Squid3 and freeradius - basic_radius_auth: No response from RADIUS server - squid

Question

I have the following setup - freeradius setup to use MySQL database and log accounting to there too. I can see that this is all ok - as when I run a radtest I get the expected results. So I am fairly sure that the freeradius part is all ok
When I configure squid3 to use this - I am getting the following
2021/08/27 12:34:16| Starting new basicauthenticator helpers...
2021/08/27 12:34:16| helperOpenServers: Starting 1/20 'basic_radius_auth' processes
basic_radius_auth: No response from RADIUS server
On the freeradius side I can see:
(2) Received Access-Request Id 6 from 172.17.0.1:59997 to 172.17.0.20:1812 length 87
(2) User-Name = "me#mine.com"
(2) User-Password = "password"
(2) NAS-Port = 111
(2) NAS-Port-Type = Async
(2) NAS-IP-Address = 172.17.0.21
(2) # Executing section authorize from file /etc/freeradius/sites-enabled/default
(2) authorize {
(2) policy filter_username {
(2) if (&User-Name) {
(2) if (&User-Name) -> TRUE
(2) if (&User-Name) {
(2) if (&User-Name =~ / /) {
(2) if (&User-Name =~ / /) -> FALSE
(2) if (&User-Name =~ /#[^#]*#/ ) {
(2) if (&User-Name =~ /#[^#]*#/ ) -> FALSE
(2) if (&User-Name =~ /\.\./ ) {
(2) if (&User-Name =~ /\.\./ ) -> FALSE
(2) if ((&User-Name =~ /#/) && (&User-Name !~ /#(.+)\.(.+)$/)) {
(2) if ((&User-Name =~ /#/) && (&User-Name !~ /#(.+)\.(.+)$/)) -> FALSE
(2) if (&User-Name =~ /\.$/) {
(2) if (&User-Name =~ /\.$/) -> FALSE
(2) if (&User-Name =~ /#\./) {
(2) if (&User-Name =~ /#\./) -> FALSE
(2) } # if (&User-Name) = notfound
(2) } # policy filter_username = notfound
(2) [preprocess] = ok
(2) [chap] = noop
(2) [mschap] = noop
(2) [digest] = noop
(2) suffix: Checking for suffix after "#"
(2) suffix: Looking up realm "mine.com" for User-Name = "me#mine.com"
(2) suffix: No such realm "mine.com"
(2) [suffix] = noop
(2) eap: No EAP-Message, not doing EAP
(2) [eap] = noop
(2) [files] = noop
(2) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}
(2) sql: --> me#mine.com
(2) sql: SQL-User-Name set to 'me#mine.com'
rlm_sql (sql): Reserved connection (6)
(2) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(2) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'me#mine.com' ORDER BY id
(2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'me#mine.com' ORDER BY id
(2) sql: User found in radcheck table
(2) sql: Conditional check items matched, merging assignment check items
(2) sql: Cleartext-Password := "password"
(2) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id
(2) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'me#mine.com' ORDER BY id
(2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'me#mine.com' ORDER BY id
(2) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
(2) sql: --> SELECT groupname FROM radusergroup WHERE username = 'me#mine.com' ORDER BY priority
(2) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'me#mine.com' ORDER BY priority
(2) sql: User not found in any groups
rlm_sql (sql): Released connection (6)
Need 1 more connections to reach min connections (3)
rlm_sql (sql): Opening additional connection (7), 1 of 30 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radius' on 192.168.0.10 via TCP/IP, server version 5.5.5-10.6.4-MariaDB-1:10.6.4+maria~focal, protocol version 10
rlm_sql (sql): You probably need to lower "min"
rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
(2) [sql] = ok
(2) [expiration] = noop
(2) [logintime] = noop
(2) [pap] = updated
(2) } # authorize = updated
(2) Found Auth-Type = PAP
(2) # Executing group from file /etc/freeradius/sites-enabled/default
(2) Auth-Type PAP {
(2) pap: Login attempt with password
(2) pap: Comparing with "known good" Cleartext-Password
(2) pap: User authenticated successfully
(2) [pap] = ok
(2) } # Auth-Type PAP = ok
(2) # Executing section post-auth from file /etc/freeradius/sites-enabled/default
(2) post-auth {
(2) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
(2) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE
(2) update {
(2) No attributes updated for RHS &session-state:
(2) } # update = noop
(2) sql: EXPAND .query
(2) sql: --> .query
(2) sql: Using query template 'query'
rlm_sql (sql): Reserved connection (6)
(2) sql: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}
(2) sql: --> me#mine.com
(2) sql: SQL-User-Name set to 'me#mine.com'
(2) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )
(2) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'me#mine.com', 'password', 'Access-Accept', '2021-08-27 12:44:12.863002' )
(2) sql: EXPAND /var/log/freeradius/sqllog.sql
(2) sql: --> /var/log/freeradius/sqllog.sql
(2) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'me#mine.com', 'password', 'Access-Accept', '2021-08-27 12:44:12.863002' )
(2) sql: SQL query returned: success
(2) sql: 1 record(s) updated
rlm_sql (sql): Released connection (6)
(2) [sql] = ok
(2) [exec] = noop
(2) policy remove_reply_message_if_eap {
(2) if (&reply:EAP-Message && &reply:Reply-Message) {
(2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(2) else {
(2) [noop] = noop
(2) } # else = noop
(2) } # policy remove_reply_message_if_eap = noop
(2) if (EAP-Key-Name && &reply:EAP-Session-Id) {
(2) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE
(2) } # post-auth = ok
(2) Sent Access-Accept Id 6 from 172.17.0.20:1812 to 172.17.0.1:59997 length 0
(2) Finished request
Waking up in 4.9 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 9.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 18.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 37.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 76.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 155.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 314.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 633.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 1272.0 seconds.
(2) Sending duplicate reply to client 172.17.0.1 port 59997 - ID: 6
Waking up in 2118.0 seconds.
in the squid.conf I have the following
auth_param basic program /usr/lib/squid/basic_radius_auth -f /etc/squid/radius_config
auth_param basic realm proxy
acl authenticated proxy_auth REQUIRED
http_access allow authenticated
I cannot figure out why the radius server is all ok - reporting back
(2) pap: User authenticated successfully
(2) [pap] = ok
(2) } # Auth-Type PAP = ok
and then
(2) Sent Access-Accept Id 6 from 172.17.0.20:1812 to 172.17.0.1:59997 length 0
(2) Finished request
and the "sending duplicate reply" errors?
Anyone know where I am going wrong?

Answer 1

Squid uses RADIUS "squid_radius_auth" authentication
Make sure squid is compiled with --enable-basic-auth-helpers="squid_radius_auth" option which is only available in Squid-2.6.STABLE17 or later.
Create a radius configuration file
The configuration specifies the connection type to RADIUS. The file contains a list of directives (one per line). Lines beginning with a "#" are ignored as comments.
Template radius config
server radiusserver: specifies the name or address of the RADIUS server
secret somesecretstring: specifies the shared RADIUS secret.
identifier nameofserver: specifies what the proxy should identify itself as to the RADIUS server. This directive is optional (optional)
port port-number: Specifies the port number or service name (default:1812)
Sample radius config: /etc/radius_config
server 192.168.10.20
secret someSecret
Test authentication squid_radius_auth command line with config
/usr/local/squid/libexec/squid_radius_auth -f /etc/radius_config
Test authentication squid_radius_auth command line without config
/usr/local/squid/libexec/squid_radius_auth -h 192.168.10.20 -w someSecret
Type your radius username and password on the same line separated with a space, it should return "OK" as the response if successful.
Tested squid.conf Configuration
auth_param basic program /usr/local/squid/libexec/squid_radius_auth -f /etc/radius_config
auth_param basic children 5
auth_param basic realm Web-Proxy
auth_param basic credentialsttl 5 minute
auth_param basic casesensitive off
acl radius-auth proxy_auth REQUIRED
http_access allow radius-auth
http_access allow localhost
http_access deny all