On Jun 21, 2024, at 9:30 AM, <dominic.stalder@unibe.ch> <dominic.stalder@unibe.ch> wrote:

Thanks, would you let me know, when I need to take actions or give any feedback?

For now, try the latest changes and see if that helps. Alan DeKok.

Hi Alan As already written, I updated to FreeRADIUS 3.2.5 on Friday evening and was now able to do some tests in our lab environment. I think there are still some "glitches" and I still have some comprehension questions. About the environment: - our FreeRADIUS servers act only as RADIUS proxy servers - we use them primarely for our eduroam infrastructure and some other / smaller SSIDs or other RADIUS based infrastructure *** A) Starting point: I restarted the FreeRADIUS service at Jun 23 2024 16:16:07 CEST:

This looks okay, most of the values remain 0 because there are no active endpoints around Q1: none the less, could you please allow me the questions, what could cause the FreeRADIUS-Total-Access-Requests to increment to 2? I had a packet capture running in the background and did not see any packet on dst port 1812.

cat <<EOF | radclient -x localhost:18121 status adminsecret FreeRADIUS-Statistics-Type = ALL Message-Authenticator=0x00 EOF Received Access-Accept Id 17 from 127.0.0.1:18121 to 127.0.0.1:40029 length 596 FreeRADIUS-Total-Access-Requests = 2 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Auth-Conflicts = 0 FreeRADIUS-Total-Accounting-Requests = 0 FreeRADIUS-Total-Accounting-Responses = 0 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Acct-Conflicts = 0 FreeRADIUS-Total-Proxy-Access-Requests = 0 FreeRADIUS-Total-Proxy-Access-Accepts = 0 FreeRADIUS-Total-Proxy-Access-Rejects = 0 FreeRADIUS-Total-Proxy-Access-Challenges = 0 FreeRADIUS-Total-Proxy-Auth-Responses = 0 FreeRADIUS-Total-Proxy-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Unknown-Types = 0 FreeRADIUS-Total-Proxy-Accounting-Requests = 0 FreeRADIUS-Total-Proxy-Accounting-Responses = 0 FreeRADIUS-Total-Proxy-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Unknown-Types = 0 FreeRADIUS-Stats-Start-Time = "Jun 23 2024 16:16:07 CEST" FreeRADIUS-Stats-HUP-Time = "Jun 23 2024 16:16:07 CEST" FreeRADIUS-Queue-Len-Internal = 0 FreeRADIUS-Queue-Len-Proxy = 0 FreeRADIUS-Queue-Len-Auth = 0 FreeRADIUS-Queue-Len-Acct = 0 FreeRADIUS-Queue-Len-Detail = 0 FreeRADIUS-Queue-PPS-In = 0 FreeRADIUS-Queue-PPS-Out = 0 FreeRADIUS-Stats-Threads-Active = 1 FreeRADIUS-Stats-Threads-Total = 5 FreeRADIUS-Stats-Threads-Max = 32 *** B) Test (with correct username / password):

FreeRADIUS-Total-Access-Requests increases pretty fast, that looks okay I get 1 FreeRADIUS-Total-Access-Accepts (= okay) Q2: in your last response, you wrote "The numbers for requests and responses should be the same" --> is this regarding "FreeRADIUS-Total-Access-Challenges = 10" compared to "FreeRADIUS-Total-Auth-Responses = 11" or did you mean "FreeRADIUS-Total-Proxy-Access-Challenges =3" compared to "FreeRADIUS-Total-Proxy-Auth-Responses =3", or both? "FreeRADIUS-Total-Proxy-Access-Requests = 3" and "FreeRADIUS-Total-Proxy-Access-Challenges = 3" and "FreeRADIUS-Total-Proxy-Auth-Responses = 3" are equal, that looks okay Q3: "FreeRADIUS-Total-Proxy-Access-Accepts = 0" is zero, I think this should have been increment by 1, right? Q4: Are Proxy statistics included in Total statistics as well (let's say a "FreeRADIUS-Total-Proxy-Access-Request" is added to "FreeRADIUS-Total-Access-Requests" as well , or are they counted completely separate?

Received Access-Accept Id 107 from 127.0.0.1:18121 to 127.0.0.1:56264 length 596 FreeRADIUS-Total-Access-Requests = 159 FreeRADIUS-Total-Access-Accepts = 1 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 10 FreeRADIUS-Total-Auth-Responses = 11 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Auth-Conflicts = 0 FreeRADIUS-Total-Accounting-Requests = 0 FreeRADIUS-Total-Accounting-Responses = 0 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Acct-Conflicts = 0 FreeRADIUS-Total-Proxy-Access-Requests = 3 FreeRADIUS-Total-Proxy-Access-Accepts = 0 FreeRADIUS-Total-Proxy-Access-Rejects = 0 FreeRADIUS-Total-Proxy-Access-Challenges = 3 FreeRADIUS-Total-Proxy-Auth-Responses = 3 FreeRADIUS-Total-Proxy-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Unknown-Types = 0 FreeRADIUS-Total-Proxy-Accounting-Requests = 0 FreeRADIUS-Total-Proxy-Accounting-Responses = 0 FreeRADIUS-Total-Proxy-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Unknown-Types = 0 FreeRADIUS-Stats-Start-Time = "Jun 23 2024 16:16:07 CEST" FreeRADIUS-Stats-HUP-Time = "Jun 23 2024 16:16:07 CEST" FreeRADIUS-Queue-Len-Internal = 0 FreeRADIUS-Queue-Len-Proxy = 0 FreeRADIUS-Queue-Len-Auth = 0 FreeRADIUS-Queue-Len-Acct = 0 FreeRADIUS-Queue-Len-Detail = 0 FreeRADIUS-Queue-PPS-In = 0 FreeRADIUS-Queue-PPS-Out = 0 FreeRADIUS-Stats-Threads-Active = 1 FreeRADIUS-Stats-Threads-Total = 5 FreeRADIUS-Stats-Threads-Max = 32 *** C) Test (with incorrect username / password): Restarted the FreeRADIUS service beforehand...

FreeRADIUS-Total-Access-Requests increases pretty fast, that looks okay again I get 1 FreeRADIUS-Total-Access-Reject (= okay) Q5: still "FreeRADIUS-Total-Access-Challenges = 8" and "FreeRADIUS-Total-Auth-Responses = 9" are not identical "FreeRADIUS-Total-Proxy-Access-Requests = 1" and "FreeRADIUS-Total-Proxy-Access-Challenges = 1" and "FreeRADIUS-Total-Proxy-Auth-Responses = 1" are equal again, that looks okay Q6: "FreeRADIUS-Total-Proxy-Access-Rejects = 0" is zero, I think this should have been increment by 1, right?

Received Access-Accept Id 170 from 127.0.0.1:18121 to 127.0.0.1:45081 length 596 FreeRADIUS-Total-Access-Requests = 21 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 1 FreeRADIUS-Total-Access-Challenges = 8 FreeRADIUS-Total-Auth-Responses = 9 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Auth-Conflicts = 0 FreeRADIUS-Total-Accounting-Requests = 0 FreeRADIUS-Total-Accounting-Responses = 0 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Acct-Conflicts = 0 FreeRADIUS-Total-Proxy-Access-Requests = 1 FreeRADIUS-Total-Proxy-Access-Accepts = 0 FreeRADIUS-Total-Proxy-Access-Rejects = 0 FreeRADIUS-Total-Proxy-Access-Challenges = 1 FreeRADIUS-Total-Proxy-Auth-Responses = 1 FreeRADIUS-Total-Proxy-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Unknown-Types = 0 FreeRADIUS-Total-Proxy-Accounting-Requests = 0 FreeRADIUS-Total-Proxy-Accounting-Responses = 0 FreeRADIUS-Total-Proxy-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Unknown-Types = 0 FreeRADIUS-Stats-Start-Time = "Jun 23 2024 16:33:23 CEST" FreeRADIUS-Stats-HUP-Time = "Jun 23 2024 16:33:23 CEST" FreeRADIUS-Queue-Len-Internal = 0 FreeRADIUS-Queue-Len-Proxy = 0 FreeRADIUS-Queue-Len-Auth = 0 FreeRADIUS-Queue-Len-Acct = 0 FreeRADIUS-Queue-Len-Detail = 0 FreeRADIUS-Queue-PPS-In = 0 FreeRADIUS-Queue-PPS-Out = 0 FreeRADIUS-Stats-Threads-Active = 1 FreeRADIUS-Stats-Threads-Total = 5 FreeRADIUS-Stats-Threads-Max = 32 *** Thanks in advance for any help on this topic; I know you wrote that the statistics are not always perfect, but I would like to build a monitoring on some parts of those values and if they could be corrected, that would be cool. Regards Dominic

Good evening Alan Perfect, thanks a lot. I am going to rebuild the sources and check the stats again, but based on your feedback, I think it will be "good enough" to monitor those stats as well. Thankd and best regards Dominic Am 23.06.24, 19:12 schrieb "Freeradius-Users im Auftrag von Alan DeKok" <freeradius-users-bounces+dominic.stalder=unibe.ch@lists.freeradius.org <mailto:unibe.ch@lists.freeradius.org> im Auftrag von aland@deployingradius.com <mailto:aland@deployingradius.com>>: On Jun 23, 2024, at 10:59 AM, dominic.stalder@unibe.ch <mailto:dominic.stalder@unibe.ch> wrote:

As already written, I updated to FreeRADIUS 3.2.5 on Friday evening and was now able to do some tests in our lab environment. I think there are still some "glitches" and I still have some comprehension questions.

OK. The main reason for the counters to be imperfect is that it takes time for the server to process packets. So if you query a running server, you might get more "requests" than "responses". But the numbers should be close. Also, if the server stops receiving packets, and cleans up its internal de-duplication cache, the number of requests should match the number of responses. That being said, some simple tests show that the stats are off. :( I've pushed some patches which: a) don't count Status-Server as Access-Request b) in some cases other packets were double-counted as Access-Request, so those numbers were too high c) it now updates the response statistics more quickly if it can. So the numbers should be a lot better.

Thanks in advance for any help on this topic; I know you wrote that the statistics are not always perfect, but I would like to build a monitoring on some parts of those values and if they could be corrected, that would be cool.

Yup. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html>

On Jun 24, 2024, at 5:23 AM, dominic.stalder@unibe.ch wrote:

Just a short feedback after the first few tests: overall it looks much better and the corresponding statistics seem to be aligned now; thanks a lot for the quick fixes / patches!

- only the following two counters remain zero all the time, maybe there could be a little fix applied as well? __

FreeRADIUS-Total-Proxy-Access-Accepts = 0 FreeRADIUS-Total-Proxy-Access-Rejects = 0

They're non-zero for me when I test proxying. I'll take a look. Alan DeKok.

On Jun 24, 2024, at 3:58 PM, <dominic.stalder@unibe.ch> <dominic.stalder@unibe.ch> wrote:

Just to confirm or let you know; I do get " FreeRADIUS-Total-Proxy-Access-Accepts" and " FreeRADIUS-Total-Proxy-Access-Rejects" now / as well, BUT compared to "FreeRADIUS-Total-Proxy-Access-Requests" and "FreeRADIUS-Total-Proxy-Auth-Responses" it is apparently pretty low:

The counters are incremented on packet retransmits, so the number of Access-Requests may be larger than the number of Access-Accepts. But the numbers should generally be relatively close. Alan DeKok.

Not necessarily… If it gets the ‘same’ request before the timeout of the already proxied request it might well not proxy it and wait for the other request to return (or timeout) first. Also not knowing your config it could have caching enabled especially ‘reject’ caching which is often seriously beneficial. (not all devices are sane when you tell them to go away). Alister. From: Freeradius-Users <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org> on behalf of dominic.stalder@unibe.ch <dominic.stalder@unibe.ch> Date: Monday, 24 June 2024 at 21:51 To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Subject: [EXTERNAL] Re: Understanding FreeRADIUS statistics A general question, what is considered as Proxy requests? As I said: our FreeRADIUS server is acting ONLY as proxy server, so if there are more than (let‘s say) 2000 Access Requests, there should be around 2000 proxy requests counted as well? Maybe a special note: our own realms are only sent to our backend servers in phase 2 of PEAP/MS-CHAPv2. Does this not count as proxy request? ________________________________ Von: Freeradius-Users <freeradius-users-bounces+dominic.stalder=unibe.ch@lists.freeradius.org> im Auftrag von Alan DeKok <aland@deployingradius.com> Gesendet: Monday, June 24, 2024 10:21:10 PM An: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Betreff: Re: Understanding FreeRADIUS statistics On Jun 24, 2024, at 3:58 PM, <dominic.stalder@unibe.ch> <dominic.stalder@unibe.ch> wrote:

Just to confirm or let you know; I do get " FreeRADIUS-Total-Proxy-Access-Accepts" and " FreeRADIUS-Total-Proxy-Access-Rejects" now / as well, BUT compared to "FreeRADIUS-Total-Proxy-Access-Requests" and "FreeRADIUS-Total-Proxy-Auth-Responses" it is apparently pretty low:

The counters are incremented on packet retransmits, so the number of Access-Requests may be larger than the number of Access-Accepts. But the numbers should generally be relatively close. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html><http://www.freeradius.org/list/users.html%3chttp:/www.freeradius.org/list/users.html%3e> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing@sky.uk. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD

On Jun 25, 2024, at 8:53 AM, dominic.stalder@unibe.ch wrote:

Thanks a lot, great point; did not know, that we have enabled caching until you mentioned it now! I took over the old FreeRADIUS 3.0 configuration from a former University member and this part was completely "ignored" by me. Just checked the mods-enabled folder and voilà:

/etc/freeradius/mods-enabled/cache_eap

That works, but I suggest using it with care. 99.9% of the time there's no proxy fail-over, so the caching is just extra work. If caching makes a large difference, then the network is unstable enough that it needs fixing.

You see, new to this as well. Can I see cached "authentications" in the logs or can I enable the logging for those (/etc/freeradius/mods-enabled/linelog) somehow?

You'll have to write policies to log the cached packets. But I'd suggest not doing this. Alan DeKok.

On Jun 25, 2024

If I understand you correctly, we should disable the EAP caching completely? As I said, I did not know about it before and I am absolutely willing to keep the configuration as simple as possible, if you recommend that!

Just disable it. I don't think it really helps.

If you recommend to disable it, is the following correct:

1. Delete the symlink /etc/freeradius/mods-enabled/cache_eap

2. Restart the FreeRADIUS service

Yes. Alan DeKk.

Hi Alan and Alister Two days ago I removed the symlink /etc/freeradius/mods-enabled/cache_eap, but today I found the following cache config lines in /etc/freeradius/mods-available/eap: tls-config tls-common { private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.crt ... cache { enable = no lifetime = 12 # hours max_entries = 0 name = "EAP module" persist_dir = "${logdir}/tlscache" } } Should I remove those lines as well or what is the recommended configuration for the tls-config part? Thanks and regards Dominic Am 25.06.24, 16:59 schrieb "Stalder, Dominic (ID)" <dominic.stalder@unibe.ch <mailto:dominic.stalder@unibe.ch>>: Thanks.

Just disable it. I don't think it really helps. Done = disabled.

Am 25.06.24, 15:53 schrieb "Freeradius-Users im Auftrag von Alan DeKok" <freeradius-users-bounces+dominic.stalder=unibe.ch@lists.freeradius.org <mailto:unibe.ch@lists.freeradius.org> <mailto:unibe.ch@lists.freeradius.org <mailto:unibe.ch@lists.freeradius.org>> im Auftrag von aland@deployingradius.com <mailto:aland@deployingradius.com> <mailto:aland@deployingradius.com <mailto:aland@deployingradius.com>>>: On Jun 25, 2024

If I understand you correctly, we should disable the EAP caching completely? As I said, I did not know about it before and I am absolutely willing to keep the configuration as simple as possible, if you recommend that!

Just disable it. I don't think it really helps.

If you recommend to disable it, is the following correct:

1. Delete the symlink /etc/freeradius/mods-enabled/cache_eap

2. Restart the FreeRADIUS service

Yes. Alan DeKk. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <http://www.freeradius.org/list/users.html> <http://www.freeradius.org/list/users.html> <http://www.freeradius.org/list/users.html;>

On Jun 24, 2024, at 4:51 PM, <dominic.stalder@unibe.ch> <dominic.stalder@unibe.ch> wrote:

A general question, what is considered as Proxy requests?

Packets that get sent to a home server. Duplicate requests get counted twice.

As I said: our FreeRADIUS server is acting ONLY as proxy server, so if there are more than (let‘s say) 2000 Access Requests, there should be around 2000 proxy requests counted as well?

Mostly.

Maybe a special note: our own realms are only sent to our backend servers in phase 2 of PEAP/MS-CHAPv2. Does this not count as proxy request?

Again, only packets which get proxied are counted as proxied requests. If you're proxying the inner session, then there will be many more incoming packets than proxied packets. This is because it takes a number of packets to set up there outer TLS tunnel, but the inner MS-CHAP is just one packet. Alan DeKok.