- Freeradius-Users - lists.freeradius.org

Redundant best practices
by Adam Taylor 30 May '23

30 May '23

Is there a site/page that has the best practices to setting up a redundant/failover Freeradius server? I have two set up and they both work independently, but when I add them to my wireless system config as primary/secondary, I get weird EAP session not matching at random times and the client just keeps trying to connect. Remove the "secondary" Radius entry and everything starts working again. If I flip the primary to secondary.....the secondary by itself has no more problems. It only happens if I list two Radius servers. I have now seen this on two completely different wireless systems, so it has made me want to make sure I am not doing something stupid on the Freeradius side that is causing this. As always, thanks for the help. BTW, we are running 3.2.1 currently. Adam

2 1

Freeradius proxy times out after 14 seconds
by raido.rattameister＠gmail.com 29 May '23

29 May '23

Hey, How to set Freeradius to wait for longer than 14 second for home server to reply? My config is: Firewall > Freeradius > Home server Home server performs 2FA so I need to give users some time to accept push notification on their phones. With default config Freeradius will wait only 14 seconds before it times out and sends login failure back to firewall. I added "response_window" setting to clients.conf file. If response_window setting is below 14 then timeout will be reduced to whatever response_window value is. If response_window is more than 14 then timeout is always 14. Is there any way to override this setting and expand timeout to 30 seconds? Log snippet from freeradius -X Proxying request to home server 192.168.1.10 port 1812 timeout 14.000000 Sent Access-Request Id 155 from 0.0.0.0:59777 to 192.168.1.10:1812 length 113 User-Name = "test(a)example.com <mailto:test@example.com> " User-Password = "password" NAS-Identifier = "RADIUS" NAS-IP-Address = 192.168.1.1 Event-Timestamp = "May 27 2023 20:33:05 EDT" Message-Authenticator := 0x00 Proxy-State = 0x3437 Waking up in 0.3 seconds. Expecting proxy response no later than 13.667138 seconds from now Waking up in 13.6 seconds. No proxy response, giving up on request and marking it done Marking home server 192.168.1.10 port 1812 as zombie (it has not responded in 14.000000 seconds). ERROR: Failing proxied request for user "test(a)example.com <mailto:test@example.com> ", due to lack of any response from home server 192.168.1.10 port 1812 Clearing existing &reply: attributes Found Post-Proxy-Type Fail-Authentication server default { Post-Proxy-Type sub-section not found. Ignoring. Executing group from file /etc/freeradius/3.0/sites-enabled/default Best, Raido

2 1

Determine REST connect URI dynamically
by Matthew McTague 29 May '23

29 May '23

Hi there, Would it be possible to determine the REST connect URI dynamically using dynamic-clients or similar, without needing to check again for each request? Warm Regards, .[cid:vg-email_e752d47f-182a-48d0-8808-3796b2df8d4a.png]<https://www.vetta.nz> .[cid:058_line_9bae9502-1e3a-48a3-ba5e-34ed9cd44185.png] Matthew McTague Head of Infrastructure [cid:bea-finalist-email_2ddba0ed-b9bb-4ab9-b680-84aa7f54077f.png] [cid:bea-winner-banner-email_590096c3-05a6-4c98-b071-1c4d748c3534.png] . D +64 3 222 6013<tel:+64%203%20222%206013> | P +64 3 684 5770 E matthew.mctague(a)vetta.nz<mailto:matthew.mctague@vetta.nz> | W www.vetta.nz<https://www.vetta.nz> Vetta Group Ltd and its subsidiaries accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company, its subsidiaries, partners or contractors. .

3 2

Version 3.2.3 has been released
by Matthew Newton 28 May '23

28 May '23

We have released version 3.2.3. This is the latest stable v3 "feature" release. There are a number of features and bug fixes included in this version. Notably: - A notable bug occasionally causing connections to stall when using RADSEC has been fixed. - rlm_ldap and rlm_sql now have a "max_retries" option to limit the number of connection retries due to failure. - Several locking issues and small memory leaks fixed. - A number of dictionary updates, as usual. as well as several other fixes and updates as shown in the ChangeLog. Of importance please note: - Python users Debian/Ubuntu packages now have "freeradius-python2" and "freeradius-python3" packages. Previously the python module was included in the main "freeradius" package. If you are upgrading using the Network RADIUS packages and use python, please make sure you now also install the correct python package for your system. The "freeradius" package recommends both new python packages which will hopefully pull them in on upgrade, but you should check to be certain. Previously the python package built depended on the which version of python was available by default on the OS, which was e.g. python3 on Ubuntu22, but python2 on Debian11 - both options are now available. - Checkrad If anyone is still using the "checkrad" script, it is now passed NAS-Port-Id when called from SQL simultaneous use, rather than "NAS-Port". This fixes the script (the SQL queries always used NAS-Port-Id), but may break installations where the an invalid value such as 0 was previously passed, and is now the correct string. Download from all the usual places: https://freeradius.org/releases/ https://freeradius.org/ftp/pub/freeradius/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_3 Packages are available from Network RADIUS: https://packages.networkradius.com/ (Note that packages are no longer built for Debian 9 Stretch as it is EoL.) Docker images are available on Dockerhub: https://hub.docker.com/r/freeradius/freeradius-server -- Matthew

3 2

Debug logs kill radiusd on AlmaLinux 9.2 with SIGSEGV
by Gerald Vogt 26 May '23

26 May '23

Hi! I am in the process of setting up freeradius-3.0.21-37.el9.x86_64 on a new AlmaLinux 9.2 server to migrate from our old centos 7 servers. I have noticed that the server crashes with a segmentation fault if I enable debug logs (e.g. radiusd -X or with raddebug) and run a test with EAP-TLS. The test works fine and succeeds without debug logging. So it's something which only happens during debug logging. gdb backtrace from the core dump is #0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:74 #1 0x00007ff611284268 in __vfprintf_internal (s=s@entry=0x7ffcc44437e0, format=format@entry=0x564c843544b8 "(TLS) Creating attributes from %s certificate", ap=ap@entry=0x7ffcc44439c0, mode_flags=mode_flags@entry=2) at vfprintf-internal.c:1647 #2 0x00007ff61129487a in __vsnprintf_internal (string=0x7ffcc4443a20 "(TLS) Creating attributes from ServerHelloDone\"\n", maxlen=<optimized out>, format=0x564c843544b8 "(TLS) Creating attributes from %s certificate", args=0x7ffcc44439c0, mode_flags=2) at vsnprintf.c:114 #3 0x00007ff611bec5dc in vsnprintf (__ap=0x7ffcc44439c0, __fmt=0x564c843544b8 "(TLS) Creating attributes from %s certificate", __n=10240, __s=0x7ffcc4443a20 "(TLS) Creating attributes from ServerHelloDone\"\n") at /usr/include/bits/stdio2.h:68 #4 vradlog_request (type=L_DBG, lvl=<optimized out>, request=0x564c85de2a30, msg=0x564c843544b8 "(TLS) Creating attributes from %s certificate", ap=0x7ffcc4446270) at src/main/log.c:695 #5 0x00007ff611bec801 in radlog_request (type=<optimized out>, lvl=<optimized out>, request=<optimized out>, msg=<optimized out>) at src/main/log.c:787 #6 0x0000564c8433b992 in ?? () #7 0x0000564c85c96368 in ?? () #8 0x0000564c85bf5aa0 in ?? () #9 0x3232363000000001 in ?? () #10 0x0000564c85c962d0 in ?? () #11 0x0000000000000003 in ?? () #12 0x3461626338663361 in ?? () #13 0x0000564c85d87380 in ?? () #14 0x0000564c85c96328 in ?? () #15 0x3039363639633635 in ?? () #16 0x6566323131383235 in ?? () #17 0x3563666364323264 in ?? () #18 0x0000000000000000 in ?? () It happens during handshake: (11) Auth-Type eap { (11) eap: Expiring EAP session with state 0x923d2dbc9836205f (11) eap: Finished EAP session with state 0x923d2dbc9836205f (11) eap: Previous EAP request found for state 0x923d2dbc9836205f, released from the list (11) eap: Peer sent packet with method EAP TLS (13) (11) eap: Calling submodule eap_tls to process data (11) eap_tls: (TLS) EAP Got final fragment (24 bytes) (11) eap_tls: (TLS) EAP Done initial handshake (11) eap_tls: (TLS) Handshake state - Server SSLv3/TLS write server done (11) eap_tls: (TLS) recv TLS 1.2 Handshake, Certificate Segmentation fault (core dumped) Tested with two different client certificates... Regards, Gerald

3 5

Need help on eap-cache
by deepika parmar 22 May '23

22 May '23

Hello, I have configured *EAP-AKA virtual-server in FreeRADIUS to perform authentication. I have enabled eap cache so that fast reauth will work and session data will be stored in cache. However during store session even if session data is there in session state, in cache while storing session data its null. Logs are like: Debug : (0.0) h9-auth-server - store session { Debug : (0.0) h9-auth-server - | debug_attr INFO : (0.0) h9-auth-server - Attributes matching "&session-state" INFO : (0.0) h9-auth-server - &session-State.session-State = { INFO : (0.0) h9-auth-server - Permanent-Identity = 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org INFO : (0.0) h9-auth-server - SIM-Ki = 0x465b5ce8b199b49faa5f0a2ee238a6bc INFO : (0.0) h9-auth-server - SIM-OPc = 0xcd63cb71954a9f4e48a5994e37a02baf INFO : (0.0) h9-auth-server - SIM-SQN = 640 INFO : (0.0) h9-auth-server - Identity = 2TGUFSvpAG13Ugm INFO : (0.0) h9-auth-server - Session-Data = 0x2d9b493ceda56d4b440d6a6b011c06b2f54ffd51 >>>>>>>>>>>>>>>>>>>>>>>>>>>> Session data is present INFO : (0.0) h9-auth-server - Counter = 0 INFO : (0.0) h9-auth-server - } Debug : (0.0) h9-auth-server - | %(debug_attr:{&session-state}) Debug : (0.0) h9-auth-server - | --> (null) Debug : (0.0) h9-auth-server - &session-state.SIM-Ki := 0x2d9b493ceda56d4b440d6a6b011c06b2f54ffd51 Debug : (0.0) eap_aka_cache - | eap-aka-sim.Session-ID Debug : (0.0) eap_aka_cache - | %{eap-aka-sim.Session-ID} Debug : (0.0) eap_aka_cache - | --> 0x345043774142776875516d30353132 Debug : (0.0) eap_aka_cache - --> 0x345043774142776875516d30353132 Debug : (0.0) eap_aka_cache - No cache entry found for "0x345043774142776875516d30353132" Debug : (0.0) eap_aka_cache - Creating new cache entry Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | session-state.Permanent-Identity Debug : (0.0) eap_aka_cache - | %{session-state.Permanent-Identity} Debug : (0.0) eap_aka_cache - | --> 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - --> 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org Debug : (0.0) eap_aka_cache - &session-State[0].Permanent-Identity := "10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org" Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Session-Data} >>>>>>>>> Session data not available Debug : (0.0) eap_aka_cache - | session-state.Session-Data Debug : (0.0) eap_aka_cache - | %{session-state.Session-Data} Debug : (0.0) eap_aka_cache - | --> Debug : (0.0) eap_aka_cache - --> Debug : (0.0) eap_aka_cache - &session-State[0].Session-Data := 0x Debug : (0.0) eap_aka_cache - EXPAND %{session-state.Encr-Data.Counter} Debug : (0.0) eap_aka_cache - | session-state.Encr-Data.Counter Debug : (0.0) eap_aka_cache - | %{session-state.Encr-Data.Counter} Store session setting in virtual server: store session { "%(debug_attr:&session-state)" eap_aka_cache "%(debug_attr:&session-state)" ok } Eap cache: cache eap_aka_cache { # # key:: Cache key. # key = "%{eap-aka-sim.Session-ID}" # # ttl:: TTL for cache entries. # ttl = 150 # # update <section> { ... }:: # update session-state { &Permanent-Identity := "%{session-state.Permanent-Identity}" &Session-Data := "%{session-state.Session-Data}" &Encr-Data.Counter := "%{session-state.Encr-Data.Counter}" } } Can anyone help? Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Thanks, Deepika

2 1

cacheable groups for ldap
by dextá 22 May '23

22 May '23

Hello, Is there any limit on how many groups can be cached via ldap module? I ask because I have some users who have 80 groups in their profile. This is because we use AD + Moodle to manage the courses. This particular user is unable to connect to the Wi-Fi. I suspect that the reason might be having too many groups in their profile. ldap module ---------------- ldap haproxy-dc { server = 172.16.7.230 port = 389 identity = 'CN=Administrator,CN=Users,dc=mydc,dc=net' password = ****** base_dn = 'dc=mydc,dc=net' group_dn = 'OU=GRUPOS,dc=mydc,dc=net' user { base_dn = "OU=USUARIOS,${..base_dn}" filter = "(samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})" scope = 'sub' access_positive = yes } group { base_dn = "OU=GRUPOS,${..base_dn}" filter = "(objectClass=group)" scope = 'base' name_attribute = cn membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" membership_attribute = 'memberOf' cacheable_name = 'no' cacheable_dn = 'yes' cache_attribute = 'LDAP-Group' } options { chase_referrals = yes rebind = yes res_timeout = 20 srv_timelimit = 20 net_timeout = 10 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } freeradius version: 3.2

3 3

rlm_cache_redis driver
by dextá 21 May '23

21 May '23

hi, I have installed freeradius via packages.networkradius.com. At first I thought the "freeradius-redis" package would include the rlm_cache_redis driver, but it doesn't. I get the output below: rlm_ldap (dc4): Bind successful # Instantiating module "redis" from file /etc/freeradius/mods-enabled/redis rlm_redis (redis): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 2 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_redis (redis): Opening additional connection (0), 1 of 10 pending slots used rlm_redis (redis): Opening additional connection (1), 1 of 9 pending slots used rlm_redis (redis): Opening additional connection (2), 1 of 8 pending slots used rlm_redis (redis): Opening additional connection (3), 1 of 7 pending slots used rlm_redis (redis): Opening additional connection (4), 1 of 6 pending slots used # Instantiating module "cache" from file /etc/freeradius/mods-enabled/cache /etc/freeradius/mods-enabled/cache[23]: Could not link driver rlm_cache_redis: (null) /etc/freeradius/mods-enabled/cache[23]: Make sure it (and all its dependent libraries!) are in the search path of your system's ld /etc/freeradius/mods-enabled/cache[23]: Instantiation failed for module "cache" In the path /usr/lib/freeradius there is no rlm_cache_redis.so root@freeradiusv3dev:/usr/lib/freeradius# ls rlm_cache rlm_cache.so rlm_cache_rbtree.so root@freeradiusv3dev:/usr/lib/freeradius# ls rlm_cache Checking the output of ldconfig -v I also found nothing about rlm_cache_redis. Which package includes the rlm_cache_redis driver? Or do I need to compile this driver?

2 4

Access-challenge with new line
by Mesut GULNAZ 20 May '23

20 May '23

How can I reply access-challenge with new line to achieve something like this below? -- İyi çalışmalar... Mesut GÜLNAZ

2 1

Re: Getting Freeradius working with LLDAP
by Matthew Macdonald-Wallace 17 May '23

17 May '23

On May 17, 2023, freeradius-users-request(a)lists.freeradius.org wrote: Message: 3 Date: Wed, 17 May 2023 07:20:27 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Getting Freeradius working with LLDAP Message-ID: <EFC4B512-AB04-4A03-A59A-F1503D781E60(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii >> My LDAP server is https://github.com/lldap/lldap and that *does not* >> expose a "plain text password" field. > Then you need to set "Auth-Type = LDAP". See the comments in sites- available/default. Done this and it's working, thanks.

1 0