- Freeradius-Users - lists.freeradius.org

Cannot increase open file descriptors above 1024
by Ibrahemoo Ghost 18 Nov '22

18 Nov '22

I use FreeRADIUS Version 3.0.20 as both proxy and (auth/acct) server. I have more than 80 realms with over 180 clients connected. Every one of them is redirecting to a different site file with separate sql module to a seperate database in the same db server. My problem is with this large amount of databases and tables i hit the fixed limit of 1024 open file descriptors and the radius.log file shows: mysql error: can't create unix socket (24) I double checked with: ls /proc/${freeradius_pid}/fd | wc -l it prints 1024 that's why I am sure its problem with the open files limit I tried to increase it manually but with no luck at all. Whenever I increase it the freeradius server stops working. So is there something I can do to increase the file descriptors limit ? Or am I doing something wrong?

4 11

Use “fast reconnect” to speed up repeat authentication requests
by uj2.hahn＠posteo.de 18 Nov '22

18 Nov '22

Hi, Alan and team! In your article https://networkradius.com/articles/2020/12/10/design-blueprint-for-universi… you describe the fast reconnect approach for universities. I was going to give it try but haven't found any docs describing how to do that. Or is this a solution you offer on a commercial base? Thanks for your help Regards Uwe

2 1

MSCHAP No logon servers are currently available (again, but solved)
by uj2.hahn＠posteo.de 16 Nov '22

16 Nov '22

Hi, all! I refer to this older thread with same subject: https://lists.freeradius.org/pipermail/freeradius-users/2021-August/100519.… I run into a similar issue and like to share the way I solved it: I implemented a Freeradius/AD solution some years ago in a school. (Win10 clients, MS server/AD in Azure cloud) This had been working fine all the time, but after the school installed some Microsoft updates to their clients Freeradius stopped working. No authorization was possible. I debugged it down to above error message when I run ntlm_auth manually (saw same message in FR debug log). Somehow the communication between Ubuntu based FR server and Windows server/AD was broken now. My guess was the the updated Windows environment needs an improved communication protocol with higher security level. So I upgraded Ubuntu to version 22.04 LTS to get a more recent Samba version (4.15.9). But this didn't help. I modified smb.conf as described in https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_D… , but this didn't help neither. Also a reboot of the FR Ubuntu server didn't help. But then I rejoined FR server to domain: net join -U admin (will prompt for password). The FR server has been part of the domain for years. But somehow this got broken. Not sure which of the actions above was root cause, but the "net join" command was finally the key. So don't forget it even though think you did it earlier already . Just to help others in case they run in same issue. Regards Uwe

2 1

Radutmp is empty
by Sébastien 65 16 Nov '22

16 Nov '22

Hi there, The radutmp file is still empty. The radwho command does not return any user... The radlast command is empty... I don't use MySQL. Here is the configuration I use for radutmp : /etc/freeradius/3.0/sites-available/default authorize { ... files ... accounting { ... radutmp ... session { ... radutmp ... I use NTRadPing to perform tests, the Radius server accepts my Authentication request without error... How to activate the logs ? Thanks

2 5

Use rest module differently for each site
by Matthew McTague 15 Nov '22

15 Nov '22

Hi there, I'm using FreeRADIUS 3.2.1 on AlmaLinux 8.6, from the NetworkRADIUS repo. I want to use the rest module for multiple sites, default and dhcp. I ideally want to change uri and data, which will contain different information for a BNG's RADIUS requests vs a DHCP relay sending DHCP requests to FreeRADIUS. Is there a way to duplicate the rest module, or configure additional sections with custom naming? I realise I could probably use a custom dictionary attribute, but I'd rather avoid this if possible. I'm confident there will be a better way to achieve this. Warm Regards, .[cid:vg-email_e752d47f-182a-48d0-8808-3796b2df8d4a.png]<https://www.vetta.nz> .[cid:058_line_9bae9502-1e3a-48a3-ba5e-34ed9cd44185.png] Matthew McTague Head of Infrastructure [cid:bea-finalist-email_2ddba0ed-b9bb-4ab9-b680-84aa7f54077f.png] [cid:bea-winner-banner-email_590096c3-05a6-4c98-b071-1c4d748c3534.png] . D +64 3 222 6013<tel:+64%203%20222%206013> | P +64 3 684 5770 E matthew.mctague(a)vetta.nz<mailto:matthew.mctague@vetta.nz> | W www.vetta.nz<https://www.vetta.nz> Vetta Group Ltd and its subsidiaries accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company, its subsidiaries, partners or contractors. .

2 2

FreeRadius and Circuit-ID
by filip.m.nikolic＠roamingnetworks.rs 14 Nov '22

14 Nov '22

Dear, All We are playing around with a scenario for subscriber attachment based on circuit-id and remote-id and ignoring PAP/CHAP. Idea is that you do not need to authenticate a user, just grant him access based on the fixed port in the access node. We struggle in the right configuration, so we are wondering if someone play with that and if someone can help us? Thanks in advance, <http://www.roamingnetworks.com/> <https://www.facebook.com/roamingnetworks/> <https://www.linkedin.com/company/roaming-networks/> <https://www.instagram.com/roaming_networks/> Filip Nikolić LEAD ENGINEER FOR TRANSPORT NETWORK DEVELOPMENT NOC Back Office <tel:+381648907383> +381648907383 <mailto:filip.m.nikolic@roamingnetworks.rs> filip.m.nikolic(a)roamingnetworks.rs <https://goo.gl/maps/g9UJK4ZZtfKtWzct8> OBLAKOVSKA 51, 11000 BELGRADE, SERBIA <http://www.roamingnetworks.com/> www.roamingnetworks.com Odricanje od odgovornosti: Ova elektronska poruka i njeni prilozi namenjeni su osobama na koje je adresirana i može biti poverljive prirode. Ako ova elektronska poruka nije upućena Vama, molimo Vas da nas odmah o tome obavestite a predmetnu elektronsku poruku i sve njene eventualne priloge izbrišete sa svog računara. Ovu elektronsku poruku nemojte kopirati niti njen sadržaj otkrivati trećim licima. Kršenje pravila o poverljivosti informacija zakonski je kažnjivo. Disclaimer: This email and any attachments to it are intended solely for the use of the individual to whom it is addressed and its content may be confidential. If you are not the intended recipient of this email, please contact us immediately. You must neither take any action based upon its contents, nor copy or show it to anyone. Any violation of confidentiality is punishable by law.

2 3

How to investigate failed Android authentication (EAP-TLS) on WiFi reconnection
by Dario Barbon 11 Nov '22

11 Nov '22

Hello, I've a Linux Ubuntu 18.04 server with Freeradius 3.0.16 on x86_64 virtual machine. Freeradius is used only to provide Android devices authentication (EAP-TLS); the authentication works. The WiFi network was installed by my client: it is a geographical distributed WiFi with a controller and 10 access points. Sometimes, when one smartphone moves out of WiFi network area and then come back, the connection to WiFi fails. I can reconnect only after a WiFi off / on from Android network settings. I want to investigate this behaviour; I've found these recurring errors inside last month log files: ERROR: rlm_eap (EAP): No EAP session matching state 0x3d4e1475385119b8 ERROR: TLS Alert write:fatal:protocol version ERROR: TLS Alert read : fatal:unknown CA ERROR: (658258) eap_tls: ERROR: TLS Alert read : fatal : internal error ERROR: (644636) eap_tls: ERROR: TLS Alert read : fatal:bad certificate ERROR: (639156) eap: ERROR: rlm_eap (EAP): Aborting! More than 50 roundtrips made in session with state 0xfd858905cfb18490 ERROR: (367333) eap_tls: ERROR: TLS Alert write:fatal:protocol version Could you please suggest a debug checklist / debug process to help me understand why this behaviour happen? Thanks. Dario Barbon

3 3

How I can enable debug logs for home server status check
by work vlpl 09 Nov '22

09 Nov '22

Hello, I am not sure if this is a potential issue or not so let me first ask how the home server if it is marked as dead can become alive? I have a configuration like this home_server <>__1812 { type = auth ipaddr = ip port = 1812 secret = <> response_window = 20 zombie_period = 40 # revive_interval = 120 status_check = request username = ping password = test check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 max_outstanding = 65536 } I've tried to uncomment or comment revive_interval but in both cases, I don't see in debug log (-fxxl) any messages about the home server status check. Also in my pool of home servers I have only 1 server, I know this is a weird config, but this is all that I have. In debug logs, I see a message like this (3600) ERROR: Failed to find live home server: Cancelling proxy (3600) Clearing existing &reply: attributes (3600) Found Post-Proxy-Type Fail-Authentication How I can enable debug messages about home server status checks? (I've tried to use more x i.e. -fxxxxx..., not helping) And manual request with radclient and credentials ping/test returns Access-Reject. So I expect that server should be marked as alive. Best regards, Vladimir

3 6

change of CA
by Burn Zero 09 Nov '22

09 Nov '22

Hi, Currently we have laptops(windows 10) which authenticate via FreeRADIUS using EAP-TLS. Now, I am going to change the CA and the laptops will get the new cert from the new CA(which will be used for authentication) and the old cert will be deleted. I have prepared to accept both old and new CA certs in the FreeRADIUS. We also have cache enabled in the eap module - Will this affect the connectivity of laptops since the cached attributes contain the old cert details from the old CA? Thank you.

2 1

3GPP Rel 8 support
by Bernard Murphy 08 Nov '22

08 Nov '22

Could anyone confirm whether they have successfully deployed freeradius for use with 3GPP Rel 8 dictionaries ? I have a need to deploy a 3GPP Rel 8 compatible radius server for use as authentication in a mobile network operators 4G private APN network configuration. I am trying to understand if anyone else has achieved this successfully previously. Regards Bernie This email transmission and any attachments to it are strictly confidential and are intended solely for the person or organisation to whom it is addressed. Its contents may contain legal professional or other privileged information. If you are not the intended recipient, please notify us immediately and delete it, without retaining it, copying it, disclosing its contents to anyone or acting upon it. You must ensure that you have appropriate virus protection before you open or detach any documents from this transmission. We accept no responsibility for viruses. We may monitor replies to emails for operational or lawful business reasons. The views or opinions expressed in this email are the author's own and may not, unless expressly stated to the contrary, reflect the views or opinions of Wales & West Utilities Limited, its affiliates or subsidiaries. Unless expressly stated to the contrary, neither Wales & West Utilities Limited, its affiliates or subsidiaries, their respective directors, officers or employees make any representation about, or accept any liability for, the accuracy or completeness of such views or opinions. Wales & West Utilities Limited Registered office: Wales & West House, Spooner Close, Celtic Springs, Coedkernew, NEWPORT NP10 8FZ Registered in England and Wales No 5046791

2 1