Hi, I have a freeradius server running v3.0.16 which is performing WPA2 Enterprise Authentication and VLAN assignment for a multi-tenant WiFi system. The latest windows 11 update appears to have forced the use of TLS1.3 and clients will no longer authenticate without a registry change back to TLS1.2. I don't have in-depth knowledge of Freeradius; I can install, configure and work with config files and debugs, so was just asking for a little advice on the best way for me to enable TLS1.3? Do I need to upgrade? Will there be any configuration changes required? Obviously we still need to support lower TLS versions as well. Internet searches have given me conflicting information, and I can't find when TLS 1.3 support started. Thanks Paul Bone Network Consultant/Engineer
On 17/01/2023 12:43, Paul Bone wrote:
I don't have in-depth knowledge of Freeradius; I can install, configure and work with config files and debugs, so was just asking for a little advice on the best way for me to enable TLS1.3?
Do I need to upgrade? Will there be any configuration changes required? Obviously we still need to support lower TLS versions as well.
Yes, you need the latest release - either 3.0.26 or (recommended) 3.2.1. The existing config should continue to work both both, but as always keep backups and test first. -- Matthew
Thanks Matthew. Paul Bone Director & Network Consultant 07803 570805 ________________________________ From: Freeradius-Users <freeradius-users-bounces+paul.bone=probitas-solutions.tech@lists.freeradius.org> on behalf of Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> Sent: Tuesday, January 17, 2023 1:03:19 PM To: freeradius-users@lists.freeradius.org <freeradius-users@lists.freeradius.org> Cc: Matthew Newton <mcn@freeradius.org> Subject: Re: TLS v1.3 On 17/01/2023 12:43, Paul Bone wrote:
I don't have in-depth knowledge of Freeradius; I can install, configure and work with config files and debugs, so was just asking for a little advice on the best way for me to enable TLS1.3?
Do I need to upgrade? Will there be any configuration changes required? Obviously we still need to support lower TLS versions as well.
Yes, you need the latest release - either 3.0.26 or (recommended) 3.2.1. The existing config should continue to work both both, but as always keep backups and test first. -- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I seem to be unable to find any instructions on how to upgrade freeradius? Paul Bone Network Consultant/Engineer -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+paul.bone=probitas-solutions.tech@lists.freeradius.org> On Behalf Of Matthew Newton via Freeradius-Users Sent: 17 January 2023 13:03 To: freeradius-users@lists.freeradius.org Cc: Matthew Newton <mcn@freeradius.org> Subject: Re: TLS v1.3 On 17/01/2023 12:43, Paul Bone wrote:
I don't have in-depth knowledge of Freeradius; I can install, configure and work with config files and debugs, so was just asking for a little advice on the best way for me to enable TLS1.3?
Do I need to upgrade? Will there be any configuration changes required? Obviously we still need to support lower TLS versions as well.
Yes, you need the latest release - either 3.0.26 or (recommended) 3.2.1. The existing config should continue to work both both, but as always keep backups and test first. -- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 17/01/2023 14:33, Paul Bone wrote:
I seem to be unable to find any instructions on how to upgrade freeradius?
Depends on your system and how it was initially installed. Network RADIUS provides packages at http://packages.networkradius.com/ That is the easiest way to get the most up-to-date versions. Many OS packages are years out of date. -- Matthew
Install a new package. It won't over-write your existing configuration.
This I have done but freeradius is no longer loading with the following error: root@ip-xxxxxxx:~# freeradius -X FreeRADIUS Version 3.2.1 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /etc/freeradius/radiusd.conf Unable to open file "/etc/freeradius/radiusd.conf": No such file or directory Errors reading or parsing /etc/freeradius/radiusd.conf My config file is located in "/etc/freeradius/3.0/radiusd.conf", and in fact there are no other folders directly under "/etc/freeradius/" Paul Bone Network Consultant/Engineer
On Jan 17, 2023, at 9:55 AM, Paul Bone <paul.bone@probitas-solutions.tech> wrote:
Install a new package. It won't over-write your existing configuration.
This I have done but freeradius is no longer loading with the following error:
root@ip-xxxxxxx:~# freeradius -X FreeRADIUS Version 3.2.1 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /etc/freeradius/radiusd.conf Unable to open file "/etc/freeradius/radiusd.conf": No such file or directory Errors reading or parsing /etc/freeradius/radiusd.conf
My config file is located in "/etc/freeradius/3.0/radiusd.conf", and in fact there are no other folders directly under "/etc/freeradius/"
Two things: 1) if you mix and match packages from different sources, they may put configuration files into different places. This is how packaging systems work 2) the server configuration is just directories and files on the disk. You can use normal file management tools to create, copy, delete, or link files. Alan DeKok.
I moved all files and folders from /etc/freeradius/3.0/ to /etc/freeradius/ and the service is now running. I'm afraid, I really cannot remember how it was originally installed, I use Linux as and when required, so can get by, but spend most of my time working with network equipment. Thanks for all the help, I have done this on a cloned test server - will do some testing and then hopefully be able to upgrade the production server. Paul Bone Network Consultant/Engineer
On 17.01.2023 15:55, Paul Bone wrote:
Install a new package. It won't over-write your existing configuration.
This I have done but freeradius is no longer loading with the following error:
root@ip-xxxxxxx:~# freeradius -X FreeRADIUS Version 3.2.1 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /etc/freeradius/radiusd.conf Unable to open file "/etc/freeradius/radiusd.conf": No such file or directory Errors reading or parsing /etc/freeradius/radiusd.conf
My config file is located in "/etc/freeradius/3.0/radiusd.conf", and in fact there are no other folders directly under "/etc/freeradius/"
Paul Bone Network Consultant/Engineer
Did you install from source, and is your distro Debian? Because Debian does some customization with their freeradius package.... Dag B
participants (4)
-
Alan DeKok -
Dag B -
Matthew Newton -
Paul Bone