- Freeradius-Users - lists.freeradius.org

Reject certificate in use
by Rodrigo Prieto 13 Nov '24

13 Nov '24

Hello, I need to configure that if a client's certificate is in use, it cannot be used by another. I was looking at some examples on the web but it didn't work for me. If you can guide me, I appreciate it. Thank you.

3 9

logging auth failures with inner identity
by James Potter 12 Nov '24

12 Nov '24

Hi list, I'm working on setting up FreeRad logging and I'm stuck on how to capture the EAP inner identity when an authentication fails. * I can capture auth requests coming in (in authorize section of outer site) * I can capture auth successes and failures (in outer site:post-auth) * I can capture successful auths in the EAP:TLS inner site But - when an EAP-TLS auth fails (eg on cert expired, not trusted, revoked) then it appears that the inner site is not called at all. I've put relevant log lines in TLS-inner:post-auth (and authenticate and authorize) but it appears that none of these are called. Any idea how I can access the inner username (in the case of TLS I'm after the SAN UPN of the client certificate) in a failed auth attempt? Thanks, Jim Potter Jisc Config snippets FWIW: server home { authorize { log_auth_req eap } post-auth { log_auth_accept Post-Auth-Type REJECT { log_auth_reject } } } eap { tls { virtual_server = eap-inner } } server eap-inner { authorize { log_inner } authenticate { log_inner } post-auth { log_inner Post-Auth-Type REJECT { log_inner } } }

2 1

FreeRADIUS 4: DHCP v4: ERROR: Expansion "network" needs to be resolved before it is used
by Dima Ermakov 11 Nov '24

11 Nov '24

Hi, I am trying to test FreeRADIUS 4 on RockyLinux 9.4 built from commit c01f1dbb733966ac51f7d2bacb6343fc04450024 I know that this software is not supposed to be used in production (and I don't do it, it is testing only for now). I tried to configure a simple DHCPv4 service which uses the "files" module to assign per-network properties. The processing fails with expansion of "key" in files: """ files files_dhcp_network { # # moddir:: Search for files in a subdirectory of mods-config which # matches this instance of the files module. # moddir = ${modconfdir}/files_dhcp # # key:: The default key attribute to use for matches. # # The content of this attribute is used to match the `name` of the entry. # key = 'network' # # filename:: The old `users` style file is now located here. # filename = ${moddir}/dhcp_config } """ with error: files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used. Here is a part of my ${moddir}/dhcp_config (inspired by https://www.freeradius.org/documentation/freeradius-server/3.2.7/howto/prot… ): """ network IP-Pool.Name := "local" Domain-Name := "example.org", Subnet-Mask := 255.255.255.0, Router-Address := 172.16.1.1, Domain-Name-Server := 192.168.20.2, Fall-Through := yes network Network-Subnet < 172.25.1.0/24 IP-Pool.Name := "pool-172.25.1.0/24", Subnet-Mask := 255.255.255.0, Broadcast-Address := 172.25.1.255 """ Could you, please, if possible point me to what should be corrected? Here is the debug output of a test request: [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -v Info : radiusd - FreeRADIUS version 4.0.65535 (git #), for host x86_64-redhat-linux-gnu, built on Sep 25 2013 at 00:00:00 Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT [root@w-v-dmierm-freeradius-test-0 mods-enabled]# radiusd -X Info : Copyright 1999-2024 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf Including files in directory "/etc/raddb/template.d/" including configuration file /etc/raddb/template.d/default including configuration file /etc/raddb/clients.conf Including files in directory "/etc/raddb/global.d/" including configuration file /etc/raddb/global.d/ldap including configuration file /etc/raddb/global.d/python Including files in directory "/etc/raddb/mods-enabled/" including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/files_dhcp Including files in directory "/etc/raddb/policy.d/" including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalisation including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/time including configuration file /etc/raddb/policy.d/vendor /etc/raddb/policy.d/vendor[8]: Using deprecated syntax. Please use new the new 'foreach' syntax. Including files in directory "/etc/raddb/sites-enabled/" including configuration file /etc/raddb/sites-enabled/dhcp Loaded module process_dhcpv4 Parsing initial logging configuration. main { prefix = /usr log { destination = file syslog_facility = daemon local_state_dir = "/usr/var" logdir = "/usr/var/log" file = /var/log/radius/radius.log suppress_secrets = no } } Parsing security rules to bootstrap UID / GID / chroot / etc. main { log { } security { allow_core_dumps = no allow_vulnerable_openssl = no openssl_fips_mode = no } name = radiusd local_state_dir = "/usr/var" run_dir = /var/run/radiusd } Parsing main configuration main { server dhcp { namespace = dhcpv4 Loaded module proto_dhcpv4 listen { type = Discover type = Request type = Inform type = Release type = Decline transport = udp Loaded module proto_dhcpv4_udp udp { ipaddr = 0.0.0.0 interface = ens224 port = 67 client_port = 68 broadcast = yes networks { } max_packet_size = 4096 max_attributes = 255 } limit { cleanup_delay = 5.0 idle_timeout = 30.0 nak_lifetime = 30.0 max_connections = 1024 max_clients = 256 max_pending_packets = 256 priority { Discover = normal Request = normal Decline = normal Release = normal Inform = normal Lease-Query = low Bulk-Lease-Query = low } } } } log { colourise = yes } security { } sbin_dir = "/usr/sbin" logdir = /var/log/radius radacctdir = /var/log/radius/radacct reverse_lookups = no hostname_lookups = yes max_request_time = 30 pidfile = /var/run/radiusd/radiusd.pid debug_level = 0 max_requests = 16384 resources { } thread pool { num_networks = 1 Dynamically determined thread.workers = 2 num_workers = 2 openssl_async_pool_init = 64 openssl_async_pool_max = 1024 } migrate { rewrite_update = false forbid_update = false } } Switching to configured log settings log debug { destination = null timestamp = yes colourise = no } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> require_message_authenticator = auto limit_proxy_state = auto proto = * limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> require_message_authenticator = no limit_proxy_state = auto limit { max_connections = 16 lifetime = 0 idle_timeout = 30s } } Debugger not attached Configuration version: A2E989E4-D5C6-4963-A1D1-083575FFAC4D systemd watchdog is disabled pre-suid-down capabilities: =ep trigger { ... } subsection not found, triggers will be disabled #### Instantiating libraries #### #### Bootstrapping process modules #### #### Bootstrapping protocol modules #### #### Instantiating libraries #### #### Bootstrapping static modules #### modules { static { Loaded module rlm_always always reject { rcode = reject } always fail { rcode = fail } always ok { rcode = ok } always handled { rcode = handled } always invalid { rcode = invalid } always disallow { rcode = disallow } always notfound { rcode = notfound } always noop { rcode = noop } always updated { rcode = updated } Loaded module rlm_files files files_dhcp_network { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } files files_dhcp_host { filename = /etc/raddb/mods-config/files_dhcp/dhcp_config } } # static #### Bootstrapping rlm modules #### Bootstrapping rlm_always "disallow" Bootstrapping rlm_always "fail" Bootstrapping rlm_always "handled" Bootstrapping rlm_always "invalid" Bootstrapping rlm_always "noop" Bootstrapping rlm_always "notfound" Bootstrapping rlm_always "ok" Bootstrapping rlm_always "reject" Bootstrapping rlm_always "updated" Including dictionary file "/etc/raddb/dictionary" #### Instantiating listeners #### Compiling policies in server dhcp { ... } Compiling policies in - recv Discover {...} Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Reading file /etc/raddb/mods-config/files_dhcp/dhcp_config Compiling policies in - recv Request {...} Compiling policies in - recv Decline {...} Compiling policies in - recv Release {...} Compiling policies in - recv Inform {...} Compiling policies in - recv Lease-Query {...} /etc/raddb/sites-enabled/dhcp[307]: Skipping remaining instructions due to 'return' /etc/raddb/sites-enabled/dhcp[319]: Skipping remaining instructions due to 'return' dhcpv4 { ... } section is unused #### Instantiating process modules #### #### Instantiating protocol modules #### Instantiating proto_dhcpv4 "dhcp.dhcpv4" Instantiating proto_dhcpv4_udp "dhcp.dhcpv4.udp" #### Instantiating rlm modules #### Instantiating rlm_always "disallow" Instantiating rlm_always "fail" Instantiating rlm_always "handled" Instantiating rlm_always "invalid" Instantiating rlm_always "noop" Instantiating rlm_always "notfound" Instantiating rlm_always "ok" Instantiating rlm_always "reject" Instantiating rlm_always "updated" Scheduler created in single-threaded mode #### Opening listener interfaces #### Listening on dhcpv4_udp server * port 67 on interface ens224 bound to virtual server dhcp post-suid-down capabilities: =ep Ready to process requests proto_dhcpv4_udp - Received Discover XID f252956f length 300 dhcpv4_udp server * port 67 on interface ens224 Worker - Resetting cleanup timer to +30 (0) dhcp { (0) Received Discover XID f252956f from 0.0.0.0:68 to 255.255.255.255:67 via ens224 (0) Opcode = Client-Message (0) Hardware-Type = Ethernet (0) Hardware-Address-Length = 6 (0) Hop-Count = 0 (0) Transaction-Id = 4065498479 (0) Number-of-Seconds = 0 (0) Flags = 0 (0) Client-IP-Address = 0.0.0.0 (0) Your-IP-Address = 0.0.0.0 (0) Server-IP-Address = 0.0.0.0 (0) Gateway-IP-Address = 0.0.0.0 (0) Client-Hardware-Address = 02:01:aa:bb:cc:dd (0) Message-Type = Discover (0) Client-Identifier = 0x616263313233 (0) Network-Subnet = 0.0.0.0/32 (0) Net { (0) Src { (0) IP = 0.0.0.0 (0) Port = 68 (0) } (0) Dst { (0) IP = 255.255.255.255 (0) Port = 67 (0) } (0) Timestamp = "2024-11-08T10:16:53Z" (0) } (0) Packet-Type = Discover (0) Running 'recv Discover' from file /etc/raddb/sites-enabled/dhcp (0) recv Discover { (0) files_dhcp_network - ERROR: Expansion "network" needs to be resolved before it is used (0) files_dhcp_network (fail) (0) } # recv Discover (fail) (0) Not sending reply to client (0) dhcp (fail) (0) } # dhcp (fail) (0) Done request (0) Finished request proto_dhcpv4_udp - cleaning up request in 5.000000s ^CSignalled to terminate Exiting normally Thank you in advance, // Dmitrii.

2 7

Mailing List test
by dominic.stalder＠unibe.ch 11 Nov '24

11 Nov '24

Sorry guys, but I just wanted to check why my emails / questions don’t get to the list anymore; am I blocked or have been thrown off the list?

4 9

Google LDAP Authentication for WIFI Setup issues
by Joseph Allen 10 Nov '24

10 Nov '24

Hello, I have been working on this for several days and am tired of asking an AI for help. I have freeRadius installed on a RPI4 through apt, so its a 3.0 version. First I tried following google workspace instructions, it connects and looks up users fine, but it keeps trying to verify passwords in clear texts...no good. Next I noticed there is a mod named ldap_google in the mods-available, which says it will bind users and void the clear text issue. I configured that to connect to my workspace, fairly simple. Next I moved that file to the enabled mods folder as well as moving the google-ldap-auth file to the sites-enable folder. (I say move, I did a symbolic link). After lots of troubleshooting, I removed the default from the sites-enabled just to try and simplify everything. First I ran into issues with the filter_inner_identity, I don't quite understand why that is failing, but I saw somewhere else that is not needed, so I commented it out. Now I keep seeing this: (0) Received Access-Request Id 26 from 192.168.52.1:59099 to 192.168.52.155:1812 length 249 (0) User-Name = "test(a)test.com" (0) NAS-IP-Address = 192.168.1.89 (0) Called-Station-Id = "9A-7F-54-27-FD-35:***WIFI SSID****" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "BE-35-1A-04-D3-70" (0) Connect-Info = "CONNECT 24Mbps 802.11a" (0) Acct-Session-Id = "C349A45BB76F8134" (0) Acct-Multi-Session-Id = "9A4E5DCFE2DA284C" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027076 (0) WLAN-AKM-Suite = 1027077 (0) WLAN-Group-Mgmt-Cipher = 1027078 (0) Framed-MTU = 1400 (0) EAP-Message = 0x027b0012017465737440746573742e636f6d (0) Message-Authenticator = 0xf88e64c655b98a2aa22e62a2844fe21d (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) policy split_username_nai { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) -> TRUE (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) update request { (0) EXPAND %{1} (0) --> test (0) &Stripped-User-Name := test (0) } # update request = noop (0) if ("%{3}" != '') { (0) EXPAND %{3} (0) --> test.com (0) if ("%{3}" != '') -> TRUE (0) if ("%{3}" != '') { (0) update request { (0) EXPAND %{3} (0) --> test.com (0) &Stripped-User-Domain = test.com (0) } # update request = noop (0) } # if ("%{3}" != '') = noop (0) [updated] = updated (0) } # if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) = updated (0) ... skipping else: Preceding "if" was taken (0) } # policy split_username_nai = updated (0) update control { (0) &Cache-Status-Only := yes (0) } # update control = noop (0) cache_auth_accept: EXPAND %{md5:%{%{Stripped-User-Name}:-%{User-Name}}%{User-Password}} (0) cache_auth_accept: --> 098f6bcd4621d373cade4e832627b4f6 (0) cache_auth_accept: No cache entry found for "098f6bcd4621d373cade4e832627b4f6" (0) [cache_auth_accept] = notfound (0) if (ok) { (0) if (ok) -> FALSE (0) update control { (0) &Cache-Status-Only := yes (0) } # update control = noop (0) cache_auth_reject: EXPAND %{md5:%{Calling-Station-Id}%{Stripped-User-Name}%{User-Password}} (0) cache_auth_reject: --> c12fe59cbee87c80dea47e15189a1410 (0) cache_auth_reject: No cache entry found for "c12fe59cbee87c80dea47e15189a1410" (0) [cache_auth_reject] = notfound (0) if (ok) { (0) if (ok) -> FALSE (0) if (&User-Password && !control:Auth-Type) { (0) if (&User-Password && !control:Auth-Type) -> FALSE (0) } # authorize = updated (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/google-ldap-auth (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test(a)test.com (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) if (&control:Auth-Type == ldap) { (0) ERROR: Failed retrieving values required to evaluate condition (0) update control { (0) &Cache-TTL := 0 (0) } # update control = noop (0) cache_ldap_user_dn: EXPAND %{Stripped-User-Name} (0) cache_ldap_user_dn: --> test (0) cache_ldap_user_dn: No cache entry found for "test" (0) cache_ldap_user_dn: Creating new cache entry (0) cache_ldap_user_dn: Merging cache entry into request (0) cache_ldap_user_dn: Committed entry, TTL 86400 seconds (0) [cache_ldap_user_dn] = updated (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test(a)test.com/<no User-Password attribute>] (from client 192.168.52.1 port 0 cli BE-35-1A-04-D3-70) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 26 from 192.168.52.155:1812 to 192.168.52.1:59099 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 26 with timestamp +19 due to cleanup_delay was reached There is an IF condition in the site config to check for the User-Password before it sets the Auth-Type, however it appears there is no user password, so the condition fails and it never even attempts to connect to LDAP. So the big question, is why is there no password? I am testing with my iPad, and I am typing in a password when connecting to the Wifi. The wifi config is set to WPA Enterprise. Thanks in advance for any help

4 6

Certificate chain - 1 intermediate CA cert(s) untrusted
by Rodrigo Prieto 09 Nov '24

09 Nov '24

Hello, I have the following problem. I configured freeradius to use EAP-TLS and it works. Create the certificates with the script inside the certificates folder. The problem is that when a client connects the following error appears: Certificate chain - 1 intermediate CA cert(s) untrusted To forbid these certificates see 'reject_unknown_intermediate_ca' (TLS) untrusted certificate with depth [1] subject name /C=AR/ST=Buenos Aires/L=Virreyes/O=Lotech/emailAddress=22(a)gmail.com/CN=CA-FREERADIUS (TLS) untrusted certificate with depth [0] subject name /C=AR/ST=Buenos Aires/O=Lotech/CN=11@gmail.com/emailAddress=11@gmail.com I don't use intermediate AC. I ran c_rehash inside the certs folder. The certificates correctly point to the CA file. rivate_key_password = loli private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem ca_file = /etc/freeradius/certs/ca.pem ca_path = ${cadir} I run openssl verify with the client and server certificates and it says OK. Freeradius is installed on Ununtu 24.04. The version of openssl is: OpenSSL 3.0.13 Jan 30, 2024 (Library: OpenSSL 3.0.13 Jan 30, 2024) If anyone can help me, I appreciate it. Greetings and thanks.

2 3

openssl FIPS mode
by Timothy J. Ebben 08 Nov '24

08 Nov '24

I have set up a FreeRADIUS server to interface with a Cisco managed switch. I am able to authenticate supplicants using the EAP-TLS protocol. When I activate FIPS mode in openssl (v3.1.5), I get the following debug output: Ready to process requests (5) Received Access-Request Id 62 from 192.168.5.132:49205 to 192.168.5.83:1812 length 131 Dropping packet without response because of error: Received packet from 192.168.5.132 with invalid Message-Authenticator! (Shared secret is incorrect.) (from client cisco) I know the shared secret is correct, because it works when not in FIPS mode. The shared secret is 15 characters long and includes uppercase and lowercase letters, numbers, and special characters. Do I need additional configuration?

2 5

EAP-TLS 1.3 support (RFC 9190)
by Stephan P. 08 Nov '24

08 Nov '24

Hello together, I only have a general technical question. Does FreeRADIUS server support EAP-TLS 1.3 (as described in RFC9190)? And if yes, beginning with which version of FreeRADIUS? I looked in the changelogs, TLS 1.3 support is mentioned for EAP-TTLS and EAP-PEAP (but not for EAP-TLS) (-> version 3.0.26 (2022.09.20) and version 3.2.2 (2023.02.16)). I haven't found anything explicit about it in the documents, only the "TLS 1.3 Configuration" mailing list thread from Boby Tharappel implicating feature support. Thanks in advance. Greetings, Stephan

2 1

Re:
by Alan DeKok 07 Nov '24

07 Nov '24

On Nov 7, 2024, at 1:49 PM, Дмитрий Ахлестин <akhlestin.dmitry(a)yandex.ru> wrote: > Hello, Freeradius users, There is no need to email me directly. I read the list. > I'm engineer who is developing support of 802.1x at network operation system(NOS) based at zebos/ocnos. > At the moment my current task is to add support of CoA(change of authorization) requests from freeradius: disable exact port(make it notauthorize), restart exact port, re- authorization of user. > But I have several problems and questions: > 1. Do you know exact RFC which I can use for making my own(my vendor) CoA-Request message? I mean exact set up of TLV fields as u can see at attached example for cisco traffic. We're not going to look at zip files, they are not helpful. If you need to know what goes in a CoA-Request packet which is sent to a Cisco device, then read the Cisco documentation. If you want to invent your own attributes to go into a CoA-Request packet, then that won't work. The reasons are too complex to explain in a short message. > 2. How and what should I change at freeradius settings and configuration files that I could send such CoA request from freeradius to Authenticator? See sites-available/originate-coa. This is documented. We are not going to give a step-by-step guide for configuring your exact system. The Cisco documentation explains what the Cisco devices need in a CoA packet. The FreeRADIUS documentation explains how to configure FreeRADIUS to send attributes. It's up to you to put those together. > 3. Possible you have some examples of traffic which contains some CoA requests? Can you share it with me? Google. Or, read the Cisco documentation. Alan DeKok.

1 0

Status-Server Segfault in 3.0.27
by Adam Bishop 06 Nov '24

06 Nov '24

I'm sure I read about this issue on the list around the release of 3.0.27/3.0.5 and had thought it was fixed but searching for it in the list archive isn't coming up with anything recent. This one is running 3.0.27 - the server is segfaulting when it tries to probe a remote radius server that is unreachable: No response to status check 5 ID 75 for home server 193.63.195.50 port 1812 bt full follows at the end of the email. I do have plans to upgrade to 3.2 but not before I'd like this particular system in production. Is this a known/previously seen issue, or am I inventing a memory? Many Thanks, Adam --- #0 0x0000555555587244 in request_stats_final (request=0x555555a69bb0) at src/main/stats.c:99 listener = <optimized out> client = <optimized out> auth_stats = <optimized out> coa_stats = <optimized out> #1 0x000055555558f811 in request_stats_final (request=0x555555a69bb0) at src/main/stats.c:91 listener = <optimized out> client = <optimized out> auth_stats = <optimized out> coa_stats = <optimized out> dsc_stats = <optimized out> done = <optimized out> proxy_stats = <optimized out> #2 request_done (request=0x555555a69bb0, original=<optimized out>) at src/main/process.c:921 now = {tv_sec = 93824996240744, tv_usec = -7131984328893351168} when = {tv_sec = 140737488347520, tv_usec = 1} action = <optimized out> #3 0x0000555555591b73 in request_ping (request=0x555555a69bb0, action=<optimized out>) at src/main/process.c:3788 home = <optimized out> buffer = "193.63.195.50\000\000\000 x\246UUU\000\000\000\000\000\000\000\000\000\000x\330\363\367\377\177\000\000\024\206\345\367\377\177\000\000\020\020\246UUU\000\000\060\000\000\000\000\000\000\000\310n\222UUU\000\000X\234\246UUU\000\000Pm\222UUU\000\000\001\000\000\000\000\000\000\000\020\020\246UUU\000\000\t\244\345\367\377\177\000\000Y4[UUU\000\000B4[UUU\000" __FUNCTION__ = "request_ping" #4 0x00007ffff7f33abb in fr_event_run (when=0x7fffffffe180, el=0x555555926d50) at src/lib/event.c:321 callback = 0x555555587a80 <request_timer> ctx = 0x555555a69bb0 ev = <optimized out> callback = <optimized out> ctx = <optimized out> ev = <optimized out> #5 fr_event_run (el=el@entry=0x555555926d50, when=when@entry=0x7fffffffe180) at src/lib/event.c:278 callback = <optimized out> ctx = <optimized out> ev = <optimized out> #6 0x00007ffff7f36c3f in fr_event_loop (el=0x555555926d50) at src/lib/event.c:691 i = <optimized out> rcode = 0 when = {tv_sec = 1730907338, tv_usec = 458268} wake = <optimized out> read_fds = {fds_bits = {0 <repeats 16 times>}} write_fds = {fds_bits = {0 <repeats 16 times>}} #7 0x000055555556c3cc in main (argc=<optimized out>, argv=<optimized out>) at src/main/radiusd.c:641 rcode = 0 status = <optimized out> argval = <optimized out> spawn_flag = true display_version = false flag = 0 from_child = {-1, -1} p = <optimized out> state = <optimized out> autofree = 0x5555555d8620 Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

2 1