- Freeradius-Users - lists.freeradius.org

modify NAS-Port in incoming messages
by Volodymyr Litovka 27 Dec '22

27 Dec '22

Hi colleagues, I'm trying to use Freeradius with Strongswan and have an issue with "registering" user sessions. In short, upon IPSec session reconfiguring (to be more precise - IKE_SA rekeying) Strongswan changes NAS-Port attribute and, thus, FreeRadius upon receiving of next Interim-Update with another NAS-Port value, consider it as a new session and create new entry in radutmp db, so finally I have the following (TTY is NAS-Port received from NAS): root@vpn01:/etc/freeradius/3.0# radwho Login Name What TTY When From Location doka doka shell S3 Sun 22:44 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S4 Sun 22:53 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S5 Sun 23:03 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S6 Sun 23:12 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S12 Sun 23:27 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S15 Sun 23:35 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S18 Sun 23:40 xxx.xxx.xx.xx 100.100.2.1 doka doka shell S19 Sun 23:51 xxx.xxx.xx.xx 100.100.2.1 which makes it impossible to use Simultaneous-Use. There is attribute which do not change during IKE_SA rekey - Acct-Session-Id and I'd like to use it instead of Nas-Port to identify this session, but have two issues: - the statement (added to preacct section of 'default' site): update request { NAS-Port = %{integer:%{base64:&Acct-Session-Id}} } gives an error: /etc/freeradius/3.0/sites-enabled/default[610]: Unknown or invalid value "%{integer:%{base64:&Acct-Session-Id}}" for attribute NAS-Port while if using double quotes `... = "%{integer...}"` converts the value improperly: (3) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (3) preacct { (3) [preprocess] = ok (3) update request { *(3) EXPAND %{integer:%{base64:&Acct-Session-Id}}* (3) --> *(3) NAS-Port = 0* (3) } # update request = noop - and nevertheless, in second case accounting records in 'details' file contains the original NAS-Port value: Mon Dec 26 00:17:19 2022 Acct-Status-Type = Interim-Update Acct-Session-Id = "1672007843-24" Class = 0x70667367726f7570 NAS-Port-Type = Virtual Service-Type = Framed-User *NAS-Port = 25* and radutmp continues to expand the list of connections with original NAS-Port value: doka doka shell *S24* Mon 00:14 xxx.xxx.xx.xx 100.100.2.1 doka doka shell *S25* Mon 00:24 xxx.xxx.xx.xx 100.100.2.1 So, there are two questions: - what is correct way to uniquely convert string to integer? - whether it's possible to mangle NAS-Port attribute to achieve what I need? Thank you! Have a nice holidays and happy next year :-) -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison

2 4

radclient test data
by vaiost SSSS 27 Dec '22

27 Dec '22

Hi,I'm using freeradius 3.2.1 just to log Accounting requests (preferably through linelog module) so as to process data later with an external process.The problem is that when stress freeradius using radclient, many requests are not logged both using linelog or detail modules. I believe that there is something wrong with my test data that is stored in a simple file(i.e. acct_test.txt).Thank you in advanceRegards radclient -f acct_test.txt -c 5000 -t 1 -x -p 10 172.19.185.60 acct m2msdp2022|grep Accounting-Response|wc -lTue Dec 27 13:38:11 EET 2022radclient: Received reply to request we did not send. (id=21 socket 4)radclient: Received reply to request we did not send. (id=59 socket 4)5000 acct_test.txtAcct-Status-Type=StopAcct-Session-Id="testing"NAS-IP-Address=10.95.142.77#User-Name=vaiosCalled-Station-Id=306974028024Framed-IP-Address=10.37.236.170Event-Timestamp=1667211238Acct-Session-Id=C110DB4B857B4FB3Service-Type=FramedFramed-Protocol=PPTP3GPP-IMSI=2020109233950123GPP-Charging-ID=2239451059

2 1

sql ldap simultaneous-use
by mcury 23 Dec '22

23 Dec '22

Hi, I'm new to freeradius, currently trying to enforce simultaneous-use = 1 in my wireless network but it is not working. unifi access point > freeradius > samba-ad-dc mysql> SELECT COUNT(*) FROM radacct WHERE username = 'vanessa' AND acctstoptime IS NULL; +----------+ | COUNT(*) | +----------+ | 2 | +----------+ 1 row in set (0.00 sec) I'm using LDAP for authentication through post-auth section in sites-available/default file using Unlang and its working perfectly. (11) if (LDAP-Group == "wifi_users" && NAS-IP-Address == "172.16.200.3") -> TRUE (11) if (LDAP-Group == "wifi_users" && NAS-IP-Address == "172.16.200.3") { (11) update { (11) control:Simultaneous-Use := 1 (11) reply:Class := 0x776966695f7573657273 (11) } # update = noop (11) [noop] = noop (11) } # if (LDAP-Group == "wifi_users" && NAS-IP-Address == "172.16.200.3") = noop (11) ... skipping elsif: Preceding "if" was taken (11) } # post-auth = ok (11) Sent Access-Accept Id 77 from 192.168.255.241:1812 to 172.16.200.3:38173 length 187 LDAP attribute map as per below: mods-available/ldap: update { ... control:Simultaneous-Use += 'radiusSimultaneousUse = 1' sql is included inside session { section as per documentation. Any tips, perhaps I forgot something? Thanks in advance

2 2

certificate expired with PEAP/MSCHAPv2/Android 11 in WiFi
by Olivier 20 Dec '22

20 Dec '22

Hello, For some times now, Android 11 requires cert validation in WiFi connections (see [1]). At the same time, Android 11 also makes it much harder for end users to import self-signed root CA (see [2]). As I provide WiFi connectivity in BYOD environments and can't help end users when they import certs, I choosed to test PEAP/MSCHAPv2 with LetsEncrypt certs though I know this would be less secure than with self-signed root CA. I'm planning to generate and renew LetsEncrypt cert on a remote Internet-connected host, and then copy both privkey.pem and fullchain.pem files to Freeradius instance, as suggested by [3]. In my lab setup, I'm using a Samsung Galaxy Tab A7 Lite to test. Though being Android 11-powered, this device also allows Do-Not-Validate pre-Android 11 option ! When I connect to WiFi with this device, I'm using the following settings: Identity: bar Password: whateverneeded CA Certificate: use system certificate Online cert status: do not validate Domain: the exact CN value My lab setup includes: - a Freeradius 3.0.21 on Debian Bullseye - a Unifi WiFi Network 6.5.55 with WiFi AP - a Samsung Galaxy Tab A7 Lite - valid LetsEncrypt certs My certs files are copied into Freeradius host as: # ls -l /etc/freeradius/3.0/certs/letsencrypt/ total 12 -rw-r----- 1 freerad freerad 5604 27 juin 19:04 fullchain.pem -rw------- 1 freerad freerad 1704 27 juin 19:04 privkey.pem # openssl x509 -dates -noout -in /etc/freeradius/3.0/certs/letsencrypt/fullchain.pem notBefore=May 28 17:32:21 2022 GMT notAfter=Aug 26 17:32:20 2022 GMT [1] https://internet-access-guide.com/android-wifi-ca-certificate-do-not-valida… [2] https://httptoolkit.tech/blog/android-11-trust-ca-certificates/ [3] https://framebyframewifi.net/2017/01/29/use-lets-encrypt-certificates-with-… When I connect to WiFi, this is part of freeradius -X output: # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } ... rlm_mschap (mschap): using internal authentication # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/letsencrypt/privkey.pem" certificate_file = "/etc/freeradius/3.0/certs/letsencrypt/fullchain.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Please use tls_min_version and tls_max_version instead of disable_tlsv1 Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336 } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 56401 Listening on proxy address :: port 45775 Ready to process requests (26) eap: Peer sent EAP Response (code 2) ID 1 length 141 (26) eap: Continuing tunnel setup (26) [eap] = ok (26) } # authorize = ok (26) Found Auth-Type = eap (26) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (26) authenticate { (26) eap: Expiring EAP session with state 0xc733062dc6321fce (26) eap: Finished EAP session with state 0xc733062dc6321fce (26) eap: Previous EAP request found for state 0xc733062dc6321fce, released from the list (26) eap: Peer sent packet with method EAP PEAP (25) (26) eap: Calling submodule eap_peap to process data (26) eap_peap: Continuing EAP-TLS (26) eap_peap: Peer indicated complete TLS record size will be 131 bytes (26) eap_peap: Got complete TLS record (131 bytes) (26) eap_peap: [eaptls verify] = length included (26) eap_peap: (other): before SSL initialization (26) eap_peap: TLS_accept: before SSL initialization (26) eap_peap: TLS_accept: before SSL initialization (26) eap_peap: <<< recv TLS 1.3 [length 007e] (26) eap_peap: TLS_accept: SSLv3/TLS read client hello (26) eap_peap: >>> send TLS 1.2 [length 003d] (26) eap_peap: TLS_accept: SSLv3/TLS write server hello (26) eap_peap: >>> send TLS 1.2 [length 0fbe] (26) eap_peap: TLS_accept: SSLv3/TLS write certificate (26) eap_peap: >>> send TLS 1.2 [length 014d] (26) eap_peap: TLS_accept: SSLv3/TLS write key exchange (26) eap_peap: >>> send TLS 1.2 [length 0004] (26) eap_peap: TLS_accept: SSLv3/TLS write server done (26) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (26) eap_peap: TLS - In Handshake Phase (26) eap_peap: TLS - got 4448 bytes of data (26) eap_peap: [eaptls process] = handled (26) eap: Sending EAP Request (code 1) ID 2 length 1004 (26) eap: EAP session adding &reply:State = 0xc733062dc5311fce (26) [eap] = handled (26) } # authenticate = handled (26) Using Post-Auth-Type Challenge (26) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (26) Challenge { ... } # empty sub-section is ignored (26) Sent Access-Challenge Id 43 from 192.168.1.244:1812 to 192.168.1.50:58452 length 0 (26) EAP-Message = 0x010203ec19c000001160160303003d020000390303af5657898d92eefe5085a4ad3604bed4f0f0b48e39cd7ada954fbee1b104098800c02f000011ff01000100000b000403000102001700001603030fbe0b000fba000fb70005303082052c30820414a003020102021203734b50cf2bcbeb7c22ada836c00a3f624f300d06092a864886f70d01010b05003032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b3009060355040313025233301e170d3232303532383137333232315a170d3232303832363137333232305a301e311c301a06035504031313686f7374332e706572656e69702e636c6f756430820122300d06092a864886f70d01010105000382010f003082010a0282010100e653da7ed722cc166a21b4055852edc8973b7daa624eb8897805f735be194e49d231f0d04e2d091679c8a1f9075bf6051d24661042467c293e77827ed8de02eacf8132699f9aac89cb9471f1857c292dca4cc9d69608d7 (26) Message-Authenticator = 0x00000000000000000000000000000000 (26) State = 0xc733062dc5311fceda200d98107c2728 (26) Finished request Waking up in 4.9 seconds. (27) Received Access-Request Id 44 from 192.168.1.50:58452 to 192.168.1.244:1812 length 231 (27) User-Name = "bar" (27) NAS-IP-Address = 192.168.1.50 (27) NAS-Identifier = "f09fc2f50d43" (27) Called-Station-Id = "F0-9F-C2-F5-0D-43:MyCompany" (27) NAS-Port-Type = Wireless-802.11 (27) Service-Type = Framed-User (27) Calling-Station-Id = "2E-9A-17-FA-78-FA" (27) Connect-Info = "CONNECT 0Mbps 802.11b" (27) Acct-Session-Id = "2087B41CCAAC0F74" (27) Acct-Multi-Session-Id = "C546EF77BB09F037" (27) WLAN-Pairwise-Cipher = 1027076 (27) WLAN-Group-Cipher = 1027076 (27) WLAN-AKM-Suite = 1027073 (27) Framed-MTU = 1400 (27) EAP-Message = 0x020200061900 (27) State = 0xc733062dc5311fceda200d98107c2728 (27) Message-Authenticator = 0x39f4e95b5909f1152843a2e02fbaffde (27) session-state: No cached attributes (27) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (27) authorize { (27) policy filter_username { (27) if (&User-Name) { (27) if (&User-Name) -> TRUE (27) if (&User-Name) { (27) if (&User-Name =~ / /) { (27) if (&User-Name =~ / /) -> FALSE (27) if (&User-Name =~ /@[^@]*@/ ) { (27) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (27) if (&User-Name =~ /\.\./ ) { (27) if (&User-Name =~ /\.\./ ) -> FALSE (27) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (27) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (27) if (&User-Name =~ /\.$/) { (27) if (&User-Name =~ /\.$/) -> FALSE (27) if (&User-Name =~ /(a)\./) { (27) if (&User-Name =~ /(a)\./) -> FALSE (27) } # if (&User-Name) = notfound (27) } # policy filter_username = notfound (27) [preprocess] = ok (27) [chap] = noop (27) [mschap] = noop (27) [digest] = noop (27) suffix: Checking for suffix after "@" (27) suffix: No '@' in User-Name = "bar", looking up realm NULL (27) suffix: No such realm "NULL" (27) [suffix] = noop (27) eap: Peer sent EAP Response (code 2) ID 2 length 6 (27) eap: Continuing tunnel setup (27) [eap] = ok (27) } # authorize = ok (27) Found Auth-Type = eap (27) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (27) authenticate { (27) eap: Expiring EAP session with state 0xc733062dc5311fce (27) eap: Finished EAP session with state 0xc733062dc5311fce (27) eap: Previous EAP request found for state 0xc733062dc5311fce, released from the list (27) eap: Peer sent packet with method EAP PEAP (25) (27) eap: Calling submodule eap_peap to process data (27) eap_peap: Continuing EAP-TLS (27) eap_peap: Peer ACKed our handshake fragment (27) eap_peap: [eaptls verify] = request (27) eap_peap: [eaptls process] = handled (27) eap: Sending EAP Request (code 1) ID 3 length 1000 (27) eap: EAP session adding &reply:State = 0xc733062dc4301fce (27) [eap] = handled (27) } # authenticate = handled (27) Using Post-Auth-Type Challenge (27) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (27) Challenge { ... } # empty sub-section is ignored (27) Sent Access-Challenge Id 44 from 192.168.1.244:1812 to 192.168.1.50:58452 length 0 (27) EAP-Message = 0x010303e81940cca15e2a9dd6bfa61b4d866fdcc7284c9a6a860076002979bef09e393921f056739f63a577e5be577d9c600af8f94d5d265c255dc784000001810bf0d4030000040300473045022037d7b0385f16f2b16e8903082d51bb15604c0262cd7473239d165e5ca5a858740221009c92c932de42f9d7883a89cd8ddc171d91a0f5b0d2e77b6886d1ea473f7fbe17300d06092a864886f70d01010b05000382010100731334fe1bbdc145631a0ddd0e7174e87df1da2cf6b032521bba82995c0460886e5b751c5f0b417ad32fa987caac9f61be48ec68673e33bc5a1deebe1004c5546cb3ef098495ab393bd60c614e132ad13e5fe0ca56106aeb92cf1f4e6de2f8f736bc1e94b7659439b711b931ba2174abb85ef05347b7d82f18411fe147f74939fbe311977c50c90b7c7720e890b59300fef66c0c7b84cd536cbde1aee6231f21550751613cba3ad52f48c82b2cc0de8e38764ba3c988a8cd37994500c1233288e294319b95c4600a48b3094eadf3ac1d68bf (27) Message-Authenticator = 0x00000000000000000000000000000000 (27) State = 0xc733062dc4301fceda200d98107c2728 (27) Finished request Waking up in 4.9 seconds. (28) Received Access-Request Id 45 from 192.168.1.50:58452 to 192.168.1.244:1812 length 231 (28) User-Name = "bar" (28) NAS-IP-Address = 192.168.1.50 (28) NAS-Identifier = "f09fc2f50d43" (28) Called-Station-Id = "F0-9F-C2-F5-0D-43:MyCompany" (28) NAS-Port-Type = Wireless-802.11 (28) Service-Type = Framed-User (28) Calling-Station-Id = "2E-9A-17-FA-78-FA" (28) Connect-Info = "CONNECT 0Mbps 802.11b" (28) Acct-Session-Id = "2087B41CCAAC0F74" (28) Acct-Multi-Session-Id = "C546EF77BB09F037" (28) WLAN-Pairwise-Cipher = 1027076 (28) WLAN-Group-Cipher = 1027076 (28) WLAN-AKM-Suite = 1027073 (28) Framed-MTU = 1400 (28) EAP-Message = 0x020300061900 (28) State = 0xc733062dc4301fceda200d98107c2728 (28) Message-Authenticator = 0x441e1d2d2df0e955fe4065c44cb93a6b (28) session-state: No cached attributes (28) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (28) authorize { (28) policy filter_username { (28) if (&User-Name) { (28) if (&User-Name) -> TRUE (28) if (&User-Name) { (28) if (&User-Name =~ / /) { (28) if (&User-Name =~ / /) -> FALSE (28) if (&User-Name =~ /@[^@]*@/ ) { (28) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (28) if (&User-Name =~ /\.\./ ) { (28) if (&User-Name =~ /\.\./ ) -> FALSE (28) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (28) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (28) if (&User-Name =~ /\.$/) { (28) if (&User-Name =~ /\.$/) -> FALSE (28) if (&User-Name =~ /(a)\./) { (28) if (&User-Name =~ /(a)\./) -> FALSE (28) } # if (&User-Name) = notfound (28) } # policy filter_username = notfound (28) [preprocess] = ok (28) [chap] = noop (28) [mschap] = noop (28) [digest] = noop (28) suffix: Checking for suffix after "@" (28) suffix: No '@' in User-Name = "bar", looking up realm NULL (28) suffix: No such realm "NULL" (28) [suffix] = noop (28) eap: Peer sent EAP Response (code 2) ID 3 length 6 (28) eap: Continuing tunnel setup (28) [eap] = ok (28) } # authorize = ok (28) Found Auth-Type = eap (28) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (28) authenticate { (28) eap: Expiring EAP session with state 0xc733062dc4301fce (28) eap: Finished EAP session with state 0xc733062dc4301fce (28) eap: Previous EAP request found for state 0xc733062dc4301fce, released from the list (28) eap: Peer sent packet with method EAP PEAP (25) (28) eap: Calling submodule eap_peap to process data (28) eap_peap: Continuing EAP-TLS (28) eap_peap: Peer ACKed our handshake fragment (28) eap_peap: [eaptls verify] = request (28) eap_peap: [eaptls process] = handled (28) eap: Sending EAP Request (code 1) ID 4 length 1000 (28) eap: EAP session adding &reply:State = 0xc733062dc3371fce (28) [eap] = handled (28) } # authenticate = handled (28) Using Post-Auth-Type Challenge (28) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (28) Challenge { ... } # empty sub-section is ignored (28) Sent Access-Challenge Id 45 from 192.168.1.244:1812 to 192.168.1.50:58452 length 0 (28) EAP-Message = 0x010403e8194001ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10 (28) Message-Authenticator = 0x00000000000000000000000000000000 (28) State = 0xc733062dc3371fceda200d98107c2728 (28) Finished request Waking up in 4.9 seconds. (29) Received Access-Request Id 46 from 192.168.1.50:58452 to 192.168.1.244:1812 length 231 (29) User-Name = "bar" (29) NAS-IP-Address = 192.168.1.50 (29) NAS-Identifier = "f09fc2f50d43" (29) Called-Station-Id = "F0-9F-C2-F5-0D-43:MyCompany" (29) NAS-Port-Type = Wireless-802.11 (29) Service-Type = Framed-User (29) Calling-Station-Id = "2E-9A-17-FA-78-FA" (29) Connect-Info = "CONNECT 0Mbps 802.11b" (29) Acct-Session-Id = "2087B41CCAAC0F74" (29) Acct-Multi-Session-Id = "C546EF77BB09F037" (29) WLAN-Pairwise-Cipher = 1027076 (29) WLAN-Group-Cipher = 1027076 (29) WLAN-AKM-Suite = 1027073 (29) Framed-MTU = 1400 (29) EAP-Message = 0x020400061900 (29) State = 0xc733062dc3371fceda200d98107c2728 (29) Message-Authenticator = 0x662064b545b5aa385ea1ebd63c5d881b (29) session-state: No cached attributes (29) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (29) authorize { (29) policy filter_username { (29) if (&User-Name) { (29) if (&User-Name) -> TRUE (29) if (&User-Name) { (29) if (&User-Name =~ / /) { (29) if (&User-Name =~ / /) -> FALSE (29) if (&User-Name =~ /@[^@]*@/ ) { (29) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (29) if (&User-Name =~ /\.\./ ) { (29) if (&User-Name =~ /\.\./ ) -> FALSE (29) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (29) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (29) if (&User-Name =~ /\.$/) { (29) if (&User-Name =~ /\.$/) -> FALSE (29) if (&User-Name =~ /(a)\./) { (29) if (&User-Name =~ /(a)\./) -> FALSE (29) } # if (&User-Name) = notfound (29) } # policy filter_username = notfound (29) [preprocess] = ok (29) [chap] = noop (29) [mschap] = noop (29) [digest] = noop (29) suffix: Checking for suffix after "@" (29) suffix: No '@' in User-Name = "bar", looking up realm NULL (29) suffix: No such realm "NULL" (29) [suffix] = noop (29) eap: Peer sent EAP Response (code 2) ID 4 length 6 (29) eap: Continuing tunnel setup (29) [eap] = ok (29) } # authorize = ok (29) Found Auth-Type = eap (29) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (29) authenticate { (29) eap: Expiring EAP session with state 0xc733062dc3371fce (29) eap: Finished EAP session with state 0xc733062dc3371fce (29) eap: Previous EAP request found for state 0xc733062dc3371fce, released from the list (29) eap: Peer sent packet with method EAP PEAP (25) (29) eap: Calling submodule eap_peap to process data (29) eap_peap: Continuing EAP-TLS (29) eap_peap: Peer ACKed our handshake fragment (29) eap_peap: [eaptls verify] = request (29) eap_peap: [eaptls process] = handled (29) eap: Sending EAP Request (code 1) ID 5 length 1000 (29) eap: EAP session adding &reply:State = 0xc733062dc2361fce (29) [eap] = handled (29) } # authenticate = handled (29) Using Post-Auth-Type Challenge (29) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (29) Challenge { ... } # empty sub-section is ignored (29) Sent Access-Challenge Id 46 from 192.168.1.244:1812 to 192.168.1.50:58452 length 0 (29) EAP-Message = 0x010503e81940f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd0 (29) Message-Authenticator = 0x00000000000000000000000000000000 (29) State = 0xc733062dc2361fceda200d98107c2728 (29) Finished request Waking up in 4.8 seconds. (30) Received Access-Request Id 47 from 192.168.1.50:58452 to 192.168.1.244:1812 length 231 (30) User-Name = "bar" (30) NAS-IP-Address = 192.168.1.50 (30) NAS-Identifier = "f09fc2f50d43" (30) Called-Station-Id = "F0-9F-C2-F5-0D-43:MyCompany" (30) NAS-Port-Type = Wireless-802.11 (30) Service-Type = Framed-User (30) Calling-Station-Id = "2E-9A-17-FA-78-FA" (30) Connect-Info = "CONNECT 0Mbps 802.11b" (30) Acct-Session-Id = "2087B41CCAAC0F74" (30) Acct-Multi-Session-Id = "C546EF77BB09F037" (30) WLAN-Pairwise-Cipher = 1027076 (30) WLAN-Group-Cipher = 1027076 (30) WLAN-AKM-Suite = 1027073 (30) Framed-MTU = 1400 (30) EAP-Message = 0x020500061900 (30) State = 0xc733062dc2361fceda200d98107c2728 (30) Message-Authenticator = 0xdb1a11eda65bfd28f2bae8a4467c4bea (30) session-state: No cached attributes (30) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (30) authorize { (30) policy filter_username { (30) if (&User-Name) { (30) if (&User-Name) -> TRUE (30) if (&User-Name) { (30) if (&User-Name =~ / /) { (30) if (&User-Name =~ / /) -> FALSE (30) if (&User-Name =~ /@[^@]*@/ ) { (30) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (30) if (&User-Name =~ /\.\./ ) { (30) if (&User-Name =~ /\.\./ ) -> FALSE (30) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (30) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (30) if (&User-Name =~ /\.$/) { (30) if (&User-Name =~ /\.$/) -> FALSE (30) if (&User-Name =~ /(a)\./) { (30) if (&User-Name =~ /(a)\./) -> FALSE (30) } # if (&User-Name) = notfound (30) } # policy filter_username = notfound (30) [preprocess] = ok (30) [chap] = noop (30) [mschap] = noop (30) [digest] = noop (30) suffix: Checking for suffix after "@" (30) suffix: No '@' in User-Name = "bar", looking up realm NULL (30) suffix: No such realm "NULL" (30) [suffix] = noop (30) eap: Peer sent EAP Response (code 2) ID 5 length 6 (30) eap: Continuing tunnel setup (30) [eap] = ok (30) } # authorize = ok (30) Found Auth-Type = eap (30) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (30) authenticate { (30) eap: Expiring EAP session with state 0xc733062dc2361fce (30) eap: Finished EAP session with state 0xc733062dc2361fce (30) eap: Previous EAP request found for state 0xc733062dc2361fce, released from the list (30) eap: Peer sent packet with method EAP PEAP (25) (30) eap: Calling submodule eap_peap to process data (30) eap_peap: Continuing EAP-TLS (30) eap_peap: Peer ACKed our handshake fragment (30) eap_peap: [eaptls verify] = request (30) eap_peap: [eaptls process] = handled (30) eap: Sending EAP Request (code 1) ID 6 length 478 (30) eap: EAP session adding &reply:State = 0xc733062dc1351fce (30) [eap] = handled (30) } # authenticate = handled (30) Using Post-Auth-Type Challenge (30) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (30) Challenge { ... } # empty sub-section is ignored (30) Sent Access-Challenge Id 47 from 192.168.1.244:1812 to 192.168.1.50:58452 length 0 (30) EAP-Message = 0x010601de1900676dc257c5463941cf8a5883586d99fe57e8360ef00e23aafd8897d0e35c0e9449b5b51735d22ebf4e85ef18e08592eb063b6c29230960dc45024c12183be9fb0ededc44f85898aeeabd4545a1885d66cafe10e96f82c811420dfbe9ece38600de9d10e338faa47db1d8e8498284069b2be86b4f010c38772ef9dde739160303014d0c0001490300174104182d51bb94eedf8e4d45ba672b11c1683550862e7b3cbcc4c060eeb4bb6a788ba97e3226321cf8ba7055f70228fd8fbd726b203aaecea3297f2f15e87c0e13190804010065efa44cf7b89671f95ce0791208321c652e630ca175e1c4c11946ffa99a7ecddf6f6e5bc8b7689bca97ea17a48c085474e867dc62b2102a477c4a022336e02e2e4e38d5542a7c69276d22fd961b4022e88c54c7fe6fad2d1176b734f007a2af32ae3fd62b53a6fcd2da0b78040ee68241e4435189e87093b227e4f4f9ebb3c1b3da591bd3c129f70dcd71fca22d92ceaa6318dfcf6397a92d127e2a999be84a9be8 (30) Message-Authenticator = 0x00000000000000000000000000000000 (30) State = 0xc733062dc1351fceda200d98107c2728 (30) Finished request Waking up in 4.8 seconds. (31) Received Access-Request Id 48 from 192.168.1.50:58452 to 192.168.1.244:1812 length 242 (31) User-Name = "bar" (31) NAS-IP-Address = 192.168.1.50 (31) NAS-Identifier = "f09fc2f50d43" (31) Called-Station-Id = "F0-9F-C2-F5-0D-43:MyCompany" (31) NAS-Port-Type = Wireless-802.11 (31) Service-Type = Framed-User (31) Calling-Station-Id = "2E-9A-17-FA-78-FA" (31) Connect-Info = "CONNECT 0Mbps 802.11b" (31) Acct-Session-Id = "2087B41CCAAC0F74" (31) Acct-Multi-Session-Id = "C546EF77BB09F037" (31) WLAN-Pairwise-Cipher = 1027076 (31) WLAN-Group-Cipher = 1027076 (31) WLAN-AKM-Suite = 1027073 (31) Framed-MTU = 1400 (31) EAP-Message = 0x020600111980000000071503030002022d (31) State = 0xc733062dc1351fceda200d98107c2728 (31) Message-Authenticator = 0x96fa48935246587652cd6219e8243639 (31) session-state: No cached attributes (31) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (31) authorize { (31) policy filter_username { (31) if (&User-Name) { (31) if (&User-Name) -> TRUE (31) if (&User-Name) { (31) if (&User-Name =~ / /) { (31) if (&User-Name =~ / /) -> FALSE (31) if (&User-Name =~ /@[^@]*@/ ) { (31) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (31) if (&User-Name =~ /\.\./ ) { (31) if (&User-Name =~ /\.\./ ) -> FALSE (31) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (31) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (31) if (&User-Name =~ /\.$/) { (31) if (&User-Name =~ /\.$/) -> FALSE (31) if (&User-Name =~ /(a)\./) { (31) if (&User-Name =~ /(a)\./) -> FALSE (31) } # if (&User-Name) = notfound (31) } # policy filter_username = notfound (31) [preprocess] = ok (31) [chap] = noop (31) [mschap] = noop (31) [digest] = noop (31) suffix: Checking for suffix after "@" (31) suffix: No '@' in User-Name = "bar", looking up realm NULL (31) suffix: No such realm "NULL" (31) [suffix] = noop (31) eap: Peer sent EAP Response (code 2) ID 6 length 17 (31) eap: Continuing tunnel setup (31) [eap] = ok (31) } # authorize = ok (31) Found Auth-Type = eap (31) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (31) authenticate { (31) eap: Expiring EAP session with state 0xc733062dc1351fce (31) eap: Finished EAP session with state 0xc733062dc1351fce (31) eap: Previous EAP request found for state 0xc733062dc1351fce, released from the list (31) eap: Peer sent packet with method EAP PEAP (25) (31) eap: Calling submodule eap_peap to process data (31) eap_peap: Continuing EAP-TLS (31) eap_peap: Peer indicated complete TLS record size will be 7 bytes (31) eap_peap: Got complete TLS record (7 bytes) (31) eap_peap: [eaptls verify] = length included (31) eap_peap: <<< recv TLS 1.2 [length 0002] (31) eap_peap: ERROR: TLS Alert read:fatal:certificate expired (31) eap_peap: TLS_accept: Need to read more data: error (31) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired (31) eap_peap: TLS - In Handshake Phase (31) eap_peap: TLS - Application data. (31) eap_peap: ERROR: TLS failed during operation (31) eap_peap: ERROR: [eaptls process] = fail (31) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (31) eap: Sending EAP Failure (code 4) ID 6 length 4 (31) eap: Failed in EAP select (31) [eap] = invalid (31) } # authenticate = invalid (31) Failed to authenticate the user (31) Using Post-Auth-Type Reject (31) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (31) Post-Auth-Type REJECT { (31) attr_filter.access_reject: EXPAND %{User-Name} (31) attr_filter.access_reject: --> bar (31) attr_filter.access_reject: Matched entry DEFAULT at line 11 (31) [attr_filter.access_reject] = updated (31) [eap] = noop (31) policy remove_reply_message_if_eap { (31) if (&reply:EAP-Message && &reply:Reply-Message) { (31) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (31) else { (31) [noop] = noop (31) } # else = noop (31) } # policy remove_reply_message_if_eap = noop (31) } # Post-Auth-Type REJECT = updated (31) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (31) Sending delayed response (31) Sent Access-Reject Id 48 from 192.168.1.244:1812 to 192.168.1.50:58452 length 44 (31) EAP-Message = 0x04060004 (31) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. (24) Cleaning up request packet ID 41 with timestamp +308 How can I correct this ? Best regards

3 5

oauth2 or oidc module for FreeRADIUS
by Việt Đức Trần 20 Dec '22

20 Dec '22

Hi Everyone! I am using FreeRADIUS version 3.2.1 installed on Ubuntu server 22.04 and I need to make a connection from my FreeRADIUS server to an external authentication server by using OAuth2 or OpenID Connect protocol. But I cannot find any available FreeRADIUS modules for OAuth2 or OpenID Connect. If these modules currently don't exist or do not support FreeRADIUS 3.2.1, how can I make the connection from my FreeRADIUS server to external authentication server via OAuth2/OIDC protocol? Thank you so much for your help./

2 2

freeradius 4.0 rlm_kafka
by vaiost SSSS 19 Dec '22

19 Dec '22

Hi,I am experimenting with freeradius 4.0 and it will be great if you share some more info on how we use rlm_kafka functionality so as to send accounting requests using a producer to a kafka server.Thank you in adnvanceRegards

2 1

TLS 1.3 Configuration
by Boby Tharappel 16 Dec '22

16 Dec '22

Hi all, I'm trying to do an EAP TLS connection with TLS 1.3 Device is running wpa_supplicant V 2.10 and openssl 1.1.1q. Server is running Freeradius 3.2.1, openssl 1.1.1f on Ubuntu 20.04. I have set min and max tls version to 1.3 in mods-enabled/eap. I'm running into the following error: (9) Received Access-Request Id 249 from 192.168.0.1:35335 to 192.168.0.109:1812 length 336 (9) User-Name = "babycam" (9) NAS-IP-Address = 192.168.0.1 (9) NAS-Identifier = "RalinkAP0" (9) NAS-Port = 0 (9) Called-Station-Id = "AC-84-C6-60-76-8E" (9) Calling-Station-Id = "08-FB-EA-CF-70-C2" (9) Framed-MTU = 1400 (9) NAS-Port-Type = Wireless-802.11 (9) EAP-Message = 0x020200c40d0016030100b9010000b50303470176dc576b264b7154e9bfedb49482d8ec94cb131322a2700ad8115cf99678000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000054000b000403000102000a000c000a001d0017001e001900180016000000170000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602 (9) State = 0xa6ed9180a6ef9cf4c53afbdf101f92ad (9) Message-Authenticator = 0x17fafa7bdf53feccf5af9f4e6411bf3d (9) Restoring &session-state (9) &session-state:Framed-MTU = 994 (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "babycam", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 2 length 196 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) files: users: Matched entry babycam at line 1 (9) [files] = ok (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: Auth-Type already set. Not setting to PAP (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = eap (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0xa6ed9180a6ef9cf4 (9) eap: Finished EAP session with state 0xa6ed9180a6ef9cf4 (9) eap: Previous EAP request found for state 0xa6ed9180a6ef9cf4, released from the list (9) eap: Peer sent packet with method EAP TLS (13) (9) eap: Calling submodule eap_tls to process data (9) eap_tls: (TLS) EAP Got final fragment (190 bytes) (9) eap_tls: WARNING: (TLS) EAP Total received record fragments (190 bytes), does not equal expected expected data length (0 bytes) (9) eap_tls: (TLS) EAP Done initial handshake (9) eap_tls: (TLS) Handshake state - before SSL initialization (9) eap_tls: (TLS) Handshake state - Server before SSL initialization (9) eap_tls: (TLS) Handshake state - Server before SSL initialization (9) eap_tls: (TLS) recv TLS 1.3 Handshake, ClientHello (9) eap_tls: (TLS) send TLS 1.2 Alert, fatal protocol_version (9) eap_tls: ERROR: (TLS) Alert write:fatal:protocol version (9) eap_tls: ERROR: (TLS) Server : Error in error (9) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (9) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (9) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (9) eap_tls: ERROR: [eaptls process] = fail (9) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (9) eap: Sending EAP Failure (code 4) ID 2 length 4 (9) eap: Failed in EAP select (9) [eap] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) Post-Auth-Type REJECT { (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> babycam (9) attr_filter.access_reject: Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # Post-Auth-Type REJECT = updated (9) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (9) (9) Discarding duplicate request from client masutest port 35335 - ID: 249 due to delayed response (9) Sending delayed response (9) Sent Access-Reject Id 249 from 192.168.0.109:1812 to 192.168.0.1:35335 length 44 (9) EAP-Message = 0x04020004 (9) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Please assist me with this. Boby Tharappel

3 7

Access-Reject message to SQL
by Steven Walters 13 Dec '22

13 Dec '22

Hi I have enabled SQL under post-auth to send access reject records to a db. Below is the query in queries.conf. Currently it only indicates the packet type but I would like to add the same message written to the radius.log file e.g "Login incorrect (pap: MD5 digest does not match "known good" digest)" to the database. query = "\ INSERT INTO ${..postauth_table} \ (username, reply, authdate) \ VALUES(\ '%{User-Name}', \ '%{reply:Packet-Type}', \ NOW())" Regards Steven

2 1

Acct-Status-Type = Stop
by mohamed almeshal 13 Dec '22

13 Dec '22

I'm struggling with UBNT NAS , But I found a Soultion but I need your confirmation about the code , the solution is simply to code a code that tell the every time UBNT cloud Key close the session the radius response to send disconnect this sesiion by id I tested it manualyy and it's work perfect , now the code for radius is : accounting { if(Acct-Status-Type == Stop){ fire the code here } } is that code is accurate or not please advice

2 1

replay
by mohamed almeshal 11 Dec '22

11 Dec '22

the problem Alan is simply that NAS is UBNT and it's behavior is not predicted , it's close the session even when I set session-timeout so this solution is shortcut to that

2 1