- Freeradius-Users - lists.freeradius.org

Getting ISO 8601 timestamp via rlm_linelog
by Coy Hile 07 Nov '22

07 Nov '22

Good afternoon, I’ve configured the linelog module to log when users get access to devices and what access level they are granted. eg: Access-Accept = ‘{Time: %T, . . . }’ Is there a way to get an ISO-8601 timestamp? Our telemetry/log management team would prefer that they don’t need to configure a custom timestamp handler in our log aggregation tool thanks, -- Coy Hile coy.hile(a)coyhile.com

2 1

Ignoring Duplicate packet perl module error
by Imdad Hasan 07 Nov '22

07 Nov '22

Hi All, *Ignoring duplicate packet from client 192.168.56.1 port 51091 - ID: 52 due to unfinished request in component authorize module perl* - Getting this error when test with 1k Auth requests with the *perl module* only.. no other load and complexity in perl module, just accepting all requests with " return RLM_MODULE_OK; ".. How can I avoid this error?

2 1

Difference between Received conflicting packet and Ignoring duplicate packet
by norbert.kunth＠now-it.de 03 Nov '22

03 Nov '22

Hi Freeradius-Users, we recently updated from 2.1.1 to 3.0.25 (we use still 3.0.25 because it is build in our SLES distribution). Freeradius uses LDAP to check users. If many users login at a time we see some error messages. To track this down we installed an internal test system that can send a lot of requests to the radius server (with radtest). We do see some problems, but the messages (and the behavior) are not the same. If we fire 60 requests in a short time from the test system to the servers, the server loggs: Thu Nov 3 13:35:11 2022 : Error: (159) Ignoring duplicate packet from client test port 46673 - ID: 65 due to unfinished request in component <core> module <queue> This seems not very bad: every user is still accepted via LDAP But in real the message is different: Thu Nov 3 00:59:25 2022 : Error: Received conflicting packet from client nas port 40634 - ID: 90 due to unfinished request in module ldap. Giving up on old request. Thu Nov 3 00:59:25 2022 : WARNING: (338542) WARNING: Module rlm_ldap became unblocked Thu Nov 3 00:59:25 2022 : Auth: (338542) Invalid user: [user024] (from client nas port 0) We think, we have a timing issue with our LDAP. But why is the log message so different? Best regards Norbert --

2 2

About Async Process
by Imdad Hasan 02 Nov '22

02 Nov '22

Hi All, Does the freeradius perl module supports *async* processing?

2 1

Windows 10 EAP-TLS w/ smartcard
by BuzzSaw Code 02 Nov '22

02 Nov '22

Working with a small network that has Linux, macOS, and Windows systems. - FreeRADIUS on RHEL8 servers in FIPS mode using the most recent RPM version provided by RedHat (3.0.20-12) - All systems have a system certificate deployed from an internal CA that is used for wired or wireless EAP-TLS/802.1x that works. - Some users now have smartcards that they want to incorporate. Smartcards are issued by external CA but both FreeRADIUS and clients have the root CAs and intermediate CAs installed required for them. - Smartcards work fine on Linux and macOS systems for EAP-TLS wired or wireless - Smartcards work on the Windows systems for web browsing/email/other applications that require them. - Smartcards fail weirdly on Windows 10 (22H2) when used with EAP-TLS with this error in the EapMethods-RasTls event logs: "Authentication failed for EAP method type 13. The error was 0x80090331." That error code is supposedly "The client and server cannot communicate, because they do not possess a common algorithm." Wireshark packet captures of the EAP conversation show the client sending its list of ciphers it supports in the Client-Hello, and then the Server-Hello coming back using one of those ciphers. But the Windows 10 host stops responding and simply says it could not connect when using the smartcard. The same host works fine when using the computer certificate and the cipher exchange looks the same in that case. - Old Windows builds (Windows 8.1for example) can connect to wireless or wired using the same smartcard without issues. - If we completely disable FIPS on the FreeRADIUS server, the Windows 10 clients can suddenly connect, despite the fact that the same ciphers appear to be selected in the EAP ClientHello/ServerHello handshake. I'm posting here in hopes that someone has suggestions on how we can debug this on the Windows side - we've run through the EventViewer logs and done netsh tracing but it never tells us exactly what cipher it thinks it can't match or any specific enough information to take action on. We would be convinced this is a certificate/trust issue if it were not for the ability to turn off FIPS on the server to make it work. Has anyone debugged something like this on Windows that could offer some tips on getting more information from the Windows system on what exactly it is seeing as a mismatch ?

1 0

OpenSSL issue released tomorrow
by Alan DeKok 31 Oct '22

31 Oct '22

OpenSSL is releasing a critical vulnerability tomorrow. https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html We suggest upgrading OpenSSL immediately when a new package is released. There should not be a need to upgrade or change FreeRADIUS. We'll know more tomorrow. Alan DeKok.

1 0

Network RADIUS packages and LDAP/SASL
by Adam Bishop 26 Oct '22

26 Oct '22

I'm working on rebuilding our internal RADIUS systems, using the Network RADIUS packages rather than our own. Our LDAP configuration uses SASL to authenticate to 389ds via a UNIX socket - works OK on RHEL 7. The RHEL 8 hosts though (with the LTB packages) fail with: ... rlm_ldap: libldap vendor: OpenLDAP, version: 20459 Configuration item 'sasl.mech' not supported. Linked libldap does not provide ldap_sasl_interactive_bind function ... As far as I can tell, the ltb LDAP does export that symbol: # nm -gD /usr/local/openldap/lib64/libldap.so | grep ldap_sasl_interactive_bind 0000000000017760 T ldap_sasl_interactive_bind 00000000000178c0 T ldap_sasl_interactive_bind_s So I'm guessing that the ltb libldap isn't being linked at runtime? If that's the case, is there a way to configure FreeRADIUS to use the ltb versions, or do I need to start overriding LD_PRELOAD_PATH/hand edit ld.conf? I'm not 100% sure how it would be linking at the moment, as I don't see the ltb so's in the output of ldconfig. Or am I just completely wrong and the ltb packages don't support SASL :) Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

2 2

Remove dots from client-mac-address
by Steven Walters 25 Oct '22

25 Oct '22

Hi I am using the below loop to extract client-mac-address from Cisco AVP and write it to the Telkom-CPE attribute. The format of the client-mac-address is "340a.3394.7291". Is there a way to remove the dots from the mac address like "340A33947291" before writing it the attribute? foreach Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /^client-mac-address=(.+)/ ) { update request{ Telkom-CPE := "%{1}" } } } Regards Steven

2 1

Re: Freeradius-Users Digest, Vol 210, Issue 25
by Michael A Hawkins 24 Oct '22

24 Oct '22

Alan, sorry about that repeated question about TACACS+. Missed that other email, my bad. /Mike On Mon, 2022-10-24 at 12:00 +0000, freeradius-users- request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. FreeRadius support for TACACS+ (Michael A Hawkins) > 2. Re: FreeRadius support for TACACS+ (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 23 Oct 2022 16:04:24 -0400 > From: Michael A Hawkins <mhawkins.consultant(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: FreeRadius support for TACACS+ > Message-ID: > <5903add9102edd4cb0129d0fc63b7bf287b7a887.camel(a)gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hello all, > > I've been searching the docs to see if TACACS+ is supported by > FreeRadius out-of-the-box. I've read a lot of the doc. It appears > that > TACACS+ is not supported and there is no built in module for it. > > Is that true? > Are there any third party TACACS+ modules that FreeRadius suggests I > look at? > > Many thanks, > > /Mike > > > ------------------------------ > > Message: 2 > Date: Sun, 23 Oct 2022 16:44:15 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius support for TACACS+ > Message-ID: > <E56D2DB0-98C1-4736-A0EB-8DEC8CE3B980(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Oct 23, 2022, at 4:04 PM, Michael A Hawkins > <mhawkins.consultant(a)gmail.com> wrote: > > I've been searching the docs to see if TACACS+ is supported by > > FreeRadius out-of-the-box. I've read a lot of the doc. It appears > > that > > TACACS+ is not supported and there is no built in module for it. > > > > Is that true? > > Already asked and answered. > > Please read the messages on this list. > > There are no super-secret features which get disclosed only when > people ask "pretty please". All of the documentation is in the open, > as is all of the source. > > Alan DeKok. > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ------------------------------ > > End of Freeradius-Users Digest, Vol 210, Issue 25 > *************************************************

1 0

FreeRadius support for TACACS+
by Michael A Hawkins 23 Oct '22

23 Oct '22

Hello all, I've been searching the docs to see if TACACS+ is supported by FreeRadius out-of-the-box. I've read a lot of the doc. It appears that TACACS+ is not supported and there is no built in module for it. Is that true? Are there any third party TACACS+ modules that FreeRadius suggests I look at? Many thanks, /Mike

2 1