- Freeradius-Users - lists.freeradius.org

Autz-Type New-TLS-Connection : tcp sessions stalled in close_wait state
by Arnaud LAURIOU 18 Jan '22

18 Jan '22

Hi, I'm back to a topic from last summer: for RadSec, we would like to check clients certicate properties without an 'openssl verify' external command. So we try 'Autz-Type New-TLS-Connection'. TCP sessions rejected by the tls virtual server (certificate expired, TLS protocol version, no certificate, ...) are in TIME_WAIT state and associated socket seems to be in closing process. Fine. TCP sessions accepted by the tls virtual server and processed by 'Autz-Type New-TLS-Connection' seems to be stalled in CLOSE_WAIT state and we quickly reach the 'client max_connections' limit. Is the 'lifetime' parameter define for the client responsible of this behavior ? Even if Autz-Type New-TLS-Connection = reject ? With an external 'openssl verify', we don't have any tcp session in CLOSE_WAIT state. Here are the debug logs : FreeRADIUS Version 3.0.25 ... radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server default { # from file /etc/freeradius/sites-enabled/default # Loading authorize {...} Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type } # server default server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:335 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel server auth-reject { # from file /etc/freeradius/sites-enabled/auth-reject # Loading authorize {...} } # server auth-reject server monitoring { # from file /etc/freeradius/sites-enabled/monitoring # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type # Loading authorize {...} } # server monitoring thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 auto_limit_acct = no } Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread 1 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread 2 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread 3 waiting to be assigned a request Thread pool initialized radiusd: #### Opening IP addresses and Ports #### Thread 4 waiting to be assigned a request Thread 5 waiting to be assigned a request listen { type = "auth" virtual_server = "default" ipaddr = 194.57.7.78 port = 2083 proto = "tcp" tls { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/ix1-pv-u18-eduroamradiusnational-02.renater.fr-key.pem" certificate_file = "/etc/freeradius/certs/ix1-pv-u18-eduroamradiusnational-02.renater.fr.crt" ca_file = "/etc/freeradius/certs/eduPKICA.crt" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 8192 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no require_client_cert = yes reject_unknown_intermediate_ca = no ecdh_curve = "prime256v1" tls_max_version = "1.3" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no tmpdir = "/var/cache/freeradius" } ocsp { enable = yes override_cert_url = yes url = "http://ocsp.edupki.org/OCSP-Server/OCSP" use_nonce = no timeout = 0 softfail = yes } } check_client_connections = yes limit { max_connections = 32 lifetime = 0 idle_timeout = 30 } clients = "radsec" client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> proto = "tls" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client others-radsec-client { ipaddr = * require_message_authenticator = no secret = <<< secret >>> proto = "tls" limit { max_connections = 32 lifetime = 0 idle_timeout = 30 } } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth proto tcp address 194.57.7.78 port 2083 (TLS) bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 34023 Ready to process requests ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48448) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.1 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48448 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48448) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.9 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48452) -> (194.57.7.78, 2083, virtual-server=default) (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1ee403d633fa3f40dfc949f6" (0) TLS-Client-Cert-Expiration := "230403080110Z" (0) TLS-Client-Cert-Valid-Since := "180404080110Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Email := "monitor(a)eduroam.org" (0) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, TLS Web Server Authentication" (0) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "82:3E:E7:DE:31:73:F6:6D:A5:C9:FE:AE:DC:21:93:7E:F4:03:5B:F5" (0) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:D2:F2:23:BD:4A:A1:7F:CF:A0:58:84:EB:FC:E6:5B:08:B3:CD:B4:E4\n" (0) TLS-Client-Cert-X509v3-Certificate-Policies += "Policy: 1.3.6.1.4.1.27262.1.13.1.1\nPolicy: 1.3.6.1.4.1.27262.1.13.1.1.1.4\nPolicy: 1.3.6.1.4.1.25178.3.1.1\nPolicy: 1.3.6.1.4.1.25178.3.1.2\nPolicy: 1.3.6.1.4.1.27262.1.13.2.1.1.7\n" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.1" Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /DC=org/DC=edupki/CN=eduPKI CA G 01 (TLS) untrusted certificate with depth [0] subject name /DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org (0) Starting OCSP Request (0) ocsp: Using responder URL "http://ocsp.edupki.org:80/OCSP-Server/OCSP" This Update: Jan 13 05:42:04 2022 GMT Next Update: Jan 20 05:42:04 2022 GMT (0) ocsp: Cert status: good (0) ocsp: Certificate is valid (0) (TLS) Handshake state - Server SSLv3/TLS read client certificate (0) (TLS) recv TLS 1.2 Handshake, ClientKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS read client key exchange (0) (TLS) recv TLS 1.2 Handshake, CertificateVerify (0) (TLS) Handshake state - Server SSLv3/TLS read certificate verify (0) (TLS) Handshake state - Server SSLv3/TLS read change cipher spec (0) (TLS) recv TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS read finished (0) (TLS) send TLS 1.2 ChangeCipherSpec (0) (TLS) Handshake state - Server SSLv3/TLS write change cipher spec (0) (TLS) send TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS write finished (0) (TLS) Handshake state - SSL negotiation finished successfully (0) (TLS) Connection Established (0) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (0) TLS-Session-Version = "TLS 1.2" Waking up in 2.8 seconds. Threads: total/active/spare threads = 5/0/5 Thread 4 got semaphore Thread 4 handling request 0, (1 handled so far) (0) (TLS) Checking connection to see if it is authorized. (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Autz-Type New-TLS-Connection { (0) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (0) EXPAND %{TLS-Client-Cert-X509v3-Certificate-Policies} (0) --> Policy: 1.3.6.1.4.1.27262.1.13.1.1 Policy: 1.3.6.1.4.1.27262.1.13.1.1.1.4 Policy: 1.3.6.1.4.1.25178.3.1.1 Policy: 1.3.6.1.4.1.25178.3.1.2 Policy: 1.3.6.1.4.1.27262.1.13.2.1.1.7 (0) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) -> TRUE (0) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (0) [ok] = ok (0) } # if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) = ok (0) ... skipping else: Preceding "if" was taken (0) } # Autz-Type New-TLS-Connection = ok (0) (TLS) Connection is authorized (0) Sent Access-Accept Id 4294967295 from 194.57.7.78:2083 to 145.100.191.84:48452 length 0 (0) Finished request Thread 4 waiting to be assigned a request Waking up in 0.3 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48462) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.2 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.2 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1ee403d8e5301110403e8ae6" (0) TLS-Client-Cert-Expiration := "230403080112Z" (0) TLS-Client-Cert-Valid-Since := "180404080112Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Email := "monitor(a)eduroam.org" (0) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, TLS Web Server Authentication" (0) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "71:52:CB:61:81:12:A1:83:89:56:89:70:07:19:35:DA:D6:8C:78:9F" (0) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:D2:F2:23:BD:4A:A1:7F:CF:A0:58:84:EB:FC:E6:5B:08:B3:CD:B4:E4\n" (0) TLS-Client-Cert-X509v3-Certificate-Policies += "Policy: 1.3.6.1.4.1.27262.1.13.1.1\nPolicy: 1.3.6.1.4.1.27262.1.13.1.1.1.4\nPolicy: 1.3.6.1.4.1.25178.3.1.2\nPolicy: 1.3.6.1.4.1.27262.1.13.2.1.1.7\n" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.1" Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /DC=org/DC=edupki/CN=eduPKI CA G 01 (TLS) untrusted certificate with depth [0] subject name /DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org (0) Starting OCSP Request (0) ocsp: Using responder URL "http://ocsp.edupki.org:80/OCSP-Server/OCSP" This Update: Jan 13 02:04:27 2022 GMT Next Update: Jan 20 02:04:27 2022 GMT (0) ocsp: Cert status: good (0) ocsp: Certificate is valid (0) (TLS) Handshake state - Server SSLv3/TLS read client certificate (0) (TLS) recv TLS 1.2 Handshake, ClientKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS read client key exchange (0) (TLS) recv TLS 1.2 Handshake, CertificateVerify (0) (TLS) Handshake state - Server SSLv3/TLS read certificate verify (0) (TLS) Handshake state - Server SSLv3/TLS read change cipher spec (0) (TLS) recv TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS read finished (0) (TLS) send TLS 1.2 ChangeCipherSpec (0) (TLS) Handshake state - Server SSLv3/TLS write change cipher spec (0) (TLS) send TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS write finished (0) (TLS) Handshake state - SSL negotiation finished successfully (0) (TLS) Connection Established (0) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (0) TLS-Session-Version = "TLS 1.2" Waking up in 0.1 seconds. Thread 5 got semaphore Thread 5 handling request 1, (1 handled so far) (1) (TLS) Checking connection to see if it is authorized. (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Autz-Type New-TLS-Connection { (1) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (1) EXPAND %{TLS-Client-Cert-X509v3-Certificate-Policies} (1) --> Policy: 1.3.6.1.4.1.27262.1.13.1.1 Policy: 1.3.6.1.4.1.27262.1.13.1.1.1.4 Policy: 1.3.6.1.4.1.25178.3.1.2 Policy: 1.3.6.1.4.1.27262.1.13.2.1.1.7 (1) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) -> FALSE (1) else { (1) update request { (1) &Module-Failure-Message += "Your certificate policy does not contain eduroam SP OID" (1) } # update request = noop (1) [reject] = reject (1) } # else = reject (1) } # Autz-Type New-TLS-Connection = reject (1) WARNING: (TLS) Connection is not authorized - closing TCP socket. (1) Sent Access-Reject Id 4294967295 from 194.57.7.78:2083 to 145.100.191.84:48462 length 0 (1) Finished request Thread 5 waiting to be assigned a request Waking up in 0.1 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48476) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.1 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1469696cfe7d84" (0) TLS-Client-Cert-Expiration := "120908124308Z" (0) TLS-Client-Cert-Valid-Since := "120907124308Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=PL/O=Uniwersytet Mikolaja Kopernika/CN=test-bogus-2.cat.eduroam.pl" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "test-bogus-2.cat.eduroam.pl" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "test-bogus-2.cat.eduroam.pl" (0) ERROR: (TLS) OpenSSL says error 10 : certificate has expired (0) (TLS) send TLS 1.2 Alert, fatal certificate_expired (0) ERROR: (TLS) Alert write:fatal:certificate expired (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48476 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48476) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48480) -> (194.57.7.78, 2083, virtual-server=default) (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1ee403d708c743865c7d7cab" (0) TLS-Client-Cert-Expiration := "230403080111Z" (0) TLS-Client-Cert-Valid-Since := "180404080111Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Email := "monitor(a)eduroam.org" (0) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, TLS Web Server Authentication" (0) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "62:93:8D:BD:FA:7A:FA:42:34:A6:4D:7C:CB:8A:F6:89:15:1A:EF:69" (0) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:D2:F2:23:BD:4A:A1:7F:CF:A0:58:84:EB:FC:E6:5B:08:B3:CD:B4:E4\n" (0) TLS-Client-Cert-X509v3-Certificate-Policies += "Policy: 1.3.6.1.4.1.27262.1.13.1.1\nPolicy: 1.3.6.1.4.1.27262.1.13.1.1.1.4\nPolicy: 1.3.6.1.4.1.25178.3.1.1\nPolicy: 1.3.6.1.4.1.25178.3.1.2\nPolicy: 1.3.6.1.4.1.27262.1.13.2.1.1.7\n" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.1" Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /DC=org/DC=edupki/CN=eduPKI CA G 01 (TLS) untrusted certificate with depth [0] subject name /DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org (0) Starting OCSP Request (0) ocsp: Using responder URL "http://ocsp.edupki.org:80/OCSP-Server/OCSP" This Update: Jan 13 05:14:45 2022 GMT Next Update: Jan 20 05:14:45 2022 GMT (0) ERROR: ocsp: Cert status: revoked Revocation Time: Apr 4 08:03:09 2018 GMT (0) ERROR: (TLS) ocsp: Certificate has been expired/revoked (0) (TLS) send TLS 1.2 Alert, fatal internal_error (0) ERROR: (TLS) Alert write:fatal:internal error (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48480 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48480) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48490) -> (194.57.7.78, 2083, virtual-server=default) (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "01" (0) TLS-Client-Cert-Expiration := "230317094729Z" (0) TLS-Client-Cert-Valid-Since := "130319094729Z" (0) TLS-Client-Cert-Subject := "/C=HR/ST=Zagreb/L=Zagreb/O=Srce test/OU=eduroam/CN=mali.pero.eduroam.hr" (0) TLS-Client-Cert-Issuer := "/C=HR/ST=Zagreb/L=Zagreb/O=Srce test/OU=eduroam/CN=CA Root certificate dc=hr/dc=eduroam/dc=MaliPero PKI 1" (0) TLS-Client-Cert-Common-Name := "mali.pero.eduroam.hr" (0) ERROR: (TLS) OpenSSL says error 20 : unable to get local issuer certificate (0) (TLS) send TLS 1.2 Alert, fatal unknown_ca (0) ERROR: (TLS) Alert write:fatal:unknown CA (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48490 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48490) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.4 seconds. Waking up in 1.9 seconds. ... cleaning up socket auth from client (145.100.191.84, 48448) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.3 seconds. ... cleaning up socket auth from client (145.100.191.84, 48476) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.1 seconds. ... cleaning up socket auth from client (145.100.191.84, 48480) -> (194.57.7.78, 2083, virtual-server=default) ... cleaning up socket auth from client (145.100.191.84, 48490) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 1.5 seconds. (0) Cleaning up request packet ID 4294967295 with timestamp +57 Waking up in 0.1 seconds. (1) Cleaning up request packet ID 4294967295 with timestamp +57 Waking up in 24.2 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48886) -> (194.57.7.78, 2083, virtual-server=default) (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase (0) (TLS) Application data. (0) (TLS) OpenSSL says that the TLS session is still negotiating, but there's no more data to send! (TLS) Closing socket from client port 48886 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48886) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.9 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48888) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.9 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.9 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "01" (0) TLS-Client-Cert-Expiration := "230317094729Z" (0) TLS-Client-Cert-Valid-Since := "130319094729Z" (0) TLS-Client-Cert-Subject := "/C=HR/ST=Zagreb/L=Zagreb/O=Srce test/OU=eduroam/CN=mali.pero.eduroam.hr" (0) TLS-Client-Cert-Issuer := "/C=HR/ST=Zagreb/L=Zagreb/O=Srce test/OU=eduroam/CN=CA Root certificate dc=hr/dc=eduroam/dc=MaliPero PKI 1" (0) TLS-Client-Cert-Common-Name := "mali.pero.eduroam.hr" (0) ERROR: (TLS) OpenSSL says error 20 : unable to get local issuer certificate (0) (TLS) send TLS 1.2 Alert, fatal unknown_ca (0) ERROR: (TLS) Alert write:fatal:unknown CA (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48888 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48888) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.9 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 48892) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.8 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.8 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 48892 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 48892) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.8 seconds. ... cleaning up socket auth from client (145.100.191.84, 48886) -> (194.57.7.78, 2083, virtual-server=default) ... cleaning up socket auth from client (145.100.191.84, 48888) -> (194.57.7.78, 2083, virtual-server=default) ... cleaning up socket auth from client (145.100.191.84, 48892) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 8.3 seconds. Ready to process requests ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 49646) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.6 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.6 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) send TLS 1.2 Alert, fatal handshake_failure (0) ERROR: (TLS) Alert write:fatal:handshake failure (0) ERROR: (TLS) Server : Error in error (0) ERROR: (TLS) Failed reading from OpenSSL: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate (0) ERROR: (TLS) System call (I/O) error (-1) (0) (TLS) Failed in TLS handshake receive (TLS) Closing socket from client port 49646 (TLS) Client has closed connection ... shutting down socket auth from client (145.100.191.84, 49646) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 2.9 seconds. ... new connection request on TCP socket Listening on auth from client (145.100.191.84, 49684) -> (194.57.7.78, 2083, virtual-server=default) Waking up in 0.2 seconds. (0) (TLS) Initiating new session (0) (TLS) Setting verify mode to require certificate from client (0) (TLS) Handshake state - before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) Handshake state - Server before SSL initialization (0) (TLS) recv TLS 1.3 Handshake, ClientHello (0) (TLS) Handshake state - Server SSLv3/TLS read client hello (0) (TLS) send TLS 1.2 Handshake, ServerHello (0) (TLS) Handshake state - Server SSLv3/TLS write server hello (0) (TLS) send TLS 1.2 Handshake, Certificate (0) (TLS) Handshake state - Server SSLv3/TLS write certificate (0) (TLS) send TLS 1.2 Handshake, ServerKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS write key exchange (0) (TLS) send TLS 1.2 Handshake, CertificateRequest (0) (TLS) Handshake state - Server SSLv3/TLS write certificate request (0) (TLS) send TLS 1.2 Handshake, ServerHelloDone (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) Server : Need to read more data: SSLv3/TLS write server done (0) (TLS) In Handshake Phase Waking up in 0.2 seconds. (0) (TLS) Handshake state - Server SSLv3/TLS write server done (0) (TLS) recv TLS 1.2 Handshake, Certificate (0) (TLS) Creating attributes from server certificate (0) TLS-Cert-Serial := "01" (0) TLS-Cert-Expiration := "301103101536Z" (0) TLS-Cert-Valid-Since := "101108101536Z" (0) TLS-Cert-Subject := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Cert-Common-Name := "eduPKI CA G 01" (0) (TLS) Creating attributes from client certificate (0) TLS-Client-Cert-Serial := "1ee403d633fa3f40dfc949f6" (0) TLS-Client-Cert-Expiration := "230403080110Z" (0) TLS-Client-Cert-Valid-Since := "180404080110Z" (0) TLS-Client-Cert-Subject := "/DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org" (0) TLS-Client-Cert-Issuer := "/DC=org/DC=edupki/CN=eduPKI CA G 01" (0) TLS-Client-Cert-Common-Name := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Dns := "cat.eduroam.org" (0) TLS-Client-Cert-Subject-Alt-Name-Email := "monitor(a)eduroam.org" (0) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, TLS Web Server Authentication" (0) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "82:3E:E7:DE:31:73:F6:6D:A5:C9:FE:AE:DC:21:93:7E:F4:03:5B:F5" (0) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:D2:F2:23:BD:4A:A1:7F:CF:A0:58:84:EB:FC:E6:5B:08:B3:CD:B4:E4\n" (0) TLS-Client-Cert-X509v3-Certificate-Policies += "Policy: 1.3.6.1.4.1.27262.1.13.1.1\nPolicy: 1.3.6.1.4.1.27262.1.13.1.1.1.4\nPolicy: 1.3.6.1.4.1.25178.3.1.1\nPolicy: 1.3.6.1.4.1.25178.3.1.2\nPolicy: 1.3.6.1.4.1.27262.1.13.2.1.1.7\n" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (0) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.1" Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /DC=org/DC=edupki/CN=eduPKI CA G 01 (TLS) untrusted certificate with depth [0] subject name /DC=net/DC=geant/DC=eduroam/C=HR/O=University of Zagreb University Computing Centre/CN=cat.eduroam.org (0) Starting OCSP Request (0) ocsp: Using responder URL "http://ocsp.edupki.org:80/OCSP-Server/OCSP" This Update: Jan 13 01:41:56 2022 GMT Next Update: Jan 20 01:41:56 2022 GMT (0) ocsp: Cert status: good (0) ocsp: Certificate is valid (0) (TLS) Handshake state - Server SSLv3/TLS read client certificate (0) (TLS) recv TLS 1.2 Handshake, ClientKeyExchange (0) (TLS) Handshake state - Server SSLv3/TLS read client key exchange (0) (TLS) recv TLS 1.2 Handshake, CertificateVerify (0) (TLS) Handshake state - Server SSLv3/TLS read certificate verify (0) (TLS) Handshake state - Server SSLv3/TLS read change cipher spec (0) (TLS) recv TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS read finished (0) (TLS) send TLS 1.2 ChangeCipherSpec (0) (TLS) Handshake state - Server SSLv3/TLS write change cipher spec (0) (TLS) send TLS 1.2 Handshake, Finished (0) (TLS) Handshake state - Server SSLv3/TLS write finished (0) (TLS) Handshake state - SSL negotiation finished successfully (0) (TLS) Connection Established (0) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (0) TLS-Session-Version = "TLS 1.2" Waking up in 0.1 seconds. Thread 3 got semaphore Thread 3 handling request 2, (1 handled so far) (2) (TLS) Checking connection to see if it is authorized. (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) Autz-Type New-TLS-Connection { (2) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (2) EXPAND %{TLS-Client-Cert-X509v3-Certificate-Policies} (2) --> Policy: 1.3.6.1.4.1.27262.1.13.1.1 Policy: 1.3.6.1.4.1.27262.1.13.1.1.1.4 Policy: 1.3.6.1.4.1.25178.3.1.1 Policy: 1.3.6.1.4.1.25178.3.1.2 Policy: 1.3.6.1.4.1.27262.1.13.2.1.1.7 (2) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) -> TRUE (2) if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) { (2) [ok] = ok (2) } # if ("%{TLS-Client-Cert-X509v3-Certificate-Policies}" =~ /1\.3\.6\.1\.4\.1\.25178\.3\.1\.1/) = ok (2) ... skipping else: Preceding "if" was taken (2) } # Autz-Type New-TLS-Connection = ok (2) (TLS) Connection is authorized (2) Sent Access-Accept Id 4294967295 from 194.57.7.78:2083 to 145.100.191.84:49684 length 0 (2) Finished request Thread 3 waiting to be assigned a request ... new connection request on TCP socket Regards, Arnaud

2 2

FR GGSN support
by Can Paçacı 18 Jan '22

18 Jan '22

Hi, Does Freeradius support authentication for mobile subscribers? Does it will respond to the Authentication and Accounting requests from the corporate GGSN? As I know for 3g gsm it is ok but what about for 4g and 5g compatibility? Regards

2 1

Which protocols work with which authentication systems?
by Network RADIUS 17 Jan '22

17 Jan '22

** Authentication systems and protocol compatibility --------------------------------------------- Not all authentication protocols work with all authentication systems. In many network configurations, there will be some transactions for which the RADIUS server will not perform the authentication itself, but simply pass credentials to a third party system and rely on the pass/fail response it gets from that system. Unfortunately, not all of these authentication systems work with all password storage formats. In these scenarios, it is important to realize that the incompatibility is between the authentication system and the password format, not the RADIUS system. This article walks explains which protocols work with which authentication systems. We also discuss the implications of an incompatibility. Read the full article… https://networkradius.com/articles/2021/10/08/authentication-system-and-pro… <https://networkradius.com/articles/2021/10/08/authentication-system-and-pro…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Docker Defaulting to Debug Mode
by Norman Elton 14 Jan '22

14 Jan '22

Looking at the Dockerfile published with FreeRADIUS: CMD ["/opt/freeradius/sbin/radiusd", "-X"] I seem to recall that -X is not advisable for production environments. Is that still the case? If so, I'll switch to running with "-f" to keep the process from forking. Thanks Norman

2 1

Python executable path empty through rlm_python and rlm_python3
by Allie Hammond 10 Jan '22

10 Jan '22

Hi! Running sys.executable in a Python script run through either rlm_python or rlm_python3 returns null - from what I can tell Python normally gets this information from argv[0](usually passed by the OS) and/or some environment variables. I've confirmed this works fine when the python script is run on it's own (not through FreeRADIUS). Is this a bug or is there a way to configure this? I need it to be set for a library we use. Thanks! -Allie

3 2

How to configure FreeRADIUS authentication with Active Directory
by Network RADIUS 10 Jan '22

10 Jan '22

** How to configure FreeRADIUS authentication with Active Directory --------------------------------------------- Active Directory is widely used in the Enterprise and University systems. However, because of proprietary design decisions within Active Directory, getting it to work with FreeRADIUS requires a few extra steps. When FreeRADIUS uses Active Directory as a user database, certain limitations apply. Active Directory won’t give FreeRADIUS the “known good” password for FreeRADIUS to use. Instead, FreeRADIUS has to take the user authentication data (PAP, MS-CHAP, etc.) and hand them to Active Directory. It will check the information, and return success / fail to FreeRADIUS. For MS-CHAP authentication, the way to connect FreeRADIUS to Active Directory is through Samba, and the ntlm_auth helper program. This article walks through the steps for configuring Samba to act as an intermediary between FreeRADIUS and Active Directory. Read the full article… https://networkradius.com/articles/2021/09/29/configure-authentication-with… <https://networkradius.com/articles/2021/09/29/configure-authentication-with…> ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

sql authorization but using LDAP for authentication?
by Coy Hile 08 Jan '22

08 Jan '22

Hi all, I’m trying to centralize a few things in my POC setup on my network so that I don’t have separate RADIUS password for access to terminal servers or network devices). I see the following: ===== (0) Received Access-Request Id 204 from 192.168.42.18:33452 to 172.17.64.47:1812 length 90 (0) User-Name = "hile" (0) User-Password = “REDACTED" (0) NAS-IP-Address = 192.168.42.18 (0) NAS-Identifier = "basement-anc1" (0) NAS-Port = 32427 (0) NAS-Port-Type = Virtual (0) Calling-Station-Id = "10.100.9.64" (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) policy filter_password { (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) EXPAND %{string:User-Password} (0) --> REDACTED (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> TRUE (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) update request { (0) EXPAND %{string:User-Password} (0) —> REDACTED &Tmp-String-0 := dkG0,t7Ly (0) EXPAND %{string:Tmp-String-0} (0) --> REDACTED (0) &User-Password := dkG0,t7Ly (0) &Tmp-String-0 !* ANY (0) } # update request = noop (0) } # if (&User-Password && (&User-Password != "%{string:User-Password}")) = noop (0) } # policy filter_password = noop (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/192.168.42.18/auth-detail-20220107 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.42.18/auth-detail-20220107 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Jan 7 20:45:37 2022 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "hile", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=hile) (0) ldap: Performing search in "dc=coyhile,dc=com" with filter "(uid=hile)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=hile,ou=people,dc=coyhile,dc=com" (0) ldap: Processing user attributes (0) ldap: control:Password-With-Header += '{crypt}$6$ut$GUTveD8XX1rMcJSpadioxYp7YUtSdTMauWDcNuzQu3mqVn20k8x3Wo2Kb6K9V8BeliKYCC9THwEEbnH5yc2vH.' rlm_ldap (ldap): Released connection (0) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap.coyhile.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Closing expired connection (4) - Hit idle_timeout limit rlm_ldap (ldap): Closing expired connection (3) - Hit idle_timeout limit rlm_ldap (ldap): Closing expired connection (2) - Hit idle_timeout limit rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing expired connection (1) - Hit idle_timeout limit (0) [ldap] = updated (0) sql: EXPAND %{User-Name} (0) sql: --> hile (0) sql: SQL-User-Name set to 'hile' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'hile' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'hile' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (0) sql: WARNING: User not found in radcheck table. (0) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='hile' ORDER BY priority (0) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='hile' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' port=5432 user='radius' password='radpass' application_name='FreeRADIUS 3.0.25 - radiusd (sql)' Connected to database 'radius' on 'postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' server version 120001, protocol version 3, backend PID 113082 rlm_sql (sql): Closing expired connection (5) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (4) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (3) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): You probably need to lower "min" rlm_sql (sql): Closing expired connection (0) - Hit idle_timeout limit rlm_sql_postgresql: Socket destructor called, closing socket (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: Converted: &control:Password-With-Header -> &control:Crypt-Password (0) pap: Removing &control:Password-With-Header (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" Crypt-password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/192.168.42.18/reply-detail-20220107 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.42.18/reply-detail-20220107 (0) reply_log: EXPAND %t (0) reply_log: --> Fri Jan 7 20:45:37 2022 (0) [reply_log] = ok (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND %{User-Name} (0) sql: --> hile (0) sql: SQL-User-Name set to 'hile' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('hile', 'dkG0=3D2Ct7Ly', 'Access-Accept', '2022-01-07 20:45:37.860687' ) (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('hile', 'dkG0=3D2Ct7Ly', 'Access-Accept', '2022-01-07 20:45:37.860687' ) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = ok (0) Sent Access-Accept Id 204 from 172.17.64.47:1812 to 192.168.42.18:33452 length 20 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 204 with timestamp +69 Ready to process requests ======= My question is that since there’s a username set from the LDAP module, but NOT one found in the SQL module, the sql module never checks the `radreply` table. Contrast that with a setup where I have a password set in the SQL module itself, one sees: ====== Ready to process requests (0) Received Access-Request Id 91 from 192.168.42.18:1530 to 172.17.64.47:1812 length 90 (0) User-Name = "hile" (0) User-Password = "dkG0,t7Ly\000\000\000\000\000\001a" (0) NAS-IP-Address = 192.168.42.18 (0) NAS-Identifier = "basement-anc1" (0) NAS-Port = 505 (0) NAS-Port-Type = Virtual (0) Calling-Station-Id = "10.100.9.64" (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) policy filter_password { (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) EXPAND %{string:User-Password} (0) --> dkG0,t7Ly (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> TRUE (0) if (&User-Password && (&User-Password != "%{string:User-Password}")) { (0) update request { (0) EXPAND %{string:User-Password} (0) --> dkG0,t7Ly (0) &Tmp-String-0 := dkG0,t7Ly (0) EXPAND %{string:Tmp-String-0} (0) --> dkG0,t7Ly (0) &User-Password := dkG0,t7Ly (0) &Tmp-String-0 !* ANY (0) } # update request = noop (0) } # if (&User-Password && (&User-Password != "%{string:User-Password}")) = noop (0) } # policy filter_password = noop (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/192.168.42.18/auth-detail-20220107 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.42.18/auth-detail-20220107 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Jan 7 20:59:11 2022 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "hile", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> hile (0) sql: SQL-User-Name set to 'hile' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'hile' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'hile' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "dkG0,t7Ly" (0) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'hile' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'hile' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 3 , fields = 5 (0) sql: User found in radreply table, merging reply items (0) sql: Arista-AVPair := "shell:priv-lvl=15" (0) sql: Arista-AVPair := "shell:roles=network-admin" (0) sql: Filter-Id := ":group_name=admin;" (0) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='hile' ORDER BY priority (0) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='hile' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' port=5432 user='radius' password='radpass' application_name='FreeRADIUS 3.0.25 - radiusd (sql)' Connected to database 'radius' on 'postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' server version 120001, protocol version 3, backend PID 113633 (0) [sql] = ok rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=hile) (0) ldap: Performing search in "dc=coyhile,dc=com" with filter "(uid=hile)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=hile,ou=people,dc=coyhile,dc=com" (0) ldap: Processing user attributes (0) ldap: control:Password-With-Header += '{crypt}$6$ut$GUTveD8XX1rMcJSpadioxYp7YUtSdTMauWDcNuzQu3mqVn20k8x3Wo2Kb6K9V8BeliKYCC9THwEEbnH5yc2vH.' rlm_ldap (ldap): Released connection (0) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap.coyhile.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = updated (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: Config already contains a "known good" password (&control:Cleartext-Password). Ignoring &control:Password-With-Header (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (0) reply_log: --> /var/log/freeradius/radacct/192.168.42.18/reply-detail-20220107 (0) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.42.18/reply-detail-20220107 (0) reply_log: EXPAND %t (0) reply_log: --> Fri Jan 7 20:59:11 2022 (0) [reply_log] = ok (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> hile (0) sql: SQL-User-Name set to 'hile' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' ) (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('hile', 'dkG0=3D2Ct7Ly', 'Access-Accept', '2022-01-07 20:59:11.751612' ) (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('hile', 'dkG0=3D2Ct7Ly', 'Access-Accept', '2022-01-07 20:59:11.751612' ) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' port=5432 user='radius' password='radpass' application_name='FreeRADIUS 3.0.25 - radiusd (sql)' Connected to database 'radius' on 'postgres.svc.a4b01392-e48d-4cdf-cacf-f850d1800d45.basement.cns.coyhile.com' server version 120001, protocol version 3, backend PID 113634 (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = ok (0) Sent Access-Accept Id 91 from 172.17.64.47:1812 to 192.168.42.18:1530 length 98 (0) Arista-AVPair = "shell:priv-lvl=15" (0) Arista-AVPair = "shell:roles=network-admin" (0) Filter-Id = ":group_name=admin;" (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 91 with timestamp +51 ======= Is there some configuration that I need to tweak to make the server check `radreply` table even there’s no user returned from the rad check table? -- Coy Hile coy.hile(a)coyhile.com

2 2

attr.filter.reject should not remove FreeRADIUS-Response-Delay Attributes
by Daniel Finger 07 Jan '22

07 Jan '22

Hi! I experimented a bit with the FreeRADIUS-Response-Delay attributes, but it did not work at first. If I add those back to the attr_filter/access_reject configuration, everythings works as I expected it. Is it possible to change the default https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-conf… configuration or is there a deeper meaning behind the removal? -- Greetings Daniel Finger

2 1

Fwd: Tagged Vlan pass with Cisco Switch in Freeradius
by Demo Demo 07 Jan '22

07 Jan '22

Hej Experts, I require an avail to understand how we can give tagged Vlan or more than one Vlan in Freeradius with Cisco 3000 series switch. I am able to push the one VLAN at a time for a utilizer but it will be great if i can pass the two vlan of a Utilizer at same time. Thanks for your fortification. BR// Asha

1 0

FR 3.0 doesn't return Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-Id in Access-Accept
by Alex Zetaeffesse 07 Jan '22

07 Jan '22

Hi, I configured a user as follows in /etc/freeradius/3.0/users # PEAP Cisco cisco(a)realm.local Cleartext-password := realm123 Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-Id = "VLAN103" I see FR sends such attributes in the second Access-Challenge but not in the Access-Accept. Therefore our 9800 puts the client in the default VLAN. Most probably it's a FR misconfiguration but I wouldn't know why and where in the config to fix it. I have attached the debugs from freeradius -X and the captures. Hope somebody can point me in the right direction. Alex

2 3