November 2023 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Can I use diffrent root CA certificates while dynamic loading certificate chains?
by James Fan 28 Oct '24

28 Oct '24

Hi, we have a case that, with multi-tenancy, there will be multiple CA certificates in our FreeRadius server, so we need to load the certificate chains dynamically. But when I use the statements below, I can't include the CA certificates in the certificate files I set. The TLS-Session-Cert-File looks like it is only for the server certificate and intermediate CA certificates. Is there any chance of dynamic loading certificate chains with root CA certificates? Thanks. authenticate { ... Auth-Type eap { if ("%{unpack:&EAP-Message 4 byte}" == 1) { update control { TLS-Session-Cert-File := "${certdir}/realms/%{Realm}" } } eap } ... }

4 8

(no subject)
by Deepansha Gaur 04 Dec '23

04 Dec '23

Hi Team, We are in the process of migrating from radiator to freeradius. I have a test freeradius server built on Ubuntu. When I am authenticating locally, radtest is successful. I added a wireless controller client and when I try to connect to the wifi using that client and freeradius authentication, it keeps failing. I see requests from the client to freeradius server but no response from freeradius. Below are the logs for reference: a2:01:00:00:01:70 > 00:50:56:a2:64:59, IPv4, length 336: WIRELESS_IP.32778 > RADIUS_IP.1812: UDP, length 294 There's no response from the radius server. Below are the firewall rules: nft add rule ip filter input udp dport 1812 counter accept nft add rule ip filter input udp dport 1813 counter accept Please let me know if you need any further information. Thanks. Regards, Deepansha Gaur

6 8

Proxy Server Deployment - Duplication of Radacct entries in the DB
by Gabriel Marais 30 Nov '23

30 Nov '23

Hi Guys, I need some advice on setting up Proxies (correctly). Currently, I have two freeRadius servers in the EU and two proxies in Africa. The proxies are configured in a fail-over scenario pointing to the two freeRadius servers in the EU. We receive accounting packets from an upstream carrier which has a fail-over, and in some cases have a load-balance configuration on their side pointing to our proxies. Our proxies receive those packets and they are forwarded to the radius servers in the EU where all the "processing" takes place. The radius servers in the EU are connected to a MySQL cluster where we make use of accounting information for session and capping purposes. The problem now, as far as I can ascertain, is the duplication of sessions in some cases for the same "user name" and as far as I can tell this happens when a proxy server sends the accounting start packet to radius server 1 in the EU - the radius server adds the information to the DB with an unique accounting session id. When the interim update is received by the proxies and that interim update packet is sent to radius server 2 in the EU, the server then creates a new radacct entry in the DB with a new unique accounting id since it cannot find an existing session in the DB with the unique accounting id created by the radius server that first received the start packet. Is there some specific way I need to modify my queries.conf files on the radius servers in the EU or some specific way I need to configure my proxies for them to better handle cases like this? My queries.conf file is the standard out-the-box config apart from adding some relevant 3GPP values to be written on accounting start and interim update packets into the DB as received from the carrier. Thanks in advance. Regards, Gabriel

3 2

real-time graphical tool User debugging
by Giovanni Trapasso 30 Nov '23

30 Nov '23

Hello, We are in the process of migrating from Radiator to FreeRadius. One of the tools we use for debugging user authentication issues is the Radiator tool called Radar, https://radiatorsoftware.com/products/radar/. I have been searching for a similar tool for FreeRadius. My question is what do people use to debug client authentications? It looks like there is the raddebug tool where you can use with varius switches raddebug -c ’Calling-Station-Id == "xx-xx-xx-xx-xx-xx"’ Or raddebug -u <username> both from https://networkradius.com/doc/FreeRADIUS-Implementation-Ch11.pdf Anything with a Graphical interface so that others can debug users without giving them cli access? -- _______________________________________________________________ Giovanni Trapasso _______________________________________________________________

2 1

Removing spaces from User-Name
by Daniel Ryšlink 30 Nov '23

30 Nov '23

Hello, There are NAS devices (Mikrotik) in our network that generate incorrect User-Names in Access-Request packets containing spaces - example: User-Name = "MK-TRA eth 0/9:269.ether8" These packets are refused and invalid by the radius server: Invalid user (Rejected: User-Name contains whitespace): [MK-TRA eth 0/9:269.ether8] The question is - is there a way/how to do a preprocessing on the radius server to remove the whitespace characters from the User-Name? I know that the most correct solution would be to generate valid radius packets on the client side, but I already looked into the RouterOS documentation and there seem to be no fine control on how the packet is generated (User-Name is obviously constructed from configuration items, separated by said whitespaces). Any practical advice would be greatly appreciated, thank you very much in advance. -- Regards, Daniel Ryšlink

2 3

Multiple server certificates for eap with virtual servers?
by alvalon＠web.de 28 Nov '23

28 Nov '23

1 0

Empty timestamp in linelog
by Ashraf Al-Basti 27 Nov '23

27 Nov '23

Hi, I have configured Linelog to log the accept/reject messages but I'm facing an issue if the username has "@". if the username has "@" the timestamp will become empty. below the conf and the debug for both cases linelog llog-auth-reject { filename = /log/authentication/auth-reject-%Y%m%d.csv escape_filenames = no permissions = 0640 format = "" reference = "messages.%{%{reply:Packet-Type}:-default}" messages { default = "Unknown packet type %{Packet-Type}" Access-Accept = "%{Event-Timestamp},%{User-Name},%{NAS-Identifier},%{reply:Packet-Type},%l,%{NAS-IP-Address},%{ERX-Dhcp-Mac-Addr},%{reply:Reply-Message}" Access-Reject = "%{Event-Timestamp},%{User-Name},%{NAS-Identifier},%{reply:Packet-Type},%l,%{NAS-IP-Address},%{ERX-Dhcp-Mac-Addr},%{reply:Reply-Message}" Access-Challenge = "" } } *Username with @* (0) Received Access-Request Id 25 from 192.168.1.21:61062 to 192.168.1.157:1812 length 153 (0) User-Name = "test@wifi" (0) User-Password = "yyyyyyy" (0) NAS-Port = 25 (0) Service-Type = Login-User (0) NAS-IP-Address = 10.129.10.50 (0) Connect-Info = "1|10" (0) Calling-Station-Id = "11-33-44-55-a5-11" (0) NAS-Identifier = "SRC" (0) Called-Station-Id = "12345" (0) ERX-Dhcp-Mac-Addr = "11-33-44-55-a5-12" (0) NAS-Port-Id = "mx480-0-re0#ae2:3500##" (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> TRUE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) update request { (0) &Module-Failure-Message += 'Rejected: Realm does not have at least one dot separator' (0) } # update request = noop (0) [reject] = reject (0) } # if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) = reject (0) } # if (&User-Name) = reject (0) } # policy filter_username = reject (0) } # authorize = reject *(0) Invalid user (Rejected: Realm does not have at least one dot separator): [test@wifi] (from client test1 port 25 cli 11-33-44-55-a5-11)* (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) llog-auth-reject: EXPAND messages.%{%{reply:Packet-Type}:-default} (0) llog-auth-reject: --> messages.Access-Reject (0) llog-auth-reject: EXPAND %{Event-Timestamp},%{User-Name},%{NAS-Identifier},%{reply:Packet-Type},%l,%{NAS-IP-Address},%{ERX-Dhcp-Mac-Addr},%{reply:Reply-Message} (0) llog-auth-reject: --> ,test@wifi ,SRC,Access-Reject,1701103042,10.129.10.50,11-33-44-55-a5-12, (0) llog-auth-reject: EXPAND /log/authentication/auth-reject-%Y%m%d.csv (0) llog-auth-reject: --> /log/authentication/auth-reject-20231127.csv (0) [llog-auth-reject] = ok (0) } # Post-Auth-Type REJECT = ok (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 25 from 192.168.1.157:1812 to 192.168.1.21:61062 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 25 with timestamp +6 Username without "@" (1) Received Access-Request Id 26 from 192.168.1.21:56579 to 192.168.1.157:1812 length 148 (1) User-Name = "test" (1) User-Password = "yyyyyyy" (1) NAS-Port = 26 (1) Service-Type = Login-User (1) NAS-IP-Address = 10.129.10.50 (1) Connect-Info = "1|10" (1) Calling-Station-Id = "11-33-44-55-a5-11" (1) NAS-Identifier = "SRC" (1) Called-Station-Id = "12345" (1) ERX-Dhcp-Mac-Addr = "11-33-44-55-a5-12" (1) NAS-Port-Id = "mx480-0-re0#ae2:3500##" (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) [files] = noop (1) sql: EXPAND %{User-Name} (1) sql: --> test (1) sql: SQL-User-Name set to 'test' rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" *rlm_sql (sql): Opening additional connection (0), 1 of 500 pending slots used* rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 8.0.30, protocol version 10 rlm_sql (sql): Reserved connection (0) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id *(1) sql: WARNING: User not found in radcheck table.* rlm_sql (sql): 1 of 1 connections in use. You may need to increase "spare" *rlm_sql (sql): Opening additional connection (1), 1 of 499 pending slots used* rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 8.0.30, protocol version 10 rlm_sql (sql): Reserved connection (1) rlm_sql (sql): Released connection (1) *Need 9 more connections to reach 10 spares* *rlm_sql (sql): Opening additional connection (2), 1 of 498 pending slots used* rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 8.0.30, protocol version 10 (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (0) (1) [sql] = notfound (1) [expiration] = noop (1) [logintime] = noop *(1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type* *(1) pap: WARNING: Authentication will fail unless a "known good" password is available* (1) [pap] = noop (1) } # authorize = ok *(1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject* (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) llog-auth-reject: EXPAND messages.%{%{reply:Packet-Type}:-default} (1) llog-auth-reject: --> messages.Access-Reject (1) llog-auth-reject: EXPAND %{Event-Timestamp},%{User-Name},%{NAS-Identifier},%{reply:Packet-Type},%l,%{NAS-IP-Address},%{ERX-Dhcp-Mac-Addr},%{reply:Reply-Message} (1) llog-auth-reject: --> Nov 27 2023 20:38:10 +04,test,SRC,Access-Reject,1701103090,10.129.10.50,11-33-44-55-a5-12, (1) llog-auth-reject: EXPAND /log/authentication/auth-reject-%Y%m%d.csv (1) llog-auth-reject: --> /log/authentication/auth-reject-20231127.csv (1) [llog-auth-reject] = ok (1) } # Post-Auth-Type REJECT = ok (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 26 from 192.168.1.157:1812 to 192.168.1.21:56579 length 20 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 26 with timestamp +54 -- Best regards, Ashraf Al-Basti

2 1

Apache Auth via User/OTP fails
by Vogt, Andreas 27 Nov '23

27 Nov '23

Hello, I try to authenticate via my Apache Webserver to my freeradius Server. The Apache connects successful, and provides User/OneTimePassword to the freeradius. Here I use the following Config: Auth-Type OTP_OWA { update control { SECRET := `/usr/bin/php /freeradius_scripts/getSecretFromDB.php --username=%{User-Name} ` LAST_USED_PIN := `/usr/bin/php /freeradius_scripts/get_last_used_pin.php --username=%{User-Name}` PIN := `/bin/bash /freeradius_scripts/getPin %{control:SECRET}` PIN_FROM_USER := %{User-Password} ATTEMPTS := `/usr/bin/php /freeradius_scripts/get_attempts.php --username=%{User-Name}` Auth-Type := `/usr/bin/php /freeradius_scripts/check_pin_dev_log.php --username=%{User-Name} --pin=%{control:PIN} --pin_from_user=%{User-Password} --last_used_pin=%{control:LAST_USED_PIN} --attempts=%{control:ATTEMPTS}` } } Unfortunately I receive an REJECT from the freeradius: {DEBUG Output}: (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type OTP_OWA { (0) update control { (0) Executing: /usr/bin/php /freeradius_scripts/getSecretFromDB.php --username=%{User-Name} : (0) EXPAND --username=%{User-Name} (0) --> --username=USER.NAME (0) Program returned code (0) and output SECRET (0) SECRET := SECRET (0) Executing: /usr/bin/php /freeradius_scripts/get_last_used_pin.php --username=%{User-Name}: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) Program returned code (0) and output 12346 (0) LAST_USED_PIN := 12346 (0) Executing: /bin/bash /freeradius_scripts/getPin %{control:SECRET}: (0) EXPAND %{control:SECRET} (0) --> SECRET (0) Program returned code (0) and output 12346 (0) PIN := 12346 (0) PIN_FROM_USER := %{User-Password} (0) Executing: /usr/bin/php /freeradius_scripts/get_attempts.php --username=%{User-Name}: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) Program returned code (0) and output '0' (0) ATTEMPTS := 0 (0) Executing: /usr/bin/php /freeradius_scripts/check_pin_dev_log.php --username=%{User-Name} --pin=%{control:PIN} --pin_from_user=%{User-Password} --last_used_pin=%{control:LAST_USED_PIN} --attempts=%{control:ATTEMPTS}: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) EXPAND --pin=%{control:PIN} (0) --> --pin=12346 (0) EXPAND --pin_from_user=%{User-Password} (0) --> --pin_from_user=12346 (0) EXPAND --last_used_pin=%{control:LAST_USED_PIN} (0) --> --last_used_pin=64321 (0) EXPAND --attempts=%{control:ATTEMPTS} (0) --> --attempts=0 (0) Program returned code (0) and output 'Accept' (0) Auth_Type_LOG := Accept (0) Executing: /usr/bin/php /freeradius_scripts/check_pin_dev_log.php --username=%{User-Name} --pin=%{control:PIN} --pin_from_user=%{User-Password} --last_used_pin=%{control:LAST_USED_PIN} --attempts=%{control:ATTEMPTS}: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) EXPAND --pin=%{control:PIN} (0) --> --pin=12346 (0) EXPAND --pin_from_user=%{User-Password} (0) --> --pin_from_user=12346 (0) EXPAND --last_used_pin=%{control:LAST_USED_PIN} (0) --> --last_used_pin=64321 (0) EXPAND --attempts=%{control:ATTEMPTS} (0) --> --attempts=0 (0) Program returned code (0) and output 'Accept' (0) Auth-Type := Accept (0) } # update control = noop (0) update reply { (0) Reply-Message := Accept (0) } # update reply = noop (0) } # Auth-Type OTP_OWA = noop (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) update control { (0) Executing: /usr/bin/php /freeradius_scripts/write_in_log_win.php --username=%{User-Name} --auth_type=%{control:Auth_Type_LOG} --ip=%{Calling-Station-Id} --reply=Reject: (0) EXPAND --username=%{User-Name} (0) --> --username= USER.NAME (0) EXPAND --auth_type=%{control:Auth_Type_LOG} (0) --> --auth_type=Accept (0) EXPAND --ip=%{Calling-Station-Id} (0) --> --ip= (0) Program returned code (0) and output 'Reject' (0) LOG_EINTRAG := Reject (0) } # update control = noop (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> USER.NAME (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.9 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 117 from 10.1.56.3:1812 to 10.1.56.167:1026 length 28 So my .php Script checks the OTP-PIN ans returns “Accept”, but the freeradius answers Accept-Reject… Why? Thanks for any response 😉 Andreas

2 1