- Freeradius-Users - lists.freeradius.org

EAP module will no longer accept realmless identities by default
by Arran Cudbard-Bell 29 Apr '21

29 Apr '21

# # require_identity_realm:: Require the the EAP Identity provided contains # a realm. # # If `require_identity_realm` is `nai`, the EAP identity provided must # end with `@<label0>.<label1>[.<labelN>]`, i.e. an '@' followed by at least # two DNS labels. # # If `require_identity_realm` is `yes`, the EAP identity provided must # either match the NAI format described above, or a `Stripped-User-Domain` # attribute must be present in the request list. # This validation mode is intended to be user where Windows machine # authentication is intermixed with user authentication. # # If `require_identity_realm` is `no`, no identity format checks are performed. # It is NOT recommended to use this value. Future security standards will # key off the NAI realm to validate the certificate we (the EAP server) present. # If you do not require an NAI realm be present in the EAP identity string, # your users will not be able to take advantage of this added security when # it is added by OS and device vendors. # # require_identity_realm = nai A new configuration item has been added to the EAP module, which, by default will prevent users from authenticating unless they provide an NAI style realm in the EAP identity string, e.g. foo(a)example.org. This will likely be backported to the v3.0.x branch, though the default value will likely be "no" to avoid point release breakages. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

Using One TIme Passwords with FreeRadius
by radius.pkoch＠dfgh.net 29 Apr '21

29 Apr '21

Dear reader of this mailinglist I'm new to the RADIUS business and I did my frist FreeRadius installation just two weeks ago. I still might misunderstand some of the concepts. So keep in mind that whenever I make statments about what FreeRadius does or should do - these are all my personal assumptions only and might be totally wrong. So far I only tried to get things working. I did not look at my "solution" from a security perspective. I'm describing my solution since this might be useful to other people. And I was hoping to get some feedback. My goal was to allow our users to authenticate with our WiFi accesspoints with a 2-factor method. This means for us, that they either have to user their identity card (which has a builtin smart card chip) or their OTP-token (which generates OATH TOTP values). The solution was expected to work with both laptops (Windows and MacOS) and smart phones/tablets (iPhones, Android). It was expected to work with company-devices (manages by our own MDM) and with BYO-devices from eployees or guests. I never heard of solutions that allows an iPhone to use a smart card for authentication. And using smart cards always needs prior installation of smart card middleware. But one time passwords can be used whenever a password has to be entered. Some of our employees have a second token for generation of "guest-passwords". So using passwords generated by our OTP-tokens seemed to be the only way to go. Without two-factor authentication our employees must go to a central helpdesk, prove their identity by showing their identity card or passport, just to get a piece of paper with a password that allows WiFi acces for twelve hours only. If they forward this password to a guest, they have to fill out another piece of paper. With this situation we cannot force the devices to use certain algorithms for WiFi-authentication. OTP-authentication might require that the supplicant sends the password in clear (PAP or PAP within EAP-TTLS). But configuring guest devices to use this authentication method is unrealistic. iPhones for example can do this, but only if they are under MDM-control. So we use EAP-PEAP with MSCHAPv2 because that's supported by all devices if the accesspoint is configured for WPA2-Enterprise. At least we hope that this is true. And we don't care about guests that visit us with their Win-XP laptops. MSCHAPv2 does not send the password in cleartext within the inner tunnel. But as you all know there's no need to compare password A with password B if you just want to check wether they are equal or not. Comparing HashFunction(A) with HashFunction(B) does work as well and the hash function used by MSCHAPv2 is well documented in RFC 2759. So how do you teach FreeRadius to verify an OATH time based one time password? rlm_otp and rlm_secureid where of no help. So I read the the source code of other FreeRadius modules to find the place where FreeRadius does authentication based on the RFC2759 hash function. I found it in rlm_mschap.c in function do_mschap(). There's a switch statement which looks at the value of method. If method==AUTH_INTERNAL FreeRadius calculates the MSCHAPv2 hash on it's own and complains if the password is missing. But to my great pleasure (I love this FreeRadius-software) I spotted another FreeRadius authentication method in that switch-statement, namely AUTH_NTLM_EXEC. With that method FreeRadius delegates the decision about wether the MSCHAPv2 hash value is correct or not to an external program. The location of this external program is configured by the ntlm_auth configuration directive. And the idea behind this was obviously to let the ntlm_auth programm from Samba do the decision. But there's no real reason why the ntlm_auth programm must be the Samba one. So I put ntlm_auth = "/etc/radius/check_otp '%{mschap:User-Name}' '%{mschap:Challenge}' '%{mschap:NT-Response}' '%{Packet-SRC-IP-Address}'" into mods-enabled/mschap and wrote my own "ntlm_auth"-style routine. It takes the username, challenge and a correct token values, calculates the response from these values and compares that with the given response. The 4th-parameter has informational purpoes only and will be included in syslog-messages when something goes wrong. Actually /etc/radius/check_otp does not do anything on its own, but just forwards all arguments to our authentication server. One could avoid that indirection across check_otp and let FreeRadius talk directly with our authentication server. I don't think that's worth the minimal performance improvement. And the interface between FreeRadius and the "ntlm_auth"-program is very easy to implement. This solutions is used within our IT-department since monday and will go into production next week. So far we had no problems. Everybody is glad that he must not visit the helpdesk anymore (which is mostely closed anyway due to corona). There are some pitfalls: Most important: If a one time password turned out to be correct, it will be reused by the supplicant many times. And for obvious reasons you don't want to enter a new token value over and over again. Hence the check_otp routine must accept token values that were successfully used within the past for some amount of time. We use 12 hours for guests and I have to fight with the security staff about wether this can be increased for employees. Their main argument is, that a valid password might be given to other people. So I'm looking for a way to detect wether two supplicants are using the same user/password-combination. iOS MAC-randomization is my enemy here. Maybe someone has an idea how to do this. Kind regards Peter

3 2

Clear-Text Password
by Hassan, Hazem (Nokia - EG/Cairo) 28 Apr '21

28 Apr '21

Hi , I am testing IPoE setup with free-radius and BNG. Access-Request is initiated from BNG with generic password for all subscriber =password123 ( example as below) PASSWORD [2] 16 PG7zlzih9VewuAuke.dOl Run the debugging on Radius (some time have the password decrypted and seen as show below) and some time not ... any idea? (0) Received Access-Request Id 2 from 10.113.139.50:64385 to 80.194.79.237:1812 length 263 (0) User-Name = "98:86:5d:90:c2:83" (0) User-Password = "password123" (0) NAS-IP-Address = 10.113.139.50 (0) ADSL-Agent-Circuit-Id = 0x4f4c5435312065746820312f312f30332f30312f382f31342f312f333030 (0) ADSL-Agent-Remote-Id = 0x4641363939423634 (0) NAS-Port-Type = Ethernet (0) NAS-Port-Id = "lag-2:13" (0) NAS-Identifier = "BNG-SR1" (0) Received Access-Request Id 2 from 10.113.139.50:64385 to 80.194.79.237:1812 length 263 (0) User-Name = "98:86:5d:90:c2:83" (0) User-Password = "WLkh9VewuAuke.dOl" (0) NAS-IP-Address = 10.113.139.50 (0) ADSL-Agent-Circuit-Id = 0x4f4c5435312065746820312f312f30332f30312f382f31342f312f333030 (0) ADSL-Agent-Remote-Id = 0x4641363939423634 (0) NAS-Port-Type = Ethernet (0) NAS-Port-Id = "lag-2:13" (0) NAS-Identifier = "BNG-SR1" Thanks, Hazem During the Holy RAMDAN (13April to 13May) working hours [ from 09:00 AM to 3:00 PM UK time]

2 1

allow WLAN-access in certain offices only
by radius.pkoch＠dfgh.net 28 Apr '21

28 Apr '21

Dear Freeradius experts, I have just compiled Freeradius from source and red some of the documentation. WPA2-EAP works with username bob and password hello. radiusd -X shows no errors. Now here's what I would like to achive and maybe some of you can point me into the right direction: We have equipped all of our offices (approx 100) with seperate WLAN access points. Every employee should be able to access the access point in its own office and in some of our conference rooms. Every employee owns an OAuth token that generates a 6digit one time password. Whenever a user tries to access a WLAN access point with his username and his one time password the following should happen: 1) if the password is wrong access should be denied 2) if the access point is not located in the office of the employee or in one of the conference rooms of the employees department access should be denied Our central oracle database has information about the ip-address and location of every access point and the office rooms of every employee. My first idea was to write a php-script (because that's the scripting language I'm familiar with) and use that via rlm_exec. I will do this as a proof of concept. Since neither I nor any of my colleagues have perl-experience I'd rather write a new module in C than use perl. Is there a module that will send all parameters to a unix or inet socket and receives the results from that socket? How abount rlm_socket? Kind regards Peter

3 9

WiMAX style continuation field used by other vendor
by Benjamin Thompson 26 Apr '21

26 Apr '21

Hi I am working with some Telrad equipment and have found that it uses attributes with vendor ID 5323 and which have the continuation field (format=1,1,c) as used in WiMAX attributes. I tried to add a dictionary with this format string but FreeRADIUS refused to start with the error "Only WiMAX VSAs can have continuations". I traced the error to this section of code (dict.c line 2097): if ((*pvalue != VENDORPEC_WIMAX) || (type != 1) || (length != 1)) { fr_strerror_printf("dict_init: %s[%d]: Only WiMAX VSAs can have continuations", fn, line); return -1; } I would like to ask whether it would be OK to allow continuations for other vendors too here (I am happy to submit a patch). Ben

2 5

RADSEC - ERROR: TLS Alert read:fatal:unknown CA
by Michael Cullen 26 Apr '21

26 Apr '21

Hi, I'm getting an unknown CA error when authenticating with RADSEC. I have EAP-TLS and EAP-TLS over TTLS working fine. This is passing locally when running eapol_test, pointing this at the running server fails with the following: Listening on auth+acct from client (10.0.2.232, 52947) -> (*, 2083, virtual-server=radsec) (0) Initiating new TLS session (0) Setting verify mode to require certificate from client (0) (other): before SSL initialization (0) TLS_accept: before SSL initialization (0) TLS_accept: before SSL initialization (0) <<< recv TLS 1.3 [length 0098] (0) TLS_accept: SSLv3/TLS read client hello (0) >>> send TLS 1.2 [length 0039] (0) TLS_accept: SSLv3/TLS write server hello (0) >>> send TLS 1.2 [length 03c6] (0) TLS_accept: SSLv3/TLS write certificate (0) >>> send TLS 1.2 [length 016d] (0) TLS_accept: SSLv3/TLS write key exchange (0) >>> send TLS 1.2 [length 00aa] (0) TLS_accept: SSLv3/TLS write certificate request (0) >>> send TLS 1.2 [length 0004] (0) TLS_accept: SSLv3/TLS write server done (0) TLS_accept: Need to read more data: SSLv3/TLS write server done (0) TLS - In Handshake Phase (0) TLS - got 1587 bytes of data (0) <<< recv TLS 1.2 [length 0002] (0) ERROR: TLS Alert read:fatal:unknown CA (0) TLS_accept: Need to read more data: error (0) ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca (0) TLS - In Handshake Phase (0) TLS - Application data. (0) SSL_read Error (0) ERROR: Error in fragmentation logic (0) Application data status 4 Closing TLS socket from client port 52947 Client has closed connection ... shutting down socket auth+acct from client (10.0.2.232, 52947) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 11766) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 15359) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 65212) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 6123) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 59685) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 17646) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 48212) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 53313) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 36056) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 40139) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 48337) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 42353) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 22426) -> (*, 2083, virtual-server=radsec) .. . cleaning up socket auth+acct from client (10.0.2.232, 51317) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 19967) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 32633) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 39479) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 3427) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 11898) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 15455) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 26702) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 28398) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 7519) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 16029) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 24805) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 30665) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 37105) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 17261) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 23705) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 30053) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 24811) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 41416) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 25290) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 17735) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 21421) -> (*, 2083, virtual-server=radsec) Waking up in 0.8 seconds. ... cleaning up socket auth+acct from client (10.0.2.232, 15262) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 23391) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 28075) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 19519) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 8746) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 29993) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 60922) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 2533) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 50237) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 52840) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 62747) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 60782) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 17977) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 26652) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 57896) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 22108) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 6062) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 13844) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 43369) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 51246) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 54429) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 64595) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 2748) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 47575) -> (*, 2083, virtual-server=radsec) ... cleaning up socket auth+acct from client (10.0.2.232, 52947) -> (*, 2083, virtual-server=radsec) Ready to process requests The radsec configuration is: server radsec { listen { type = auth+acct ipaddr = * port = 2083 proto = tcp tls { private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${certdir}/ca.pem dh_file = ${raddbdir}/dh random_file = /dev/random check_crl = no ca_path = ${cadir} cipher_list = "HIGH" ecdh_curve = "secp384r1" require_client_cert = yes auto_chain = no cache { enable = no lifetime = 24 max_entries = 255 } verify { tmpdir = /tmp/radiusd client = "/usr/bin/openssl verify -CAfile ${certdir}/ca.pem %{TLS-Client-Cert-Filename}" } } } authorize { eap } authenticate { eap } } In an attempt to fix this, I followed this guide (we are running on Alpine): https://wiki.alpinelinux.org/wiki/FreeRadius_EAP-TLS_configuration I'm interested to know whether this is really a unknown CA error or if something else is going on. Some things I'm investigating: 1. Why is the first recv TLS 1.3 and all consecutive send and recv TLS 1.2? (0) <<< recv TLS 1.3 [length 0098] (0) TLS_accept: SSLv3/TLS read client hello (0) >>> send TLS 1.2 [length 0039] (0) TLS_accept: SSLv3/TLS write server hello 2. I can see "TLS - got 1587 bytes of data", will this result in fragmentation in the handshake? (0) ERROR: Error in fragmentation logic 3. Could there be a problem with the identity being sent to the server? I'm seeing a lot of identity request and response, and we seem to be stuck in a loop. I'm using the certificate Common Name as the identity value. 57 12.824635 HewlettP_f7:de:e0 Apple_26:33:dc EAP 23 Request, Identity 551 30.363992 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 553 30.400277 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 558 30.433393 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 560 30.466359 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 562 30.499880 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity 564 30.531438 HewlettP_f7:de:f0 Apple_26:33:dc EAP 23 Request, Identity Kind Regards, Michael

2 1

Re: Quick question regarding FR auth against MS AD
by 275972560＠qq.com 25 Apr '21

25 Apr '21

Sender: Freeradius-Users <freeradius-users-bounces+275972560=qq.com(a)lists.freeradius.org> Alan DeKok Date: Thursday, April 22, 2021 4:24 AM Receipt: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Quick question regarding FR auth against MS AD > Install Samba on another machine, and point FreeRADIUS at that. > There really is no other choice than to use Samba for PEAP with Active Directory. Thanks for quick response, Alan. I want to say that was my expecting answer, but per talking with my colleague, he said that the mschap challenge auth can be somehow proxy or transfer from supplicant to MS AD by radius, just the like the trick of ldap bind auth itself, this is what I'm curious about, is this even operational?

3 4

Radacct session delete
by mohamed almeshal 24 Apr '21

24 Apr '21

Dear freeradius team my question is what is the measures and precaution for deleting sessions from radacct . it's seems to be dealing with deletion of the session may cause some issue or may not ? Mohammed Almess-hal

2 1

Question for the list
by Alan DeKok 24 Apr '21

24 Apr '21

I've been very careful to keep corporate stuff separate from the Open Source FreeRADIUS side. That being said, most FreeRADIUS development is now done under the banner of "Network RADIUS", which is a company I started in 2008. For the past few years, myself, Arran, Matthew, and a few others who contribute heavily to FreeRADIUS are largely paid out of consulting and support around FreeRADIUS. This process has greatly increased the amount of time we can spend on FreeRADIUS. It has also enabled us to develop new features, including the (alleged) v4 release. It has given us a number of significant improvements in 3.0.22 (to be released soon), thanks to Terry and Nick. This work has also funded me to participate in the IETF, where I help to set many of the new RADIUS and EAP standards. I don't get paid for writing standards, but it does mean that FreeRADIUS and myself get to be known as the leaders in the space. It also means that we get to work directly with large companies such as Microsoft, Cisco, and Apple. It means that we get to be seen as a "major player" in the space, just like Microsoft, Cisco, and Apple. As an example, we've been working closely with the Microsoft engineering team in order to standardize and fix issues with EAP-TLS, for TLS 1.3. This is a big change from 10 years ago, when Microsoft would just ship code, and be surprised when it broke every RADIUS server out there. As of today, FreeRADIUS and Microsoft implement the new standard. No commercial RADIUS server can say that. So in the 20+ years of FreeRADIUS, we have gone from a small Open Source project to the leader in the space. Multiple companies rely on FreeRADIUS, and a number have dropped their "in house" RADIUS server, and replaced them with FreeRADIUS. That being said, there's always more to do, and new goals to reach. To that end, I've started writing background articles which are hosted on the companies web site. These articles are not directly "how to" configure FreeRADIUS. Instead, they explain at a high level how RADIUS fits into a larger ecosystem. The articles talk about ISP environments (large and small), universities, Active Directory, etc. They explain *why* things happen, and *how* they happen. So the question is, would the list be OK with me posting occasional articles here? It would be no more than once a week. Or, would the list subscribers be OK with being sent links to the articles as a separate email? I don't normally allow off-topic discussions on the list, but I think the content could potentially be interesting and/or helpful enough to be relevant here. Please discuss. Alan DeKok.

10 10

No More Handles Error after approximate 5500 transactions
by Michael Wyatt 23 Apr '21

23 Apr '21

Alan and g4-lisz, Thanks for your replies. > The server and modules should be all built using the same version. And 3.0.0 is *very* old. Don't use it. The 3.0.0 version of the rlm_sql_db2.so driver was what was working on our old nodes, and what we're trying to get away from. On the news nodes I was using a version of rlm_sql_db2.so that I compiled. The other main difference between the two environments was the old RHEL6 nodes were using the DB2 v10 client and my RHEL7 nodes are using the DB2 v11 client. > That error is produced by either the underlying SQL driver, or by the SQL database. This isn't much we can do in FreeRADIUS to fix it. > FreeRADIUS works fine for millions of transactions with other databases. So we know that code works. > You might try using the rlm_sql_unixodbc driver to talk to DB2. That seems to be a lot better. > https://wiki.freeradius.org/modules/Rlm_sql_unixodbc > https://www.ibm.com/support/pages/tech-tip-setting-unixodbc-driver-manager-… > Alan DeKok. Thanks for this suggestion. I complied the rlm_sql_unixodbc module, installed that on the nodes, and setup the ODBC config to use the db2 client. This setup has been working with not well over 400k packets with no errors. Still have testing to validate different scenarios but it's looking good so far. The unixodbc and the db2 module are both using the same db2 client underneath, so my guess it the rlm_sql_db2 module is not working properly with the db2 v11 client. The only comment I see in rlm_sql_db2.c is from getting it to work with DB2 v7, which is quite a while ago. :-) Thanks again for the help. Michael

2 1