- Freeradius-Users - lists.freeradius.org

FreeRADIUS Guidance
by Phillip Morley 06 Jul '26

06 Jul '26

Greetings, I am looking for some guidance on the following matters with an instance of FreeRADIUS I am trying to put up/complete...... If there is anyone out there who can provide some simple guidance, that would be appreciated. We are looking for FreeRADIUS to work in conjunction with trusted and signed SSL/TLS certificates, so that when users connect to wireless on a Ubiquiti platform, they are NOT prompted to accept or "trust" the RADIUS server's certificate. That's the end goal...... I need to better understand how to specify a wide range or a list of "client" IP addresses, which will be the Ubiquiti access points, in the FreeRADIUS configuration. Right now, I have 1 AP defined as our test AP. Right now, after putting SSL/TLS certificates on the RADIUS server, I cannot get the "server" to answer or process any requests for user authentication external to the server. I have disabled firewalld and rebooted. We are working with FQDNs as well and not sure if this has anything to do with this..... In terms of the user file, this is great for very small environments, however this one is going to be several hundred user accounts, and where a VLAN ID needs to be specified along with their user account entry, so when they connect, they get placed on the VLAN they are supposed to by the RADIUS authentication request. For this level of credential storage, is there a standard MySQL DB that is canned and can be put up as the mechanism to store user credentials? A software developer in this environment can and I think we should have him develop a custom web page/portal for non-technical users to add/remove user credentials. What is the best recommended set of tools and stuff for this need? Finally, we want to store user credentials in a secure fashion. I am reading there is a way to encrypt them on the server and in transit but requires some configuration and such. What are the components of getting this done, and then also storing them in whatever medium needed to address the immediately preceding question I made above about a database for them? Thanks so much! Phillip Morley phillip(a)is-md.com<mailto:phillip@is-md.com> Legal Disclaimer: The information contained in this electronic transmission, and any documents attached hereto, may contain confidential information that is legally privileged and confidential. This electronic transmission is intended solely for its recipients only and is not intended to be relied upon without subsequent written confirmation of its contents. Accordingly Information Systems of Maryland, LLC., its subsidiaries and all its associated entities disclaim all responsibility and accept no liability (including in negligence) for the unauthorized use of such information prior to the receipt by the above addressed person(s). Any disclosure, copying, distribution or the taking of any action in reliance on the contents of the information received in error is strictly prohibited by U.S. Law (Title 18, Section 2511). If you have received this electronic message in error, please notify the sender and delete the electronic message and any associated content of its transmission.

2 1

radius authentication via TCP/TLS
by Alan Smith 04 Jul '26

04 Jul '26

Greetings all. I am currently running Freeradius on RHEL 8.10 in a lab. It has custom site configured and make use of sql for radius client table.Customised perl module is used for the authentication. It listens on UDP 1812 and 1813. I would say it is working fine. I would like to check the use of Radius over TLS on TCP 2083 for some of the clients. I update tls in sites-available and created symlink in sites-enabled. Configured the custom CA certs.It is now listening at TCP 2083. I want to test if the clients from sql be recognized. Is there like a tool NTRadping? I can test from either Windows or Linux.I do not have any device that can authenticate. Kindly advise. Thank you.

4 4

MCP Server
by Kushal Gupta 02 Jul '26

02 Jul '26

Hello, While reviewing the FreeRADIUS documentation, I would like to confirm if there is an MCP server available for this project. Best regards, Kushal Gupta

5 5

No full certificate chain in EAP in 3.2.7
by Dave Wang 30 Jun '26

30 Jun '26

Hi there, Recently I upgraded from freeradius 3.0.26 (with openssl 3.0.20) to 3.2.7/3.2.8, (with openssl 3.5.0), and I noticed that the server does not send the full certificate chain to the EAP client anymore. The server certificate has a chained structure like cert->intermediate CA2->intermediate CA1->root CA, and I am relying on the auto_chain and the ca_path to construct the chain on the freeradius side. Now it only sends the server_certificate + intermediate CA2, but previously it sent all *four* certificates. Is this a known issue? Regards, Dave

2 1

Mailing list infrastructure move
by Arran Cudbard-Bell 27 Jun '26

27 Jun '26

Hi All, The list server has moved onto our IP space 199.66.222.136 (AS54975), from 184.95.211.22. Please report any issues. Many Thanks, -Arran

1 0

Freeradius 3.2.x TEAP Support for Machine Only Authentication
by Suriya Shankar 16 Jun '26

16 Jun '26

Hi Alan, With the current EAP-TEAP implementation, we don't have the option to support devices that only want to use Machine Auth. I implemented and tested this on my machine and it works as expected. The changes I made as follows diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c index b30ab7e3d3..36b2dbdfa3 100644 --- a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c +++ b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c @@ -1217,6 +1217,7 @@ static PW_CODE eap_teap_phase2(REQUEST *request, eap_handler_t *eap_session, { PW_CODE code = PW_CODE_ACCESS_REJECT; rlm_rcode_t rcode; + bool machine_only = false; VALUE_PAIR *tvp; teap_tunnel_t *t = (teap_tunnel_t *)tls_session->opaque; int eap_method = 0; @@ -1253,6 +1254,17 @@ static PW_CODE eap_teap_phase2(REQUEST *request, eap_handler_t *eap_session, RDEBUG("Phase 2: Got tunneled identity of %s", t->username->vp_strvalue); + } else if (tvp && + (tvp->vp_length == EAP_HEADER_LEN + 1) && + (tvp->vp_strvalue[0] == PW_EAP_RESPONSE) && + (tvp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY)) { + /* + * Empty inner EAP-Identity indicates machine-only auth: finish + * with final TEAP Result TLV, then wait for client Result echo. + */ + RDEBUG2("Phase 2: Received empty inner EAP-Identity; treating as machine-only TEAP completion"); + machine_only = true; + } else if (!fake->username) { /* * Don't reject the request outright, @@ -1556,12 +1568,14 @@ done: * Call authentication recursively, which will * do PAP, CHAP, MS-CHAP, etc. */ - rad_virtual_server(fake, true); + if (!machine_only) { + rad_virtual_server(fake, true); + } /* * Decide what to do with the reply. */ - switch (fake->reply->code) { + switch (machine_only ? PW_CODE_ACCESS_CHALLENGE : fake->reply->code) { case 0: tvp = fr_pair_find_by_num(fake->config, PW_RESPONSE_PACKET_TYPE, 0, TAG_ANY); if (tvp && (tvp->vp_integer == PW_CODE_ACCESS_CHALLENGE)) { @@ -1573,6 +1587,15 @@ done: code = PW_CODE_ACCESS_REJECT; break; + case PW_CODE_ACCESS_CHALLENGE: + if (machine_only) { + t->result_final = true; + eap_teap_append_result(request, tls_session, PW_CODE_ACCESS_ACCEPT); + code = PW_CODE_ACCESS_CHALLENGE; + break; + } + /* FALL-THROUGH */ + case PW_CODE_ACCESS_ACCEPT: tvp = fr_pair_find_by_num(fake->packet->vps, PW_EAP_TYPE, 0, TAG_ANY); if (tvp) { *And the logs from my testing * *From the client we received after authenticating the Machine Certificate* Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Session established. Proceeding to decode tunneled attributes Mon Jun 15 22:14:10 2026 : Debug: TEAP tunnel data total 101 TEAP tunnel data in 00: 80 0c 00 4c 00 01 01 21 9a 89 af 0a 7d e6 5d b1 TEAP tunnel data in 10: 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 a3 TEAP tunnel data in 20: 22 3b 6e c8 31 c8 9b e5 00 00 00 00 00 00 00 00 TEAP tunnel data in 30: 00 00 00 00 00 00 00 00 00 00 00 00 b6 0e 4f 32 TEAP tunnel data in 40: 5f ab f5 f7 28 37 3d cd 9e 1c ee 0b 6a ab c8 05 TEAP tunnel data in 50: 80 0a 00 02 00 01 00 02 00 02 00 01 80 09 00 05 TEAP tunnel data in 60: 02 82 00 05 01 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Got Tunneled TEAP TLVs Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Found the pair by TEAP_TLV_IDENTITY copying the value to t->identity Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: FreeRADIUS-EAP-TEAP-Crypto-Binding = 0x000101219a89af0a7de65db1229b2aebad14809a0b721fa4876b65a3223b6ec831c89be50000000000000000000000000000000000000000b60e4f325fabf5f728373dcd9e1cee0b6aabc805 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: FreeRADIUS-EAP-TEAP-Intermediate-Result = Success Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: FreeRADIUS-EAP-TEAP-EAP-Payload = 0x0282000501 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: BUFFER for Compound MAC calculation - hexdump(len=123): 80 0c 00 4c 00 01 01 21 9a 89 af 0a 7d e6 5d b1 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 a3 22 3b 6e c8 31 c8 9b e5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 00 01 00 26 53 5f 39 34 64 65 36 36 65 38 2d 35 35 36 61 2d 34 64 35 36 2d 38 37 38 30 2d 61 31 31 34 36 32 30 61 35 63 34 32 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: S-IMCK[j] - hexdump(len=40): 68 d4 a1 17 ad bb de f1 4b fb cb 4c 94 71 95 63 60 b2 f7 91 24 c4 6d ca ef 7d c8 13 56 a5 47 d4 b3 fd 0a 0a 18 ad 68 4d Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (MSK) - hexdump(len=64): f3 93 64 e5 bd 76 78 39 ff c6 b6 8f 85 ad 95 ff 56 9e 60 ae 4e c9 51 c1 8b 55 20 5b 4a 59 ec a9 9e 58 9c d8 63 1c 4a b6 f4 3d cb f5 6f 07 14 13 ea 91 ff fb 7c b8 52 89 fd fa 5a f9 b5 ff 3f 9e Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (EMSK) - hexdump(len=64): 9b e4 9d 86 ff c5 f1 fa f0 16 62 11 ca 09 ed d7 39 6b c0 90 03 22 ac bd d4 6b b9 35 eb 26 5c b9 9f 20 c0 6b f7 a8 ec 5b 7f a7 4e 14 97 86 95 9e de 9f c4 e5 04 dc 85 dd 96 0f 8d 6e 68 27 30 56 02 82 00 05 01 -> Sending the identity packet without any username for the client preferring Machine Only Authentication. *When challenged by Accept as the changes shown in the diff, client accepts the connection* Debug: TEAP tunnel data total 6 TEAP tunnel data in 00: 80 03 00 02 00 01 Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap: Got Tunneled TEAP TLVs Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap: FreeRADIUS-EAP-TEAP-Result = Success Mon Jun 15 22:14:10 2026 : Debug: (136) eap_S_94de66e8-556a-4d56-8780-a114620a5c42: Sending If you find this good, I would like to raise a PR. If any changes required or if it's not the way as expected, will update it accordingly Thanks, Suriya

2 2

Windows 11 and Session Resumption
by Alan DeKok 15 Jun '26

15 Jun '26

I've attached a file with instructions for how to test session resumption with Windows 11 (Insider preview) and PEAP / TTLS. Until now, session resumption has only been supported in EAP-TLS. This change should make a noticeable difference for the university crowd. The load on the RADIUS server will drop significantly once this feature is available. Please test and report back. It's easier to check things now, rather than trying to work out what's wrong after something gets shipped in an official release. These instructions are direct from Microsoft. There's no ETA on when it will be in Windows 11, but any and all feedback on testing will help to move this forward.

2 3

Upgrading to 3.2.10 Breaks EAP-TLS
by Hector Rodriguez 14 Jun '26

14 Jun '26

Community, After upgrading to the latest and greatest, I have authentication issues again with EAP-TLS. TLS handshake has no issues, but my Windows 11 client does not want to authenticate anymore. Certs were checked, no warning , successful handshakes. Should I revert back 3.2.9 ? Everything worked in the last version, but release notes stated there were memory leak issues. [cid:c71a9768-dc21-43c6-bb02-45e1deeb48a4] Hector Rodriguez Cloud Administrator WestCare Foundation Phone (702) 482 0922 Web westcare.com Email hector.rodriguez(a)westcare.com<mailto:hector.rodriguez@westcare.com> Office 1711 Whitney Mesa, Henderson, NV 89014 [cid:a0282c75-4d2b-465b-a672-a3770b4237b0]<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> Book time to meet with me<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> -- CONFIDENTIALITY NOTICE: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. This communication may contain material protected by HIPAA legislation (45 CFR, Parts 160 & 164) or by 42 CFR Part 2. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is strictly prohibited. If you have received this email in error, please notify the sender by reply email and destroy all copies of the original message.

2 2

Version 3.2.10 and 3.0.28 have been released
by Matthew Newton 08 Jun '26

08 Jun '26

We have released FreeRADIUS versions 3.2.10 (and 3.2.9, ahem), and 3.0.28. These releases contain bug fixes for a number of overflows and memory leaks. Please see the announcement at https://www.freeradius.org/security/ There are also a lot of other updates and improvements. Please see the changelog. We recommend that everyone upgrades to these new versions. Those still on 3.0.x should consider making the move to 3.2.10. There are now few reasons to stay on 3.0. Except for critical security issues, this is likely to be the last release in the 3.0 branch. Packages are not available for 3.0.28 on several newer distributions as it will no longer build - please upgrade to 3.2.10. Download from the usual places: https://www.freeradius.org/releases/ https://www.freeradius.org/ftp/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_10 Pre-built packages for common Linux distributions are available from InkBridge Networks: https://packages.inkbridgenetworks.com/ -- Matthew

5 5

detail listener is broken in the 3.2.9 release
by Bjørn Mork 02 Jun '26

02 Jun '26

I bisected it down to https://github.com/FreeRADIUS/freeradius-server/commit/5691cbc615e515490fc4… It didn't revert cleanly so I looked a bit closer and noticed that it ends up changing if (!request->packet->vps) { .. } else { rcode = 0; } .. return 1; into a more direct if (request->packet->vps) return 0; The problem is obviously that the return value changes from 1 to 0. Simple fix ready for pulling at https://github.com/FreeRADIUS/freeradius-server/pull/5870 (yes, I found this and verified the fix in a real world installation) Bjørn

2 1