December 2025 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

TEAP Chaining and Partial Success Policies
by Jan Kříž 10 Feb '26

10 Feb '26

Hello everyone, I'm following up on a thread from with the subject of "EAP-TEAP not doing 2nd inner Method" from December 2024 (https://lists.freeradius.org/pipermail/freeradius-users/2024-December/10515…) about TEAP and setting network policies based on partial success (e.g., Machine cert succeeds, but User cert fails). I would specifically like to ask for clarification about something Alan DeKok wrote in the mentioned thread: > Exactly. None of the implementations (even Windows) support this workflow. I agree that the client side is a huge hurdle here, but I’m confused because some commercial platforms like Cisco ISE and Aruba ClearPass explicitly advertise and allow admins to configure different VLANs/ACLs precisely for that partial success scenario. Since the commercial vendors seem to have found a way to achieve this, are they relying on some vendor-specific extensions or a different, non-TEAP chaining method entirely? Is it possible to configure this in FreeRADIUS at all? Any insight into how FreeRADIUS could be configured to accurately process the final result and differentiate between Machine-only, User-only success and Full success would be hugely helpful. Thanks for the clarification! Best regards, Jan K.

3 5

Accept in Accounting Section
by Erdal Emlik 27 Dec '25

27 Dec '25

Hi, I have a FreeRADIUS backend–proxy setup which I was previously running on FreeRADIUS 3.2.1 without any issues. After upgrading the backend-proxy to FreeRADIUS 3.2.8, I noticed a change in behavior: for users with static IP addresses, a Message-Authenticator attribute suddenly appears in Accounting-Response packets. This only happens for sessions where the IP address is not present in radippool (i.e. static IP users). Dynamic IP (CGNAT) users do not show this behavior. My configuration has always been the same, and the default behavior did not change on my side. Below is the debug output from the proxy side showing where the Message-Authenticator is added to the Accounting-Response: 56) Proxy-State = 0x323533 (56) Clearing existing &reply: attributes (56) Received Access-Accept Id 3 from 10.2.134.250:1813 to 172.18.0.2:50949 length 43 (56) Message-Authenticator = 0xcb7e447acd6eb189578d5ec25a844b36 (56) Proxy-State = 0x323533 (56) server default { (56) } (56) Sent Accounting-Response Id 253 from 172.18.0.2:1813 to 193.192.126.156:1646 length 38 (56) Message-Authenticator = 0xcb7e447acd6eb189578d5ec25a844b36 (56) Finished request (56) Cleaning up request packet ID 253 with timestamp +5 due to done Below is the relevant part of my accounting configuration. This has been in place for a long time, and I am not sure why accept was originally used here: ippoolv4 { fail = 1 noop = 2 notfound = 3 } if (fail) { accept } if (noop) { accept } if (notfound) { accept } I could not find clear documentation explaining what accept actually does in the accounting section, and how it affects the generated response. My questions are: Does using accept here cause FreeRADIUS to internally treat this as an Access-Accept, even though this is an Accounting-Request? Could this be the reason why an Access-Accept is received from the backend on the accounting port, and why a Message-Authenticator is added to the Accounting-Response? Has the behavior of accept in accounting changed between 3.2.1 and 3.2.8? Any clarification on the semantics of accept in accounting, or pointers to relevant documentation or changelogs, would be greatly appreciated. Thanks in advance.

3 2

EAP-TLS authentication issue
by Aubin, Dylan 16 Dec '25

16 Dec '25

Hi, I try to configure a private network with a WiFi Access Point using WPA3-Enterprise with a RADIUS server on a Raspberry Pi 3 Model B with FreeRADIUS (v3.2.7) and EAP-TLS 1.3 as authentication protocol. I ran the bootstrap script file to generate the example PKI, I installed client key/certificate and CA certificate on my Windows 11 PC. It works well. However, after generating my own PKI with the same pattern (One CA generating a server certificate and a client certificate), and installing client key/certificate and CA certificate in my certificate store the same way I did for example ones, it doesn't work. >From the debug output it seems that client PC says that the server certificate is issued by an unknown CA but it is installed the same way that the example one. Also, I verified that the server certificate from my custom PKI is correct and has been issued by the custom CA whose certificate is installed in my PC's certificate store. I made sure also I added the correct usage extension for WiFi. I can't find solution on the web or similar problem, neither from Chat-GPT. Attached to this email, you will find both freeradius -X outputs from the example CA and the custom one. Also, you will find the certificates from both PKI. Have a good day, D. AUBIN

3 2

Status of version 3.0.x
by Alan DeKok 05 Dec '25

05 Dec '25

Unless there is significant support for updates to 3.0.x, we are going to declare it "EOL". The only changes to it will be patches to address any security flaws which may be discovered. There are a few reasons for this decision: * The OpenSSL APIs have changed significantly in recent years. v3.2.x has been updated to support the new APIs, but the changes have not been back-ported to the v3.0.x branch. * Back-porting these changes would require a fair bit of work. * 3.0.x currently works on older operating systems, so it can continue to be used there. * However, if the OS is upgraded, you will like need to upgrade to 3.2.x. * 3.2.x has a number of changes to the RadSec code, and it would take a significant effort to back-port those to 3.0.x. * most new OS distributions have moved to 3.2.x already. We will continue to support 3.0.x for people who are using it. But any new functionality will be in 3.2, and any new OS distributions are shipping 3.2.x. Questions or comments are welcome. Alan DeKok.

2 1

"libldap is using GnuTLS, while FreeRADIUS is using OpenSSL" ????
by Marc Fradin 04 Dec '25

04 Dec '25

Hello I just installed : *Ubuntu *24.04.2 LTS" and *FreeRADIUS *Version 3.2.5 We use our LDAP directory for authentication using the `userpasswd` field, which is encoded in SCYPT (EAP/TTLS/PAP). Everything works fine, but it's impossible to perform "LDAP over TLS or SSL" (start_tls = yes in module ldap ) Here's the error message : *!! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL !! There may be random issues with TLS connections due to this conflict. !! The server may also crash. * * !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information.* How can I fix ? Should I install another library like `libldap`? Thanks, Marc --

2 1

freeradius 3.2.8 on debian 13 Trixie Depends libperl5.36 (>= 5.36.0) while libperl5.40/stable,now 5.40.1-6 amd64 is installed
by Joost Ringoot 03 Dec '25

03 Dec '25

Hi, In Debian 13, the stable freeradius is 3.2.7 and no update in the backports On the https://www.freeradius.org/ website, the recommended stable version is 3.2.8 There is a repo for debian 12 and for ubuntu 24.04 on https://packages.inkbridgenetworks.com/#fr32-debian-bookworm https://packages.inkbridgenetworks.com/#fr32-ubuntu-noble The procedure looks identical. I tried that procedure https://packages.inkbridgenetworks.com/#fr32-debian-bookworm root@radius:/etc/apt# apt install freeradius Solving dependencies... Error! Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: Unsatisfied dependencies: freeradius : Depends: libperl5.36 (>= 5.36.0) but it is not installable Depends: libfreeradius3 (= 3.2.8-2) but it is not going to be installed Recommends: freeradius-utils but it is not going to be installed Recommends: freeradius-python3 but it is not going to be installed Error: Unable to correct problems, you have held broken packages. Error: The following information from --solver 3.0 may provide additional context: Unable to satisfy dependencies. Reached two conflicting decisions: 1. freeradius:amd64=3.2.8-2 is selected for install 2. freeradius:amd64=3.2.8-2 Depends libperl5.36 (>= 5.36.0) but none of the choices are installable: [no choices] root@radius:/etc/apt# root@radius:/etc/apt# apt search libperl5 libperl5.40/stable,now 5.40.1-6 amd64 [installed,automatic] shared Perl library root@radius:/etc/apt# I am now considering: what would be the best option: 1. install radius 3.2.7 on debian trixie from it's standard repository 2. install debian 12 and try to install radius 3.2.8 from the inkbridge repo 3. try to fool the 3.2.8 inkbridge debian package into believing that the installed libperl5.40 is libperl5.36 4. try to install freeradius 3.2.8 from the tgz on https://www.freeradius.org/releases/ on debian trixie 13 What do you suggest? Any issues that you had? Best regards, Joost

2 1