FreeRadius: Client secret regression

[MartB]

Hey there,

after switching to 21.7 my freeradius stopped working with the following message:

Error: /usr/local/etc/raddb/clients.conf[2]: secret must be at least 1 character long

This was caused by missing quotes around the secret and possibly due to my secret starting with #@.

We need to add the quotation signs around the secrets when writing the config to prevent this.

[mimugmail]

Does it start without #@ in the secret?

[mimugmail]

Only change in this release was that clients need to use IP/networks instead of hostname

[MartB]

Does it start without #@ in the secret?

Yes it does, adding it back is making it fail again.
Might be some dependency or os package change?

[mimugmail]

What was the last known working version?

[MartB]

RC2 must have worked, i should have noticed otherwise.
I can help find the exact cause for this in 6 hours if needed.

[mimugmail]

Freeradius was updated from 3.0.22 to 3.0.23 and plugin from 1.9.14 to 1.9.15.

First testen:

opnsense-revert -r 21.7.r1 freeradius3

If you still have the error:

opnsense-revert -r 21.7.r1 os-freeradius

[franco]

If Jinja2 templates are involved this might be a side effect of Python 3.8 upgrade?


Cheers,
Franco

[mimugmail]

Templating is correct, but Freeradius seems to interpret is as a commect (leading hash) since 3.0.23

[franco]

err ok 

[mimugmail]

I'm unsure if FR intepretes " " as part of the string or not, maybe someone can verify it.

[MartB]

It does not thats what i did to fix it. Thanks for your research, just putting the quotes around would be enough to fix it.

Edit:
The 3.0.22 revert also works

[mimugmail]

It does not thats what i did to fix it. Thanks for your research, just putting the quotes around would be enough to fix it

Would? Or did you test it?

[MartB]

As i said in my first post, yes it does fix it.

[soernt.poppe]

Hi there,

I had this issue and updated the secrets to be inclosed in "".

I just update to version 21.7.4 and get once again the message
Error: /usr/local/etc/raddb/clients.conf[2]: secret must be at least 1 character long

The secrets are still in inclosed with "". I remove the "" and still get the same error.

What do I need to do here?