- Freeradius-Users - lists.freeradius.org

Problem with datetime and mysql
by ANGEL LUIS MATEO MARTINEZ 19 Sep '23

19 Sep '23

Hello, I have a running freeradius with Ubuntu 18.04 and freeradius 3.0.19. In this system I'm using mysql to store accounting records in a MySQL database (radacct). To achieve this, I'm using the buffered-sql site. This is working fine. Now I'm developing a new updated system with Ubuntu 22.04 and freeradius 3.0.26. I'm trying to configure this same MySQL database. I'm using the same database. Although the store in the database is working, I have a problem with datetime stored in acctstarttime, aactupdatetime and acctstoptime columns. The problem is that the datetime stored is 1 hour ahead of my current time. I have both SO configured with the same timezone. In my case, it's Europe/Madrid (CEST, GMT+2 now). I have also the same queries.conf file in both systems. I'm using the queries.conf distributed with the freeradius 3.0.26 22.04 package. In this file: ... event_timestamp_epoch = "%{%{integer:Event-Timestamp}:-%l}" # event_timestamp is the SQL snippet for converting an epoch timestamp # to an SQL date. event_timestamp = "FROM_UNIXTIME(${event_timestamp_epoch})" ... start { # # Insert a new record into the sessions table # query = "\ INSERT INTO ${....acct_table1} \ (${...column_list}) \ VALUES \ ('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', \ '%{NAS-IP-Address}', \ '%{%{NAS-Port-ID}:-%{NAS-Port}}', \ '%{NAS-Port-Type}', \ ${....event_timestamp}, \ ${....event_timestamp}, \ NULL, \ '0', \ '%{Acct-Authentic}', \ '%{Connect-Info}', \ '', \ '0', \ '0', \ '%{Called-Station-Id}', \ '%{Calling-Station-Id}', \ '', \ '%{Service-Type}', \ '%{Framed-Protocol}', \ '%{Framed-IP-Address}', \ '%{Framed-IPv6-Address}', \ '%{Framed-IPv6-Prefix}', \ '%{Framed-Interface-Id}', \ '%{Delegated-IPv6-Prefix}' \ ${....class.packet_xlat})" ... With this configuration, I have this Start record in my old system: Fri Sep 15 09:33:10 2023 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 15728730 NAS-Port-Type = Virtual User-Name = "XXXXX(a)um.es" Calling-Station-Id = "155.54.67.5" Called-Station-Id = "155.54.213.7" MS-CHAP-Domain = "um.es" Acct-Session-Id = "81a00056" Framed-IP-Address = 155.54.192.37 Acct-Authentic = RADIUS Event-Timestamp = "Sep 15 2023 09:33:10 CEST" Acct-Status-Type = Start NAS-Identifier = "MikroTik-Pruebas" Acct-Delay-Time = 0 Mikrotik-Realm = "um.es" NAS-IP-Address = 155.54.213.7 Huntgroup-Name = "vpn" X-Atica-Service = "vpn" X-Atica-Service-Filter = "vpn" Stripped-User-Name = "XXXXX" Realm = "um.es" Timestamp = 1694763190 and the corresponding insert query in the database is: use dbradiuslog; SET timestamp=1694763191; INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('81a00056', 'eb9b9fe238b5a46ac0e6be64acd6ec58', 'XXXXX(a)um.es', 'um.es', '155.54.213.7', '15728730', 'Virtual', FROM_UNIXTIME(1694763190), FROM_UNIXTIME(1694763190), NULL, '0', 'RADIUS', '', '', '0', '0', '155.54.213.7', '155.54.67.5', '', 'Framed-User', 'PPP', '155.54.192.37', '', '', '', '' ); where the 1694763191 timestamp is "Fri Sep 15 2023 09:33:11 GMT+0200" and 1694763190 is "Fri Sep 15 2023 09:33:10 GMT+0200" and datetimes are correct. But in the updated system I have this detail entry: Fri Sep 15 09:35:47 2023 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 15728731 NAS-Port-Type = Virtual User-Name = "XXXXX(a)um.es" Calling-Station-Id = "155.54.67.5" Called-Station-Id = "155.54.213.7" MS-CHAP-Domain = "um.es" Acct-Session-Id = "81a00057" Framed-IP-Address = 155.54.194.50 Acct-Authentic = RADIUS Event-Timestamp = "Sep 15 2023 09:35:47 CEST" Acct-Status-Type = Start NAS-Identifier = "MikroTik-Pruebas" Acct-Delay-Time = 0 Mikrotik-Realm = "um.es" NAS-IP-Address = 155.54.213.7 Huntgroup-Name = "vpn" X-Atica-Service = "vpn" X-Atica-Service-Filter = "vpn" Stripped-User-Name = "XXXXX" Realm = "um.es" Timestamp = 1694763347 and the insert query is: use dbradiuslog; SET timestamp=1694763348; INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('81a00057', '186c6d4ebe375d3178097fe46f3bdaae', 'XXXXX(a)um.es', 'um.es', '155.54.213.7', '15728731', 'Virtual', FROM_UNIXTIME(1694766947), FROM_UNIXTIME(1694766947), NULL, '0', 'RADIUS', '', '', '0', '0', '155.54.213.7', '155.54.67.5', '', 'Framed-User', 'PPP', '155.54.194.50', '', '', '', '' ); in this case, the first 1694763348 datetime (the used in SET) corresponds to "Fri Sep 15 2023 09:35:48 GMT+0200" (it's fine), but the 1694766947 used in FROM_UNIX(1694766947) corresponds to "Fri Sep 15 2023 10:35:47 GMT+0200" which is wrong. The date stored in the database is wrong too. It seems that there is a problem somewhere in the transformation from the Event-Timestamp entry in the detail to the epoch used in the SQL query. Any help with this? Thank you.

2 4

MySQL Client Issue
by Selahattin CILEK 18 Sep '23

18 Sep '23

I have been installing FreeRADIUS 3 on pfSense for about out 5 years and it always came bundled with some version of *mysql57-client* (this or that minor version) and it always worked well with *mysql57-server* (again, this or that minor version), which FreeRADIUS connected to. To give you a context, the last time I installed was about a month ago and the versions were as follows: pfSense -> 2.6.0 (FreeBSD 1.3-STABLE) FreeRADIUS -> 3.0.25 MySQL Client -> 5.736 But the guys at pfSense decided to skip version 13 of FreeBSD and build version 2.7.0 on FreeBSDversion 14. The 2.7.0 version of pfSense comes with *freeradius3-3.2.2* and *mysql80-client-8.0.32_2* . Of course, I could just install *mysql80-client-8.0.32_2* and modify my SQL code a little bit and it would still work. But the problem is that I have Syslog-NG installed on the system and it too connects to the same MySQL instance and though it has been upgraded to version 4.20, it still uses the old *mysql57-client. * So is there a way to get FreeRADIUS 3.2.2 to work with the old MySQL client, you know, using the good old "libdbi" driver? * * -- This email has been checked for viruses by Avast antivirus software. www.avast.com

4 12

When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work
by 平林哲 15 Sep '23

15 Sep '23

Hi! When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work. Register a user in ActiveDirectory with the password "pass\"word@2022", the following LDAP settings. === # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\"word@2022" base_dn = 'dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' === When attempting to start the RADIUS service in this state, a syntax error occurred. ===== # /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 /usr/local/etc/raddb/mods-enabled/ldap1[4]: Syntax error: Expected comma after 'pass\\': word@2022" Errors reading or parsing /usr/local/etc/raddb/radiusd.conf ===== We also tried several patterns and summarised the results. Password | Configration | Result -------------------|-----------------------|------- pass"word@2022 | "pass\"word@2022" | OK pass\"word@2022 | "pass\\"word@2022" | Syntax error pass\\"word@2022 | "pass\\\"word@2022" | OK pass\\\"word@2022 | "pass\\\\"word@2022" | Syntax error As mentioned above, a Syntax Error occurs when '\' is an even number in the configuration. After investigating the cause of this, it appears that there is a problem with the determination of '˶' in the following section. === /* * Convert backslash-quote to quote, but * leave everything else alone. */ if (p[1] == quote) { /* convert '\'' --> ' */ p++; } else { if (buflen < 2) { fr_strerror_printf("Truncated input"); return T_INVALID; } *(s++) = *(p++); } *(s++) = *(p++); } === This problem was solved by changing the above section as follows. === } else { /* * Convert backslash-quote to quote, but * leave everything else alone. */ if (p[1] == quote) { /* convert '\'' --> ' */ if (p[2] != '\0') { p++; } } *(s++) = *(p++); } === Is this the right approach? Any advice would be appreciated.

4 24

Windows and TLS 1.0 / TLS 1.1
by Alan DeKok 11 Sep '23

11 Sep '23

Microsoft is disabled TLS 1.0 and TLS 1.1 in newer versions of Windows. This shouldn't affect most people. However, if you're running a very old RADIUS server (e.g. 5+ years), then it's time to upgrade. Your users will not be able to get online. https://www.theregister.com/2023/09/04/tls_windows_deprecation/ Alan DeKok.

2 2

How to cleanly shut down a PEAP TLS tunnel
by Joe Garcia 11 Sep '23

11 Sep '23

I've got a client that tries to shut down the TLS tunnel used for PEAP after running through the full authentication process and getting the Access-Accept/Success at the end. However the Access-Accept/Success comes in without a State attribute, and if the TLS Close-Alert (appropriately wrapped in several layers of outer protocols) is sent that way then FreeRADIUS reports: (18) eap: ERROR: EAP requires the State attribute to work, but no State exists in the Access-Request packet. (18) eap: ERROR: The RADIUS client is broken. No amount of changing FreeRADIUS will fix the RADIUS client. (18) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request If OTOH I use the State value from the last message preceding the Access-Accept/Success I get: (37) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x57f74ed950ff57da (37) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request What's the correct way to perform a clean shutdown of the TLS tunnel after completing the PEAP authentication process? Or do you just leave it hanging? Although no two diagrams seem to be able to agree on what happens at this point, one example is this: https://mrncciew.files.wordpress.com/2014/08/eap-peap-20.png which tears down the tunnel at step 15 and then the client gets the Access-Accept/Success at step 16/17, while with FreeRADIUS I'm getting the Access-Accept/Success before the TLS tunnel is torn down and then one of the two errors above with an attempt to tear down the tunnel. JG.

2 2

Is Radius Authorization bound to Radius Authentication?
by little-nemo＠virgilio.it 08 Sep '23

08 Sep '23

Dear members, I managed to autenticate users through MschapV2/ntlm_auth vs Active Directory (reference#1 https://networkradius.com/articles/2021/02/04/active-directory-with-FreeRAD…, reference#2 https://networkradius.com/articles/2021/09/29/configure-authentication-with…) Freeradius version: 3.0.21. Then I read "Authentication systems and protocol compatibility https://networkradius.com/articles/2021/10/08/authentication-system-and-pro…" and "Authenticating Users with LDAP https://freeradius.org/documentation/freeradius-server/3.2.4/concepts/modul…", so now I wonder whether I could also use LDAP(S) for the Authorization phase-only. The doubt comes from the presence of the "identity" in mods-available/ldap. Is that Identity used for the binding to AD? I guess so. Thus, username/password of the user trying to authenticate are not involved in the LDAP binding. Am I wrong? Is it worth to spend additional time to study how to setup LDAP Authorization? The primary goal is to read group membership but in future other needs may arise. Thanks in advance for your time. Pietro

2 1

freeradius windows machine authentication
by Härtl, Calvin 04 Sep '23

04 Sep '23

Hi all, first of all thanks for your great help in my past questions! Sadly, I have yet another one, that I can not quite figure out. Maybe I missed something, I don’t know. I tried looking for past list-threads, to no avail. When my Windows client connects to the WiFi and subsequently to the FreeRADIUS server, it first authenticates via machine authentication (host/HOSTNAME.MYDOMAIN.COM) This fails and the client cannot connect to the WiFi: (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) eap_mschapv2: authenticate { (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: Client is using MS-CHAPv2 (6) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (6) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (6) mschap: --> --username=host/HOSTNAME.DOMAIN.COM (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (6) mschap: --> --challenge=ef98e59da6aea4aa (6) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (6) mschap: --> --nt-response=1e7106295666480efb781446f97f618e57e09017da042590 (6) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (6) mschap: External script failed (6) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) eap_mschapv2: [mschap] = reject (6) eap_mschapv2: } # authenticate = reject However, if I manually configure the WiFi on my Windows device to only use user authentication, it works flawlessly (as expected): (14) eap_mschapv2: authenticate { (14) mschap: Creating challenge hash with username: calvin.haertl (14) mschap: Client is using MS-CHAPv2 (14) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (14) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (14) mschap: --> --username=MYUSERNAME (14) mschap: Creating challenge hash with username: MYUSERNAME (14) mschap: Program returned code (0) (14) mschap: Adding MS-CHAPv2 MPPE keys (14) eap_mschapv2: [mschap] = ok (14) eap_mschapv2: } # authenticate = ok (14) eap_mschapv2: MSCHAP Success (14) eap: Sending EAP Request (code 1) ID 9 length 51 My FreeRADIUS server is connected to our Active Directory via SAMBA and winbind, and I checked that the users can authenticate via radtest. Is FreeRADIUS natively capable of doing machine authentication via AD, do I have to configure some additional files or are there any modules that I can install to do this for me? Kind regards, Calvin

4 5

Observing a common error in Freeradius with Postgres but not justification why it happens
by Ibrahim Al Mahfooz 02 Sep '23

02 Sep '23

Hello all, We have implemented freeradius 3.2.3 with Postgresql 12.15 to store accounting packets i.e start, interim-update, stop for reporting purposes. We customized the queries files to store fewer columns than the original schema since this is what we need. The following columns are customized in the accounting queries and same columns in postgres radacct table: radacctid, acctsessionid, acctuniqueid, acctstarttime, acctudpatetime, acctstoptime, callingstationid, framedipaddress, imei, 3gpplocation. Also the following indexes are in radacct table: 1. radacct_active_session_idx (this is the original from FR schema of postgresql) 2. framedipaddress, starttime, stoptime, updatetime (This one we added to use upon need in our read queries on report generation) Currently, from postgres dashboard we observe around 300-400 write/update transactions. The issue we noticed a couple of days ago is there were a lot of messages in radius log stating "Error: xxx requests have been waiting in the processing queue for x seconds. Check that all databases are running properly!" And sometimes we see another warning stating "Warning: Please check the configuration file. The value for 'max_requests' is probably set too low. " Based on the above observed messages, we tuned two matters: 1. the postgresql db by changing the default shared_buffer from 128MB to 8GB since we have plenty of RAM in the server, and this clearly reflected in the performance and removed around 98% of the above error messages. However we sometimes see the same error message showing up in peak hours and KPI of radius is impacted per the NAS report. After tuning the Postgres, we used pgbench and the following is what we get: [postgres@postgresql-syslog01 ~]$ pgbench -c 10 -j 2 -t 1000 my_benchmark_test_db starting vacuum...end. transaction type: <builtin: TPC-B (sort of)> scaling factor: 1 query mode: simple number of clients: 10 number of threads: 2 number of transactions per client: 1000 number of transactions actually processed: 10000/10000 latency average = 10.931 ms tps = 914.869517 (including connections establishing) tps = 915.175572 (excluding connections establishing) 2. In radiusd.conf we have the following, and we tuned max request to 32000, start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_request_time = 30 max_requests = 32000 Radius server specs: We have 4 sockets 1.87Ghz and RAM 8GB In Linux top command, load average is almost always : 0.17, 0.14, 0.13 Postgres server specs: 8 sockets 2.5Ghz and RAM 16GB In Linux top command, load average is around most of the time : 0.59, 0.50, 0.45 The questions to summarize are : 1. Is ~900 TPS and 10ms acceptable DB performance for accounting? 2. In the max_requests setting, what does the clients mean here, does it mean NAS client or SQL connections based on max requests? how to size it? 3. What could be the culprit given the fact all the servers are relaxed? Really appreciate your guidance here Best,

3 10

VLAN Assignment
by Rodrigo Abrantes Antunes 31 Aug '23

31 Aug '23

Hello, is there a guide to configure vlan assignment on freeradius? I searched the documentation and didn't find. Thanks.

5 6

Re: compilation problem deprecated: Since OpenSSL 3.0
by Joost Ringoot 29 Aug '23

29 Aug '23

Thanks for the suggestion. Meanwhile I found the eapoltest is available in debian as separate package, and it appears to function https://packages.debian.org/bookworm/eapoltest I have other questions however: Is there an upgrade or current documentation that handles EAP-TTLS? Can you provide a link? because this is all I can find on your site about it, all the searches and throughclicking seem to lead to this same PDF from 2014 (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) >> chapter 6 -EAP authentication, Pg 46,47) Further I read everywhere on internet that mschap and also mschapv2 is flawed microsoft advises not to use it https://learn.microsoft.com/en-us/windows/security/identity-protection/cred… some security sites show how to walk trough it's defense. https://www.kitploit.com/2021/09/assless-chaps-crack-mschapv2.html https://securityonline.info/assless-chaps-crack-mschapv2-challenge-response… Thanks, Joost ----- Original Message ----- > From: "Alan DeKok" <aland(a)deployingradius.com> > To: "Joost Ringoot" <joost.ringoot(a)meteo.be>, "hostap" <hostap(a)lists.infradead.org> > Sent: Thursday, 15 June, 2023 14:31:19 > Subject: Re: compilation problem deprecated: Since OpenSSL 3.0 > On Jun 15, 2023, at 6:30 AM, Joost Ringoot <joost.ringoot(a)meteo.be> wrote: >> I am trying to compile eampol_test >> >> "make eapol_test" >> >> (Following "THE FREERADIUS IMPLEMENTATION GUIDE" (2014 network radius sarl) >> chapter 6 -EAP authentication, Pg 46,47) > > That guide was written long before OpenSSL3 came out. It is very likely that's > it's not relevant here. > > I suggest looking at the hostap source. > > $ git grep -i openssl3 > > That may be instructive. > > Alan DeKok.

2 1