- Freeradius-Users - lists.freeradius.org

EAP-TLS unable to get local issuer certificate
by MH 08 Jun '23

08 Jun '23

Hello, I am trying to setup EAP-TLS and I am getting radius server error "eap_tls: (TLS) OpenSSL says error 20 : unable to get local issuer certificate", "send TLS 1.2 Alert, fatal unknown_ca" Test client is wpa_supplicant 2.1 built on Ubuntu Linux 22.04.2. All tests are done locally on FreeRadius server 3.2.3 (Ubuntu Linux 22.04.2) When I test "client.crt" with "openssl verify ./client.crt" I get "OK". Specifying -CAFile OpenSSL parameter with chained CA cert also produces "OK". All CA certificates (there is also an intermediate certificate) are in /etc/freeradius/certs, /etc/freeradius/certs_eaptls and also /usr/lib/ssl/cert. One certificate per file. FreeRadius's EAP-TLS stanza is cadir = ${certdir}/certs_eaptls private_key_file = ${certdir}/rad.key certificate_file = ${certdir}/rad.crt auto_chain = no Server and client certificates are signed by different commercial CA. All certificates have intermediate CA. eapol_test config file for EAP-TLS is network={ key_mgmt=WPA-EAP eap=TLS identity="blabla(a)domain.tld" ca_cert="/etc/ssl/certs/chain.crt" client_cert="client.crt" private_key="client.key" private_key_passwd="blabla" } AppArmor disabled. Permissions for all certs are r--r--r-- (at least). OpenSSL rehash done. I have no idea what could be wrong.

3 10

TEAP support
by Natarajan M 07 Jun '23

07 Jun '23

> Is EAP-FAST & TEAP are same? I couldn't find a way to configure freeradius > for TEAP, some mentioned EAP-FAST & TEAP may be similar and TEAP is like > EAP-FASTv2, any pointers will help on configuring TEAP on freeradius if it > is supported. > > Thanks > Natarajan >

2 1

rlm_perl module crash on high load, need to restart service
by Imdad Hasan 05 Jun '23

05 Jun '23

Thanks Alen, This is my perl script code which is a socket client for the swoole TCP socket server. use strict; use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use IO::Socket; use locale; use POSIX; use JSON; use Sys::Syslog; # our (%RAD_REQUEST, %RAD_REPLY, %RAD_CHECK, %RAD_STATE); setlocale(LC_ALL, 'C'); use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ my $swoole; my $answer; sub logs { my $err2 = @_[0]; &radiusd::radlog(1, $err2); # uncomment to logs to syslog # syslog('info', $err2); } sub rtrim { my $s = shift; $s =~ s/\s+$//; return $s }; sub socket_init { &logs("Opening connection to swoole\n"); my $swoole = new IO::Socket::INET ( PeerAddr => '127.0.0.1', PeerPort => '26312', Proto => 'tcp' ); # setsockopt($swoole, SOL_SOCKET, SO_KEEPALIVE, 1); &logs("Connect to swoole finish with error: $!\n") unless $swoole; return $swoole; } sub CLONE { &logs('Cloning...'); $swoole=&socket_init; } sub check_connection() { # swoole connection check... if ((not defined $swoole) || (!$swoole->connected())) { &logs("Try to reconnect to swoole\n"); $swoole=&socket_init; } if ((not defined $swoole) || (!$swoole->connected())) { return 0; } else { return 1; } } sub authorize { if (!check_connection()) { return RLM_MODULE_REJECT; } print $swoole "::authorization::\n" .encode_json(\%RAD_REQUEST) . "\n" .encode_json(\%RAD_REPLY) ."\n" .encode_json(\%RAD_CHECK); $answer=<$swoole>; $answer=rtrim($answer); &logs("ans:".$answer); $answer=decode_json($answer); if ($answer->{radreply} ne "") { my $radreply = $answer->{radreply}; %RAD_REPLY=%{$radreply}; } if($answer->{radcheck} ne "") { my $radcheck = $answer->{radcheck}; %RAD_CHECK=%{$radcheck}; } if ($answer->{response} ne "accept") { return RLM_MODULE_REJECT; } return RLM_MODULE_OK; } sub authenticate { if ($RAD_REPLY{'Packet-Type'} eq "Access-Reject") { return RLM_MODULE_REJECT; } else { return RLM_MODULE_OK; } } sub preacct { return RLM_MODULE_OK; } sub accounting { if (!check_connection()) { return RLM_MODULE_OK; } print $swoole "::accounting::\n" . encode_json(\%RAD_REQUEST); $answer=<$swoole>; $answer=rtrim($answer); &logs("Accounting:".$answer); return RLM_MODULE_OK; } sub checksimul { return RLM_MODULE_OK; } sub pre_proxy { return RLM_MODULE_OK; } sub post_proxy { return RLM_MODULE_OK; } sub post_auth { return RLM_MODULE_OK; } Guide me if i made a mistake here.. Thanks Imdad

2 1

rlm_perl module crash on high load, need to restart service
by Imdad Hasan 05 Jun '23

05 Jun '23

Thanks Alen, Great if the perl or any module will provide async support. Right now I am using FreeRADIUS version 3.0.20 with Jan-2023 built. Actually I tried loading with Jmeter, it's handling around 300 requests per second, but sometimes the resend ratio is big compared to my last exec module php script.. Even the new perl module and php swoole back-end is very light weight with Async MySQL support. But I don't know why the resend ratio is more than the old exec module. I am using 2Core CPU/1GB RAM EC2 for new code for FreeRADIUS with perl module and php swoole backend. The MySQL server is in the same VPC with different EC2. Please guide me for a quick solution for now, after FreeRADIUS 4.x, i will upgrade it. Thanks Imdad

2 1

rlm_perl module crash on high load, need to restart service
by Imdad Hasan 04 Jun '23

04 Jun '23

Hi All, I am using the rlm_perl module with an async TCP server. in this rlm_perl module is the TCP socket client and swoole is Async TCP socket server. When i am testing high load, at that time it's showing an error duplicate packet conflict module queue and crashes the server, even after stopping the load the freerdius is not working, i need to restart the freeradius server and it's working fine. Please guide me. Thanks Imdad

2 1

radiusd binary static (linux) build
by Ľudovít Mikula 03 Jun '23

03 Jun '23

Hi, have anybody tried to do a static build of radiusd binary? Would it be possible with current build setup? If so, can you share the steps to get a static build (or with as little dynamic dependencies as possible). Thank you. -- Ludo

2 2

Modifying outgoing device name attribute
by Kenny Simpson 02 Jun '23

02 Jun '23

Hi all, New to freeradius and need a little help which has stumped me and a colleague. We are using freeradius to proxy authentication from Fortinet to freeradius to cisco acs. We are now stumped on how to get it to authenticate properly. We can see in the Cisco ACS logs that the device is being authenticated and that it is matching the appropriate access service but it is failing on shared secret even though we know that the shared secret is correct and that the password for the user is correct. Looking at the logs its says that the client is the incoming proxy server with its name and ip address as this is what is in the client. It has the NAS IP correctly defined but I am thinking that because the device name and ip are different to the NAS IP then its failing as the actual proxied connection has a different secret. Is there anyway of modifying the out going "device name attribute and ip" to match that of the client configuration. I hope this makes sense hahah Thanks Kenny

2 1

Weird behaviour of sqlcounter / dailycounter
by Robert Senger 31 May '23

31 May '23

Hi all, tonight I've seen some weird behaviour during tests of sqlcounter module. Please see the output below. The situation is that the station trying to connect is allowed a Max- Daily-Session of 300 seconds. The counter is at 299, so sqlcounter correctly sets Session-Timeout = 1, and the station is allowed access for one second remaining... However, this connection is terminated immediately by the Wifi AP (running hostapd 2.due to Session-Timeout = 1. The counter never gets increased, the station retries and is allowed access, and every 5 seconds or so this repeats and repeats and repeats... The logs get flooded and there's useless load on the AP and freeradius. The station (Linux machine with NetworkManager) stopped trying to connect after half an hour or so... This behaviour is reproduceable. Every time the station's Max-Daily- Session value is reached and it get's kicked off by the AP, it get's into this loop. The number of retries until the station finally is giving up is significantly higher if more than one AP with the same SSID is reachable (>30 minutes). This behaviour also occurs if the "counter" module is used rather than the "sqlcounter" module. Freeradius version is 3.0.21, hostapd version is 2.10-8. Did I configure something wrong, or what happens here? Thank you for help! Robert freeradius -X output: <...> (3090) dailycounter: EXPAND %{User-Name} (3090) dailycounter: --> testtesttest (3090) dailycounter: SQL-User-Name set to 'testtesttest' rlm_sql (sql): Reserved connection (297) (3090) dailycounter: Executing select query: SELECT SUM(acctsessiontime - GREATEST((1685484000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'testtesttest' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1685484000' rlm_sql (sql): Released connection (297) (3090) dailycounter: EXPAND %{sql:SELECT SUM(acctsessiontime -GREATEST((1685484000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1685484000'} (3090) dailycounter: --> 299 (3090) dailycounter: Allowing user, &control:Max-Daily-Session value (300) is greater than counter value (299) (3090) dailycounter: Setting &reply:Session-Timeout value to 1 (3090) [dailycounter] = ok (3090) [expiration] = noop <...> (2499) Login OK: [testtesttest] (from client pherkad_ipv6 port 1 cli A0-88-B4-B5-47-C0) (2499) Sent Access-Accept Id 250 from [fd10:2842:f0d1:101::2]:1812 to [fd10:2842:f0d1:101:20d:b9ff:fe0d:c9c0]:56722 length 0 (2499) MS-MPPE-Recv-Key = 0x5006b02549aab2d72a020f8a17a16052e8c967bf253791d93f8a904d72bc8ec8 (2499) MS-MPPE-Send-Key = 0x98b138434cfd1cc09198086179c52dce065bde4d2634520098c6bf70e92aa0c2 (2499) EAP-Message = 0x03a90004 (2499) Message-Authenticator = 0x00000000000000000000000000000000 (2499) User-Name = "testtesttest" (2499) Session-Timeout += 1 (2499) Acct-Interim-Interval = 600 <...> -- Robert Senger

3 7

Migrate from "files" to "sql" with multiple DEFAULT users
by Robert Senger 31 May '23

31 May '23

Hi there, I am trying to migrate from wifi users stored in the 'authorize' file to wifi users stored in a mysql database. The 'sites-available/default' configuration file says: "The schema of the database is meant to mirror the 'users' file." Ok, this is fine with single users with known username. But what to do if there is more than one DEFAULT user? The 'authorize' file says, that it is processed by order, but this will not work in a database. My config is like this, to allow different sets of passwords for different SSIDs (staff and guests): <...> DEFAULT Auth-Type := ACCEPT, Called-Station-Id != "02-A5-04-3D-96- 13:Cassiopeia", Called-Station-Id != "02-A5-04-3D-96-23:Cassiopeia" Tunnel-Password = "passwordforuser1", Tunnel-Password = "passwordforuser2", Tunnel-Password = "passwordforuser3" DEFAULT Auth-Type := ACCEPT, Called-Station-Id == "02-A5-04-3D-96- 13:Cassiopeia" Tunnel-Password = "passwordforguest1", Tunnel-Password = "passwordforguest2", Tunnel-Password = "passwordforguest3" DEFAULT Auth-Type := ACCEPT, Called-Station-Id == "02-A5-04-3D-96- 23:Cassiopeia" Tunnel-Password = "passwordforguest1", Tunnel-Password = "passwordforguest2", Tunnel-Password = "passwordforguest3" DEFAULT Auth-Type := Reject <EOF> I have no idea how to build this in the mysql database... Any suggestions? Thank you! Robert -- Robert Senger

3 4

PPPoE User Suddenly internet is not working even user is connected
by Imdad Hasan 31 May '23

31 May '23

Hi All, One of my clients is complaining to me sometimes, a pppoe user suddenly showing no internet at the user side but the user is connected with mikrotik pppoe server.. when he disconnects it from mikrotik and after re-connection, that user's internet is working fine at the user side.. So, is this related to the radius accounting response or something? Because this issue is not there when he is connected to a local user which is created in mikrotik without radius. Thanks Imdad

5 5