- Freeradius-Users - lists.freeradius.org

Using rest with sending post request
by Çağlar Karahan 12 Aug '24

12 Aug '24

Dear all, I want to use the rest module to send post authentication to the server. Related config files are shown below. *default: * authorize { if ("%{Service-Type}" == "Login") { if (&Message-Authenticator) { rest } } } *rest:* rest { connect_uri = "https://127.0.0.1:4433/" tls { client_cert = /path/to/client/cert.pem client_key = /path/to/client/key.key disable_verify_peer = yes check_cert = no check_cert_cn = no } authorize { uri = "${..connect_uri}api/v1/login" method = 'post' body = 'json' tls = ${..tls} data = '{"user": {"name":"%{User-Name}", "passwd": "%{User-Password}"}, "attributes": {"messageAuthenticator": "%{Message-Authenticator}", "clientIP":"%{Packet-Src-IP-Address}"}}' header = 'Content-Type: application/json' connect_timeout = 30 recv_timeout = 30 } } To test it I am using radclient with below command: echo "Service-Type=1, User-Name=caglar,User-Password=caglar, Message-Authenticator=0x00" | ./radclient -s -x -P udp a.b.c.d:1812 auth shared_secret When running freeradius in debug mode, I am seeing that below error: *(0) rest: ERROR: Request failed: 56 - Failure when receiving data from the peer(0) rest: ERROR: Server returned no data* I am also testing server with curl command. And it works properly. curl -v -k -H 'Content-Type: application/json' -d '{ "user": { "passwd":"caglar", "name":"caglar"}, "attributes": { "messageAuthenticator":"0x00", "clientIp": "a.b.c.d"}}' -X POST https://127.0.0.1:4433/api/v1/login --cert /path/to/client/cert.pem --key /path/to/client/key.key Thanks for your support, Caglar

1 0

Re: xfs filesystem being remounted
by Alan DeKok 09 Aug '24

09 Aug '24

Please do not CC me on messages to the list. In case you hadn't noticed, I subscribe to the list. It doesn't help to get duplicate messages. > On Aug 9, 2024, at 12:46 AM, (null) (null) <kckong1(a)yahoo.com> wrote: > > This issue may not be related to the FreeRADIUS service but rather to the operating system (RHEL 7.9). > > I would appreciate any advice or clues regarding why, after restarting FreeRADIUS, messages below the XFS filesystem being remounted appear in dmesg. These messages are being produced by the OS, and have nothing to do with FreeRADIUS. There's probably a local service script to restart FreeRAIDUS. That script does a number of things when it runs, including file system things. If the message doesn't appear in the FreeRADIUS log, then it wasn't created by FreeRADIUS, and it has nothing to do with FreeRADIUS. Alan DeKok.

1 0

We have released version 3.0.0 of the pam_radius module
by Alan DeKok 09 Aug '24

09 Aug '24

This release has a number of fixes, including mitigations for the BlastRADIUS attack. > Begin forwarded message: > > From: Matthew Newton <notifications(a)github.com> > Subject: [FreeRADIUS/pam_radius] Release release_3_0_0 - 3.0.0 > Date: August 9, 2024 at 5:37:04 AM EDT > To: FreeRADIUS/pam_radius <pam_radius(a)noreply.github.com> > Cc: Subscribed <subscribed(a)noreply.github.com> > Reply-To: FreeRADIUS/pam_radius <noreply(a)github.com> > > > 3.0.0 <https://github.com/FreeRADIUS/pam_radius/releases/tag/release_3_0_0> > Repository: FreeRADIUS/pam_radius <https://github.com/FreeRADIUS/pam_radius> · Tag: release_3_0_0 <https://github.com/FreeRADIUS/pam_radius/tree/release_3_0_0> · Commit: b6442c3 <https://github.com/FreeRADIUS/pam_radius/commit/b6442c3e0147f1019990520483f…> · Released by: mcnewton <https://github.com/mcnewton> > Feature improvements > > RPM and DEB packages can be built from the source. Just do "make rpm" or "make deb". > Add continuous integration (CI) tests > Configuration is now in /etc/pam_radius_auth.conf > BlastRADIUS attack mitigations (add Message-Authenticator to Access-Request packets, new require_message_authenticator config flag) > Bug fixes > > All known and reported bugs have been fixed. > Ignore packets from unknown sources. Based on patches from Alex Malowany. > Remove obsolete functionality (Old-Password support, workarounds for Livingston RADIUS server, password change support, etc) > — > This release has 6 assets: > > pam_radius-3.0.0.tar.bz2 > pam_radius-3.0.0.tar.bz2.sig > pam_radius-3.0.0.tar.gz > pam_radius-3.0.0.tar.gz.sig > Source code (zip) > Source code (tar.gz) > Visit the release page <https://github.com/FreeRADIUS/pam_radius/releases/tag/release_3_0_0> to download them. > > — > You are receiving this because you are watching this repository. > View it on GitHub <https://github.com/FreeRADIUS/pam_radius/releases/tag/release_3_0_0> or unsubscribe <https://github.com/FreeRADIUS/pam_radius/unsubscribe_via_email/AAAEJTE3WYHD…> from all notifications for this repository. >

1 0

rlm_rest: Parsing the response attributes
by Michael Schwartzkopff 24 Jul '24

24 Jul '24

Hi, My REST API service returns something like: { "count": 1, "next": null, "previous": null, "results": [ ... ] } The rest module of FR tells me: rest: Failed parsing attribute: Invalid vendor name in attribute name "count", skipping Is there any possibility to map the return attributes from my REST service to FR attributes? Michael Schwartzkopff

2 2

Freeradius sql module usage
by Alan Smith 23 Jul '24

23 Jul '24

Hi everyone, How may I encrypt the password used in Connection info in SQL module? Kindly advise. Thanks.

6 9

Importing users and nas clients from the radius files to a mysql database
by Conrad Classen 23 Jul '24

23 Jul '24

Hi Is there a tool that can be run (Linux Rocky9) to import the freeradius users and the nas clients to a mysql (mariadb) database? If so, please can you point me to it ...-- Conrad

4 7

disable password checking against ldap
by Kong Kai Chen 23 Jul '24

23 Jul '24

In steel belted radius (SBR), we can setup sbr to do a simple bind to ldap database. In such as setup, sbr will omit password checking. If the bind is successful (meaning username is found in ldap) then reply accept being sent back to radius client. When I try to do this in freeradius, it passes the authentication process to ldap and insists on checking the password. How can I disable the password checking in freeRadius?

5 12

Separate FR instance for TLS (RADSEC)?
by James Wood 21 Jul '24

21 Jul '24

On a production server running standard RADIUS on UDP 1812/1813, is it recommended to run TLS based authentication (port 2083 for RADSEC etc) as just another server on the same instance/process, or is there a benefit in running that as a separate instance/process for security/performance reasons? Thanks James

1 0

Issue with home server proxy after upgrading from 3.2.3 to 3.2.5
by James Wood 21 Jul '24

21 Jul '24

After upgrading from 3.2.3 to 3.2.5, when proxying to third party home servers, the request stalls and after 30 seconds gives up. Two examples are below, both different servers depending on the realm. One is Google's radsec server and one is WBA's OpenRoaming radsec server. I've tried multiple clients, Android, iOS and Windows with the same result Example 1: Sun Jul 14 18:33:21 2024 : Debug: (0) Proxying due to Home-Server-Name Sun Jul 14 18:33:21 2024 : Debug: (0) Starting proxy to home server 146.148.44.172 port 2083 Sun Jul 14 18:33:21 2024 : Debug: (0) server default { Sun Jul 14 18:33:21 2024 : Debug: (0) # Executing section pre-proxy from file /usr/local/etc/raddb/sites-enabled/default Sun Jul 14 18:33:21 2024 : Debug: (0) pre-proxy { Sun Jul 14 18:33:21 2024 : Debug: (0) } # pre-proxy = noop Sun Jul 14 18:33:21 2024 : Debug: (0) } Sun Jul 14 18:33:21 2024 : Debug: (0) proxy: Trying to allocate ID (0/2) Sun Jul 14 18:33:21 2024 : Debug: (0) proxy: Trying to open a new listener to the home server Sun Jul 14 18:33:21 2024 : Debug: (TLS) Trying new outgoing proxy connection to proxy (0.0.0.0, 0) -> home_server (146.148.44.172, 2083) Sun Jul 14 18:33:21 2024 : Debug: Requiring Server certificate Sun Jul 14 18:33:21 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [PINIT] - before SSL initialization (0) Sun Jul 14 18:33:21 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [PINIT] - Client before SSL initialization (0) Sun Jul 14 18:33:21 2024 : Debug: (0) (TLS) RADIUS/TLS - send TLS 1.3 Handshake, ClientHello Sun Jul 14 18:33:21 2024 : Debug: Waking up in 0.3 seconds. Sun Jul 14 18:33:21 2024 : Debug: (0) (TLS) RADIUS/TLS - Client : Need to write more data: SSLv3/TLS write client hello Sun Jul 14 18:33:21 2024 : Debug: (0) (TLS) RADIUS/TLS - tls_new_client_session WANT_WRITE Sun Jul 14 18:33:21 2024 : Debug: Opened new proxy socket 'proxy (10.210.0.17, 49473) -> home_server (146.148.44.172, 2083)' Sun Jul 14 18:33:21 2024 : Debug: (0) proxy: Trying to allocate ID (1/2) Sun Jul 14 18:33:21 2024 : Debug: Listening on proxy (10.210.0.17, 49473) -> home_server (146.148.44.172, 2083) Sun Jul 14 18:33:21 2024 : Debug: Waking up in 0.3 seconds. Sun Jul 14 18:33:21 2024 : Debug: (0) proxy: request is now in proxy hash Sun Jul 14 18:33:21 2024 : Debug: (0) proxy: allocating destination 146.148.44.172 port 2083 - Id 160 Sun Jul 14 18:33:21 2024 : Debug: (0) Proxying request to home server 146.148.44.172 port 2083 (TLS) timeout 30.000000 Sun Jul 14 18:33:21 2024 : Debug: (0) Sent Access-Request Id 160 from 10.210.0.17:49473 to 146.148.44.172:2083 length 457 Sun Jul 14 18:33:21 2024 : Debug: (0) User-Name = " anonymous(a)openroaming.goog" Sun Jul 14 18:33:21 2024 : Debug: (0) NAS-IP-Address = 192.168.1.116 Sun Jul 14 18:33:21 2024 : Debug: (0) NAS-Identifier = "E0-CB-BC-8A-1A-6E:vap2" Sun Jul 14 18:33:21 2024 : Debug: (0) Called-Station-Id := "EA-CB-AC-8A-1A-6E" Sun Jul 14 18:33:21 2024 : Debug: (0) NAS-Port-Type = Wireless-802.11 Sun Jul 14 18:33:21 2024 : Debug: (0) Service-Type = Framed-User Sun Jul 14 18:33:21 2024 : Debug: (0) NAS-Port = 2 Sun Jul 14 18:33:21 2024 : Debug: (0) Calling-Station-Id := "7A-74-DB-94-B9-B9" Sun Jul 14 18:33:21 2024 : Debug: (0) Connect-Info = "CONNECT 54.00 Mbps / 802.11ac / RSSI: 66 / Channel: 40" Sun Jul 14 18:33:21 2024 : Debug: (0) Acct-Session-Id = "436F6F1202EEE66A" Sun Jul 14 18:33:21 2024 : Debug: (0) Acct-Multi-Session-Id = "80C9B13F6851715F" Sun Jul 14 18:33:21 2024 : Debug: (0) WLAN-Pairwise-Cipher = 1027076 Sun Jul 14 18:33:21 2024 : Debug: (0) WLAN-Group-Cipher = 1027076 Sun Jul 14 18:33:21 2024 : Debug: (0) WLAN-AKM-Suite = 1027073 Sun Jul 14 18:33:21 2024 : Debug: (0) Meraki-Ap-Name = "meraki-mr42-test-ap" Sun Jul 14 18:33:21 2024 : Debug: (0) Meraki-Ap-Tags = " recently-added " Sun Jul 14 18:33:21 2024 : Debug: (0) Meraki-Device-Name = "meraki-mr42-test-ap" Sun Jul 14 18:33:21 2024 : Debug: (0) Framed-MTU = 1400 Sun Jul 14 18:33:21 2024 : Debug: (0) EAP-Message = 0x0263001f01616e6f6e796d6f7573406f70656e726f616d696e672e676f6f67 Sun Jul 14 18:33:21 2024 : Debug: (0) HS20-AP-Version = 1 Sun Jul 14 18:33:21 2024 : Debug: (0) HS20-Mobile-Device-Version = 0x010000 Sun Jul 14 18:33:21 2024 : Debug: (0) HS20-Roaming-Consortium = 0x5a03ba0000 Sun Jul 14 18:33:21 2024 : Debug: (0) Message-Authenticator = 0x291dcaa493772a756028e8807f7966f6 Sun Jul 14 18:33:21 2024 : Debug: (0) Event-Timestamp = "Jul 14 2024 18:33:21 UTC" Sun Jul 14 18:33:21 2024 : Debug: (0) Proxy-State = 0x323134 Sun Jul 14 18:33:21 2024 : Debug: (0) (TLS) RADIUS/TLS - Client : Need to write more data: SSLv3/TLS write client hello Sun Jul 14 18:33:21 2024 : Debug: (TLS) SSL_connect() returned WANT_WRITE Sun Jul 14 18:33:21 2024 : Debug: (0) (TLS) has 0 bytes in the buffer Sun Jul 14 18:33:21 2024 : Debug: (0) (TLS) Saving 457 bytes of RADIUS traffic for later (total 457) Sun Jul 14 18:33:21 2024 : Debug: Thread 5 waiting to be assigned a request Sun Jul 14 18:33:21 2024 : Debug: (0) Expecting proxy response no later than 29.671359 seconds from now Sun Jul 14 18:33:21 2024 : Debug: Waking up in 29.6 seconds. Sun Jul 14 18:33:22 2024 : Debug: Suppressing duplicate proxied request (tcp) to home server 146.148.44.172 port 2083 proto TCP - ID: 160 Sun Jul 14 18:33:22 2024 : Debug: Waking up in 29.0 seconds. Sun Jul 14 18:33:23 2024 : Debug: Suppressing duplicate proxied request (tcp) to home server 146.148.44.172 port 2083 proto TCP - ID: 160 Sun Jul 14 18:33:23 2024 : Debug: Waking up in 28.0 seconds. Example 2: Sun Jul 14 21:19:02 2024 : Debug: (3) Proxying due to Home-Server-Name Sun Jul 14 21:19:02 2024 : Debug: (3) Starting proxy to home server 34.71.27.162 port 2083 Sun Jul 14 21:19:02 2024 : Debug: (3) server default { Sun Jul 14 21:19:02 2024 : Debug: (3) # Executing section pre-proxy from file /usr/local/etc/raddb/sites-enabled/default Sun Jul 14 21:19:02 2024 : Debug: (3) pre-proxy { Sun Jul 14 21:19:02 2024 : Debug: (3) } # pre-proxy = noop Sun Jul 14 21:19:02 2024 : Debug: (3) } Sun Jul 14 21:19:02 2024 : Debug: (3) proxy: Trying to allocate ID (0/2) Sun Jul 14 21:19:02 2024 : Debug: (3) proxy: Trying to open a new listener to the home server Sun Jul 14 21:19:02 2024 : Debug: (TLS) Trying new outgoing proxy connection to proxy (0.0.0.0, 0) -> home_server (34.71.27.162, 2083) Sun Jul 14 21:19:02 2024 : Debug: Requiring Server certificate Sun Jul 14 21:19:02 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [PINIT] - before SSL initialization (0) Sun Jul 14 21:19:02 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [PINIT] - Client before SSL initialization (0) Sun Jul 14 21:19:02 2024 : Debug: (0) (TLS) RADIUS/TLS - send TLS 1.3 Handshake, ClientHello Sun Jul 14 21:19:02 2024 : Debug: (0) (TLS) RADIUS/TLS - Client : Need to write more data: SSLv3/TLS write client hello Sun Jul 14 21:19:02 2024 : Debug: (0) (TLS) RADIUS/TLS - tls_new_client_session WANT_WRITE Sun Jul 14 21:19:02 2024 : Debug: Opened new proxy socket 'proxy (10.210.0.17, 58915) -> home_server (34.71.27.162, 2083)' Sun Jul 14 21:19:02 2024 : Debug: Listening on proxy (10.210.0.17, 58915) -> home_server (34.71.27.162, 2083) Sun Jul 14 21:19:02 2024 : Debug: Waking up in 0.3 seconds. Sun Jul 14 21:19:02 2024 : Debug: (3) proxy: Trying to allocate ID (1/2) Sun Jul 14 21:19:02 2024 : Debug: (3) proxy: request is now in proxy hash Sun Jul 14 21:19:02 2024 : Debug: (3) proxy: allocating destination 34.71.27.162 port 2083 - Id 129 Sun Jul 14 21:19:02 2024 : Debug: (3) Proxying request to home server 34.71.27.162 port 2083 (TLS) timeout 30.000000 Sun Jul 14 21:19:02 2024 : Debug: (3) Sent Access-Request Id 129 from 10.210.0.17:58915 to 34.71.27.162:2083 length 459 Sun Jul 14 21:19:02 2024 : Debug: (3) User-Name = " anonymous(a)test.orportal.org" Sun Jul 14 21:19:02 2024 : Debug: (3) NAS-IP-Address = 192.168.1.116 Sun Jul 14 21:19:02 2024 : Debug: (3) NAS-Identifier = "E0-CB-BC-8A-1A-6E:vap2" Sun Jul 14 21:19:02 2024 : Debug: (3) Called-Station-Id := "EA-CB-AC-8A-1A-6E" Sun Jul 14 21:19:02 2024 : Debug: (3) NAS-Port-Type = Wireless-802.11 Sun Jul 14 21:19:02 2024 : Debug: (3) Service-Type = Framed-User Sun Jul 14 21:19:02 2024 : Debug: (3) NAS-Port = 1 Sun Jul 14 21:19:02 2024 : Debug: (3) Calling-Station-Id := "92-D4-9F-CE-0B-03" Sun Jul 14 21:19:02 2024 : Debug: (3) Connect-Info = "CONNECT 54.00 Mbps / 802.11ac / RSSI: 66 / Channel: 40" Sun Jul 14 21:19:02 2024 : Debug: (3) Acct-Session-Id = "D603341511C2BCD5" Sun Jul 14 21:19:02 2024 : Debug: (3) Acct-Multi-Session-Id = "8E65FAC05F4D0058" Sun Jul 14 21:19:02 2024 : Debug: (3) WLAN-Pairwise-Cipher = 1027076 Sun Jul 14 21:19:02 2024 : Debug: (3) WLAN-Group-Cipher = 1027076 Sun Jul 14 21:19:02 2024 : Debug: (3) WLAN-AKM-Suite = 1027073 Sun Jul 14 21:19:02 2024 : Debug: (3) Meraki-Ap-Name = "meraki-mr42-test-ap" Sun Jul 14 21:19:02 2024 : Debug: (3) Meraki-Ap-Tags = " recently-added " Sun Jul 14 21:19:02 2024 : Debug: (3) Meraki-Device-Name = "meraki-mr42-test-ap" Sun Jul 14 21:19:02 2024 : Debug: (3) Framed-MTU = 1400 Sun Jul 14 21:19:02 2024 : Debug: (3) EAP-Message = 0x02fa002001616e6f6e796d6f757340746573742e6f72706f7274616c2e6f7267 Sun Jul 14 21:19:02 2024 : Debug: (3) HS20-AP-Version = 1 Sun Jul 14 21:19:02 2024 : Debug: (3) HS20-Mobile-Device-Version = 0x010000 Sun Jul 14 21:19:02 2024 : Debug: (3) HS20-Roaming-Consortium = 0x5a03ba0000 Sun Jul 14 21:19:02 2024 : Debug: (3) Message-Authenticator = 0xaca57ed0829ccbef818ef945142ee620 Sun Jul 14 21:19:02 2024 : Debug: (3) Event-Timestamp = "Jul 14 2024 21:19:02 UTC" Sun Jul 14 21:19:02 2024 : Debug: (3) Proxy-State = 0x313238 Sun Jul 14 21:19:02 2024 : Debug: (0) (TLS) RADIUS/TLS - Client : Need to write more data: SSLv3/TLS write client hello Sun Jul 14 21:19:02 2024 : Debug: (TLS) SSL_connect() returned WANT_WRITE Sun Jul 14 21:19:02 2024 : Debug: (3) (TLS) has 0 bytes in the buffer Sun Jul 14 21:19:02 2024 : Debug: (3) (TLS) Saving 459 bytes of RADIUS traffic for later (total 459) Sun Jul 14 21:19:02 2024 : Debug: Thread 2 waiting to be assigned a request Sun Jul 14 21:19:02 2024 : Debug: (3) Expecting proxy response no later than 29.673344 seconds from now Sun Jul 14 21:19:02 2024 : Debug: Waking up in 29.6 seconds. Sun Jul 14 21:19:03 2024 : Debug: Suppressing duplicate proxied request (tcp) to home server 34.71.27.162 port 2083 proto TCP - ID: 129 Sun Jul 14 21:19:03 2024 : Debug: Waking up in 29.0 seconds. Sun Jul 14 21:19:04 2024 : Debug: Suppressing duplicate proxied request (tcp) to home server 34.71.27.162 port 2083 proto TCP - ID: 129 Sun Jul 14 21:19:04 2024 : Debug: Waking up in 28.0 seconds. Sun Jul 14 21:19:32 2024 : Debug: (3) No proxy response, giving up on request and marking it done Sun Jul 14 21:19:32 2024 : Proxy: Marking home server 34.71.27.162 port 2083 as zombie (it has not responded in 30.000000 seconds). Sun Jul 14 21:19:32 2024 : ERROR: (3) Failing proxied request for user " anonymous(a)test.orportal.org", due to lack of any response from home server 34.71.27.162 port 2083 Sun Jul 14 21:19:32 2024 : Debug: Waking up in 0.3 seconds. Sun Jul 14 21:19:32 2024 : Debug: Thread 1 got semaphore Sun Jul 14 21:19:32 2024 : Debug: Thread 1 handling request 3, (1 handled so far) Sun Jul 14 21:19:32 2024 : Debug: (3) Clearing existing &reply: attributes Sun Jul 14 21:19:32 2024 : Debug: (3) Found Post-Proxy-Type Fail-Authentication Sun Jul 14 21:19:32 2024 : Debug: (3) server default { Sun Jul 14 21:19:32 2024 : Debug: (3) Post-Proxy-Type sub-section not found. Ignoring. Sun Jul 14 21:19:32 2024 : Debug: (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Sun Jul 14 21:19:32 2024 : Debug: (3) } Sun Jul 14 21:19:32 2024 : Auth: (3) Login incorrect (Home Server failed to respond): [anonymous(a)test.orportal.org/<via Auth-Type = eap>] (from client 158.115.148.241 port 1 cli 92-D4-9F-CE-0B-03) However, sometimes, after a long delay, when the AP sends another request/retry, it will work: Sun Jul 14 21:12:33 2024 : Debug: (0) Proxying due to Home-Server-Name Sun Jul 14 21:12:33 2024 : Debug: (0) Starting proxy to home server 34.71.27.162 port 2083 Sun Jul 14 21:12:33 2024 : Debug: (0) server default { Sun Jul 14 21:12:33 2024 : Debug: (0) # Executing section pre-proxy from file /usr/local/etc/raddb/sites-enabled/default Sun Jul 14 21:12:33 2024 : Debug: (0) pre-proxy { Sun Jul 14 21:12:33 2024 : Debug: (0) } # pre-proxy = noop Sun Jul 14 21:12:33 2024 : Debug: (0) } Sun Jul 14 21:12:33 2024 : Debug: (0) proxy: Trying to allocate ID (0/2) Sun Jul 14 21:12:33 2024 : Debug: (0) proxy: Trying to open a new listener to the home server Sun Jul 14 21:12:33 2024 : Debug: (TLS) Trying new outgoing proxy connection to proxy (0.0.0.0, 0) -> home_server (34.71.27.162, 2083) Sun Jul 14 21:12:33 2024 : Debug: Requiring Server certificate Sun Jul 14 21:12:33 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [PINIT] - before SSL initialization (0) Sun Jul 14 21:12:33 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [PINIT] - Client before SSL initialization (0) Sun Jul 14 21:12:33 2024 : Debug: (0) (TLS) RADIUS/TLS - send TLS 1.3 Handshake, ClientHello Sun Jul 14 21:12:33 2024 : Debug: (0) (TLS) RADIUS/TLS - Client : Need to write more data: SSLv3/TLS write client hello Sun Jul 14 21:12:33 2024 : Debug: (0) (TLS) RADIUS/TLS - tls_new_client_session WANT_WRITE Sun Jul 14 21:12:33 2024 : Debug: Opened new proxy socket 'proxy (10.210.0.17, 52075) -> home_server (34.71.27.162, 2083)' Sun Jul 14 21:12:33 2024 : Debug: (0) proxy: Trying to allocate ID (1/2) Sun Jul 14 21:12:33 2024 : Debug: (0) proxy: request is now in proxy hash Sun Jul 14 21:12:33 2024 : Debug: (0) proxy: allocating destination 34.71.27.162 port 2083 - Id 125 Sun Jul 14 21:12:33 2024 : Debug: (0) Proxying request to home server 34.71.27.162 port 2083 (TLS) timeout 30.000000 Sun Jul 14 21:12:33 2024 : Debug: (0) Sent Access-Request Id 125 from 10.210.0.17:52075 to 34.71.27.162:2083 length 457 Sun Jul 14 21:12:33 2024 : Debug: (0) User-Name = " anonymous(a)test.orportal.org" Sun Jul 14 21:12:33 2024 : Debug: (0) NAS-IP-Address = 192.168.1.116 Sun Jul 14 21:12:33 2024 : Debug: (0) NAS-Identifier = "E0-CB-BC-8A-1A-6E:vap2" Sun Jul 14 21:12:33 2024 : Debug: (0) Called-Station-Id := "EA-CB-BC-8A-1A-6E" Sun Jul 14 21:12:33 2024 : Debug: (0) NAS-Port-Type = Wireless-802.11 Sun Jul 14 21:12:33 2024 : Debug: (0) Service-Type = Framed-User Sun Jul 14 21:12:33 2024 : Debug: (0) NAS-Port = 1 Sun Jul 14 21:12:33 2024 : Debug: (0) Calling-Station-Id := "92-D4-9F-CE-0B-03" Sun Jul 14 21:12:33 2024 : Debug: (0) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 66 / Channel: 11" Sun Jul 14 21:12:33 2024 : Debug: (0) Acct-Session-Id = "C761770D256A61C9" Sun Jul 14 21:12:33 2024 : Debug: (0) Acct-Multi-Session-Id = "6004A9491042AF0E" Sun Jul 14 21:12:33 2024 : Debug: (0) WLAN-Pairwise-Cipher = 1027076 Sun Jul 14 21:12:33 2024 : Debug: (0) WLAN-Group-Cipher = 1027076 Sun Jul 14 21:12:33 2024 : Debug: (0) WLAN-AKM-Suite = 1027073 Sun Jul 14 21:12:33 2024 : Debug: (0) Meraki-Network-Name = "WiFi SDK" Sun Jul 14 21:12:33 2024 : Debug: (0) Meraki-Ap-Name = "meraki-mr42-test-ap" Sun Jul 14 21:12:33 2024 : Debug: (0) Meraki-Ap-Tags = " recently-added " Sun Jul 14 21:12:33 2024 : Debug: (0) Meraki-Device-Name = "meraki-mr42-test-ap" Sun Jul 14 21:12:33 2024 : Debug: (0) Framed-MTU = 1400 Sun Jul 14 21:12:33 2024 : Debug: (0) EAP-Message = 0x024c002001616e6f6e796d6f757340746573742e6f72706f7274616c2e6f7267 Sun Jul 14 21:12:33 2024 : Debug: (0) HS20-AP-Version = 1 Sun Jul 14 21:12:33 2024 : Debug: (0) HS20-Mobile-Device-Version = 0x010000 Sun Jul 14 21:12:33 2024 : Debug: Waking up in 0.3 seconds. Sun Jul 14 21:12:33 2024 : Debug: Listening on proxy (10.210.0.17, 52075) -> home_server (34.71.27.162, 2083) Sun Jul 14 21:12:33 2024 : Debug: (0) HS20-Roaming-Consortium = 0x5a03ba0000 Sun Jul 14 21:12:33 2024 : Debug: (0) Message-Authenticator = 0x682d40e95aad80a327255abd7a299545 Sun Jul 14 21:12:33 2024 : Debug: (0) Event-Timestamp = "Jul 14 2024 21:12:33 UTC" Sun Jul 14 21:12:33 2024 : Debug: Waking up in 0.3 seconds. Sun Jul 14 21:12:33 2024 : Debug: (0) Login-IP-Host := 158.115.148.241 Sun Jul 14 21:12:33 2024 : Debug: (0) Proxy-State = 0x3931 Sun Jul 14 21:12:33 2024 : Debug: (0) (TLS) RADIUS/TLS - Client : Need to write more data: SSLv3/TLS write client hello Sun Jul 14 21:12:33 2024 : Debug: (TLS) SSL_connect() returned WANT_WRITE Sun Jul 14 21:12:33 2024 : Debug: (0) (TLS) has 0 bytes in the buffer Sun Jul 14 21:12:33 2024 : Debug: (0) (TLS) Saving 457 bytes of RADIUS traffic for later (total 457) Sun Jul 14 21:12:33 2024 : Debug: Thread 5 waiting to be assigned a request Sun Jul 14 21:12:33 2024 : Debug: (0) Expecting proxy response no later than 29.670882 seconds from now Sun Jul 14 21:12:33 2024 : Debug: Waking up in 29.6 seconds. Sun Jul 14 21:12:34 2024 : Debug: Suppressing duplicate proxied request (tcp) to home server 34.71.27.162 port 2083 proto TCP - ID: 125 Sun Jul 14 21:12:34 2024 : Debug: Waking up in 29.1 seconds. Sun Jul 14 21:12:35 2024 : Debug: Suppressing duplicate proxied request (tcp) to home server 34.71.27.162 port 2083 proto TCP - ID: 125 Sun Jul 14 21:12:35 2024 : Debug: Waking up in 28.1 seconds. [delay of approx 11 seconds] Sun Jul 14 21:12:46 2024 : Debug: (1) Proxying due to Home-Server-Name Sun Jul 14 21:12:46 2024 : Debug: (1) Starting proxy to home server 34.71.27.162 port 2083 Sun Jul 14 21:12:46 2024 : Debug: (1) server default { Sun Jul 14 21:12:46 2024 : Debug: (1) # Executing section pre-proxy from file /usr/local/etc/raddb/sites-enabled/default Sun Jul 14 21:12:46 2024 : Debug: (1) pre-proxy { Sun Jul 14 21:12:46 2024 : Debug: (1) } # pre-proxy = noop Sun Jul 14 21:12:46 2024 : Debug: (1) } Sun Jul 14 21:12:46 2024 : Debug: (1) proxy: Trying to allocate ID (0/2) Sun Jul 14 21:12:46 2024 : Debug: (1) proxy: request is now in proxy hash Sun Jul 14 21:12:46 2024 : Debug: (1) proxy: allocating destination 34.71.27.162 port 2083 - Id 218 Sun Jul 14 21:12:46 2024 : Debug: (1) Proxying request to home server 34.71.27.162 port 2083 (TLS) timeout 30.000000 Sun Jul 14 21:12:46 2024 : Debug: (1) Sent Access-Request Id 218 from 10.210.0.17:52075 to 34.71.27.162:2083 length 459 Sun Jul 14 21:12:46 2024 : Debug: (1) User-Name = " anonymous(a)test.orportal.org" Sun Jul 14 21:12:46 2024 : Debug: (1) NAS-IP-Address = 192.168.1.116 Sun Jul 14 21:12:46 2024 : Debug: (1) NAS-Identifier = "E0-CB-BC-8A-1A-6E:vap2" Sun Jul 14 21:12:46 2024 : Debug: (1) Called-Station-Id := "EA-CB-AC-8A-1A-6E" Sun Jul 14 21:12:46 2024 : Debug: (1) NAS-Port-Type = Wireless-802.11 Sun Jul 14 21:12:46 2024 : Debug: (1) Service-Type = Framed-User Sun Jul 14 21:12:46 2024 : Debug: (1) NAS-Port = 1 Sun Jul 14 21:12:46 2024 : Debug: (1) Calling-Station-Id := "92-D4-9F-CE-0B-03" Sun Jul 14 21:12:46 2024 : Debug: (1) Connect-Info = "CONNECT 54.00 Mbps / 802.11ac / RSSI: 59 / Channel: 40" Sun Jul 14 21:12:46 2024 : Debug: (1) Acct-Session-Id = "61F9B0FCE7763CE0" Sun Jul 14 21:12:46 2024 : Debug: (1) Acct-Multi-Session-Id = "8549D73EAF2A1D02" Sun Jul 14 21:12:46 2024 : Debug: (1) WLAN-Pairwise-Cipher = 1027076 Sun Jul 14 21:12:46 2024 : Debug: (1) WLAN-Group-Cipher = 1027076 Sun Jul 14 21:12:46 2024 : Debug: (1) WLAN-AKM-Suite = 1027073 Sun Jul 14 21:12:46 2024 : Debug: (1) Meraki-Ap-Name = "meraki-mr42-test-ap" Sun Jul 14 21:12:46 2024 : Debug: (1) Meraki-Ap-Tags = " recently-added " Sun Jul 14 21:12:46 2024 : Debug: (1) Meraki-Device-Name = "meraki-mr42-test-ap" Sun Jul 14 21:12:46 2024 : Debug: (1) Framed-MTU = 1400 Sun Jul 14 21:12:46 2024 : Debug: (1) EAP-Message = 0x0244002001616e6f6e796d6f757340746573742e6f72706f7274616c2e6f7267 Sun Jul 14 21:12:46 2024 : Debug: (1) HS20-AP-Version = 1 Sun Jul 14 21:12:46 2024 : Debug: (1) HS20-Mobile-Device-Version = 0x010000 Sun Jul 14 21:12:46 2024 : Debug: (1) HS20-Roaming-Consortium = 0x5a03ba0000 Sun Jul 14 21:12:46 2024 : Debug: (1) Message-Authenticator = 0xc65d316989bbd3bf645feb05d9cd5633 Sun Jul 14 21:12:46 2024 : Debug: (1) Event-Timestamp = "Jul 14 2024 21:12:46 UTC" Sun Jul 14 21:12:46 2024 : Debug: (1) Proxy-State = 0x313133 Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [TWCH] - Client SSLv3/TLS write client hello (12) Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Client : Need to read more data: SSLv3/TLS write client hello Sun Jul 14 21:12:46 2024 : Debug: (TLS) SSL_connect() returned WANT_READ Sun Jul 14 21:12:46 2024 : Debug: (1) (TLS) has 457 bytes in the buffer Sun Jul 14 21:12:46 2024 : Debug: (1) (TLS) Saving 459 bytes of RADIUS traffic for later (total 916) Sun Jul 14 21:12:46 2024 : Debug: Thread 4 waiting to be assigned a request Sun Jul 14 21:12:46 2024 : Debug: Waking up in 0.3 seconds. Sun Jul 14 21:12:46 2024 : Debug: Proxy SSL socket has data to read Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [TWCH] - Client SSLv3/TLS write client hello (12) Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - recv TLS 1.3 Handshake, ServerHello Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [TRSH] - Client SSLv3/TLS read server hello (3) Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - recv TLS 1.3 Handshake, EncryptedExtensions Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [TREE] - Client TLSv1.3 read encrypted extensions (38) Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - recv TLS 1.3 Handshake, CertificateRequest Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Client : Need to read more data: SSLv3/TLS read server certificate request Sun Jul 14 21:12:46 2024 : Debug: (TLS) SSL_connect() returned WANT_READ Sun Jul 14 21:12:46 2024 : Debug: Waking up in 0.2 seconds. Sun Jul 14 21:12:46 2024 : Debug: Proxy SSL socket has data to read Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Handshake state [TRCR] - Client SSLv3/TLS read server certificate request (7) Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - recv TLS 1.3 Handshake, Certificate Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Creating attributes from 4 certificate in chain Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) chain-depth : 3 Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) error : 0 Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) common name : openroaming.org Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) subject : /C=US/ST=California/L=San Jose/O=Cisco Systems, Inc./OU=Openroaming/CN= openroaming.org/emailAddress=enb-devops@cisco.com Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) issuer : /C=US/ST=California/L=San Jose/O=Cisco Systems, Inc./OU=Openroaming/CN= openroaming.org/emailAddress=enb-devops@cisco.com Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) verify return : 1 Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Creating attributes from 3 certificate in chain Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) chain-depth : 2 Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) error : 0 Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) common name : openroaming.org Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) subject : /C=SG/ST=Singapore/L=Singapore/O=Wireless Broadband Alliance/OU=WBA/CN= openroaming.org/emailAddress=enb-devops@cisco.com/dnQualifier=WBA WRIX ECC Policy Intermediate CA-01 Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) issuer : /C=US/ST=California/L=San Jose/O=Cisco Systems, Inc./OU=Openroaming/CN= openroaming.org/emailAddress=enb-devops@cisco.com Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) verify return : 1 Sun Jul 14 21:12:46 2024 : Debug: (0) (TLS) RADIUS/TLS - Creating attributes from 2 certificate in chain and the rest works.... auth is successful. When I restore back to 3.2.3 with the exact same config, it works the first time, every time. I have tested against 4 different proxy home servers and they all have similar behaviour so it must be some local issue. Any thoughts? Thanks, James

3 7

Internal error during the authentication
by Çağlar Karahan 18 Jul '24

18 Jul '24

I am building Freeradius 3.2.2 and Openssl 3.3.0 separately. And for enabling tls 1.0 and legacy ciphers, I configured both of them. *My freeradius eap configuration as shown below* eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 tls-config tls-common { private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${certdir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT@SECLEVEL=0" tls_min_version = "1.0" ecdh_curve = "secp256k1:secp384r1:secp521r1:prime256v1:X448:X25519" cache { enable = no lifetime = 24 max_entries = 255 } verify{} } tls { tls = tls-common } } To test the TLSv1.0 authentication, I am using eapol_test as a client which is provided by wpa supplicant (v 2.9). And I have already configured the openssl.cnf file in the client computer as it supports tlsv1.0. *eapol_test configuration file:* network={ phase1="tls_disable_tlsv1_0=0 tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1 tls_disable_tlsv1_3=1 peapver=0" ssid="test-ssid" key_mgmt=WPA-EAP eap=TLS identity="testuser" ca_cert="/path/to/ca.pem" client_cert="/path/to/client.pem" private_key="/path/to/client.key" private_key_passwd="clientkeypassword" eapol_flags=3 } Testing with eapol_test is working properly and successfully. But when another hardware device is used as a client with same configured certificates and configurations, I am getting an error as below Debug: (14) eap_tls: (TLS) recv TLS 1.0 Alert, fatal internal_error Debug: (14) eap_tls: (TLS) The client is informing us that there is a failure inside the TLS protocol exchange. ERROR: (14) eap_tls: (TLS) Alert read:fatal:internal error Debug: (14) eap_tls: (TLS) Server : Need to read more data: error ERROR: (14) eap_tls: (TLS) Failed reading from OpenSSL: ssl/record/rec_layer_s3.c[907]:error:0A000438:SSL routines::tlsv1 alert internal error Debug: (14) eap_tls: (TLS) In Handshake Phase Debug: (14) eap_tls: (TLS) Application data. ERROR: (14) eap_tls: (TLS) Cannot continue, as the peer is misbehaving. ERROR: (14) eap_tls: [eaptls process] = fail ERROR: (14) eap: Failed continuing EAP TLS (13) session. EAP sub-module failed Do you have any thoughts about this issue? I know that it is probably about the client side. But any suggestions or thoughts would be great. I have already checked certificates, protocol matches and cipher suites that are provided by client and server side. Thank you. Caglar

1 0