- Freeradius-Users - lists.freeradius.org

How long does the Server cache session-state attributes?
by Daniel Finger 11 May '23

11 May '23

Hi! I am currently implementing a 2-Factor authentication with a TOTP Challenge which looks very promising so far. As there is user interaction, the Access-Request after my first Access-Challenge can take some time. I wondered for how long does the server cache the session-state Attributes and what happens if the server never receives a new request for this particular state. Is this related to max_request_time? Daniel Finger

2 1

How to escape values in radclient?
by rany 08 May '23

08 May '23

Hi, I am planning on using radclient in a quick authentication script until I could fix an authentication library. I thought of using radclient in a shell script for the authentication task as it seemed fairly simple, however I wasn't able to figure out how to escape values that are set by the user; namely User-Name and User-Password. I tried checking the manual page but I haven't had any luck with that. It doesn't seem to have been mentioned, but I'm fairly sure this scenario was considered. TIA, rany

2 19

cache module
by Anatoliy 06 May '23

06 May '23

Hi team , can somebody share example of using a cache module ? I need to cache values from very simple sql table, like this one. ______________ |_n1__|_ 100___| |_n2__|__110___| |_n3__|__55____| And I want to cache these values for 30min to decrease number of query to DB,

1 0

Need help with EAP AKA Fast reauth
by deepika parmar 05 May '23

05 May '23

Hello, I have configured *EAP-AKA virtual-server in FreeRADIUS to perform authentication. * *I could successfully authenticate the Users, However facing an issue with fast reauth.* *I have used eap cache to store the session state. I could load the session state properly * *On receiving a fast reauth ID. Still reauth is not continued, rather it fails saying * *can't calculate re-auth keys and falling back to full auth.* I could see following logs : .. Debug : (2) eap - Peer sent EAP-Identity. Returning 'ok' so we can short-circuit the rest of authorize Debug : (2) eap - Setting &control.Auth-Type = eap Debug : (2) eap (ok) Debug : (2) } # recv Access-Request (ok) Debug : (2) default - Running 'authenticate eap' from file /usr/local/etc/raddb/sites-enabled/default Debug : (2) default - authenticate eap { Debug : (2) eap - New EAP session started Debug : (2) eap - Peer sent packet with EAP method Identity (1) Debug : (2) eap - Calling submodule eap_aka Debug : (2) eap - subrequest { Debug : (2.0) h9-auth-server - recv Identity-Response { Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # recv Identity-Response (ok) Debug : (2.0) h9-auth-server - New EAP-AKA session Debug : (2.0) h9-auth-server - Changed state INIT -> REAUTHENTICATION Debug : (2.0) h9-auth-server - load session { Debug : (2.0) eap_aka_cache - | eap-aka-sim.Session-ID Debug : (2.0) eap_aka_cache - | %{eap-aka-sim.Session-ID} Debug : (2.0) eap_aka_cache - | --> 0x346844533743546c516f736a376d62 Debug : (2.0) eap_aka_cache - --> 0x346844533743546c516f736a376d62 Debug : (2.0) eap_aka_cache - Found entry for "0x346844533743546c516f736a376d62" Debug : (2.0) eap_aka_cache - Merging cache entry into request Debug : (2.0) eap_aka_cache - &session-State[0].Permanent-Identity := '10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org' Debug : (2.0) eap_aka_cache - &session-State[0].Session-Data := 0xab32a5be4d8309d4a40938e425ef1714d71cf87a Debug : (2.0) eap_aka_cache - &session-State[0].Encr-Data.Counter := 0 Debug : (2.0) h9-auth-server - eap_aka_cache (updated) Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # load session (updated) Debug : (2.0) h9-auth-server - send Reauthentication-Request { Debug : (2.0) h9-auth-server - &reply.Encr-Data.Next-Reauth-Id := Debug : (2.0) h9-auth-server - &reply.Encr-Data.Next-Pseudonym := Debug : (2.0) h9-auth-server - | debug_attr INFO : (2.0) h9-auth-server - Attributes matching "&session-state" INFO : (2.0) h9-auth-server - &session-State.session-State = { INFO : (2.0) h9-auth-server - Permanent-Identity = 10026000000000(a)wlan.mnc11343.mcc0.3gppnetwork.org INFO : (2.0) h9-auth-server - Session-Data = 0xab32a5be4d8309d4a40938e425ef1714d71cf87a INFO : (2.0) h9-auth-server - Counter = 0 INFO : (2.0) h9-auth-server - } Debug : (2.0) h9-auth-server - | %(debug_attr:{&session-state}) Debug : (2.0) h9-auth-server - | --> (null) Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # send Reauthentication-Request (ok) Debug : (2.0) h9-auth-server - Generating new session keys Debug : (2.0) h9-auth-server - Neither &session-state.Session-Data or &session-state.MK attributes found, can't calculate re-auth keys >>>>>>>>>>>>>>>>>>>>> Getting this error, however I could see session-state has Session-Data loaded. Debug : (2.0) h9-auth-server - Composing EAP-Request/Reauthentication failed. Clearing reply attributes and requesting additional Identity Debug : (2.0) h9-auth-server - Changed state REAUTHENTICATION -> AKA-IDENTITY Debug : (2.0) h9-auth-server - send Identity-Request { Debug : (2.0) h9-auth-server - ok (ok) Debug : (2.0) h9-auth-server - } # send Identity-Request (ok) And then it falls back to full authentication... Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Any help would be greatly appreciated. Thank you in advance. Thanks, Deepika

1 0

Which module is listening to udp port 52894
by Yuriy Ivkin 02 May '23

02 May '23

Greetings! Could you please tell me, which module cal listening to udp port 52894 ? Grepping of configs gives nothing as well as googling and searching in the sources repository. Freeradius installed from the ubuntu package repository. Listening port output: #lsof -Pi4 ... freeradiu 89399 freerad 16u IPv4 124336 0t0 UDP *:52894 ... -- Best regards, Yuriy Ivkin

3 5

traffic quota control
by ReZa Esfahani 02 May '23

02 May '23

hi I want to control traffic quota for users in freeradius, for example, I want to set a monthly 20GB traffic quota for a specific group. How can I do that ? and after the traffic quota is reached , freeradius disconnects the user? and my last question is rlm_quota module in freeradius for this or do we have to do it in another way? thank you

3 3

Is it possible to query freeradius' certificate expiration remotely?
by Matt H 02 May '23

02 May '23

Is it possible to query freeradius' certificate expiration date remotely for the cert in /etc/raddb/certs? I'm trying to set up an alert so there's notification when the cert is <60 days from requiring renewal. I'm trying the following but the command returns connection refused on all of the ports I expected it to work on: openssl s_client -servername rad2.domain.com -connect rad2.domain.com:1813 | openssl x509 -noout -dates I've tried ports 443, 8080, 88, 1812, 1813, 1645, 1646, and everything else I can find that might be listening, to no avail. Thanks for any guidance /mh

5 4

radperf and radius returns challenge
by Mesut GULNAZ 29 Apr '23

29 Apr '23

I am trying to make a performance test for a radius server that sends challenge instead of Access-Accepted but radperf marks all responses as fail Total failed : 100 this is the command I used. radperf -q -s -a pap -c 100 -T test.rad -f user.csv -p 100 -r 1 -t 60 localhost:1812 auth testing123 what can I do? any help is highly appreciated.

2 1

FW: Need help with EAP-AKA configuration
by Mrudul Dighe 26 Apr '23

26 Apr '23

Hello, I am trying to configure EAP-AKA virtual-server in FreeRADIUS to perform authentication of multiple sim cards we own. We have followed the documentation and configured below in sites-enabled/eap-aka-sim and able to authenticate successful with EAPOL_TEST tool using same Ki and OPc: <<<<<<<<<<<<<<<<<<<<<<<<<<<< send Challenge-Request { &control.SIM-Ki := 0x465b5ce8b199b49faa5f0a2ee238a6bc &control.SIM-Opc := 0xcd63cb71954a9f4e48a5994e37a02baf &control.SIM-SQN := 3 } >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> However, this helps in authenticating only the imsi with above Ki/OPc. But our requirement is to authenticate multiple such IMSIs/SIMs with their Ki/OPc whose values we are aware of. May I know how to specify the list of imsi/Users and make it work instead of hardcoding like above? We tried adding following line in 'users' file in raddb/ folder and removed above hardcoding in Challenge-Response part of eap-aka-sim virtual-server configuration : "315010000000002(a)wlan.mnc010.mcc315.3gppnetwork.org<mailto:315010000000002@wlan.mnc010.mcc315.3gppnetwork.org> SIM-Ki := 770db7f9275c47eb3d12b2024caa3548, SIM-Opc := 6245aedadf3ebbb82b0f62df52e0de12, SIM-SQN := 3" But it's not working. I have attached the radiusd Logs with the mail. Where I see following error - """ (0.0) eap-aka-sim - WARNING: Could not find or derive data for UMTS vector (0.0) eap-aka-sim - ERROR: Failed retrieving UMTS vectors """ Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Any help would be greatly appreciated. Thank you in advance. Best regards, Mrudul Dighe.

2 1

"switch" statement": would you know a more compact statement?
by Alex Zetaeffesse 26 Apr '23

26 Apr '23

Hi FR people, Is there a more compact way to state what follows? switch { ("%{User-Name}" =~ /(a)tenant101\.bic\.local/) {update control{Proxy-To-Realm := "tenant101"} ("%{User-Name}" =~ /(a)tenant102\.bic\.local/) {update control{Proxy-To-Realm := "tenant102"} ("%{User-Name}" =~ /(a)tenant103\.bic\.local/) {update control{Proxy-To-Realm := "tenant103"} ("%{User-Name}" =~ /(a)tenant104\.bic\.local/) {update control{Proxy-To-Realm := "tenant104"} ("%{User-Name}" =~ /(a)tenant105\.bic\.local/) {update control{Proxy-To-Realm := "tenant105"} ("%{User-Name}" =~ /(a)tenant106\.bic\.local/) {update control{Proxy-To-Realm := "tenant106"} ("%{User-Name}" =~ /(a)tenant107\.bic\.local/) {update control{Proxy-To-Realm := "tenant107"} .... ("%{User-Name}" =~ /(a)tenant170\.bic\.local/) {update control{Proxy-To-Realm := "tenant170"} } Eventually, I may get the value of the Proxy-To-Realm variable, by stripping the 2nd and top level domain and there would not need to repeat the case. Thanks, Alex

2 4