- Freeradius-Users - lists.freeradius.org

debugging SSL self-signed cert issues
by Malcolm Herbert 05 Nov '24

05 Nov '24

Hi - I've had a long-running setup with freeradius 3.0.16 which I acknowledge is likely quite ancient now, but I've barely had to touch it since I set it up about 4y ago ... I've been using self-signed certificate-based auth for our mobile label printers for some time without problems but after a CA certificate expiry extension (retaining the original CA key, pushing the notAfter date out) and creation of a new server-side certificate on my radius server, the clients will now generate a bad certificate alert whenever I try using it. I can replace the original server-side cert and things are ok again, so - something clearly is wrong with the new cert, but I haven't been able to pinpoint what. The old and new server cert have the same information, barring minor differences between their SANs and relevant dates. I've confirmed that openssl can verify both the old and new server certs against both the old and new CA certs and it seems to think everything is fine. For testing purposes, half the printers have been given the updated CA cert and the others are on the same original CA cert but this side of the equation doesn't appear to change the result - printers configured with either will start having issues if I start using the new server cert. I don't want to spam the list with long radiusd debug traces unless requested as I definitely think this is a cert issue of my own making, but I'm stumped as to how to get more information to isolate the underlying cause. Has anyone else encountered this problem before? Here's just the SSL negotiation in the working (original server cert) case: : : (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x8abbb4538a68ad3a (1) eap: Finished EAP session with state 0x8abbb4538a68ad3a (1) eap: Previous EAP request found for state 0x8abbb4538a68ad3a, released from the list (1) eap: Peer sent packet with method EAP PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Continuing EAP-TLS (1) eap_peap: Peer indicated complete TLS record size will be 296 bytes (1) eap_peap: Got complete TLS record (296 bytes) (1) eap_peap: [eaptls verify] = length included (1) eap_peap: (other): before SSL initialization (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0123] (1) eap_peap: TLS_accept: SSLv3/TLS read client hello (1) eap_peap: >>> send TLS 1.2 [length 0039] (1) eap_peap: TLS_accept: SSLv3/TLS write server hello (1) eap_peap: >>> send TLS 1.2 [length 0d2c] (1) eap_peap: TLS_accept: SSLv3/TLS write certificate (1) eap_peap: >>> send TLS 1.2 [length 01cd] (1) eap_peap: TLS_accept: SSLv3/TLS write key exchange (1) eap_peap: >>> send TLS 1.2 [length 0004] (1) eap_peap: TLS_accept: SSLv3/TLS write server done (1) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_peap: In SSL Handshake Phase (1) eap_peap: In SSL Accept mode (1) eap_peap: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 212 length 1004 (1) eap: EAP session adding &reply:State = 0x8abbb4538b6fad3a (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored : : Here is the same again in the failed (new server cert) case: : : (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x5f15dbf65b3fc265 (5) eap: Finished EAP session with state 0x5f15dbf65b3fc265 (5) eap: Previous EAP request found for state 0x5f15dbf65b3fc265, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer indicated complete TLS record size will be 7 bytes (5) eap_peap: Got complete TLS record (7 bytes) (5) eap_peap: [eaptls verify] = length included (5) eap_peap: <<< recv TLS 1.2 [length 0002] (5) eap_peap: ERROR: TLS Alert read:fatal:bad certificate (5) eap_peap: TLS_accept: Need to read more data: error (5) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate (5) eap_peap: In SSL Handshake Phase (5) eap_peap: In SSL Accept mode (5) eap_peap: SSL Application Data (5) eap_peap: ERROR: TLS failed during operation (5) eap_peap: ERROR: [eaptls process] = fail (5) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (5) eap: Sending EAP Failure (code 4) ID 42 length 4 (5) eap: Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Post-Auth-Type REJECT { : : Regards, Malcolm -- Malcolm Herbert mjch(a)mjch.net

2 2

Duplicate "object" definition
by Alex Zetaeffesse 04 Nov '24

04 Nov '24

Hi all, I apologize if I don't use the right terminology. I'm playing/testing with 3.2.6 to better understand how freeradius behaves when finding duplicate definitions. I created a copy of the filter policy, calling it policy.d/filter2 and I defined the object/policy filter_username in this way: filter_username { if (&User-Name) { reject } } Now, when in the directory policy.d I only have the file filter2, I always get the expected Access-Reject, if I just have the default file filter I get Access-Accept (the user is correctly configured in the file users). If I have both files (filter and filter 2), when I launch radiusd -X I get, the file filter is loaded first and then the file filter2 ... *including configuration file /etc/freeradius/policy.d/filter <<<*including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/accounting *including configuration file /etc/freeradius/policy.d/filter2 <<<* ... and I always get Access-Accept. How are duplicate objects treated? Is the first definition that's retained or the last? From my experiment it seems the first is retained. May you please confirm? Regards, Alex

3 3

Check LDAP if object exist with filter based on user's certificate attributest after EAP-TLS auth succeeds?
by Alexey D. Filimonov 04 Nov '24

04 Nov '24

In short, I have EAP-TLS auth, and I need to check if there is an LDAP object that has value of `TLS-Client-Cert-Subject-Alt-Name-Upn` in `krbCanonicalName` attribute and it's `createTimestamp` is less or equal than `TLS-Client-Cert-Valid-Since` value. 1. I found that `TLS-Client-Cert-Subject-Alt-Name-Upn` attribute is created only inside `authenticate { Auth-Type eap { ... }}` section. Is it correct that I have no access to certificate properties inside `authorize` section? 2. Next, I found that according to [rlm_ldap guide from networkradius](https://www.networkradius.com/doc/current/raddb/mods-availab…, ldap module can `look for user` only inside `authorize` section, but not inside `authenticate`. Is it correct I can not make a check for existence of an object in LDAP from `authenticate` section using `rlm_ldap` module, and only xlat-ing can be used? 3. I found that there are some xlat functions exposed by `rlm_ldap` module, but they are only mentioned in my `mods-available/ldap`, and not documented in `3.2.x` branch on github. I vave FreeRADIUS version from debian-stable and it is `3.2.1`. Is raddb/mods-available/ldap from master branch is useful as documentation for 3.2.1 ldap?

2 3

How to bypass some logic during EAP-TLS auth?
by Alexey D. Filimonov 03 Nov '24

03 Nov '24

Currently I have several if()s in authorize{} before eap and I think I can not move it past EAP call But during EAP authentication I see this logic gets executed 8(!) times in -X debug session. Can I wrap those if()s into some rule like "If session is new, then execute wrapped logic, else - just bypass wrapped block"? authorize { if (!(&NAS-Port-Type && &NAS-Port-Type == Wireless-802.11)) { update request { &Module-Failure-Message += 'Rejected: NAS-Port-Type is not Wireless-802.11.' } reject } rewrite_called_station_id if (!Called-Station-SSID) { update request { &Module-Failure-Message += 'Rejected: No SSID in Called-Station-Id' } reject } if ("%{client:vlan_for_%{Called-Station-SSID}}") { update session-state { Tunnel-Type := VLAN # rfc3580 Tunnel-Medium-Type := IEEE-802 #rfc2628 Tunnel-Private-Group-Id := "%{client:vlan_for_%{Called-Station-SSID}}" # string, rfc2628 } } else { update request { &Module-Failure-Message += "Rejected: No vlan_for_%{Called-Station-SSID} defined for client %{client:shortname}" } reject } if (!(&User-Name)) { update request { &Module-Failure-Message += 'Rejected: User-Name not provided.' } reject } eap_wifi { ok = return updated = return } } authenticate { eap_wifi }

3 2

dynamic client
by mohamed almeshal 03 Nov '24

03 Nov '24

dear all this config file for dynamic client work fine without any problems but my goal is to accept any connection from any nas I try to do * in ipaddr but didn't work also I try it with listen part but also not work # SQL_LISTEN_CONFIG_START listen { type = auth port = 1812 ipaddr = * proto = udp limit { max_pps = 1000 } } listen { type = acct port = 1813 ipaddr = * proto = udp limit { max_pps = 1000 } } # SQL_LISTEN_CONFIG_END client dynamic { # CLIENT_IPADDR_START ipaddr = 0.0.0.0/0 # CLIENT_IPADDR_END dynamic_clients = dynamic_clients lifetime = 1 } server dynamic_clients { authorize { if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { update control { &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" &FreeRADIUS-Client-Require-MA = no &FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" } ok } } }

1 0

Ignoring duplicate packet from client
by Mamun Ahmed 02 Nov '24

02 Nov '24

Hello, I'm using Ubuntu server 22.04 and FreeRADIUS Version 3.0.26 I'm trying to connect with Mikrotik and my mikrotik has 267 users but when users are trying to connect to freeradius the freeradius Error: (0) Ignoring duplicate packet from client SaraNet port 46328 - ID: 175 due to unfinished request in component authorize module sql. my database server is capable of handling 267 users and also freeradius server. database resource 2GB Memory and 2 CPU freeradius resource 1GB Memory and 1CPU can you guide me? how can I prevent duplicate packet from client. Is Freeradius have by default configuration to prevent duplicate packet from client or any configuration?. I need to solve this error anyway. I'm trying to solve this problem by changing some the freeradius configuration but I can't solve it. Fri Sep 6 07:03:22 2024 : Info: Loaded virtual server inner-tunnel Fri Sep 6 07:03:22 2024 : Info: Ready to process requests Fri Sep 6 07:06:44 2024 : Error: (0) Ignoring duplicate packet from client SaraNet port 46328 - ID: 175 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (1) Ignoring duplicate packet from client SaraNet port 45985 - ID: 176 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (2) Ignoring duplicate packet from client SaraNet port 54469 - ID: 177 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (3) Ignoring duplicate packet from client SaraNet port 57714 - ID: 178 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (4) Ignoring duplicate packet from client SaraNet port 37314 - ID: 179 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (5) Ignoring duplicate packet from client SaraNet port 52315 - ID: 180 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (7) Ignoring duplicate packet from client SaraNet port 38181 - ID: 182 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (6) Ignoring duplicate packet from client SaraNet port 48777 - ID: 181 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (8) Ignoring duplicate packet from client SaraNet port 49147 - ID: 183 due to unfinished request in component authorize module sql Fri Sep 6 07:06:44 2024 : Error: (9) Ignoring duplicate packet from client SaraNet port 38949 - ID: 184 due to unfinished request in component authorize module sql *Sincerly* Mamun Ahmed

3 2

IP assignment based on AD group
by Rodrigo Abrantes Antunes 31 Oct '24

31 Oct '24

Hi, I currently have vlan assignment based on ad group working flawlessly for my wireless clients. Now I want ip assignment, is it possible? I tried to achieve that with the ippool module but I think I am missing something. How should I configure the wlc or the dhcp server? mods-enabled/ippool ippool professores-cstsi { filename = ${db_dir}/ippools/professores-cstsi.ippool range_start = 172.17.10.1 range_stop = 172.17.10.20 netmask = 255.255.0.0 cache_size = 20 ip_index = ${db_dir}/ippools/professores-cstsi.ipindex override = yes maximum_timeout = 0 } users DEFAULT LDAP-Group == "test", Pool-Name := "professores-cstsi" Thanks.

5 14

Pass client attributes from client.conf to post-auth section
by Alexey D. Filimonov 30 Oct '24

30 Oct '24

Is it possible to have client shortname (from clients.conf) or any custom per-client property inside post-auth and post-proxy block? Problem: I have multiple physical locations of different "types", each location type has it's own requirement for Tunnel-Private-Group-Id. With MS NPS, I have AAA clients named location-a@location-type-x@ap1 location-a@location-type-x@ap2 location-b@location-type-x@ap1 location-c@location-type-z@ap1 location-c@location-type-z@ap2 And I build access rules logic with conditions like "rule when client name match /@location-type-x@/" and "another rule when client name match /@location-type-z@/". With FreeRADIUS I found no information about client shortname in debug_all output inside post-auth block. I can build huge ruleset of additional unlang logic like this, or maybe more simple... if (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "100" } } elsif (&NAS-IP-Address == "1.1.1.1" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "101" } } elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "100" } } elsif (&NAS-IP-Address == "1.1.1.2" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "101" } } elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid1/) { update response { Tunnel-Private-Group-Id = "203" } } elsif (&NAS-IP-Address == "1.1.2.1" && Called-Station-Id =~ /:ssid2/) { update response { Tunnel-Private-Group-Id = "204" } } ... But in my opinion, 1) there must be a way not to duplicate client address information in both post-auth and clients.conf 2) amount of code looks stupid when scaled to tens of locations.

2 2

Can I use diffrent root CA certificates while dynamic loading certificate chains?
by James Fan 28 Oct '24

28 Oct '24

Hi, we have a case that, with multi-tenancy, there will be multiple CA certificates in our FreeRadius server, so we need to load the certificate chains dynamically. But when I use the statements below, I can't include the CA certificates in the certificate files I set. The TLS-Session-Cert-File looks like it is only for the server certificate and intermediate CA certificates. Is there any chance of dynamic loading certificate chains with root CA certificates? Thanks. authenticate { ... Auth-Type eap { if ("%{unpack:&EAP-Message 4 byte}" == 1) { update control { TLS-Session-Cert-File := "${certdir}/realms/%{Realm}" } } eap } ... }

4 8

General Issues
by mohamed almeshal 28 Oct '24

28 Oct '24

Dear Savers , I'm doing lot's of work with FreeRadius , but I'm stuck with 3 major issues. * What is the best max_pps that can handle heavy load , also what is best database software that can handle heavy load . * Doing some modifications to default sites-available what is best way to implement modifications in database queries for custom purpose . * Is modified the queries of the FreeRadius to lower the load like shrink the data being inserted or updated. Will effect the FreerRadius as all Thanks ,

2 1