October 2023 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

LDAPS - where to start from?
by little-nemo＠virgilio.it 23 Nov '23

23 Nov '23

Hello, members. I followed the upgrading suggestion. Now working on Freeradius 3.2.1 (on Debian 11.5). I'm also using some personalized templates of the Eduroam/GARR consortium. Trying to setup LDAP filtering. To get an idea on how to do it, I read the tread "LDAP groups and how to filter" (https://lists.freeradius.org/pipermail/freeradius-users/2020-February/09743…) Is it still up to date? Is it a feasible solution? I'm still not understanding if this solution also requires the memberof/membership settings in the mods-available/ldap module. Does it? Now my main concern is the LDAPS binding, which is not working. Debug last rows: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldaps://dc1.testuni.it:636 rlm_ldap (ldap): Bind with CN=reader-freeradius,OU=ServiceUsers,OU=ServicePeople,DC=testuni,DC=it to ldaps://dc1.testuni.it:636 failed: Can't contact LDAP server rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" I tried to bind, manually, using the general command: ldapsearch -D ${identity} -w ${password} -H ${server} -b 'CN=user,${base_dn}' and it worked. In mods-available/ldap, at line 77, I read the suggestion: ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}' which did not work (the "-h" parameter is not supported anymore?). I don't think that this is the exact command used by freeradius, so the cause is elsewhere, likely in my configuration files. What am I supposed to check? Do you need the full debug? Thanks in advance, Pietro

3 11

FreeRADIUS CoA Proxy [invalid Message-Authenticator] in response
by Alexander Shulgin 31 Oct '23

31 Oct '23

I am trying to configure the coa proxy in latest Radius docker image 3.2.3. I have defined a client with a proper shared secret (message initiator) and also defined a home server with a shared secret (message destination). When I send the CoA message I see in debug that the radius server is proxying the request, the NAS at destination receiving it, it responds back to the radius server and then the radius server forwards that message back to the initiator. The problem is when I receive the final message from the radius server it has invalid message-authenticator. "Reply verification failed: Received packet from 192.168.2.157 with invalid Message-Authenticator! (Shared secret is incorrect.) I checked the shared secret on all sides, everything is as expected but somehow it signs the final message incorrectly. Thanks in advance. Attached is a debugfile of the freeradius And the request command and output is: echo " NAS-IP-Address = 192.168.2.224 Calling-Station-Id = 'BC:54:51:EF:70:AE' Event-Timestamp = $(date +%s) " | radclient -x 192.168.2.157:3799 disconnect testing123 Sent Disconnect-Request Id 7 from 0.0.0.0:33184 to 192.168.2.157:3799 length 51 NAS-IP-Address = 192.168.2.224 Calling-Station-Id = "BC:54:51:EF:70:AE" Event-Timestamp = "Oct 31 2023 13:29:27 MDT" (0) Reply verification failed: Received packet from 192.168.2.157 with invalid Message-Authenticator! (Shared secret is incorrect.)

2 4

OTP support - OATH compliant 2FA with freeradius
by Michael Hawkins 31 Oct '23

31 Oct '23

Hello all, Way back when, freeradius supported otp. Has that support been removed? What is it replaced with? Or, to put it another way. If I wanted to use some form of 2FA that used a server that was code running on a LINUX box, that was open source, that worked with freeradius, what might it be? The 2FA piece would support OATH compliant event (not time based) tokens - hardware or software. Many thanks, -- Michael A Hawkins Stamford, CT 06902 USA Mobile: 203-550-5502

2 1

File module processing error "Invalid operator"
by Chinnapaiyan, Nagamani 31 Oct '23

31 Oct '23

Hi, I am seeing "Invalid operator" error on a file module. # /usr/sbin/radiusd -X Info : Copyright 1999-2023 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/raddb/dictionary" Debug : including configuration file /etc/raddb/radiusd.conf Debug : Including files in directory "/etc/raddb/template.d/" Debug : including configuration file /etc/raddb/template.d/default Debug : including configuration file /etc/raddb/clients.conf Debug : Including files in directory "/etc/raddb/global.d/" Debug : including configuration file /etc/raddb/global.d/ldap Debug : Including files in directory "/etc/raddb/mods-enabled/" Debug : including configuration file /etc/raddb/mods-enabled/always Debug : including configuration file /etc/raddb/mods-enabled/files Debug : including configuration file /etc/raddb/mods-enabled/ldap Debug : including configuration file /etc/raddb/mods-enabled/linelog_dhcp Debug : including configuration file /etc/raddb/mods-enabled/redis Debug : including configuration file /etc/raddb/mods-enabled/redis_ippool Debug : including configuration file /etc/raddb/mods-enabled/unpack Debug : Including files in directory "/etc/raddb/policy.d/" ... ... Debug : rlm_redis (redis) [1] - Reserved connection (0) Debug : rlm_redis (redis) [1] - Released connection (0) Debug : Instantiating rlm_always "reject" Debug : Instantiating rlm_files "subnet_policy" Debug : Reading file /etc/raddb/mods-config/files/subnet_policies Error : /etc/raddb/mods-config/files/subnet_policies[1692]: dhcpv4.Router-Address := 25.26.0.1, Error : /etc/raddb/mods-config/files/subnet_policies[1692]: ^ Invalid operator Error : Failed reading /etc/raddb/mods-config/files/subnet_policies Error : /etc/raddb/mods-enabled/files[25]: Instantiation failed for module "subnet_policy" After removing some commented lines or adding some empty lines or empty spaces in the file module, the error goes away. pwd:/etc/raddb/mods-config/files subnet_policies is the file module which gives this error. below is the diff between the problematic file and working file. Just removed a line. # wc subnet_policies* 4438 7982 111085 subnet_policies 4439 7983 111161 subnet_policies.problem # diff subnet_policies.problem subnet_policies 1d0 < ########################################################################### Debug : rlm_redis (redis) [1] - Reserved connection (0) Debug : rlm_redis (redis) [1] - Released connection (0) Debug : Instantiating rlm_always "reject" Debug : Instantiating rlm_files "subnet_policy" Debug : Reading file /etc/raddb/mods-config/files/subnet_policies Debug : Instantiating rlm_files "subscriber_host_policy" Debug : Reading file /etc/raddb/mods-config/files/host_policies Regards, Nagamani Chinnapaiyan

2 3

Will radiusd reload certificates on hup command?
by James Fan 31 Oct '23

31 Oct '23

Assuming that the FreeRADIUS configuration files have changed, will the hup command make the server reload its certificates, keys, etc.? Thanks.

3 4

Debugmode together with Kerberos
by Stefan Kania 30 Oct '23

30 Oct '23

Hi everybody, I have configured freeradius to use gssapi for authentication while searching the LDAP for users or hosts. Now I can't start the debugmode anymore. Everytime I try I'm getting: ---------- rlm_ldap (ldap): Connecting to ldaps://ldap-r01.example.net:636 ldaps://ldap-r02.example.net:636 rlm_ldap (ldap): Starting SASL mech(s): gssapi SASL/GSSAPI authentication started rlm_ldap (ldap): Bind with (anonymous) to ldaps://ldap-r01.example.net:636 ldaps://ldap-r02.example.net:636 failed: Local error rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" ---------- The log from the LDAP-server is showing: ---------- Okt 29 15:27:27 ldap-r01 slapd[620]: conn=1024 fd=26 ACCEPT from IP=192.168.56.47:34490 (IP=0.0.0.0:636) Okt 29 15:27:27 ldap-r01 slapd[620]: conn=1024 fd=26 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Okt 29 15:27:27 ldap-r01 slapd[620]: conn=1024 op=0 UNBIND Okt 29 15:27:27 ldap-r01 slapd[620]: conn=1024 fd=26 closed ---------- Running freeradius normal I can search for a user end check authentication with username and password -------------------- root@radius-r01:~# radtest u1-verw geheim 192.168.56.47 1812 Passw0rd Sent Access-Request Id 143 from 0.0.0.0:34828 to 192.168.56.47:1812 length 77 User-Name = "u1-verw" User-Password = "geheim" NAS-IP-Address = 192.168.56.47 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "geheim" Received Access-Accept Id 143 from 192.168.56.47:1812 to 192.168.56.47:34828 length 20 -------------------- The logfile for m my LDAP-Server is showing: ---------- Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1031 op=2 BIND dn="" method=163 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1031 op=2 BIND authcid="radius/radius-r01.example.net" authzid="radius/radius-r01.example.net" Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1031 op=2 BIND dn="uid=radius/radius-r01.example.net,cn=gssapi,cn=auth" mech=GSSAPI bind_ssf=56 ssf=256 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1031 op=2 RESULT tag=97 err=0 qtime=0.000006 etime=0.000187 text= Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1026 op=3 BIND anonymous mech=implicit bind_ssf=0 ssf=256 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1026 op=3 BIND dn="cn=u1 Verw,ou=users,ou=Verwaltung,dc=example,dc=net" method=128 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1026 op=3 BIND dn="cn=u1 Verw,ou=users,ou=Verwaltung,dc=example,dc=net" mech=SIMPLE bind_ssf=0 ssf=256 Okt 29 15:30:29 ldap-r01 slapd[620]: conn=1026 op=3 RESULT tag=97 err=0 qtime=0.000007 etime=0.006275 text= ---------- So as you can see, authentication via Kerberos for the search and authentication of users is working. To do the next step, switch to user-authentication via certificate, I want to start the debugmode, but I could not figure out how to get the debugmode running with Kerberos authentication :-( Is there a way to get it running? Stefan

4 7

%{SQL-User-Name} parsing in authorize section - bug?
by Igor Smitran 30 Oct '23

30 Oct '23

Hi list, Have i found a bug or i have made a mistake in configuring freeradius, version 3.2.3 from networkradius ubuntu repo... When i put this into authorize section: authorize { ... # MAC LIMIT update control { Tmp-Integer-3 := "%{sql: SELECT count(*) FROM radcheck WHERE Username = '%{SQL-User-Name}' and (mac_limit='%{Calling-Station-Id}' or mac_limit='*');}" } ... } it doesn't work, SQL-User-Name is empty: (0) update control { (0) EXPAND %{User-Name} (0) --> testuser (0) SQL-User-Name set to 'testuser' rlm_sql (sql): Reserved connection (2) (0) Executing select query: SELECT count(*) FROM radcheck WHERE Username = '' and (mac_limit='' or mac_limit='*'); rlm_sql (sql): Released connection (2) (0) EXPAND %{sql: SELECT count(*) FROM radcheck WHERE Username = '%{SQL-User-Name}' and (mac_limit='%{Calling-Station-Id}' or mac_limit='*');} (0) --> 0 (0) Tmp-Integer-3 := 0 (0) } # update control = noop If User-Name is used instead of SQL-User-Name it works: authorize { ... # MAC LIMIT update control { Tmp-Integer-3 := "%{sql: SELECT count(*) FROM radcheck WHERE Username = '%{User-Name}' and (mac_limit='%{Calling-Station-Id}' or mac_limit='*');}" } ... } (0) update control { rlm_sql (sql): Reserved connection (2) rlm_sql (sql): Released connection (2) (0) EXPAND %{User-Name} (0) --> testuser (0) SQL-User-Name set to 'testuser' rlm_sql (sql): Reserved connection (3) (0) Executing select query: SELECT count(*) FROM radcheck WHERE Username = 'testuser' and (mac_limit='' or mac_limit='*'); rlm_sql (sql): Released connection (3) (0) EXPAND %{sql: SELECT count(*) FROM radcheck WHERE Username = '%{User-Name}' and (mac_limit='%{Calling-Station-Id}' or mac_limit='*');} (0) --> 1 (0) Tmp-Integer-3 := 1 (0) } # update control = noop It looks like SQL-User-Name population is done after authorize is processed, i am not sure. Everywhere else i am able to use SQL-User-Name, including queris.conf. But, not in authorize. Please correct me if i am wrong. I would appreciate any help. If it's my error than even better. It's not so big problem, but it's annoying. Same setup works in 2.1 but not in 3.0 and 3.2 Thank you, Igor Smitran

2 2