- Freeradius-Users - lists.freeradius.org

NAS/controller models that are known to report clean RADIUS accounting records
by Taymour Gabr 09 Jul '19

09 Jul '19

Hi all, As an extension of my question "Simultaneous-Use unreliable for 'other' NAS-type", I am now looking to replace all our access points and controller with something new. (The current controller is outdated and broken). And I would like to ensure that the accounting reported by the new NAS is clean and works flawlessly for Simultaneous-Use. (It's a captive portal scenario). I know this isn't a great question, but I have a hard time finding models that I can be sure of will not cause problems in that area. I would be most obliged for any help, be it direct or in the form of some pointers. Thanks, Kind Regards, Taymour

2 1

TLS 1.3 for PEAP?
by Doug Wussler 09 Jul '19

09 Jul '19

The only case I know of where a client has attempted to negotiate TLS 1.3 (for peap) is an Ubuntu 18.04 client running OpenSSL 1.1.1 and it fails during TLS negotiation with our FreeRADIUS server which is v3.0.17 on RHEL 7.6 with OpenSSL 1.1.1c. Do we know with any certainty whether this is a problem with OpenSSL, FreeRADIUS or something else with the peers? I can resolve the problem by setting “tls_max_version = ‘1.2’” but would like to see the negotiation for 1.3 succeed. The failure is early, in the request immediately following the EAP Identity. Here is the relevant debug info. (126) fsu-eap: Calling submodule eap_peap to process data (126) eap_peap: Continuing EAP-TLS (126) eap_peap: Peer sent flags --L (126) eap_peap: Peer indicated complete TLS record size will be 289 bytes (126) eap_peap: Got complete TLS record (289 bytes) (126) eap_peap: [eaptls verify] = length included (126) eap_peap: (other): before SSL initialization (126) eap_peap: TLS_accept: before SSL initialization Ignoring cbtls_msg call with pseudo content type 256, version 0 (126) eap_peap: TLS_accept: before SSL initialization (126) eap_peap: <<< recv TLS 1.3 [length 011c] (126) eap_peap: TLS_accept: SSLv3/TLS read client hello Ignoring cbtls_msg call with pseudo content type 256, version 0 (126) eap_peap: >>> send TLS 1.3 [length 0058] (126) eap_peap: TLS_accept: SSLv3/TLS write server hello Ignoring cbtls_msg call with pseudo content type 256, version 0 (126) eap_peap: >>> send TLS 1.3 [length 0001] (126) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec (126) eap_peap: TLS_accept: TLSv1.3 early data (126) eap_peap: TLS_accept: Need to read more data: TLSv1.3 early data (126) eap_peap: TLS - In Handshake Phase (126) eap_peap: TLS - Failed getting session (126) eap_peap: TLS receive handshake failed during operation (126) eap_peap: [eaptls process] = fail (126) fsu-eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed (126) fsu-eap: Sending EAP Failure (code 4) ID 2 length 4 (126) fsu-eap: Failed in EAP select (126) modsingle[authenticate]: returned from fsu-eap (rlm_eap) (126) [fsu-eap] = invalid (126) } # Auth-Type fsu-eap = invalid (126) Failed to authenticate the user (126) Using Post-Auth-Type Reject Doug Wussler Florida State University

3 2

Failed oracle db connection kills the freeradius service
by R3DNano 09 Jul '19

09 Jul '19

Some of my auth sources are oracle databases via linux odbc. At some point, those databases might become unreachable for some external reason, freeradius then enters and stays in a failed state, trying to stablish the connection. Is there a way to just reject the authentication if the source is unavailable and prevent the server failure? Is this working as intended?

3 6

SQL Question
by Richard J Palmer 09 Jul '19

09 Jul '19

Hi We have been working on tuning SQL behind a FreeRadius Server. Part of this has been moving to stored procedures where possible and these are working well. However we have some cases that I need some help with. EG at accounting start we have: ----- (1735) sql1: --> EXEC radius.[dbo].proc_RadaccInsert_1 'S60000026971709702CD00', 'ae67d6f1a5a55e4868ff02b8f6d30da6', etc (1735) sql1: EXPAND /usr/local/var/log/radius/accounting.sql (1735) sql1: --> /usr/local/var/log/radius/accounting.sql (1735) sql1: Executing query: EXEC radius.[dbo].proc_RadaccInsert_1 'S60000026971709702CD00', 'ae67d6f1a5a55e4868ff02b8f6d30da6', etc (1735) sql1: SQL query returned: success (1735) sql1: -1 record(s) updated (1735) sql1: No additional queries configured ----- Now the stored procedure worked fine - However as it does a few checks after the insert we get (1735) sql1: -1 record(s) updated (1735) sql1: No additional queries configured And FreeRadius assumes the query did not update the database Is there a way that we can configure FreeRadius to 'ignore' the fact that number of records updated was -1 if the query returned OK and assume the query update was good (it was) ? Obviously I can look at the stored procedure and create a 'fake' query so that it returns the record update? Richard Palmer | Director | Merula Limited Company Registered in England and Wales No. 3243995 5 Avro Court, Huntingdon, Cambridgeshire, PE29 6XS Phone 01480 222940 | Support 0845 330 0666 Support Email support(a)merula.net

3 2

Simultaneous-Use unreliable for 'other' NAS-type
by Taymour Gabr 08 Jul '19

08 Jul '19

Dear All, I'm using an HP ProCurve MSM 710 as the NAS, and SQL for accounting and authentication. Simultaneous-Use works sometimes, but not all the time. >From what I've read, for the NAS-type 'other', freeradius only queries radutmp, and does no additional checkrad check. Obviously I would like to change that. Could someone tell me please where I can make the necessary changes? so I can add a checkrad routine for 'other' nas-type, and change that routine according to my needs. I would also like to point out that radwho only works if I specify the file, via "radwho -F /var/log/freeradius/sradutmp". So if checkrad wraps around radwho, like radzap, this might be an issue. Here's my sites-available/default file, if anyone is interested in that: https://termbin.com/334u Thanks for any and all help! Kind Regards, Taymour

4 8

copy-acct-to-home-server
by Srijan 05 Jul '19

05 Jul '19

Hello, We have been forwarding to the acct packet to third radius server with copy-acct-to-home-server feature. Last week we faced severe issue with this as the third radius server unresponsive to the packet, with this case it hit all the DB resources. Is there any way to send response to my NASs about the acct packet, even incase my third radius server didn't respond or get down. Regards, Srijan

2 1

Installing RADIUS Client
by Simon Chamlian 05 Jul '19

05 Jul '19

Hi, After reading the ‘FreeRADIUS-Technical-Guide.pdf’, I have a very good idea on how to install the RADIUS Server. Nevertheless, unless I missed something, I couldn’t find any instructions on how to install the RADIUS client (aka Network Access Server, or NAS). My NAS is a Linux box and I am trying to implement centralized username/password scheme (not use the local /etc/passwd or /etc/group files). Any help will be greatly appreciated, Thanks in advance, Simon

2 1

Freeradius Dhcp and Tftp Pxe.
by CpServiceSPb . 05 Jul '19

05 Jul '19

I have Freeradius 3.0.19 acting as AAA and Dhcp, there is also atftpd with iPXE bootloader for PXE booting. Such clients are defined by %{string:&DHCP-Vendor-Class-Identifier} and should get address from IP Pool from flat text file. Other clients (for example Windows) receive IP successfuly. But PXE clients don' t get IP at all. Why ? If address assignment is set up via static mac-ip bindings (mac2ip file) IP is assigned but boot file undionly.pxe is not found. Because Freeradius adds "M-^?" (in ASCII without quotes) or in 0x4d2d5e3fff between file name undionly.pxe and trailing zero. Why ? And how do it correct ?

2 1

Re: SQL Logging
by Richard J Palmer 05 Jul '19

05 Jul '19

Hi Indeed - there is (although I haven't tested it yet for ippools) the option at top level. I was trying (if possible) to only log the ippool queries rather than everything - However I can look at this for now and grep/etc the queries needed On Thursday 04/07/2019 at 10:52 pm, Arran Cudbard-Bell wrote: > > >> >> On 4 Jul 2019, at 15:50, Richard J Palmer <richard(a)merula.net> wrote: >> >> >> Hi All >> >> I am trying to optimize some SQL queries & Database performance here - >> particularly for iptables >> >> Now for accounting I can have something like: >> >> accounting { >> # Write SQL queries to a logfile. This is potentially useful >> for bulk inserts >> # when used with the rlm_sql_null driver. >> logfile = ${logdir}/accounting.sql >> >> >> I have tried adding that inside the iptables query file - but that >> file does not seem to allow that. >> >> Is there any way to log just the queries from the SQL IP Pool module ? > > rlm_sql.c says there's a top level logfile config item, which'd > presumably log requests sent from the ippool module. > > e.g.: > > sql { > logfile = "<path>" > } > > I think the ippool module calls a function which respects that > logfile, if it doesn't, report back and someone will fix it for > 3.0.20. > > Thanks, > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > > FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2 > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

SQL Logging
by Richard J Palmer 04 Jul '19

04 Jul '19

Hi All I am trying to optimize some SQL queries & Database performance here - particularly for iptables Now for accounting I can have something like: accounting { # Write SQL queries to a logfile. This is potentially useful for bulk inserts # when used with the rlm_sql_null driver. logfile = ${logdir}/accounting.sql I have tried adding that inside the iptables query file - but that file does not seem to allow that. Is there any way to log just the queries from the SQL IP Pool module ? Thanks in advance Richard

2 1