Authentication not working after update

[jerheij]

First of all; thanks for your freeradius container, I've been using it as authentication issue for a while and it has been working great.

Unfortunately after updating from container version 1.3 to latest the authentication doesn't work any more. They all result in failures. I've been using this test as a final test: link.

With version tag 1.3 it works without issues but with latest it results in failures. Do you have any clue what the issue could be? I already compared the versions of freeradius in the container and them seem identical.

I only use a basic docker-compose config and an external database:

version: '3.2'

services:
  freeradius:
    container_name: radius
    image: "2stacks/freeradius:latest"
    ports:
      - "<IP>:1812:1812/udp"
    environment:
      - DB_NAME=radius_docker
      - DB_HOST=<db IP>
      - DB_USER=<db_user>
      - DB_PASS=<db_pass>
      - DB_PORT=3306
      - RADIUS_KEY=<random key>
      - RAD_CLIENTS=*
      - RAD_DEBUG=yes
    restart: always
    networks:
      infra:
        ipv4_address: <IP>

networks:
  infra:
    external: true

[2stacks]

Sorry about the issue, I'm glad you've found it useful. In the latest version I removed eap to cut back on some of the dependencies in my envirionment. You can see the full change list since v1.3 here v1.3...master. In hind site that may not have been a great idea. Version 1.4 also includes the latest Freeradius 3 raddb and a new mysql schema that supports IPv6. It should be mostly compatible with your existing database but at least one other user had issues with accounting because of a new field 'groupname' in the schema. So long as you are using an older version of raddb you shouln't have this issue.

I'll add back eap and push an update. I also made changes to how the container waits for the mysql service to start that I'm not positive I like. You may or may not see issues with that. I'll try to push a commit later today.

[jerheij]

Thanks for your quick reply! I am running my MySQL server on the Docker host itself, so that dependency can't be the issue.

My setup is indeed depending on the EAP compatibility, authentication still works if I use a Windows tool that puts everything on automatic. Is it maybe an idea to have EAP disabled by default and just an option in the Docker startup (like EAP=enabled)? Or would that make the start of the container to complicated/timely?

[2stacks]

It's not an issue to re-enable eap. Overtime and across different OS's I've found that eap is sometimes enabled by default and sometimes not. This was causing me to have to debug it every time I made updates. Since I wasn't using it I just decided to rip it out of my alpine container 'debian, ubuntu include it by default alpine you have to add it manually'. Had I realized that others were making use of it I would not have done this. I'll just revert that change back to how it was in v1.3.

…

On Tue, Mar 19, 2019 at 9:50 AM Jeremy ***@***.***> wrote: Thanks for your quick reply! I am running my MySQL server on the Docker host itself, so that dependency can't be the issue. My setup is indeed depending on the EAP compatibility, authentication still works if I use a Windows tool that puts everything on automatic. Is it maybe an idea to have EAP of by default and just an option in the Docker startup (like EAP=enabled)? Or would that make the start of the container to complicated/timely? — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#7 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AOjSHAp_7lwvRZb7SO3zQxcX-4qwU4Qtks5vYOsUgaJpZM4b7a5S> .

[jerheij]

That would be awesome! :)

[2stacks]

I just pushed a new v1.4.1. All of the tests passed but let me know if you still have issues. I added some documentation regarding SSL certs that are required for using eap.

…

On Tue, Mar 19, 2019 at 10:03 AM Jeremy ***@***.***> wrote: That would be awesome! :) — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#7 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AOjSHNPvFDvXtFRzq4rI5LKl6yIYqq4oks5vYO4lgaJpZM4b7a5S> .

[jerheij]

EAP authentication seems to work fine again when using tag 1.4.1!

[2stacks]

Great! Thanks for the feedback.

…

On Wed, Mar 20, 2019 at 2:34 AM Jeremy ***@***.***> wrote: EAP authentication seems to work fine again when using tag *1.4.1*! — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#7 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AOjSHDDjUu4fxyDe3GC59it0tT2voZVvks5vYdaEgaJpZM4b7a5S> .

[2stacks]

You can also use the 'latest' tag as well if you prefer but there's only a minimal guarantee that future changes won't break stuff :)

…

On Wed, Mar 20, 2019 at 11:53 AM A Stanley ***@***.***> wrote: Great! Thanks for the feedback. On Wed, Mar 20, 2019 at 2:34 AM Jeremy ***@***.***> wrote: > EAP authentication seems to work fine again when using tag *1.4.1*! > > — > You are receiving this because you modified the open/close state. > Reply to this email directly, view it on GitHub > <#7 (comment)>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AOjSHDDjUu4fxyDe3GC59it0tT2voZVvks5vYdaEgaJpZM4b7a5S> > . >