- Freeradius-Users - lists.freeradius.org

FreeRADIUS 3.2.8 EAP-TLS OCSP fails with AWS Private CA: signer certificate not found
by andrew.aveyard＠justice.gov.uk 12 Aug '26

12 Aug '26

Hi all, We are investigating an OCSP validation issue with FreeRADIUS 3.2.8 and AWS ACM Private CA managed OCSP. EAP-TLS certificate validation works when native OCSP is disabled. When native OCSP is enabled, authentication fails during the OCSP check with: (11) eap_tls: Starting OCSP Request (11) eap_tls: ocsp: Using responder URL "http://ocsp.acm-pca.eu-west-2.amazonaws.com:80/" (11) eap_tls: ERROR: (TLS) ocsp: Couldn't verify OCSP basic response: error:13800076:OCSP routines::signer certificate not found (11) eap_tls: ERROR: (TLS) ocsp: Certificate has been expired/revoked (11) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:0A000086:SSL routines::certificate verify failed (11) Sent Access-Reject Environment: FreeRADIUS: 3.2.8 OS/container: Alpine 3.23 TLS: EAP-TLS via rlm_eap OCSP responder: AWS ACM Private CA managed OCSP OCSP nonce: disabled, as AWS Private CA managed OCSP does not support request extensions The relevant section from EAP TLS configuration is: verify { tmpdir = /tmp/radiusd client = "/usr/bin/openssl verify -verbose -CAfile ${certdir}/ca-bundle.pem -CApath ${certdir} %{TLS-Client-Cert-Filename}" } ocsp { enable = yes override_cert_url = no use_nonce = no } } The OCSP response from AWS contains: OCSP Response Status: successful (0x0) Response Type: Basic OCSP Response Responder Id: C = GB, O = xxxxxx, OU = NACS, CN = xxxxxxxxxxxxxx-20260701113446 Cert Status: good This Update: Aug 11 10:18:25 2026 GMT Next Update: Aug 18 09:18:25 2026 GMT Signature Algorithm: sha256WithRSAEncryption We do not see an embedded responder certificate in the OCSP response output. The responder ID appears to match the issuing CA. Standalone OpenSSL tests inside the same container succeed. Command without -verify_other: openssl ocsp \ -issuer issuing-ca.pem \ -cert ocsp-test-client.pem \ -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \ -CAfile root-ca.pem \ -no_nonce \ -resp_text Result: Response verify OK ocsp-test-client.pem: good Command with -verify_other: openssl ocsp \ -issuer issuing-ca.pem \ -cert ocsp-test-client.pem \ -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \ -CAfile root-ca.pem \ -verify_other issuing-ca.pem \ -no_nonce \ -resp_text Result: Response verify OK ocsp-test-client.pem: good We have also tested EAP-TLS with the supplicant sending: 1. leaf certificate + issuing CA 2. leaf certificate only Both cases fail in FreeRADIUS native OCSP with the same error: OCSP routines::signer certificate not found We have also tested adding root + issuing CA to ca-bundle.pem, configuring both ca_file and ca_path, and running openssl rehash on the certificate directories before FreeRADIUS starts. That did not change the FreeRADIUS native OCSP result. So the current state is: - AWS OCSP endpoint is reachable from the container - AWS returns Cert Status: good - standalone OpenSSL ocsp verification succeeds inside the same container - FreeRADIUS native OCSP fails during EAP-TLS with signer certificate not found - the failure occurs even when the issuing CA is in ca_file/ca_path - the failure occurs whether the client sends leaf+issuer or leaf only I found this earlier mailing-list thread which looks similar: https://lists.freeradius.org/hyperkitty/list/freeradius-users@lists.freerad… In that thread, the discussion mentions responder certificate purpose / OCSPSigning. In our case the AWS response responder ID appears to be the issuing CA itself, and standalone OpenSSL verifies the response successfully. My question is: what additional certificate/context does FreeRADIUS 3.2.8 need for native OCSP verification here, given that the same OCSP response verifies successfully with standalone OpenSSL in the same container? Is there any additional debug output or specific certificate inspection that would help confirm why FreeRADIUS cannot locate the OCSP response signer? Thanks, Andrew

1 0

New mailman server
by Arran Cudbard-Bell 11 Aug '26

11 Aug '26

Hi All, The mailing lists (users, devel, announce), have been upgraded to Mailman 3.3. Accounts should've migrated across with preferences, and credentials preserved. Please report any issues. Many Thanks, -Arran

1 1

Copying User-Name from inner tunnel to outer for accounting
by Dominik George 22 Jul '26

22 Jul '26

Hi, I am trying to do accounting for a user that previously authenticated through RADIUS. I know that the best way would be to use cui and have the NAS send a properly hashed identifier in its Accounting-Request, but unfortunately, my NAS does not support re-using the User-Name from the Access-Response for accounting. It always sends the anomymous identity from EAP instead. My idea was to save the authenticated user in the auth phase in inner tunnel, then extract this again when the accounting request comes in. However, I can't get this to work. What I tried is to set post-auth { update outer.session-state { User-Name := "%{User-Name}" } } in inner tunnel, then accounting { update request { User-Name := "%{session-state:User-Name}" } } in the outer config. HOwever, it always is empty that way. I verified that the NAS does correctly send the same Acct-Session-Id for both the auth ant the accounting requests, so FreeRADIUS should be able to correlate the state. The accounting request will ultimately be forwarded using the REST module. Can anyone explain how I could get this to work? Kind regards, Nik

5 13

FreeRADIUS RHEL 10 Upgrade – Older Client TLS Compatibility Question
by Mike Diggins 20 Jul '26

20 Jul '26

I'm updating my FreeRADIUS environment to RHEL 10 using the RHEL-provided FreeRADIUS 3.2.8 package and the default OpenSSL version (3.5.5). For the most part, everything is working as it did before, but I have one admittedly very old MacBook Air running Sierra 10.12.6 that no longer works in the new environment. FreeRADIUS is reporting SSL/TLS errors. Long story short, I found I could get it working by lowering what appear to be some of the new minimum SSL/TLS requirements: OS: update-crypto-policies --set LEGACY FreeRADIUS: tls_min_version = "1.0" FreeRADIUS: cipher_list = "DEFAULT@SECLEVEL=0" I had to drop it all the way back to TLS 1.0 for this client to work. While researching, I noticed that even this older version of macOS should (?) support TLS 1.2, so I'm trying to understand why it no longer works. My previous FreeRADIUS server was running on RHEL 7 with FreeRadius 3.0.13 and OpenSSL 1.0.2. I'm also wondering what kind of security impact there would be if I left these settings in place. We are a large BYOD environment with many different types of clients, and I don't know how many other devices may have similar compatibility issues. -Mike

2 1

No full certificate chain in EAP in 3.2.7
by Dave Wang 17 Jul '26

17 Jul '26

Hi there, Recently I upgraded from freeradius 3.0.26 (with openssl 3.0.20) to 3.2.7/3.2.8, (with openssl 3.5.0), and I noticed that the server does not send the full certificate chain to the EAP client anymore. The server certificate has a chained structure like cert->intermediate CA2->intermediate CA1->root CA, and I am relying on the auto_chain and the ca_path to construct the chain on the freeradius side. Now it only sends the server_certificate + intermediate CA2, but previously it sent all *four* certificates. Is this a known issue? Regards, Dave

2 2

Fresh Install of 4.0 on jammy using package from networkradius.com getting Efault: Bad address and Opening radius I/O interface failed
by Jonathan Dukes 15 Jul '26

15 Jul '26

I'm trying to setup an instance of freeradius 4.0 so that I can use the IMAP authentication module to authenticate from our Google workspace since the non-profit version is not allowed to use LDAP and we can't afford to switch a paid version that will allow it. I used the package from networkradius.com on a fresh install of jammy per the install guide. But when I went to start it gives this Error: Error : Network - Failed adding new socket to network event loop: Failed inserting filters for FD 17: EFAULT: Bad address Error : /etc/freeradius/sites-enabled/default[275]: Opening radius I/O interface failed The only other reference I can find for that says I'm using the wrong version of libkqueue. Here's the info on the vesion I'm running: root@freeradius:/etc/freeradius# apt show libkqueue-dev Package: libkqueue-dev Version: 2.7.0-nr+git41 Priority: optional Section: libdevel Source: libkqueue Maintainer: Mark Heily <mark(a)heily.com> Installed-Size: 41.0 kB Depends: libkqueue0 (= 2.7.0-nr+git41) Homepage: https://github.com/mheily/libkqueue/wiki Download-Size: 12.5 kB APT-Sources: http://packages.networkradius.com/extras/ubuntu/jammy jammy/main amd64 Packages Description: Development files for libkqueue Contains the header files, manpages, and static libraries for use in developing applications that use the libkqueue library. . libkqueue is a portable userspace implementation of the kqueue(2) kernel event notification mechanism found in FreeBSD and other BSD-based operating systems. The library translates between the kevent structure and the native kernel facilities of the host machine. N: There are 7 additional records. Please use the '-a' switch to see them. I have included the full output of the debug output below. Thanks, Jonathan Dukes Technical Ministry New Heights Church JDukes(a)NewHeights.org Info : Copyright 1999-2023 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/freeradius/dictionary" Debug : including configuration file /etc/freeradius/radiusd.conf Debug : Including files in directory "/etc/freeradius/template.d/" Debug : including configuration file /etc/freeradius/template.d/default Debug : including configuration file /etc/freeradius/clients.conf Debug : Including files in directory "/etc/freeradius/global.d/" Debug : including configuration file /etc/freeradius/global.d/ldap Debug : including configuration file /etc/freeradius/global.d/python Debug : Including files in directory "/etc/freeradius/mods-enabled/" Debug : including configuration file /etc/freeradius/mods-enabled/always Debug : including configuration file /etc/freeradius/mods-enabled/attr_filter Debug : including configuration file /etc/freeradius/mods-enabled/cache_eap Debug : including configuration file /etc/freeradius/mods-enabled/chap Debug : including configuration file /etc/freeradius/mods-enabled/client Debug : including configuration file /etc/freeradius/mods-enabled/delay Debug : including configuration file /etc/freeradius/mods-enabled/detail Debug : including configuration file /etc/freeradius/mods-enabled/detail.log Debug : including configuration file /etc/freeradius/mods-enabled/digest Debug : including configuration file /etc/freeradius/mods-enabled/eap Debug : including configuration file /etc/freeradius/mods-enabled/eap_inner Debug : including configuration file /etc/freeradius/mods-enabled/echo Debug : including configuration file /etc/freeradius/mods-enabled/exec Debug : including configuration file /etc/freeradius/mods-enabled/files Debug : including configuration file /etc/freeradius/mods-enabled/linelog Debug : including configuration file /etc/freeradius/mods-enabled/mschap Debug : including configuration file /etc/freeradius/mods-enabled/ntlm_auth Debug : including configuration file /etc/freeradius/mods-enabled/pam Debug : including configuration file /etc/freeradius/mods-enabled/pap Debug : including configuration file /etc/freeradius/mods-enabled/passwd Debug : including configuration file /etc/freeradius/mods-enabled/radutmp Debug : including configuration file /etc/freeradius/mods-enabled/sradutmp Debug : including configuration file /etc/freeradius/mods-enabled/stats Debug : including configuration file /etc/freeradius/mods-enabled/unix Debug : including configuration file /etc/freeradius/mods-enabled/unpack Debug : including configuration file /etc/freeradius/mods-enabled/utf8 Debug : Including files in directory "/etc/freeradius/policy.d/" Debug : including configuration file /etc/freeradius/policy.d/abfab-tr Debug : including configuration file /etc/freeradius/policy.d/accounting Debug : including configuration file /etc/freeradius/policy.d/canonicalisation Debug : including configuration file /etc/freeradius/policy.d/control Debug : including configuration file /etc/freeradius/policy.d/cui Debug : including configuration file /etc/freeradius/policy.d/debug Debug : including configuration file /etc/freeradius/policy.d/dhcp Debug : including configuration file /etc/freeradius/policy.d/eap Debug : including configuration file /etc/freeradius/policy.d/filter Debug : including configuration file /etc/freeradius/policy.d/operator-name Debug : including configuration file /etc/freeradius/policy.d/time Debug : including configuration file /etc/freeradius/policy.d/vendor Debug : Including files in directory "/etc/freeradius/sites-enabled/" Debug : including configuration file /etc/freeradius/sites-enabled/default Debug : Loaded module process_radius Debug : including configuration file /etc/freeradius/sites-enabled/inner-tunnel Debug : Parsing initial logging configuration. Debug : main { Debug : prefix = /usr Debug : log { Debug : destination = files Debug : syslog_facility = daemon Debug : local_state_dir = "/usr/var" Debug : logdir = "/usr/var/log" Debug : file = /var/log/freeradius/radius.log Debug : suppress_secrets = no Debug : } Debug : } Debug : Parsing security rules to bootstrap UID / GID / chroot / etc. Debug : main { Debug : log { Debug : } Debug : security { Debug : user = freerad Debug : group = freerad Debug : allow_core_dumps = no Debug : openssl_fips_mode = no Debug : } Debug : name = freeradius Debug : local_state_dir = "/usr/var" Debug : run_dir = /var/run/freeradius Debug : } Debug : Parsing main configuration Debug : main { Debug : server default { Debug : namespace = radius Debug : radius { Debug : Access-Request { Debug : log { Debug : stripped_names = no Debug : auth = no Debug : auth_badpass = no Debug : auth_goodpass = no Debug : msg_denied = "You are already logged in - access denied" Debug : } Debug : session { Debug : timeout = 15 Debug : max = 4096 Debug : } Debug : } Debug : } Debug : Loaded module proto_radius Debug : listen { Debug : type = Access-Request Debug : type = Status-Server Debug : transport = udp Debug : Loaded module proto_radius_udp Debug : udp { Debug : ipaddr = * Debug : port = 1812 Debug : networks { Debug : allow = 127/8 Debug : allow = 192.0.2/24 Debug : } Debug : max_packet_size = 4096 Debug : max_attributes = 255 Debug : } Debug : limit { Debug : cleanup_delay = 5.0 Debug : idle_timeout = 60.0 Debug : nak_lifetime = 30.0 Debug : max_connections = 256 Debug : max_clients = 256 Debug : max_pending_packets = 256 Debug : } Debug : priority { Debug : Access-Request = high Debug : Accounting-Request = low Debug : CoA-Request = normal Debug : Disconnect-Request = low Debug : Status-Server = now Debug : } Debug : } Debug : listen tcp_auth { Debug : type = Access-Request Debug : type = Status-Server Debug : transport = tcp Debug : Loaded module proto_radius_tcp Debug : tcp { Debug : ipaddr = * Debug : port = 1812 Debug : networks { Debug : allow = 127/8 Debug : allow = 192.0.2/24 Debug : } Debug : max_packet_size = 4096 Debug : max_attributes = 255 Debug : } Debug : limit { Debug : cleanup_delay = 5.0 Debug : idle_timeout = 30.0 Debug : nak_lifetime = 30.0 Debug : max_connections = 1024 Debug : max_clients = 256 Debug : max_pending_packets = 256 Debug : } Debug : priority { Debug : Access-Request = high Debug : Accounting-Request = low Debug : CoA-Request = normal Debug : Disconnect-Request = low Debug : Status-Server = now Debug : } Debug : } Debug : listen udp_acct { Debug : type = Accounting-Request Debug : transport = udp Debug : udp { Debug : ipaddr = * Debug : port = 1813 Debug : networks { Debug : } Debug : max_packet_size = 4096 Debug : max_attributes = 255 Debug : } Debug : limit { Debug : cleanup_delay = 5.0 Debug : idle_timeout = 30.0 Debug : nak_lifetime = 30.0 Debug : max_connections = 1024 Debug : max_clients = 256 Debug : max_pending_packets = 256 Debug : } Debug : priority { Debug : Access-Request = high Debug : Accounting-Request = low Debug : CoA-Request = normal Debug : Disconnect-Request = low Debug : Status-Server = now Debug : } Debug : } Debug : } Debug : server inner-tunnel { Debug : namespace = radius Debug : radius { Debug : Access-Request { Debug : log { Debug : stripped_names = no Debug : auth = no Debug : auth_badpass = no Debug : auth_goodpass = no Debug : msg_denied = "You are already logged in - access denied" Debug : } Debug : session { Debug : timeout = 15 Debug : max = 4096 Debug : } Debug : } Debug : } Debug : listen { Debug : type = Access-Request Debug : transport = udp Debug : udp { Debug : ipaddr = 127.0.0.1 Debug : port = 18120 Debug : networks { Debug : } Debug : max_packet_size = 4096 Debug : max_attributes = 255 Debug : } Debug : limit { Debug : cleanup_delay = 5.0 Debug : idle_timeout = 30.0 Debug : nak_lifetime = 30.0 Debug : max_connections = 1024 Debug : max_clients = 256 Debug : max_pending_packets = 256 Debug : } Debug : priority { Debug : Access-Request = high Debug : Accounting-Request = low Debug : CoA-Request = normal Debug : Disconnect-Request = low Debug : Status-Server = now Debug : } Debug : } Debug : } Debug : log { Debug : colourise = yes Debug : } Debug : security { Debug : } Debug : sbin_dir = "/usr/sbin" Debug : logdir = /var/log/freeradius Debug : radacctdir = /var/log/freeradius/radacct Debug : reverse_lookups = no Debug : hostname_lookups = yes Debug : max_request_time = 30 Debug : pidfile = /var/run/freeradius/freeradius.pid Debug : debug_level = 0 Debug : max_requests = 16384 Debug : resources { Debug : } Debug : thread pool { Debug : num_networks = 1 Info : Dynamically determined thread.workers = 4 Debug : num_workers = 4 Debug : openssl_async_pool_init = 64 Debug : openssl_async_pool_max = 1024 Debug : } Debug : migrate { Debug : rewrite_update = false Debug : forbid_update = false Debug : } Debug : } Info : Switching to configured log settings Debug : freeradius: #### Loading Clients #### Debug : client localhost { Debug : ipaddr = 127.0.0.1 Debug : secret = <<< secret >>> Debug : require_message_authenticator = no Debug : proto = * Debug : limit { Debug : max_connections = 16 Debug : lifetime = 0 Debug : idle_timeout = 30 Debug : } Debug : } Debug : client localhost_ipv6 { Debug : ipv6addr = ::1 Debug : secret = <<< secret >>> Debug : limit { Debug : max_connections = 16 Debug : lifetime = 0 Debug : idle_timeout = 30s Debug : } Debug : } Warn : radiusd - Process concurrency checks disabled: Failed associating semaphore with "/etc/freeradius/freeradius.conf" ID 0x66: ENOENT: No such file or directory Info : Debugger not attached Info : systemd watchdog is disabled Info : pre-suid-down capabilities: =p Warn : trigger { ... } subsection not found, triggers will be disabled Debug : #### Instantiating libraries #### Debug : #### Bootstrapping process modules #### Debug : Bootstrapping process_radius "default" Debug : Creating Auth-Type = pap Debug : Creating Auth-Type = chap Debug : Creating Auth-Type = mschap Debug : Creating Auth-Type = digest Debug : Creating Auth-Type = ldap Debug : Creating Auth-Type = eap Debug : Bootstrapping process_radius "inner-tunnel" Debug : #### Bootstrapping protocol modules #### Debug : Bootstrapping proto_radius "default.radius" Debug : client localhost { Debug : ipaddr = 192.0.2.1 Debug : secret = <<< secret >>> Debug : shortname = sample Debug : limit { Debug : max_connections = 16 Debug : lifetime = 0 Debug : idle_timeout = 30s Debug : } Debug : } Debug : Bootstrapping proto_radius "default.tcp_auth" Debug : Bootstrapping proto_radius "default.udp_acct" Debug : Bootstrapping proto_radius "inner-tunnel.radius" Debug : #### Instantiating libraries #### Debug : #### Bootstrapping modules #### Debug : modules { Debug : Loaded module rlm_always Debug : always reject { Debug : rcode = reject Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always fail { Debug : rcode = fail Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always ok { Debug : rcode = ok Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always handled { Debug : rcode = handled Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always invalid { Debug : rcode = invalid Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always disallow { Debug : rcode = disallow Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always notfound { Debug : rcode = notfound Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always noop { Debug : rcode = noop Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always updated { Debug : rcode = updated Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : Loaded module rlm_attr_filter Debug : attr_filter attr_filter.pre-proxy { Debug : filename = /etc/freeradius/mods-config/attr_filter/pre-proxy Debug : key = "%{Realm}" Debug : relaxed = no Debug : } Debug : attr_filter attr_filter.post-proxy { Debug : filename = /etc/freeradius/mods-config/attr_filter/post-proxy Debug : key = "%{Realm}" Debug : relaxed = no Debug : } Debug : attr_filter attr_filter.access_reject { Debug : filename = /etc/freeradius/mods-config/attr_filter/access_reject Debug : key = "%{User-Name}" Debug : relaxed = no Debug : } Debug : attr_filter attr_filter.access_challenge { Debug : filename = /etc/freeradius/mods-config/attr_filter/access_challenge Debug : key = "%{User-Name}" Debug : relaxed = no Debug : } Debug : attr_filter attr_filter.accounting_response { Debug : filename = /etc/freeradius/mods-config/attr_filter/accounting_response Debug : key = "%{User-Name}" Debug : relaxed = no Debug : } Debug : Loaded module rlm_cache Debug : cache cache_eap { Debug : driver = rbtree Debug : Loaded module rlm_cache_rbtree Debug : key = %{&control.State || &reply.State || &State} Debug : ttl = 15 Debug : max_entries = 0 Debug : epoch = 0 Debug : add_stats = no Debug : } Debug : Loaded module rlm_chap Debug : chap { Debug : min_challenge_len = 16 Debug : } Debug : Loaded module rlm_client Debug : Loaded module rlm_delay Debug : delay { Debug : delay = 1.0s Debug : relative = no Debug : force_reschedule = no Debug : } Debug : delay delay_reject { Debug : delay = "%{&reply.FreeRADIUS-Response-Delay || 1}" Debug : relative = yes Debug : force_reschedule = no Debug : } Debug : Loaded module rlm_detail Debug : detail { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : detail auth_log { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/auth-detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : detail reply_log { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/reply-detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : detail pre_proxy_log { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/pre-proxy-detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : detail post_proxy_log { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/post-proxy-detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : Loaded module rlm_digest Debug : Loaded module rlm_eap Debug : eap { Debug : require_identity_realm = nai Debug : type = md5 Debug : Loaded module rlm_eap_md5 Debug : type = gtc Debug : Loaded module rlm_eap_gtc Debug : gtc { Debug : challenge = "Password: " Debug : auth_type = PAP Debug : } Debug : type = tls Debug : Loaded module rlm_eap_tls Debug : tls { Debug : tls = tls-common Debug : require_client_cert = yes Debug : include_length = yes Debug : } Debug : type = ttls Debug : Loaded module rlm_eap_ttls Debug : ttls { Debug : tls = tls-common Debug : virtual_server = "inner-tunnel" Debug : include_length = yes Debug : require_client_cert = no Debug : } Debug : type = mschapv2 Debug : Loaded module rlm_eap_mschapv2 Debug : mschapv2 { Debug : with_ntdomain_hack = no Debug : auth_type = mschap Debug : send_error = no Debug : } Debug : type = peap Debug : Loaded module rlm_eap_peap Debug : peap { Debug : tls = tls-common Debug : virtual_server = "inner-tunnel" Debug : require_client_cert = no Debug : } Debug : ignore_unknown_eap_types = no Debug : } Debug : eap inner-eap { Debug : require_identity_realm = nai Debug : default_eap_type = mschapv2 Debug : type = md5 Debug : type = gtc Debug : gtc { Debug : challenge = "Password: " Debug : auth_type = PAP Debug : } Debug : type = mschapv2 Debug : mschapv2 { Debug : with_ntdomain_hack = no Debug : auth_type = mschap Debug : send_error = no Debug : } Debug : type = tls Debug : tls { Debug : tls = tls-peer Debug : require_client_cert = yes Debug : include_length = yes Debug : } Debug : ignore_unknown_eap_types = no Debug : } Debug : Loaded module rlm_exec Debug : exec echo { Debug : wait = yes Debug : input_pairs = &request Debug : output_pairs = &reply Debug : shell_escape = yes Debug : env_inherit = no Debug : } Debug : exec { Debug : wait = yes Debug : input_pairs = &request Debug : shell_escape = yes Debug : env_inherit = no Debug : timeout = 10 Debug : } Debug : Loaded module rlm_files Debug : files { Debug : filename = /etc/freeradius/mods-config/files/authorize Debug : acctusersfile = /etc/freeradius/mods-config/files/accounting Debug : key = %{%{Stripped-User-Name}:-%{User-Name}} Debug : } Debug : Loaded module rlm_linelog Debug : linelog { Debug : destination = file Debug : delimiter = "\n" Debug : format = "This is a log message for %{User-Name}" Debug : reference = "messages.%{&reply.Packet-Type || 'default'}" Debug : file { Debug : filename = /var/log/freeradius/linelog Debug : permissions = 0600 Debug : escape_filenames = no Debug : } Debug : syslog { Debug : severity = "info" Debug : } Debug : unix { Debug : } Debug : tcp { Debug : server = localhost Debug : port = 514 Debug : timeout = 2.0 Debug : } Debug : udp { Debug : server = localhost Debug : port = 514 Debug : timeout = 2.0 Debug : } Debug : } Debug : linelog log_accounting { Debug : destination = file Debug : delimiter = "\n" Debug : format = "" Debug : reference = "Accounting-Request.%{&Acct-Status-Type || 'unknown'}" Debug : file { Debug : filename = /var/log/freeradius/linelog-accounting Debug : permissions = 0600 Debug : escape_filenames = no Debug : } Debug : syslog { Debug : severity = "info" Debug : } Debug : unix { Debug : } Debug : tcp { Debug : timeout = 1000 Debug : } Debug : udp { Debug : timeout = 1000 Debug : } Debug : } Debug : Loaded module rlm_mschap Debug : mschap { Debug : normalise = yes Debug : use_mppe = yes Debug : require_encryption = no Debug : require_strong = no Debug : with_ntdomain_hack = yes Debug : passchange { Debug : } Debug : allow_retry = yes Debug : winbind { Debug : retry_with_normalised_username = no Debug : } Debug : } Debug : exec ntlm_auth { Debug : wait = yes Debug : shell_escape = yes Debug : env_inherit = no Debug : } Debug : Loaded module rlm_pam Debug : pam { Debug : pam_auth = radiusd Debug : } Debug : Loaded module rlm_pap Debug : pap { Debug : normalise = yes Debug : } Debug : Loaded module rlm_passwd Debug : passwd etc_passwd { Debug : filename = /etc/passwd Debug : format = "*User-Name:Crypt-Password:" Debug : delimiter = ":" Debug : ignore_nislike = no Debug : ignore_empty = yes Debug : allow_multiple_keys = no Debug : hash_size = 100 Debug : } Debug : Loaded module rlm_radutmp Debug : radutmp { Debug : filename = /var/log/freeradius/radutmp Debug : username = %{User-Name} Debug : check_with_nas = yes Debug : permissions = 0600 Debug : caller_id = no Debug : } Debug : radutmp sradutmp { Debug : filename = /var/log/freeradius/sradutmp Debug : username = "%{User-Name}" Debug : check_with_nas = yes Debug : permissions = 0644 Debug : caller_id = no Debug : } Debug : Loaded module rlm_stats Debug : stats { Debug : } Debug : Loaded module rlm_unix Debug : unix { Debug : } Debug : Loaded module rlm_unpack Debug : Loaded module rlm_utf8 Debug : #### Bootstrapping rlm modules #### Debug : Bootstrapping rlm_cache "cache_eap" Debug : Bootstrapping rlm_chap "chap" Debug : Bootstrapping rlm_delay "delay" Debug : Bootstrapping rlm_delay "delay_reject" Debug : Bootstrapping rlm_always "disallow" Debug : Bootstrapping rlm_eap "eap" Debug : Bootstrapping rlm_exec "echo" Debug : Bootstrapping rlm_exec "exec" Debug : Bootstrapping rlm_always "fail" Debug : Bootstrapping rlm_always "handled" Debug : Bootstrapping rlm_eap "inner-eap" Debug : Bootstrapping rlm_always "invalid" Debug : Bootstrapping rlm_linelog "linelog" Debug : Bootstrapping rlm_linelog "log_accounting" Debug : Bootstrapping rlm_mschap "mschap" Debug : Bootstrapping rlm_always "noop" Debug : Bootstrapping rlm_always "notfound" Debug : Bootstrapping rlm_exec "ntlm_auth" Debug : Bootstrapping rlm_always "ok" Debug : Bootstrapping rlm_always "reject" Debug : Bootstrapping rlm_unix "unix" Debug : Bootstrapping rlm_always "updated" Debug : } # modules Debug : #### Instantiating listeners #### Debug : Compiling policies in server default { ... } Debug : Instantiating proto_radius "default.radius" Debug : Instantiating proto_radius "default.tcp_auth" Debug : Instantiating proto_radius "default.udp_acct" Debug : Instantiating process_radius "default" Debug : Compiling policies in - recv Access-Request {...} Warn : /etc/freeradius/sites-enabled/default[859]: Ignoring "-sql" as the "sql" module is not enabled. Warn : /etc/freeradius/sites-enabled/default[875]: Ignoring "-ldap" as the "ldap" module is not enabled. Warn : /etc/freeradius/policy.d/time[13]: Skipping remaining instructions due to 'return' Warn : /etc/freeradius/policy.d/time[18]: Please use the 'filter' keyword for attribute filtering Debug : Compiling policies in - send Access-Accept {...} Warn : /etc/freeradius/sites-enabled/default[1174]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - send Access-Challenge {...} Debug : Compiling policies in - send Access-Reject {...} Warn : /etc/freeradius/sites-enabled/default[1289]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - recv Accounting-Request {...} Debug : Compiling policies in - send Accounting-Response {...} Warn : /etc/freeradius/sites-enabled/default[1504]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - recv Status-Server {...} Debug : Compiling policies in - authenticate pap {...} Debug : Compiling policies in - authenticate chap {...} Debug : Compiling policies in - authenticate mschap {...} Debug : Compiling policies in - authenticate digest {...} Debug : Compiling policies in - authenticate ldap {...} Warn : /etc/freeradius/sites-enabled/default[1037]: Ignoring "-ldap" as the "ldap" module is not enabled. Debug : Compiling policies in - authenticate eap {...} Debug : Compiling policies in - accounting Start {...} Debug : Compiling policies in - accounting Stop {...} Debug : Compiling policies in - accounting Interim-Update {...} Debug : Compiling policies in - accounting Accounting-On {...} Debug : Compiling policies in - accounting Accounting-Off {...} Debug : Compiling policies in - accounting Failed {...} Warn : /etc/freeradius/sites-enabled/default[80]: radius { ... } section is unused Warn : /etc/freeradius/sites-enabled/default[224]: dictionary { ... } section is unused Debug : Compiling policies in server inner-tunnel { ... } Debug : Instantiating proto_radius "inner-tunnel.radius" Debug : Instantiating process_radius "inner-tunnel" Debug : Compiling policies in - recv Access-Request {...} Warn : /etc/freeradius/sites-enabled/inner-tunnel[124]: Ignoring "-sql" as the "sql" module is not enabled. Warn : /etc/freeradius/sites-enabled/inner-tunnel[134]: Ignoring "-ldap" as the "ldap" module is not enabled. Warn : /etc/freeradius/policy.d/time[13]: Skipping remaining instructions due to 'return' Warn : /etc/freeradius/policy.d/time[18]: Please use the 'filter' keyword for attribute filtering Debug : Compiling policies in - send Access-Accept {...} Warn : /etc/freeradius/sites-enabled/inner-tunnel[266]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - send Access-Reject {...} Warn : /etc/freeradius/sites-enabled/inner-tunnel[301]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - authenticate pap {...} Debug : Compiling policies in - authenticate chap {...} Debug : Compiling policies in - authenticate mschap {...} Debug : Compiling policies in - authenticate eap {...} Warn : radius { ... } section is unused Debug : #### Instantiating rlm modules #### Debug : Instantiating rlm_attr_filter "attr_filter.access_challenge" Debug : Reading file /etc/freeradius/mods-config/attr_filter/access_challenge Debug : Instantiating rlm_attr_filter "attr_filter.access_reject" Debug : Reading file /etc/freeradius/mods-config/attr_filter/access_reject Debug : Instantiating rlm_attr_filter "attr_filter.accounting_response" Debug : Reading file /etc/freeradius/mods-config/attr_filter/accounting_response Debug : Instantiating rlm_attr_filter "attr_filter.post-proxy" Debug : Reading file /etc/freeradius/mods-config/attr_filter/post-proxy Debug : Instantiating rlm_attr_filter "attr_filter.pre-proxy" Debug : Reading file /etc/freeradius/mods-config/attr_filter/pre-proxy Debug : Instantiating rlm_detail "auth_log" Debug : auth_log - 'User-Password' suppressed, will not appear in detail output Debug : Instantiating rlm_cache "cache_eap" Debug : Instantiating rlm_chap "chap" Debug : Instantiating rlm_detail "detail" Debug : Instantiating rlm_digest "digest" Debug : Instantiating rlm_always "disallow" Debug : Instantiating rlm_eap "eap" Debug : Instantiating rlm_passwd "etc_passwd" Debug : Instantiating rlm_always "fail" Debug : Instantiating rlm_files "files" Debug : Reading file /etc/freeradius/mods-config/files/authorize Error : /etc/freeradius/mods-config/files/authorize[1]: Unknown attribute 'Cleartext.Password' Error : Failed reading /etc/freeradius/mods-config/files/authorize Error : /etc/freeradius/mods-enabled/files[26]: Instantiation failed for module "files" root@freeradius:/etc/freeradius# nano /etc/freeradius/mods-config/files/authorize root@freeradius:/etc/freeradius# freeradius -X > debug.txt root@freeradius:/etc/freeradius# radtest testing password 127.0.0.1 0 testing123 Sent Access-Request Id 76 from 0.0.0.0:43164 to 127.0.0.1:1812 length 77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Password.Cleartext = "password" Sent Access-Request Id 76 from 0.0.0.0:43164 to 127.0.0.1:1812 length 77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Password.Cleartext = "password" Sent Access-Request Id 76 from 0.0.0.0:43164 to 127.0.0.1:1812 length 77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 Password.Cleartext = "password" (0) No reply from server for ID 76 socket 3 root@freeradius:/etc/freeradius# sudo systemctl stop freeradius root@freeradius:/etc/freeradius# cat debug.txt Info : Copyright 1999-2023 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/etc/freeradius/dictionary" Debug : including configuration file /etc/freeradius/radiusd.conf Debug : Including files in directory "/etc/freeradius/template.d/" Debug : including configuration file /etc/freeradius/template.d/default Debug : including configuration file /etc/freeradius/clients.conf Debug : Including files in directory "/etc/freeradius/global.d/" Debug : including configuration file /etc/freeradius/global.d/ldap Debug : including configuration file /etc/freeradius/global.d/python Debug : Including files in directory "/etc/freeradius/mods-enabled/" Debug : including configuration file /etc/freeradius/mods-enabled/always Debug : including configuration file /etc/freeradius/mods-enabled/attr_filter Debug : including configuration file /etc/freeradius/mods-enabled/cache_eap Debug : including configuration file /etc/freeradius/mods-enabled/chap Debug : including configuration file /etc/freeradius/mods-enabled/client Debug : including configuration file /etc/freeradius/mods-enabled/delay Debug : including configuration file /etc/freeradius/mods-enabled/detail Debug : including configuration file /etc/freeradius/mods-enabled/detail.log Debug : including configuration file /etc/freeradius/mods-enabled/digest Debug : including configuration file /etc/freeradius/mods-enabled/eap Debug : including configuration file /etc/freeradius/mods-enabled/eap_inner Debug : including configuration file /etc/freeradius/mods-enabled/echo Debug : including configuration file /etc/freeradius/mods-enabled/exec Debug : including configuration file /etc/freeradius/mods-enabled/files Debug : including configuration file /etc/freeradius/mods-enabled/linelog Debug : including configuration file /etc/freeradius/mods-enabled/mschap Debug : including configuration file /etc/freeradius/mods-enabled/ntlm_auth Debug : including configuration file /etc/freeradius/mods-enabled/pam Debug : including configuration file /etc/freeradius/mods-enabled/pap Debug : including configuration file /etc/freeradius/mods-enabled/passwd Debug : including configuration file /etc/freeradius/mods-enabled/radutmp Debug : including configuration file /etc/freeradius/mods-enabled/sradutmp Debug : including configuration file /etc/freeradius/mods-enabled/stats Debug : including configuration file /etc/freeradius/mods-enabled/unix Debug : including configuration file /etc/freeradius/mods-enabled/unpack Debug : including configuration file /etc/freeradius/mods-enabled/utf8 Debug : Including files in directory "/etc/freeradius/policy.d/" Debug : including configuration file /etc/freeradius/policy.d/abfab-tr Debug : including configuration file /etc/freeradius/policy.d/accounting Debug : including configuration file /etc/freeradius/policy.d/canonicalisation Debug : including configuration file /etc/freeradius/policy.d/control Debug : including configuration file /etc/freeradius/policy.d/cui Debug : including configuration file /etc/freeradius/policy.d/debug Debug : including configuration file /etc/freeradius/policy.d/dhcp Debug : including configuration file /etc/freeradius/policy.d/eap Debug : including configuration file /etc/freeradius/policy.d/filter Debug : including configuration file /etc/freeradius/policy.d/operator-name Debug : including configuration file /etc/freeradius/policy.d/time Debug : including configuration file /etc/freeradius/policy.d/vendor Debug : Including files in directory "/etc/freeradius/sites-enabled/" Debug : including configuration file /etc/freeradius/sites-enabled/default Debug : Loaded module process_radius Debug : including configuration file /etc/freeradius/sites-enabled/inner-tunnel Debug : Parsing initial logging configuration. Debug : main { Debug : prefix = /usr Debug : log { Debug : destination = files Debug : syslog_facility = daemon Debug : local_state_dir = "/usr/var" Debug : logdir = "/usr/var/log" Debug : file = /var/log/freeradius/radius.log Debug : suppress_secrets = no Debug : } Debug : } Debug : Parsing security rules to bootstrap UID / GID / chroot / etc. Debug : main { Debug : log { Debug : } Debug : security { Debug : user = freerad Debug : group = freerad Debug : allow_core_dumps = no Debug : openssl_fips_mode = no Debug : } Debug : name = freeradius Debug : local_state_dir = "/usr/var" Debug : run_dir = /var/run/freeradius Debug : } Debug : Parsing main configuration Debug : main { Debug : server default { Debug : namespace = radius Debug : radius { Debug : Access-Request { Debug : log { Debug : stripped_names = no Debug : auth = no Debug : auth_badpass = no Debug : auth_goodpass = no Debug : msg_denied = "You are already logged in - access denied" Debug : } Debug : session { Debug : timeout = 15 Debug : max = 4096 Debug : } Debug : } Debug : } Debug : Loaded module proto_radius Debug : listen { Debug : type = Access-Request Debug : type = Status-Server Debug : transport = udp Debug : Loaded module proto_radius_udp Debug : udp { Debug : ipaddr = * Debug : port = 1812 Debug : networks { Debug : allow = 127/8 Debug : allow = 192.0.2/24 Debug : } Debug : max_packet_size = 4096 Debug : max_attributes = 255 Debug : } Debug : limit { Debug : cleanup_delay = 5.0 Debug : idle_timeout = 60.0 Debug : nak_lifetime = 30.0 Debug : max_connections = 256 Debug : max_clients = 256 Debug : max_pending_packets = 256 Debug : } Debug : priority { Debug : Access-Request = high Debug : Accounting-Request = low Debug : CoA-Request = normal Debug : Disconnect-Request = low Debug : Status-Server = now Debug : } Debug : } Debug : listen tcp_auth { Debug : type = Access-Request Debug : type = Status-Server Debug : transport = tcp Debug : Loaded module proto_radius_tcp Debug : tcp { Debug : ipaddr = * Debug : port = 1812 Debug : networks { Debug : allow = 127/8 Debug : allow = 192.0.2/24 Debug : } Debug : max_packet_size = 4096 Debug : max_attributes = 255 Debug : } Debug : limit { Debug : cleanup_delay = 5.0 Debug : idle_timeout = 30.0 Debug : nak_lifetime = 30.0 Debug : max_connections = 1024 Debug : max_clients = 256 Debug : max_pending_packets = 256 Debug : } Debug : priority { Debug : Access-Request = high Debug : Accounting-Request = low Debug : CoA-Request = normal Debug : Disconnect-Request = low Debug : Status-Server = now Debug : } Debug : } Debug : listen udp_acct { Debug : type = Accounting-Request Debug : transport = udp Debug : udp { Debug : ipaddr = * Debug : port = 1813 Debug : networks { Debug : } Debug : max_packet_size = 4096 Debug : max_attributes = 255 Debug : } Debug : limit { Debug : cleanup_delay = 5.0 Debug : idle_timeout = 30.0 Debug : nak_lifetime = 30.0 Debug : max_connections = 1024 Debug : max_clients = 256 Debug : max_pending_packets = 256 Debug : } Debug : priority { Debug : Access-Request = high Debug : Accounting-Request = low Debug : CoA-Request = normal Debug : Disconnect-Request = low Debug : Status-Server = now Debug : } Debug : } Debug : } Debug : server inner-tunnel { Debug : namespace = radius Debug : radius { Debug : Access-Request { Debug : log { Debug : stripped_names = no Debug : auth = no Debug : auth_badpass = no Debug : auth_goodpass = no Debug : msg_denied = "You are already logged in - access denied" Debug : } Debug : session { Debug : timeout = 15 Debug : max = 4096 Debug : } Debug : } Debug : } Debug : listen { Debug : type = Access-Request Debug : transport = udp Debug : udp { Debug : ipaddr = 127.0.0.1 Debug : port = 18120 Debug : networks { Debug : } Debug : max_packet_size = 4096 Debug : max_attributes = 255 Debug : } Debug : limit { Debug : cleanup_delay = 5.0 Debug : idle_timeout = 30.0 Debug : nak_lifetime = 30.0 Debug : max_connections = 1024 Debug : max_clients = 256 Debug : max_pending_packets = 256 Debug : } Debug : priority { Debug : Access-Request = high Debug : Accounting-Request = low Debug : CoA-Request = normal Debug : Disconnect-Request = low Debug : Status-Server = now Debug : } Debug : } Debug : } Debug : log { Debug : colourise = yes Debug : } Debug : security { Debug : } Debug : sbin_dir = "/usr/sbin" Debug : logdir = /var/log/freeradius Debug : radacctdir = /var/log/freeradius/radacct Debug : reverse_lookups = no Debug : hostname_lookups = yes Debug : max_request_time = 30 Debug : pidfile = /var/run/freeradius/freeradius.pid Debug : debug_level = 0 Debug : max_requests = 16384 Debug : resources { Debug : } Debug : thread pool { Debug : num_networks = 1 Info : Dynamically determined thread.workers = 4 Debug : num_workers = 4 Debug : openssl_async_pool_init = 64 Debug : openssl_async_pool_max = 1024 Debug : } Debug : migrate { Debug : rewrite_update = false Debug : forbid_update = false Debug : } Debug : } Info : Switching to configured log settings Debug : freeradius: #### Loading Clients #### Debug : client localhost { Debug : ipaddr = 127.0.0.1 Debug : secret = <<< secret >>> Debug : require_message_authenticator = no Debug : proto = * Debug : limit { Debug : max_connections = 16 Debug : lifetime = 0 Debug : idle_timeout = 30 Debug : } Debug : } Debug : client localhost_ipv6 { Debug : ipv6addr = ::1 Debug : secret = <<< secret >>> Debug : limit { Debug : max_connections = 16 Debug : lifetime = 0 Debug : idle_timeout = 30s Debug : } Debug : } Warn : radiusd - Process concurrency checks disabled: Failed associating semaphore with "/etc/freeradius/freeradius.conf" ID 0x66: ENOENT: No such file or directory Info : Debugger not attached Info : systemd watchdog is disabled Info : pre-suid-down capabilities: =p Warn : trigger { ... } subsection not found, triggers will be disabled Debug : #### Instantiating libraries #### Debug : #### Bootstrapping process modules #### Debug : Bootstrapping process_radius "default" Debug : Creating Auth-Type = pap Debug : Creating Auth-Type = chap Debug : Creating Auth-Type = mschap Debug : Creating Auth-Type = digest Debug : Creating Auth-Type = ldap Debug : Creating Auth-Type = eap Debug : Bootstrapping process_radius "inner-tunnel" Debug : #### Bootstrapping protocol modules #### Debug : Bootstrapping proto_radius "default.radius" Debug : client localhost { Debug : ipaddr = 192.0.2.1 Debug : secret = <<< secret >>> Debug : shortname = sample Debug : limit { Debug : max_connections = 16 Debug : lifetime = 0 Debug : idle_timeout = 30s Debug : } Debug : } Debug : Bootstrapping proto_radius "default.tcp_auth" Debug : Bootstrapping proto_radius "default.udp_acct" Debug : Bootstrapping proto_radius "inner-tunnel.radius" Debug : #### Instantiating libraries #### Debug : #### Bootstrapping modules #### Debug : modules { Debug : Loaded module rlm_always Debug : always reject { Debug : rcode = reject Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always fail { Debug : rcode = fail Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always ok { Debug : rcode = ok Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always handled { Debug : rcode = handled Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always invalid { Debug : rcode = invalid Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always disallow { Debug : rcode = disallow Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always notfound { Debug : rcode = notfound Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always noop { Debug : rcode = noop Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : always updated { Debug : rcode = updated Debug : simulcount = 0 Debug : mpp = no Debug : } Debug : Loaded module rlm_attr_filter Debug : attr_filter attr_filter.pre-proxy { Debug : filename = /etc/freeradius/mods-config/attr_filter/pre-proxy Debug : key = "%{Realm}" Debug : relaxed = no Debug : } Debug : attr_filter attr_filter.post-proxy { Debug : filename = /etc/freeradius/mods-config/attr_filter/post-proxy Debug : key = "%{Realm}" Debug : relaxed = no Debug : } Debug : attr_filter attr_filter.access_reject { Debug : filename = /etc/freeradius/mods-config/attr_filter/access_reject Debug : key = "%{User-Name}" Debug : relaxed = no Debug : } Debug : attr_filter attr_filter.access_challenge { Debug : filename = /etc/freeradius/mods-config/attr_filter/access_challenge Debug : key = "%{User-Name}" Debug : relaxed = no Debug : } Debug : attr_filter attr_filter.accounting_response { Debug : filename = /etc/freeradius/mods-config/attr_filter/accounting_response Debug : key = "%{User-Name}" Debug : relaxed = no Debug : } Debug : Loaded module rlm_cache Debug : cache cache_eap { Debug : driver = rbtree Debug : Loaded module rlm_cache_rbtree Debug : key = %{&control.State || &reply.State || &State} Debug : ttl = 15 Debug : max_entries = 0 Debug : epoch = 0 Debug : add_stats = no Debug : } Debug : Loaded module rlm_chap Debug : chap { Debug : min_challenge_len = 16 Debug : } Debug : Loaded module rlm_client Debug : Loaded module rlm_delay Debug : delay { Debug : delay = 1.0s Debug : relative = no Debug : force_reschedule = no Debug : } Debug : delay delay_reject { Debug : delay = "%{&reply.FreeRADIUS-Response-Delay || 1}" Debug : relative = yes Debug : force_reschedule = no Debug : } Debug : Loaded module rlm_detail Debug : detail { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : detail auth_log { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/auth-detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : detail reply_log { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/reply-detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : detail pre_proxy_log { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/pre-proxy-detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : detail post_proxy_log { Debug : filename = /var/log/freeradius/radacct/%{Net.Src.IP}/post-proxy-detail-%Y-%m-%d Debug : header = %t Debug : permissions = 0600 Debug : locking = no Debug : escape_filenames = no Debug : log_packet_header = no Debug : } Debug : Loaded module rlm_digest Debug : Loaded module rlm_eap Debug : eap { Debug : require_identity_realm = nai Debug : type = md5 Debug : Loaded module rlm_eap_md5 Debug : type = gtc Debug : Loaded module rlm_eap_gtc Debug : gtc { Debug : challenge = "Password: " Debug : auth_type = PAP Debug : } Debug : type = tls Debug : Loaded module rlm_eap_tls Debug : tls { Debug : tls = tls-common Debug : require_client_cert = yes Debug : include_length = yes Debug : } Debug : type = ttls Debug : Loaded module rlm_eap_ttls Debug : ttls { Debug : tls = tls-common Debug : virtual_server = "inner-tunnel" Debug : include_length = yes Debug : require_client_cert = no Debug : } Debug : type = mschapv2 Debug : Loaded module rlm_eap_mschapv2 Debug : mschapv2 { Debug : with_ntdomain_hack = no Debug : auth_type = mschap Debug : send_error = no Debug : } Debug : type = peap Debug : Loaded module rlm_eap_peap Debug : peap { Debug : tls = tls-common Debug : virtual_server = "inner-tunnel" Debug : require_client_cert = no Debug : } Debug : ignore_unknown_eap_types = no Debug : } Debug : eap inner-eap { Debug : require_identity_realm = nai Debug : default_eap_type = mschapv2 Debug : type = md5 Debug : type = gtc Debug : gtc { Debug : challenge = "Password: " Debug : auth_type = PAP Debug : } Debug : type = mschapv2 Debug : mschapv2 { Debug : with_ntdomain_hack = no Debug : auth_type = mschap Debug : send_error = no Debug : } Debug : type = tls Debug : tls { Debug : tls = tls-peer Debug : require_client_cert = yes Debug : include_length = yes Debug : } Debug : ignore_unknown_eap_types = no Debug : } Debug : Loaded module rlm_exec Debug : exec echo { Debug : wait = yes Debug : input_pairs = &request Debug : output_pairs = &reply Debug : shell_escape = yes Debug : env_inherit = no Debug : } Debug : exec { Debug : wait = yes Debug : input_pairs = &request Debug : shell_escape = yes Debug : env_inherit = no Debug : timeout = 10 Debug : } Debug : Loaded module rlm_files Debug : files { Debug : filename = /etc/freeradius/mods-config/files/authorize Debug : acctusersfile = /etc/freeradius/mods-config/files/accounting Debug : key = %{%{Stripped-User-Name}:-%{User-Name}} Debug : } Debug : Loaded module rlm_linelog Debug : linelog { Debug : destination = file Debug : delimiter = "\n" Debug : format = "This is a log message for %{User-Name}" Debug : reference = "messages.%{&reply.Packet-Type || 'default'}" Debug : file { Debug : filename = /var/log/freeradius/linelog Debug : permissions = 0600 Debug : escape_filenames = no Debug : } Debug : syslog { Debug : severity = "info" Debug : } Debug : unix { Debug : } Debug : tcp { Debug : server = localhost Debug : port = 514 Debug : timeout = 2.0 Debug : } Debug : udp { Debug : server = localhost Debug : port = 514 Debug : timeout = 2.0 Debug : } Debug : } Debug : linelog log_accounting { Debug : destination = file Debug : delimiter = "\n" Debug : format = "" Debug : reference = "Accounting-Request.%{&Acct-Status-Type || 'unknown'}" Debug : file { Debug : filename = /var/log/freeradius/linelog-accounting Debug : permissions = 0600 Debug : escape_filenames = no Debug : } Debug : syslog { Debug : severity = "info" Debug : } Debug : unix { Debug : } Debug : tcp { Debug : timeout = 1000 Debug : } Debug : udp { Debug : timeout = 1000 Debug : } Debug : } Debug : Loaded module rlm_mschap Debug : mschap { Debug : normalise = yes Debug : use_mppe = yes Debug : require_encryption = no Debug : require_strong = no Debug : with_ntdomain_hack = yes Debug : passchange { Debug : } Debug : allow_retry = yes Debug : winbind { Debug : retry_with_normalised_username = no Debug : } Debug : } Debug : exec ntlm_auth { Debug : wait = yes Debug : shell_escape = yes Debug : env_inherit = no Debug : } Debug : Loaded module rlm_pam Debug : pam { Debug : pam_auth = radiusd Debug : } Debug : Loaded module rlm_pap Debug : pap { Debug : normalise = yes Debug : } Debug : Loaded module rlm_passwd Debug : passwd etc_passwd { Debug : filename = /etc/passwd Debug : format = "*User-Name:Crypt-Password:" Debug : delimiter = ":" Debug : ignore_nislike = no Debug : ignore_empty = yes Debug : allow_multiple_keys = no Debug : hash_size = 100 Debug : } Debug : Loaded module rlm_radutmp Debug : radutmp { Debug : filename = /var/log/freeradius/radutmp Debug : username = %{User-Name} Debug : check_with_nas = yes Debug : permissions = 0600 Debug : caller_id = no Debug : } Debug : radutmp sradutmp { Debug : filename = /var/log/freeradius/sradutmp Debug : username = "%{User-Name}" Debug : check_with_nas = yes Debug : permissions = 0644 Debug : caller_id = no Debug : } Debug : Loaded module rlm_stats Debug : stats { Debug : } Debug : Loaded module rlm_unix Debug : unix { Debug : } Debug : Loaded module rlm_unpack Debug : Loaded module rlm_utf8 Debug : #### Bootstrapping rlm modules #### Debug : Bootstrapping rlm_cache "cache_eap" Debug : Bootstrapping rlm_chap "chap" Debug : Bootstrapping rlm_delay "delay" Debug : Bootstrapping rlm_delay "delay_reject" Debug : Bootstrapping rlm_always "disallow" Debug : Bootstrapping rlm_eap "eap" Debug : Bootstrapping rlm_exec "echo" Debug : Bootstrapping rlm_exec "exec" Debug : Bootstrapping rlm_always "fail" Debug : Bootstrapping rlm_always "handled" Debug : Bootstrapping rlm_eap "inner-eap" Debug : Bootstrapping rlm_always "invalid" Debug : Bootstrapping rlm_linelog "linelog" Debug : Bootstrapping rlm_linelog "log_accounting" Debug : Bootstrapping rlm_mschap "mschap" Debug : Bootstrapping rlm_always "noop" Debug : Bootstrapping rlm_always "notfound" Debug : Bootstrapping rlm_exec "ntlm_auth" Debug : Bootstrapping rlm_always "ok" Debug : Bootstrapping rlm_always "reject" Debug : Bootstrapping rlm_unix "unix" Debug : Bootstrapping rlm_always "updated" Debug : } # modules Debug : #### Instantiating listeners #### Debug : Compiling policies in server default { ... } Debug : Instantiating proto_radius "default.radius" Debug : Instantiating proto_radius "default.tcp_auth" Debug : Instantiating proto_radius "default.udp_acct" Debug : Instantiating process_radius "default" Debug : Compiling policies in - recv Access-Request {...} Warn : /etc/freeradius/sites-enabled/default[859]: Ignoring "-sql" as the "sql" module is not enabled. Warn : /etc/freeradius/sites-enabled/default[875]: Ignoring "-ldap" as the "ldap" module is not enabled. Warn : /etc/freeradius/policy.d/time[13]: Skipping remaining instructions due to 'return' Warn : /etc/freeradius/policy.d/time[18]: Please use the 'filter' keyword for attribute filtering Debug : Compiling policies in - send Access-Accept {...} Warn : /etc/freeradius/sites-enabled/default[1174]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - send Access-Challenge {...} Debug : Compiling policies in - send Access-Reject {...} Warn : /etc/freeradius/sites-enabled/default[1289]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - recv Accounting-Request {...} Debug : Compiling policies in - send Accounting-Response {...} Warn : /etc/freeradius/sites-enabled/default[1504]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - recv Status-Server {...} Debug : Compiling policies in - authenticate pap {...} Debug : Compiling policies in - authenticate chap {...} Debug : Compiling policies in - authenticate mschap {...} Debug : Compiling policies in - authenticate digest {...} Debug : Compiling policies in - authenticate ldap {...} Warn : /etc/freeradius/sites-enabled/default[1037]: Ignoring "-ldap" as the "ldap" module is not enabled. Debug : Compiling policies in - authenticate eap {...} Debug : Compiling policies in - accounting Start {...} Debug : Compiling policies in - accounting Stop {...} Debug : Compiling policies in - accounting Interim-Update {...} Debug : Compiling policies in - accounting Accounting-On {...} Debug : Compiling policies in - accounting Accounting-Off {...} Debug : Compiling policies in - accounting Failed {...} Warn : /etc/freeradius/sites-enabled/default[80]: radius { ... } section is unused Warn : /etc/freeradius/sites-enabled/default[224]: dictionary { ... } section is unused Debug : Compiling policies in server inner-tunnel { ... } Debug : Instantiating proto_radius "inner-tunnel.radius" Debug : Instantiating process_radius "inner-tunnel" Debug : Compiling policies in - recv Access-Request {...} Warn : /etc/freeradius/sites-enabled/inner-tunnel[124]: Ignoring "-sql" as the "sql" module is not enabled. Warn : /etc/freeradius/sites-enabled/inner-tunnel[134]: Ignoring "-ldap" as the "ldap" module is not enabled. Warn : /etc/freeradius/policy.d/time[13]: Skipping remaining instructions due to 'return' Warn : /etc/freeradius/policy.d/time[18]: Please use the 'filter' keyword for attribute filtering Debug : Compiling policies in - send Access-Accept {...} Warn : /etc/freeradius/sites-enabled/inner-tunnel[266]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - send Access-Reject {...} Warn : /etc/freeradius/sites-enabled/inner-tunnel[301]: Ignoring "-sql" as the "sql" module is not enabled. Debug : Compiling policies in - authenticate pap {...} Debug : Compiling policies in - authenticate chap {...} Debug : Compiling policies in - authenticate mschap {...} Debug : Compiling policies in - authenticate eap {...} Warn : radius { ... } section is unused Debug : #### Instantiating rlm modules #### Debug : Instantiating rlm_attr_filter "attr_filter.access_challenge" Debug : Reading file /etc/freeradius/mods-config/attr_filter/access_challenge Debug : Instantiating rlm_attr_filter "attr_filter.access_reject" Debug : Reading file /etc/freeradius/mods-config/attr_filter/access_reject Debug : Instantiating rlm_attr_filter "attr_filter.accounting_response" Debug : Reading file /etc/freeradius/mods-config/attr_filter/accounting_response Debug : Instantiating rlm_attr_filter "attr_filter.post-proxy" Debug : Reading file /etc/freeradius/mods-config/attr_filter/post-proxy Debug : Instantiating rlm_attr_filter "attr_filter.pre-proxy" Debug : Reading file /etc/freeradius/mods-config/attr_filter/pre-proxy Debug : Instantiating rlm_detail "auth_log" Debug : auth_log - 'User-Password' suppressed, will not appear in detail output Debug : Instantiating rlm_cache "cache_eap" Debug : Instantiating rlm_chap "chap" Debug : Instantiating rlm_detail "detail" Debug : Instantiating rlm_digest "digest" Debug : Instantiating rlm_always "disallow" Debug : Instantiating rlm_eap "eap" Debug : Instantiating rlm_passwd "etc_passwd" Debug : Instantiating rlm_always "fail" Debug : Instantiating rlm_files "files" Debug : Reading file /etc/freeradius/mods-config/files/authorize Debug : Reading file /etc/freeradius/mods-config/files/accounting Debug : Instantiating rlm_always "handled" Debug : Instantiating rlm_eap "inner-eap" Warn : inner-eap - Failed to find 'authenticate inner-eap {...}' section. EAP authentication will likely not work Debug : Instantiating rlm_always "invalid" Debug : Instantiating rlm_linelog "linelog" Debug : Instantiating rlm_linelog "log_accounting" Debug : Instantiating rlm_mschap "mschap" Debug : mschap - Using internal authentication Debug : Instantiating rlm_always "noop" Debug : Instantiating rlm_always "notfound" Debug : Instantiating rlm_always "ok" Debug : Instantiating rlm_pam "pam" Debug : Instantiating rlm_pap "pap" Debug : Instantiating rlm_detail "post_proxy_log" Debug : Instantiating rlm_detail "pre_proxy_log" Debug : Instantiating rlm_always "reject" Debug : Instantiating rlm_detail "reply_log" Debug : Instantiating rlm_stats "stats" Debug : Instantiating rlm_always "updated" Debug : Instantiating _cache_rbtree "cache_eap.rbtree" Debug : Instantiating _eap_mschapv2 "eap.mschapv2" Debug : Instantiating _eap_peap "eap.peap" Debug : tls-config tls-common { Debug : chain rsa { Debug : format = pem Debug : certificate_file = /etc/freeradius/certs/rsa/server.pem Debug : private_key_password = <<< secret >>> Debug : private_key_file = /etc/freeradius/certs/rsa/server.key Debug : ca_file = /etc/freeradius/certs/rsa/ca.pem Debug : verify_mode = hard Debug : include_root_ca = no Debug : } Debug : verify_depth = 0 Debug : ca_path = /etc/freeradius/certs Debug : ca_file = /etc/freeradius/certs/rsa/ca.pem Debug : dh_file = /etc/freeradius/certs/dh Debug : fragment_size = 1024 Debug : cipher_list = "DEFAULT" Debug : cipher_server_preference = yes Debug : allow_renegotiation = no Debug : ecdh_curve = prime256v1 Debug : tls_min_version = 1.2 Debug : session { Debug : mode = auto Warn : tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless" Debug : name = "%{EAP-Type}%(interpreter:server)" Debug : lifetime = 1d Debug : require_extended_master_secret = yes Debug : require_perfect_forward_secrecy = no Debug : } Debug : verify { Debug : mode = all Debug : attribute_mode = client-and-issuer Debug : check_crl = no Debug : } Debug : } Debug : Instantiating _eap_tls "eap.tls" Debug : tls - Using cached TLS configuration from previous invocation Debug : Instantiating _eap_ttls "eap.ttls" Debug : tls - Using cached TLS configuration from previous invocation Debug : Instantiating _eap_mschapv2 "inner-eap.mschapv2" Debug : Instantiating _eap_tls "inner-eap.tls" Debug : tls-config tls-peer { Debug : chain { Debug : format = pem Debug : certificate_file = /etc/freeradius/certs/rsa/server.pem Debug : private_key_password = <<< secret >>> Debug : private_key_file = /etc/freeradius/certs/rsa/server.key Debug : ca_file = /etc/freeradius/certs/rsa/ca.pem Debug : verify_mode = hard Debug : include_root_ca = no Debug : } Debug : verify_depth = 0 Debug : ca_path = /etc/freeradius/certs Debug : ca_file = /etc/freeradius/certs/rsa/ca.pem Debug : dh_file = /etc/freeradius/certs/dh Debug : fragment_size = 16384 Debug : cipher_server_preference = yes Debug : allow_renegotiation = no Debug : ecdh_curve = "prime256v1" Debug : tls_min_version = 1.2 Debug : session { Debug : mode = auto Warn : tls - A virtual_server must be provided for stateful caching. cache.mode = "auto" rewritten to cache.mode = "stateless" Debug : name = "%{EAP-Type}%(interpreter:server)" Debug : lifetime = 1d Debug : require_extended_master_secret = yes Debug : require_perfect_forward_secrecy = no Debug : } Debug : verify { Debug : mode = all Debug : attribute_mode = client-and-issuer Debug : check_crl = no Debug : } Debug : } Debug : Scheduler created in single-threaded mode Debug : #### Opening listener interfaces #### Error : Network - Failed adding new socket to network event loop: Failed inserting filters for FD 17: EFAULT: Bad address Error : /etc/freeradius/sites-enabled/default[275]: Opening radius I/O interface failed

4 3

radius authentication via TCP/TLS
by Alan Smith 12 Jul '26

12 Jul '26

Greetings all. I am currently running Freeradius on RHEL 8.10 in a lab. It has custom site configured and make use of sql for radius client table.Customised perl module is used for the authentication. It listens on UDP 1812 and 1813. I would say it is working fine. I would like to check the use of Radius over TLS on TCP 2083 for some of the clients. I update tls in sites-available and created symlink in sites-enabled. Configured the custom CA certs.It is now listening at TCP 2083. I want to test if the clients from sql be recognized. Is there like a tool NTRadping? I can test from either Windows or Linux.I do not have any device that can authenticate. Kindly advise. Thank you.

4 10

FreeRADIUS Guidance
by Phillip Morley 06 Jul '26

06 Jul '26

Greetings, I am looking for some guidance on the following matters with an instance of FreeRADIUS I am trying to put up/complete...... If there is anyone out there who can provide some simple guidance, that would be appreciated. We are looking for FreeRADIUS to work in conjunction with trusted and signed SSL/TLS certificates, so that when users connect to wireless on a Ubiquiti platform, they are NOT prompted to accept or "trust" the RADIUS server's certificate. That's the end goal...... I need to better understand how to specify a wide range or a list of "client" IP addresses, which will be the Ubiquiti access points, in the FreeRADIUS configuration. Right now, I have 1 AP defined as our test AP. Right now, after putting SSL/TLS certificates on the RADIUS server, I cannot get the "server" to answer or process any requests for user authentication external to the server. I have disabled firewalld and rebooted. We are working with FQDNs as well and not sure if this has anything to do with this..... In terms of the user file, this is great for very small environments, however this one is going to be several hundred user accounts, and where a VLAN ID needs to be specified along with their user account entry, so when they connect, they get placed on the VLAN they are supposed to by the RADIUS authentication request. For this level of credential storage, is there a standard MySQL DB that is canned and can be put up as the mechanism to store user credentials? A software developer in this environment can and I think we should have him develop a custom web page/portal for non-technical users to add/remove user credentials. What is the best recommended set of tools and stuff for this need? Finally, we want to store user credentials in a secure fashion. I am reading there is a way to encrypt them on the server and in transit but requires some configuration and such. What are the components of getting this done, and then also storing them in whatever medium needed to address the immediately preceding question I made above about a database for them? Thanks so much! Phillip Morley phillip(a)is-md.com<mailto:phillip@is-md.com> Legal Disclaimer: The information contained in this electronic transmission, and any documents attached hereto, may contain confidential information that is legally privileged and confidential. This electronic transmission is intended solely for its recipients only and is not intended to be relied upon without subsequent written confirmation of its contents. Accordingly Information Systems of Maryland, LLC., its subsidiaries and all its associated entities disclaim all responsibility and accept no liability (including in negligence) for the unauthorized use of such information prior to the receipt by the above addressed person(s). Any disclosure, copying, distribution or the taking of any action in reliance on the contents of the information received in error is strictly prohibited by U.S. Law (Title 18, Section 2511). If you have received this electronic message in error, please notify the sender and delete the electronic message and any associated content of its transmission.

2 1

MCP Server
by Kushal Gupta 02 Jul '26

02 Jul '26

Hello, While reviewing the FreeRADIUS documentation, I would like to confirm if there is an MCP server available for this project. Best regards, Kushal Gupta

5 5

Mailing list infrastructure move
by Arran Cudbard-Bell 27 Jun '26

27 Jun '26

Hi All, The list server has moved onto our IP space 199.66.222.136 (AS54975), from 184.95.211.22. Please report any issues. Many Thanks, -Arran

1 0