- Freeradius-Users - lists.freeradius.org

Issue with SQL-Group
by David Lake 13 Oct '26

13 Oct '26

Hello FreeRadius 3.2.10 with sqlippool and split read/write to a backend Galera cluster. I have an issue where SQL-Group is not populating the group since I’ve moved from a single module (sql) to two (sql_read and sql_write). This is what I see with a single module named sql: (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: --> SELECT groupname FROM radusergroup WHERE username = '100061702368(a)boxbb.uk' ORDER BY priority (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = '100061702368(a)boxbb.uk' ORDER BY priority (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: User found in the group table (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '1g' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '1g' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Group "1g": Conditional check items matched (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Group "1g": Merging assignment check items (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '1g' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '1g' ORDER BY id (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: Group "1g": Merging reply items (1596321) Tue Oct 13 07:04:26 2026: Debug: sql: ERX-CoS-Shaping-Pmt-Type = "T06 1g” This is what I see when I change the module to be sql_read: (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: --> SELECT groupname FROM radusergroup WHERE username = '10091055046(a)boxbb.uk' ORDER BY priority (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Executing select query: SELECT groupname FROM radusergroup WHERE username = '10091055046(a)boxbb.uk' ORDER BY priority (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: User found in the group table (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Group "1g": Conditional check items matched (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Group "1g": Merging assignment check items (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '' ORDER BY id (55912) Tue Oct 13 06:28:24 2026: Debug: sql_read: Group "1g": Merging reply items The difference is in the bold line - the response from sql_read no longer has the groupname set. Nothing has changed in the database. What have I missed please? Thanks David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

2 2

3.2.x: clients read from SQL still ignore require_message_authenticator / limit_proxy_state (#5378)
by Kushal Gupta 09 Oct '26

09 Oct '26

Hi, I'm running FreeRADIUS 3.2.5 (Ubuntu 24.04 package) with clients loaded from the nas table (rlm_sql, read_clients = yes, stock client_query). The NASes are MikroTik routers. In radiusd.conf: security { require_message_authenticator = yes limit_proxy_state = auto } These settings don't apply to clients read from SQL. They do apply to clients from clients.conf. Hand-built Access-Requests (radclient always adds Message-Authenticator, so I built the packets myself), sent from the same IP, defined either as a nas row or as a clients.conf client: Client defined as a nas row (SQL): - no Message-Authenticator: answered - no Message-Authenticator, with Proxy-State: answered - with Message-Authenticator: answered Client defined in clients.conf with require_message_authenticator = yes: - no Message-Authenticator: dropped - no Message-Authenticator, with Proxy-State: dropped - with Message-Authenticator: answered Client defined in clients.conf with require_message_authenticator = auto: - no Message-Authenticator: answered - no Message-Authenticator, with Proxy-State: dropped - with Message-Authenticator: answered This is GitHub issue #5378 ("Blast parameters does not work for SQL clients"). It was closed after ef5e6560 ("inherit from the main dynamic client definition"), and the last comment there says SQL clients inherit the global settings. As far as I can tell from the current v3.2.x branch, that commit only changed client_afrom_request() (dynamic clients). SQL clients still go through: - rlm_sql.c, generate_sql_clients(): client_afrom_query(..., server, false); so require_ma is always false; - client.c, client_afrom_query(): require_ma comes from that argument, and limit_proxy_state is never set, so it stays at its talloc_zero value. So even on 3.2.6 to 3.2.8, an SQL client seems to get neither setting. Questions: 1. Am I reading this right? If so, would a patch that makes client_afrom_query() start from main_config.require_ma and main_config.limit_proxy_state (the way client_afrom_cs() does) be accepted? Optional per-client columns in client_query could come on top of that. I can open a new issue or a PR. 2. Until then, I'm planning to enforce it in unlang, first thing in authorize, with a per-NAS flag in the nas table (set for NASes whose firmware sends Message-Authenticator): authorize { if (&Proxy-State && !&Message-Authenticator) { do_not_respond } if (!&Message-Authenticator && "%{sql:SELECT require_message_auth FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" == "1") { do_not_respond } ... } Is that a sound workaround, or does it miss something? For example, is a reply ever sent before authorize runs, or are there other packet types I should cover the same way? I know moving the clients to clients.conf would work. I'd like to keep them in SQL because a web panel manages the NAS list. Thanks, Kushal Gupta

2 1

Radius accounting/sqlippool question
by David Lake 09 Oct '26

09 Oct '26

After much work, I have now upgraded my FreeRadius, HAProxy and MariaDB and appear to have a MUCH more performant system - thank you for everyone’s help and ideas. I do have a question because I think I must have missed something. In my ‘default’ I have this: post-auth { ... if(!&reply:Framed-IP-Address) { update reply { control:Pool-Name = "Pool" } sqlippool } if (noop) { reject } -sql_write ... } This allocates an address from the pool ‘Pool. In sqlippool I have this: sqlippool { sql_module_instance = "sql" dialect = "mysql" pool_name = "Pool-Name" ippool_table = "radippool" lease_duration = 3600 allocate_clear_timeout = 1 attribute_name = Framed-IP-Address req_attribute_name = Framed-IP-Address pool_key = "%{Calling-Station-Id}" messages { exists = "Existing IP: %{reply:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IP: %{reply:${..attribute_name}} from %{control:${..pool_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" clear = "Released IP %{request:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" failed = "IP Allocation FAILED from %{control:${..pool_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" nopool = "No ${..pool_name} defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } $INCLUDE ${modconfdir}/sql/ippool/${dialect}/queries.conf } Also in default there is a statement that I should uncomment sqlippool in the accounting section: accounting { detail # # Return an address to the IP Pool when we see a stop record. # # Ensure that &control:Pool-Name is set to determine which # pool of IPs are used. # sqlippool -sql_write exec attr_filter.accounting_response } I’m getting a bit confused here. I can see that ‘control:Pool-Name’ works for authentication because addresses are being allocated from that pool But do I need to uncomment sqlippool and then how to I tell it to use the pool name ‘Pool’? Is pool_name=‘Pool-Name’ referencing the Pool-Name above or is that the actual name of the pool it will use? Thanks David

2 2

FreeRadius 3.0.3 and Galera Cluster
by David Lake 28 Sep '26

28 Sep '26

Hi Need some design advice here please. I have two FR 3.0.3 servers and a 3-node Galera cluster for HA. I’m seeing issues with Deadlocks when under stress - mostly if there is a storm of reconnects. I’m running HAProxy on the FR nodes but there are a couple of things I don’t quite understand: 1. Should I run the ’Skip Locked’ on FreeRadius or not? Some documentation says that I shouldn’t as MariaDB doesn’t support it, but other say newer versions do support it 1. What is the optimal way of configuring HAProxy? 1. How do I separate out writes from reads - I have two sites, each with one FR server and one Galera node. There is a high-speed network between the two, but ideally, I want to keep cross-site traffic to a minimum. (I have another IP allocation question which I’ll ask in another three). Thank you David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

5 10

Status of v4
by Alan DeKok 26 Sep '26

26 Sep '26

Anyone who's been following FreeRADIUS knows that v4 is the "always tomorrow" project. One of the reasons is that for a long time RadSec was "up and coming", but actual work on it was minimal. Unfortunately, other things were higher priority. Happily, it looks like that work is coming to a close. There have been substantial commits to v4 in the last week, which move the bar forward for RadSec. We don't (yet) have a functioning RadSec in the server, but for the first time in a long while, progress is being made. With luck, we will be releasing a beta of v4 before December, which includes RadSec. Alan DeKok.

5 6

Webinar on October 29
by Alan DeKok 25 Sep '26

25 Sep '26

Hi, I'm doing a short webinar on October 29, 1pm EST. It's free, and anyone who attends will get a download link for a free tool. The registration and content page is here: https://www.inkbridgenetworks.com/videos-webinars/inkquire-tools-for-freera… The free tool won't be available immediately after the webinar, but I don't expect the delay to be too long. All of the tools are useful, even in the age of AI. There are a host of reasons to not use AI. The simplest is GPDR (or equivalent). Unless you're running a local model, using any AI system will upload private customer information to the cloud. At which point who knows where it ends up. So there's a need to run local tools. The tools don't need AI, and don't use AI. They run locally, and give you information about what FreeRADIUS is doing. Some of the tools are free, some are not. More details will be in the webinar. I hope to see everyone there. I expect the webinar to be useful to most people who are running FreeRADIUS. Alan DeKok.

1 0

Initial install for Client.
by Parks, Grady * 22 Sep '26

22 Sep '26

Hello, I am trying to complete the install of freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64.rpm but I need to download some additional rpms to build a repo. - nothing provides libfreeradius-dhcp.so()(64bit) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides libfreeradius-eap.so()(64bit) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides libfreeradius-radius.so()(64bit) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides libfreeradius-server.so()(64bit) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides perl(DBI) needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline - nothing provides freeradius = 3.0.20-15.module+el8.10.0+90375+641abe33 needed by freeradius-utils-3.0.20-15.module+el8.10.0+90375+641abe33.x86_64 from @commandline (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) Can someone assist me with where I can get the missing components where I can successfully install this product? Thanks Grady D. Parks OIMT / DIO (Division of Infrastructure Operations) FDA Account, Server Operations FDA Data Center and Infrastructure Support Contractor - Peraton e-mail: grady.parks(a)fda.hhs.gov<mailto:grady.parks@fda.hhs.gov> Phone: 240-762-2227 Linux Team Lead - Dan Drummond Linux Manager - Nancy Coultas-Carol

2 1

Small report on the status of v4
by Alan DeKok 18 Sep '26

18 Sep '26

Yes, it's still ongoing. Anyone who checks the commits on GitHub will see a lot of activity. The main blocker is still RadSec. We're working on it, but are actively making progress. Unfortunately, other things keep getting in the way. One thing which is slowing down progress on RadSec in v4 is the status of RadSec in v3. Anyone who checks the commits on GitHub will see a lot of activity in the v3.2.x branch, too. There have been many fixes to odd corner cases, and more test cases added. I'd like to thank Paul Dekkers for his ongoing assistance with testing the changes. That effort makes a big difference. I'll go back now to worrying abut the ongoing AI takeover of almost everything. :( Alan DeKok.

2 2

FreeRadius 3.0.3 IP Allocation Failure
by David Lake 17 Sep '26

17 Sep '26

Hi I have FreeRadius configured to allocate v4 from sqlippool but to send a pool name to the router for v6 allocation. Occasionally, I see v4 allocation failures. Obviously I am getting to the bottom of this but in the meantime if I see a v4 allocation fail, I want to immediately send an auth-fail. At the moment, if the v4 fails, the process continues and I send the v6 pool name. The result is that the client authenticates, gets a v6 address but no v4 address. Can someone point me in the right direction of how to modify the logic to do this please? Thanks David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

2 2

FreeRADIUS 3.2.8 EAP-TLS OCSP fails with AWS Private CA: signer certificate not found
by andrew.aveyard＠justice.gov.uk 12 Aug '26

12 Aug '26

Hi all, We are investigating an OCSP validation issue with FreeRADIUS 3.2.8 and AWS ACM Private CA managed OCSP. EAP-TLS certificate validation works when native OCSP is disabled. When native OCSP is enabled, authentication fails during the OCSP check with: (11) eap_tls: Starting OCSP Request (11) eap_tls: ocsp: Using responder URL "http://ocsp.acm-pca.eu-west-2.amazonaws.com:80/" (11) eap_tls: ERROR: (TLS) ocsp: Couldn't verify OCSP basic response: error:13800076:OCSP routines::signer certificate not found (11) eap_tls: ERROR: (TLS) ocsp: Certificate has been expired/revoked (11) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:0A000086:SSL routines::certificate verify failed (11) Sent Access-Reject Environment: FreeRADIUS: 3.2.8 OS/container: Alpine 3.23 TLS: EAP-TLS via rlm_eap OCSP responder: AWS ACM Private CA managed OCSP OCSP nonce: disabled, as AWS Private CA managed OCSP does not support request extensions The relevant section from EAP TLS configuration is: verify { tmpdir = /tmp/radiusd client = "/usr/bin/openssl verify -verbose -CAfile ${certdir}/ca-bundle.pem -CApath ${certdir} %{TLS-Client-Cert-Filename}" } ocsp { enable = yes override_cert_url = no use_nonce = no } } The OCSP response from AWS contains: OCSP Response Status: successful (0x0) Response Type: Basic OCSP Response Responder Id: C = GB, O = xxxxxx, OU = NACS, CN = xxxxxxxxxxxxxx-20260701113446 Cert Status: good This Update: Aug 11 10:18:25 2026 GMT Next Update: Aug 18 09:18:25 2026 GMT Signature Algorithm: sha256WithRSAEncryption We do not see an embedded responder certificate in the OCSP response output. The responder ID appears to match the issuing CA. Standalone OpenSSL tests inside the same container succeed. Command without -verify_other: openssl ocsp \ -issuer issuing-ca.pem \ -cert ocsp-test-client.pem \ -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \ -CAfile root-ca.pem \ -no_nonce \ -resp_text Result: Response verify OK ocsp-test-client.pem: good Command with -verify_other: openssl ocsp \ -issuer issuing-ca.pem \ -cert ocsp-test-client.pem \ -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \ -CAfile root-ca.pem \ -verify_other issuing-ca.pem \ -no_nonce \ -resp_text Result: Response verify OK ocsp-test-client.pem: good We have also tested EAP-TLS with the supplicant sending: 1. leaf certificate + issuing CA 2. leaf certificate only Both cases fail in FreeRADIUS native OCSP with the same error: OCSP routines::signer certificate not found We have also tested adding root + issuing CA to ca-bundle.pem, configuring both ca_file and ca_path, and running openssl rehash on the certificate directories before FreeRADIUS starts. That did not change the FreeRADIUS native OCSP result. So the current state is: - AWS OCSP endpoint is reachable from the container - AWS returns Cert Status: good - standalone OpenSSL ocsp verification succeeds inside the same container - FreeRADIUS native OCSP fails during EAP-TLS with signer certificate not found - the failure occurs even when the issuing CA is in ca_file/ca_path - the failure occurs whether the client sends leaf+issuer or leaf only I found this earlier mailing-list thread which looks similar: https://lists.freeradius.org/hyperkitty/list/freeradius-users@lists.freerad… In that thread, the discussion mentions responder certificate purpose / OCSPSigning. In our case the AWS response responder ID appears to be the issuing CA itself, and standalone OpenSSL verifies the response successfully. My question is: what additional certificate/context does FreeRADIUS 3.2.8 need for native OCSP verification here, given that the same OCSP response verifies successfully with standalone OpenSSL in the same container? Is there any additional debug output or specific certificate inspection that would help confirm why FreeRADIUS cannot locate the OCSP response signer? Thanks, Andrew

1 0