June 2026 - Freeradius-Users - lists.freeradius.org

MCP Server
by Kushal Gupta 02 Jul '26

02 Jul '26

Hello, While reviewing the FreeRADIUS documentation, I would like to confirm if there is an MCP server available for this project. Best regards, Kushal Gupta

5 5

No full certificate chain in EAP in 3.2.7
by Dave Wang 30 Jun '26

30 Jun '26

Hi there, Recently I upgraded from freeradius 3.0.26 (with openssl 3.0.20) to 3.2.7/3.2.8, (with openssl 3.5.0), and I noticed that the server does not send the full certificate chain to the EAP client anymore. The server certificate has a chained structure like cert->intermediate CA2->intermediate CA1->root CA, and I am relying on the auto_chain and the ca_path to construct the chain on the freeradius side. Now it only sends the server_certificate + intermediate CA2, but previously it sent all *four* certificates. Is this a known issue? Regards, Dave

2 1

Mailing list infrastructure move
by Arran Cudbard-Bell 27 Jun '26

27 Jun '26

Hi All, The list server has moved onto our IP space 199.66.222.136 (AS54975), from 184.95.211.22. Please report any issues. Many Thanks, -Arran

1 0

Freeradius 3.2.x TEAP Support for Machine Only Authentication
by Suriya Shankar 16 Jun '26

16 Jun '26

Hi Alan, With the current EAP-TEAP implementation, we don't have the option to support devices that only want to use Machine Auth. I implemented and tested this on my machine and it works as expected. The changes I made as follows diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c index b30ab7e3d3..36b2dbdfa3 100644 --- a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c +++ b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c @@ -1217,6 +1217,7 @@ static PW_CODE eap_teap_phase2(REQUEST *request, eap_handler_t *eap_session, { PW_CODE code = PW_CODE_ACCESS_REJECT; rlm_rcode_t rcode; + bool machine_only = false; VALUE_PAIR *tvp; teap_tunnel_t *t = (teap_tunnel_t *)tls_session->opaque; int eap_method = 0; @@ -1253,6 +1254,17 @@ static PW_CODE eap_teap_phase2(REQUEST *request, eap_handler_t *eap_session, RDEBUG("Phase 2: Got tunneled identity of %s", t->username->vp_strvalue); + } else if (tvp && + (tvp->vp_length == EAP_HEADER_LEN + 1) && + (tvp->vp_strvalue[0] == PW_EAP_RESPONSE) && + (tvp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY)) { + /* + * Empty inner EAP-Identity indicates machine-only auth: finish + * with final TEAP Result TLV, then wait for client Result echo. + */ + RDEBUG2("Phase 2: Received empty inner EAP-Identity; treating as machine-only TEAP completion"); + machine_only = true; + } else if (!fake->username) { /* * Don't reject the request outright, @@ -1556,12 +1568,14 @@ done: * Call authentication recursively, which will * do PAP, CHAP, MS-CHAP, etc. */ - rad_virtual_server(fake, true); + if (!machine_only) { + rad_virtual_server(fake, true); + } /* * Decide what to do with the reply. */ - switch (fake->reply->code) { + switch (machine_only ? PW_CODE_ACCESS_CHALLENGE : fake->reply->code) { case 0: tvp = fr_pair_find_by_num(fake->config, PW_RESPONSE_PACKET_TYPE, 0, TAG_ANY); if (tvp && (tvp->vp_integer == PW_CODE_ACCESS_CHALLENGE)) { @@ -1573,6 +1587,15 @@ done: code = PW_CODE_ACCESS_REJECT; break; + case PW_CODE_ACCESS_CHALLENGE: + if (machine_only) { + t->result_final = true; + eap_teap_append_result(request, tls_session, PW_CODE_ACCESS_ACCEPT); + code = PW_CODE_ACCESS_CHALLENGE; + break; + } + /* FALL-THROUGH */ + case PW_CODE_ACCESS_ACCEPT: tvp = fr_pair_find_by_num(fake->packet->vps, PW_EAP_TYPE, 0, TAG_ANY); if (tvp) { *And the logs from my testing * *From the client we received after authenticating the Machine Certificate* Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Session established. Proceeding to decode tunneled attributes Mon Jun 15 22:14:10 2026 : Debug: TEAP tunnel data total 101 TEAP tunnel data in 00: 80 0c 00 4c 00 01 01 21 9a 89 af 0a 7d e6 5d b1 TEAP tunnel data in 10: 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 a3 TEAP tunnel data in 20: 22 3b 6e c8 31 c8 9b e5 00 00 00 00 00 00 00 00 TEAP tunnel data in 30: 00 00 00 00 00 00 00 00 00 00 00 00 b6 0e 4f 32 TEAP tunnel data in 40: 5f ab f5 f7 28 37 3d cd 9e 1c ee 0b 6a ab c8 05 TEAP tunnel data in 50: 80 0a 00 02 00 01 00 02 00 02 00 01 80 09 00 05 TEAP tunnel data in 60: 02 82 00 05 01 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Got Tunneled TEAP TLVs Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Found the pair by TEAP_TLV_IDENTITY copying the value to t->identity Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: FreeRADIUS-EAP-TEAP-Crypto-Binding = 0x000101219a89af0a7de65db1229b2aebad14809a0b721fa4876b65a3223b6ec831c89be50000000000000000000000000000000000000000b60e4f325fabf5f728373dcd9e1cee0b6aabc805 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: FreeRADIUS-EAP-TEAP-Intermediate-Result = Success Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: FreeRADIUS-EAP-TEAP-EAP-Payload = 0x0282000501 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: BUFFER for Compound MAC calculation - hexdump(len=123): 80 0c 00 4c 00 01 01 21 9a 89 af 0a 7d e6 5d b1 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 a3 22 3b 6e c8 31 c8 9b e5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 00 01 00 26 53 5f 39 34 64 65 36 36 65 38 2d 35 35 36 61 2d 34 64 35 36 2d 38 37 38 30 2d 61 31 31 34 36 32 30 61 35 63 34 32 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: S-IMCK[j] - hexdump(len=40): 68 d4 a1 17 ad bb de f1 4b fb cb 4c 94 71 95 63 60 b2 f7 91 24 c4 6d ca ef 7d c8 13 56 a5 47 d4 b3 fd 0a 0a 18 ad 68 4d Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (MSK) - hexdump(len=64): f3 93 64 e5 bd 76 78 39 ff c6 b6 8f 85 ad 95 ff 56 9e 60 ae 4e c9 51 c1 8b 55 20 5b 4a 59 ec a9 9e 58 9c d8 63 1c 4a b6 f4 3d cb f5 6f 07 14 13 ea 91 ff fb 7c b8 52 89 fd fa 5a f9 b5 ff 3f 9e Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (EMSK) - hexdump(len=64): 9b e4 9d 86 ff c5 f1 fa f0 16 62 11 ca 09 ed d7 39 6b c0 90 03 22 ac bd d4 6b b9 35 eb 26 5c b9 9f 20 c0 6b f7 a8 ec 5b 7f a7 4e 14 97 86 95 9e de 9f c4 e5 04 dc 85 dd 96 0f 8d 6e 68 27 30 56 02 82 00 05 01 -> Sending the identity packet without any username for the client preferring Machine Only Authentication. *When challenged by Accept as the changes shown in the diff, client accepts the connection* Debug: TEAP tunnel data total 6 TEAP tunnel data in 00: 80 03 00 02 00 01 Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap: Got Tunneled TEAP TLVs Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap: FreeRADIUS-EAP-TEAP-Result = Success Mon Jun 15 22:14:10 2026 : Debug: (136) eap_S_94de66e8-556a-4d56-8780-a114620a5c42: Sending If you find this good, I would like to raise a PR. If any changes required or if it's not the way as expected, will update it accordingly Thanks, Suriya

2 2

Windows 11 and Session Resumption
by Alan DeKok 15 Jun '26

15 Jun '26

I've attached a file with instructions for how to test session resumption with Windows 11 (Insider preview) and PEAP / TTLS. Until now, session resumption has only been supported in EAP-TLS. This change should make a noticeable difference for the university crowd. The load on the RADIUS server will drop significantly once this feature is available. Please test and report back. It's easier to check things now, rather than trying to work out what's wrong after something gets shipped in an official release. These instructions are direct from Microsoft. There's no ETA on when it will be in Windows 11, but any and all feedback on testing will help to move this forward.

2 3

Upgrading to 3.2.10 Breaks EAP-TLS
by Hector Rodriguez 14 Jun '26

14 Jun '26

Community, After upgrading to the latest and greatest, I have authentication issues again with EAP-TLS. TLS handshake has no issues, but my Windows 11 client does not want to authenticate anymore. Certs were checked, no warning , successful handshakes. Should I revert back 3.2.9 ? Everything worked in the last version, but release notes stated there were memory leak issues. [cid:c71a9768-dc21-43c6-bb02-45e1deeb48a4] Hector Rodriguez Cloud Administrator WestCare Foundation Phone (702) 482 0922 Web westcare.com Email hector.rodriguez(a)westcare.com<mailto:hector.rodriguez@westcare.com> Office 1711 Whitney Mesa, Henderson, NV 89014 [cid:a0282c75-4d2b-465b-a672-a3770b4237b0]<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> Book time to meet with me<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> -- CONFIDENTIALITY NOTICE: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. This communication may contain material protected by HIPAA legislation (45 CFR, Parts 160 & 164) or by 42 CFR Part 2. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is strictly prohibited. If you have received this email in error, please notify the sender by reply email and destroy all copies of the original message.

2 2

Version 3.2.10 and 3.0.28 have been released
by Matthew Newton 08 Jun '26

08 Jun '26

We have released FreeRADIUS versions 3.2.10 (and 3.2.9, ahem), and 3.0.28. These releases contain bug fixes for a number of overflows and memory leaks. Please see the announcement at https://www.freeradius.org/security/ There are also a lot of other updates and improvements. Please see the changelog. We recommend that everyone upgrades to these new versions. Those still on 3.0.x should consider making the move to 3.2.10. There are now few reasons to stay on 3.0. Except for critical security issues, this is likely to be the last release in the 3.0 branch. Packages are not available for 3.0.28 on several newer distributions as it will no longer build - please upgrade to 3.2.10. Download from the usual places: https://www.freeradius.org/releases/ https://www.freeradius.org/ftp/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_10 Pre-built packages for common Linux distributions are available from InkBridge Networks: https://packages.inkbridgenetworks.com/ -- Matthew

5 5

detail listener is broken in the 3.2.9 release
by Bjørn Mork 02 Jun '26

02 Jun '26

I bisected it down to https://github.com/FreeRADIUS/freeradius-server/commit/5691cbc615e515490fc4… It didn't revert cleanly so I looked a bit closer and noticed that it ends up changing if (!request->packet->vps) { .. } else { rcode = 0; } .. return 1; into a more direct if (request->packet->vps) return 0; The problem is obviously that the return value changes from 1 to 0. Simple fix ready for pulling at https://github.com/FreeRADIUS/freeradius-server/pull/5870 (yes, I found this and verified the fix in a real world installation) Bjørn

2 1