April 2026 - Freeradius-Users - lists.freeradius.org

RadGraph - a tool to return VLAN ID and Class attributes based on Entra Groups
by John Cleary 11 May '26

11 May '26

Hi all, First, I have to say THANK-YOU to the whole FreeRADIUS team. I love this product!! :) I hope this is an appropriate place to share this! I’ve been using FreeRADIUS with great success for the past 6 months to do wired and wireless auth for the school network I managed. We’re a Microsoft 365 house, and I’m trying to deprecate on-prem NPS, hence the move to FreeRADIUS. We’re using EAP-TLS with user certs issued via Intune (from an on-prem NDES for now, hopefully sth else soon!). Because I need users dropped into different VLANs during the Wi-Fi auth, and to also supply RADIUS “Class” attributes to my Fortigate for RSSO based internet filtering, I built a ‘plugin’ solution for FreeRADIUS that uses the “exec” module to run a lookup during auth. I thought I’d share it here in case it’s useful to others! https://github.com/johnclearyconsulting/radgraph Thanks again, John -- John Cleary Melbourne, Australia +61 417 143 312 john(a)cleary.au

4 3

Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...' even when setting explicitly Attr-26 (or vendor data type)
by Francesco Di Nucci 29 Apr '26

29 Apr '26

Hi, I am using FreeRADIUS 3.0.27 on EL9, and I'm trying to set a Vendor Attribute in replies. For context, I am trying to authenticate SuperMicro BMCs with LDAP (see thread https://lists.freeradius.org/pipermail/freeradius-users/2018-March/091085.h…) So in my enabled site I edited the post-auth section post-auth { update { reply:Attr-26 := "0x483D342C20493D34" } } This results in "Cannot parse RHS hex as the data type of the attribute Vendor-Specific" As it's missing Vendor ID, I tried to add it. Super Micro PEN on IANA is 10876, so full vendor attribute should be 1A1200002A7C483D342C20493D34 if I am correct: post-auth { update { reply:Attr-26 := "1A1200002A7C483D342C20493D34" } } And here the result is Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...' , even if I am setting reply:Attr-26 Does anyone have a suggestion? I'd like to add it to post-auth (and not to mods-enabled/ldap) to then add a conditional on NAS-Identifier = "SUPERMICRO BMC" Thanks in advance Francesco -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email: francesco.dinucci(a)na.infn.it

3 7

FreeRADIUS RadSec TCP connection plateau at 505
by Tayyab Elahi 22 Apr '26

22 Apr '26

Hi all, We're running FreeRADIUS 3.x as a RadSec terminator (TLS/TCP on port 2083) in a Linux container, and we hit a hard ceiling at ~505 concurrent TLS connections. Looking for guidance on the recommended path forward. *Symptom (full logs attached):* Every new connection above ~505 is rejected. *Root cause: *The #ifndef HAVE_KQUEUE branch in event.c uses select() + fd_set. On glibc, FD_SETSIZE and __FD_SETSIZE are hard-coded to 1024 in <bits/typesizes.h>, and sizeof(fd_set) is 128 bytes (1024 bits). Since each RadSec peer holds a persistent TCP FD, we run out at ~1000. *What we tried (none of it gets past 1024):* 1. Raised FR_EV_MAX_FDS 512 → 2048 (event.c) 2. Raised MAX_SOCKETS 1024 → 2048 (packet.c) 3. Added -DFD_SETSIZE=65536 to CFLAGS — verified as a no-op: glibc redefines 4. FD_SETSIZE back to 1024 in <sys/select.h>, and sizeof(fd_set) stays 128 bytes 5. Raised ulimit -n / LimitNOFILE to 65536 6. Raised max_connections on the listener and per client *Questions:* 1. Is there any supported way on v3.x to use an event backend other than select() on Linux? I see the kqueue branch but no epoll branch. 2. Does upgrading to v4 solve this — i.e., can v4 handle 5k–10k concurrent RadSec sessions on Linux out of the box? 3. Would an epoll backend patch for v3 (new #elif defined(HAVE_EPOLL) branch in event.c, replacing fd_set with an fd-indexed array) be of interest upstream, or is that out of scope for v3 maintenance? 4. Any deployment patterns people use to stretch v3 further, beyond tight idle_timeout / lifetime / cleanup_delay and sharding across multiple FR instances? *Environment:* - FreeRADIUS 3.x (event.c commit 92ab704b) - Linux, glibc (Debian-based container), Kubernetes - Single radiusd process, multi-threaded - TLS listener on 0.0.0.0:2083, virtual-server=radius-tls - ~1000 long-lived RadSec sessions at steady state - Container confirms __FD_SETSIZE=1024, sizeof(fd_set)=128 Logs attached. Any pointers appreciated. Thanks, Tayyab Elahi

2 1

LSP - Language Server Protocol - FreeRADIUS and or unlang
by Douglas Fischer 21 Apr '26

21 Apr '26

There is any thing on roadmap related to some kind data model of the possible attributes and correlates for FreeRadius. I saw something on pararel projects pyfreeradius and freeradius-api But the docs could be better... Talking about LSP I had an opportunity of creating a "ugly web-gui" for a software just using the LSP. Using that to propose suggestions instead os just parsing what was writed. So, considering that, any plans to something like LSP for freeradius? Douglas Fernando Fischer Engº de Controle e Automação

2 1

Compile on RHEL9: No libtalloc-devel
by g4-lisz＠tonarchiv.ch 17 Apr '26

17 Apr '26

Hi there, We had to do a upgrade our RHEL 9 VM (dnf update). And now it seems there is no libtalloc-devel package anymore. dnf provides '*talloc.h' cant find anything. Has anyone managed to compile under the latest RHEL 9 using libraries from the official RHEL repositories? Or do I also have to compile talloc from the source code? Cheers, Till

2 2

FreeRadius Mythos Scan
by Karlo Zatylny 17 Apr '26

17 Apr '26

Sorry if this has been asked before but I couldn’t find it in the archive. Has FreeRadius been scanned by Mythos and have any bugs been reported and or fixed by this scan? If so, is it only on the latest code base or have older versions also been scanned? I am unsure how to reach out to Anthropic to have this happen but am willing to help if needed. Thanks Karlo

3 3

XLAT Question
by g4-lisz＠tonarchiv.ch 14 Apr '26

14 Apr '26

Hi there, I read about the default / alternation syntax for string expansion, like %{%{Foo}:-bar}. But what I needed is this: if (foo != '' ) ? '[ %{foo} ]' : 'null'. This is for a JSON request string in a REST module configuration. The request property in question must be a JSON array ( [ .. ] ) or 'null'. I could use Unlang IF and declare the complete JSON request in different versions depending on foo. But I would prefer to do this with expansion inside the JSON string definition, if possible. Cheers Till

3 4

802.1X - ldap AND users file
by cedric Delaunay 10 Apr '26

10 Apr '26

Hello List, Network Wired Project running here. Devices users authenticate successfully using peap/mschapV2 and ldap backend outer identity is configured as anonymous I'd like to find how to force "accept" for a special user, based on "mods-config/files/authorize" file - user is logged-in on device so that is real username is kown only by inner-tunnel - user isn't known by ldap (that's why I try with "users" file) - user's password may change so that I don't want to check it "users" entry looks like : myuser Auth-Type := Accept Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, #Tunnel-Private-Group-ID = "407", Tmp-String-1 = "407" Tmp-String-1 is used by default/post-auth section as it : update reply { Tunnel-Private-Group-Id := "%{reply:Tmp-String-1}" } files module is enabled in inner tunnel/authorize My problem : I cant see "accept" during inner-tunnel (after authorize file module) (9) files: users: Matched entry myuser at line 99 (9) [files] = ok (9) } # authorize = ok (9) Found Auth-Type = Accept (9) Auth-Type = Accept, accepting the user (9) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel but next challenge says (10) eap_peap: ERROR: We sent a success, but the client did not agree (10) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed Il don't know what is the best way to achieve this. Any idea ? Thanks -- : *Cédric Delaunay * *Service Infrastructure Systèmes et Réseaux / Direction du Système d'Information* *Admin Réseau / RSSI Suppléant * Tel. : +33 (0)2 23 23 8568 *INSA Rennes* 20 avenue des Buttes de Coêsmes CS 70839 - 35 708 RENNES Cedex 7 www.insa-rennes.fr <http://www.insa-rennes.fr/>

4 7

v4 - missing radmin?
by James Wood 06 Apr '26

06 Apr '26

When compiling v4 from the latest source, radmin doesn't seem to be included/built. Is this expected? ~/freeradius-server# grep -r "radmin" src/bin/all.mk 2>/dev/null ~/freeradius-server# grep -r "radmin" src/bin/radmin.mk 2>/dev/null ~/freeradius-server# cat src/bin/radmin.mk cat: src/bin/radmin.mk: No such file or directory Do I need to do something specific? Thanks James -- Visit purple.ai <https://purple.ai/> Purple on LinkedIn <https://uk.linkedin.com/company/purple-wifi> Email disclaimer <http://www.purple.ai/email-disclaimer/>

2 10

Documentation Feature Compare Releases
by Douglas Fischer 06 Apr '26

06 Apr '26

Hello all! https://www.freeradius.org/documentation/freeradius-server/ How difficult would it be to add some resource that could allow comparing the documentation of two releases of freeRADIUS? This is just a suggestion to perhaps try to smooth the learning curve for those who don't have extensive experience with AAA or with freeRADIUS specifically. I'm not sure (I'm not a programmer), but I believe Sphinx has some plugin that allows this comparison of release documentation. I'm making this suggestion because I believe this possibility would be particularly useful at transition points between major releases, or when adding more impactful features. Thank you in advance for your understanding! -- Douglas Fernando Fischer Engº de Controle e Automação

2 3