June 2025 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Accounting Tutorial scripts
by tach yon 07 Jul '25

07 Jul '25

Hi hi, I'm working through the tutorial on Accounting - to make sure I've set it properly etc; but I'm struggling to find the shell scripts that are mentioned for generating the test accounting packets. I searched the filesystem for "bob-acct-start.sh" and looked in github, but wasn't able to find them. Would someone be so kind as to point me in the right direction please? Thank you in advance for your time and consideration!

2 2

circled part a must?
by Christoph Egger 30 Jun '25

30 Jun '25

Hello, I configured freeradius 3.2.7. Authentication works for wired clients but not for wireless clients. I have contacted TP-Link for support. After some ping pong with them they finally managed to reproduce the issue. They tried various freeradius versions and report successful authentication with freeradius version 3.0.13. I tried various versions without success. Oldest version I could try is 3.0.16. They would like to know if the circled part shown in the attached screenshot is a must. Regards, Christoph

2 1

Freeradius in Docker
by Kat 30 Jun '25

30 Jun '25

Hi! I would like some data persistence in my Freeradius Docker container so I would like to add a volume of some kind (eg. bind mount) to persist the data. Which folders in the container can I safely choose to do this? I have experienced difficulties with some folders as others also appear to have experience the same thing (https://stackoverflow.com/questions/64105419/how-to-run-freeradius-using-do…) How can I have data persistence with configuration files and certificates? Admittedly I am starting to get a bit tired but I don't think I can find the answer here: https://hub.docker.com/r/freeradius/freeradius-server/ Best regards, Kat

2 1

Thank you, and freeradius mode?
by Kat 30 Jun '25

30 Jun '25

Firstly, 1. Thanks to Alan for letting me know that the freeradius image on Dockerhub does support EAP-TLS. That's very helpful :-) 2. Any by the process of logically writing out my question, I have solved my next problem. 3. Third problem: how can I tell if I have successfully started freeradius in debug mode? freeradius -v does not say which mode it is running in. Despite my attempts to start in debug mode, I suspect it is not in debug mode. This is how the Bob initial test result looks: Sent Access-Request Id 217 from 0.0.0.0:49095 to 127.0.0.1:1812 length 73 User-Name = "bob" User-Password = "test" NAS-IP-Address = 172.17.0.6 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "test" Received Access-Accept Id 217 from 127.0.0.1:1812 to 127.0.0.1:49095 length 38 Message-Authenticator = 0xdf169e01bb4399fada2b31bbde5e7ff3 So is it possible to tell from this whether freeradius is running in debug mode? Thank you! Kat

2 1

New vendor dictionary files - proper process to submit ?
by BuzzSaw Code 27 Jun '25

27 Jun '25

We found that F5 has updated their dictionary at the end of 2024 for some of their newest devices. What is the proper way to provide this so it can be added to future FreeRADIUS releases ? Reference - https://my.f5.com/manage/s/article/K14324 - A pull request on Github with the diff ? - An issue on Github attaching the updated dictionary ? - Have the vendor follow one of the above options so it comes direct from them ? - Something else ?

2 1

Problem with 802.1X and EAP-PEAP configuration
by Peter Sprenger 27 Jun '25

27 Jun '25

Hi, I have problem with 802.1X and after some time I am really desperated: - I am writing an Embedded Ansi C client that already supports EAP-TLS, EAP-TTLS PAP and EAP-TTLS CHAP. Now I thought EAP-PEAP would not be so hard. But with the FreeRadius config I cannot get the outer TLS-tunnel running. The TLS 1.2 connection gets rejected from my SSL library "ASN parsing error, invalid input". For EAP-TLS and EAP-TTLS I have no problem with TLS 1.2 and TLS 1.3 connections. - I tried to work with eapol_test and there is the same picture: EAP-TLS, EAP-TTLS PAP and EAP-TTLS CHAP are working, but for EAP-PEAP the outer TLS connection gets refused. - From ChatGPT I got the info, that TLS 1.3 may cause problems to EAP-PEAP. So I have restricted the client and the FreeRadius server to TLS 1.2. No success. Any help or idea what be very appreciated! Best Regards, Peter

2 1

Unlang policy to remove duplicate attributes from reply?
by tach yon 25 Jun '25

25 Jun '25

Hello, I've spent many hours searching the docs, examples, list posts, etc, plus AI generators - testing as many permutations I can think of - trying to find the correct syntax and method to do this with Unlang, but nothing seems to work 🙁 I'll try to explain in sudo-code what I mean: if (number of Framed-IP-Address attributes > 1) { update control { # Save the first Framed-IP-Address to a temporary String (because I read ipaddr type isn't available). &Tmp-String-0 := &reply:Framed-IP-Address[0] } update reply { # Remove all Framed-IP-Address entries currently in the reply. &Framed-IP-Address !* ANY # Re-create Framed-IP-Address with the first value we saved temporarily. # Cast as ipaddr because Framed-IP-Address needs that data type. &Framed-IP-Address := (ipaddr) &control:Tmp-String-0 } } Everything I've tried is either invalid syntax, or a comma is expected after the cast statement, or freeradius cannot resolve to IP address, or it just doesn't work. It's starting to drive me crazy 🙁 If anyone could please help me understand what I'm doing wrong, it would be very much appreciated. Thank you in advance for your time and consideration!

3 4

Freeradius docker
by Kat 25 Jun '25

25 Jun '25

Gday, I am new to Freeradius, radius, WPA Enterprise, EAP-TLS, etc. So I created a Docker container with Freeradius (https://hub.docker.com/r/freeradius/freeradius-server/) and I was looking at this tutorial: https://www.freeradius.org/documentation/freeradius-server/4.0.0/tutorials/… I do note that the tutorial appears to be listed for FreeRadius 4 BUT the page itself says that it is not yet updated for 4. So it means it applies to version 3??? In that tutorial it refers to three files, ( rlm_eap.so, but also rlm_tls_md5.so and rlm_eap_tls.so). I cannot find rlm_tls_md5.so in the Docker container. Does this mean that the docker container as is cannot run WPA-3 EAP-TLS Enterprise? if not, is there something I can do to change that? Can I add files or do I need to download and build freeradius in a docker container to make it work? Extra information in case it is needed: What you are trying to do: We are trying to get a WPA-3 Enterprise testing environment up and running and we are mostly using what we already have. We have a Unifi Wireless Access Point, and running UniFi Network Controller on a Synology NAS through a Docker environment in Portainer. FreeRadius is also running in a Docker container in that same Portainer. why you are trying to do it: I did originally try Synology Radius and did get that working BUT that doesn't support EAP-TLS which is what we are looking for here. And that is why I have Switched to FreeRadius which should support EAP-TLS but now I am unsure if the Free radius image from Freeradius does support EAP-TLS. what you expect the server to do: Run EAP-TLS for WPA-3 Enterprise. Best regards, Kat

2 1