September 2025 - Freeradius-Users - lists.freeradius.org

Relationship between Thread Pool and Sql Pool
by Erdal Emlik 10 Sep '25

10 Sep '25

Hi, I would like to ask about how the SQL connection pool works in FreeRADIUS. Does each thread use a separate connection from the pool, or can the same connection be used simultaneously by multiple threads? Can I basically say 1 Accounting/Access Request = 1 Thread = 1 Connection from pool?

2 1

How to extract vendor specific information from Sub-Option 9 of Option 82
by Ľudovít Mikula 06 Sep '25

06 Sep '25

Hi all, is it possible to automatically decode Vendor Specific Information from inocoming DHCP packet in freeradius 3.2.28? In DHCP Discover Option 82 -> Sub-Option 9 I am receiving vendor specific information and I'd like to have it automatically decoded. If I got the docs right, I need to create a dictionary and then the defined attributes should be accessible by %{dhcp_options:<Attribute-ref>} (after enabling dhcp mod) I am a bit struggling with writing the dictionary tbh (I've checked also the suggested dictionary.alcatel.sr and dictionary.erx). I am interested in two TLVs: enterprise number: 0000061b (dec: 1563) 03: length: 0a (dec: 10) data: 444d 5a2d 434f 532d 3032 ("DMZ-COS-02") 01: length: 0e (dec: 14) data: 4554 492d 5250 442d 504f 5254 2d30 ("ETI-RPD-PORT-0") I was able to get the information with "unpack" from DHCP-Vendor-Specific-Information but am wondering whether this can be achieved by defining a custom dictionary and using dhcp_options ? Regards -- Ľudovít Mikula

2 3

Certificate validation in rest module fails
by Murali Krishnamoorthy 06 Sep '25

06 Sep '25

Hello, I am using a https api in rest module with mutual tls enabled. The freeradius 3.2.8 gives me an error message that the peer certificate is not valid. However, I am able to use the same certificates with the same url to make the tls connection. What could be the problem here? --- With "check_cert = no", the rest api is able to make the mtls connection. But I would like to also have the server certificate validation enabled. --- Freeradius debug output below: FreeRADIUS Version 3.2.8 Copyright (C) 1999-2025 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT FreeRADIUS is developed, maintained, and supported by InkBridge Networks. For commercial support, please email sales(a)inkbridgenetworks.com https://inkbridgenetworks.com/ Starting - reading configuration files ... including dictionary file /opt/share/freeradius/dictionary including dictionary file /opt/share/freeradius/dictionary.dhcp including dictionary file /opt/share/freeradius/dictionary.vqp including configuration file /opt/etc/raddb/radiusd.conf including configuration file /opt/etc/raddb/clients.conf including files in directory /opt/etc/raddb/mods-enabled/ including configuration file /opt/etc/raddb/mods-enabled/preprocess including configuration file /opt/etc/raddb/mods-enabled/pap including configuration file /opt/etc/raddb/mods-enabled/files including configuration file /opt/etc/raddb/mods-enabled/rest_auth_log including configuration file /opt/etc/raddb/mods-enabled/realm including files in directory /opt/etc/raddb/sites-enabled/ including configuration file /opt/etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radacct" hostname_lookups = no max_request_time = 30 proxy_dedup_window = 1 cleanup_delay = 5 max_requests = 256 max_fds = 512 postauth_client_lost = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 0 reject_delay = 0.000000 delay_proxy_rejects = no status_server = no require_message_authenticator = "auto" limit_proxy_state = "auto" allow_vulnerable_openssl = "no" } unlang { group_stop_return = no policy_stop_return = no } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client radtest { ipaddr = 0.0.0.0/0 secret = <<< secret >>> proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Shared secret for client radtest is short, and likely can be broken by an attacker. Found debugger attached Configuration version: 0da7-aa84-14bb-36bd # Creating Auth-Type = PAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_preprocess # Loading module "preprocess" from file /opt/etc/raddb/mods-enabled/preprocess preprocess { with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_pap # Loading module "pap" from file /opt/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_files # Loading module "files" from file /opt/etc/raddb/mods-enabled/files files { usersfile = "/opt/etc/raddb/users" } # Loaded module rlm_rest # Loading module "rest_auth_failure_log" from file /opt/etc/raddb/mods-enabled/rest_auth_log rest rest_auth_failure_log { connect_timeout = 4.000000 http_negotiation = "default" } # Loaded module rlm_realm # Loading module "IPASS" from file /opt/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /opt/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /opt/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /opt/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /opt/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Instantiating module "preprocess" from file /opt/etc/raddb/mods-enabled/preprocess # Instantiating module "pap" from file /opt/etc/raddb/mods-enabled/pap # Instantiating module "files" from file /opt/etc/raddb/mods-enabled/files reading pairlist file /opt/etc/raddb/users # Instantiating module "rest_auth_failure_log" from file /opt/etc/raddb/mods-enabled/rest_auth_log post-auth { uri = "https://auth.feature-devops.qa.xcloudiq.com:8443/auth/log-event" method = "post" body = "json" attr_num = no raw_value = no data = "{"Auth-Result": "FAILURE", "Message":"%{Reply-Message}", "User-Name": "%{User-Name}", "NAS-Identifier": "%{NAS-Identifier}", "NAS-Port-Type": "%{NAS-Port-Type}", "NAS-IP-Address": "%{NAS-IP-Address}", "NAS-Port": "%{NAS-Port}", "NAS-Port-Id": "%{NAS-Port-Id}", "Called-Station-Id": "%{Called-Station-Id}", "Calling-Station-Id": "%{Calling-Station-Id}", "EAP-Message": "%{EAP-Message}"}" auth = "none" require_auth = no timeout = 4.000000 chunk = 0 tls { ca_file = "/etc/certs/craas-ca.pem" certificate_file = "/etc/certs/client.pem" private_key_file = "/etc/certs/client.key" check_cert = yes check_cert_cn = yes } body_uri_encode = yes } rlm_rest: libcurl version: libcurl/8.12.1 OpenSSL/3.3.4 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 c-ares/1.34.5 libidn2/2.3.7 libpsl/0.21.5 nghttp2/1.64.0 rlm_rest (rest_auth_failure_log): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 max_retries = 5 spread = no } rlm_rest (rest_auth_failure_log): Opening additional connection (0), 1 of 10 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified rlm_rest (rest_auth_failure_log): Opening additional connection (1), 1 of 9 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified rlm_rest (rest_auth_failure_log): Opening additional connection (2), 1 of 8 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified rlm_rest (rest_auth_failure_log): Opening additional connection (3), 1 of 7 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified rlm_rest (rest_auth_failure_log): Opening additional connection (4), 1 of 6 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified # Instantiating module "IPASS" from file /opt/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /opt/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /opt/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /opt/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /opt/etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /opt/etc/raddb/radiusd.conf } # server server default { # from file /opt/etc/raddb/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type # Loading authorize {...} # Loading preacct {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Ready to process requests !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! BlastRADIUS check: Received packet with Message-Authenticator. Setting "require_message_authenticator = true" for client radtest !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! It looks like the client has been updated to protect from the BlastRADIUS attack. Please set "require_message_authenticator = true" for client radtest !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) Received Access-Request Id 209 from 172.25.0.2:42843 to 172.25.0.20:1812 length 78 (0) Message-Authenticator = 0x8313e1ea17ab9e92ecbe637497d3d878 (0) User-Name = "testuser" (0) User-Password = "password123" (0) NAS-IP-Address = 172.25.0.2 (0) NAS-Port = 0 (0) # Executing section authorize from file /opt/etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /opt/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { rlm_rest (rest_auth_failure_log): Reserved connection (0) (0) rest_auth_failure_log: Expanding URI components (0) rest_auth_failure_log: EXPAND https://auth.feature-devops.qa.xcloudiq.com:8443 (0) rest_auth_failure_log: --> https://auth.feature-devops.qa.xcloudiq.com:8443 (0) rest_auth_failure_log: EXPAND /auth/log-event (0) rest_auth_failure_log: --> /auth/log-event (0) rest_auth_failure_log: Sending HTTP POST to " https://auth.feature-devops.qa.xcloudiq.com:8443/auth/log-event" (0) rest_auth_failure_log: EXPAND {"Auth-Result": "FAILURE", "Message":"%{Reply-Message}", "User-Name": "%{User-Name}", "NAS-Identifier": "%{NAS-Identifier}", "NAS-Port-Type": "%{NAS-Port-Type}", "NAS-IP-Address": "%{NAS-IP-Address}", "NAS-Port": "%{NAS-Port}", "NAS-Port-Id": "%{NAS-Port-Id}", "Called-Station-Id": "%{Called-Station-Id}", "Calling-Station-Id": "%{Calling-Station-Id}", "EAP-Message": "%{EAP-Message}"} (0) rest_auth_failure_log: --> {"Auth-Result": "FAILURE", "Message":"", "User-Name": "testuser", "NAS-Identifier": "", "NAS-Port-Type": "", "NAS-IP-Address": "172.25.0.2", "NAS-Port": "0", "NAS-Port-Id": "", "Called-Station-Id": "", "Calling-Station-Id": "", "EAP-Message": ""} *(0) rest_auth_failure_log: ERROR: Request failed: 60 - SSL peer certificate or SSH remote key was not OK* (0) rest_auth_failure_log: ERROR: Server returned no data rlm_rest (rest_auth_failure_log): Released connection (0) (0) [rest_auth_failure_log] = fail (0) } # Post-Auth-Type REJECT = fail (0) Sent Access-Reject Id 209 from 172.25.0.20:1812 to 172.25.0.2:42843 length 38 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 209 with timestamp +17 due to cleanup_delay was reached Ready to process requests ------ Using curl from the same container: # curl -v https://auth.feature-devops.qa.xcloudiq.com:8443/auth/log-event \ > --cert /etc/certs/client.pem \ > --key /etc/certs/client.key \ > --cacert /etc/certs/craas-ca.pem \ > --data '{"authResult": "SUCCESS", "message": "test"}' \ > -H "Content-Type: application/json" * Host auth.feature-devops.qa.xcloudiq.com:8443 was resolved. * IPv6: (none) * IPv4: 3.150.3.32, 3.19.113.11 * Trying 3.150.3.32:8443... * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/certs/craas-ca.pem * CApath: /etc/ssl/certs * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Request CERT (13): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Certificate (11): * TLSv1.3 (OUT), TLS handshake, CERT verify (15): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / x25519 / RSASSA-PSS * ALPN: server accepted h2 * Server certificate: * subject: CN=auth.feature-devops.qa.xcloudiq.com * start date: Aug 21 10:48:40 2025 GMT * expire date: Apr 13 10:49:06 2027 GMT * subjectAltName: host "auth.feature-devops.qa.xcloudiq.com" matched cert's "auth.feature-devops.qa.xcloudiq.com" * issuer: CN=example.com ** SSL certificate verify ok.* * Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * Connected to auth.feature-devops.qa.xcloudiq.com (3.150.3.32) port 8443 * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://auth.feature-devops.qa.xcloudiq.com:8443/auth/log-event * [HTTP/2] [1] [:method: POST] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: auth.feature-devops.qa.xcloudiq.com:8443] * [HTTP/2] [1] [:path: /auth/log-event] * [HTTP/2] [1] [user-agent: curl/8.12.1] * [HTTP/2] [1] [accept: */*] * [HTTP/2] [1] [content-type: application/json] * [HTTP/2] [1] [content-length: 44] > POST /auth/log-event HTTP/2 > Host: auth.feature-devops.qa.xcloudiq.com:8443 > User-Agent: curl/8.12.1 > Accept: */* > Content-Type: application/json > Content-Length: 44 ----- Using openssl from the same container: # openssl s_client -connect auth.feature-devops.qa.xcloudiq.com:8443 -servername auth.feature-devops.qa.xcloudiq.com -showcerts -CAfile /etc/certs/craas-ca.pem -cert /etc/certs/client.pem -key /etc/certs/client.key Connecting to 3.19.113.11 CONNECTED(0000000C) depth=1 CN=example.com verify return:1 depth=0 CN=auth.feature-devops.qa.xcloudiq.com verify return:1 --- Certificate chain 0 s:CN=auth.feature-devops.qa.xcloudiq.com i:CN=example.com a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Aug 21 10:48:40 2025 GMT; NotAfter: Apr 13 10:49:06 2027 GMT -----BEGIN CERTIFICATE----- MIID5jCCAs6gAwIBAgITMmRgH5Qu0MLxEf/HtpvN9ukxBDANBgkqhkiG9w0BAQsF ADAWMRQwEgYDVQQDEwtleGFtcGxlLmNvbTAeFw0yNTA4MjExMDQ4NDBaFw0yNzA0 MTMxMDQ5MDZaMC4xLDAqBgNVBAMTI2F1dGguZmVhdHVyZS1kZXZvcHMucWEueGNs b3VkaXEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnSi/OpCZ oCklple6nG5i+RJtpBPyVtmEs2SNFnFfztdRYRERLA8HjvzwOzvOHAY7LiN7WoCN 1oxl6pEcGCuQYngUpGeF/wXRj3MI3kRdlA5Hi+S/D8oM4F5I+oE5OE4R04zXh5zP Fxtrkec1F67CWLi7RFJzWKuyaXVpH3Ge5U8r7mItz5VmKoOCaaE43nq+R1uXurxm 2rS+VgirDklqcZknNNTIlQe75Omhy3pFXX6lp3pmFCmJHNa8YiZH1IdCrt5kAoup 3RkRfeqAqKXqxfNUUi1FvYleho64OBWCf+g7Bv0tHeG1ZaruqIxaQmm17bmoWiNL ByZ8I2IQYOC27QIDAQABo4IBEzCCAQ8wDgYDVR0PAQH/BAQDAgOoMB0GA1UdJQQW MBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUbayxOWLxD6AMBItZUd7O JpzFDnswHwYDVR0jBBgwFoAURsoapNlzJJEMyTV66SO8zP85RyAwOwYIKwYBBQUH AQEELzAtMCsGCCsGAQUFBzAChh9odHRwOi8vMTI3LjAuMC4xOjgyMDAvdjEvcGtp L2NhMC4GA1UdEQQnMCWCI2F1dGguZmVhdHVyZS1kZXZvcHMucWEueGNsb3VkaXEu Y29tMDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly8xMjcuMC4wLjE6ODIwMC92MS9w a2kvY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQCgksYhW1qTb5ajFGBu8xTWW04QnxI2 8VH4r3m2uQe0Mjl+eoMB/QxnOANQbmSO3QScbW8sQL/nw0kGHH3mdeLSpSatE3ix tzM1Sp/RUywMTmKJZuSGEm/3TSIAq7ZEmk1i/ohXm9npXptkc7r66OFp66UwT8MP fN8pT4ffgJYOUMWv8NBNre3qHrBSoB3Lmq4WS4ZYel7U3yhXcqfwLtzCyEvgSERW mDLRVFkYwR1mjasRGaaRTmn/P/IdNaFUPb6r8jmUTvIim/yZOsW6vaNGMQqCOa9s iDXRteuNTVVXbvuT1/RJRkVfPmaBOBXcrbEYB2LXeyyAl2A5WwhfcKbD -----END CERTIFICATE----- --- Server certificate subject=CN=auth.feature-devops.qa.xcloudiq.com issuer=CN=example.com --- Acceptable client certificate CA names CN=example.com Requested Signature Algorithms: RSA-PSS+SHA256:ECDSA+SHA256:ed25519:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA384:ECDSA+SHA512:RSA+SHA1:ECDSA+SHA1 Shared Requested Signature Algorithms: RSA-PSS+SHA256:ECDSA+SHA256:ed25519:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA384:ECDSA+SHA512 Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 1641 bytes and written 2531 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256 Server public key is 2048 bit This TLS version forbids renegotiation. No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- --- Post-Handshake New Session Ticket arrived: SSL-Session: Protocol : TLSv1.3 Cipher : TLS_AES_128_GCM_SHA256 Session-ID: 59BA87B9568BB087AD6E74F9A1488D0D9EF4F504465A77CB1D64127D28099D93 Session-ID-ctx: Resumption PSK: 25BA17E099AE416784ABFA9B70EED3F040BA03239E9DA3E118320ACA843E9EB4 PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 604800 (seconds) TLS session ticket: 0000 - 51 ec 04 b8 20 fd 94 97-09 ff ca 67 c4 40 8f 4b Q... ......g.@ .K 0010 - 41 b5 53 4a ad 4e fd f2-bd 38 ab 70 ff 2c 58 e3 A.SJ.N...8.p.,X. 0020 - d8 b7 52 5a 3c c1 88 f8-b3 eb da 20 58 95 84 fc ..RZ<...... X... 0030 - 17 4c 15 24 30 29 00 26-50 68 0d 17 bd 54 80 ff .L.$0).&Ph...T.. 0040 - d7 35 67 0b b5 47 71 99-cf 0a 04 14 80 89 38 c5 .5g..Gq.......8. 0050 - cf 3b ec 9b 30 3c 07 6f-69 b6 f1 e8 67 46 54 b2 .;..0<.oi...gFT. 0060 - 8f 78 33 fe ec 73 06 d6-d3 82 bf e0 4b 29 6b 11 .x3..s......K)k. 0070 - 68 52 4d 20 56 3d 0c c5-66 19 b3 b4 33 34 a1 a2 hRM V=..f...34.. 0080 - a2 bb a2 6f 64 d9 ab f7-e1 20 a9 34 31 df 00 c1 ...od.... .41... 0090 - 97 37 77 9e 05 03 f1 f6-b7 7a 3a 64 5a 6a 05 ba .7w......z:dZj.. 00a0 - 7e b6 74 eb 67 94 d7 66-a7 4e fc 07 5b e0 7c 74 ~.t.g..f.N..[.|t 00b0 - 03 0d 2a ac 64 28 98 08-6a e4 3b e4 4b 93 b3 c9 ..*.d(..j.;.K... 00c0 - 16 0f b4 6b 09 ea 31 97-d6 79 f3 bd 58 31 c8 17 ...k..1..y..X1.. 00d0 - 54 df 9d bf 25 00 98 15-37 58 4e 3b 06 8a 15 87 T...%...7XN;.... 00e0 - 81 48 79 44 4a 09 6e 8d-dc 94 6f 7e d0 36 1a 04 .HyDJ.n...o~.6.. 00f0 - 61 80 4c ca a5 8c cb 4f-40 3f ad ef 6c 5a ee fb a.L....O@ ?..lZ.. 0100 - d9 a4 ca e5 43 d3 62 4c-5c 88 84 7d 47 69 0c f5 ....C.bL\..}Gi.. 0110 - b9 38 93 a4 df e3 2a cd-34 8e d8 82 90 95 25 76 .8....*.4.....%v 0120 - 92 5f 2d f0 8a a7 12 5b-f4 7a 46 2d d5 52 82 f5 ._-....[.zF-.R.. 0130 - ff b6 64 88 d0 6f e4 27-e6 b7 f3 f9 6f db a1 77 ..d..o.'....o..w 0140 - 15 49 6d 98 19 c0 ef 75-ba 62 39 b1 5a d1 d9 29 .Im....u.b9.Z..) 0150 - 65 1e 11 3d 19 2f 6d 8b-a7 79 cf 12 2a fa 64 df e..=./m..y..*.d. 0160 - 34 a1 81 fe 16 e2 ab 37-7b a5 81 c5 e0 be 63 96 4......7{.....c. 0170 - 27 5a db 84 05 44 13 67-10 80 67 9c f8 cd e8 5e 'Z...D.g..g....^ 0180 - 53 a1 c8 55 20 30 7f fc-03 8a 58 ac 27 fc 7b ab S..U 0....X.'.{. 0190 - c9 30 97 06 68 72 69 ed-78 76 23 f8 46 1c b7 3a .0..hri.xv#.F..: 01a0 - 2d c0 b8 98 66 21 32 67-46 e8 63 e0 06 76 e2 e9 -...f!2gF.c..v.. 01b0 - 8e 42 d4 cd 9c 91 b8 14-ae 23 3a 29 04 c9 78 8e .B.......#:)..x. 01c0 - b7 39 fe 46 55 af 5c 2b-56 cb 06 1f 38 d8 91 df .9.FU.\+V...8... 01d0 - 12 d0 6b c5 00 f5 e2 33-7c 96 b5 22 f9 cd 66 95 ..k....3|.."..f. 01e0 - 52 ff ef 8a 2e 80 a9 35-82 8b 8e 4c 42 d2 96 4e R......5...LB..N 01f0 - d2 61 6f da db 87 1a 21-f0 51 98 62 c7 12 8b b5 .ao....!.Q.b.... 0200 - a4 3f ac ca 76 bc d5 26-e0 a5 a9 a8 2e bc 7b 42 .?..v..&......{B 0210 - ac 3a 65 d2 67 b8 7a d3-b5 7a 83 73 67 ee 28 5c .:e.g.z..z.sg.(\ 0220 - d4 62 0a 68 a8 e3 a0 43-f8 ba f8 bc 7c ed 5a 94 .b.h...C....|.Z. 0230 - 01 6a 96 01 e5 95 0a b3-41 92 10 ba 9d 7c 5f 21 .j......A....|_! 0240 - cc 03 a3 49 d8 c2 02 3b-08 1e e2 63 9a 20 12 30 ...I...;...c. .0 0250 - 78 f6 5d 94 8f 76 97 0a-e3 cb 12 52 90 b6 6f 03 x.]..v.....R..o. 0260 - 3e a2 fe 80 f7 02 16 19-65 0a 70 0e 5a a9 95 39 >.......e.p.Z..9 0270 - 14 94 b6 d6 12 e5 86 67-43 7f 7e 39 2f 68 25 e1 .......gC.~9/h%. 0280 - ad eb d6 e5 e8 93 55 4b-70 83 1e 17 ea ca 26 20 ......UKp.....& 0290 - 47 b7 d6 32 d2 2f 25 19-8b d5 a5 ee fc bc 84 35 G..2./%........5 02a0 - 29 1c 1b d7 7b 48 b5 66-3a 17 b3 a9 de 56 cf f2 )...{H.f:....V.. 02b0 - df 35 9d 98 cb 38 cb 71-f9 65 64 4f fe 2b 13 4d .5...8.q.edO.+.M 02c0 - 44 da ed d1 41 5a 61 95-73 b2 dc 71 43 72 68 a0 D...AZa.s..qCrh. 02d0 - 6e a2 0a a2 b0 d2 b3 8a-32 93 e4 87 31 fc f3 e9 n.......2...1... 02e0 - 75 45 2a e4 04 8a ff 3e-ca 9f af a0 b4 3e 65 49 uE*....>.....>eI 02f0 - 54 a6 a0 cc 7c e4 a2 f9-03 62 75 d8 57 ef 8a 41 T...|....bu.W..A 0300 - 5e 7a 5c bf b6 64 5e 86-aa 1c fb 17 c7 68 c2 da ^z\..d^......h.. 0310 - 47 8d ac 22 d8 fe 5b dd-bc ca 3e f0 8b 2d b2 25 G.."..[...>..-.% 0320 - 88 56 c5 e2 21 09 aa af-61 4d fb 58 5f a3 9a 29 .V..!...aM.X_..) 0330 - 06 2c 59 be c9 c7 d9 7e-c4 e0 74 58 c4 30 2a f4 .,Y....~..tX.0*. 0340 - 00 25 30 97 bd 79 47 e4-51 3a 89 e0 27 61 f8 dd .%0..yG.Q:..'a.. 0350 - 97 b0 dc da 00 ab c2 58-53 83 ec 6d 35 37 e0 d5 .......XS..m57.. 0360 - 6c 1d 90 84 49 b3 5f f4-5a 37 4c 52 12 c9 2a e9 l...I._.Z7LR..*. 0370 - 7f 74 6f c0 dd c5 ff d5-78 80 76 cd 49 dd 94 2e .to.....x.v.I... 0380 - a0 5a 68 6c 58 aa d0 f3-e9 a7 53 fc 1a 56 6b fe .ZhlX.....S..Vk. 0390 - a9 f4 be a3 ff 95 be 9d-ed c7 02 99 59 e6 bc eb ............Y... 03a0 - 16 bd 58 da c3 1f e5 bf-3f d1 80 59 48 42 e6 f3 ..X.....?..YHB.. 03b0 - 60 d4 4f a8 4f e7 2a ea-8e 64 2b 81 30 1e a2 89 `.O.O.*..d+.0... 03c0 - 09 e0 ad 5f 8b 4a 6b 60-bd 64 a8 db ef ab bf 42 ..._.Jk`.d.....B 03d0 - 48 37 b7 08 c5 17 18 62-c2 f9 a8 76 d7 a1 9f d6 H7.....b...v.... 03e0 - 71 1f d5 8f 6b a4 fa 2d-c4 9b f9 63 95 57 74 73 q...k..-...c.Wts 03f0 - 1f ea 6d 1a f9 c1 57 62-72 47 cc f2 0b 3e 8e 5a ..m...WbrG...>.Z 0400 - fd 71 05 c3 97 10 28 d7-9b db a7 14 46 fb f3 f3 .q....(.....F... 0410 - 56 ed 70 16 29 da 4e f8-8c a4 cf 78 50 e8 0e 11 V.p.).N....xP... 0420 - d2 ef 9b d5 ec 8f f7 57-64 eb 5b 0c b0 54 ad f2 .......Wd.[..T.. 0430 - 4c 70 8a 82 87 48 12 4d-38 37 6f d0 0f d5 17 94 Lp...H.M87o..... 0440 - 27 64 9a 7c 32 83 5a 6e-1d e6 83 80 14 64 9c b5 'd.|2.Zn.....d.. 0450 - b2 f0 05 4f c1 c0 67 58-a3 c9 a4 e2 7a 00 c8 dd ...O..gX....z... 0460 - 7d a4 f1 30 b4 c7 4e f6-56 f4 b5 4b b7 6e ce cc }..0..N.V..K.n.. 0470 - b0 f5 f5 5f 0d e7 96 04-31 eb 88 44 f1 7b d6 92 ..._....1..D.{.. 0480 - df 5a 83 ca c3 67 86 69-56 11 90 0f 8b 3a 6e b7 .Z...g.iV....:n. 0490 - f5 7a 0a 8d ee bc 3d b7-a7 06 4c 87 4c 39 9e be .z....=...L.L9.. 04a0 - 75 df aa 06 f6 b3 8b c1-b5 e6 e8 82 36 65 b2 e1 u...........6e.. 04b0 - 38 c8 ef 2d 7d c0 6a 06-9e 01 1d 5a de c5 09 57 8..-}.j....Z...W 04c0 - cf 5d 3a c5 10 1c 71 ef-de 60 80 66 c3 1d 28 35 .]:...q..`.f..(5 04d0 - 81 59 36 88 4c 06 c2 e2-9b fa f3 d4 7c 36 85 c2 .Y6.L.......|6.. 04e0 - a8 48 e5 b2 85 1c 71 73-59 fc 5b f4 a1 10 db 40 .H....qsY.[....@ 04f0 - ab 93 0e e2 b7 7f 44 9f-85 1d d4 a9 45 e8 b3 44 ......D.....E..D 0500 - 3e 95 f0 be 2d 6f 20 ee-5b 47 47 f7 23 76 a8 3d >...-o .[GG.#v.= 0510 - 89 46 5a 9d 1e c5 ed c9-97 6e 8e 87 81 16 88 df .FZ......n...... 0520 - 5a d4 a3 a2 9d bb 2a b7-48 28 07 3b 59 ba 84 06 Z.....*.H(.;Y... 0530 - 44 81 80 cf 0c d3 85 db-2c af bc 5b e9 03 76 e3 D.......,..[..v. 0540 - 67 b3 9f aa b8 42 86 15-02 cb 9a af fd da 4e c1 g....B........N. 0550 - 39 ae c9 0f da 73 2c 88-a2 11 2a 3f 7f 7e 09 c8 9....s,...*?.~.. 0560 - bf 9b 02 34 57 de bd 13-f8 67 29 e7 a8 8d ee 39 ...4W....g)....9 0570 - 19 50 51 00 01 16 70 84-18 38 b7 28 7b 3d ee ae .PQ...p..8.({=.. 0580 - e0 06 45 28 c2 22 ee 59-72 08 10 1e 3d 72 14 14 ..E(.".Yr...=r.. 0590 - e7 68 97 59 b2 6d 4f a3-c9 0d fd db a5 2d 95 33 .h.Y.mO......-.3 05a0 - a0 63 03 f2 59 9f 39 40-77 e1 f8 14 fd ee 66 ba .c..Y.9@w. ....f. 05b0 - d5 b8 20 fb 25 90 1c 7b-d9 5a 9c e6 a6 08 29 01 .. .%..{.Z....). 05c0 - 9e 94 45 e2 43 51 ad 03-cc 3f 38 f5 b4 c7 cd da ..E.CQ...?8..... 05d0 - 54 f0 75 62 aa 5a e4 35-99 a5 6f c8 2a b4 c2 ba T.ub.Z.5..o.*... 05e0 - 13 45 ca ab a1 e3 c8 37-65 b9 c0 8e 55 57 2a 72 .E.....7e...UW*r 05f0 - df 1a f3 51 e5 68 cc 05-c4 b6 9a b0 19 c8 bf a4 ...Q.h.......... 0600 - c1 fe 8e d9 19 05 8e 21-a1 ac 5e be 64 60 1f 89 .......!..^.d`.. 0610 - 51 b4 3d 34 c6 49 49 1d-2e 3a 25 0a b0 f0 88 37 Q.=4.II..:%....7 0620 - 88 59 e6 62 ff 7d f2 c9-6a f5 d4 15 46 23 56 81 .Y.b.}..j...F#V. 0630 - c7 32 33 9f 2e b1 9c d8-e7 52 ab 5f e9 ff 54 40 .23......R._..T@ 0640 - fe 7b f9 65 92 55 35 1f-98 af ff b6 57 39 94 3c .{.e.U5.....W9.< 0650 - f1 29 62 af 89 99 fe 0b-e7 0c 8a ac 05 1b e6 08 .)b............. 0660 - 24 2c fa c7 7f 26 d6 99-2e 1b 39 f2 d5 01 3b b7 $,...&....9...;. 0670 - 67 9f f1 a8 7e fd e3 f3-f9 be 9f e4 06 6f 04 36 g...~........o.6 0680 - 19 9f 05 c0 6d b7 2c 44-74 30 08 6d 6a cf 5d 17 ....m.,Dt0.mj.]. 0690 - 1d 2b 19 02 60 99 ca 5f-9e 54 f4 61 ef 98 b2 19 .+..`.._.T.a.... 06a0 - 18 c9 2f 63 c8 59 49 f6-61 2d 25 91 27 0d 09 e1 ../c.YI.a-%.'... 06b0 - ee c7 be a2 d1 7c f3 a3-e5 6f 31 aa cf ac e4 0b .....|...o1..... 06c0 - e6 47 71 a6 74 ba 2d ba-02 c4 e5 b6 ae 8e 15 9e .Gq.t.-......... 06d0 - b2 bf 66 84 e6 d3 d1 06-ca 4b 14 a3 16 63 ee cd ..f......K...c.. 06e0 - e5 19 3c 0f 4c 57 31 32-07 03 b8 7a 95 8e 04 d7 ..<.LW12...z.... 06f0 - 0f 41 7d 06 6f 80 14 f6-ce ec f1 d6 8a 85 5b 98 .A}.o.........[. 0700 - 7b e4 6c 5c 2e 86 c7 e3-27 25 fd c8 02 ec 20 0c {.l\....'%.... . 0710 - 33 6e 05 70 76 e5 63 3f-af d0 97 25 8b e8 41 1c 3n.pv.c?...%..A. 0720 - f1 c9 c2 80 ba ef 2c cf-af e4 b2 b7 a2 53 a7 8c ......,......S.. 0730 - fb 24 b2 e5 65 8a 71 4b-06 a4 fe fc d5 91 16 7b .$..e.qK.......{ 0740 - 44 fa 3c 5e a0 f3 b1 1b-0c 03 2a 91 4b c8 68 7d D.<^......*.K.h} 0750 - d1 aa 5b 86 8b 1d 77 fa-9f 2b f9 19 0c 0d 9b eb ..[...w..+...... 0760 - 47 69 03 b3 2e f9 c5 29-f5 e7 ff 7d 9e 81 24 e8 Gi.....)...}..$. 0770 - 56 ed 22 cf a3 87 19 77-05 55 9f d1 9c 89 1e 6c V."....w.U.....l 0780 - 32 c8 f1 5d 85 21 bd 21-3c 22 43 bb 0f 3e 53 e3 2..].!.!<"C..>S. 0790 - b7 b3 cc fa 7e 83 55 c0-cb 36 1e 67 a4 fa 97 1b ....~.U..6.g.... 07a0 - 2f 5a 7f 14 8a d8 e1 6f-ca c8 ca f1 e6 b2 fc c8 /Z.....o........ 07b0 - 37 15 1b 8e bf 25 61 aa-ea e8 3e 03 28 5f 61 7b 7....%a...>.(_a{ 07c0 - 85 d3 81 dc 0c 27 94 ff-6a 18 7d 4c d1 cb 5a 5c .....'..j.}L..Z\ 07d0 - 61 44 24 cc 8b a2 2c 48-a2 88 66 e4 c4 ae 82 02 aD$...,H..f..... 07e0 - b3 4c 89 f2 8f 5b 25 d1-14 87 6d 7a a9 df 40 2f .L...[%...mz..@ / 07f0 - ab b2 48 e9 1e 3b 87 4d-2e 3c ea e1 f0 3e a5 14 ..H..;.M.<...>.. 0800 - e2 94 1b d0 49 a5 05 06-3e 55 e4 c0 64 89 d1 e6 ....I...>U..d... 0810 - d2 12 3e 15 5e 76 9b 44-0c 53 30 32 d8 40 df 10 ..>.^v.D.S02.@ .. 0820 - 63 c2 e9 04 41 fe c5 b5-38 5b 36 c8 4b c3 87 94 c...A...8[6.K... 0830 - c4 e4 2d 3f e6 34 da 94-b1 b8 ef 3e a6 86 cc d4 ..-?.4.....>.... 0840 - b2 12 2f 4c 1c aa 74 f6-a1 34 76 b6 c8 93 4a a6 ../L..t..4v...J. 0850 - db 2a 6b 11 3f e4 c5 34-ab 73 26 85 18 77 60 50 .*k.?..4.s&..w`P 0860 - 63 f5 89 94 ff fe 13 88-4c 49 fd ab 62 86 e8 14 c.......LI..b... 0870 - 26 23 da 87 20 05 1e 12-8a 43 7d ed 12 67 82 f3 &#.. ....C}..g.. 0880 - 5a 6f 55 5d ce 67 67 ef-59 41 5f 1a 00 a7 1e 5a ZoU].gg.YA_....Z 0890 - 7e d7 e0 2a 4d 76 0f f1-9f e8 75 ec 91 1e 3e 96 ~..*Mv....u...>. 08a0 - c2 e3 a9 5e db e7 48 18-b8 9d da 92 ef 5a 79 9f ...^..H......Zy. 08b0 - 2d a5 b7 e3 43 56 7c 4d-7a cd 2a c5 7f 12 08 57 -...CV|Mz.*....W 08c0 - 05 36 1b 9f 1c 63 a9 c2-b1 0c fa 6d 33 f6 bb 37 .6...c.....m3..7 08d0 - 00 31 33 2b 59 f7 2a e4-07 db 46 1f fc d2 e0 b7 .13+Y.*...F..... 08e0 - 82 a9 75 f1 07 bf 49 9b-e2 7d ef e1 81 de 7f 09 ..u...I..}...... 08f0 - f0 8e 6f 83 5c 9c 3a e4-f0 ac ac e8 4a f9 12 3a ..o.\.:.....J..: 0900 - 02 dd b5 86 0b b8 61 a0-90 9e 5a 9f 9d 3f 8d 64 ......a...Z..?.d 0910 - a2 74 83 e0 9a 95 a1 ea-ec 6d 69 89 fd 86 f0 1e .t.......mi..... 0920 - 28 aa c1 b3 8a 40 28 f9-61 f0 1c f6 7f 21 d9 f2 (....(a)(.a....!.. 0930 - 1a 15 3b 86 c4 fa f0 d6-9a bf 34 ce f6 e5 3b df ..;.......4...;. 0940 - 73 20 6d b5 ab 5d 00 9f-e2 34 5f ea 62 4a 78 2f s m..]...4_.bJx/ 0950 - ce 5b e3 59 ae ba 69 03-64 4d 74 b8 7b 9a 5e 93 .[.Y..i.dMt.{.^. 0960 - 52 49 72 f7 2f 32 f4 68-af a7 87 86 65 3d 5b fc RIr./2.h....e=[. 0970 - 7b 72 6a 21 42 af 09 d5-cb 68 a1 e2 7c 07 16 c4 {rj!B....h..|... 0980 - 3e 15 87 e9 e3 8e 9d 22-e4 64 09 22 0b 55 6d c3 >......".d.".Um. 0990 - e3 c8 7c 1f e8 4d 2d df-8b ba 95 6a ed a9 6c a0 ..|..M-....j..l. 09a0 - 7a b5 be cf 38 87 e0 77-de 9c 34 f7 19 3f f1 f7 z...8..w..4..?.. 09b0 - 25 cc 65 40 14 09 0a 5f-7b d0 de 26 d5 58 ae 38 %.e@ ..._{..&.X.8 09c0 - a0 f6 83 ce 6f d5 96 59-b3 f0 cd 3f 11 91 a1 36 ....o..Y...?...6 09d0 - 22 b3 e7 51 47 1c c9 b8-a6 42 34 30 25 05 67 e3 "..QG....B40%.g. 09e0 - 50 90 45 7f f0 c6 fc 89-8d 03 3c bd 60 f5 9a a0 P.E.......<.`... 09f0 - 97 10 f7 c8 a4 3a 88 f8-a3 02 f3 43 80 cd 9b 75 .....:.....C...u 0a00 - 29 69 e5 63 88 d7 2c a2-64 5a 3d c3 0b 43 5c 6f )i.c..,.dZ=..C\o 0a10 - fe 87 61 2e fd 68 b8 c7-65 02 cf 24 23 f1 66 2c ..a..h..e..$#.f, Thanks, Murali Krishnamoorthy

2 6

Verify that the user belongs to a specific ipv4 network
by Dzmitry Shykuts 05 Sep '25

05 Sep '25

Hello! In additionto the password, Ineedto verifythat theuserbelongstoa specificipv4network. Idon'tuseanydatabases. 1. I'm tryingto dothisinthe usersfile: test Cleartext-Password := "password", NAS-IP-Address == 10.1.1.0/24 Cisco-AVPair = "shell:priv-lvl=1", Service-Type = Administrative-User Got error: /etc/freeradius/3.0/mods-config/files/authorize[227]: Parse error (check) for entry test: Invalid IPv4 mask length "/24". Only "/32" permitted for non-prefix types Failed reading /etc/freeradius/3.0/mods-config/files/authorize /etc/freeradius/3.0/mods-enabled/files[9]: Instantiation failed for module "files" 2. I'm tryingto dothisinthe usersfile: test Cleartext-Password := "password", NAS-IP-Address < 10.1.1.0/24 Cisco-AVPair = "shell:priv-lvl=1", Service-Type = Administrative-User Got error: /etc/freeradius/3.0/mods-config/files/authorize[227]: Parse error (check) for entry test: Invalid IPv4 mask length "/24". Only "/32" permitted for non-prefix types Failed reading /etc/freeradius/3.0/mods-config/files/authorize /etc/freeradius/3.0/mods-enabled/files[9]: Instantiation failed for module "files" 3. I'm tryingto dothisinthe usersfile: test Cleartext-Password := "password", NAS-IP-Address =~ /10\.1\.1\..+/ Cisco-AVPair = "shell:priv-lvl=1", Service-Type = Administrative-User Got error: (0) files: EXPAND /10\.1\.1\..+/ (0) files: --> /10\.1\.1\..+/ (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test] (from client net port 0) (0) Delaying response for 1.000000 seconds Is it possible to make such a check for belonging to an ipv4 network? How to do this correctly? This check is very important for me...

2 2