May 2026 - Freeradius-Users - lists.freeradius.org

Heads-up: Debian/Ubuntu repository update
by Matthew Newton 29 May '26

29 May '26

The metadata on the FreeRADIUS Debian and Ubuntu package repositories is being updated, specifically the Origin and Label fields. The Origin field will change from 'Network RADIUS SARL' to 'InkBridge Networks'. The Label field will change from 'Network RADIUS SARL' to the name of the repository, for example 'freeradius-3.2', 'freeradius-3.0', or 'freeradius-devel-3.2'. apt/apt-get will likely complain about this. To update the repository you may need, as a one-off: apt-get update --allow-releaseinfo-change If you are using apt pinning rules in /etc/apt/preferences.d that match based on these fields then you may also need to update them as well, for example: Package: /freeradius/ Pin: release o=InkBridge Networks,l=freeradius-3.2 Pin-Priority: 999 -- Matthew

1 0

Version 4 rlm_cache and LDAP cacheable_name
by Brian Julin 21 May '26

21 May '26

TLDR: should I be using a different update block in the following for version 4? cache ad-my-ldap-group-cache { driver = "rbtree" key = "%{User-Name}" ttl = 5 add_stats = "no" cacheable_name = "yes" update { control.ad-my-ldap-LDAP-Group := control.ad-my-ldap-LDAP-Group } } ... I ask because it seems that when loading the cache again, it copies the *same* value into multiple elements in the restored attribute, giving me [n] copies of whatever value ended up first in this list. So either something is broken or this is a subtle behavior of := in list assignments conflicting with the special currying of the rhs in this module and I need an alternate operator. (a few values munged to protect internal identfiers) (6.0) ad-my-ldap-group-cache - Found entry for "my.user.name" (6.0) ad-my-ldap-group-cache - Merging cache entry into request (6.0) ad-my-ldap-group-cache - control.ad-my-ldap-LDAP-Group := 'Group1' (6.0) ad-my-ldap-group-cache - control.ad-my-ldap-LDAP-Group := 'Group2' (6.0) ad-my-ldap-group-cache.load (updated) (6.0) if (!control.ad-my-ldap-LDAP-Group) { (6.0) | ! (6.0) | control.ad-my-ldap-LDAP-Group (6.0) | %exists() (6.0) | --> true (6.0) | %unary_not({true}) (6.0) | --> false (6.0) ... (6.0) } (6.0) if ("%{control.ad-my-ldap-LDAP-Group[0]}/%{control.ad-my-ldap-LDAP-Group[1]}/%{control.ad-my-ldap-LDAP-Group[2]}/%{control.ad-my-ldap-LDAP-Group[n]}" == "foo") { (6.0) | control.ad-my-ldap-LDAP-Group[0] (6.0) | control.ad-my-ldap-LDAP-Group[0] (6.0) | --> Group2 (6.0) | control.ad-my-ldap-LDAP-Group[1] (6.0) | --> Group2 (6.0) | control.ad-my-ldap-LDAP-Group[2] (6.0) (null) (6.0) | control.ad-my-ldap-LDAP-Group[n] (6.0) | --> Group2 (6.0) | ({ngt_top/ngt_top//ngt_top} == {foo}) (6.0) | --> false (6.0) ... (6.0) }

1 0

Version 4
by Munroe Sollog 20 May '26

20 May '26

I’ve been trying to follow the FreeRADIUS v4 development process and wanted to ask about the current project status. I haven’t seen much recent activity on the mailing lists, including the developer and announcement lists, and I noticed that the latest tarballs available on freeradius.org/ftp appear to be from 2023. At the same time, it does look like there is still ongoing activity in the GitHub repository. Is there currently a status page, roadmap, or compatibility matrix for v4 that outlines what is considered stable, what is still in progress, and any known limitations or unsupported features? We are considering adding a FreeRADIUS v4 proof-of-concept effort to our project calendar for the next fiscal year, and having a clearer understanding of the current maturity level and known gaps would help us better assess the scope and potential impact of that work. Any guidance or pointers to current documentation would be greatly appreciated. -- Munroe Sollog (He/Him/His) Network Architect munroe(a)lehigh.edu

2 1

Suppress radpostauth password logging with unlang variable reference
by Sam Hutchings 18 May '26

18 May '26

Hi All, PostgreSQL datastore is logging passwords in plain text in the 'radpostauth' table for accepted and rejected requests. This is occurring even when 'auth_goodpass' and 'auth_badpass' are set to 'no' - which this looks to be only relevant to logging to radius.log. I could comment out '-sql' in the 'post-auth' section of the server or amend the queries.conf for sql to remove the password. However, for flexibility/simplicity I have looked into using unlang to suppress the attribute. I would like to use the variable reference from radiusd.conf for auth_goodpass/auth_badpass to control whether the User-Password is suppressed ideally for efficiency. The unlang is as follows in the 'post-auth' section of the default server: if (${log.auth_goodpass}) { -sql } else { suppress { User-Password } -sql } This throws the below error: /etc/freeradius/sites-enabled/default[919]: Parse error in condition /etc/freeradius/sites-enabled/default[919]: (${log.auth_goodpass}) { /etc/freeradius/sites-enabled/default[919]: ^ Expected a module return code I have then attempted to set a variable called 'auth_good' as 'false' in the default server and referenced it as ${.auth_good} instead but encountered the same issue. If anyone has any advice on how to achieve this or where I am going wrong, it would be much appreciated. Kind regards, Sam FreeRADIUS Version 3.2.8 Copyright (C) 1999-2025 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT FreeRADIUS is developed, maintained, and supported by InkBridge Networks. For commercial support, please email sales(a)inkbridgenetworks.com https://inkbridgenetworks.com/ Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/proxy_rate_limit including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/totp including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/postgresql/queries.conf including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/rfc7542 including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default /etc/freeradius/sites-enabled/default[919]: Parse error in condition /etc/freeradius/sites-enabled/default[919]: (${.auth_good}) { /etc/freeradius/sites-enabled/default[919]: ^ Expected a module return code Errors reading or parsing /etc/freeradius/radiusd.conf

2 2

Some modules .so are stripped while others are not
by g4-lisz＠tonarchiv.ch 18 May '26

18 May '26

Hi there, I wonder why some modules are stripped of their text symbols, others are not. For example >nm -D /opt/rad/lib/rlm_rest.so | grep -i " T " gives the expected list for -g cflag. >nm -D /opt/cpr/lib/rlm_realm.so | grep -i " T " doesn't show anything, even when using ./configure --enable-developer How is this configured? I couldn't find the "magic"... Thanks in advance Till

2 5

FreeRADIUS | Tattoo Inquiry
by Cyrus Humphreville 18 May '26

18 May '26

Hi Alan, If one is considering a FreeRADIUS tattoo, can your team share the concept behind the octopus(?) logo? Sassy replies welcome and expected. Best, Cyrus Von meinem iPhone gesendet

3 2

New module - Native .NET policy support for FreeRADIUS
by Chris Knipe 15 May '26

15 May '26

Hi everyone, I'm pleased to announce that I have submitted a new module for FreeRADIUS called rlm_dotnet, which enables writing FreeRADIUS policies and modules in C# and other .NET languages. Pull Request: https://github.com/FreeRADIUS/freeradius-server/pull/5852 rlm_dotnet hosts the Microsoft .NET runtime using hostfxr and allows FreeRADIUS to call managed code directly. This makes it possible to implement FreeRADIUS policies in: - C# - F# - VB.NET - Any other language targeting the .NET runtime The design supports both synchronous and asynchronous policies, and provides strongly typed access to RADIUS requests and replies. - Native integration with the .NET runtime (hostfxr) - Strongly typed request and reply objects - Support for all major FreeRADIUS processing sections - Async/await support using ValueTask - Structured binary request/reply formats (RDb1 / RDr1) - Structured JSON error reporting - Access to native FreeRADIUS logging (radlog) - Per-thread or shared policy instances - Comprehensive XML documentation and examples - Unit tests and smoke tests - Full C# Sdk included A minimal policy can be as simple as: public sealed class MyPolicy : IRadiusPolicy { public (int Rcode, string ReplyPairList) Authorize(RadiusRequest request) => (RlmRcode.Ok, IRadiusPolicy.EmptyReply); } Async policies are also supported for database, HTTP, Redis, LDAP, or other I/O-bound operations. The .NET CLR is shared across all instances initiated by FreeRADIUS, and as such memory is shared across all instances and not destroyed each time FreeRADIUS recycles the process. This makes extensive in-memory usage highly viable and was one of the main reasons why the module was developed (in memory, shared session-db). FreeRADIUS has long supported embedded languages such as Python and Perl. rlm_dotnet brings modern .NET capabilities to the platform, including: - Strong typing - Excellent tooling and debugging - High performance - Rich ecosystem libraries - Modern asynchronous programming This makes it easier for organizations with existing .NET expertise to build custom AAA logic directly within FreeRADIUS. The pull request includes: - Full and comprehensive documentation - Assembly-level XML documentation - A comprehensive ExamplePolicy - Unit tests and smoke tests - Full C# Sdk - Feedback Welcome Thank you to the FreeRADIUS team for building such a powerful and extensible platform. Kind regards, Chris Knipe

2 2

RadGraph - a tool to return VLAN ID and Class attributes based on Entra Groups
by John Cleary 11 May '26

11 May '26

Hi all, First, I have to say THANK-YOU to the whole FreeRADIUS team. I love this product!! :) I hope this is an appropriate place to share this! I’ve been using FreeRADIUS with great success for the past 6 months to do wired and wireless auth for the school network I managed. We’re a Microsoft 365 house, and I’m trying to deprecate on-prem NPS, hence the move to FreeRADIUS. We’re using EAP-TLS with user certs issued via Intune (from an on-prem NDES for now, hopefully sth else soon!). Because I need users dropped into different VLANs during the Wi-Fi auth, and to also supply RADIUS “Class” attributes to my Fortigate for RSSO based internet filtering, I built a ‘plugin’ solution for FreeRADIUS that uses the “exec” module to run a lookup during auth. I thought I’d share it here in case it’s useful to others! https://github.com/johnclearyconsulting/radgraph Thanks again, John -- John Cleary Melbourne, Australia +61 417 143 312 john(a)cleary.au

4 3

Support for python free threading
by The2nd 09 May '26

09 May '26

Hello list, i want to ask, if there are plans to support python in free threading mode (https://docs.python.org/3/howto/free-threading-python.html) Regards The2nd

3 2

Re: [EXTERNAL] Re: Intermediate-Trust certificate issues
by Hector Rodriguez 02 May '26

02 May '26

Alan, Thank you for replying, it means a lot to me. The version installed is 3.2.5. Are you saying that upgrading to version 3.2.9 should fix the issue ? (Yes || no) I currently see the version on the site. Unsure based on the response if it's already committed into the new version. ________________________________ From: Alan DeKok Sent: Friday, May 1, 2026 3:20 PM To: FreeRadius users mailing list Cc: Hector Rodriguez Subject: Re: [EXTERNAL] Re: Intermediate-Trust certificate issues On May 1, 2026, at 2:35 PM, Hector Rodriguez via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > I hope everyone is well. Currently I have implemented Free Radius in a test environment with EAP-TLS mode enabled. Which version? > My environment currently has a two tier PKI (CA Root and Ca Issuer within the Intune Microsoft Cloud PKI environment) . Our Free Radius server is configured to have an SSL from the CA server installed within my Free Radius Server, which is generated by the CA config. Our Root CA and Issuer CA certificates have been imported from Intune, and converted from Cer to PEM/CRT file formats, and the EAP config file has been edited to point to a bundled (full chain ) Issuer CA cert. The server's certificate store has been updated to trust the Microsoft CA and Issuer CA for our environment . I have created a configuration profile within Intune to grant machines (in my case, just a test machine) to install both CA ROOT and Issuer certs to their prespective certificate store. Public certs are owned by the freerad user and currently have the 755 permissions OK. There's always some magic fighting with certificates, but that sounds reasonable. > Another thing to note is that we are currently using a Unifi switch and we have set the controller profile to authenticate with Radius. I have been going a bit insane trying to figure out why the Free Radius server is not trusting my intermediate certificate when I have clearly followed the appropriate instructions. No matter what I do the intermediate cert is not trusted. Authentication only occurs when I set:reject_unknown_intermediate_ca to No. I have been notciing that other users have a similar issue, with PKI's related to Microsoft Cloud PKI. Do you thing there will be a fix. Is there anything that I can do for this issue ? Although it seems unsafe, do you think it would be Ok, to set reject_unknown_intermediate_ca =no ? IIRC there were issues with intermediate certs at one point. The fix is likely in commit aca3a5955d4e i.e. it will be in 3.2.9, which we expect to release shortly. Alan DeKok. [cid:54071d05-fdb4-47e4-863c-76f80c12afcc] Hector Rodriguez Cloud Administrator WestCare Foundation Phone (702) 482 0922 Web westcare.com Email hector.rodriguez(a)westcare.com<mailto:hector.rodriguez@westcare.com> Office 1711 Whitney Mesa, Henderson, NV 89014 [cid:e1e62e03-511d-42d2-a611-01b18262a642]<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> Book time to meet with me<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> -- CONFIDENTIALITY NOTICE: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. This communication may contain material protected by HIPAA legislation (45 CFR, Parts 160 & 164) or by 42 CFR Part 2. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is strictly prohibited. If you have received this email in error, please notify the sender by reply email and destroy all copies of the original message.

2 1