- Freeradius-Users - lists.freeradius.org

freeradius sql MD5-Password pap fails
by Jan-Christoph Fuchs 29 Sep '16

29 Sep '16

Hello Mailing-List Members, I have manged to set up an freeradius server with mysql backend. My Supplicants are TP-Link Accesspoints (will be exchanged to Unifi soon) with OpenWRT installed. Port-Based authentacation and dynamic VLAN assignment works. All Passwords in the MySQL Database are stored as Cleartext-Password. Everythings works fine. I have tested the envirement with radtest and Smartphones and laptops via the Accesspoint. No I have changed the Database table radcheck to store MD5-Password. Tests with radtest works, but livetest will be rejected. I really dont know much about protocolls (pap, chap, eap and so on) Debigging freeradius told me that radtest uses pap and live test via accespoint cant establish pap and uses somthing other. Is there someone who can help me please. The System is not live yet. So we can search for my fault or I also can setup a new freeradius if troubleshooting ends up with a neverending story :-) Background: We are a BOYD school. If the solution is to install a protocoll extension on every client of our students to achieve md5 passwords, than the project is not possible and I will keep Cleartext-Password Best Regards Jan If you want to see more outputs or config-file, tell me, I will post them Here is the Debug output: rad_recv: Access-Request packet from host 10.4.254.128 port 47333, id=236, length=185 User-Name = "FuchsA" Called-Station-Id = "C6-E9-84-71-33-A2:FES-WLAN" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "44-00-10-57-E4-82" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "57DD11F2-0000001E" X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027076 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x0286000b01467563687341 Message-Authenticator = 0x819d0053ba71a3c1525673a983d95924 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 134 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> FuchsA [sql] sql_set_user escaped user --> 'FuchsA' rlm_sql (sql): Reserving sql socket id: 17 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'FuchsA' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'FuchsA' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'FuchsA' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'admin' ORDER BY id [sql] User found in group admin [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'admin' ORDER BY id rlm_sql (sql): Released sql socket id: 17 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing MD5-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 236 to 10.4.254.128 port 47333 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "250" EAP-Message = 0x01870016041036755ba251ac95120aa224d97bd61aa9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2213206da51747a13dedf79c550bd5 Finished request 28. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.4.254.128 port 47333, id=237, length=200 User-Name = "FuchsA" Called-Station-Id = "C6-E9-84-71-33-A2:FES-WLAN" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "44-00-10-57-E4-82" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "57DD11F2-0000001E" X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027076 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x028700080319152b State = 0x6d2213206da51747a13dedf79c550bd5 Message-Authenticator = 0xdc30aaf425f5dabaa0472c254f5384b8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 135 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> FuchsA [sql] sql_set_user escaped user --> 'FuchsA' rlm_sql (sql): Reserving sql socket id: 16 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'FuchsA' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'FuchsA' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'FuchsA' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'admin' ORDER BY id [sql] User found in group admin [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'admin' ORDER BY id rlm_sql (sql): Released sql socket id: 16 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing MD5-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 237 to 10.4.254.128 port 47333 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "250" EAP-Message = 0x018800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2213206caa0a47a13dedf79c550bd5 Finished request 29. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.4.254.128 port 47333, id=238, length=319 User-Name = "FuchsA" Called-Station-Id = "C6-E9-84-71-33-A2:FES-WLAN" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "44-00-10-57-E4-82" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "57DD11F2-0000001E" X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027076 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x0288007f19800000007516030100700100006c030157eb768e89b2857cbe003d1389f98db48372a8570086886e7b71517d1a05be1400002000ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000a01000023000a00080006001700180019000b000201000005000501000000000012000000170000 State = 0x6d2213206caa0a47a13dedf79c550bd5 Message-Authenticator = 0x45280af78c56a967ba77f3210aa4fe44 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 136 length 127 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 117 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0070], ClientHello [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 0039], ServerHello [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 02ca], Certificate [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] TLS_accept: Need to read more data: unknown state In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 238 to 10.4.254.128 port 47333 EAP-Message = 0x0189040019c00000046616030100390200003503013cc6e4266ef83183eb4609ac0eae4f941b2e88e0103f771e18a149ae336fb3ae00c01400000dff01000100000b00040300010216030102ca0b0002c60002c30002c0308202bc308201a4a003020102020900a5fffa2bd980f52f300d06092a864886f70d01010b050030163114301206035504030c0b7261737062657272797069301e170d3136303531363039353930305a170d3236303531343039353930305a30163114301206035504030c0b726173706265727279706930820122300d06092a864886f70d01010105000382010f003082010a0282010100c3d09a5c1cf391c424a9db1c9546 EAP-Message = 0xe2d0d56ef0c7992e58cc9fddfcca2e1e792de870f1b44732e39760c9be69d00bee75ebb6544ef6e7552cd6071cf42a0314dfcf5f6588403e82906d1bdc76e22d83d897f5822cc3ad4e8688b26a7e51272de8f12178c18eeef3736db12c082c610cf4ed064ca669a8502cd0b304f9b347e9b6e792d22b7477447b724fc1a5b8feaa5bc2dab89c47f61083f2ad2a713346a45779f64738f78e6c6b50dd9fba57b8c429d9130ffe2852ae300f0da67338d241c7f9ed1a3edfd9e60e4a204888db9e7c2b2c4b2720cac0bb75955fdc8dededdcd3005b33e3c3665cb56f8fea647fe98b100ac37981f6664b06baf77672578b49510203010001a30d300b3009 EAP-Message = 0x0603551d1304023000300d06092a864886f70d01010b0500038201010059f5ccb527a5c95bd585d481cf2c0d940a2100bfe19c781f8fc6c9fe6ecf9581cc11899915a4a4a76f93ce5d9a27a1377e9f5b595d0c91b85158b46264b6bbf53d663f5972a29bb9ee27f94fa19c0e10cb315bbfff1a0b9dada6af7b44055bde3a97fce3d03d0e3d9dd2ca98d02899654c38e978067be45716b8095b7eec985ed5766a840d768fde1384f8d70c2b2b62f3bf1ce577e8c7e55870217ef8101973e33c417108d7645823438b1b637bf66d11755e23ccceabf7256480a3ce55f410d5479aa862e7cd048a3661213131c38bdcfae6a8223dbc92e680e4e8feee2c86 EAP-Message = 0xf60edf462d78a0cd61d0be2a807c82feddfb62a74cd23265bc34cf55c8de1296160301014b0c00014703001741043ead1ff12c3e5fed822014f6d59b539cabcbf196f4eb40ee5d62854c0dc2bdda5030b357400422658f71d055af54e1d62e7e5a5b9f22432c813f8003c72c570601009811ddf450723aa785b5bc9629ba26c9e1b1806b3e0ea97361040fb1b81deb2dd6e9ff5ad8e1961704df861d7487ac12fbdad29924c1f5ae6898b24f41103a99de1ee61d9a28ff0ae4db32bddace0029ac193391d575036ce541a1e8c989db3582cab0533386df57b67fa022ef71e3102b85135d484fc70a870f51145e5adb1d1881eb9ecb51be126594cd950c EAP-Message = 0x9e950b6987abca735dd6656b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2213206fab0a47a13dedf79c550bd5 Finished request 30. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.4.254.128 port 47333, id=239, length=198 User-Name = "FuchsA" Called-Station-Id = "C6-E9-84-71-33-A2:FES-WLAN" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "44-00-10-57-E4-82" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "57DD11F2-0000001E" X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027076 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x028900061900 State = 0x6d2213206fab0a47a13dedf79c550bd5 Message-Authenticator = 0x7e55a5a478220f8876242bc4959696cd # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 137 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 239 to 10.4.254.128 port 47333 EAP-Message = 0x018a007619000822c25dfccbe32a0f8e5d315cbeb3f24eda13493ae01b43ca705bfd836af6a8ac776f2152e0481330415ba2b210ef511fd77d1c99a915e5624ce91cb979472e0117e1f9abeee7791ef4bbf951f30d85246f947afe66649ba8497178fb9172a8951fb621fbcc4416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2213206ea80a47a13dedf79c550bd5 Finished request 31. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.4.254.128 port 47333, id=240, length=336 User-Name = "FuchsA" Called-Station-Id = "C6-E9-84-71-33-A2:FES-WLAN" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "44-00-10-57-E4-82" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "57DD11F2-0000001E" X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027076 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x028a00901980000000861603010046100000424104acff38e6d2efbb463eb192cbfd1960fc9726ecd13a153cfa0a86e678bcc4c07b968b58bad98e7ede0da65e40e22443b1243af69357374a908aa0eaaa8189bcbe140301000101160301003047da577f491a90ecf37d4971f3fbf1b674805e3211566f9a18a7d8237f3434aca36930765161165150e20ee086fa47be State = 0x6d2213206ea80a47a13dedf79c550bd5 Message-Authenticator = 0x01f653ca010fc02c1e138ba276e5028b # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 138 length 144 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 134 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [peap] TLS_accept: unknown state [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: unknown state [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 240 to 10.4.254.128 port 47333 EAP-Message = 0x018b004119001403010001011603010030754f1b44a5ef9a3eb053ca666d7928e0ec660a6761ee7d3cfe8502961adfdfb081f8e341bf29200b219a09d1b4f89b3a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d22132069a90a47a13dedf79c550bd5 Finished request 32. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.4.254.128 port 47333, id=241, length=198 User-Name = "FuchsA" Called-Station-Id = "C6-E9-84-71-33-A2:FES-WLAN" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "44-00-10-57-E4-82" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "57DD11F2-0000001E" X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027076 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x028b00061900 State = 0x6d22132069a90a47a13dedf79c550bd5 Message-Authenticator = 0x614e1872ae450f11e6193f10d89d1152 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 139 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 241 to 10.4.254.128 port 47333 EAP-Message = 0x018c002b1900170301002040970fe4cdfce1c98d07750e9e8dfbfe6203c4c251f1c91f41a0a8c5af703471 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d22132068ae0a47a13dedf79c550bd5 Finished request 33. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.4.254.128 port 47333, id=242, length=235 User-Name = "FuchsA" Called-Station-Id = "C6-E9-84-71-33-A2:FES-WLAN" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "44-00-10-57-E4-82" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "57DD11F2-0000001E" X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027076 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x028c002b19001703010020a4f6487c901e758952d4ebb8192b06a100c952c0f51cbf9075095376ce46d79d State = 0x6d22132068ae0a47a13dedf79c550bd5 Message-Authenticator = 0x0d74a47e1f6a7da6ff1d1d56c9306c7f # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 140 length 43 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - FuchsA [peap] Got inner identity 'FuchsA' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x028c000b01467563687341 server { [peap] Setting User-Name to FuchsA Sending tunneled request EAP-Message = 0x028c000b01467563687341 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "FuchsA" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 140 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> FuchsA [sql] sql_set_user escaped user --> 'FuchsA' rlm_sql (sql): Reserving sql socket id: 15 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'FuchsA' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'FuchsA' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'FuchsA' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'admin' ORDER BY id [sql] User found in group admin [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'admin' ORDER BY id rlm_sql (sql): Released sql socket id: 15 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing MD5-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] = handled +} # group authenticate = handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "250" EAP-Message = 0x018d00201a018d001b10221b294c64d499b6034b7a226fd25479467563687341 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8847961788ca8c9cc6104708d23e8f0f [peap] Got tunneled reply RADIUS code 11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "250" EAP-Message = 0x018d00201a018d001b10221b294c64d499b6034b7a226fd25479467563687341 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8847961788ca8c9cc6104708d23e8f0f [peap] Got tunneled Access-Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 242 to 10.4.254.128 port 47333 EAP-Message = 0x018d004b19001703010040f16b47ee01283d92c5211f2eba865c3cf690c5d8f379e6ceee8b650118294e59d208ef197054f33899aa42b3b5bb564c958de862da3e91f39a3855befbf2d416 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2213206baf0a47a13dedf79c550bd5 Finished request 34. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 10.4.254.128 port 47333, id=243, length=299 User-Name = "FuchsA" Called-Station-Id = "C6-E9-84-71-33-A2:FES-WLAN" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "44-00-10-57-E4-82" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "57DD11F2-0000001E" X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027076 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x028d006b1900170301006032b97f11dad52cbaccf648b6e4c7e35fd590aa635a565d03d9c20b05c6e279f28ca0e9805a8fc5571a52378448b1e51fe1d64414e0a0d2e183a54ff7f8b97b31fe341b0a4b65f3a2c1d63dacb20e2c2b0aad4d3b77bcef5d7cc5ca14c78dbf67 State = 0x6d2213206baf0a47a13dedf79c550bd5 Message-Authenticator = 0x4d2fe674478a1905fc8bcb893ab44529 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 141 length 107 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x028d00411a028d003c318eac3750d1e862afbc3e94a20e35e8370000000000000000f60f6c1f11e9ecee306c68cb23756e67bd0c66735896eecf00467563687341 server { [peap] Setting User-Name to FuchsA Sending tunneled request EAP-Message = 0x028d00411a028d003c318eac3750d1e862afbc3e94a20e35e8370000000000000000f60f6c1f11e9ecee306c68cb23756e67bd0c66735896eecf00467563687341 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "FuchsA" State = 0x8847961788ca8c9cc6104708d23e8f0f server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 141 length 65 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> FuchsA [sql] sql_set_user escaped user --> 'FuchsA' rlm_sql (sql): Reserving sql socket id: 14 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'FuchsA' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'FuchsA' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'FuchsA' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'admin' ORDER BY id [sql] User found in group admin [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'admin' ORDER BY id rlm_sql (sql): Released sql socket id: 14 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing MD5-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +group MS-CHAP { [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: FuchsA [mschap] Client is using MS-CHAPv2 for FuchsA, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject +} # group MS-CHAP = reject [eap] Freeing handler ++[eap] = reject +} # group authenticate = reject Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> FuchsA attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\215E=691 R=1" EAP-Message = 0x048d0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\215E=691 R=1" EAP-Message = 0x048d0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 243 to 10.4.254.128 port 47333 EAP-Message = 0x018e002b1900170301002023498abf9b5d47cb17b4ebf0b990c141fcbd38fd2a87b7d8294e62fc5da56cce Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2213206aac0a47a13dedf79c550bd5 Finished request 35. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.4.254.128 port 47333, id=244, length=235 User-Name = "FuchsA" Called-Station-Id = "C6-E9-84-71-33-A2:FES-WLAN" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "44-00-10-57-E4-82" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "57DD11F2-0000001E" X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027076 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x028e002b19001703010020f39ddab6c30dbe6e7aa9b45952c3032c64658f9f7db0a3c653ba5ec288b9ccaa State = 0x6d2213206aac0a47a13dedf79c550bd5 Message-Authenticator = 0x35027d583f9d44fccca2de40949ce9e1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "FuchsA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 142 length 43 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> FuchsA attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 36 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 36 Sending Access-Reject of id 244 to 10.4.254.128 port 47333 EAP-Message = 0x048e0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. Cleaning up request 28 ID 236 with timestamp +189 Cleaning up request 29 ID 237 with timestamp +189 Cleaning up request 30 ID 238 with timestamp +189 Cleaning up request 31 ID 239 with timestamp +189 Cleaning up request 32 ID 240 with timestamp +189 Cleaning up request 33 ID 241 with timestamp +189 Cleaning up request 34 ID 242 with timestamp +189 Waking up in 0.1 seconds. Cleaning up request 35 ID 243 with timestamp +189 Waking up in 1.0 seconds. Cleaning up request 36 ID 244 with timestamp +189 Ready to process requests.

3 4

PEAP and MSCHAPv2 with personal supplicant certificates
by Renato Rodrigues 29 Sep '16

29 Sep '16

Good afternoon everyone. I'm new to freeradius and I have been trying a few setups to implement 802.1x on our wired infrastructure + WPA Enterprise on our wireless infrastructure. We have a mixed environment with Linux and Windows 7 client machines and I have successfully configured freeradius to authenticate to our AD server, through both PEAP and EAP-TLS. Over EAP-TLS the client certificate is being verified against the CA and on the CN against the declared EAP username. I am still working on encrypting the client certificate with personal passwords on each supplicant machine (and I believe I'll succeed soon). I believe I'm close to replicating this behavior over PEAP, which would add the MSCHAPv2 authentication after the TLS validation, however this is not the full functionality that we desire. The idea is to have individual certificates for each user, encrypted with a personal password. The certificates being signed by the server CA with usernames as CNs, which we are already able to check thanks to the great templates available, and as the second step we'd like to have the user authenticated (under the encrypted TLS connection) with MSCHAP against our Active Directory. The current challenge is to lock the tunneled authentication to the same username of the certificate step. This would ensure (or at least make it harder) for privileged users to steal another certificate and impersonate that user with that certificate. I'm not sure if I have made myself clear, but we want to make sure users will only be able to use their own certificates, on their own computers and not be able to authenticate their credentials with a certificate from someone else's. What has been troublesome for me is this last step, to lock the AD authentication to the same user declared on the certificate. It seems to me that the RADIUS server would be able to reject this kind of abuse, though it might not be the way it is supposed to work. I couldn't find the right documentation on how to do it, so anything close to it can help me. Our lab right now is on a Debian server with freeradius 2.2.5, but we expect to put it in production on a pfSense firewall (I should confirm soon which version will be available there). Thank you for your time, Att, *Renato Zippert*

3 3

Re: Help for configuration 3.0.11
by Philipp Trenz 29 Sep '16

29 Sep '16

Thanks for your help! The main problem was to notice, that the ldap user has rights to search through ldap, but was denied to get the NT-Password Hash because its IP was not recognized. ldap authentification now runs like a charme! Only thing left is, that freeradius seems not to close the ldap-connection. The ldap-admin says there are "error 11"s while the connection runs into a timeout and ldap then closes the connection after 60s or so. Any guesses where to start? Freeradius is also configured to work with Accounting, is FR trying to hold the connection for setting attributes or something like this? Thanks a lot! P.S. I have to correct the version, it's a 3.0.12 build from last week. Am Donnerstag, 29. September 2016, 13:32:33 CEST schrieb freeradius-users- request(a)lists.freeradius.org: > Message: 3 > Date: Thu, 29 Sep 2016 12:08:20 +0100 > From: Brian Candler <b.candler(a)pobox.com> > To: Philipp Trenz <mail(a)philipptrenz.de>, > freeradius-users(a)lists.freeradius.org > Subject: Re: Help for configuration 3.0.11 > Message-ID: <dd527617-ed09-10f3-1c63-9daa2b9f06d7(a)pobox.com> > Content-Type: text/plain; charset=utf-8; format=flowed > > On 28/09/2016 18:21, Philipp Trenz wrote: > > As I understand, PEAP gets processed within the outer default-virtual > > server and this passes the inner MS-CHAPv2 to inner-tunnel. Now I'm > > not shure if it has to be processed through the mschap-module or > > through ldap-module. > > Both. > > > If mschap-module where or when does freeradius get the NT-Password > > from LDAP? Does the mschap-module trigger the ldap-module? > > You use the ldap module during the "authorize" phase, which finds the > account and reads out the NT password hash. Then you use the mschap > module during the "authenticate" phase, which actually checks the > supplied password against the NT password hash. > > It is very important to remember that FreeRADIUS runs the authorize > modules *first*, and the authenticate modules at the end. > > There are a couple of good articles here, specifically for using > FreeRADIUS with a FreeIPA backend: > > http://firstyear.id.au/blog/html/2016/01/13/FreeRADIUS:_Using_mschapv2_with_ > freeipa.html > http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_to_ > service_accounts..html > > They also gives the fu required to get FreeIPA to store the ipaNTHash > attribute, and to selectively expose it to the RADIUS server. > > (You don't want to expose your NT password hashes to the whole world; > they are essentially plain text passwords in their own right. A client > can use the NT password hash by itself to authenticate, without having > to brute force it) > > Regards, > > Brian.

3 3

Freeradius giving error on start
by feroze waris 29 Sep '16

29 Sep '16

Hi All, I have recently migrated from freeradius version 2 to version 3.0.11 when i strart the radius it gives me following error Thu Sep 29 10:52:47 2016 : Debug: including files in directory /usr/local/etc/raddb/policy.d/ Thu Sep 29 10:52:47 2016 : Debug: including configuration file /usr/local/etc/raddb/policy.d/canonicalization Thu Sep 29 10:52:47 2016 : Debug: including configuration file /usr/local/etc/raddb/policy.d/abfab-tr Thu Sep 29 10:52:47 2016 : Error: /usr/local/etc/raddb/policy.d/abfab-tr[12]: Parse error in condition Thu Sep 29 10:52:47 2016 : Error: /usr/local/etc/raddb/policy.d/abfab-tr[12]: (TLS-PSK-Identity) { Thu Sep 29 10:52:47 2016 : Error: /usr/local/etc/raddb/policy.d/abfab-tr[12]: ^ Expected a module return code Thu Sep 29 10:52:47 2016 : Error: Errors reading or parsing /usr/local/etc/raddb/radiusd.conf does anybody know what is happening here ?

2 2

Help for configuration 3.0.11
by Philipp Trenz 29 Sep '16

29 Sep '16

Hi freeradius-list, I'm trying to configure v3.0.11 and have some problems to understand how freeradius requests the configuration. The plan is to process requests via PEAP/MS-CHAPv2 to check MD4-Hashes against NT-Password-Attribute at a LDAP database. As I understand, PEAP gets processed within the outer default-virtual server and this passes the inner MS-CHAPv2 to inner-tunnel. Now I'm not shure if it has to be processed through the mschap-module or through ldap-module. If mschap-module where or when does freeradius get the NT-Password from LDAP? Does the mschap-module trigger the ldap-module? In details I want to upgrade a working 2.0.0 configuration to 3.0.11 (and then update to the upcoming 3.0.12 release). Another point I'm struggeling are the mappings of the LDAP attributes. I have the old ldap.attrmap, but don't know how to bring checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem to the new configuration. changing the NT-Password is more simple ;) Later on some requests should get proxied via RadSec depending on their REALM, but for now having the above working would make me quite happy. I'm very thankful for your help! Thanks!

3 2

missing.auth.so
by Ejaz 28 Sep '16

28 Sep '16

While running radiusd -X, I have following error. Would you please help.. # Loading post-auth { ...} I # server inner tunnel server default { # from file fusr/locat/freeradius3 etc/raddbisites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading accounting (...) # Loading post auth f...} 1 # server default radiusd: #### Opening IP addresses -,.d Por-Is #### listen f type = "auth" ipaddr . 172.1.40.14 port , 18120 listen type - "auth' ipaddr * port = 0 limit { max_connections lifetime 0 idletimeout = 30 Failed inding to auth a..ress 4- port 1812 bound to server .e au t: EADDRINUSE: Ad.ress a ready in use iusr/local/freeradlus3/etc/raddb/-enabledidefault[59]: Error binding to port for 0.0.0.0 port 1812 EXIT(1) CALLED src r'2.53]. ,,- error was: 1d.,0.1: radiusd: fatal: /usr/local/freeradius3/libi.roto <http://auth.so:> auth.so: o.en failed: No such Thanks, Mohammed Ejaz Asst. Operation Director of Systems. Cyberia SAUDI ARABIA P.O.Box: 301079, Riyadh 11372 Phone: (+966) 11 464 7114 Ext. 140 Mobile: (+966) 562311787 Fax: (+966) 11 465 4735 Website: http://www.cyberia.net.sa

3 4

AnyEvent::Hiredis module crashes when redis connection failed
by feroze waris 28 Sep '16

28 Sep '16

Hi All I am using Freeradius 2.2.1 server with AnyEvent::Hiredis module to connect to redis server. When my redis server stops or unreachable freeradius crashes with the following error rlm_perl: perl_embed:: module = /usr/local/etc/raddb/example.pl , func = accounting exit status= ac does not have a struct associated with it at /usr/local/share/perl5/AnyEvent/Hiredis.pm line 84. I also tried exception handling using Trycatch to catch the error but it is not working because radius already crashes before replying with error. Regards Feroze

2 2

PEAP/TTLS
by Peter Lesko 27 Sep '16

27 Sep '16

I'm having a similar issue to the one described here: http://freeradius.1045715.n5.nabble.com/PEAP-TTLS-and-Client-certificates-t… Currently, I can auth with just a signed cert, or just username/password I would like to enforce both, but I have been unable to determine the correct keywords/config after reading many forum posts, in addition to the comments provided in the default configuration I have attempted to add this config line to enforce signed certs in sites-available/default: EAP-TLS-Require-Client-Cert = yes This causes freeradius not to start for me though, and I'm pretty certain I have tried putting that in each block present in the file As for requiring user/password auth, I have tried: DEFAULT EAP-Type == EAP-Type-TLS, Auth-Type := Reject Which causes freeradius to fail to load DEFAULT EAP-Type == EAP-TLS, Auth-Type := Reject Which still allows EAP-TLS only DEFAULT EAP-Type != PEAP, Auth-Type := Reject Which still allows EAP-TLS only as well Please advise Thanks in advance, -Pete

4 5

accounting packet loss
by liran kessel 27 Sep '16

27 Sep '16

Hi In the past I have asked regarding this message that appears in the radius log Tue Sep 27 17:01:06 2016 : Error: Received conflicting packet from client XXXXXX port 33542 - ID: 47 due to unfinished request 885176866. Giving up on old request. and you explained that this is a problem probably because of my Mysql that is not managing to write quickly enough to the DB, and I understand that. However after changes we have made to other processes that run on the MySQL we have reached the point that we are only loosing messages for 2 or 3 seconds every 15 minutes when our scheduled processing runs. What I want to do is try and configure the radius to have a large enough cache to be able to handle this short spikes without losing messages, as I don’t have shortage in RAM. I have played around with the following parameters in the radiusd.conf file but they don’t see to be helping . max_requests max_request_time cleanup_delay we are not sending a reply ack to the GGSN for any message so cleanup delay as I understand it isn’t critical. is there a solution for me to “force” freeradius to be able to handle the MySQL problem without dropping messages? Thanks in Advance. Liran Kessel

5 7

Release of 3.0.12
by Alan DeKok 27 Sep '16

27 Sep '16

A belated request for last-minute tests of 3.0.12. I've pushed some changes to complain about OpenSSL. They work for me, but another check would be useful. If all is OK, I'll release 3.0.12 on Monday. For real this time. Alan DeKok.

5 10