated } Loaded module rlm_files files files_dhcp_network { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } files files_dhcp_host { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } } # static #### Bootstrapping rlm modules #### Bootstrapping rlm_always "disallow" Bootstrapping rlm_always "fail" Bootstrapping rlm_always "handled" Bootstrapping rlm_always "invalid" Bootstrapping rlm_always "noop" Bootstrapping rlm_always "notfound" Bootstrapping rlm_always "ok" Bootstrapping rlm_always "reject" Bootstrapping rlm_always "updated" Including dictionary file "/etc/raddb/dictionary" #### Instantiating listeners #### Compiling policies in server dhcp { ... } Compiling policies in - recv Discover {...} Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Compiling policies in - recv Request {...} Compiling policies in - recv Decline {...} Compiling policies in - recv Release {...} Compiling policies in - recv Inform {...} Compiling policies in - recv Lease-Query {...} /etc/raddb/sites-enabled/dhcp[307]: Skipping remaining instructions due to 'return' /etc/raddb/sites-enabled/dhcp[319]: Skipping remaining instructions due to 'return' dhcpv4 { ... } section is unused #### Instantiating process modules #### #### Instantiating protocol modules #### Instantiating proto_dhcpv4 "dhcp.dhcpv4" Instantiating proto_dhcpv4_udp "dhcp.dhcpv4.udp" #### Instantiating rlm modules #### Instantiating rlm_always "disallow" Instantiating rlm_always "fail" Instantiating rlm_always "handled" Instantiating rlm_always "invalid" Instantiating rlm_always "noop" Instantiating rlm_always "notfound" Instantiating rlm_always "ok" Instantiating rlm_always "reject" Instantiating rlm_always "updated" Scheduler created in single-threaded mode #### Opening listener interfaces #### Listening on dhcpv4_udp server * port 67 on interface ens224 bound to virtual server dhcp post-suid-down capabilities: =ep Ready to process requests proto_dhcpv4_udp - Received Discover XID f252956f length 300 dhcpv4_udp server * port 67 on interface ens224 Worker - Resetting cleanup timer to +30 (0) dhcp { (0) Received Discover XID f252956f from 0.0.0.0:68 to 255.255.255.255:67 via ens224 (0) Opcode = Client-Message (0) Hardware-Type = Ethernet (0) Hardware-Address-Length = 6 (0) Hop-Count = 0 (0) Transaction-Id = 4065498479 (0) Number-of-Seconds = 0 (0) Flags = 0 (0) Client-IP-Address = 0.0.0.0 (0) Your-IP-Address = 0.0.0.0 (0) Server-IP-Address = 0.0.0.0 (0) Gateway-IP-Address = 0.0.0.0 (0) Client-Hardware-Address = 02:01:aa:bb:cc:dd (0) Message-Type = Discover (0) Client-Identifier = 0x616263313233 (0) Network-Subnet = 0.0.0.0/32 (0) Net { (0) Src { (0) IP = 0.0.0.0 (0) Port = 68 (0) } (0) Dst { (0) IP = 255.255.255.255 (0) Port = 67 (0) } (0) Timestamp = "2024-11-08T10:16:53Z" (0) } (0) Packet-Type = Discover (0) Running 'recv Discover' from file /etc/raddb/sites-enabled/dhcp (0) recv Discover { (0) files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used (0) files_dhcp_network (fail) (0) } # recv Discover (fail) (0) Not sending reply to client (0) dhcp (fail) (0) } # dhcp (fail) (0) Done request (0) Finished request proto_dhcpv4_udp - cleaning up request in 5.000000s ^CSignalled to terminate Exiting normally Thank you in advance, // Dmitrii.

2 7

Mailing List test
by dominic.stalder＠unibe.ch 11 Nov '24

11 Nov '24

Sorry guys, but I just wanted to check why my emails / questions don’t get to the list anymore; am I blocked or have been thrown off the list?

4 9

Google LDAP Authentication for WIFI Setup issues
by Joseph Allen 10 Nov '24

10 Nov '24

Hello, I have been working on this for several days and am tired of asking an AI for help. I have freeRadius installed on a RPI4 through apt, so its a 3.0 version. First I tried following google workspace instructions, it connects and looks up users fine, but it keeps trying to verify passwords in clear texts...no good. Next I noticed there is a mod named ldap_google in the mods-available, which says it will bind users and void the clear text issue. I configured that to connect to my workspace, fairly simple. Next I moved that file to the enabled mods folder as well as moving the google-ldap-auth file to the sites-enable folder. (I say move, I did a symbolic link). After lots of troubleshooting, I removed the default from the sites-enabled just to try and simplify everything. First I ran into issues with the filter_inner_identity, I don't quite understand why that is failing, but I saw somewhere else that is not needed, so I commented it out. Now I keep seeing this: (0) Received Access-Request Id 26 from 192.168.52.1:59099 to 192.168.52.155:1812 length 249 (0) User-Name = "test(a)test.com" (0) NAS-IP-Address = 192.168.1.89 (0) Called-Station-Id = "9A-7F-54-27-FD-35:***WIFI SSID****" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "BE-35-1A-04-D3-70" (0) Connect-Info = "CONNECT 24Mbps 802.11a" (0) Acct-Session-Id = "C349A45BB76F8134" (0) Acct-Multi-Session-Id = "9A4E5DCFE2DA284C" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027076 (0) WLAN-AKM-Suite = 1027077 (0) WLAN-Group-Mgmt-Cipher = 1027078 (0) Framed-MTU = 1400 (0) EAP-Message = 0x027b0012017465737440746573742e636f6d (0) Message-Authenticator = 0xf88e64c655b98a2aa22e62a2844fe21d (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) policy split_username_nai { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) -> TRUE (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) update request { (0) EXPAND %{1} (0) --> test (0) &Stripped-User-Name := test (0) } # update request = noop (0) if ("%{3}" != '') { (0) EXPAND %{3} (0) --> test.com (0) if ("%{3}" != '') -> TRUE (0) if ("%{3}" != '') { (0) update request { (0) EXPAND %{3} (0) --> test.com (0) &Stripped-User-Domain = test.com (0) } # update request = noop (0) } # if ("%{3}" != '') = noop (0) [updated] = updated (0) } # if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) = updated (0) ... skipping else: Preceding "if" was taken (0) } # policy split_username_nai = updated (0) update control { (0) &Cache-Status-Only := yes (0) } # update control = noop (0) cache_auth_accept: EXPAND %{md5:%{%{Stripped-User-Name}:-%{User-Name}}%{User-Password}} (0) cache_auth_accept: --> 098f6bcd4621d373cade4e832627b4f6 (0) cache_auth_accept: No cache entry found for "098f6bcd4621d373cade4e832627b4f6" (0) [cache_auth_accept] = notfound (0) if (ok) { (0) if (ok) -> FALSE (0) update control { (0) &Cache-Status-Only := yes (0) } # update control = noop (0) cache_auth_reject: EXPAND %{md5:%{Calling-Station-Id}%{Stripped-User-Name}%{User-Password}} (0) cache_auth_reject: --> c12fe59cbee87c80dea47e15189a1410 (0) cache_auth_reject: No cache entry found for "c12fe59cbee87c80dea47e15189a1410" (0) [cache_auth_reject] = notfound (0) if (ok) { (0) if (ok) -> FALSE (0) if (&User-Password && !control:Auth-Type) { (0) if (&User-Password && !control:Auth-Type) -> FALSE (0) } # authorize = updated (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test(a)test.com (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) if (&control:Auth-Type == ldap) { (0) ERROR: Failed retrieving values required to evaluate condition (0) update control { (0) &Cache-TTL := 0 (0) } # update control = noop (0) cache_ldap_user_dn: EXPAND %{Stripped-User-Name} (0) cache_ldap_user_dn: --> test (0) cache_ldap_user_dn: No cache entry found for "test" (0) cache_ldap_user_dn: Creating new cache entry (0) cache_ldap_user_dn: Merging cache entry into request (0) cache_ldap_user_dn: Committed entry, TTL 86400 seconds (0) [cache_ldap_user_dn] = updated (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test(a)test.com/<no User-Password attribute>] (from client 192.168.52.1 port 0 cli BE-35-1A-04-D3-70) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 26 from 192.168.52.155:1812 to 192.168.52.1:59099 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 26 with timestamp +19 due to cleanup_delay was reached There is an IF condition in the site config to check for the User-Password before it sets the Auth-Type, however it appears there is no user password, so the condition fails and it never even attempts to connect to LDAP. So the big question, is why is there no password? I am testing with my iPad, and I am typing in a password when connecting to the Wifi. The wifi config is set to WPA Enterprise. Thanks in advance for any help

4 6

Certificate chain - 1 intermediate CA cert(s) untrusted
by Rodrigo Prieto 09 Nov '24

09 Nov '24

Hello, I have the following problem. I configured freeradius to use EAP-TLS and it works. Create the certificates with the script inside the certificates folder. The problem is that when a client connects the following error appears: Certificate chain - 1 intermediate CA cert(s) untrusted To forbid these certificates see 'reject_unknown_intermediate_ca' (TLS) untrusted certificate with depth [1] subject name /C=AR/ST=Buenos Aires/L=Virreyes/O=Lotech/emailAddress=22(a)gmail.com/CN=CA-FREERADIUS (TLS) untrusted certificate with depth [0] subject name /C=AR/ST=Buenos Aires/O=Lotech/CN=11@gmail.com/emailAddress=11@gmail.com I don't use intermediate AC. I ran c_rehash inside the certs folder. The certificates correctly point to the CA file. rivate_key_password = loli private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem ca_file = /etc/freeradius/certs/ca.pem ca_path = ${cadir} I run openssl verify with the client and server certificates and it says OK. Freeradius is installed on Ununtu 24.04. The version of openssl is: OpenSSL 3.0.13 Jan 30, 2024 (Library: OpenSSL 3.0.13 Jan 30, 2024) If anyone can help me, I appreciate it. Greetings and thanks.

2 3

openssl FIPS mode
by Timothy J. Ebben 08 Nov '24

08 Nov '24

I have set up a FreeRADIUS server to interface with a Cisco managed switch. I am able to authenticate supplicants using the EAP-TLS protocol. When I activate FIPS mode in openssl (v3.1.5), I get the following debug output: Ready to process requests (5) Received Access-Request Id 62 from 192.168.5.132:49205 to 192.168.5.83:1812 length 131 Dropping packet without response because of error: Received packet from 192.168.5.132 with invalid Message-Authenticator! (Shared secret is incorrect.) (from client cisco) I know the shared secret is correct, because it works when not in FIPS mode. The shared secret is 15 characters long and includes uppercase and lowercase letters, numbers, and special characters. Do I need additional configuration?

2 5

EAP-TLS 1.3 support (RFC 9190)
by Stephan P. 08 Nov '24

08 Nov '24

Hello together, I only have a general technical question. Does FreeRADIUS server support EAP-TLS 1.3 (as described in RFC9190)? And if yes, beginning with which version of FreeRADIUS? I looked in the changelogs, TLS 1.3 support is mentioned for EAP-TTLS and EAP-PEAP (but not for EAP-TLS) (-> version 3.0.26 (2022.09.20) and version 3.2.2 (2023.02.16)). I haven't found anything explicit about it in the documents, only the "TLS 1.3 Configuration" mailing list thread from Boby Tharappel implicating feature support. Thanks in advance. Greetings, Stephan

2 1

Re:
by Alan DeKok 07 Nov '24

07 Nov '24

On Nov 7, 2024, at 1:49 PM, Дмитрий Ахлестин <akhlestin.dmitry(a)yandex.ru> wrote: > Hello, Freeradius users, There is no need to email me directly. I read the list. > I'm engineer who is developing support of 802.1x at network operation system(NOS) based at zebos/ocnos. > At the moment my current task is to add support of CoA(change of authorization) requests from freeradius: disable exact port(make it notauthorize), restart exact port, re- authorization of user. > But I have several problems and questions: > 1. Do you know exact RFC which I can use for making my own(my vendor) CoA-Request message? I mean exact set up of TLV fields as u can see at attached example for cisco traffic. We're not going to look at zip files, they are not helpful. If you need to know what goes in a CoA-Request packet which is sent to a Cisco device, then read the Cisco documentation. If you want to invent your own attributes to go into a CoA-Request packet, then that won't work. The reasons are too complex to explain in a short message. > 2. How and what should I change at freeradius settings and configuration files that I could send such CoA request from freeradius to Authenticator? See sites-available/originate-coa. This is documented. We are not going to give a step-by-step guide for configuring your exact system. The Cisco documentation explains what the Cisco devices need in a CoA packet. The FreeRADIUS documentation explains how to configure FreeRADIUS to send attributes. It's up to you to put those together. > 3. Possible you have some examples of traffic which contains some CoA requests? Can you share it with me? Google. Or, read the Cisco documentation. Alan DeKok.

1 0

Status-Server Segfault in 3.0.27
by Adam Bishop 06 Nov '24

06 Nov '24

I'm sure I read about this issue on the list around the release of 3.0.27/3.0.5 and had thought it was fixed but searching for it in the list archive isn't coming up with anything recent. This one is running 3.0.27 - the server is segfaulting when it tries to probe a remote radius server that is unreachable: No response to status check 5 ID 75 for home server 193.63.195.50 port 1812 bt full follows at the end of the email. I do have plans to upgrade to 3.2 but not before I'd like this particular system in production. Is this a known/previously seen issue, or am I inventing a memory? Many Thanks, Adam --- #0 0x0000555555587244 in request_stats_final (request=0x555555a69bb0) at src/main/stats.c:99 listener = <optimized out> client = <optimized out> auth_stats = <optimized out> coa_stats = <optimized out> #1 0x000055555558f811 in request_stats_final (request=0x555555a69bb0) at src/main/stats.c:91 listener = <optimized out> client = <optimized out> auth_stats = <optimized out> coa_stats = <optimized out> dsc_stats = <optimized out> done = <optimized out> proxy_stats = <optimized out> #2 request_done (request=0x555555a69bb0, original=<optimized out>) at src/main/process.c:921 now = {tv_sec = 93824996240744, tv_usec = -7131984328893351168} when = {tv_sec = 140737488347520, tv_usec = 1} action = <optimized out> #3 0x0000555555591b73 in request_ping (request=0x555555a69bb0, action=<optimized out>) at src/main/process.c:3788 home = <optimized out> buffer = "193.63.195.50\000\000\000 x\246UUU\000\000\000\000\000\000\000\000\000\000x\330\363\367\377\177\000\000\024\206\345\367\377\177\000\000\020\020\246UUU\000\000\060\000\000\000\000\000\000\000\310n\222UUU\000\000X\234\246UUU\000\000Pm\222UUU\000\000\001\000\000\000\000\000\000\000\020\020\246UUU\000\000\t\244\345\367\377\177\000\000Y4[UUU\000\000B4[UUU\000" __FUNCTION__ = "request_ping" #4 0x00007ffff7f33abb in fr_event_run (when=0x7fffffffe180, el=0x555555926d50) at src/lib/event.c:321 callback = 0x555555587a80 <request_timer> ctx = 0x555555a69bb0 ev = <optimized out> callback = <optimized out> ctx = <optimized out> ev = <optimized out> #5 fr_event_run (el=el@entry=0x555555926d50, when=when@entry=0x7fffffffe180) at src/lib/event.c:278 callback = <optimized out> ctx = <optimized out> ev = <optimized out> #6 0x00007ffff7f36c3f in fr_event_loop (el=0x555555926d50) at src/lib/event.c:691 i = <optimized out> rcode = 0 when = {tv_sec = 1730907338, tv_usec = 458268} wake = <optimized out> read_fds = {fds_bits = {0 <repeats 16 times>}} write_fds = {fds_bits = {0 <repeats 16 times>}} #7 0x000055555556c3cc in main (argc=<optimized out>, argv=<optimized out>) at src/main/radiusd.c:641 rcode = 0 status = <optimized out> argval = <optimized out> spawn_flag = true display_version = false flag = 0 from_child = {-1, -1} p = <optimized out> state = <optimized out> autofree = 0x5555555d8620 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

2 1

Plans for adding PQC support
by Mike Luken (mluken) 06 Nov '24

06 Nov '24

What are the plans for adding post-quantum crypto (PQC) support into FreeRADIUS?

2 1

Problem verifying EAP-TLS certificates (untrusted warning)
by Alexey D. Filimonov 06 Nov '24

06 Nov '24

I have a problem with warning about "untrusted certificate" and rejecting if set "reject_unknown_intermediate_ca = yes". Could you help me solving this issue? In short, this is the problem: > Tue Nov 5 22:37:37 2024 : Warning: Certificate chain - 1 cert(s) untrusted > Tue Nov 5 22:37:37 2024 : Warning: (TLS) untrusted certificate with depth [1] subject name /O=OD.FREEIPA.XYZ/CN=OD.FREEIPA.XYZ Certificate Authority > Tue Nov 5 22:37:37 2024 : Warning: (TLS) untrusted certificate with depth [0] subject name /O=OD.FREEIPA.XYZ/CN=rpi4b.od.freeipa.xyz I have One-Tier PKI. On FreeRADIUS server I copied client certificate and CA to /tmp/certs: 802_1x.crt and 802_1x.ca.crt . On FreeRADIUS server I have server certificate issued by the same CA. To check certificates I run commands under same user FreeRADIUS runs: `su freerad -s /bin/bash`. Check if both CAs same ``` freerad@radius2:/root$ md5sum /tmp/certs/802_1x.ca.crt /etc/freeradius/3.0/tls/certs/ca/wifi/wifi.ca.crt e65a3b9362b313ed3a10a3ce4a3588e5 /tmp/certs/802_1x.ca.crt e65a3b9362b313ed3a10a3ce4a3588e5 /etc/freeradius/3.0/tls/certs/ca/wifi/wifi.ca.crt ``` Check if both CAs are self-signed and same: ``` freerad@radius2:/root$ openssl x509 -noout -text -in /etc/freeradius/3.0/tls/certs/ca/wifi/wifi.ca.crt | grep -A1 'Key Identifier' X509v3 Subject Key Identifier: CD:4B:3C:31:60:D9:81:22:75:1B:47:4E:50:AB:3B:FB:5A:68:85:79 X509v3 Authority Key Identifier: CD:4B:3C:31:60:D9:81:22:75:1B:47:4E:50:AB:3B:FB:5A:68:85:79 freerad@radius2:/root$ openssl x509 -noout -text -in /tmp/certs/802_1x.ca.crt | grep -A1 'Key Identifier' X509v3 Subject Key Identifier: CD:4B:3C:31:60:D9:81:22:75:1B:47:4E:50:AB:3B:FB:5A:68:85:79 X509v3 Authority Key Identifier: CD:4B:3C:31:60:D9:81:22:75:1B:47:4E:50:AB:3B:FB:5A:68:85:79 ``` Check if client and server certificate is issued by this CA: ``` freerad@radius2:/root$ openssl x509 -noout -text -in /tmp/certs/802_1x.crt | grep -A1 'Authority Key Identifier' X509v3 Authority Key Identifier: CD:4B:3C:31:60:D9:81:22:75:1B:47:4E:50:AB:3B:FB:5A:68:85:79 freerad@radius2:/root$ openssl x509 -noout -text -in /etc/freeradius/3.0/tls/certs/wifi.crt | grep -A1 'Authority Key Identifier' X509v3 Authority Key Identifier: CD:4B:3C:31:60:D9:81:22:75:1B:47:4E:50:AB:3B:FB:5A:68:85:79 ``` Check if client both client and server certificates are issued by same CA (here I see "untrusted"): ``` freerad@radius2:/root$ openssl verify -verbose -crl_download -crl_check -show_chain -verify_depth 10 -issuer_checks -no_alt_chains -check_ss_sig -CAfile /etc/freeradius/3.0/tls/certs/ca/wifi/wifi.ca.crt -CApath /etc/freeradius/3.0/tls/certs/ca/wifi /tmp/certs/802_1x.crt /tmp/certs/802_1x.crt: OK Chain: depth=0: O = OD.FREEIPA.XYZ, CN = rpi4b.od.freeipa.xyz (untrusted) depth=1: O = OD.FREEIPA.XYZ, CN = OD.FREEIPA.XYZ Certificate Authority freerad@radius2:/root$ openssl verify -verbose -crl_download -crl_check -show_chain -verify_depth 10 -issuer_checks -no_alt_chains -check_ss_sig -CAfile /etc/freeradius/3.0/tls/certs/ca/wifi/wifi.ca.crt -CApath /etc/freeradius/3.0/tls/certs/ca/wifi /etc/freeradius/3.0/tls/certs/wifi.crt /etc/freeradius/3.0/tls/certs/wifi.crt: OK Chain: depth=0: O = OD.FREEIPA.XYZ, CN = radius2.od.freeipa.xyz (untrusted) depth=1: O = OD.FREEIPA.XYZ, CN = OD.FREEIPA.XYZ Certificate Authority ``` Copied (under root) to ca store and run `c_rehash /etc/ssl/certs`. Found that my CA cert is already here. ``` root@radius2:~# mkdir /usr/share/ca-certificates/wifi root@radius2:~# cp /etc/freeradius/3.0/tls/certs/ca/wifi/wifi.ca.crt /usr/share/ca-certificates/wifi root@radius2:~# chmod -R 755 /usr/share/ca-certificates/wifi root@radius2:~# ls -laR /usr/share/ca-certificates/wifi /usr/share/ca-certificates/wifi: total 12 drwxr-xr-x 2 root root 4096 Nov 5 21:44 . drwxr-xr-x 4 root root 4096 Nov 5 21:43 .. -rwxr-xr-x 1 root root 1598 Nov 5 21:44 wifi.ca.crt root@radius2:~# ln -s /usr/share/ca-certificates/wifi/wifi.ca.crt /etc/ssl/certs/wifi.ca.crt root@radius2:~# ls -la /etc/ssl/certs/wifi.ca.crt lrwxrwxrwx 1 root root 43 Nov 5 21:46 /etc/ssl/certs/wifi.ca.crt -> /usr/share/ca-certificates/wifi/wifi.ca.crt root@radius2:~# c_rehash /etc/ssl/certs Doing /etc/ssl/certs WARNING: Skipping duplicate certificate ca-certificates.crt WARNING: Skipping duplicate certificate ca-certificates.crt WARNING: Skipping duplicate certificate wifi.ca.crt WARNING: Skipping duplicate certificate wifi.ca.crt ``` Still no luck. Run `c_rehash /etc/freeradius/3.0/tls/certs/ca/wifi` (this is where wifi.ca.crt is also added) and added `ca_path = "/etc/freeradius/3.0/tls/certs/ca/wifi"` ``` root@radius2:~# ls -laR /etc/freeradius/3.0/tls/certs/ca/wifi/ /etc/freeradius/3.0/tls/certs/ca/wifi/: total 12 drwxr-xr-x 2 freerad freerad 4096 Nov 5 21:48 . drwxr-xr-x 3 freerad freerad 4096 Nov 5 20:32 .. lrwxrwxrwx 1 root root 11 Nov 5 21:48 577f4bb3.0 -> wifi.ca.crt lrwxrwxrwx 1 root root 11 Nov 5 21:48 ed3eb11a.0 -> wifi.ca.crt -rwxr-xr-x 1 freerad freerad 1598 Nov 5 20:34 wifi.ca.crt ``` Still no luck. This is my EAP config: ``` # /etc/freeradius/3.0/mods-available/eap_wifi eap eap_wifi { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} tls-config tls_eap_wifi { private_key_file = "/etc/freeradius/3.0/tls/private/wifi.key" certificate_file = "/etc/freeradius/3.0/tls/certs/wifi.crt" ca_file = "/etc/freeradius/3.0/tls/certs/ca/wifi/wifi.ca.crt" ca_path = "/etc/freeradius/3.0/tls/certs/ca/wifi" auto_chain = yes cipher_list = "HIGH" check_crl = no check_all_crl = no cipher_server_preference = no tls_min_version = "1.2" tls_max_version = "1.2" ecdh_curve = "prime256v1" reject_unknown_intermediate_ca = yes } tls { tls = tls_eap_wifi configurable_client_cert = no } } ``` This is part of `freeradius -X` log: ``` > (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi > (7) Auth-Type eap_wifi { > (7) eap_wifi: Expiring EAP session with state 0xe7b966f3e1e06b16 > (7) eap_wifi: Finished EAP session with state 0xe7b966f3e1e06b16 > (7) eap_wifi: Previous EAP request found for state 0xe7b966f3e1e06b16, released from the list > (7) eap_wifi: Peer sent packet with method EAP TLS (13) > (7) eap_wifi: Calling submodule eap_tls to process data > (7) eap_tls: (TLS) EAP Got final fragment (321 bytes) > (7) eap_tls: (TLS) EAP Done initial handshake > (7) eap_tls: (TLS) Handshake state - Server SSLv3/TLS write server done > (7) eap_tls: (TLS) recv TLS 1.2 Handshake, Certificate > (7) eap_tls: (TLS) Creating attributes from server certificate > (7) eap_tls: TLS-Cert-Serial := "01" > (7) eap_tls: TLS-Cert-Expiration := "441018201402Z" > (7) eap_tls: TLS-Cert-Valid-Since := "241018201402Z" > (7) eap_tls: TLS-Cert-Subject := "/O=OD.FREEIPA.XYZ/CN=OD.FREEIPA.XYZ Certificate Authority" > (7) eap_tls: TLS-Cert-Issuer := "/O=OD.FREEIPA.XYZ/CN=OD.FREEIPA.XYZ Certificate Authority" > (7) eap_tls: TLS-Cert-Common-Name := "OD.FREEIPA.XYZ Certificate Authority" > (7) eap_tls: (TLS) Creating attributes from client certificate > (7) eap_tls: TLS-Client-Cert-Serial := "22" > (7) eap_tls: TLS-Client-Cert-Expiration := "250104182310Z" > (7) eap_tls: TLS-Client-Cert-Valid-Since := "241105182310Z" > (7) eap_tls: TLS-Client-Cert-Subject := "/O=OD.FREEIPA.XYZ/CN=rpi4b.od.freeipa.xyz" > (7) eap_tls: TLS-Client-Cert-Issuer := "/O=OD.FREEIPA.XYZ/CN=OD.FREEIPA.XYZ Certificate Authority" > (7) eap_tls: TLS-Client-Cert-Common-Name := "rpi4b.od.freeipa.xyz" > (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Dns := "rpi4b.od.freeipa.xyz" > (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Upn := "host/rpi4b.od.freeipa.xyz(a)OD.FREEIPA.XYZ" > (7) eap_tls: TLS-Client-Cert-X509v3-Authority-Key-Identifier += "CD:4B:3C:31:60:D9:81:22:75:1B:47:4E:50:AB:3B:FB:5A:68:85:79" > (7) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, 1.3.6.1.5.5.7.3.14" > (7) eap_tls: TLS-Client-Cert-X509v3-Subject-Key-Identifier += "F1:BC:FD:76:AC:E4:92:AD:A1:82:81:79:25:CC:1D:09:63:15:C9:00" > (7) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" > (7) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.14" > Certificate chain - 1 cert(s) untrusted > (TLS) untrusted certificate with depth [1] subject name /O=OD.FREEIPA.XYZ/CN=OD.FREEIPA.XYZ Certificate Authority > (TLS) untrusted certificate with depth [0] subject name /O=OD.FREEIPA.XYZ/CN=rpi4b.od.freeipa.xyz > tls: There are untrusted certificates in the certificate chain. Rejecting. > (7) eap_tls: (TLS) send TLS 1.2 Alert, fatal internal_error > (7) eap_tls: ERROR: (TLS) Alert write:fatal:internal error > (7) eap_tls: ERROR: (TLS) Server : Error in error > (7) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:0A000086:SSL routines::certificate verify failed > (7) eap_tls: ERROR: (TLS) System call (I/O) error (-1) > (7) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation > (7) eap_tls: ERROR: [eaptls process] = fail > (7) eap_wifi: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed > (7) eap_wifi: Sending EAP Failure (code 4) ID 89 length 4 > (7) eap_wifi: Failed in EAP select > (7) [eap_wifi] = invalid ``` The piece around warning when `freeradius -X -xx` is used: ``` ... Tue Nov 5 22:37:37 2024 : Debug: (15) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.14" Tue Nov 5 22:37:37 2024 : Warning: Certificate chain - 1 cert(s) untrusted Tue Nov 5 22:37:37 2024 : Warning: (TLS) untrusted certificate with depth [1] subject name /O=OD.FREEIPA.XYZ/CN=OD.FREEIPA.XYZ Certificate Authority Tue Nov 5 22:37:37 2024 : Warning: (TLS) untrusted certificate with depth [0] subject name /O=OD.FREEIPA.XYZ/CN=rpi4b.od.freeipa.xyz Tue Nov 5 22:37:37 2024 : Auth: tls: There are untrusted certificates in the certificate chain. Rejecting. Tue Nov 5 22:37:37 2024 : Debug: (15) eap_tls: (TLS) chain-depth : 0 Tue Nov 5 22:37:37 2024 : Debug: (15) eap_tls: (TLS) error : 0 Tue Nov 5 22:37:37 2024 : Debug: (15) eap_tls: identity : anonymous-od-type-a Tue Nov 5 22:37:37 2024 : Debug: (15) eap_tls: (TLS) common name : rpi4b.od.freeipa.xyz Tue Nov 5 22:37:37 2024 : Debug: (15) eap_tls: (TLS) subject : /O=OD.FREEIPA.XYZ/CN=rpi4b.od.freeipa.xyz Tue Nov 5 22:37:37 2024 : Debug: (15) eap_tls: (TLS) issuer : /O=OD.FREEIPA.XYZ/CN=OD.FREEIPA.XYZ Certificate Authority Tue Nov 5 22:37:37 2024 : Debug: (15) eap_tls: (TLS) verify return : 0 Tue Nov 5 22:37:37 2024 : Debug: (TLS) Ignoring cbtls_msg call with pseudo content type 256, version 771 Tue Nov 5 22:37:37 2024 : Debug: (TLS) Received 2 bytes of TLS data Tue Nov 5 22:37:37 2024 : Debug: (TLS) 02 50 Tue Nov 5 22:37:37 2024 : Debug: (15) eap_tls: (TLS) send TLS 1.2 Alert, fatal internal_error Tue Nov 5 22:37:37 2024 : ERROR: (15) eap_tls: (TLS) Alert write:fatal:internal error Tue Nov 5 22:37:37 2024 : ERROR: (15) eap_tls: (TLS) Server : Error in error Tue Nov 5 22:37:37 2024 : ERROR: (15) eap_tls: (TLS) Failed reading from OpenSSL: ../ssl/statem/statem_srvr.c[3522]:error: :SSL routines::certificate verify failed Tue Nov 5 22:37:37 2024 : ERROR: (15) eap_tls: (TLS) System call (I/O) error (-1) Tue Nov 5 22:37:37 2024 : ERROR: (15) eap_tls: (TLS) EAP Receive handshake failed during operation Tue Nov 5 22:37:37 2024 : ERROR: (15) eap_tls: [eaptls process] = fail Tue Nov 5 22:37:37 2024 : ERROR: (15) eap_wifi: Failed continuing EAP TLS (13) session. EAP sub-module failed Tue Nov 5 22:37:37 2024 : Debug: (15) eap_wifi: Sending EAP Failure (code 4) ID 98 length 4 Tue Nov 5 22:37:37 2024 : Debug: (15) eap_wifi: Failed in EAP select Tue Nov 5 22:37:37 2024 : Debug: (15) modsingle[authenticate]: returned from eap_wifi (rlm_eap) Tue Nov 5 22:37:37 2024 : Debug: (15) [eap_wifi] = invalid ... ```

2 2