March 2026 - Freeradius-Users - lists.freeradius.org

Question about Clickhouse DB to Store Accounting
by Ibrahim Almahfooz 06 Mar '26

06 Mar '26

Hello, We are working on a project to store every accounting start, update and stop for special reporting purposes and we are thinking of using ClickHouse DB due to its capability such as supporting fast analytical queries and great for reporting and BI dashboards. Are there any concerns or suggestions if we decide to use rlm_sql_unixodbc with it, concerns like compatibility or performance? Thanks

3 2

EAP-TLS with Google Secure LDAP - iPhone authentication issue
by Helder Miolo 06 Mar '26

06 Mar '26

Hello, I am running FreeRADIUS 3.0 on Ubuntu 24.04. I am trying to authenticate users via WPA2-Enterprise using Google Secure LDAP as the backend.It turns out that Android phones are working perfectly, but iPhones are experiencing a similar error: 5) ldap: ERROR: Attribute "User-Password" is required for authentication (5) [ldap] = invalid (5) } # Auth-Type LDAP = invalid (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> 706130272(a)ucm.ac.mz (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) update outer.session-state { (5) &Module-Failure-Message := &request:Module-Failure-Message -> 'ldap: Attribute "User-Password" is required for authentication' (5) } # update outer.session-state = noop (5) } # Post-Auth-Type REJECT = updated (5) Login incorrect (ldap: Attribute "User-Password" is required for authentication): [706130272(a)ucm.ac.mz] (from client ap4 port 0 cli 7E-F4-29-39-B9-0F via TLS tunnel) (5) } # server inner-tunnel (5) Virtual server sending reply (5) eap_ttls: Got tunneled Access-Reject (5) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed Problem: - IPhone forces MSCHAPv2 even when EAP-TTLS/PAP is configured - radtest with PAP works successfully Current configuration: - eap.conf: default_eap_type = ttls, ttls { default_eap_type = pap } - inner-tunnel: Auth-Type PAP and LDAP configured - libldap is using GnuTLS while FreeRADIUS uses OpenSSL (Ubuntu 24.04 issue)

3 2

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Freeradius Framed-MTU
by Kat 02 Mar '26

02 Mar '26

> 2. Re: Setting Framed-MTU in Freeradius (Nick Porter) > Gday, To start with, thank you so much Nick Porter for answering! That is amazing! Thank you :-) > > This is a case of AI being confidently wrong - but there is wrong > information out there which was probably part of the training set. Based on your email, I took another look and I found reference to Framed-MTU in the etc/raddb/users file, so I uncommented that in and tried to set it to 1024. I saved the changes and restarted the server in -x. And then reconnected to check the logs. A subset of logs are provided below the email. Framed-MTU is being set to 1002 or 994, not 1024. eg: (24) Framed-MTU += 994 (24) Framed-MTU = 1002 (24) &session-state:Framed-MTU = 994 Google Gemini tells me it is because of this line: (24) [files] = noop and that the default setting of Framed-MTU that I brought back in is being disregarded because the supplicant has an identity. So do I need to put that identity in the users file and set the Framed-MTU there specifically? > If you are running into issues with fragmentation on the packets from > client to server, then usually the key is getting path MTU discovery to > work correctly.? Failing that, it is a matter of ensuring that fragments > are not getting dropped by firewalls. I would like to set the Framed-MTU because I have been asked to do so. I don't know if it will help them or not but I want to do it because I have been asked to do so. Why they want to set Framed-MTU is because Freeradius is returning many debug lines that look like this: (458002) Cleaning up request packet ID 112 with timestamp +945036 due to cleanup_delay was reached They are hoping that setting the Framed-MTU will solve this. > Example logs: (24) Received Access-Request Id 193 from 172.17.0.1:52424 to 172.17.0.2:1812 length 243 (24) User-Name = "redacted" (24) NAS-IP-Address = redacted (24) NAS-Identifier = "redacted" (24) Called-Station-Id = "2A-70-4E-AB-FB-33:T-TEC Enterprise" (24) NAS-Port-Type = Wireless-802.11 (24) Service-Type = Framed-User (24) Calling-Station-Id = "redacted" (24) Connect-Info = "CONNECT 24Mbps 802.11a" (24) Acct-Session-Id = "1B70491FD72097B8" (24) Acct-Multi-Session-Id = "33F1B622305CBD65" (24) WLAN-Pairwise-Cipher = 1027076 (24) WLAN-Group-Cipher = 1027076 (24) WLAN-AKM-Suite = 1027073 (24) Framed-MTU = 1002 (24) EAP-Message = 0x02f500060d00 (24) State = 0xc08ccb62c779c6c0c349c973c80ddb37 (24) Chargeable-User-Identity = 0x00 (24) Message-Authenticator = 0x9151c9eca3140df6df7002b31dd0faa0 (24) Restoring &session-state (24) &session-state:Framed-MTU = 994 (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Certificate" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Finished" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 ChangeCipherSpec" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Finished" (24) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (24) &session-state:TLS-Session-Version = "TLS 1.2" (24) # Executing section authorize from file /etc/freeradius/sites-enabled/default (24) authorize { (24) policy filter_username { (24) if (&User-Name) { (24) if (&User-Name) -> TRUE (24) if (&User-Name) { (24) if (&User-Name =~ / /) { (24) if (&User-Name =~ / /) -> FALSE (24) if (&User-Name =~ /@[^@]*@/ ) { (24) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (24) if (&User-Name =~ /\.\./ ) { (24) if (&User-Name =~ /\.\./ ) -> FALSE (24) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (24) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (24) if (&User-Name =~ /\.$/) { (24) if (&User-Name =~ /\.$/) -> FALSE (24) if (&User-Name =~ /(a)\./) { (24) if (&User-Name =~ /(a)\./) -> FALSE (24) } # if (&User-Name) = notfound (24) } # policy filter_username = notfound (24) [preprocess] = ok (24) [digest] = noop (24) suffix: Checking for suffix after "@" (24) suffix: No '@' in User-Name = "redacted", looking up realm NULL (24) suffix: No such realm "NULL" (24) [suffix] = noop (24) eap: Peer sent EAP Response (code 2) ID 245 length 6 (24) eap: No EAP Start, assuming it's an on-going EAP conversation (24) [eap] = updated (24) [files] = noop (24) [expiration] = noop (24) [logintime] = noop (24) } # authorize = updated (24) Found Auth-Type = eap (24) # Executing group from file /etc/freeradius/sites-enabled/default (24) authenticate { (24) eap: Removing EAP session with state 0xc08ccb62c779c6c0 (24) eap: Previous EAP request found for state 0xc08ccb62c779c6c0, released from the list (24) eap: Peer sent packet with method EAP TLS (13) (24) eap: Calling submodule eap_tls to process data (24) eap_tls: (TLS) Peer ACKed our handshake fragment. handshake is finished (24) eap: Sending EAP Success (code 3) ID 245 length 4 (24) eap: Freeing handler (24) [eap] = ok (24) } # authenticate = ok (24) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (24) post-auth { (24) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (24) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (24) update { (24) &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 994 (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, ClientHello' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerHello' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, Certificate' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, Certificate' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, Finished' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 ChangeCipherSpec' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, Finished' (24) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-RSA-AES256-GCM-SHA384' (24) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2' (24) } # update = noop (24) [exec] = noop (24) policy remove_reply_message_if_eap { (24) if (&reply:EAP-Message && &reply:Reply-Message) { (24) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (24) else { (24) [noop] = noop (24) } # else = noop (24) } # policy remove_reply_message_if_eap = noop (24) if (EAP-Key-Name && &reply:EAP-Session-Id) { (24) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (24) } # post-auth = noop (24) Sent Access-Accept Id 193 from 172.17.0.2:1812 to 172.17.0.1:52424 length 173 (24) MS-MPPE-Recv-Key = 0x9e7d6bc3e620c918df655f5b6f3df6354afb8a122a23d067e577eeceef5d41dd (24) MS-MPPE-Send-Key = 0x30c4a64e47a5fadfdbe66e814dda937c5a16d504439fdb0c7e21602acbc3664b (24) EAP-Message = 0x03f50004 (24) Message-Authenticator = 0x00000000000000000000000000000000 (24) User-Name = "redacted" (24) Framed-MTU += 994 (24) Finished request Waking up in 4.8 seconds.

2 1