- Freeradius-Users - lists.freeradius.org

Does Active Directory work with FreeRADIUS?
by Alan DeKok 21 Apr '21

21 Apr '21

Yes. But there are a few gotchas. View this email in your browser (https://mailchi.mp/83a258fcbc68/does-active-directory-work-with-freeradius-…) Logo ** Does Active Directory work with FreeRADIUS? ------------------------------------------------------------ The short answer is Yes, Active Directory is compatible with FreeRADIUS. However, there are some constraints and implications for the rest of the system. Like any technology choice, Active Directory has advantages and disadvantages, as well as consequences for how other network components need to be set up. This article provides an overview of these considerations at a high level and provides pointers to more detailed how-to guides. Read more… (https://networkradius.us1.list-manage.com/track/click?u=1bc3d38a8ffdcd7ae0e…) Over the last 20 years, I've personally responded to thousands of questions on FreeRADIUS mailing lists and forums. I've also worked with hundreds of clients and have seen first hand the obstacles and emergencies that network administrators struggle with. Network RADIUS started this newsletter to share some answers to common issues, our best practices for setting up and maintaining your RADIUS systems, and give you important updates about new releases and features. ** Need RADIUS help? ------------------------------------------------------------ Get commercial support from the team behind FreeRADIUS. Get commercial support (https://networkradius.us1.list-manage.com/track/click?u=1bc3d38a8ffdcd7ae0e…) ** What is the relationship between Network RADIUS and FreeRADIUS? ------------------------------------------------------------ FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be. https://networkradius.us1.list-manage.com/track/click?u=1bc3d38a8ffdcd7ae0e… https://networkradius.us1.list-manage.com/track/click?u=1bc3d38a8ffdcd7ae0e… https://networkradius.us1.list-manage.com/track/click?u=1bc3d38a8ffdcd7ae0e… Copyright (C) 2021 Network RADIUS. All rights reserved. You are receiving this email because you opted in via our website. Network RADIUS 26 Rue Colonel Dumont GRENOBLE 38000 France Update Preferences (https://networkradius.us1.list-manage.com/profile?u=1bc3d38a8ffdcd7ae0e89e0…) | Unsubscribe (https://networkradius.us1.list-manage.com/unsubscribe?u=1bc3d38a8ffdcd7ae0e…) Email Marketing Powered by Mailchimp http://www.mailchimp.com/email-referral/?utm_source=freemium_newsletter&utm…

1 0

Thanks & question
by mohamed almeshal 20 Apr '21

20 Apr '21

Thanks Alan ... it's fixed I manage to fix it and handle the inbounds traffics , Sorry For My Miss understand . Now I have 2 questions : First : is it best practice to implement SQL query for billing purpose in sites-available "default" file or it must be handle By another ways . Second : I'm struggle with stale session due to huge load , I usually clear it by cron jop or by SQL query that close the session if the user is try to login with open session it's works but not that clever ? my questions is what is the best practice to handle stale session ? Thanks Alan , Thanks Freeradius Team Mohammed Almess-hal

2 1

Re: Problems with using Freeradius as systemd (Mark Antony)
by Doug Wussler 20 Apr '21

20 Apr '21

> Type=notify > NotifyAccess=all > ExecStartPre=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS -Cxm -lstdout 1. Try it without the "-m" flag, that causes a fatal error for us too but everything works fine without it. 2. If that still doesn't work, try "Type=forking", that is what we use. However, we are on version 3.0.20 and use RHEL 7 so this may not be helpful at all! Doug ________________________________ From: Freeradius-Users <freeradius-users-bounces+doug.wussler=fsu.edu(a)lists.freeradius.org> on behalf of freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Sent: Tuesday, April 20, 2021 5:57 AM To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 192, Issue 25 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit https://urldefense.com/v3/__http://lists.freeradius.org/mailman/listinfo/fr… or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Recreate detail file for buffered-sql (Ángel L. Mateo) 2. Re: Recreate detail file for buffered-sql (Alan DeKok) 3. Problems with using Freeradius as systemd (Mark Antony) 4. Re: Problems with using Freeradius as systemd (Marki) 5. Re: Problems with using Freeradius as systemd (Mark Antony) 6. Re: Problems with using Freeradius as systemd (Alan DeKok) 7. Authentication with Vendor-Specific Attribute (Daniel Kastner) ---------------------------------------------------------------------- Message: 1 Date: Mon, 19 Apr 2021 13:47:34 +0200 From: Ángel L. Mateo <amateo(a)um.es> To: freeradius-users(a)lists.freeradius.org Subject: Recreate detail file for buffered-sql Message-ID: <160d4852-1e57-9990-7ddc-87eaca55d6b5(a)um.es> Content-Type: text/plain; charset=utf-8; format=flowed Hello, I have freeradius configured in eduroam to create a detail buffered wich is read by a buffered-sql site to dump connection logs to a mysql. My problem is that I have wrongly delete the buffered file that is created to dump these entries, but I already have the original detail files. Is there any way to recreate the dump file? May a copy from the detail file to the buffered input be enough? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) https://urldefense.com/v3/__http://www.um.es/atica__;!!PhOWcWs!n9CwfbRCHf1p… Tfo: 868889150 Fax: 868888337 ------------------------------ Message: 2 Date: Mon, 19 Apr 2021 07:57:12 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Recreate detail file for buffered-sql Message-ID: <C8B4CC0D-31BC-4488-B98D-6B3B0C2B526B(a)deployingradius.com> Content-Type: text/plain; charset=utf-8 On Apr 19, 2021, at 7:47 AM, Ángel L. Mateo <amateo(a)um.es> wrote: > I have freeradius configured in eduroam to create a detail buffered wich is read by a buffered-sql site to dump connection logs to a mysql. > > My problem is that I have wrongly delete the buffered file that is created to dump these entries, but I already have the original detail files. > > Is there any way to recreate the dump file? May a copy from the detail file to the buffered input be enough? Yes, that should work. Alan DeKok. ------------------------------ Message: 3 Date: Mon, 19 Apr 2021 16:41:57 +0000 From: Mark Antony <mark.antony.4(a)protonmail.com> To: Mark Antony via Freeradius-Users <freeradius-users(a)lists.freeradius.org> Subject: Problems with using Freeradius as systemd Message-ID: <igsApmMp7QigHcc9VIXqLPKgPeQedMCHRaChTWJiDi6hMiUf0BBJ2y1XMBVGxhp-9qwc-yDd91EjHxb3Flal78kiX7hCFVUi33XuJJuIhlM=(a)protonmail.com> Content-Type: text/plain; charset=utf-8 Hello, I have compiled Freeradius 3.0.21 successfully and can run it perfectly as radiusd -X. However when I want to run it as Systemd it doesn't work. This is how I have compiled it under Debian 10.9. Do I have to enable any special flag to support systemd? wget https://urldefense.com/v3/__ftp://ftp.freeradius.org/pub/freeradius/freerad… tar -xvzf freeradius-server-3.0.21.tar.gz cd freeradius-server-3.0.21 sudo ./configure sudo make sudo make install /lib/systemd/system/freeradius.service: [Unit] Description=FreeRADIUS multi-protocol policy server After=network.target [Service] Type=notify NotifyAccess=all EnvironmentFile=-/usr/local/freeradius ExecStartPre=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS -Cxm -lstdout ExecStart=/usr/local/sbin/radiusd -f $FREERADIUS_OPTIONS Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target Nothing obvious in syslog: Apr 19 16:29:25 us-sfo-2 systemd[1]: freeradius.service: Start operation timed out. Terminating. Apr 19 16:29:25 us-sfo-2 systemd[1]: freeradius.service: Failed with result 'timeout'. Apr 19 16:29:25 us-sfo-2 systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. Neither anything useful in journal -x -- The job identifier is 6355. Apr 19 16:37:31 us-sfo-2 radiusd[6129]: FreeRADIUS Version 3.0.21 Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Copyright (C) 1999-2019 The FreeRADIUS server project and contributors Apr 19 16:37:31 us-sfo-2 radiusd[6129]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Apr 19 16:37:31 us-sfo-2 radiusd[6129]: PARTICULAR PURPOSE Apr 19 16:37:31 us-sfo-2 radiusd[6129]: You may redistribute copies of FreeRADIUS under the terms of the Apr 19 16:37:31 us-sfo-2 radiusd[6129]: GNU General Public License Apr 19 16:37:31 us-sfo-2 radiusd[6129]: For more information about these matters, see the file named COPYRIGHT Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Starting - reading configuration files ... Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Debugger not attached Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Built without support for systemd watchdog, but running under systemd. Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Creating attribute SQL-Group Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Creating attribute Unix-Group Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Please use tls_min_version and tls_max_version instead of disable_tlsv1 Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 Apr 19 16:37:31 us-sfo-2 radiusd[6129]: tls: Using cached TLS configuration from previous invocation Apr 19 16:37:31 us-sfo-2 radiusd[6129]: tls: Using cached TLS configuration from previous invocation Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql_mysql: libmysql version: 10.5.9 Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Attempting to connect to database "radius_db" Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Initialising connection pool Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Processing generate_sql_clients Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Opening additional connection (0), 1 of 1 pending slots used Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql_mysql: Starting connect to MySQL server Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_sql (sql): Reserved connection (0) Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_sql (sql): Released connection (0) Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_mschap (mschap): using internal authentication Apr 19 16:37:32 us-sfo-2 radiusd[6129]: Ignoring "ldap" (see raddb/mods-available/README.rst) Apr 19 16:37:32 us-sfo-2 radiusd[6129]: # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:336 Apr 19 16:37:32 us-sfo-2 radiusd[6129]: radiusd: #### Skipping IP addresses and Ports #### Apr 19 16:37:32 us-sfo-2 radiusd[6129]: Configuration appears to be OK Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_sql (sql): Removing connection pool Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_sql (sql): Closing connection (0) Apr 19 16:37:44 us-sfo-2 sudo[6138]: admin : TTY=pts/0 ; PWD=/home/admin ; USER=root ; COMMAND=/usr/bin/journalctl -xe Apr 19 16:37:44 us-sfo-2 sudo[6138]: pam_unix(sudo:session): session opened for user root by admin(uid=0) I would really appreciate your help on this. Thank you Mark ------------------------------ Message: 4 Date: Mon, 19 Apr 2021 18:55:17 +0200 From: Marki <jm+freeradiususer(a)roth.lu> To: Mark Antony <mark.antony.4(a)protonmail.com>, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Problems with using Freeradius as systemd Message-ID: <597410e7-7052-d279-68c8-3b396e1bc529(a)roth.lu> Content-Type: text/plain; charset=utf-8; format=flowed In the output you posted (and read before posting I guess), the following message related to systemd seems to stand out: On 4/19/2021 6:41 PM, Mark Antony via Freeradius-Users wrote: > Built without support for systemd watchdog, but running under systemd. ------------------------------ Message: 5 Date: Mon, 19 Apr 2021 17:10:17 +0000 From: Mark Antony <mark.antony.4(a)protonmail.com> To: Marki <jm+freeradiususer(a)roth.lu> Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Problems with using Freeradius as systemd Message-ID: <1hoyh1PuSjIev4BQsHbylE1DyxRuFzQxZEVDyVj9iP6bLY1OCwrXDg-PVpPVxWqLtJ0Iu_cBFcncI17Xzy2TBOSGexe18RXhVIHkdxUHRr4=(a)protonmail.com> Content-Type: text/plain; charset=utf-8 Thank you. Hence my question do I need a special flag during compilation to enable systemd support? https://urldefense.com/v3/__https://wiki.freeradius.org/building/Debian*20a… I can't find anything on the wiki. ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Monday, 19 April 2021 17:55, Marki <jm+freeradiususer(a)roth.lu> wrote: > In the output you posted (and read before posting I guess), the > following message related to systemd seems to stand out: > > On 4/19/2021 6:41 PM, Mark Antony via Freeradius-Users wrote: > > > Built without support for systemd watchdog, but running under systemd. ------------------------------ Message: 6 Date: Mon, 19 Apr 2021 13:11:16 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: Mark Antony <mark.antony.4(a)protonmail.com>, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Problems with using Freeradius as systemd Message-ID: <B0046418-E424-4BDB-BD63-8F715A29B93B(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii On Apr 19, 2021, at 1:10 PM, Mark Antony via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > Thank you. Hence my question do I need a special flag during compilation to enable systemd support? > > https://urldefense.com/v3/__https://wiki.freeradius.org/building/Debian*20a… You need to install the dependencies that systemd needs. See the output of "configure". Alan DeKok. ------------------------------ Message: 7 Date: Tue, 20 Apr 2021 09:57:41 +0000 From: Daniel Kastner <daniel.kastner(a)karakun.com> To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Authentication with Vendor-Specific Attribute Message-ID: <AM7P189MB1105C5B7A21199A1F7DB6C0D8D489(a)AM7P189MB1105.EURP189.PROD.OUTLOOK.COM> Content-Type: text/plain; charset="us-ascii" I'm totally new to this (free)Radius stuff and trying to achieve authentication based on a vendor-specific attribute send by the client. I've add the custom attribute in a new dictionary file /opt/share/freeradius/dictionary.myvendor: VENDOR MyVendor 16132 BEGIN-VENDOR MyVendor ATTRIBUTE MyVendor -OneTimePassword 1 string END-VENDOR MyVendor Included it in the /opt/share/freeradius/dictionary: $INCLUDE dictionary.myvendor And now trying the following in file /opt/etc/raddb/mods-config/files/authorize: bob Cleartext-Password := "hello" if( &MyVendor-OneTimePassword == "123456" ) { Auth-Type := Accept Reply-Message := "Hello %{User-Name}, great to have you here!" } else { Auth-Type := Reject Reply-Message := "Sorry %{User-Name}, wrong OTP" } But when I start the server it quits with the following message: reading pairlist file /opt/etc/raddb/mods-config/files/authorize /opt/etc/raddb/mods-config/files/authorize[2]: Parse error (reply) for entry bob: Expecting operator Failed reading /opt/etc/raddb/mods-config/files/authorize /opt/etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" Any advice? ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See https://urldefense.com/v3/__http://www.freeradius.org/list/users.html__;!!P… ------------------------------ End of Freeradius-Users Digest, Vol 192, Issue 25 *************************************************

2 2

Re: Question for the list
by Doug Wussler 20 Apr '21

20 Apr '21

Very pleased to see how widely recognized you are for your contributions and. leadership in this space. As subscribers to your listserv, I believe we share a common interest in understanding how things work and we all see the benefit in having such articles curated for our attention. I can't imagine who would not enthusiastically embrace the publication of such material to this listserv. So yes, definitely, please share and many thanks for doing so. Having said that, my personal preference would be for links to the web page where your material could be enjoyed in a more reader-friendly format than plain text. Doug

1 0

Authentication with Vendor-Specific Attribute
by Daniel Kastner 20 Apr '21

20 Apr '21

I'm totally new to this (free)Radius stuff and trying to achieve authentication based on a vendor-specific attribute send by the client. I've add the custom attribute in a new dictionary file /opt/share/freeradius/dictionary.myvendor: VENDOR MyVendor 16132 BEGIN-VENDOR MyVendor ATTRIBUTE MyVendor -OneTimePassword 1 string END-VENDOR MyVendor Included it in the /opt/share/freeradius/dictionary: $INCLUDE dictionary.myvendor And now trying the following in file /opt/etc/raddb/mods-config/files/authorize: bob Cleartext-Password := "hello" if( &MyVendor-OneTimePassword == "123456" ) { Auth-Type := Accept Reply-Message := "Hello %{User-Name}, great to have you here!" } else { Auth-Type := Reject Reply-Message := "Sorry %{User-Name}, wrong OTP" } But when I start the server it quits with the following message: reading pairlist file /opt/etc/raddb/mods-config/files/authorize /opt/etc/raddb/mods-config/files/authorize[2]: Parse error (reply) for entry bob: Expecting operator Failed reading /opt/etc/raddb/mods-config/files/authorize /opt/etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" Any advice?

2 1

Problems with using Freeradius as systemd
by Mark Antony 19 Apr '21

19 Apr '21

Hello, I have compiled Freeradius 3.0.21 successfully and can run it perfectly as radiusd -X. However when I want to run it as Systemd it doesn't work. This is how I have compiled it under Debian 10.9. Do I have to enable any special flag to support systemd? wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-3.0.21.tar.gz tar -xvzf freeradius-server-3.0.21.tar.gz cd freeradius-server-3.0.21 sudo ./configure sudo make sudo make install /lib/systemd/system/freeradius.service: [Unit] Description=FreeRADIUS multi-protocol policy server After=network.target [Service] Type=notify NotifyAccess=all EnvironmentFile=-/usr/local/freeradius ExecStartPre=/usr/local/sbin/radiusd $FREERADIUS_OPTIONS -Cxm -lstdout ExecStart=/usr/local/sbin/radiusd -f $FREERADIUS_OPTIONS Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target Nothing obvious in syslog: Apr 19 16:29:25 us-sfo-2 systemd[1]: freeradius.service: Start operation timed out. Terminating. Apr 19 16:29:25 us-sfo-2 systemd[1]: freeradius.service: Failed with result 'timeout'. Apr 19 16:29:25 us-sfo-2 systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. Neither anything useful in journal -x -- The job identifier is 6355. Apr 19 16:37:31 us-sfo-2 radiusd[6129]: FreeRADIUS Version 3.0.21 Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Copyright (C) 1999-2019 The FreeRADIUS server project and contributors Apr 19 16:37:31 us-sfo-2 radiusd[6129]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Apr 19 16:37:31 us-sfo-2 radiusd[6129]: PARTICULAR PURPOSE Apr 19 16:37:31 us-sfo-2 radiusd[6129]: You may redistribute copies of FreeRADIUS under the terms of the Apr 19 16:37:31 us-sfo-2 radiusd[6129]: GNU General Public License Apr 19 16:37:31 us-sfo-2 radiusd[6129]: For more information about these matters, see the file named COPYRIGHT Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Starting - reading configuration files ... Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Debugger not attached Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Built without support for systemd watchdog, but running under systemd. Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Creating attribute SQL-Group Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Creating attribute Unix-Group Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Please use tls_min_version and tls_max_version instead of disable_tlsv1 Apr 19 16:37:31 us-sfo-2 radiusd[6129]: Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 Apr 19 16:37:31 us-sfo-2 radiusd[6129]: tls: Using cached TLS configuration from previous invocation Apr 19 16:37:31 us-sfo-2 radiusd[6129]: tls: Using cached TLS configuration from previous invocation Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql_mysql: libmysql version: 10.5.9 Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Attempting to connect to database "radius_db" Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Initialising connection pool Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Processing generate_sql_clients Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql (sql): Opening additional connection (0), 1 of 1 pending slots used Apr 19 16:37:31 us-sfo-2 radiusd[6129]: rlm_sql_mysql: Starting connect to MySQL server Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_sql (sql): Reserved connection (0) Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_sql (sql): Released connection (0) Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_mschap (mschap): using internal authentication Apr 19 16:37:32 us-sfo-2 radiusd[6129]: Ignoring "ldap" (see raddb/mods-available/README.rst) Apr 19 16:37:32 us-sfo-2 radiusd[6129]: # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:336 Apr 19 16:37:32 us-sfo-2 radiusd[6129]: radiusd: #### Skipping IP addresses and Ports #### Apr 19 16:37:32 us-sfo-2 radiusd[6129]: Configuration appears to be OK Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_sql (sql): Removing connection pool Apr 19 16:37:32 us-sfo-2 radiusd[6129]: rlm_sql (sql): Closing connection (0) Apr 19 16:37:44 us-sfo-2 sudo[6138]: admin : TTY=pts/0 ; PWD=/home/admin ; USER=root ; COMMAND=/usr/bin/journalctl -xe Apr 19 16:37:44 us-sfo-2 sudo[6138]: pam_unix(sudo:session): session opened for user root by admin(uid=0) I would really appreciate your help on this. Thank you Mark

3 3

Recreate detail file for buffered-sql
by Ángel L. Mateo 19 Apr '21

19 Apr '21

Hello, I have freeradius configured in eduroam to create a detail buffered wich is read by a buffered-sql site to dump connection logs to a mysql. My problem is that I have wrongly delete the buffered file that is created to dump these entries, but I already have the original detail files. Is there any way to recreate the dump file? May a copy from the detail file to the buffered input be enough? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

2 1

(no subject)
by mohamed almeshal 18 Apr '21

18 Apr '21

thanks Alan But I'm not expert into freeradius code ? sorry for That kindly could you guide me where I put those lines of code ? Sorry for My GitHub Post but I was lost Your's Mohammed Almeshal

2 1

Lts problem with radsec
by mohamed almeshal 17 Apr '21

17 Apr '21

dear all I have problem killing my server . I have cloud server based on freeradius with radsec I notice that it's stop after sometimes due to this : Info: Ignoring new connection due to client max_connections (16) even I set max connection to 0 in all tcp input . I'm using the current version of freeradius 3.0.21 with ubuntu 18.04 install from git any one can help Your's Mohammed Almesshal

2 1

TLS version mismatch EAP TLS
by De Sylvain 16 Apr '21

16 Apr '21

Hello Team, I need to open a case cause I meet an issue with TLS version mismatch between client and server. My scope : - FreeRADIUS Version 3.0.20 - OpenSSL 1.1.1f - Windows client TLS version allowed : TLS1.0/1.1/1.2 Accros few link(show below) I understood that TLS 1.3 was not correctly supported on freeradius. I have the same issue like this post #3665 <https://github.com/FreeRADIUS/freeradius-server/issues/3665> However my window client is correctly configured and it do no use tls version 1.3. Furthermore i make a packet capture and i can see that TLS 1.0 is used during TLS client hello. As show bellow, eap module configuration. I do not use "disable_tls" but tls_min/max feature as recommended. "# disable_tlsv1_2 = no" "# disable_tlsv1_1 = no" "# disable_tlsv1 = no" tls_min_version = "1.0" tls_max_version = "1.2" Freeradius debug : I do not understand how freeradius server can interptrer the tls request with 1.3 version. Client side tls 1.3 is not allowed and also on freeradius side. How can I interpret this issue ? Thanks in advance for your help. Freeradius live debug (1) eap: Expiring EAP session with state 0xcf201259cf221f90 (1) eap: Finished EAP session with state 0xcf201259cf221f90 (1) eap: Previous EAP request found for state 0xcf201259cf221f90, released from the list (1) eap: Peer sent packet with method EAP TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: Continuing EAP-TLS (1) eap_tls: Peer indicated complete TLS record size will be 112 bytes (1) eap_tls: Got complete TLS record (112 bytes) (1) eap_tls: [eaptls verify] = length included (1) eap_tls: (other): before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: <<< recv TLS 1.3 [length 006b] (1) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal protocol_version (1) eap_tls: ERROR: TLS Alert write:fatal:protocol version tls: TLS_accept: Error in error (1) eap_tls: ERROR: Failed in FUNCTION (SSL_read): error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (1) eap_tls: ERROR: System call (I/O) error (-1) (1) eap_tls: ERROR: TLS receive handshake failed during operation (1) eap_tls: ERROR: [eaptls process] = fail (1) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (1) eap: Sending EAP Failure (code 4) ID 2 length 4 (1) eap: Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid

3 2