January 2025 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

terminating...-could not determine remote IP address
by Mamun Ahmed 14 Feb '25

14 Feb '25

*Hello Alan DeKok,* I am currently using FreeRADIUS with the SQL driver integrated with Mikrotik, and everything is set up as per the guidelines. Below is my configuration for the radgroupreply table: [image: image.png] However, I am encountering an issue where the system is unable to determine the remote IP address during the termination process. Attached Mikrotik logs for your reference: DC:8E:8D:2E:7E:34 local ip pool error: std failure: unknown id (4) pppoe, ppp, info, acc... k-gopalghosh logged in, 10.10.22.115 from DC:8E:8D:2E:7E:34 pppoe, ppp, info <pppoe-k-gopalghosh>: authenticated pppoe.ppp, info <pppoe-k-gopalghosh>: terminating... - could not determine remote IP address pppoe, ppp, info, acc... k-gopalghosh logged out, 0 62 103 5 7 from DC:8E:8D:2E:7E:34 <pppoek-gopalghosh>: disconnected pppoe, ppp, info pppoe, ppp, error pppoe, info <02e7>: user s-siddik authentication failed Could you please guide me on how to resolve this issue? Thank you for your assistance. I look forward to your response. Best regards, Mamun Ahmed

3 2

Seeking assistance with eap_peap error log
by Joseph Repuyan 31 Jan '25

31 Jan '25

Hello, Good day to everyone. We have a wireless setup where the SSID password is updated every day. FreeRADIUS is used for authentication and some automation behind to update the password and store them to an SQL database. Mobile phones can successfully authenticate using the password for the day, but laptops cannot. The client claims both mac and windows laptops cannot connect but I only have logs of the windows machine attempting to authenticate. Attached are the logs. Near the bottom of the logs, I found these errors. From the looks of it, the client itself is complaining about the TLS exchange, but I'm lost as to what to check next. I cannot replicate the issue with my windows laptop using the same FreeRADIUS server (but using different a access point). (7) eap_peap: (TLS) EAP Peer says that the final record size will be 31 bytes (7) eap_peap: (TLS) EAP Got all data (31 bytes) (7) eap_peap: (TLS) PEAP - recv TLS 1.2 Alert, fatal access_denied (7) eap_peap: (TLS) PEAP - The client is informing us that there is a failure inside the TLS protocol exchange. (7) eap_peap: ERROR: (TLS) PEAP - Alert read:fatal:access denied (7) eap_peap: ERROR: (TLS) Error in fragmentation logic - code 1 (7) eap_peap: ERROR: (TLS) Failed reading application data from OpenSSL: error:0A000419:SSL routines::tlsv1 alert access denied (7) eap_peap: ERROR: [eaptls process] = fail (7) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (7) eap: Sending EAP Failure (code 4) ID 88 length 4 (7) eap: Failed in EAP select (7) [eap] = invalid (7) } # authenticate = invalid Regards, Joseph [cid:ea68704a-6679-482d-add8-dada5d5730a3] Joseph Repuyan Technical Consultant [cid:3c9afbd0-df84-456b-8360-722ef2e2b1cd]<https://www.linkedin.com/company/cloud4x/> [cid:79c2a19c-09f3-44f7-9739-da337b2450e7] <https://www.facebook.com/user_name_here> [cid:f67cdc37-ab87-4e28-82f3-f236945d4c23] <https://www.youtube.com/@Cloud4x-Australia> [banners-01.png] 1800 325 683 [banners-02.png] www.cloud4x.com.au<https://cloud4x.com.au/> [banners-03.png] Sydney Corporate Park, Level 4 184 Bourke Road, Alexandria, NSW 2015 [cloud4x-01.png]<https://cloud4x.com.au/documentation/> [cloud4x-02.png]<https://www.crn.com.au/news/announcing-the-2024-crn-impact-award-winners-61…>

2 3

Version 3.2.7 has been released
by Matthew Newton 31 Jan '25

31 Jan '25

We have released FreeRADIUS version 3.2.7 today. Some highlights in this release: - Easier configuration of TEAP - Configurable behaviour for "return" in policies and groups - see "unlang" in radiusd.conf - A new "python_path_mode" in rlm_python3 to configure how the python_path option is used. - Updates for RADIUS/TLS and more configuration options. Note that python2 and rlm_couchbase have been removed from the Alpine Docker images as the base OS has been updated and no longer supports Python 2 or Couchbase 2. Full information is in doc/ChangeLog. Download from the normal places: https://freeradius.org/releases/ https://freeradius.org/ftp/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_7 Packages are available from InkBridge Networks for common Linux distributions as usual: https://packages.inkbridgenetworks.com/ and Docker images have been refreshed on Dockerhub: https://hub.docker.com/r/freeradius/freeradius-server -- Matthew

2 1

We have released version 3.2.7
by Alan DeKok 31 Jan '25

31 Jan '25

Release notes below. Note that we have updated TEAP, and are interoperable with Microsoft. However, there are open issues with the TEAP standard which are being worked through the IETF. As such, TEAP may or may not work outside of the "Microsoft - FreeRADIUS" ecosystem. I would suggest that people wait before doing wide-spread deployments for TEAP. Configuration changes • The dpsk module now supports dynamic expansion of the filename parameter. • radiusd.conf now contains an unlang section, which controls new behavior for the return statement. • New configuration parameters for TEAP which makes it much easier to configure. See the teap section of the eap module. • Change idle timeout for incoming radsec connections, to better match behavior of radsecproxy. • python2 and rlm_couchbase are no longer available in the alpine docker image. • utmp files are becoming obsolete due to 32-bit time. unix/radwtmp have been commented out in the default config and radlast is no longer installed if last is not present on the system. Feature improvements • Print MD5 hash of the configuration files in debug mode. This helps people track configuration changes. • Add support for IPv6 to "abinary" type. The fields are the same as for "ip", but use "ipv6", and IPv6 formatted addresses. • Update radclient to make it clear that Message-Authenticator is added to all Access-Request packets, even if the input file does not contain it. • Add support for Subject AltName URI. Closes #5450. • Add python_path_mode option to python3 module. • Relax checks on OpenSSL minor versions for OpenSSL 3.x. • Add API for deleting dynamic home servers. • Set SO_KEEPALIVE on outbound sockets, so firewalls are less likly to close TCP connections. • Allow querying of statistics when home_server has src_ipaddr set. See FreeRADIUS-Stats-Server-Src-IP-Address. Fixes #5483 • Update dictionary "man" page. Fixes #4346. • Change jlibtool to use --show-config, to avoid conflicts with clang --config. Fixes #5442. • RADIUS/TLS clients now support a tls subsection. For connections from this client, this section is used in preference to the "listen" TLS settings. This allows a server to easily present different identities to different clients. • RADIUS/TLS has been updated for TLS-PSK and TLS 1.3. Tested with radsecproxy. Bug fixes • For EAP-TLS, send TLS start without a length field. Some clients refuse to do EAP-TLS when this field exists. • Avoid blocking TLS sockets on corner cases during session setup. • Update home server stats. • Correct error message about untrusted certs. Fixes #5466. • Use PyEval_RestoreThread to swap to main thread. Fixes #5111 • Don't run Python detach function on config check. • Fix a number of issues with TLS connections and check_client_connections = yes. • Be more careful about managing the incoming queue when databases block the server. The server will still be unable to make progress, but it should crash less. Whether or not this is a good thing is unknown. • Better handler single-character expansions. Fixes #2216. • Correct calculation of EAP length in pre-proxy. Fixes #5486. • Don't segfault when using detail listeners. Fixes #5485 • Add build check for Couchbase v2, rlm_couchbase won't build on v3.

1 0

Unable to use freeradius 3.0.26 with openssl 3.0
by Amit P 31 Jan '25

31 Jan '25

Hi, I am using Freeradius version 3.0.26 for a basic authentication, My system is upgraded from Openssl 1.0.2 to 3.0.4 version and after this the authentication is failing because server is rejecting the incoming request with following message. Dropping packet without response because of error: Received packet from 10.0.0.1 with invalid Message-Authenticator! (Shared secret is incorrect.) This must be happening, because MD5 is deprecated in openssl3.0 which is used by Freeradius for calculating Message-Authenticator attribute. I could see in release notes of 3.0.26, openssl 3.0 and tls1.3 support is added. i need help with the below line from release notes. *Add configure-time FIPS workaround to use internal MD4/MD5 implementations when disabled in OpenSSL.* I believe this workaround is the solution to my problem, can you please help me in what exactly needs to be done for this workaround. Thanks & Regards, Amit

4 7

Message-Authenticator in Access-Challenge and Access-Accept
by FreeRAD 30 Jan '25

30 Jan '25

In Access-Requests I can see that the Message-Authenticator is set to a randomly generated string which I would expect. However in the Access-Challenge and Access-Accept packets it is just set to all 0s (e.g. 0x0000...). What could the reason be for a random string not being generated for the replies from the server to the NAS? I added the below in response to the BlastRADIUS vulnerability notification on the FreeRADIUS but I was under the impression that FreeRADIUS should still be generating it's own string based off of HMAC and shared secret etc. * if (!EAP-Message) { update reply { Message-Authenticator := 0x00 } }*

2 2

eapol_test
by Bill Schoolfield 29 Jan '25

29 Jan '25

I'm following https://networkradius.com/articles/2021/10/25/command-line-EAP-testing.html (well sort of)..... I installed the debian 12 package for wpa_suppliment but I don't see any files for eapol_test. I also looked at the tar file contents at https://w1.fi/releases/ and I don't see any mention there. Anybody know how to build or download eapol_test?

3 3

Attributes Limits in Radius for SQL Queries
by Ahmed Chohan 29 Jan '25

29 Jan '25

Hi, I would like to know if there is a way to increase attribute size in radius as I'm getting an error when adding vendor attributes under mysq/queries.conf with message: "... is too long. Errors reading or parsing /etc/raddb/radiusd.conf" Currently under queries.conf, there are 146 vendor-specific attributes I've added for accounting purposes but if I go over 146 vendor-specific attributes, getting the message as shared above. Furthermore, I even increased the max_attribute parameter from 200 to 0 (no limit) for testing purposes, but I still got this error. Please let me know how I can overcome this issue. -- Regards, Ahmed Munir Chohan

2 1