- Freeradius-Users - lists.freeradius.org

eap-tls tls_max_version empty
by Kai Rüsen 25 Jan '22

25 Jan '22

Hello everyone, I want to set up a FreeRADIUS server to test eap-tls connections with embedded devices. I'm using self signed certificates. I have two embedded devices, one using tls v1.2 the other using tls v1.0 (only testing). Every request get's rejected, with an error output from the eap-tls submodule. I get a little bit confused, because the configuration of the tls_max_version parameter in the eap mod doesn't seem to be accepted. Please see the debug output where the value of that parameter is empty ("") Is there another file to configurate this parameter? The rejection doesn't seem to be due to an invalid certificate, can you please tell me why it get's rejected? Debug output: FreeRADIUS Version 3.0.20 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/logintime including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/eap including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/tls including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server tls { ipaddr = 127.0.0.1 port = 2083 type = "auth" proto = "tcp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } tls { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/server.key" certificate_file = "/etc/freeradius/3.0/certs/server.pem" ca_file = "/etc/freeradius/3.0/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" random_file = "/dev/urandom" fragment_size = 8192 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" } The configuration allows TLS 1.0 and/or TLS 1.1. We STRONGLY recommned using only TLS 1.2 for security Please set: min_tls_version = "1.2" home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server_pool tls { type = fail-over home_server = tls } realm tls { auth_pool = tls } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client HS-Technik { ipaddr = 192.168.2.199/24 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest /etc/freeradius/3.0/sites-enabled/default[547]: Duplicate Auth-Type 'eap' radiusd: #### Instantiating modules #### modules { # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } instantiate { } # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" virtual_server = "check-eap-tls" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/server.key" certificate_file = "/etc/freeradius/3.0/certs/server.pem" ca_file = "/etc/freeradius/3.0/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "1.2" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } } The configuration allows TLS 1.0 and/or TLS 1.1. We STRONGLY recommned using only TLS 1.2 for security Please set: min_tls_version = "1.2" # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336 } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 auto_limit_acct = no } Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread 1 waiting to be assigned a request Thread spawned new child 3. Total threads in pool: 3 Thread 3 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread 4 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized radiusd: #### Opening IP addresses and Ports #### Thread 5 waiting to be assigned a request listen { type = "auth+acct" virtual_server = "default" ipaddr = * port = 1812 proto = "tcp" tls { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/server.key" certificate_file = "/etc/freeradius/3.0/certs/server.pem" ca_file = "/etc/freeradius/3.0/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 8192 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no require_client_cert = yes ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } } The configuration allows TLS 1.0 and/or TLS 1.1. We STRONGLY recommned using only TLS 1.2 for security Please set: min_tls_version = "1.2" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } clients = "radsec" client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> proto = "tls" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth+acct proto tcp address * port 1812 (TLS) bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 50021 Listening on proxy address :: port 47060 Ready to process requests Threads: total/active/spare threads = 5/0/5 Waking up in 0.3 seconds. Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) (0) Received Access-Request Id 66 from 192.168.2.2:34605 to 192.168.2.199:1812 length 164 (0) User-Name = "Test-Werkzeug" (0) NAS-Port = 0 (0) Called-Station-Id = "20-87-56-1A-5F-48:Test-RADIUS" (0) Calling-Station-Id = "60-09-C3-26-FA-51" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = "CONNECT 0Mbps 802.11b" (0) EAP-Message = 0x0264001201546573742d5765726b7a657567 (0) Message-Authenticator = 0xaddb56771b754e250436b9e99ac20a45 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "Test-Werkzeug", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 100 length 18 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_tls to process data (0) eap_tls: Initiating new TLS session (0) eap_tls: Setting verify mode to require certificate from client (0) eap_tls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 101 length 6 (0) eap: EAP session adding &reply:State = 0xeb0504a7eb6009c0 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 66 from 192.168.2.199:1812 to 192.168.2.2:34605 length 0 (0) EAP-Message = 0x016500060d20 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xeb0504a7eb6009c0660dc0bdca2881bc (0) Finished request Thread 1 waiting to be assigned a request Waking up in 0.3 seconds. Thread 3 got semaphore Thread 3 handling request 1, (1 handled so far) (1) Received Access-Request Id 67 from 192.168.2.2:34605 to 192.168.2.199:1812 length 224 (1) User-Name = "Test-Werkzeug" (1) NAS-Port = 0 (1) Called-Station-Id = "20-87-56-1A-5F-48:Test-RADIUS" (1) Calling-Station-Id = "60-09-C3-26-FA-51" (1) Framed-MTU = 1400 (1) NAS-Port-Type = Wireless-802.11 (1) Connect-Info = "CONNECT 0Mbps 802.11b" (1) EAP-Message = 0x0265003c0d0016030300310100002d03030000000053e42867166ab6e440ccee1366a9272d43c79739a0bb9679ab1c0d57000006003c002f000a0100 (1) State = 0xeb0504a7eb6009c0660dc0bdca2881bc (1) Message-Authenticator = 0x72fd5c33f5d2909fff13d4f086324996 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "Test-Werkzeug", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 101 length 60 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) files: users: Matched entry Test-Werkzeug at line 91 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xeb0504a7eb6009c0 (1) eap: Finished EAP session with state 0xeb0504a7eb6009c0 (1) eap: Previous EAP request found for state 0xeb0504a7eb6009c0, released from the list (1) eap: Peer sent packet with method EAP TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: Continuing EAP-TLS (1) eap_tls: Got final TLS record fragment (54 bytes) (1) eap_tls: WARNING: Total received TLS record fragments (54 bytes), does not equal indicated TLS record length (0 bytes) (1) eap_tls: [eaptls verify] = ok (1) eap_tls: Done initial handshake (1) eap_tls: (other): before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: <<< recv TLS 1.3 [length 0031] (1) eap_tls: >>> send TLS 1.2 [length 0002] (1) eap_tls: ERROR: TLS Alert write:fatal:internal error tls: TLS_accept: Error in error (1) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14201044:SSL routines:tls_choose_sigalg:internal error (1) eap_tls: ERROR: System call (I/O) error (-1) (1) eap_tls: ERROR: TLS receive handshake failed during operation (1) eap_tls: ERROR: [eaptls process] = fail (1) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (1) eap: Sending EAP Failure (code 4) ID 101 length 4 (1) eap: Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> Test-Werkzeug (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Thread 3 waiting to be assigned a request Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 67 from 192.168.2.199:1812 to 192.168.2.2:34605 length 44 (1) EAP-Message = 0x04650004 (1) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Thank you very much in advance, Kai

3 3

When and how to use the Auth-Type attribute
by Network RADIUS 24 Jan '22

24 Jan '22

** How to use the Auth-Type attribute --------------------------------------------- The FreeRADIUS Auth-Type attribute is often misunderstood and misused. There are actually very few situations where this attribute should be manipulated at all. ** Rule 1: Don’t use the Auth-Type Attribute This is the first rule and really, the only rule. If you’re unsure about whether or not you should use the Auth-Type attribute, you shouldn’t. Seriously. Just don’t. This article explains why. Read the full article… https://networkradius.com/articles/2021/10/08/freeradius-auth-type-attribut… ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

New blog article: FreeRADIUS and netbox
by Michael Schwartzkopff 24 Jan '22

24 Jan '22

Hi, as a proof of concept I tried to connect FreeRADIUS to a netbox. So all clients would be managed in the netbox. I documented my setup in my blog: https://blog.sys4.de/freeradius-clients-netbox-en.html Mit freundlichen Grüßen, -- [*] sys4 AG https://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG,80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief Aufsichtsratsvorsitzender: Florian Kirstein

1 0

Mac osx authentication problems
by Jure Simšič 23 Jan '22

23 Jan '22

Hi, we are implementing two wifi SSIDs with two different radius authentications - first is our internal net with local freeradius 3.0 and NTLM and this works without a problem. The other is eduroam with external radius and while testing we found out that Mac OsX users can't connect to it. They get a u/p and the cert popup but after that it seems to just hang and eventually timeout. I've contacted the external radius guys and they said they are still on freeradius 2.1. Could this be the cause of the problems? I know the general rule is to upgrade to 3 but as said it's not our radius. If someone had similar experience or knows it's a version issue I will have better arguments to convince them to upgrade (I hope). Thanks, Cheers, Jure

3 2

Freeradius with IPV6
by Bassem Mettichi 19 Jan '22

19 Jan '22

Hello, is it possible the combine IPV4 and IPV6 on the same freeradius server. Iam using redis as database, i would like to add new acct type called Start-IPV6 on the rediswho conf file and on rediswho.c when the acct request comes with Framed-IPV6-address i will use the conf section of Start-IPV6 instead of Start Section, is this configuration possible to do? Thanks in advance Bassem

2 3

Mailing list move
by Matthew Newton 19 Jan '22

19 Jan '22

At some point over the next week or so we're planning to migrate the FreeRADIUS mailing lists over to a different server. Apart from the possibility of mail being delayed a bit, hopefully nobody will notice much... -- Matthew

1 1

Autz-Type New-TLS-Connection : tcp sessions stalled in close_wait state
by Arnaud LAURIOU 18 Jan '22

18 Jan '22

Hi, I'm back to a topic from last summer: for RadSec, we would like to check clients certicate properties without an 'openssl verify' external command. So we try 'Autz-Type New-TLS-Connection'. TCP sessions rejected by the tls virtual server (certificate expired, TLS protocol version, no certificate, ...) are in TIME_WAIT state and associated socket seems to be in closing process. Fine. TCP sessions accepted by the tls virtual server and processed by 'Autz-Type New-TLS-Connection' seems to be stalled in CLOSE_WAIT state and we quickly reach the 'client max_connections' limit. Is the 'lifetime' parameter define for the client responsible of this behavior ? Even if Autz-Type New-TLS-Connection = reject ? With an external 'openssl verify', we don't have any tcp session in CLOSE_WAIT state. Here are the debug logs : FreeRADIUS Version 3.0.25 ... radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server default { # from file /etc/freeradius/sites-enabled/default # Loading authorize {...} Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type } # server default server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:335 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel server auth-reject { # from file /etc/freeradius/sites-enabled/auth-reject # Loading authorize {...} } # server auth-reject server monitoring { # from file /etc/freeradius/sites-enabled/monitoring # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type # Loading authorize {...} } # server monitoring thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 auto_limit_acct = no } Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread 1 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread 2 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread 3 waiting to be assigned a request Thread pool initialized radiusd: #### Opening IP addresses and Ports #### Thread 4 waiting to be assigned a request Thread 5 waiting to be assigned a request listen { type = "auth" virtual_server = "default" ipaddr = 194.57.7.78 port = 2083 proto = "tcp" tls { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/ix1-pv-u18-eduroamradiusnational-02.renater.fr-key.pem" certificate_file = "/etc/freeradius/certs/ix1-pv-u18-eduroamradiusnational-02.renater.fr.crt" ca_file = "/etc/freeradius/certs/eduPKICA.crt" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 8192 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no require_client_cert = yes reject_unknown_intermediate_ca = no ecdh_curve = "prime256v1" tls_max_version = "1.3" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no tmpdir = "/var/cache/freeradius" } ocsp { enable = yes override_cert_url = yes url = "http://ocsp.edupki.org/OCSP-Server/OCSP" use_nonce = no timeout = 0 softfail = yes } } check_client_connections = yes limit { max_connections = 32 lifetime = 0 idle_timeout = 30 } clients = "radsec" client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> proto = "tls" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client others-radsec-client { ipaddr = * require_message_authenticator = no secret = <<< secret >>> proto = "tls" limit { max_connections = 32 lifetime = 0 idle_timeout = 30 } } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth proto tcp address 194.57.7.78 port 2083 (TLS) bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 34023 Ready to process requests ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48448) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.1 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48448 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48448) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.9 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48452) -> (194.57.7.78, 2083, virtual-server=default) (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1ee403d633fa3f40dfc949f6" (0) TLS-Client-Cert-Expiration := "230403080110Z" (0) TLS-Client-Cert-Valid-Since := "180404080110Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Email := "monitor(a)eduroam.org" (0) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, TLS Web Server Authentication" (0) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "82:3E:E7:DE:31:73:F6:6D:A5:C9:FE:AE:DC:21:93:7E:F4:03:5B:F5" (0) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:D2:F2:23:BD:4A:A1:7F:CF:A0:58:84:EB:FC:E6:5B:08:B3:CD:B4:E4\n" (0) TLS-Client-Cert-X509v3-Certificate-Policies += "Policy: 1.3.6.1.4.1.27262.1.13.1.1\nPolicy: 1.3.6.1.4.1.27262.1.13.1.1.1.4\nPolicy: 1.3.6.1.4.1.25178.3.1.1\nPolicy: 1.3.6.1.4.1.25178.3.1.2\nPolicy: 1.3.6.1.4.1.27262.1.13.2.1.1.7\n" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.1" Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /DC=org/DC=edupki/CN=eduPKI CA G 01 (TLS) untrusted certificate with depth [0] subject name /DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org (0) Starting OCSP Request (0) ocsp: Using responder URL "http://ocsp.edupki.org:80/OCSP-Server/OCSP" This Update: Jan 13 05:42:04 2022 GMT Next Update: Jan 20 05:42:04 2022 GMT (0) ocsp: Cert status: good (0) ocsp: Certificate is valid (0) (TLS) Handshake state - Server SSLv3/TLS read client certificate (0) (TLS) recv TLS 1.2 Handshake, ClientKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS read client key exchange (0) (TLS) recv TLS 1.2 Handshake, CertificateVerify (0) (TLS) Handshake state - Server SSLv3/TLS read certificate verify (0) (TLS) Handshake state - Server SSLv3/TLS read change cipher spec (0) (TLS) recv TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS read finished (0) (TLS) send TLS 1.2 ChangeCipherSpec (0) (TLS) Handshake state - Server SSLv3/TLS write change cipher spec (0) (TLS) send TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS write finished (0) (TLS) Handshake state - SSL negotiation finished successfully (0) (TLS) Connection Established (0) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (0) TLS-Session-Version = "TLS 1.2" Waking up in 2.8 seconds. Threads: total/active/spare threads = 5/0/5 Thread 4 got semaphore Thread 4 handling request 0, (1 handled so far) (0) (TLS) Checking connection to see if it is authorized. (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Autz-Type New-TLS-Connection { (0) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (0) EXPAND %{TLS-Client-Cert-X509v3-Certificate-Policies} (0) --> Policy: 1.3.6.1.4.1.27262.1.13.1.1 Policy: 1.3.6.1.4.1.27262.1.13.1.1.1.4 Policy: 1.3.6.1.4.1.25178.3.1.1 Policy: 1.3.6.1.4.1.25178.3.1.2 Policy: 1.3.6.1.4.1.27262.1.13.2.1.1.7 (0) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) -> TRUE (0) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (0) [ok] = ok (0) } # if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) = ok (0) ... skipping else: Preceding "if" was taken (0) } # Autz-Type New-TLS-Connection = ok (0) (TLS) Connection is authorized (0) Sent Access-Accept Id 4294967295 from 194.57.7.78:2083 to 145.100.191.84:48452 length 0 (0) Finished request Thread 4 waiting to be assigned a request Waking up in 0.3 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48462) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.2 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.2 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1ee403d8e5301110403e8ae6" (0) TLS-Client-Cert-Expiration := "230403080112Z" (0) TLS-Client-Cert-Valid-Since := "180404080112Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Email := "monitor(a)eduroam.org" (0) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, TLS Web Server Authentication" (0) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "71:52:CB:61:81:12:A1:83:89:56:89:70:07:19:35:DA:D6:8C:78:9F" (0) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:D2:F2:23:BD:4A:A1:7F:CF:A0:58:84:EB:FC:E6:5B:08:B3:CD:B4:E4\n" (0) TLS-Client-Cert-X509v3-Certificate-Policies += "Policy: 1.3.6.1.4.1.27262.1.13.1.1\nPolicy: 1.3.6.1.4.1.27262.1.13.1.1.1.4\nPolicy: 1.3.6.1.4.1.25178.3.1.2\nPolicy: 1.3.6.1.4.1.27262.1.13.2.1.1.7\n" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.1" Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /DC=org/DC=edupki/CN=eduPKI CA G 01 (TLS) untrusted certificate with depth [0] subject name /DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org (0) Starting OCSP Request (0) ocsp: Using responder URL "http://ocsp.edupki.org:80/OCSP-Server/OCSP" This Update: Jan 13 02:04:27 2022 GMT Next Update: Jan 20 02:04:27 2022 GMT (0) ocsp: Cert status: good (0) ocsp: Certificate is valid (0) (TLS) Handshake state - Server SSLv3/TLS read client certificate (0) (TLS) recv TLS 1.2 Handshake, ClientKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS read client key exchange (0) (TLS) recv TLS 1.2 Handshake, CertificateVerify (0) (TLS) Handshake state - Server SSLv3/TLS read certificate verify (0) (TLS) Handshake state - Server SSLv3/TLS read change cipher spec (0) (TLS) recv TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS read finished (0) (TLS) send TLS 1.2 ChangeCipherSpec (0) (TLS) Handshake state - Server SSLv3/TLS write change cipher spec (0) (TLS) send TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS write finished (0) (TLS) Handshake state - SSL negotiation finished successfully (0) (TLS) Connection Established (0) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (0) TLS-Session-Version = "TLS 1.2" Waking up in 0.1 seconds. Thread 5 got semaphore Thread 5 handling request 1, (1 handled so far) (1) (TLS) Checking connection to see if it is authorized. (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Autz-Type New-TLS-Connection { (1) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (1) EXPAND %{TLS-Client-Cert-X509v3-Certificate-Policies} (1) --> Policy: 1.3.6.1.4.1.27262.1.13.1.1 Policy: 1.3.6.1.4.1.27262.1.13.1.1.1.4 Policy: 1.3.6.1.4.1.25178.3.1.2 Policy: 1.3.6.1.4.1.27262.1.13.2.1.1.7 (1) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) -> FALSE (1) else { (1) update request { (1) &Module-Failure-Message += "Your certificate policy does not contain eduroam SP OID" (1) } # update request = noop (1) [reject] = reject (1) } # else = reject (1) } # Autz-Type New-TLS-Connection = reject (1) WARNING: (TLS) Connection is not authorized - closing TCP socket. (1) Sent Access-Reject Id 4294967295 from 194.57.7.78:2083 to 145.100.191.84:48462 length 0 (1) Finished request Thread 5 waiting to be assigned a request Waking up in 0.1 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48476) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.1 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1469696cfe7d84" (0) TLS-Client-Cert-Expiration := "120908124308Z" (0) TLS-Client-Cert-Valid-Since := "120907124308Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=PL/O=Uniwersytet Mikolaja Kopernika/CN=test-bogus-2.cat.eduroam.pl" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "test-bogus-2.cat.eduroam.pl" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "test-bogus-2.cat.eduroam.pl" (0) ERROR: (TLS) OpenSSL says error 10 : certificate has expired (0) (TLS) send TLS 1.2 Alert, fatal certificate_expired (0) ERROR: (TLS) Alert write:fatal:certificate expired (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48476 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48476) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48480) -> (194.57.7.78, 2083, virtual-server=default) (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1ee403d708c743865c7d7cab" (0) TLS-Client-Cert-Expiration := "230403080111Z" (0) TLS-Client-Cert-Valid-Since := "180404080111Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Email := "monitor(a)eduroam.org" (0) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, TLS Web Server Authentication" (0) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "62:93:8D:BD:FA:7A:FA:42:34:A6:4D:7C:CB:8A:F6:89:15:1A:EF:69" (0) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:D2:F2:23:BD:4A:A1:7F:CF:A0:58:84:EB:FC:E6:5B:08:B3:CD:B4:E4\n" (0) TLS-Client-Cert-X509v3-Certificate-Policies += "Policy: 1.3.6.1.4.1.27262.1.13.1.1\nPolicy: 1.3.6.1.4.1.27262.1.13.1.1.1.4\nPolicy: 1.3.6.1.4.1.25178.3.1.1\nPolicy: 1.3.6.1.4.1.25178.3.1.2\nPolicy: 1.3.6.1.4.1.27262.1.13.2.1.1.7\n" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.1" Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /DC=org/DC=edupki/CN=eduPKI CA G 01 (TLS) untrusted certificate with depth [0] subject name /DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org (0) Starting OCSP Request (0) ocsp: Using responder URL "http://ocsp.edupki.org:80/OCSP-Server/OCSP" This Update: Jan 13 05:14:45 2022 GMT Next Update: Jan 20 05:14:45 2022 GMT (0) ERROR: ocsp: Cert status: revoked Revocation Time: Apr 4 08:03:09 2018 GMT (0) ERROR: (TLS) ocsp: Certificate has been expired/revoked (0) (TLS) send TLS 1.2 Alert, fatal internal_error (0) ERROR: (TLS) Alert write:fatal:internal error (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48480 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48480) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48490) -> (194.57.7.78, 2083, virtual-server=default) (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "01" (0) TLS-Client-Cert-Expiration := "230317094729Z" (0) TLS-Client-Cert-Valid-Since := "130319094729Z" (0) TLS-Client-Cert-Subject := "/C=HR/ST=Zagreb/L=Zagreb/O=Srce test/OU=eduroam/CN=mali.pero.eduroam.hr" (0) TLS-Client-Cert-Issuer := "/C=HR/ST=Zagreb/L=Zagreb/O=Srce test/OU=eduroam/CN=CA Root certificate dc=hr/dc=eduroam/dc=MaliPero PKI 1" (0) TLS-Client-Cert-Common-Name := "mali.pero.eduroam.hr" (0) ERROR: (TLS) OpenSSL says error 20 : unable to get local issuer certificate (0) (TLS) send TLS 1.2 Alert, fatal unknown_ca (0) ERROR: (TLS) Alert write:fatal:unknown CA (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48490 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48490) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.4 seconds. Waking up in 1.9 seconds. ... cleaning up socket auth from client (145.100.191.84, 48448) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.3 seconds. ... cleaning up socket auth from client (145.100.191.84, 48476) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. ... cleaning up socket auth from client (145.100.191.84, 48480) -> (194.57.7.78, 2083, virtual-server=default) ... cleaning up socket auth from client (145.100.191.84, 48490) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 1.5 seconds. (0) Cleaning up request packet ID 4294967295 with timestamp +57 Waking up in 0.1 seconds. (1) Cleaning up request packet ID 4294967295 with timestamp +57 Waking up in 24.2 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48886) -> (194.57.7.78, 2083, virtual-server=default) (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Application data. (0) (TLS) OpenSSL says that the TLS session is still negotiating, but there's no more data to send! (TLS) Closing socket from client port 48886 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48886) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.9 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48888) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.9 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.9 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "01" (0) TLS-Client-Cert-Expiration := "230317094729Z" (0) TLS-Client-Cert-Valid-Since := "130319094729Z" (0) TLS-Client-Cert-Subject := "/C=HR/ST=Zagreb/L=Zagreb/O=Srce test/OU=eduroam/CN=mali.pero.eduroam.hr" (0) TLS-Client-Cert-Issuer := "/C=HR/ST=Zagreb/L=Zagreb/O=Srce test/OU=eduroam/CN=CA Root certificate dc=hr/dc=eduroam/dc=MaliPero PKI 1" (0) TLS-Client-Cert-Common-Name := "mali.pero.eduroam.hr" (0) ERROR: (TLS) OpenSSL says error 20 : unable to get local issuer certificate (0) (TLS) send TLS 1.2 Alert, fatal unknown_ca (0) ERROR: (TLS) Alert write:fatal:unknown CA (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48888 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48888) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.9 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48892) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.8 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.8 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48892 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48892) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.8 seconds. ... cleaning up socket auth from client (145.100.191.84, 48886) -> (194.57.7.78, 2083, virtual-server=default) ... cleaning up socket auth from client (145.100.191.84, 48888) -> (194.57.7.78, 2083, virtual-server=default) ... cleaning up socket auth from client (145.100.191.84, 48892) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 8.3 seconds. Ready to process requests ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 49646) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.6 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.6 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 49646 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 49646) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.9 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 49684) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.2 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.2 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1ee403d633fa3f40dfc949f6" (0) TLS-Client-Cert-Expiration := "230403080110Z" (0) TLS-Client-Cert-Valid-Since := "180404080110Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Email := "monitor(a)eduroam.org" (0) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, TLS Web Server Authentication" (0) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "82:3E:E7:DE:31:73:F6:6D:A5:C9:FE:AE:DC:21:93:7E:F4:03:5B:F5" (0) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:D2:F2:23:BD:4A:A1:7F:CF:A0:58:84:EB:FC:E6:5B:08:B3:CD:B4:E4\n" (0) TLS-Client-Cert-X509v3-Certificate-Policies += "Policy: 1.3.6.1.4.1.27262.1.13.1.1\nPolicy: 1.3.6.1.4.1.27262.1.13.1.1.1.4\nPolicy: 1.3.6.1.4.1.25178.3.1.1\nPolicy: 1.3.6.1.4.1.25178.3.1.2\nPolicy: 1.3.6.1.4.1.27262.1.13.2.1.1.7\n" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.1" Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /DC=org/DC=edupki/CN=eduPKI CA G 01 (TLS) untrusted certificate with depth [0] subject name /DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org (0) Starting OCSP Request (0) ocsp: Using responder URL "http://ocsp.edupki.org:80/OCSP-Server/OCSP" This Update: Jan 13 01:41:56 2022 GMT Next Update: Jan 20 01:41:56 2022 GMT (0) ocsp: Cert status: good (0) ocsp: Certificate is valid (0) (TLS) Handshake state - Server SSLv3/TLS read client certificate (0) (TLS) recv TLS 1.2 Handshake, ClientKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS read client key exchange (0) (TLS) recv TLS 1.2 Handshake, CertificateVerify (0) (TLS) Handshake state - Server SSLv3/TLS read certificate verify (0) (TLS) Handshake state - Server SSLv3/TLS read change cipher spec (0) (TLS) recv TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS read finished (0) (TLS) send TLS 1.2 ChangeCipherSpec (0) (TLS) Handshake state - Server SSLv3/TLS write change cipher spec (0) (TLS) send TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS write finished (0) (TLS) Handshake state - SSL negotiation finished successfully (0) (TLS) Connection Established (0) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (0) TLS-Session-Version = "TLS 1.2" Waking up in 0.1 seconds. Thread 3 got semaphore Thread 3 handling request 2, (1 handled so far) (2) (TLS) Checking connection to see if it is authorized. (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) Autz-Type New-TLS-Connection { (2) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (2) EXPAND %{TLS-Client-Cert-X509v3-Certificate-Policies} (2) --> Policy: 1.3.6.1.4.1.27262.1.13.1.1 Policy: 1.3.6.1.4.1.27262.1.13.1.1.1.4 Policy: 1.3.6.1.4.1.25178.3.1.1 Policy: 1.3.6.1.4.1.25178.3.1.2 Policy: 1.3.6.1.4.1.27262.1.13.2.1.1.7 (2) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) -> TRUE (2) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (2) [ok] = ok (2) } # if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) = ok (2) ... skipping else: Preceding "if" was taken (2) } # Autz-Type New-TLS-Connection = ok (2) (TLS) Connection is authorized (2) Sent Access-Accept Id 4294967295 from 194.57.7.78:2083 to 145.100.191.84:49684 length 0 (2) Finished request Thread 3 waiting to be assigned a request ... new connection request on TCP socket Regards, Arnaud

2 2

FR GGSN support
by Can Paçacı 18 Jan '22

18 Jan '22

Hi, Does Freeradius support authentication for mobile subscribers? Does it will respond to the Authentication and Accounting requests from the corporate GGSN? As I know for 3g gsm it is ok but what about for 4g and 5g compatibility? Regards

2 1

Which protocols work with which authentication systems?
by Network RADIUS 17 Jan '22

17 Jan '22

** Authentication systems and protocol compatibility --------------------------------------------- Not all authentication protocols work with all authentication systems. In many network configurations, there will be some transactions for which the RADIUS server will not perform the authentication itself, but simply pass credentials to a third party system and rely on the pass/fail response it gets from that system. Unfortunately, not all of these authentication systems work with all password storage formats. In these scenarios, it is important to realize that the incompatibility is between the authentication system and the password format, not the RADIUS system. This article walks explains which protocols work with which authentication systems. We also discuss the implications of an incompatibility. Read the full article… https://networkradius.com/articles/2021/10/08/authentication-system-and-pro… <https://networkradius.com/articles/2021/10/08/authentication-system-and-pro…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Docker Defaulting to Debug Mode
by Norman Elton 14 Jan '22

14 Jan '22

Looking at the Dockerfile published with FreeRADIUS: CMD ["/opt/freeradius/sbin/radiusd", "-X"] I seem to recall that -X is not advisable for production environments. Is that still the case? If so, I'll switch to running with "-f" to keep the process from forking. Thanks Norman

2 1