- Freeradius-Users - lists.freeradius.org

rlm_perl module crash on high load, need to restart service
by Imdad Hasan 04 Jun '23

04 Jun '23

Hi All, I am using the rlm_perl module with an async TCP server. in this rlm_perl module is the TCP socket client and swoole is Async TCP socket server. When i am testing high load, at that time it's showing an error duplicate packet conflict module queue and crashes the server, even after stopping the load the freerdius is not working, i need to restart the freeradius server and it's working fine. Please guide me. Thanks Imdad

2 1

radiusd binary static (linux) build
by Ľudovít Mikula 03 Jun '23

03 Jun '23

Hi, have anybody tried to do a static build of radiusd binary? Would it be possible with current build setup? If so, can you share the steps to get a static build (or with as little dynamic dependencies as possible). Thank you. -- Ludo

2 2

Modifying outgoing device name attribute
by Kenny Simpson 02 Jun '23

02 Jun '23

Hi all, New to freeradius and need a little help which has stumped me and a colleague. We are using freeradius to proxy authentication from Fortinet to freeradius to cisco acs. We are now stumped on how to get it to authenticate properly. We can see in the Cisco ACS logs that the device is being authenticated and that it is matching the appropriate access service but it is failing on shared secret even though we know that the shared secret is correct and that the password for the user is correct. Looking at the logs its says that the client is the incoming proxy server with its name and ip address as this is what is in the client. It has the NAS IP correctly defined but I am thinking that because the device name and ip are different to the NAS IP then its failing as the actual proxied connection has a different secret. Is there anyway of modifying the out going "device name attribute and ip" to match that of the client configuration. I hope this makes sense hahah Thanks Kenny

2 1

Weird behaviour of sqlcounter / dailycounter
by Robert Senger 31 May '23

31 May '23

Hi all, tonight I've seen some weird behaviour during tests of sqlcounter module. Please see the output below. The situation is that the station trying to connect is allowed a Max- Daily-Session of 300 seconds. The counter is at 299, so sqlcounter correctly sets Session-Timeout = 1, and the station is allowed access for one second remaining... However, this connection is terminated immediately by the Wifi AP (running hostapd 2.due to Session-Timeout = 1. The counter never gets increased, the station retries and is allowed access, and every 5 seconds or so this repeats and repeats and repeats... The logs get flooded and there's useless load on the AP and freeradius. The station (Linux machine with NetworkManager) stopped trying to connect after half an hour or so... This behaviour is reproduceable. Every time the station's Max-Daily- Session value is reached and it get's kicked off by the AP, it get's into this loop. The number of retries until the station finally is giving up is significantly higher if more than one AP with the same SSID is reachable (>30 minutes). This behaviour also occurs if the "counter" module is used rather than the "sqlcounter" module. Freeradius version is 3.0.21, hostapd version is 2.10-8. Did I configure something wrong, or what happens here? Thank you for help! Robert freeradius -X output: <...> (3090) dailycounter: EXPAND %{User-Name} (3090) dailycounter: --> testtesttest (3090) dailycounter: SQL-User-Name set to 'testtesttest' rlm_sql (sql): Reserved connection (297) (3090) dailycounter: Executing select query: SELECT SUM(acctsessiontime - GREATEST((1685484000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'testtesttest' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1685484000' rlm_sql (sql): Released connection (297) (3090) dailycounter: EXPAND %{sql:SELECT SUM(acctsessiontime -GREATEST((1685484000 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1685484000'} (3090) dailycounter: --> 299 (3090) dailycounter: Allowing user, &control:Max-Daily-Session value (300) is greater than counter value (299) (3090) dailycounter: Setting &reply:Session-Timeout value to 1 (3090) [dailycounter] = ok (3090) [expiration] = noop <...> (2499) Login OK: [testtesttest] (from client pherkad_ipv6 port 1 cli A0-88-B4-B5-47-C0) (2499) Sent Access-Accept Id 250 from [fd10:2842:f0d1:101::2]:1812 to [fd10:2842:f0d1:101:20d:b9ff:fe0d:c9c0]:56722 length 0 (2499) MS-MPPE-Recv-Key = 0x5006b02549aab2d72a020f8a17a16052e8c967bf253791d93f8a904d72bc8ec8 (2499) MS-MPPE-Send-Key = 0x98b138434cfd1cc09198086179c52dce065bde4d2634520098c6bf70e92aa0c2 (2499) EAP-Message = 0x03a90004 (2499) Message-Authenticator = 0x00000000000000000000000000000000 (2499) User-Name = "testtesttest" (2499) Session-Timeout += 1 (2499) Acct-Interim-Interval = 600 <...> -- Robert Senger

3 7

Migrate from "files" to "sql" with multiple DEFAULT users
by Robert Senger 31 May '23

31 May '23

Hi there, I am trying to migrate from wifi users stored in the 'authorize' file to wifi users stored in a mysql database. The 'sites-available/default' configuration file says: "The schema of the database is meant to mirror the 'users' file." Ok, this is fine with single users with known username. But what to do if there is more than one DEFAULT user? The 'authorize' file says, that it is processed by order, but this will not work in a database. My config is like this, to allow different sets of passwords for different SSIDs (staff and guests): <...> DEFAULT Auth-Type := ACCEPT, Called-Station-Id != "02-A5-04-3D-96- 13:Cassiopeia", Called-Station-Id != "02-A5-04-3D-96-23:Cassiopeia" Tunnel-Password = "passwordforuser1", Tunnel-Password = "passwordforuser2", Tunnel-Password = "passwordforuser3" DEFAULT Auth-Type := ACCEPT, Called-Station-Id == "02-A5-04-3D-96- 13:Cassiopeia" Tunnel-Password = "passwordforguest1", Tunnel-Password = "passwordforguest2", Tunnel-Password = "passwordforguest3" DEFAULT Auth-Type := ACCEPT, Called-Station-Id == "02-A5-04-3D-96- 23:Cassiopeia" Tunnel-Password = "passwordforguest1", Tunnel-Password = "passwordforguest2", Tunnel-Password = "passwordforguest3" DEFAULT Auth-Type := Reject <EOF> I have no idea how to build this in the mysql database... Any suggestions? Thank you! Robert -- Robert Senger

3 4

PPPoE User Suddenly internet is not working even user is connected
by Imdad Hasan 31 May '23

31 May '23

Hi All, One of my clients is complaining to me sometimes, a pppoe user suddenly showing no internet at the user side but the user is connected with mikrotik pppoe server.. when he disconnects it from mikrotik and after re-connection, that user's internet is working fine at the user side.. So, is this related to the radius accounting response or something? Because this issue is not there when he is connected to a local user which is created in mikrotik without radius. Thanks Imdad

5 5

Redundant best practices
by Adam Taylor 30 May '23

30 May '23

Is there a site/page that has the best practices to setting up a redundant/failover Freeradius server? I have two set up and they both work independently, but when I add them to my wireless system config as primary/secondary, I get weird EAP session not matching at random times and the client just keeps trying to connect. Remove the "secondary" Radius entry and everything starts working again. If I flip the primary to secondary.....the secondary by itself has no more problems. It only happens if I list two Radius servers. I have now seen this on two completely different wireless systems, so it has made me want to make sure I am not doing something stupid on the Freeradius side that is causing this. As always, thanks for the help. BTW, we are running 3.2.1 currently. Adam

2 1

Freeradius proxy times out after 14 seconds
by raido.rattameister＠gmail.com 29 May '23

29 May '23

Hey, How to set Freeradius to wait for longer than 14 second for home server to reply? My config is: Firewall > Freeradius > Home server Home server performs 2FA so I need to give users some time to accept push notification on their phones. With default config Freeradius will wait only 14 seconds before it times out and sends login failure back to firewall. I added "response_window" setting to clients.conf file. If response_window setting is below 14 then timeout will be reduced to whatever response_window value is. If response_window is more than 14 then timeout is always 14. Is there any way to override this setting and expand timeout to 30 seconds? Log snippet from freeradius -X Proxying request to home server 192.168.1.10 port 1812 timeout 14.000000 Sent Access-Request Id 155 from 0.0.0.0:59777 to 192.168.1.10:1812 length 113 User-Name = "test(a)example.com <mailto:test@example.com> " User-Password = "password" NAS-Identifier = "RADIUS" NAS-IP-Address = 192.168.1.1 Event-Timestamp = "May 27 2023 20:33:05 EDT" Message-Authenticator := 0x00 Proxy-State = 0x3437 Waking up in 0.3 seconds. Expecting proxy response no later than 13.667138 seconds from now Waking up in 13.6 seconds. No proxy response, giving up on request and marking it done Marking home server 192.168.1.10 port 1812 as zombie (it has not responded in 14.000000 seconds). ERROR: Failing proxied request for user "test(a)example.com <mailto:test@example.com> ", due to lack of any response from home server 192.168.1.10 port 1812 Clearing existing &reply: attributes Found Post-Proxy-Type Fail-Authentication server default { Post-Proxy-Type sub-section not found. Ignoring. Executing group from file /etc/freeradius/3.0/sites-enabled/default Best, Raido

2 1

Determine REST connect URI dynamically
by Matthew McTague 29 May '23

29 May '23

Hi there, Would it be possible to determine the REST connect URI dynamically using dynamic-clients or similar, without needing to check again for each request? Warm Regards, .[cid:vg-email_e752d47f-182a-48d0-8808-3796b2df8d4a.png]<https://www.vetta.nz> .[cid:058_line_9bae9502-1e3a-48a3-ba5e-34ed9cd44185.png] Matthew McTague Head of Infrastructure [cid:bea-finalist-email_2ddba0ed-b9bb-4ab9-b680-84aa7f54077f.png] [cid:bea-winner-banner-email_590096c3-05a6-4c98-b071-1c4d748c3534.png] . D +64 3 222 6013<tel:+64%203%20222%206013> | P +64 3 684 5770 E matthew.mctague(a)vetta.nz<mailto:matthew.mctague@vetta.nz> | W www.vetta.nz<https://www.vetta.nz> Vetta Group Ltd and its subsidiaries accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company, its subsidiaries, partners or contractors. .

3 2

Version 3.2.3 has been released
by Matthew Newton 28 May '23

28 May '23

We have released version 3.2.3. This is the latest stable v3 "feature" release. There are a number of features and bug fixes included in this version. Notably: - A notable bug occasionally causing connections to stall when using RADSEC has been fixed. - rlm_ldap and rlm_sql now have a "max_retries" option to limit the number of connection retries due to failure. - Several locking issues and small memory leaks fixed. - A number of dictionary updates, as usual. as well as several other fixes and updates as shown in the ChangeLog. Of importance please note: - Python users Debian/Ubuntu packages now have "freeradius-python2" and "freeradius-python3" packages. Previously the python module was included in the main "freeradius" package. If you are upgrading using the Network RADIUS packages and use python, please make sure you now also install the correct python package for your system. The "freeradius" package recommends both new python packages which will hopefully pull them in on upgrade, but you should check to be certain. Previously the python package built depended on the which version of python was available by default on the OS, which was e.g. python3 on Ubuntu22, but python2 on Debian11 - both options are now available. - Checkrad If anyone is still using the "checkrad" script, it is now passed NAS-Port-Id when called from SQL simultaneous use, rather than "NAS-Port". This fixes the script (the SQL queries always used NAS-Port-Id), but may break installations where the an invalid value such as 0 was previously passed, and is now the correct string. Download from all the usual places: https://freeradius.org/releases/ https://freeradius.org/ftp/pub/freeradius/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_3 Packages are available from Network RADIUS: https://packages.networkradius.com/ (Note that packages are no longer built for Debian 9 Stretch as it is EoL.) Docker images are available on Dockerhub: https://hub.docker.com/r/freeradius/freeradius-server -- Matthew

3 2