- Freeradius-Users - lists.freeradius.org

radiusd crashing on zero length option61
by Chinnapaiyan, Nagamani 07 Dec '23

07 Dec '23

We are observing radiusd crash when we receive zero length option61 in the dhcp request message.(we are using 2 months old 4.x) 3d 00 Option: (61) Client identifier Length: 0 Value: <MISSING> Thanks, Nagamani Chinnapaiyan

3 4

Re: UnicodeDecodeError in python3 module with binary input
by Aren Sandersen 06 Dec '23

06 Dec '23

We have a commit that adds a configuration flag so that anything that can't be interpreted as UTF-8 will be a binary string instead. I'll submit it as a PR. Aren > while using the python3 module with 3.2.1 I got the following errors: > > mod_populate_vptuple:402, vp->da->name: User-Password > python_error_log:209, Exception type: <class 'UnicodeDecodeError'>, > Exception value: 'utf-8' codec can't decode byte 0xb3 in position 0: > invalid start byte > do_python_single:496, authorize - mod_populate_vps failed > do_python_single:675, authorize - RLM_MODULE_FAIL > > The cause is a switch whichs software mangles the User-Password to binary > garbage. > > Is this handling of binary values in the python module favorable? To my > feeling it would be > cleaner to convert to bytes (instead of a string). Then python can handle > binary data well. > > Or make the conversion using replacement character/ignoring encoding > errors. > > The switch will be fixed, so this is only a design question. > > Thanks for all your great work, > greetings > Hermann >

1 0

issue with reject function while handling interim-update accounting
by Vinayak Makwana 06 Dec '23

06 Dec '23

Hello all, I am facing an issue in the accounting section. I do work on freeradius accounting to handle START, STOP and INTERIM-UPDATE requests. So in an interim-update request I am getting every 1 minute. In that request i am checking user balance if user balance is not sufficient then i am using reject function to send reject request to client. but when I do use the reject function then this function directly rejects the interim-update request without sending access-reject to the client. File : sites-available/default Here's my code : ######################################################### accounting { if(Acct-Status-Type == "Interim-Update"){ if ("%{user_balance}" == 0) { reject } } } ######################################################### Please suggest to me how I can send access-reject messages to client-server. Thanks & Regards Vinayak -- *Disclaimer* In addition to generic Disclaimer which you have agreed on our website, any views or opinions presented in this email are solely those of the originator and do not necessarily represent those of the Company or its sister concerns. Any liability (in negligence, contract or otherwise) arising from any third party taking any action, or refraining from taking any action on the basis of any of the information contained in this email is hereby excluded. *Confidentiality* This communication (including any attachment/s) is intended only for the use of the addressee(s) and contains information that is PRIVILEGED AND CONFIDENTIAL. Unauthorized reading, dissemination, distribution, or copying of this communication is prohibited. Please inform originator if you have received it in error. *Caution for viruses, malware etc.* This communication, including any attachments, may not be free of viruses, trojans, similar or new contaminants/malware, interceptions or interference, and may not be compatible with your systems. You shall carry out virus/malware scanning on your own before opening any attachment to this e-mail. The sender of this e-mail and Company including its sister concerns shall not be liable for any damage that may incur to you as a result of viruses, incompleteness of this message, a delay in receipt of this message or any other computer problems.

3 4

repository issue networkradius?
by Joost Ringoot 06 Dec '23

06 Dec '23

Hi, This is not an immediate problem for me, but I think this is worth to look into. I tried to install freedius with the repository as mentioned here, but it fails, the bigger packages (+ 80 kb) appear to be truncated [ https://networkradius.com/packages/#fr32-ubuntu-jammy | https://networkradius.com/packages/#fr32-ubuntu-jammy ] downloading the packages from here [ http://packages.networkradius.com/freeradius-3.2/ubuntu/jammy/pool/main/f/f… | http://packages.networkradius.com/freeradius-3.2/ubuntu/jammy/pool/main/f/f… ] with wget, the transfer appears to be interrupted by a remote connection closed, wget can resume and downloads it in chunks of 50 - 75 kb which can then be successfull installed with apt I am working from home and tried on a server, that I prepare, I first thought that our IPS or firewall is acting up, but even from home directly on my pc without vpn connection, I have the same behaviour: with wget downloads are interrupted into chunks of 50-70 kb but appear complete in the end. Best regards, Joost [ https://networkradius.com/packages/#fr32-ubuntu-jammy ]

2 1

UnicodeDecodeError in python3 module with binary input
by Hermann.Lauer＠uni-heidelberg.de 06 Dec '23

06 Dec '23

Dear All, while using the python3 module with 3.2.1 I got the following errors: mod_populate_vptuple:402, vp->da->name: User-Password python_error_log:209, Exception type: <class 'UnicodeDecodeError'>, Exception value: 'utf-8' codec can't decode byte 0xb3 in position 0: invalid start byte do_python_single:496, authorize - mod_populate_vps failed do_python_single:675, authorize - RLM_MODULE_FAIL The cause is a switch whichs software mangles the User-Password to binary garbage. Is this handling of binary values in the python module favorable? To my feeling it would be cleaner to convert to bytes (instead of a string). Then python can handle binary data well. Or make the conversion using replacement character/ignoring encoding errors. The switch will be fixed, so this is only a design question. Thanks for all your great work, greetings Hermann -- Administration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 205; 69120 Heidelberg; Tel: (06221)54-14405 Fax: -14427 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

1 0

(no subject)
by Deepansha Gaur 04 Dec '23

04 Dec '23

Hi Team, We are in the process of migrating from radiator to freeradius. I have a test freeradius server built on Ubuntu. When I am authenticating locally, radtest is successful. I added a wireless controller client and when I try to connect to the wifi using that client and freeradius authentication, it keeps failing. I see requests from the client to freeradius server but no response from freeradius. Below are the logs for reference: a2:01:00:00:01:70 > 00:50:56:a2:64:59, IPv4, length 336: WIRELESS_IP.32778 > RADIUS_IP.1812: UDP, length 294 There's no response from the radius server. Below are the firewall rules: nft add rule ip filter input udp dport 1812 counter accept nft add rule ip filter input udp dport 1813 counter accept Please let me know if you need any further information. Thanks. Regards, Deepansha Gaur

6 8

Proxy Server Deployment - Duplication of Radacct entries in the DB
by Gabriel Marais 30 Nov '23

30 Nov '23

Hi Guys, I need some advice on setting up Proxies (correctly). Currently, I have two freeRadius servers in the EU and two proxies in Africa. The proxies are configured in a fail-over scenario pointing to the two freeRadius servers in the EU. We receive accounting packets from an upstream carrier which has a fail-over, and in some cases have a load-balance configuration on their side pointing to our proxies. Our proxies receive those packets and they are forwarded to the radius servers in the EU where all the "processing" takes place. The radius servers in the EU are connected to a MySQL cluster where we make use of accounting information for session and capping purposes. The problem now, as far as I can ascertain, is the duplication of sessions in some cases for the same "user name" and as far as I can tell this happens when a proxy server sends the accounting start packet to radius server 1 in the EU - the radius server adds the information to the DB with an unique accounting session id. When the interim update is received by the proxies and that interim update packet is sent to radius server 2 in the EU, the server then creates a new radacct entry in the DB with a new unique accounting id since it cannot find an existing session in the DB with the unique accounting id created by the radius server that first received the start packet. Is there some specific way I need to modify my queries.conf files on the radius servers in the EU or some specific way I need to configure my proxies for them to better handle cases like this? My queries.conf file is the standard out-the-box config apart from adding some relevant 3GPP values to be written on accounting start and interim update packets into the DB as received from the carrier. Thanks in advance. Regards, Gabriel

3 2

real-time graphical tool User debugging
by Giovanni Trapasso 30 Nov '23

30 Nov '23

Hello, We are in the process of migrating from Radiator to FreeRadius. One of the tools we use for debugging user authentication issues is the Radiator tool called Radar, https://radiatorsoftware.com/products/radar/. I have been searching for a similar tool for FreeRadius. My question is what do people use to debug client authentications? It looks like there is the raddebug tool where you can use with varius switches raddebug -c ’Calling-Station-Id == "xx-xx-xx-xx-xx-xx"’ Or raddebug -u <username> both from https://networkradius.com/doc/FreeRADIUS-Implementation-Ch11.pdf Anything with a Graphical interface so that others can debug users without giving them cli access? -- _______________________________________________________________ Giovanni Trapasso _______________________________________________________________

2 1

Removing spaces from User-Name
by Daniel Ryšlink 30 Nov '23

30 Nov '23

Hello, There are NAS devices (Mikrotik) in our network that generate incorrect User-Names in Access-Request packets containing spaces - example: User-Name = "MK-TRA eth 0/9:269.ether8" These packets are refused and invalid by the radius server: Invalid user (Rejected: User-Name contains whitespace): [MK-TRA eth 0/9:269.ether8] The question is - is there a way/how to do a preprocessing on the radius server to remove the whitespace characters from the User-Name? I know that the most correct solution would be to generate valid radius packets on the client side, but I already looked into the RouterOS documentation and there seem to be no fine control on how the packet is generated (User-Name is obviously constructed from configuration items, separated by said whitespaces). Any practical advice would be greatly appreciated, thank you very much in advance. -- Regards, Daniel Ryšlink

2 3

Multiple server certificates for eap with virtual servers?
by alvalon＠web.de 28 Nov '23

28 Nov '23

1 0