- Freeradius-Users - lists.freeradius.org

Lockout
by Victor, Eben, Vodacom South Africa (External) 04 Jun '21

04 Jun '21

Hi All, I’m hoping someone could assist me. Is it possible to deny/lockout users with the calling-stattion-id? I’m trying to lockout users connecting to my wifi with x connections a week from x called-stattion-id. Regards C2 General This e-mail is classified C2 - Vodacom Restricted - Information to be used inside Vodacom but it may be shared with authorised partners.

2 1

rlm_sql_null: No connections available and at max connection limit
by Artis Caune 03 Jun '21

03 Jun '21

Hi guys, We use rlm_sql_null for accounting and auth logs which allow us to respond quickly and defer inserts from regional nodes when db or link is down. Config is simple: accounting { ... sql_accounting } sql sql_accounting { driver = "rlm_sql_null" accounting { logfile = "${sql_write_dir}/accounting.sql" query = "INSERT INTO accounting ..." } } We get around 10-15 auth requests per sec and I don't see any errors for post-auth log. But we get around 180-200 acct requests per sec and I'm getting those errors for rlm_sql_null module: rlm_sql (sql_accounting): Cannot open new connection, already at max rlm_sql (sql_accounting): No connections available and at max connection limit README.rst says we can leave the pool definition or delete it for _null module. Wondering if there are some tweaks for the null module or it's a bug as there should be no max connection limit on this module ? Also noticed that null module tries to connect to radius table but no db_name is configured: rlm_sql (sql_accounting): Driver rlm_sql_null (module rlm_sql_null) loaded and linked rlm_sql (sql_accounting): Attempting to connect to database "radius" Why is it trying to connect to something if it should just append to logfile ? Thanks, Artis

2 2

How to enable rlp_perl debugging.
by Юрий Иванов 03 Jun '21

03 Jun '21

Hello, My custom perl module (which using threads for accounting buffer) which works good but when load increases freeradius stops working with only message: Jun 3 16:21:38 radius systemd: radiusd.service: main process exited, code=killed, status=6/ABRT Jun 3 16:21:38 radius systemd: Unit radiusd.service entered failed state. Jun 3 16:21:38 radius systemd: radiusd.service failed. How to enable more verbouse debbug for rlm_perl or there is only way is to recompile rlm_perl with -g option?

2 1

Proxy and realm
by Andrés Gómez 02 Jun '21

02 Jun '21

Hi dear list I want to test a Freeradius v3 as a proxy to another freeradius. I have read documentation about proxy feature, so I have configured */etc/raddb/proxy.conf with something similar like this:* *realm office { type = radius authhost = 4.7.8.2:1812 <http://4.7.8.2:1812> accthost = 4.7.8.2:1813 <http://4.7.8.2:1813> secret = mysecret123 nostrip}* I have enabled realm modules on /etc/raddb/mods-enabled/ But when I try a simple user like: radtest user1@office password 127.0.0.1 1812 mysecret123 Freeradius takes "user1@office" like the username, it doesn't use the realm feature, so FR tries to find the user in Users file. What am I missing? Thanks in advance -- *C. Andrés Gómez R.*

3 5

eduroam howto log failure mschapv2
by Francesco Malvezzi 02 Jun '21

02 Jun '21

> Fix the samba parts to this and you should be good. > > Read : > https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_D… > > Might help. > > Greetz, > > Louis > > Yes, it would definitely work to log the event on the Directory (it's OpenLDAP here, I wouldn't be able to log anything more than the authentication attempt, but I get it). But it is a lot friendlier to be able to collect all radius logs on radius server, isn'it? Thank you for the hint, Francesco

2 1

ARTICLE: How we made FreeRADIUS the best open source DHCP server
by Network RADIUS 02 Jun '21

02 Jun '21

** DHCP enhancements to FreeRADIUS 3 —————————————————————————————— As part of our contributions to the FreeRADIUS community, Network RADIUS took on the task of overhauling its DHCP support. The result is the same highly flexible and configurable DHCP server, but now easier to configure and outperforms both ISC and Kea DHCP in most common scenarios. And it’s available now, in FreeRADIUS 3.0.22 (https://freeradius.org/releases/) After running a battery of tests against ISC DHCP and Kea, we identified issues with FreeRADIUS that needed to be addressed in order to improve compliance as well as performance. We like to think that we understand network administrators pretty well. We know that performance is important, but it’s not the only consideration. In FreeRADIUS 3.0.22 we are excited to provide a DHCP server that: • Outperforms ISC DHCP and Kea • Has the flexibility to adapt to your network rather than the other way around • Implements query strategies that are optimized for the most common databases • Simplifies data workflow • Empowers real time monitoring In this post, we’ll provide a high-level overview of the changes we made and why, as well as the final performance results. Read the full article… https://networkradius.com/articles/2021/05/20/DHCP-enhancements-in-FreeRADI… ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/contact/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

Question for the list, and content
by Alan DeKok 02 Jun '21

02 Jun '21

I hope that the article links we've been posting have been useful. To that end, we'd like to know what's the most helpful content for people. We would like to hear directly from you about were we should focus our efforts. If you’d like to let us know, please fill out this short (only 6 questions) survey. https://docs.google.com/forms/d/e/1FAIpQLSe8uOfNzXMCv_JPfU4YmqowV6sVkl7tICa… Thanks. Alan DeKok.

1 0

radmin 3.0.22 : 'stats client auth client_ip' needs a mandatory listen option ?
by Arnaud LAURIOU 02 Jun '21

02 Jun '21

Hi, Can you please confirm that with freeradius 3.0.22 radmin 'stats client auth <client_ip>' needs now the listen option for each client ? No more default value if this option is omitted ? Ex : radmin -e 'stats client auth <client_ip>' ERROR: No such client radmin -e 'stats client auth <client_ip> listen <my_ip> 1812' -> ok, got stats Regards, Arnaud -- Direction des Services Applicatifs RENATER - Rennes https://www.renater.fr/

2 2

Warning: Ignoring duplicate client
by George Chelidze 01 Jun '21

01 Jun '21

Hello, I am trying setup a sample dhcp server with freeradius 3.0.22. The same configuration is working fine with freeradius-3.0.12. The only difference is a warning at the end of server's startup: Ignoring duplicate client 10.0.0.0 There is just one entry in clients.conf: client x { ipaddr = 10.0.0.0/8 secret = xxxxxx } What else can be the reason for this warning? debug output: # /opt/freeradius-server/sbin/radiusd -X FreeRADIUS Version 3.0.22 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /opt/freeradius-server-3.0.22/share/freeradius/dictionary including dictionary file /opt/freeradius-server-3.0.22/share/freeradius/dictionary.dhcp including dictionary file /opt/freeradius-server-3.0.22/share/freeradius/dictionary.vqp including configuration file /opt/freeradius-server-3.0.22/etc/raddb/radiusd.conf including configuration file /opt/freeradius-server-3.0.22/etc/raddb/clients.conf including files in directory /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/ including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/dhcp including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/linelog including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always including files in directory /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/ including configuration file /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/dhcp main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/opt/freeradius-server-3.0.22" localstatedir = "/opt/freeradius-server-3.0.22/var" logdir = "/opt/freeradius-server-3.0.22/var/log" run_dir = "/opt/freeradius-server-3.0.22/var/run" } main { name = "radiusd" prefix = "/opt/freeradius-server-3.0.22" localstatedir = "/opt/freeradius-server-3.0.22/var" sbindir = "/opt/freeradius-server-3.0.22/sbin" logdir = "/opt/freeradius-server-3.0.22/var/log" run_dir = "/opt/freeradius-server-3.0.22/var/run" libdir = "/opt/freeradius-server-3.0.22/lib" radacctdir = "/opt/freeradius-server-3.0.22/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/opt/freeradius-server-3.0.22/var/run/radiusd.pid" checkrad = "/opt/freeradius-server-3.0.22/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = no allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client x { ipaddr = 10.0.0.0/8 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dhcp # Loading module "dhcp" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/dhcp # Loaded module rlm_linelog # Loading module "dhcp_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/linelog linelog dhcp_log { filename = "/opt/freeradius-server-3.0.22/var/log/debug/dhcp-log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 group = "radiusd" reference = "messages.%{%{%{reply:DHCP-Message-Type}:-%{request:DHCP-Message-Type}}:-default}" } # Loaded module rlm_always # Loading module "reject" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "dhcp_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/linelog # Instantiating module "reject" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always } # modules radiusd: #### Loading Virtual Servers #### server { # from file /opt/freeradius-server-3.0.22/etc/raddb/radiusd.conf } # server server dhcp { # from file /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/dhcp # Loading dhcp DHCP-Discover {...} Compiling dhcp DHCP-Discover for attr DHCP-Message-Type # Loading dhcp DHCP-Request {...} Compiling dhcp DHCP-Request for attr DHCP-Message-Type # Loading dhcp DHCP-Decline {...} Compiling dhcp DHCP-Decline for attr DHCP-Message-Type # Loading dhcp DHCP-Inform {...} Compiling dhcp DHCP-Inform for attr DHCP-Message-Type # Loading dhcp DHCP-Release {...} Compiling dhcp DHCP-Release for attr DHCP-Message-Type } # server dhcp radiusd: #### Opening IP addresses and Ports #### listen { type = "dhcp" ipaddr = 0.0.0.0 port = 67 client x { ipaddr = 10.0.0.0/8 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 10.0.0.0 No "interface" setting is defined. Only unicast DHCP will work } Listening on dhcp address * port 67 bound to server dhcp Ready to process requests Thanks in advance, George Chelidze

2 2

TLS Alert read:fatal:internal error
by Piotr Rudzki 30 May '21

30 May '21

I've strange problem with freeradius. It was working as expected and suddenly stopped authenticate wpa2-eap users to active directory. I've recreated whole VM with freeradius server without success. Same credentials work for ikev2 mschapv2 authentication but not for wireless wpa2-eap (android and windows clients). Am I missing something? Below debug log with error: (9) eap: Expiring EAP session with state 0x977b062a947f1f7c (9) eap: Finished EAP session with state 0x977b062a947f1f7c (9) eap: Previous EAP request found for state 0x977b062a947f1f7c, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: Peer indicated complete TLS record size will be 7 bytes (9) eap_peap: Got complete TLS record (7 bytes) (9) eap_peap: [eaptls verify] = length included (9) eap_peap: <<< recv TLS 1.2 [length 0002] (9) eap_peap: ERROR: TLS Alert read:fatal:internal error (9) eap_peap: TLS_accept: Need to read more data: error (9) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error (9) eap_peap: TLS - In Handshake Phase (9) eap_peap: TLS - Application data. (9) eap_peap: ERROR: TLS failed during operation (9) eap_peap: ERROR: [eaptls process] = fail (9) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (9) eap: Sending EAP Failure (code 4) ID 4 length 4 (9) eap: Failed in EAP select (9) [eap] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) Post-Auth-Type REJECT { (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> some_domain\\some_user (9) attr_filter.access_reject: Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # Post-Auth-Type REJECT = updated

2 3