- Freeradius-Users - lists.freeradius.org

Status of v4
by Alan DeKok 26 Sep '26

26 Sep '26

Anyone who's been following FreeRADIUS knows that v4 is the "always tomorrow" project. One of the reasons is that for a long time RadSec was "up and coming", but actual work on it was minimal. Unfortunately, other things were higher priority. Happily, it looks like that work is coming to a close. There have been substantial commits to v4 in the last week, which move the bar forward for RadSec. We don't (yet) have a functioning RadSec in the server, but for the first time in a long while, progress is being made. With luck, we will be releasing a beta of v4 before December, which includes RadSec. Alan DeKok.

5 6

Webinar on October 29
by Alan DeKok 25 Sep '26

25 Sep '26

Hi, I'm doing a short webinar on October 29, 1pm EST. It's free, and anyone who attends will get a download link for a free tool. The registration and content page is here: https://www.inkbridgenetworks.com/videos-webinars/inkquire-tools-for-freera… The free tool won't be available immediately after the webinar, but I don't expect the delay to be too long. All of the tools are useful, even in the age of AI. There are a host of reasons to not use AI. The simplest is GPDR (or equivalent). Unless you're running a local model, using any AI system will upload private customer information to the cloud. At which point who knows where it ends up. So there's a need to run local tools. The tools don't need AI, and don't use AI. They run locally, and give you information about what FreeRADIUS is doing. Some of the tools are free, some are not. More details will be in the webinar. I hope to see everyone there. I expect the webinar to be useful to most people who are running FreeRADIUS. Alan DeKok.

1 0

Initial install for Client.
by Parks, Grady * 22 Sep '26

22 Sep '26

Hello, I am trying to complete the install of freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64.rpm but I need to download some additional rpms to build a repo. - nothing provides libfreeradius-dhcp.so()(64bit) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides libfreeradius-eap.so()(64bit) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides libfreeradius-radius.so()(64bit) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides libfreeradius-server.so()(64bit) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides perl(DBI) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides freeradius = 3.0.20-15.module+el8.10.0+90375+641abe33 needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) Can someone assist me with where I can get the missing components where I can successfully install this product? Thanks Grady D. Parks OIMT / DIO (Division of Infrastructure Operations) FDA Account, Server Operations FDA Data Center and Infrastructure Support Contractor - Peraton e-mail: grady.parks(a)fda.hhs.gov<mailto:grady.parks@fda.hhs.gov> Phone: 240-762-2227 Linux Team Lead - Dan Drummond Linux Manager - Nancy Coultas-Carol

2 1

Small report on the status of v4
by Alan DeKok 18 Sep '26

18 Sep '26

Yes, it's still ongoing. Anyone who checks the commits on GitHub will see a lot of activity. The main blocker is still RadSec. We're working on it, but are actively making progress. Unfortunately, other things keep getting in the way. One thing which is slowing down progress on RadSec in v4 is the status of RadSec in v3. Anyone who checks the commits on GitHub will see a lot of activity in the v3.2.x branch, too. There have been many fixes to odd corner cases, and more test cases added. I'd like to thank Paul Dekkers for his ongoing assistance with testing the changes. That effort makes a big difference. I'll go back now to worrying abut the ongoing AI takeover of almost everything. :( Alan DeKok.

2 2

FreeRadius 3.0.3 and Galera Cluster
by David Lake 18 Sep '26

18 Sep '26

Hi Need some design advice here please. I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. I’m seeing issues with Deadlocks when under stress - mostly if there is a storm of reconnects. I’m running HAProxy on the FR nodes but there are a couple of things I don’t quite understand: 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it 1. What is the optimal way of configuring HAProxy? 1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum. (I have another IP allocation question which I’ll ask in another three). Thank you David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

4 4

FreeRadius 3.0.3 IP Allocation Failure
by David Lake 17 Sep '26

17 Sep '26

Hi I have FreeRadius configured to allocate v4 from sqlippool but to send a pool name to the router for v6 allocation. Occasionally, I see v4 allocation failures. Obviously I am getting to the bottom of this but in the meantime if I see a v4 allocation fail, I want to immediately send an auth-fail. At the moment, if the v4 fails, the process continues and I send the v6 pool name. The result is that the client authenticates, gets a v6 address but no v4 address. Can someone point me in the right direction of how to modify the logic to do this please? Thanks David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

2 2

FreeRADIUS 3.2.8 EAP-TLS OCSP fails with AWS Private CA: signer certificate not found
by andrew.aveyard＠justice.gov.uk 12 Aug '26

12 Aug '26

Hi all, We are investigating an OCSP validation issue with FreeRADIUS 3.2.8 and AWS ACM Private CA managed OCSP. EAP-TLS certificate validation works when native OCSP is disabled. When native OCSP is enabled, authentication fails during the OCSP check with: (11) eap_tls: Starting OCSP Request (11) eap_tls: ocsp: Using responder URL "http://ocsp.acm-pca.eu-west-2.amazonaws.com:80/" (11) eap_tls: ERROR: (TLS) ocsp: Couldn't verify OCSP basic response: error:13800076:OCSP routines::signer certificate not found (11) eap_tls: ERROR: (TLS) ocsp: Certificate has been expired/revoked (11) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:0A000086:SSL routines::certificate verify failed (11) Sent Access-Reject Environment: FreeRADIUS: 3.2.8 OS/container: Alpine 3.23 TLS: EAP-TLS via rlm_eap OCSP responder: AWS ACM Private CA managed OCSP OCSP nonce: disabled, as AWS Private CA managed OCSP does not support request extensions The relevant section from EAP TLS configuration is: verify { tmpdir = /tmp/radiusd client = "/usr/bin/openssl verify -verbose -CAfile ${certdir}/ca-bundle.pem -CApath ${certdir} %{TLS-Client-Cert-Filename}" } ocsp { enable = yes override_cert_url = no use_nonce = no } } The OCSP response from AWS contains: OCSP Response Status: successful (0x0) Response Type: Basic OCSP Response Responder Id: C = GB, O = xxxxxx, OU = NACS, CN = xxxxxxxxxxxxxx-20260701113446 Cert Status: good This Update: Aug 11 10:18:25 2026 GMT Next Update: Aug 18 09:18:25 2026 GMT Signature Algorithm: sha256WithRSAEncryption We do not see an embedded responder certificate in the OCSP response output. The responder ID appears to match the issuing CA. Standalone OpenSSL tests inside the same container succeed. Command without -verify_other: openssl ocsp \ -issuer issuing-ca.pem \ -cert ocsp-test-client.pem \ -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \ -CAfile root-ca.pem \ -no_nonce \ -resp_text Result: Response verify OK ocsp-test-client.pem: good Command with -verify_other: openssl ocsp \ -issuer issuing-ca.pem \ -cert ocsp-test-client.pem \ -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \ -CAfile root-ca.pem \ -verify_other issuing-ca.pem \ -no_nonce \ -resp_text Result: Response verify OK ocsp-test-client.pem: good We have also tested EAP-TLS with the supplicant sending: 1. leaf certificate + issuing CA 2. leaf certificate only Both cases fail in FreeRADIUS native OCSP with the same error: OCSP routines::signer certificate not found We have also tested adding root + issuing CA to ca-bundle.pem, configuring both ca_file and ca_path, and running openssl rehash on the certificate directories before FreeRADIUS starts. That did not change the FreeRADIUS native OCSP result. So the current state is: - AWS OCSP endpoint is reachable from the container - AWS returns Cert Status: good - standalone OpenSSL ocsp verification succeeds inside the same container - FreeRADIUS native OCSP fails during EAP-TLS with signer certificate not found - the failure occurs even when the issuing CA is in ca_file/ca_path - the failure occurs whether the client sends leaf+issuer or leaf only I found this earlier mailing-list thread which looks similar: https://lists.freeradius.org/hyperkitty/list/freeradius-users@lists.freerad… In that thread, the discussion mentions responder certificate purpose / OCSPSigning. In our case the AWS response responder ID appears to be the issuing CA itself, and standalone OpenSSL verifies the response successfully. My question is: what additional certificate/context does FreeRADIUS 3.2.8 need for native OCSP verification here, given that the same OCSP response verifies successfully with standalone OpenSSL in the same container? Is there any additional debug output or specific certificate inspection that would help confirm why FreeRADIUS cannot locate the OCSP response signer? Thanks, Andrew

1 0

New mailman server
by Arran Cudbard-Bell 11 Aug '26

11 Aug '26

Hi All, The mailing lists (users, devel, announce), have been upgraded to Mailman 3.3. Accounts should've migrated across with preferences, and credentials preserved. Please report any issues. Many Thanks, -Arran

1 1

Copying User-Name from inner tunnel to outer for accounting
by Dominik George 22 Jul '26

22 Jul '26

Hi, I am trying to do accounting for a user that previously authenticated through RADIUS. I know that the best way would be to use cui and have the NAS send a properly hashed identifier in its Accounting-Request, but unfortunately, my NAS does not support re-using the User-Name from the Access-Response for accounting. It always sends the anomymous identity from EAP instead. My idea was to save the authenticated user in the auth phase in inner tunnel, then extract this again when the accounting request comes in. However, I can't get this to work. What I tried is to set post-auth { update outer.session-state { User-Name := "%{User-Name}" } } in inner tunnel, then accounting { update request { User-Name := "%{session-state:User-Name}" } } in the outer config. HOwever, it always is empty that way. I verified that the NAS does correctly send the same Acct-Session-Id for both the auth ant the accounting requests, so FreeRADIUS should be able to correlate the state. The accounting request will ultimately be forwarded using the REST module. Can anyone explain how I could get this to work? Kind regards, Nik

5 13

FreeRADIUS RHEL 10 Upgrade – Older Client TLS Compatibility Question
by Mike Diggins 20 Jul '26

20 Jul '26

I'm updating my FreeRADIUS environment to RHEL 10 using the RHEL-provided FreeRADIUS 3.2.8 package and the default OpenSSL version (3.5.5). For the most part, everything is working as it did before, but I have one admittedly very old MacBook Air running Sierra 10.12.6 that no longer works in the new environment. FreeRADIUS is reporting SSL/TLS errors. Long story short, I found I could get it working by lowering what appear to be some of the new minimum SSL/TLS requirements: OS: update-crypto-policies --set LEGACY FreeRADIUS: tls_min_version = "1.0" FreeRADIUS: cipher_list = "DEFAULT@SECLEVEL=0" I had to drop it all the way back to TLS 1.0 for this client to work. While researching, I noticed that even this older version of macOS should (?) support TLS 1.2, so I'm trying to understand why it no longer works. My previous FreeRADIUS server was running on RHEL 7 with FreeRadius 3.0.13 and OpenSSL 1.0.2. I'm also wondering what kind of security impact there would be if I left these settings in place. We are a large BYOD environment with many different types of clients, and I don't know how many other devices may have similar compatibility issues. -Mike

2 1