- Freeradius-Users - lists.freeradius.org

Correct way of redefining sql queries
by Jiří Hromádka 09 Mar '22

09 Mar '22

Hello, I’d like to ask what is the correct way to redefine some main sql queries in mods-config and don’t change default files so any updates won’t stop asking what version I want? Let’s say I need to add few more conditions to “authorize_check_query” in sql/main/mysql/queries.conf. Editing this file directly will make future updates stops, asking me which version to use (in case this file is changed in new version) I’ve created new file with redefined query and included that file at the end of the rlm_sql instance definition, right before include of default queries.conf with other queries definition. Based on debug output, I can see that authorize_check_query contains my changed SQL query. The question is, is this correct way to do this or is there better one? Thank you very much for your help in advance. Regards Jiri

2 2

EAP-TLS Certificate renewal
by Dario Barbon 09 Mar '22

09 Mar '22

Hello, I've setup Freeradius EAP-TLS for Android device following this tutorial by Techtalk (https://techtalkblog.ch/ubuntu-18-04-freeradius-v3-wifi-authentication/) The first certificate I've issued will expire next July: Is there a way to extend the life of this certificate? What are the best practices to manage certificates under Freeradius environment? Thanks! Dario Barbon

2 3

Variable/Attribute expansion in SQL
by Antônio Modesto 08 Mar '22

08 Mar '22

Hello everyone, Do you guys know if there is a way to have variable expansion working when attributes are fetched from a SQL database? For example: Reply-Message := "Hello, %{User-Name}" I have a situation where I must use something like this only for a specific type of NAS. I could edit the configuration to do this conditionally in the post-auth section, but if it is possible with SQL it would be a cleaner solution. We use Freeradius 3.0.21 or later. -- Att, *Antônio Modesto*

4 7

Some Questions
by mohamed almeshal 07 Mar '22

07 Mar '22

I mean that the server user sql and decouple account which is faster and reliable , OS mean on the /var/log/freeradius I want top stop logging into this folder because the vm has limited storage . thanks alan

2 1

Some Questions
by mohamed almeshal 07 Mar '22

07 Mar '22

Dear Savers ... I have some tricky issues ??? first what is different between detail & detal.doucple in accounting module ? and if I don't want to log into OS files I can comment the detail line in default configuration file . second ... I have the freeradius configured to work with TLC at port 2083 I need to operate the radius at both 2083 and 1812 & 1813 with UDP How I can achieve this on latest version of freeradius . clients radsec { client radsec { ipaddr = 0.0.0.0/0 secret = radsec proto = tls } } server default { listen { type = auth ipaddr = * proto = udp limit { max_pps = 0 } } listen { type = auth ipv6addr = :: proto = udp limit { max_pps = 0 } } listen { type = auth ipaddr = * proto = tcp limit { max_connections = 0 lifetime = 0 idle_timeout = 30 } } listen { type = auth ipv6addr = :: proto = tcp limit { max_connections = 0 lifetime = 0 idle_timeout = 30 } } listen { type = acct ipaddr = * proto = udp limit { max_pps = 0 } } listen { type = acct ipv6addr = :: proto = udp limit { max_pps = 0 } } listen { type = acct ipaddr = * proto = tcp limit { max_connections = 0 lifetime = 0 idle_timeout = 30 } } listen { type = acct ipv6addr = :: proto = tcp limit { max_connections = 0 lifetime = 0 idle_timeout = 30 } } listen { type = auth+acct ipaddr = * port = 2083 proto = tcp limit { max_connections = 0 lifetime = 0 idle_timeout = 30 } tls { private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh fragment_size = 8192 cipher_list = "DEFAULT" cipher_server_preference = yes tls_min_version = "1.2" cache { enable = yes lifetime = 24 # hours } require_client_cert = yes } clients = radsec } listen { type = auth+acct ipv6addr = :: port = 2083 proto = tcp limit { max_connections = 0 lifetime = 0 idle_timeout = 30 } tls { private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh fragment_size = 8192 cipher_list = "DEFAULT" cipher_server_preference = yes tls_min_version = "1.2" cache { enable = yes lifetime = 24 # hours } require_client_cert = yes } clients = radsec }

2 1

EAP-TLS not working with windows 7
by Elias Pereira 07 Mar '22

07 Mar '22

hi, I have set up on our freeradius server EAP-TLS with a user certificate. I put together the user certificate + key + CA server in a .p12 file. At first on android, windows 10 and 11 it is working. My problem is with windows 7. *The freeradius log shows this:* Mon Mar 7 10:40:38 2022 : Debug: (46) eap_tls: (TLS) recv TLS 1.3 Handshake, ClientHello Mon Mar 7 10:40:38 2022 : Debug: (TLS) Ignoring cbtls_msg call with pseudo content type 256, version 0 Mon Mar 7 10:40:38 2022 : Debug: (TLS) Received 2 bytes of TLS data Mon Mar 7 10:40:38 2022 : Debug: (TLS) 02 46 Mon Mar 7 10:40:38 2022 : Debug: (46) eap_tls: (TLS) send TLS 1.0 Alert, fatal protocol_version Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) Alert write:fatal:protocol version Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) Server : Error in error Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) Failed reading from OpenSSL: ../ssl/statem/statem_srvr.c[1661]:error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) System call (I/O) error (-1) Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) EAP Receive handshake failed during operation Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: [eaptls process] = fail Mon Mar 7 10:40:38 2022 : ERROR: (46) eap: Failed continuing EAP TLS (13) session. EAP sub-module failed Mon Mar 7 10:40:38 2022 : Debug: (46) eap: Sending EAP Failure (code 4) ID 82 length 4 Mon Mar 7 10:40:38 2022 : Debug: (46) eap: Failed in EAP select Mon Mar 7 10:40:38 2022 : Debug: (46) modsingle[authenticate]: returned from eap (rlm_eap) Mon Mar 7 10:40:38 2022 : Debug: (46) [eap] = invalid Mon Mar 7 10:40:38 2022 : Debug: (46) } # authenticate = invalid Mon Mar 7 10:40:38 2022 : Debug: (46) Failed to authenticate the user In windows 7 client I looked for some information in the event viewer, but found nothing. Anyone else using this method, is having this problem? -- Elias Pereira

3 2

FreeRADIUS acting slow? Check your database(s)
by Network RADIUS 07 Mar '22

07 Mar '22

** My FreeRADIUS server is slow. What’s wrong? --------------------------------------------- If you are encountering performance issues with FreeRADIUS, the first thought is usually to blame FreeRADIUS. In fact, it’s always the database which is the source of a system slowdown. Well, maybe not always, but 99 times out of a 100, it’s the database. It is extremely unlikely that FreeRADIUS is the culprit when you notice slow performance. Here’s how we know. We have run tests running the server with a minimal configuration, i.e. no database, and minimal processing rules. These tests can easily reach 40,000-50,000 packets per second. But when we add a database such as SQL, the performance drops significantly, to around two thousand packets per second. Given that FreeRADIUS alone can handle 40K pps, and FreeRADIUS with a DB can only handle 2K pps, the question is do we blame FreeRADIUS, or the DB for the slow performance? In our experience, the database is almost always the performance bottleneck. Read the full article… https://networkradius.com/articles/2022/01/10/its-always-the-database.html ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be. Powered by Mailbutler, the email extension that does it all

1 0

Fwd: radiusd -X - command not found - Regarding
by P.Thirunavukkarasu 07 Mar '22

07 Mar '22

*Hi Team,* *Greetings..* *I am getting the message for radiusd -X as "-bash command not found"* *How to do the radiusd -X to identify the issues?* *root@packetfence:~# /etc/init.d/freeradius status● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; disabled; vendor preset: enabled) Active: inactive (dead) Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ <http://wiki.freeradius.org/> http://networkradius.com/doc/ <http://networkradius.com/doc/>----------------------* *root@packetfence:~# /etc/init.d/freeradius startStarting freeradius (via systemctl): freeradius.serviceJob for freeradius.service failed because the control process exited with error code.See "systemctl status freeradius.service" and "journalctl -xe" for details.* *failed!* *----------------------* *root@packetfence:~# systemctl status freeradius.service● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; disabled; vendor p> Active: activating (auto-restart) (Result: exit-code) since Sun 2022-03-06> Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ <http://wiki.freeradius.org/> http://networkradius.com/doc/ <http://networkradius.com/doc/> Process: 3947 ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius (> Process: 3948 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -ls> Process: 3949 ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS (code=e> Main PID: 3949 (code=exited, status=1/FAILURE) CPU: 176msMar 06 19:31:00 packetfence systemd[1]: freeradius.service: Main process exited>Mar 06 19:31:00 packetfence systemd[1]: freeradius.service: Failed with result >Mar 06 19:31:00 packetfence systemd[1]: Failed to start FreeRADIUS multi-protoc>lines 1-16/16 (END)...skipping...● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; disabled; vendor preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Sun 2022-03-06 19:31:00 IST; 2s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ <http://wiki.freeradius.org/> http://networkradius.com/doc/ <http://networkradius.com/doc/> Process: 3947 ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius (code=exited, status=0/SUCCESS) Process: 3948 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Process: 3949 ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS (code=exited, status=1/FAILURE) Main PID: 3949 (code=exited, status=1/FAILURE) CPU: 176msMar 06 19:31:00 packetfence systemd[1]: freeradius.service: Main process exited, code=exited, status=1/FAILUREMar 06 19:31:00 packetfence systemd[1]: freeradius.service: Failed with result 'exit-code'.Mar 06 19:31:00 packetfence systemd[1]: Failed to start FreeRADIUS multi-protocol policy server.* *--------------------* *root@packetfence:~# journalctl -xeMar 06 19:32:58 packetfence freeradius[4676]: Starting - reading configuration files ...Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 20.000000", forcing to "response_window = >Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 30.000000", forcing to "response_window = >Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 30.000000", forcing to "response_window = >Mar 06 19:32:58 packetfence freeradius[4676]: /usr/local/pf/raddb/proxy.conf.inc[20]: Duplicate home server address >Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Control process exited, code=exited, statu>░░ Subject: Unit process exited░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ An ExecStartPre= process belonging to unit packetfence-radiusd-auth.service has exited.░░░░ The process' exit code is 'exited' and its exit status is 1.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Failed with result 'exit-code'.░░ Subject: Unit failed░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service has entered the 'failed' state with result 'exit-code'.Mar 06 19:32:58 packetfence systemd[1]: Failed to start PacketFence FreeRADIUS authentication multi-protocol authent>░░ Subject: A start job for unit packetfence-radiusd-auth.service has failed░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A start job for unit packetfence-radiusd-auth.service has finished with a failure.░░░░ The job identifier is 37980 and the job result is failed.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Consumed 3.214s CPU time.░░ Subject: Resources consumed by unit runtime░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service completed and consumed the indicated resources.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Scheduled restart job, restart counter is >░░ Subject: Automatic restarting of a unit has been scheduled░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ Automatic restarting of the unit packetfence-radiusd-auth.service has been scheduled, as the result for░░ the configured Restart= setting for the unit.Mar 06 19:32:58 packetfence systemd[1]: Stopped PacketFence FreeRADIUS authentication multi-protocol authentication >░░ Subject: A stop job for unit packetfence-radiusd-auth.service has finished░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A stop job for unit packetfence-radiusd-auth.service has finished.░░░░ The job identifier is 38364 and the job result is done.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Consumed 3.214s CPU time.░░ Subject: Resources consumed by unit runtime░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service completed and consumed the indicated resources.Mar 06 19:32:58 packetfence systemd[1]: Starting PacketFence FreeRADIUS authentication multi-protocol authentication>░░ Subject: A start job for unit packetfence-radiusd-auth.service has begun execution░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A start job for unit packetfence-radiusd-auth.service has begun execution.░░░░ The job identifier is 38364.lines 2663-2724/2724 (END)Mar 06 19:32:58 packetfence freeradius[4676]: Starting - reading configuration files ...Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 20.000000", forcing to "response_window = 10.000000"Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 30.000000", forcing to "response_window = 10.000000"Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 30.000000", forcing to "response_window = 10.000000"Mar 06 19:32:58 packetfence freeradius[4676]: /usr/local/pf/raddb/proxy.conf.inc[20]: Duplicate home server address (already in use by eduroam_server2): 144.16.140.190:UDP/1812Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Control process exited, code=exited, status=1/FAILURE░░ Subject: Unit process exited░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ An ExecStartPre= process belonging to unit packetfence-radiusd-auth.service has exited.░░░░ The process' exit code is 'exited' and its exit status is 1.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Failed with result 'exit-code'.░░ Subject: Unit failed░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service has entered the 'failed' state with result 'exit-code'.Mar 06 19:32:58 packetfence systemd[1]: Failed to start PacketFence FreeRADIUS authentication multi-protocol authentication server.░░ Subject: A start job for unit packetfence-radiusd-auth.service has failed░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A start job for unit packetfence-radiusd-auth.service has finished with a failure.░░░░ The job identifier is 37980 and the job result is failed.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Consumed 3.214s CPU time.░░ Subject: Resources consumed by unit runtime░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service completed and consumed the indicated resources.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Scheduled restart job, restart counter is at 107.░░ Subject: Automatic restarting of a unit has been scheduled░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ Automatic restarting of the unit packetfence-radiusd-auth.service has been scheduled, as the result for░░ the configured Restart= setting for the unit.Mar 06 19:32:58 packetfence systemd[1]: Stopped PacketFence FreeRADIUS authentication multi-protocol authentication server.░░ Subject: A stop job for unit packetfence-radiusd-auth.service has finished░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A stop job for unit packetfence-radiusd-auth.service has finished.░░░░ The job identifier is 38364 and the job result is done.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Consumed 3.214s CPU time.░░ Subject: Resources consumed by unit runtime░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service completed and consumed the indicated resources.Mar 06 19:32:58 packetfence systemd[1]: Starting PacketFence FreeRADIUS authentication multi-protocol authentication server...░░ Subject: A start job for unit packetfence-radiusd-auth.service has begun execution░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A start job for unit packetfence-radiusd-auth.service has begun execution.░░░░ The job identifier is 38364.lines 2663-2724/2724 (END)* *--------------* root@packetfence:~# /etc/init.d/freeradius status ● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; disabled; vendor preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Sun 2022-03-06 19:37:08 IST; 2s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 6189 ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius (code=exited, status=0/SUCCESS) Process: 6191 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Process: 6192 ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS (code=exited, status=1/FAILURE) Main PID: 6192 (code=exited, status=1/FAILURE) CPU: 176ms Thanks and Regards Thirunavukkarasu

5 6

Accounting issues
by mohamed almeshal 06 Mar '22

06 Mar '22

dear savers ... I struggle with these problems ? please help me to figure out what is going wrong -in Hotspot users always mikrotik give these message " RADIUS accounting request not sent: no response" now I try to figure out what is going on I found that mikrotik some times don't sync with radius for sending data and then I figure that if I don't set Interlam-update it's correct by 85% but in heavy load it's not . So how I can explore the problem and find out what is happening. -I have the free radius set to TLS users and it's work fine but I need to operate UDP users and TLS on same freeradius is that possible. and who I can set those parameters together. Your's Mohammed Almeeshal

2 1

Re: "redundant" block works in "default" virtual server, but does not work in "inner-tunnel"
by Rahman Duran 05 Mar '22

05 Mar '22

Ok, you are right as always :) It is not working as I expect, in default virtual server either (with radtest). But I was sure it was working like this. I made too many changes, maybe. So at least you know what I try to do. How can I achieve this then? I want to use multiple authentication sources, they can be users text file, sql or ldap, and there can be multiple of the same kind, multiple sql, multiple files, multiple ldap. User-Name should be searched in them sequentially and if the user is not found in any of them (noop for files, notfound for sql and ldap), I set the module failure message and reject the request here. The problem is testing for "ok", "noop", "notfound" etc with a following unlang if condition is not working as expected everywhere. So I am using "group" statements as I need to be sure I am checking the correct module return value. Any advice is appreciated. Rahman Duran

2 3