- Freeradius-Users - lists.freeradius.org

FR behavior when DB not available
by Anatoliy 20 Jul '23

20 Jul '23

Hi Alan ,team, I am testing scenario when main DB is temporary not available. I set rule in iptables to block all connections to DB. In this situation freeradius should return Accept with some parameters to NAS. authorize section is looks like sql { fail = 1 notfound = 2 } if ( fail ) { update { reply:Class = "outage" control:Auth-Type := Accept reply:Reply-Message := "DB Failed" reply:Acct-Interim-Interval := 600 } } This part works fine, but in traffic dump I see that radius replay with big delay , some times upto 20-30 seconds. In log a lot messages like Mon Jul 17 06:12:23 2023 : Error: Unresponsive child for request 288, in component <core> module Mon Jul 17 06:12:26 2023 : Error: rlm_sql_unixodbc: SQL down 08S01 [Oracle][ODBC][Ora]ORA-03113: end-of-file on communication channel Process ID: 151372 Session ID: 97 Serial number: 5095 Mon Jul 17 06:12:34 2023 : Error: rlm_sql_unixodbc: Connection failed I am trying to tune some parameters for sql connection, but this does not help. pool section retry_delay = 120 lifetime = 30 max_retries = 2 uses = 0 in radius.conf max_request_time = 5 and kernel (for faster detection that tcp session is broken) net.ipv4.tcp_retries2 = 2 net.ipv4.tcp_keepalive_intvl=5 net.ipv4.tcp_keepalive_probes=3 net.ipv4.tcp_keepalive_time=15 Can you recommend which params to change to prevent freeradius stuck on sql connection to DB ? Is it possible to prevent FR trying to connect to DB for some time (i think it is param retry_delay ) for all threads ?

6 15

EAP Failure Code 4
by Paul Bone 18 Jul '23

18 Jul '23

Hi I have a network of Unifi Access Points using WPA2 Enterprise and Freeradius. We often get times when Access Points appear to just stop allow connections and a reboot will fix the issue. I have just run a packet capture when this problem is occurring and notice that the radius server replies with Access-Reject Code 3 and EAP Failure Code 4. Any advice on the best place to start looking as to what might be causing these issues? Thanks Paul Bone

3 8

update disconnect
by Anatoliy 16 Jul '23

16 Jul '23

In accounting section I have configuration like sql { fail = 1 } if ( !fail ) { if (&Class) { if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { update disconnect { Acct-Session-Id := "%{Acct-Session-Id}" } } } } We check that DB is working and if Class attribute eq outage(this set when DB not accessible) freeradius should send DM message to NAS to disconnect this subscriber. We tested this with freeradius 3.2.0 and it works fine, but after upgrading to 3.2.3 we got error Here is part of debug log (1128) [sql] = ok (1128) if ( !fail ) { (1128) if ( !fail ) -> TRUE (1128) if ( !fail ) { (1128) if (&Class) { (1128) if (&Class) -> TRUE (1128) if (&Class) { (1128) if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { (1128) if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") -> TRUE (1128) if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { (1128) update disconnect { (1128) ERROR: You can only do 'update coa' when processing a packet which was received from the network (1128) } # update disconnect = invalid (1128) } # if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") = invalid (1128) } # if (&Class) = invalid (1128) } # if ( !fail ) = invalid (1128) } # accounting = invalid (1128) Finished internally proxied request. (1128) Clearing existing &reply: attributes (1128) Found Post-Proxy-Type Fail-Accounting Can you help to understand how to fix this ?

2 7

rate linit connections to DB
by Anatoliy 15 Jul '23

15 Jul '23

Hi Alan, team. I saw in logs messages like this Thu Jul 13 02:23:40 2023 : Warning: rlm_sql (mysql): Cannot open a new connection due to rate limit after failure Why we limiting connections and how we can control this ? Unable to find anything on doc

2 2

RPM packages and certs dir
by Gerald Vogt 14 Jul '23

14 Jul '23

Hi! It seems all the files for the test/bootstrap certs in raddb/certs are packed into the RPM file. The README.md in the certs directory specifically suggest to use "make destroycerts" to remove all the test certificates before starting with the real ones. Of course, that doesn't really help because with the next update the new rpm will restore all those config files which are missing: # rpm -V freeradius-config-3.2.3-1.el9.x86_64 missing c /etc/raddb/certs/01.pem missing c /etc/raddb/certs/02.pem missing c /etc/raddb/certs/ca.crl missing c /etc/raddb/certs/ca.der missing c /etc/raddb/certs/ca.key SM5....T. c /etc/raddb/certs/ca.pem missing c /etc/raddb/certs/client.crt missing c /etc/raddb/certs/client.csr missing c /etc/raddb/certs/client.key missing c /etc/raddb/certs/client.p12 missing c /etc/raddb/certs/client.pem missing c /etc/raddb/certs/dh missing c /etc/raddb/certs/index.txt missing c /etc/raddb/certs/index.txt.attr missing c /etc/raddb/certs/index.txt.attr.old missing c /etc/raddb/certs/index.txt.old missing c /etc/raddb/certs/serial missing c /etc/raddb/certs/serial.old missing c /etc/raddb/certs/server.crt missing c /etc/raddb/certs/server.csr missing c /etc/raddb/certs/server.key missing c /etc/raddb/certs/server.p12 missing c /etc/raddb/certs/server.pem missing c /etc/raddb/certs/user(a)example.org.p12 missing c /etc/raddb/certs/user(a)example.org.pem S.5....T. c /etc/raddb/clients.conf ... So technically, those files shouldn't be included in the RPM file, but instead, I guess the bootstrap script should run during the %post section in the spec file unless it's not all in the original state... Regards, Gerald

2 1

update disconnect and order of operations
by Anatoliy 14 Jul '23

14 Jul '23

Hi team, How update disconnect work in accounting section ? For example we have accounting configuration like this sql { fail = 1 } if ( !fail ) { if (&Class) { if (&Class == "outage" && &Acct-Status-Type == "Interim-Update") { update disconnect { Acct-Session-Id := "%{Acct-Session-Id}" } } } } linelog if we receive accounting pack with Class=outage and DB accessible , we should send disconnect message for this session. But, what happens if NAS is busy , or packet will be lost , so we did not receive reply ? Will freeradius wait for some timeout before continue to linelog directive or sending and processing disconnect message will be executed in parallel and we process the linelog without any delay?

3 6

EAP-MSCHAPv2 and AD Authentication w/o ntlm_auth
by BOUILLOUD Corentin 11 Jul '23

11 Jul '23

Hi everyone, nice to meet you, I would like to use Kerberos instead of ntlm_auth to authenticate AD users with FreeRADIUS. I configured 'mschap' module to directly use winbind daemon directly and, If I understood samba documentation properly, winbindd can't authenticate users himself. It uses 'pam_winbind' module that we can configure to use Kerberos. Could you confirm me that it is correct and/or possible in another way ? mods-enabled/mschap # # An alternative to using ntlm_auth is to connect to the # winbind daemon directly for authentication. This option # is likely to be faster and may be useful on busy systems, # but is less well tested. # # Using this option requires libwbclient from Samba 4.2.1 # or later to be installed. Make sure that ntlm_auth above is # commented out. # winbind_username = "%{mschap:User-Name}" winbind_domain = "%{mschap:NT-Domain}" https://www.samba.org/samba/docs/current/man-html/winbindd.8.html The service provided by winbindd is called `winbind' and can be used to resolve user and group information from a Windows NT server. The service can also provide authentication services via an associated PAM module. https://www.samba.org/samba/docs/current/man-html/pam_winbind.8.html krb5_auth pam_winbind can authenticate using Kerberos when winbindd is talking to an Active Directory domain controller. Kerberos authentication must be enabled with this parameter. ======================================================== This message has been scanned for malware. This message and any attachments (the "message") are confidential, intended solely for the addressees, and may contain legally privileged information. Any unauthorised use or dissemination is prohibited. E-mails are susceptible to alteration. Neither our company or any of its subsidiaries or affiliates shall be liable for the message if altered, changed or falsified. ========================================================= Ce message a ete verifie et ne contient pas de programme malveillant. Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et susceptibles de contenir des informations couvertes par le secret professionnel. Ce message est etabli a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Notre societe et ses filiales declinent toute responsabilite au titre de ce message s'il a ete altere, deforme falsifie. O =========================================================

2 2

Errors when building binary RPM on OL9
by Linus Hicks 30 Jun '23

30 Jun '23

I have downloaded the 3.2.3 tar file from the freeradius site and trying to build the binary RPM on an Oracle Linux 9 system. I copied the redhat/freeradius.spec file into the SPECS directory but needed to make a couple of changes to get it this far. 1. I got a file not found error on SOURCES/freeradius-tmpfiles-conf. That file is in the redhat/ directory but I couldn't figure out how to change where it is looking for it so just put a copy where it is looking. 2. I have installed postgresql-15 from binary RPM on their site and the paths to the /lib and /include directories don't match the paths searched in the build, now resolved. 3. Now I'm getting: RPM build errors: line 51: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-devel line 52: It's not recommended to have unversioned Obsoletes: Obsoletes: freeradius-libs Macro expanded in comment on line 602: %{_mandir}/man5/rlm_idn.5.gz} File listed twice: /etc/raddb/certs/bootstrap File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/queries.conf File listed twice: /etc/raddb/mods-config/sql/main/mysql/extras/wimax/schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql File listed twice: /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf Installed (but unpackaged) file(s) found: /etc/raddb/mods-config/python/example.py /etc/raddb/mods-config/python/radiusd.py /usr/lib/debug/usr/lib64/freeradius/rlm_python.so-3.2.3-1.el9.x86_64.debug /usr/lib64/freeradius/rlm_python.so It did not create the RPM and I believe the last set of files listed as "Installed (but unpackaged)" need to be resolved. I know there's a way to ignore the error and continue, but that could leave me with a broken RPM. Any help is appreciated. C. Linus Hicks Please access the attached hyperlink for Highstreet’s electronic communications disclaimer: http://www.highstreetit.com/Email_Disclaimer.htm

2 5

Migrating DHCP configuration from v3 to v4
by Ľudovít Mikula 30 Jun '23

30 Jun '23

I am migrating my dhcp setup from freeradius v3 into v4 and have some questions. In v3 there was a dedicated dhcp and dhcp-ippool mods-config/sql setup, where the sql_user_name was set to: sql_user_name = "%{control:DHCP-SQL-Option-Identifier}" and in my processing sections I have set the "control:DHCP-SQL-Option-Identifier" based on some custom logic. In v4 there is no such configuration, but the comments in ippool queries seem to suggest it can now all be done in one config. However when using ippool module in DHCP request processing, the %{User-Name} attribute (configured in sql_user_name) is not known and I have not found an alternative to DHCP-SQL-Option-Identifier attribute. What is the recommended way of migrating such configuration from v3 into v4? Thank you. -- Ludo Mikula

2 4

Problem using hased passwords
by Michael Schwartzkopff 30 Jun '23

30 Jun '23

Hi, I am trying to use a hased password, but I get the error: pap: ERROR: SHA1 digest does not match "known good" digest from the eap_gtc module. According to the compatibility matrix this should work. My setup: users file: user SHA-Password := "<SHA sum of the password, not salted>" Log: (31) files: users: Matched entry misch3 at line 101 (31) [files] = ok (...) (31) pap: Normalizing SHA-Password from hex encoding, 40 bytes -> 20 bytes (31) pap: WARNING: Auth-Type already set. Not setting to PAP (31) [pap] = noop (31) } # authorize = updated (31) eap_gtc: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (31) eap_gtc: Auth-Type PAP { (31) pap: Login attempt with password (31) pap: Comparing with "known-good" SHA-Password (31) pap: ERROR: SHA1 digest does not match "known good" digest (31) pap: Passwords don't match (31) eap_gtc: [pap] = reject (31) eap_gtc: } # Auth-Type PAP = reject Any ideas? I double checked the passwords and the SHA sum on both ends. Michael.

2 4