September 2023 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Monitor the number of open EAP sessions
by Sergey Marochkin 23 Nov '23

23 Nov '23

Hi everyone! I am facing a problem when freeradius reports that the limit of open sessions has been reached. These are log entries, like "Too many open sessions. Try increasing "max_sessions" in the EAP module configuration". During the debugging, it was determined that some ios devices (ipad/iphone), for a reason unknown to me, cyclically cannot complete eap/tls authentication process. I found that these devices successfully start communicating with the NAS (send EAP-Response/Identity). But after receiving the (TLS Start)-message, they no longer send the (TLS client_hello)-message, and restart the association process with the access point and therefore open a new EAP session. If recreate a wifi connection on such a device, it will connect successfully. Until I find the root cause of this behavior, I would like to monitor the number of open sessions of the radius server. But I couldn't find a suitable way to do it. Here is what I tried: - use the "status server" tool, but there is no suitable one among its counters - use tool "control-socket" and radmin but also i didn't find suitable counter Can you help me with this question? Thanks!

2 4

LDAPS - where to start from?
by little-nemo＠virgilio.it 23 Nov '23

23 Nov '23

Hello, members. I followed the upgrading suggestion. Now working on Freeradius 3.2.1 (on Debian 11.5). I'm also using some personalized templates of the Eduroam/GARR consortium. Trying to setup LDAP filtering. To get an idea on how to do it, I read the tread "LDAP groups and how to filter" (https://lists.freeradius.org/pipermail/freeradius-users/2020-February/09743…) Is it still up to date? Is it a feasible solution? I'm still not understanding if this solution also requires the memberof/membership settings in the mods-available/ldap module. Does it? Now my main concern is the LDAPS binding, which is not working. Debug last rows: rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldaps://dc1.testuni.it:636 rlm_ldap (ldap): Bind with CN=reader-freeradius,OU=ServiceUsers,OU=ServicePeople,DC=testuni,DC=it to ldaps://dc1.testuni.it:636 failed: Can't contact LDAP server rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" I tried to bind, manually, using the general command: ldapsearch -D ${identity} -w ${password} -H ${server} -b 'CN=user,${base_dn}' and it worked. In mods-available/ldap, at line 77, I read the suggestion: ldapsearch -D ${identity} -w ${password} -h ${server} -b 'CN=user,${base_dn}' which did not work (the "-h" parameter is not supported anymore?). I don't think that this is the exact command used by freeradius, so the cause is elsewhere, likely in my configuration files. What am I supposed to check? Do you need the full debug? Thanks in advance, Pietro

3 11

Will radiusd reload certificates on hup command?
by James Fan 31 Oct '23

31 Oct '23

Assuming that the FreeRADIUS configuration files have changed, will the hup command make the server reload its certificates, keys, etc.? Thanks.

3 4

Problems to authenticate against an Azure AD -Ldap
by Uwe Faber 02 Oct '23

02 Oct '23

Hi folks, i hopw you can help after reading thousends articles and making hundred of trials with the freeradius with no succes. Here ist the situation, we have an Azure AD and for this an ldap server front-end. So i could connect to the AD over the ldap. for testing reason i implementet an Local openldap server and testet ist with the eapol test and it works without problems, but if i change the ldap connection to the azure/ldap i got the following error: 5) ldap_khs: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (5) ldap_khs: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) regards Uwe

5 17

FreeRADIUS on mac
by Robert Fernandez 30 Sep '23

30 Sep '23

Has anyone gotten FreeRADIUS 3.2.3 to compile on Macintosh. When I run “make” it errors on the line: configure: error: failed linking to libcrypto. Use --with-openssl-lib-dir=<path>, or --with-openssl=no (builds without OpenSSL)

2 1

Quick question about FreeRADIUS and timezones
by Stefan Paetow 29 Sep '23

29 Sep '23

Hi, I know this is probably something really obvious but… Does FreeRADIUS log in UTC or the local timezone? Is there anything specific in terms of settings (in radiusd.conf) to make FreeRADIUS log in UTC by default if it does not? I’ve looked at the date {} module and I note that both the ‘date’ and the ‘wispr2date’ xlats have the option to output things in UTC… would that be the only thing where this can be tweaked? With kind regards Stefan Paetow Federated Roaming Technical Specialist eduroam(UK), Jisc email/teams: stefan.paetow(a)jisc.ac.uk gpg: 0x3FCE5142 For eduroam support, please contact the eduroam team via help(a)jisc.ac.uk and mark it for eduroam’s attention. On Wednesdays and Fridays, I am not available between 12:00 and 15:00. jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB Tel: 020 3697 5800.

2 2

Lockout by IP number?
by Ann Cantelow 28 Sep '23

28 Sep '23

Hello, I am looking to implement a lockout for excessive login tries. I have been following advice offered at https://wiki.freeradius.org/guide/lockout , and thank you very much for that. Is there a variable like '%{User-Name}' for IP number? I would like to do a lockout based on IP number as well as User-Name. I see the IP is listed in the radius log, but I haven't been able to find an attribute that I figure will give this information. I've looked in the dictionary files, but maybe I've somehow missed it. My radius version is 2.1.12 on RHEL6, and client nastype is cisco. Radius upgrade to version 3 is planned. Radius log example lines showing ip numbers: ... Wed Sep 27 11:29:13 2023 : Auth: Login incorrect: [edc] (from client [clientname] port 212271104 cli 62.122.184.231) Wed Sep 27 11:29:14 2023 : Auth: Login incorrect: [edc] (from client [clientname] port 86839296 cli 62.122.184.231) Wed Sep 27 11:29:16 2023 : Auth: Login incorrect: [qazwsx] (from client [clientname] port 241688576 cli 62.122.184.231) Wed Sep 27 11:29:17 2023 : Auth: Login incorrect: [qazwsx] (from client [clientname] port 166244352 cli 62.122.184.231) ... Many thanks, Ann Cantelow

4 4

Simple question (Request Duration)
by Andy Arp 27 Sep '23

27 Sep '23

Is there a builtin value i can emit to linelog that will indicate how long a given request has taken from start to finish? -- Thanks, Andy Arp

3 3