- Freeradius-Users - lists.freeradius.org

SQL Custom - MySQL
by Rodrigo Prazim 12 Sep '25

12 Sep '25

Hello, I am attempting to create a query to retrieve the last piece of information from a REGEX: input_circuitid { if ("%{reply:Packet-Type}" == 'Access-Accept') { "%{sql:INSERT INTO ... CASE \ WHEN '%{string:ADSL-Agent-Circuit-Id}' \ REGEXP '^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[0-9]{1,2})\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[0-9]{1,2})/[0-9]+/[0-9]+/[A-Za-z0-9]+$' \ THEN SUBSTRING_INDEX('%{string:ADSL-Agent-Circuit-Id}', '/', -1) \ ELSE NULL \ END \ ) \ ON DUPLICATE KEY UPDATE \ ... sn = CASE \ WHEN '%{string:ADSL-Agent-Circuit-Id}' \ REGEXP '^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[0-9]{1,2})\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[0-9]{1,2})/[0-9]+/[0-9]+/[A-Za-z0-9]+$' \ THEN SUBSTRING_INDEX('%{string:ADSL-Agent-Circuit-Id}', '/', -1) \ ELSE sn \ END \ }" } } However, FreeRadius interprets the curly braces "}" as the end of the statement. REGEXP '^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[0-9]{1,2} Is there any way for FreeRadius to understand that this does not close the instruction? Sincerely, Rodrigo Prazim

2 1

attribute checking in the session REJECT
by Can Paçacı 11 Sep '25

11 Sep '25

Hi, In the authorize section, I check the username and password and print the relevant Reply-Message as in the followings. I works. authorize { .. sql{ notfound = 1 reject = 2 } if(notfound){ update reply { Reply-Message := "Please check your Username" } reject } if(reject){ update reply { Reply-Message := "%{reply:Reply-Message} Wrong Password" } reject } .. } Then, for those who reject, I check the NAS-Identifier in the "Post-Auth-Type REJECT" section. If the NAS-Identifier is incompatible according to the racheck table, I print a "wrong NAS" message. Ok so far. However, if the NAS-Identifier is not in the radcheck table, the NAS-Identifier should not check, if the password is incorrect, I want a "wrong password" error. I couldn't do this. Post-Auth-Type REJECT { .... if (&NAS-Identifier != "%{sql:SELECT value FROM radcheck WHERE Username = '%{User-Name}' and attribute='NAS-Identifier'}") { update reply { Reply-Message = "%{Reply-Message} Wrong NAS, NAS:%{NAS-Identifier}" } } update reply { Reply-Message = "%{reply:Reply-Message} Wrong Password." # Reply-Message := "Wrong Password.." } .. } Could you please help me how to fix it. Regards

2 4

Inquiry Regarding Backslash Handling in Reply-Message
by 平林哲 10 Sep '25

10 Sep '25

Hi! We have encountered an issue in FreeRADIUS version 3.2.8 where the backslash (`\`) character in the `Reply-Message` configured for a user is not correctly reflected in the response. --- **Configuration Details:** In `mods-available/ldap2`, the following directive is set: ``` valuepair_attribute = "radiusAttribute" ``` The LDAP entry for `uid=user003` includes the following attributes: ``` radiusAttribute: Reply-Message += 'mess\age' radiusAttribute: Reply-Message += 'mess\\age' radiusAttribute: Reply-Message += 'mess\\\age' radiusAttribute: Reply-Message += 'mess\\\\age' ``` --- **Observed Behavior:** When PAP authentication is performed using this configuration, the response consistently contains only a single backslash, regardless of the number of backslashes defined in LDAP: ``` Reply-Message = "mess\age" Reply-Message = "mess\age" Reply-Message = "mess\age" Reply-Message = "mess\age" ``` --- **Inquiry:** If backslashes (`\`) within the LDAP database value are escaped as shown below: ``` radiusAttribute: Reply-Message += 'mess\\age' radiusAttribute: Reply-Message += 'mess\\\\age' ``` Is it possible to modify the system so that the response reflects the intended number of backslashes, as follows? ``` Reply-Message = "mess\age" Reply-Message = "mess\\age" ``` Any guidance or suggestions regarding this behavior would be greatly appreciated. Best regards, Satoshi Hirabayashi ----- radiusd -X ----- FreeRADIUS Version 3.2.8 Copyright (C) 1999-2025 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT FreeRADIUS is developed, maintained, and supported by InkBridge Networks. For commercial support, please email sales(a)inkbridgenetworks.com https://inkbridgenetworks.com/ Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy_test.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/ldap2 including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/mschap including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 proxy_dedup_window = 1 cleanup_delay = 5 max_requests = 16384 max_fds = 512 postauth_client_lost = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 delay_proxy_rejects = no status_server = yes require_message_authenticator = "auto" limit_proxy_state = "auto" allow_vulnerable_openssl = "no" } unlang { group_stop_return = no policy_stop_return = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server naeps93 { nonblock = no ipaddr = 192.168.1.93 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } home_server_pool naeps93_pool { type = fail-over home_server = naeps93 } realm soliton.co.jp { auth_pool = naeps93_pool } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = "no" secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Shared secret for client localhost is short, and likely can be broken by an attacker. client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Shared secret for client localhost_ipv6 is short, and likely can be broken by an attacker. client naeps245 { ipaddr = 192.168.1.245 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Shared secret for client naeps245 is short, and likely can be broken by an attacker. client naeps102 { ipaddr = 192.168.1.102 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Shared secret for client naeps102 is short, and likely can be broken by an attacker. Debugger not attached Configuration version: 9b08-cf8e-ba66-a123 # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = LDAP # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_exec # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?" } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" key = "%{%{Stripped-User-Name}:-%{User-Name}}" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 dedup_key = "" } # Loaded module rlm_ldap # Loading module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap2 ldap { server = "192.168.1.123" port = 389 identity = "cn=admin,dc=rdd-osaka,dc=soliton,dc=corp" password = <<< secret >>> sasl { } valuepair_attribute = "radiusAttribute" user { scope = "sub" access_positive = yes sasl { } } group { scope = "sub" name_attribute = "cn" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { scope = "sub" base_dn = "" } profile { } options { ldap_debug = 0 net_timeout = 10 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 30 } tls { check_crl = no start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } instantiate { } # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/coa # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no reject_unknown_intermediate_ca = no ecdh_curve = "" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = yes } # Instantiating module "ldap" from file /usr/local/etc/raddb/mods-enabled/ldap2 rlm_ldap: libldap vendor: OpenLDAP, version: 20457 rlm_ldap (ldap): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap): Couldn't find configuration for post-auth, will return NOOP for calls from this section !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! libldap is using GnuTLS, while FreeRADIUS is using OpenSSL !! There may be random issues with TLS connections due to this conflict. !! The server may also crash. !! See https://wiki.freeradius.org/modules/Rlm_ldap for more information. !! !! Perhaps also see https://ltb-project.org/download.html !! Which may have a pre-build package of libldap which links to OpenSSL. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 max_retries = 5 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 10 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.123:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 9 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.123:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 8 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.123:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 7 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.123:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 6 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.1.123:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type Compiling Auth-Type LDAP for attr Auth-Type # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type } # server default server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:366 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 47811 Listening on proxy address :: port 36791 Ready to process requests !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! BlastRADIUS check: Received packet without Message-Authenticator. Setting "require_message_authenticator = false" for client naeps245 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! UPGRADE THE CLIENT AS YOUR NETWORK IS VULNERABLE TO THE BLASTRADIUS ATTACK. Once the client is upgraded, set "require_message_authenticator = true" for client naeps245 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! BlastRADIUS check: Received packet without Proxy-State. Setting "limit_proxy_state = true" for client naeps245 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! The packet does not contain Message-Authenticator, which is a security issue. UPGRADE THE CLIENT AS YOUR NETWORK MAY BE VULNERABLE TO THE BLASTRADIUS ATTACK. Once the client is upgraded, set "require_message_authenticator = true" for client naeps245 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) Received Access-Request Id 112 from 192.168.1.245:50341 to 192.168.1.123:1812 length 61 (0) User-Name = "user003" (0) User-Password = "S0l!@rch" (0) Calling-Station-Id = "112233445566" (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) { (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "user003", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: EXPAND %{%{Stripped-User-Name}:-%{User-Name}} (0) files: --> user003 (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{User-Name}) (0) ldap: --> (uid=user003) (0) ldap: Performing search in "ou=Users,dc=rdd-osaka,dc=soliton,dc=corp" with filter "(uid=user003)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=user003,ou=Users,dc=rdd-osaka,dc=soliton,dc=corp" (0) ldap: Processing user attributes (0) ldap: Reply-Message += 'mess\\age' (0) ldap: Reply-Message += 'mess\\age' (0) ldap: Reply-Message += 'mess\\age' (0) ldap: Reply-Message += 'mess\\age' rlm_ldap (ldap): Released connection (0) (0) [ldap] = updated (0) if ((ok || updated) && User-Password && !control:Auth-Type) { (0) if ((ok || updated) && User-Password && !control:Auth-Type) -> TRUE (0) if ((ok || updated) && User-Password && !control:Auth-Type) { (0) update control { (0) &Auth-Type := LDAP (0) } # update control = noop (0) } # if ((ok || updated) && User-Password && !control:Auth-Type) = noop (0) [expiration] = noop (0) [logintime] = noop Not doing PAP as Auth-Type is already set. (0) [pap] = noop (0) } # authorize = updated (0) Found Auth-Type = LDAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type LDAP { rlm_ldap (ldap): Reserved connection (1) (0) ldap: Login attempt by "user003" (0) ldap: Using user DN from request "uid=user003,ou=Users,dc=rdd-osaka,dc=soliton,dc=corp" (0) ldap: Waiting for bind result... (0) ldap: Bind successful (0) ldap: Bind as user "uid=user003,ou=Users,dc=rdd-osaka,dc=soliton,dc=corp" was successful rlm_ldap (ldap): Released connection (1) (0) [ldap] = ok (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = noop (0) Login OK: [user003] (from client naeps245 port 0 cli 112233445566) (0) Sent Access-Accept Id 112 from 192.168.1.123:1812 to 192.168.1.245:50341 length 78 (0) Reply-Message += "mess\\age" (0) Reply-Message += "mess\\age" (0) Reply-Message += "mess\\age" (0) Reply-Message += "mess\\age" (0) Finished request Waking up in 4.9 seconds.

3 3

Relationship between Thread Pool and Sql Pool
by Erdal Emlik 10 Sep '25

10 Sep '25

Hi, I would like to ask about how the SQL connection pool works in FreeRADIUS. Does each thread use a separate connection from the pool, or can the same connection be used simultaneously by multiple threads? Can I basically say 1 Accounting/Access Request = 1 Thread = 1 Connection from pool?

2 1

How to extract vendor specific information from Sub-Option 9 of Option 82
by Ľudovít Mikula 06 Sep '25

06 Sep '25

Hi all, is it possible to automatically decode Vendor Specific Information from inocoming DHCP packet in freeradius 3.2.28? In DHCP Discover Option 82 -> Sub-Option 9 I am receiving vendor specific information and I'd like to have it automatically decoded. If I got the docs right, I need to create a dictionary and then the defined attributes should be accessible by %{dhcp_options:<Attribute-ref>} (after enabling dhcp mod) I am a bit struggling with writing the dictionary tbh (I've checked also the suggested dictionary.alcatel.sr and dictionary.erx). I am interested in two TLVs: enterprise number: 0000061b (dec: 1563) 03: length: 0a (dec: 10) data: 444d 5a2d 434f 532d 3032 ("DMZ-COS-02") 01: length: 0e (dec: 14) data: 4554 492d 5250 442d 504f 5254 2d30 ("ETI-RPD-PORT-0") I was able to get the information with "unpack" from DHCP-Vendor-Specific-Information but am wondering whether this can be achieved by defining a custom dictionary and using dhcp_options ? Regards -- Ľudovít Mikula

2 3

Certificate validation in rest module fails
by Murali Krishnamoorthy 06 Sep '25

06 Sep '25

Hello, I am using a https api in rest module with mutual tls enabled. The freeradius 3.2.8 gives me an error message that the peer certificate is not valid. However, I am able to use the same certificates with the same url to make the tls connection. What could be the problem here? --- With "check_cert = no", the rest api is able to make the mtls connection. But I would like to also have the server certificate validation enabled. --- Freeradius debug output below: FreeRADIUS Version 3.2.8 Copyright (C) 1999-2025 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT FreeRADIUS is developed, maintained, and supported by InkBridge Networks. For commercial support, please email sales(a)inkbridgenetworks.com https://inkbridgenetworks.com/ Starting - reading configuration files ... including dictionary file /opt/share/freeradius/dictionary including dictionary file /opt/share/freeradius/dictionary.dhcp including dictionary file /opt/share/freeradius/dictionary.vqp including configuration file /opt/etc/raddb/radiusd.conf including configuration file /opt/etc/raddb/clients.conf including files in directory /opt/etc/raddb/mods-enabled/ including configuration file /opt/etc/raddb/mods-enabled/preprocess including configuration file /opt/etc/raddb/mods-enabled/pap including configuration file /opt/etc/raddb/mods-enabled/files including configuration file /opt/etc/raddb/mods-enabled/rest_auth_log including configuration file /opt/etc/raddb/mods-enabled/realm including files in directory /opt/etc/raddb/sites-enabled/ including configuration file /opt/etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radacct" hostname_lookups = no max_request_time = 30 proxy_dedup_window = 1 cleanup_delay = 5 max_requests = 256 max_fds = 512 postauth_client_lost = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 0 reject_delay = 0.000000 delay_proxy_rejects = no status_server = no require_message_authenticator = "auto" limit_proxy_state = "auto" allow_vulnerable_openssl = "no" } unlang { group_stop_return = no policy_stop_return = no } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client radtest { ipaddr = 0.0.0.0/0 secret = <<< secret >>> proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Shared secret for client radtest is short, and likely can be broken by an attacker. Found debugger attached Configuration version: 0da7-aa84-14bb-36bd # Creating Auth-Type = PAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_preprocess # Loading module "preprocess" from file /opt/etc/raddb/mods-enabled/preprocess preprocess { with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_pap # Loading module "pap" from file /opt/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_files # Loading module "files" from file /opt/etc/raddb/mods-enabled/files files { usersfile = "/opt/etc/raddb/users" } # Loaded module rlm_rest # Loading module "rest_auth_failure_log" from file /opt/etc/raddb/mods-enabled/rest_auth_log rest rest_auth_failure_log { connect_timeout = 4.000000 http_negotiation = "default" } # Loaded module rlm_realm # Loading module "IPASS" from file /opt/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /opt/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /opt/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /opt/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /opt/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Instantiating module "preprocess" from file /opt/etc/raddb/mods-enabled/preprocess # Instantiating module "pap" from file /opt/etc/raddb/mods-enabled/pap # Instantiating module "files" from file /opt/etc/raddb/mods-enabled/files reading pairlist file /opt/etc/raddb/users # Instantiating module "rest_auth_failure_log" from file /opt/etc/raddb/mods-enabled/rest_auth_log post-auth { uri = "https://auth.feature-devops.qa.xcloudiq.com:8443/auth/log-event" method = "post" body = "json" attr_num = no raw_value = no data = "{"Auth-Result": "FAILURE", "Message":"%{Reply-Message}", "User-Name": "%{User-Name}", "NAS-Identifier": "%{NAS-Identifier}", "NAS-Port-Type": "%{NAS-Port-Type}", "NAS-IP-Address": "%{NAS-IP-Address}", "NAS-Port": "%{NAS-Port}", "NAS-Port-Id": "%{NAS-Port-Id}", "Called-Station-Id": "%{Called-Station-Id}", "Calling-Station-Id": "%{Calling-Station-Id}", "EAP-Message": "%{EAP-Message}"}" auth = "none" require_auth = no timeout = 4.000000 chunk = 0 tls { ca_file = "/etc/certs/craas-ca.pem" certificate_file = "/etc/certs/client.pem" private_key_file = "/etc/certs/client.key" check_cert = yes check_cert_cn = yes } body_uri_encode = yes } rlm_rest: libcurl version: libcurl/8.12.1 OpenSSL/3.3.4 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 c-ares/1.34.5 libidn2/2.3.7 libpsl/0.21.5 nghttp2/1.64.0 rlm_rest (rest_auth_failure_log): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 max_retries = 5 spread = no } rlm_rest (rest_auth_failure_log): Opening additional connection (0), 1 of 10 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified rlm_rest (rest_auth_failure_log): Opening additional connection (1), 1 of 9 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified rlm_rest (rest_auth_failure_log): Opening additional connection (2), 1 of 8 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified rlm_rest (rest_auth_failure_log): Opening additional connection (3), 1 of 7 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified rlm_rest (rest_auth_failure_log): Opening additional connection (4), 1 of 6 pending slots used rlm_rest (rest_auth_failure_log): Skipping pre-connect, connect_uri not specified # Instantiating module "IPASS" from file /opt/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /opt/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /opt/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /opt/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /opt/etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /opt/etc/raddb/radiusd.conf } # server server default { # from file /opt/etc/raddb/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type # Loading authorize {...} # Loading preacct {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Ready to process requests !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! BlastRADIUS check: Received packet with Message-Authenticator. Setting "require_message_authenticator = true" for client radtest !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! It looks like the client has been updated to protect from the BlastRADIUS attack. Please set "require_message_authenticator = true" for client radtest !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (0) Received Access-Request Id 209 from 172.25.0.2:42843 to 172.25.0.20:1812 length 78 (0) Message-Authenticator = 0x8313e1ea17ab9e92ecbe637497d3d878 (0) User-Name = "testuser" (0) User-Password = "password123" (0) NAS-IP-Address = 172.25.0.2 (0) NAS-Port = 0 (0) # Executing section authorize from file /opt/etc/raddb/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "testuser", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /opt/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { rlm_rest (rest_auth_failure_log): Reserved connection (0) (0) rest_auth_failure_log: Expanding URI components (0) rest_auth_failure_log: EXPAND https://auth.feature-devops.qa.xcloudiq.com:8443 (0) rest_auth_failure_log: --> https://auth.feature-devops.qa.xcloudiq.com:8443 (0) rest_auth_failure_log: EXPAND /auth/log-event (0) rest_auth_failure_log: --> /auth/log-event (0) rest_auth_failure_log: Sending HTTP POST to " https://auth.feature-devops.qa.xcloudiq.com:8443/auth/log-event" (0) rest_auth_failure_log: EXPAND {"Auth-Result": "FAILURE", "Message":"%{Reply-Message}", "User-Name": "%{User-Name}", "NAS-Identifier": "%{NAS-Identifier}", "NAS-Port-Type": "%{NAS-Port-Type}", "NAS-IP-Address": "%{NAS-IP-Address}", "NAS-Port": "%{NAS-Port}", "NAS-Port-Id": "%{NAS-Port-Id}", "Called-Station-Id": "%{Called-Station-Id}", "Calling-Station-Id": "%{Calling-Station-Id}", "EAP-Message": "%{EAP-Message}"} (0) rest_auth_failure_log: --> {"Auth-Result": "FAILURE", "Message":"", "User-Name": "testuser", "NAS-Identifier": "", "NAS-Port-Type": "", "NAS-IP-Address": "172.25.0.2", "NAS-Port": "0", "NAS-Port-Id": "", "Called-Station-Id": "", "Calling-Station-Id": "", "EAP-Message": ""} *(0) rest_auth_failure_log: ERROR: Request failed: 60 - SSL peer certificate or SSH remote key was not OK* (0) rest_auth_failure_log: ERROR: Server returned no data rlm_rest (rest_auth_failure_log): Released connection (0) (0) [rest_auth_failure_log] = fail (0) } # Post-Auth-Type REJECT = fail (0) Sent Access-Reject Id 209 from 172.25.0.20:1812 to 172.25.0.2:42843 length 38 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 209 with timestamp +17 due to cleanup_delay was reached Ready to process requests ------ Using curl from the same container: # curl -v https://auth.feature-devops.qa.xcloudiq.com:8443/auth/log-event \ > --cert /etc/certs/client.pem \ > --key /etc/certs/client.key \ > --cacert /etc/certs/craas-ca.pem \ > --data '{"authResult": "SUCCESS", "message": "test"}' \ > -H "Content-Type: application/json" * Host auth.feature-devops.qa.xcloudiq.com:8443 was resolved. * IPv6: (none) * IPv4: 3.150.3.32, 3.19.113.11 * Trying 3.150.3.32:8443... * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/certs/craas-ca.pem * CApath: /etc/ssl/certs * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Request CERT (13): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Certificate (11): * TLSv1.3 (OUT), TLS handshake, CERT verify (15): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / x25519 / RSASSA-PSS * ALPN: server accepted h2 * Server certificate: * subject: CN=auth.feature-devops.qa.xcloudiq.com * start date: Aug 21 10:48:40 2025 GMT * expire date: Apr 13 10:49:06 2027 GMT * subjectAltName: host "auth.feature-devops.qa.xcloudiq.com" matched cert's "auth.feature-devops.qa.xcloudiq.com" * issuer: CN=example.com ** SSL certificate verify ok.* * Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * Connected to auth.feature-devops.qa.xcloudiq.com (3.150.3.32) port 8443 * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://auth.feature-devops.qa.xcloudiq.com:8443/auth/log-event * [HTTP/2] [1] [:method: POST] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: auth.feature-devops.qa.xcloudiq.com:8443] * [HTTP/2] [1] [:path: /auth/log-event] * [HTTP/2] [1] [user-agent: curl/8.12.1] * [HTTP/2] [1] [accept: */*] * [HTTP/2] [1] [content-type: application/json] * [HTTP/2] [1] [content-length: 44] > POST /auth/log-event HTTP/2 > Host: auth.feature-devops.qa.xcloudiq.com:8443 > User-Agent: curl/8.12.1 > Accept: */* > Content-Type: application/json > Content-Length: 44 ----- Using openssl from the same container: # openssl s_client -connect auth.feature-devops.qa.xcloudiq.com:8443 -servername auth.feature-devops.qa.xcloudiq.com -showcerts -CAfile /etc/certs/craas-ca.pem -cert /etc/certs/client.pem -key /etc/certs/client.key Connecting to 3.19.113.11 CONNECTED(0000000C) depth=1 CN=example.com verify return:1 depth=0 CN=auth.feature-devops.qa.xcloudiq.com verify return:1 --- Certificate chain 0 s:CN=auth.feature-devops.qa.xcloudiq.com i:CN=example.com a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Aug 21 10:48:40 2025 GMT; NotAfter: Apr 13 10:49:06 2027 GMT -----BEGIN CERTIFICATE----- MIID5jCCAs6gAwIBAgITMmRgH5Qu0MLxEf/HtpvN9ukxBDANBgkqhkiG9w0BAQsF ADAWMRQwEgYDVQQDEwtleGFtcGxlLmNvbTAeFw0yNTA4MjExMDQ4NDBaFw0yNzA0 MTMxMDQ5MDZaMC4xLDAqBgNVBAMTI2F1dGguZmVhdHVyZS1kZXZvcHMucWEueGNs b3VkaXEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnSi/OpCZ oCklple6nG5i+RJtpBPyVtmEs2SNFnFfztdRYRERLA8HjvzwOzvOHAY7LiN7WoCN 1oxl6pEcGCuQYngUpGeF/wXRj3MI3kRdlA5Hi+S/D8oM4F5I+oE5OE4R04zXh5zP Fxtrkec1F67CWLi7RFJzWKuyaXVpH3Ge5U8r7mItz5VmKoOCaaE43nq+R1uXurxm 2rS+VgirDklqcZknNNTIlQe75Omhy3pFXX6lp3pmFCmJHNa8YiZH1IdCrt5kAoup 3RkRfeqAqKXqxfNUUi1FvYleho64OBWCf+g7Bv0tHeG1ZaruqIxaQmm17bmoWiNL ByZ8I2IQYOC27QIDAQABo4IBEzCCAQ8wDgYDVR0PAQH/BAQDAgOoMB0GA1UdJQQW MBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUbayxOWLxD6AMBItZUd7O JpzFDnswHwYDVR0jBBgwFoAURsoapNlzJJEMyTV66SO8zP85RyAwOwYIKwYBBQUH AQEELzAtMCsGCCsGAQUFBzAChh9odHRwOi8vMTI3LjAuMC4xOjgyMDAvdjEvcGtp L2NhMC4GA1UdEQQnMCWCI2F1dGguZmVhdHVyZS1kZXZvcHMucWEueGNsb3VkaXEu Y29tMDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly8xMjcuMC4wLjE6ODIwMC92MS9w a2kvY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQCgksYhW1qTb5ajFGBu8xTWW04QnxI2 8VH4r3m2uQe0Mjl+eoMB/QxnOANQbmSO3QScbW8sQL/nw0kGHH3mdeLSpSatE3ix tzM1Sp/RUywMTmKJZuSGEm/3TSIAq7ZEmk1i/ohXm9npXptkc7r66OFp66UwT8MP fN8pT4ffgJYOUMWv8NBNre3qHrBSoB3Lmq4WS4ZYel7U3yhXcqfwLtzCyEvgSERW mDLRVFkYwR1mjasRGaaRTmn/P/IdNaFUPb6r8jmUTvIim/yZOsW6vaNGMQqCOa9s iDXRteuNTVVXbvuT1/RJRkVfPmaBOBXcrbEYB2LXeyyAl2A5WwhfcKbD -----END CERTIFICATE----- --- Server certificate subject=CN=auth.feature-devops.qa.xcloudiq.com issuer=CN=example.com --- Acceptable client certificate CA names CN=example.com Requested Signature Algorithms: RSA-PSS+SHA256:ECDSA+SHA256:ed25519:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA384:ECDSA+SHA512:RSA+SHA1:ECDSA+SHA1 Shared Requested Signature Algorithms: RSA-PSS+SHA256:ECDSA+SHA256:ed25519:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA384:ECDSA+SHA512 Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 1641 bytes and written 2531 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256 Server public key is 2048 bit This TLS version forbids renegotiation. No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- --- Post-Handshake New Session Ticket arrived: SSL-Session: Protocol : TLSv1.3 Cipher : TLS_AES_128_GCM_SHA256 Session-ID: 59BA87B9568BB087AD6E74F9A1488D0D9EF4F504465A77CB1D64127D28099D93 Session-ID-ctx: Resumption PSK: 25BA17E099AE416784ABFA9B70EED3F040BA03239E9DA3E118320ACA843E9EB4 PSK identity: None PSK identity hint: None SRP username: None TLS session ticket lifetime hint: 604800 (seconds) TLS session ticket: 0000 - 51 ec 04 b8 20 fd 94 97-09 ff ca 67 c4 40 8f 4b Q... ......g.@ .K 0010 - 41 b5 53 4a ad 4e fd f2-bd 38 ab 70 ff 2c 58 e3 A.SJ.N...8.p.,X. 0020 - d8 b7 52 5a 3c c1 88 f8-b3 eb da 20 58 95 84 fc ..RZ<...... X... 0030 - 17 4c 15 24 30 29 00 26-50 68 0d 17 bd 54 80 ff .L.$0).&Ph...T.. 0040 - d7 35 67 0b b5 47 71 99-cf 0a 04 14 80 89 38 c5 .5g..Gq.......8. 0050 - cf 3b ec 9b 30 3c 07 6f-69 b6 f1 e8 67 46 54 b2 .;..0<.oi...gFT. 0060 - 8f 78 33 fe ec 73 06 d6-d3 82 bf e0 4b 29 6b 11 .x3..s......K)k. 0070 - 68 52 4d 20 56 3d 0c c5-66 19 b3 b4 33 34 a1 a2 hRM V=..f...34.. 0080 - a2 bb a2 6f 64 d9 ab f7-e1 20 a9 34 31 df 00 c1 ...od.... .41... 0090 - 97 37 77 9e 05 03 f1 f6-b7 7a 3a 64 5a 6a 05 ba .7w......z:dZj.. 00a0 - 7e b6 74 eb 67 94 d7 66-a7 4e fc 07 5b e0 7c 74 ~.t.g..f.N..[.|t 00b0 - 03 0d 2a ac 64 28 98 08-6a e4 3b e4 4b 93 b3 c9 ..*.d(..j.;.K... 00c0 - 16 0f b4 6b 09 ea 31 97-d6 79 f3 bd 58 31 c8 17 ...k..1..y..X1.. 00d0 - 54 df 9d bf 25 00 98 15-37 58 4e 3b 06 8a 15 87 T...%...7XN;.... 00e0 - 81 48 79 44 4a 09 6e 8d-dc 94 6f 7e d0 36 1a 04 .HyDJ.n...o~.6.. 00f0 - 61 80 4c ca a5 8c cb 4f-40 3f ad ef 6c 5a ee fb a.L....O@ ?..lZ.. 0100 - d9 a4 ca e5 43 d3 62 4c-5c 88 84 7d 47 69 0c f5 ....C.bL\..}Gi.. 0110 - b9 38 93 a4 df e3 2a cd-34 8e d8 82 90 95 25 76 .8....*.4.....%v 0120 - 92 5f 2d f0 8a a7 12 5b-f4 7a 46 2d d5 52 82 f5 ._-....[.zF-.R.. 0130 - ff b6 64 88 d0 6f e4 27-e6 b7 f3 f9 6f db a1 77 ..d..o.'....o..w 0140 - 15 49 6d 98 19 c0 ef 75-ba 62 39 b1 5a d1 d9 29 .Im....u.b9.Z..) 0150 - 65 1e 11 3d 19 2f 6d 8b-a7 79 cf 12 2a fa 64 df e..=./m..y..*.d. 0160 - 34 a1 81 fe 16 e2 ab 37-7b a5 81 c5 e0 be 63 96 4......7{.....c. 0170 - 27 5a db 84 05 44 13 67-10 80 67 9c f8 cd e8 5e 'Z...D.g..g....^ 0180 - 53 a1 c8 55 20 30 7f fc-03 8a 58 ac 27 fc 7b ab S..U 0....X.'.{. 0190 - c9 30 97 06 68 72 69 ed-78 76 23 f8 46 1c b7 3a .0..hri.xv#.F..: 01a0 - 2d c0 b8 98 66 21 32 67-46 e8 63 e0 06 76 e2 e9 -...f!2gF.c..v.. 01b0 - 8e 42 d4 cd 9c 91 b8 14-ae 23 3a 29 04 c9 78 8e .B.......#:)..x. 01c0 - b7 39 fe 46 55 af 5c 2b-56 cb 06 1f 38 d8 91 df .9.FU.\+V...8... 01d0 - 12 d0 6b c5 00 f5 e2 33-7c 96 b5 22 f9 cd 66 95 ..k....3|.."..f. 01e0 - 52 ff ef 8a 2e 80 a9 35-82 8b 8e 4c 42 d2 96 4e R......5...LB..N 01f0 - d2 61 6f da db 87 1a 21-f0 51 98 62 c7 12 8b b5 .ao....!.Q.b.... 0200 - a4 3f ac ca 76 bc d5 26-e0 a5 a9 a8 2e bc 7b 42 .?..v..&......{B 0210 - ac 3a 65 d2 67 b8 7a d3-b5 7a 83 73 67 ee 28 5c .:e.g.z..z.sg.(\ 0220 - d4 62 0a 68 a8 e3 a0 43-f8 ba f8 bc 7c ed 5a 94 .b.h...C....|.Z. 0230 - 01 6a 96 01 e5 95 0a b3-41 92 10 ba 9d 7c 5f 21 .j......A....|_! 0240 - cc 03 a3 49 d8 c2 02 3b-08 1e e2 63 9a 20 12 30 ...I...;...c. .0 0250 - 78 f6 5d 94 8f 76 97 0a-e3 cb 12 52 90 b6 6f 03 x.]..v.....R..o. 0260 - 3e a2 fe 80 f7 02 16 19-65 0a 70 0e 5a a9 95 39 >.......e.p.Z..9 0270 - 14 94 b6 d6 12 e5 86 67-43 7f 7e 39 2f 68 25 e1 .......gC.~9/h%. 0280 - ad eb d6 e5 e8 93 55 4b-70 83 1e 17 ea ca 26 20 ......UKp.....& 0290 - 47 b7 d6 32 d2 2f 25 19-8b d5 a5 ee fc bc 84 35 G..2./%........5 02a0 - 29 1c 1b d7 7b 48 b5 66-3a 17 b3 a9 de 56 cf f2 )...{H.f:....V.. 02b0 - df 35 9d 98 cb 38 cb 71-f9 65 64 4f fe 2b 13 4d .5...8.q.edO.+.M 02c0 - 44 da ed d1 41 5a 61 95-73 b2 dc 71 43 72 68 a0 D...AZa.s..qCrh. 02d0 - 6e a2 0a a2 b0 d2 b3 8a-32 93 e4 87 31 fc f3 e9 n.......2...1... 02e0 - 75 45 2a e4 04 8a ff 3e-ca 9f af a0 b4 3e 65 49 uE*....>.....>eI 02f0 - 54 a6 a0 cc 7c e4 a2 f9-03 62 75 d8 57 ef 8a 41 T...|....bu.W..A 0300 - 5e 7a 5c bf b6 64 5e 86-aa 1c fb 17 c7 68 c2 da ^z\..d^......h.. 0310 - 47 8d ac 22 d8 fe 5b dd-bc ca 3e f0 8b 2d b2 25 G.."..[...>..-.% 0320 - 88 56 c5 e2 21 09 aa af-61 4d fb 58 5f a3 9a 29 .V..!...aM.X_..) 0330 - 06 2c 59 be c9 c7 d9 7e-c4 e0 74 58 c4 30 2a f4 .,Y....~..tX.0*. 0340 - 00 25 30 97 bd 79 47 e4-51 3a 89 e0 27 61 f8 dd .%0..yG.Q:..'a.. 0350 - 97 b0 dc da 00 ab c2 58-53 83 ec 6d 35 37 e0 d5 .......XS..m57.. 0360 - 6c 1d 90 84 49 b3 5f f4-5a 37 4c 52 12 c9 2a e9 l...I._.Z7LR..*. 0370 - 7f 74 6f c0 dd c5 ff d5-78 80 76 cd 49 dd 94 2e .to.....x.v.I... 0380 - a0 5a 68 6c 58 aa d0 f3-e9 a7 53 fc 1a 56 6b fe .ZhlX.....S..Vk. 0390 - a9 f4 be a3 ff 95 be 9d-ed c7 02 99 59 e6 bc eb ............Y... 03a0 - 16 bd 58 da c3 1f e5 bf-3f d1 80 59 48 42 e6 f3 ..X.....?..YHB.. 03b0 - 60 d4 4f a8 4f e7 2a ea-8e 64 2b 81 30 1e a2 89 `.O.O.*..d+.0... 03c0 - 09 e0 ad 5f 8b 4a 6b 60-bd 64 a8 db ef ab bf 42 ..._.Jk`.d.....B 03d0 - 48 37 b7 08 c5 17 18 62-c2 f9 a8 76 d7 a1 9f d6 H7.....b...v.... 03e0 - 71 1f d5 8f 6b a4 fa 2d-c4 9b f9 63 95 57 74 73 q...k..-...c.Wts 03f0 - 1f ea 6d 1a f9 c1 57 62-72 47 cc f2 0b 3e 8e 5a ..m...WbrG...>.Z 0400 - fd 71 05 c3 97 10 28 d7-9b db a7 14 46 fb f3 f3 .q....(.....F... 0410 - 56 ed 70 16 29 da 4e f8-8c a4 cf 78 50 e8 0e 11 V.p.).N....xP... 0420 - d2 ef 9b d5 ec 8f f7 57-64 eb 5b 0c b0 54 ad f2 .......Wd.[..T.. 0430 - 4c 70 8a 82 87 48 12 4d-38 37 6f d0 0f d5 17 94 Lp...H.M87o..... 0440 - 27 64 9a 7c 32 83 5a 6e-1d e6 83 80 14 64 9c b5 'd.|2.Zn.....d.. 0450 - b2 f0 05 4f c1 c0 67 58-a3 c9 a4 e2 7a 00 c8 dd ...O..gX....z... 0460 - 7d a4 f1 30 b4 c7 4e f6-56 f4 b5 4b b7 6e ce cc }..0..N.V..K.n.. 0470 - b0 f5 f5 5f 0d e7 96 04-31 eb 88 44 f1 7b d6 92 ..._....1..D.{.. 0480 - df 5a 83 ca c3 67 86 69-56 11 90 0f 8b 3a 6e b7 .Z...g.iV....:n. 0490 - f5 7a 0a 8d ee bc 3d b7-a7 06 4c 87 4c 39 9e be .z....=...L.L9.. 04a0 - 75 df aa 06 f6 b3 8b c1-b5 e6 e8 82 36 65 b2 e1 u...........6e.. 04b0 - 38 c8 ef 2d 7d c0 6a 06-9e 01 1d 5a de c5 09 57 8..-}.j....Z...W 04c0 - cf 5d 3a c5 10 1c 71 ef-de 60 80 66 c3 1d 28 35 .]:...q..`.f..(5 04d0 - 81 59 36 88 4c 06 c2 e2-9b fa f3 d4 7c 36 85 c2 .Y6.L.......|6.. 04e0 - a8 48 e5 b2 85 1c 71 73-59 fc 5b f4 a1 10 db 40 .H....qsY.[....@ 04f0 - ab 93 0e e2 b7 7f 44 9f-85 1d d4 a9 45 e8 b3 44 ......D.....E..D 0500 - 3e 95 f0 be 2d 6f 20 ee-5b 47 47 f7 23 76 a8 3d >...-o .[GG.#v.= 0510 - 89 46 5a 9d 1e c5 ed c9-97 6e 8e 87 81 16 88 df .FZ......n...... 0520 - 5a d4 a3 a2 9d bb 2a b7-48 28 07 3b 59 ba 84 06 Z.....*.H(.;Y... 0530 - 44 81 80 cf 0c d3 85 db-2c af bc 5b e9 03 76 e3 D.......,..[..v. 0540 - 67 b3 9f aa b8 42 86 15-02 cb 9a af fd da 4e c1 g....B........N. 0550 - 39 ae c9 0f da 73 2c 88-a2 11 2a 3f 7f 7e 09 c8 9....s,...*?.~.. 0560 - bf 9b 02 34 57 de bd 13-f8 67 29 e7 a8 8d ee 39 ...4W....g)....9 0570 - 19 50 51 00 01 16 70 84-18 38 b7 28 7b 3d ee ae .PQ...p..8.({=.. 0580 - e0 06 45 28 c2 22 ee 59-72 08 10 1e 3d 72 14 14 ..E(.".Yr...=r.. 0590 - e7 68 97 59 b2 6d 4f a3-c9 0d fd db a5 2d 95 33 .h.Y.mO......-.3 05a0 - a0 63 03 f2 59 9f 39 40-77 e1 f8 14 fd ee 66 ba .c..Y.9@w. ....f. 05b0 - d5 b8 20 fb 25 90 1c 7b-d9 5a 9c e6 a6 08 29 01 .. .%..{.Z....). 05c0 - 9e 94 45 e2 43 51 ad 03-cc 3f 38 f5 b4 c7 cd da ..E.CQ...?8..... 05d0 - 54 f0 75 62 aa 5a e4 35-99 a5 6f c8 2a b4 c2 ba T.ub.Z.5..o.*... 05e0 - 13 45 ca ab a1 e3 c8 37-65 b9 c0 8e 55 57 2a 72 .E.....7e...UW*r 05f0 - df 1a f3 51 e5 68 cc 05-c4 b6 9a b0 19 c8 bf a4 ...Q.h.......... 0600 - c1 fe 8e d9 19 05 8e 21-a1 ac 5e be 64 60 1f 89 .......!..^.d`.. 0610 - 51 b4 3d 34 c6 49 49 1d-2e 3a 25 0a b0 f0 88 37 Q.=4.II..:%....7 0620 - 88 59 e6 62 ff 7d f2 c9-6a f5 d4 15 46 23 56 81 .Y.b.}..j...F#V. 0630 - c7 32 33 9f 2e b1 9c d8-e7 52 ab 5f e9 ff 54 40 .23......R._..T@ 0640 - fe 7b f9 65 92 55 35 1f-98 af ff b6 57 39 94 3c .{.e.U5.....W9.< 0650 - f1 29 62 af 89 99 fe 0b-e7 0c 8a ac 05 1b e6 08 .)b............. 0660 - 24 2c fa c7 7f 26 d6 99-2e 1b 39 f2 d5 01 3b b7 $,...&....9...;. 0670 - 67 9f f1 a8 7e fd e3 f3-f9 be 9f e4 06 6f 04 36 g...~........o.6 0680 - 19 9f 05 c0 6d b7 2c 44-74 30 08 6d 6a cf 5d 17 ....m.,Dt0.mj.]. 0690 - 1d 2b 19 02 60 99 ca 5f-9e 54 f4 61 ef 98 b2 19 .+..`.._.T.a.... 06a0 - 18 c9 2f 63 c8 59 49 f6-61 2d 25 91 27 0d 09 e1 ../c.YI.a-%.'... 06b0 - ee c7 be a2 d1 7c f3 a3-e5 6f 31 aa cf ac e4 0b .....|...o1..... 06c0 - e6 47 71 a6 74 ba 2d ba-02 c4 e5 b6 ae 8e 15 9e .Gq.t.-......... 06d0 - b2 bf 66 84 e6 d3 d1 06-ca 4b 14 a3 16 63 ee cd ..f......K...c.. 06e0 - e5 19 3c 0f 4c 57 31 32-07 03 b8 7a 95 8e 04 d7 ..<.LW12...z.... 06f0 - 0f 41 7d 06 6f 80 14 f6-ce ec f1 d6 8a 85 5b 98 .A}.o.........[. 0700 - 7b e4 6c 5c 2e 86 c7 e3-27 25 fd c8 02 ec 20 0c {.l\....'%.... . 0710 - 33 6e 05 70 76 e5 63 3f-af d0 97 25 8b e8 41 1c 3n.pv.c?...%..A. 0720 - f1 c9 c2 80 ba ef 2c cf-af e4 b2 b7 a2 53 a7 8c ......,......S.. 0730 - fb 24 b2 e5 65 8a 71 4b-06 a4 fe fc d5 91 16 7b .$..e.qK.......{ 0740 - 44 fa 3c 5e a0 f3 b1 1b-0c 03 2a 91 4b c8 68 7d D.<^......*.K.h} 0750 - d1 aa 5b 86 8b 1d 77 fa-9f 2b f9 19 0c 0d 9b eb ..[...w..+...... 0760 - 47 69 03 b3 2e f9 c5 29-f5 e7 ff 7d 9e 81 24 e8 Gi.....)...}..$. 0770 - 56 ed 22 cf a3 87 19 77-05 55 9f d1 9c 89 1e 6c V."....w.U.....l 0780 - 32 c8 f1 5d 85 21 bd 21-3c 22 43 bb 0f 3e 53 e3 2..].!.!<"C..>S. 0790 - b7 b3 cc fa 7e 83 55 c0-cb 36 1e 67 a4 fa 97 1b ....~.U..6.g.... 07a0 - 2f 5a 7f 14 8a d8 e1 6f-ca c8 ca f1 e6 b2 fc c8 /Z.....o........ 07b0 - 37 15 1b 8e bf 25 61 aa-ea e8 3e 03 28 5f 61 7b 7....%a...>.(_a{ 07c0 - 85 d3 81 dc 0c 27 94 ff-6a 18 7d 4c d1 cb 5a 5c .....'..j.}L..Z\ 07d0 - 61 44 24 cc 8b a2 2c 48-a2 88 66 e4 c4 ae 82 02 aD$...,H..f..... 07e0 - b3 4c 89 f2 8f 5b 25 d1-14 87 6d 7a a9 df 40 2f .L...[%...mz..@ / 07f0 - ab b2 48 e9 1e 3b 87 4d-2e 3c ea e1 f0 3e a5 14 ..H..;.M.<...>.. 0800 - e2 94 1b d0 49 a5 05 06-3e 55 e4 c0 64 89 d1 e6 ....I...>U..d... 0810 - d2 12 3e 15 5e 76 9b 44-0c 53 30 32 d8 40 df 10 ..>.^v.D.S02.@ .. 0820 - 63 c2 e9 04 41 fe c5 b5-38 5b 36 c8 4b c3 87 94 c...A...8[6.K... 0830 - c4 e4 2d 3f e6 34 da 94-b1 b8 ef 3e a6 86 cc d4 ..-?.4.....>.... 0840 - b2 12 2f 4c 1c aa 74 f6-a1 34 76 b6 c8 93 4a a6 ../L..t..4v...J. 0850 - db 2a 6b 11 3f e4 c5 34-ab 73 26 85 18 77 60 50 .*k.?..4.s&..w`P 0860 - 63 f5 89 94 ff fe 13 88-4c 49 fd ab 62 86 e8 14 c.......LI..b... 0870 - 26 23 da 87 20 05 1e 12-8a 43 7d ed 12 67 82 f3 &#.. ....C}..g.. 0880 - 5a 6f 55 5d ce 67 67 ef-59 41 5f 1a 00 a7 1e 5a ZoU].gg.YA_....Z 0890 - 7e d7 e0 2a 4d 76 0f f1-9f e8 75 ec 91 1e 3e 96 ~..*Mv....u...>. 08a0 - c2 e3 a9 5e db e7 48 18-b8 9d da 92 ef 5a 79 9f ...^..H......Zy. 08b0 - 2d a5 b7 e3 43 56 7c 4d-7a cd 2a c5 7f 12 08 57 -...CV|Mz.*....W 08c0 - 05 36 1b 9f 1c 63 a9 c2-b1 0c fa 6d 33 f6 bb 37 .6...c.....m3..7 08d0 - 00 31 33 2b 59 f7 2a e4-07 db 46 1f fc d2 e0 b7 .13+Y.*...F..... 08e0 - 82 a9 75 f1 07 bf 49 9b-e2 7d ef e1 81 de 7f 09 ..u...I..}...... 08f0 - f0 8e 6f 83 5c 9c 3a e4-f0 ac ac e8 4a f9 12 3a ..o.\.:.....J..: 0900 - 02 dd b5 86 0b b8 61 a0-90 9e 5a 9f 9d 3f 8d 64 ......a...Z..?.d 0910 - a2 74 83 e0 9a 95 a1 ea-ec 6d 69 89 fd 86 f0 1e .t.......mi..... 0920 - 28 aa c1 b3 8a 40 28 f9-61 f0 1c f6 7f 21 d9 f2 (....(a)(.a....!.. 0930 - 1a 15 3b 86 c4 fa f0 d6-9a bf 34 ce f6 e5 3b df ..;.......4...;. 0940 - 73 20 6d b5 ab 5d 00 9f-e2 34 5f ea 62 4a 78 2f s m..]...4_.bJx/ 0950 - ce 5b e3 59 ae ba 69 03-64 4d 74 b8 7b 9a 5e 93 .[.Y..i.dMt.{.^. 0960 - 52 49 72 f7 2f 32 f4 68-af a7 87 86 65 3d 5b fc RIr./2.h....e=[. 0970 - 7b 72 6a 21 42 af 09 d5-cb 68 a1 e2 7c 07 16 c4 {rj!B....h..|... 0980 - 3e 15 87 e9 e3 8e 9d 22-e4 64 09 22 0b 55 6d c3 >......".d.".Um. 0990 - e3 c8 7c 1f e8 4d 2d df-8b ba 95 6a ed a9 6c a0 ..|..M-....j..l. 09a0 - 7a b5 be cf 38 87 e0 77-de 9c 34 f7 19 3f f1 f7 z...8..w..4..?.. 09b0 - 25 cc 65 40 14 09 0a 5f-7b d0 de 26 d5 58 ae 38 %.e@ ..._{..&.X.8 09c0 - a0 f6 83 ce 6f d5 96 59-b3 f0 cd 3f 11 91 a1 36 ....o..Y...?...6 09d0 - 22 b3 e7 51 47 1c c9 b8-a6 42 34 30 25 05 67 e3 "..QG....B40%.g. 09e0 - 50 90 45 7f f0 c6 fc 89-8d 03 3c bd 60 f5 9a a0 P.E.......<.`... 09f0 - 97 10 f7 c8 a4 3a 88 f8-a3 02 f3 43 80 cd 9b 75 .....:.....C...u 0a00 - 29 69 e5 63 88 d7 2c a2-64 5a 3d c3 0b 43 5c 6f )i.c..,.dZ=..C\o 0a10 - fe 87 61 2e fd 68 b8 c7-65 02 cf 24 23 f1 66 2c ..a..h..e..$#.f, Thanks, Murali Krishnamoorthy

2 6

Verify that the user belongs to a specific ipv4 network
by Dzmitry Shykuts 05 Sep '25

05 Sep '25

Hello! In additionto the password, Ineedto verifythat theuserbelongstoa specificipv4network. Idon'tuseanydatabases. 1. I'm tryingto dothisinthe usersfile: test Cleartext-Password := "password", NAS-IP-Address == 10.1.1.0/24 Cisco-AVPair = "shell:priv-lvl=1", Service-Type = Administrative-User Got error: /etc/freeradius/3.0/mods-config/files/authorize[227]: Parse error (check) for entry test: Invalid IPv4 mask length "/24". Only "/32" permitted for non-prefix types Failed reading /etc/freeradius/3.0/mods-config/files/authorize /etc/freeradius/3.0/mods-enabled/files[9]: Instantiation failed for module "files" 2. I'm tryingto dothisinthe usersfile: test Cleartext-Password := "password", NAS-IP-Address < 10.1.1.0/24 Cisco-AVPair = "shell:priv-lvl=1", Service-Type = Administrative-User Got error: /etc/freeradius/3.0/mods-config/files/authorize[227]: Parse error (check) for entry test: Invalid IPv4 mask length "/24". Only "/32" permitted for non-prefix types Failed reading /etc/freeradius/3.0/mods-config/files/authorize /etc/freeradius/3.0/mods-enabled/files[9]: Instantiation failed for module "files" 3. I'm tryingto dothisinthe usersfile: test Cleartext-Password := "password", NAS-IP-Address =~ /10\.1\.1\..+/ Cisco-AVPair = "shell:priv-lvl=1", Service-Type = Administrative-User Got error: (0) files: EXPAND /10\.1\.1\..+/ (0) files: --> /10\.1\.1\..+/ (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test] (from client net port 0) (0) Delaying response for 1.000000 seconds Is it possible to make such a check for belonging to an ipv4 network? How to do this correctly? This check is very important for me...

2 2

freeradius-3.2.8-1.el9 fails to start
by Dan Oachs 22 Aug '25

22 Aug '25

I have a Rocky Linux release 9.6 system running with: freeradius-3.2.7-1.el9.x86_64 freeradius-mysql-3.2.7-1.el9.x86_64 freeradius-utils-3.2.7-1.el9.x86_64 I am using the networkradius repo: [networkradius] name=NetworkRADIUS-$releasever baseurl=http://packages.networkradius.com/freeradius-3.2/rocky/$releasever/ enabled=1 gpgcheck=1 gpgkey=https://packages.networkradius.com/pgp/packages%40networkradius.com After doing a DNF update to my system today results in radiusd failing to start. /var/log/messages has what looks like some relevant error messages: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Invalid regular expression: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: ^ Pattern JIT failed: no more memory Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Failed with result 'exit-code'. If I downgrade back to 3.2.7-1 the service starts as usual. Am I missing a step in the upgrade or something? Thanks, Dan Oachs

6 9

Version 3.2.8 has been released
by Matthew Newton 22 Aug '25

22 Aug '25

We have released FreeRADIUS 3.2.8. A few noteworthy items from the changelog: - Added rlm_kafka to produce messages to Kafka. - Alterations to how reject_delay works. - Ability to delay proxied messages, too. - Improvements to the dpsk module. - More debug output with helpful pointers to documentation. As well as many bug fixes. Full information is in doc/ChangeLog. Download from the normal places: https://freeradius.org/releases/ https://freeradius.org/ftp/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_8 Packages -------- Packages are available from InkBridge Networks for common Linux distributions as usual: https://packages.inkbridgenetworks.com/ Note that there are not yet packages for Rocky 10 or Debian 13 due to these being newly released. These will follow in due course. Docker images are also available: https://hub.docker.com/r/freeradius/freeradius-server Important note on Docker ------------------------ With this release we are making experimental multi-arch Docker images available at freeradius/freeradius-test:3.2.8 (and similar). The current intention is to swap the main `freeradius/freeradius-server` tags over to this at the next release. To date, images have been built at release time only meaning no further updates are made. As well as having support for common ARM architectures as well as amd64, the images going forwards will be refreshed on a more regular basis meaning base OS security updates will be applied to the FreeRADIUS images. (At least the images for the last couple of released versions will be rebuilt regularly.) This will break the assumption that a Docker image does not change once the tag has been released (not common for Docker in general, but has largely been true for FreeRADIUS thus far). We recommend that you check any processes (e.g. CI or release pipelines) before the next release. If you have a requirement that the image does not change once pulled, you may need to use an intermediary local docker registry or build based on the image hashes (which are fixed), rather than the published tags. FreeRADIUS Support ------------------ Finally, brief a reminder that commercial FreeRADIUS support (including system builds and professional development services) is available from InkBridge Networks, which helps fund FreeRADIUS development. -- Matthew

1 1

[FreeRadius] Help how do I make Expiration
by Horas Hajovan Siregar 21 Aug '25

21 Aug '25

Hello, I'm having a problem creating a user that, when logged in, will not be able to be used again for 1 hour after logging in. I tried using session-timeout, but I can still log in for the next hour. I was hoping to prevent logging in again after 1 hour. I found sources from several articles using the Expiration attribute, but I'm having a problem where it doesn't count as 1 hour after logging in. Please help. I use freeradius root@rad:~# freeradius -X FreeRADIUS Version 3.0.26 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE

3 4