- Freeradius-Users - lists.freeradius.org

FreeRadius and Circuit-ID
by filip.m.nikolic＠roamingnetworks.rs 14 Nov '22

14 Nov '22

Dear, All We are playing around with a scenario for subscriber attachment based on circuit-id and remote-id and ignoring PAP/CHAP. Idea is that you do not need to authenticate a user, just grant him access based on the fixed port in the access node. We struggle in the right configuration, so we are wondering if someone play with that and if someone can help us? Thanks in advance, <http://www.roamingnetworks.com/> <https://www.facebook.com/roamingnetworks/> <https://www.linkedin.com/company/roaming-networks/> <https://www.instagram.com/roaming_networks/> Filip Nikolić LEAD ENGINEER FOR TRANSPORT NETWORK DEVELOPMENT NOC Back Office <tel:+381648907383> +381648907383 <mailto:filip.m.nikolic@roamingnetworks.rs> filip.m.nikolic(a)roamingnetworks.rs <https://goo.gl/maps/g9UJK4ZZtfKtWzct8> OBLAKOVSKA 51, 11000 BELGRADE, SERBIA <http://www.roamingnetworks.com/> www.roamingnetworks.com Odricanje od odgovornosti: Ova elektronska poruka i njeni prilozi namenjeni su osobama na koje je adresirana i može biti poverljive prirode. Ako ova elektronska poruka nije upućena Vama, molimo Vas da nas odmah o tome obavestite a predmetnu elektronsku poruku i sve njene eventualne priloge izbrišete sa svog računara. Ovu elektronsku poruku nemojte kopirati niti njen sadržaj otkrivati trećim licima. Kršenje pravila o poverljivosti informacija zakonski je kažnjivo. Disclaimer: This email and any attachments to it are intended solely for the use of the individual to whom it is addressed and its content may be confidential. If you are not the intended recipient of this email, please contact us immediately. You must neither take any action based upon its contents, nor copy or show it to anyone. Any violation of confidentiality is punishable by law.

2 3

How to investigate failed Android authentication (EAP-TLS) on WiFi reconnection
by Dario Barbon 11 Nov '22

11 Nov '22

Hello, I've a Linux Ubuntu 18.04 server with Freeradius 3.0.16 on x86_64 virtual machine. Freeradius is used only to provide Android devices authentication (EAP-TLS); the authentication works. The WiFi network was installed by my client: it is a geographical distributed WiFi with a controller and 10 access points. Sometimes, when one smartphone moves out of WiFi network area and then come back, the connection to WiFi fails. I can reconnect only after a WiFi off / on from Android network settings. I want to investigate this behaviour; I've found these recurring errors inside last month log files: ERROR: rlm_eap (EAP): No EAP session matching state 0x3d4e1475385119b8 ERROR: TLS Alert write:fatal:protocol version ERROR: TLS Alert read : fatal:unknown CA ERROR: (658258) eap_tls: ERROR: TLS Alert read : fatal : internal error ERROR: (644636) eap_tls: ERROR: TLS Alert read : fatal:bad certificate ERROR: (639156) eap: ERROR: rlm_eap (EAP): Aborting! More than 50 roundtrips made in session with state 0xfd858905cfb18490 ERROR: (367333) eap_tls: ERROR: TLS Alert write:fatal:protocol version Could you please suggest a debug checklist / debug process to help me understand why this behaviour happen? Thanks. Dario Barbon

3 3

How I can enable debug logs for home server status check
by work vlpl 09 Nov '22

09 Nov '22

Hello, I am not sure if this is a potential issue or not so let me first ask how the home server if it is marked as dead can become alive? I have a configuration like this home_server <>__1812 { type = auth ipaddr = ip port = 1812 secret = <> response_window = 20 zombie_period = 40 # revive_interval = 120 status_check = request username = ping password = test check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 65536 } I've tried to uncomment or comment revive_interval but in both cases, I don't see in debug log (-fxxl) any messages about the home server status check. Also in my pool of home servers I have only 1 server, I know this is a weird config, but this is all that I have. In debug logs, I see a message like this (3600) ERROR: Failed to find live home server: Cancelling proxy (3600) Clearing existing &reply: attributes (3600) Found Post-Proxy-Type Fail-Authentication How I can enable debug messages about home server status checks? (I've tried to use more x i.e. -fxxxxx..., not helping) And manual request with radclient and credentials ping/test returns Access-Reject. So I expect that server should be marked as alive. Best regards, Vladimir

3 6

change of CA
by Burn Zero 09 Nov '22

09 Nov '22

Hi, Currently we have laptops(windows 10) which authenticate via FreeRADIUS using EAP-TLS. Now, I am going to change the CA and the laptops will get the new cert from the new CA(which will be used for authentication) and the old cert will be deleted. I have prepared to accept both old and new CA certs in the FreeRADIUS. We also have cache enabled in the eap module - Will this affect the connectivity of laptops since the cached attributes contain the old cert details from the old CA? Thank you.

2 1

3GPP Rel 8 support
by Bernard Murphy 08 Nov '22

08 Nov '22

Could anyone confirm whether they have successfully deployed freeradius for use with 3GPP Rel 8 dictionaries ? I have a need to deploy a 3GPP Rel 8 compatible radius server for use as authentication in a mobile network operators 4G private APN network configuration. I am trying to understand if anyone else has achieved this successfully previously. Regards Bernie This email transmission and any attachments to it are strictly confidential and are intended solely for the person or organisation to whom it is addressed. Its contents may contain legal professional or other privileged information. If you are not the intended recipient, please notify us immediately and delete it, without retaining it, copying it, disclosing its contents to anyone or acting upon it. You must ensure that you have appropriate virus protection before you open or detach any documents from this transmission. We accept no responsibility for viruses. We may monitor replies to emails for operational or lawful business reasons. The views or opinions expressed in this email are the author's own and may not, unless expressly stated to the contrary, reflect the views or opinions of Wales & West Utilities Limited, its affiliates or subsidiaries. Unless expressly stated to the contrary, neither Wales & West Utilities Limited, its affiliates or subsidiaries, their respective directors, officers or employees make any representation about, or accept any liability for, the accuracy or completeness of such views or opinions. Wales & West Utilities Limited Registered office: Wales & West House, Spooner Close, Celtic Springs, Coedkernew, NEWPORT NP10 8FZ Registered in England and Wales No 5046791

2 1

Getting ISO 8601 timestamp via rlm_linelog
by Coy Hile 07 Nov '22

07 Nov '22

Good afternoon, I’ve configured the linelog module to log when users get access to devices and what access level they are granted. eg: Access-Accept = ‘{Time: %T, . . . }’ Is there a way to get an ISO-8601 timestamp? Our telemetry/log management team would prefer that they don’t need to configure a custom timestamp handler in our log aggregation tool thanks, -- Coy Hile coy.hile(a)coyhile.com

2 1

Ignoring Duplicate packet perl module error
by Imdad Hasan 07 Nov '22

07 Nov '22

Hi All, *Ignoring duplicate packet from client 192.168.56.1 port 51091 - ID: 52 due to unfinished request in component authorize module perl* - Getting this error when test with 1k Auth requests with the *perl module* only.. no other load and complexity in perl module, just accepting all requests with " return RLM_MODULE_OK; ".. How can I avoid this error?

2 1

Difference between Received conflicting packet and Ignoring duplicate packet
by norbert.kunth＠now-it.de 03 Nov '22

03 Nov '22

Hi Freeradius-Users, we recently updated from 2.1.1 to 3.0.25 (we use still 3.0.25 because it is build in our SLES distribution). Freeradius uses LDAP to check users. If many users login at a time we see some error messages. To track this down we installed an internal test system that can send a lot of requests to the radius server (with radtest). We do see some problems, but the messages (and the behavior) are not the same. If we fire 60 requests in a short time from the test system to the servers, the server loggs: Thu Nov 3 13:35:11 2022 : Error: (159) Ignoring duplicate packet from client test port 46673 - ID: 65 due to unfinished request in component <core> module <queue> This seems not very bad: every user is still accepted via LDAP But in real the message is different: Thu Nov 3 00:59:25 2022 : Error: Received conflicting packet from client nas port 40634 - ID: 90 due to unfinished request in module ldap. Giving up on old request. Thu Nov 3 00:59:25 2022 : WARNING: (338542) WARNING: Module rlm_ldap became unblocked Thu Nov 3 00:59:25 2022 : Auth: (338542) Invalid user: [user024] (from client nas port 0) We think, we have a timing issue with our LDAP. But why is the log message so different? Best regards Norbert --

2 2

About Async Process
by Imdad Hasan 02 Nov '22

02 Nov '22

Hi All, Does the freeradius perl module supports *async* processing?

2 1

Windows 10 EAP-TLS w/ smartcard
by BuzzSaw Code 02 Nov '22

02 Nov '22

Working with a small network that has Linux, macOS, and Windows systems. - FreeRADIUS on RHEL8 servers in FIPS mode using the most recent RPM version provided by RedHat (3.0.20-12) - All systems have a system certificate deployed from an internal CA that is used for wired or wireless EAP-TLS/802.1x that works. - Some users now have smartcards that they want to incorporate. Smartcards are issued by external CA but both FreeRADIUS and clients have the root CAs and intermediate CAs installed required for them. - Smartcards work fine on Linux and macOS systems for EAP-TLS wired or wireless - Smartcards work on the Windows systems for web browsing/email/other applications that require them. - Smartcards fail weirdly on Windows 10 (22H2) when used with EAP-TLS with this error in the EapMethods-RasTls event logs: "Authentication failed for EAP method type 13. The error was 0x80090331." That error code is supposedly "The client and server cannot communicate, because they do not possess a common algorithm." Wireshark packet captures of the EAP conversation show the client sending its list of ciphers it supports in the Client-Hello, and then the Server-Hello coming back using one of those ciphers. But the Windows 10 host stops responding and simply says it could not connect when using the smartcard. The same host works fine when using the computer certificate and the cipher exchange looks the same in that case. - Old Windows builds (Windows 8.1for example) can connect to wireless or wired using the same smartcard without issues. - If we completely disable FIPS on the FreeRADIUS server, the Windows 10 clients can suddenly connect, despite the fact that the same ciphers appear to be selected in the EAP ClientHello/ServerHello handshake. I'm posting here in hopes that someone has suggestions on how we can debug this on the Windows side - we've run through the EventViewer logs and done netsh tracing but it never tells us exactly what cipher it thinks it can't match or any specific enough information to take action on. We would be convinced this is a certificate/trust issue if it were not for the ability to turn off FIPS on the server to make it work. Has anyone debugged something like this on Windows that could offer some tips on getting more information from the Windows system on what exactly it is seeing as a mismatch ?

1 0