- Freeradius-Users - lists.freeradius.org

Verify that the user belongs to a specific ipv4 network
by Dzmitry Shykuts 05 Sep '25

05 Sep '25

Hello! In additionto the password, Ineedto verifythat theuserbelongstoa specificipv4network. Idon'tuseanydatabases. 1. I'm tryingto dothisinthe usersfile: test Cleartext-Password := "password", NAS-IP-Address == 10.1.1.0/24 Cisco-AVPair = "shell:priv-lvl=1", Service-Type = Administrative-User Got error: /etc/freeradius/3.0/mods-config/files/authorize[227]: Parse error (check) for entry test: Invalid IPv4 mask length "/24". Only "/32" permitted for non-prefix types Failed reading /etc/freeradius/3.0/mods-config/files/authorize /etc/freeradius/3.0/mods-enabled/files[9]: Instantiation failed for module "files" 2. I'm tryingto dothisinthe usersfile: test Cleartext-Password := "password", NAS-IP-Address < 10.1.1.0/24 Cisco-AVPair = "shell:priv-lvl=1", Service-Type = Administrative-User Got error: /etc/freeradius/3.0/mods-config/files/authorize[227]: Parse error (check) for entry test: Invalid IPv4 mask length "/24". Only "/32" permitted for non-prefix types Failed reading /etc/freeradius/3.0/mods-config/files/authorize /etc/freeradius/3.0/mods-enabled/files[9]: Instantiation failed for module "files" 3. I'm tryingto dothisinthe usersfile: test Cleartext-Password := "password", NAS-IP-Address =~ /10\.1\.1\..+/ Cisco-AVPair = "shell:priv-lvl=1", Service-Type = Administrative-User Got error: (0) files: EXPAND /10\.1\.1\..+/ (0) files: --> /10\.1\.1\..+/ (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test] (from client net port 0) (0) Delaying response for 1.000000 seconds Is it possible to make such a check for belonging to an ipv4 network? How to do this correctly? This check is very important for me...

2 2

freeradius-3.2.8-1.el9 fails to start
by Dan Oachs 22 Aug '25

22 Aug '25

I have a Rocky Linux release 9.6 system running with: freeradius-3.2.7-1.el9.x86_64 freeradius-mysql-3.2.7-1.el9.x86_64 freeradius-utils-3.2.7-1.el9.x86_64 I am using the networkradius repo: [networkradius] name=NetworkRADIUS-$releasever baseurl=http://packages.networkradius.com/freeradius-3.2/rocky/$releasever/ enabled=1 gpgcheck=1 gpgkey=https://packages.networkradius.com/pgp/packages%40networkradius.com After doing a DNF update to my system today results in radiusd failing to start. /var/log/messages has what looks like some relevant error messages: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Invalid regular expression: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: ^ Pattern JIT failed: no more memory Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Failed with result 'exit-code'. If I downgrade back to 3.2.7-1 the service starts as usual. Am I missing a step in the upgrade or something? Thanks, Dan Oachs

6 9

Version 3.2.8 has been released
by Matthew Newton 22 Aug '25

22 Aug '25

We have released FreeRADIUS 3.2.8. A few noteworthy items from the changelog: - Added rlm_kafka to produce messages to Kafka. - Alterations to how reject_delay works. - Ability to delay proxied messages, too. - Improvements to the dpsk module. - More debug output with helpful pointers to documentation. As well as many bug fixes. Full information is in doc/ChangeLog. Download from the normal places: https://freeradius.org/releases/ https://freeradius.org/ftp/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_8 Packages -------- Packages are available from InkBridge Networks for common Linux distributions as usual: https://packages.inkbridgenetworks.com/ Note that there are not yet packages for Rocky 10 or Debian 13 due to these being newly released. These will follow in due course. Docker images are also available: https://hub.docker.com/r/freeradius/freeradius-server Important note on Docker ------------------------ With this release we are making experimental multi-arch Docker images available at freeradius/freeradius-test:3.2.8 (and similar). The current intention is to swap the main `freeradius/freeradius-server` tags over to this at the next release. To date, images have been built at release time only meaning no further updates are made. As well as having support for common ARM architectures as well as amd64, the images going forwards will be refreshed on a more regular basis meaning base OS security updates will be applied to the FreeRADIUS images. (At least the images for the last couple of released versions will be rebuilt regularly.) This will break the assumption that a Docker image does not change once the tag has been released (not common for Docker in general, but has largely been true for FreeRADIUS thus far). We recommend that you check any processes (e.g. CI or release pipelines) before the next release. If you have a requirement that the image does not change once pulled, you may need to use an intermediary local docker registry or build based on the image hashes (which are fixed), rather than the published tags. FreeRADIUS Support ------------------ Finally, brief a reminder that commercial FreeRADIUS support (including system builds and professional development services) is available from InkBridge Networks, which helps fund FreeRADIUS development. -- Matthew

1 1

[FreeRadius] Help how do I make Expiration
by Horas Hajovan Siregar 22 Aug '25

22 Aug '25

Hello, I'm having a problem creating a user that, when logged in, will not be able to be used again for 1 hour after logging in. I tried using session-timeout, but I can still log in for the next hour. I was hoping to prevent logging in again after 1 hour. I found sources from several articles using the Expiration attribute, but I'm having a problem where it doesn't count as 1 hour after logging in. Please help. I use freeradius root@rad:~# freeradius -X FreeRADIUS Version 3.0.26 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE

3 4

3.2.8 | ^ Pattern JIT failed: no more memory
by Cyrus Humphreville 22 Aug '25

22 Aug '25

Hi All, Spun up a new RHEL 9 VM and installed below RPMs for 3.2.8: freeradius-utils-3.2.8-1.el9.x86_64.rpm freeradius-config-3.2.8-1.el9.x86_64.rpm freeradius-3.2.8-1.el9.x86_64.rpm After installation, no configuration changes were made (kept at default). We then ran "systemctl start radiusd" and saw the below error via "journalctl -u radiusd": Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24178]: Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24178]: /etc/raddb/policy.d/filter[31]: Invalid regular expression: Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24178]: /etc/raddb/policy.d/filter[31]: Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24178]: /etc/raddb/policy.d/filter[31]: ^ Pattern JIT failed: no more memory Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com systemd[1]: radiusd.service: Failed with result 'exit-code'. Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. We also tried upgrading an existing RHEL 8 VM running 3.2.7 (used el8 RPMs) with our custom configs and encountered the same error. If we run radiusd in debug mode, it appears to start up without issue, so issue is only when trying to start via systemd. We have plenty of memory/RAM allocated to both VMs. Many thanks. Kind regards, Cyrus Humphreville

1 0

Error: Unresponsive child for request in component authorize module cache
by James Fan 20 Aug '25

20 Aug '25

Hi Alan, We recently did a stress test for the home server proxy. However, we found these two kinds of errors that block the server: Wed Aug 20 06:58:04 2025 : Error: Unresponsive child for request 396685, in component authorize module cache Wed Aug 20 06:58:04 2025 : Error: Unresponsive child for request 396689, in component <core> module I know it could be slow SQL queries causing these errors. But I wonder if the slow SQL queries cause the cache module to be unresponsive? Because the errors of the cache module are more than the core module. And I can't see the SQL module being unresponsive. So, I'm unsure where to find the root cause. The SQL server is working fine. We are conducting a stress test with 150 reqs/sec, but I'm unsure if a deadlock issue arises due to setting the max_requests to 50000 and utilizing the rlm_cache_tree driver for the local cache. Please advise how to find the root cause, and I can provide more details if needed. Thank you. Regards, James

3 2

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Wiki - Search broken?
by Sven Anders 14 Aug '25

14 Aug '25

Hello! I tried to use the search on https://wiki.freeradius.org/ I only get an "404 Not Found ----- - openresty" Is it broken? Can you repair it? Regards Sven

2 1

DELL S3148P with OS9 - Egress-VLANID-Support?
by Sven Anders 12 Aug '25

12 Aug '25

Hello! I'm trying to find out, if the DELL switch S3148P with OS9 (9.14.2.23) supports dynamically setting of tagged VLAN-IDs. Setting the untagged VLAN-ID with "Tunnel-Private-Group-Id" attribute works. I tried setting the tagged (and untagged) VLAN-IDs with the "Egress-VLANID" attribute, but without success. This still can be a configuration problem on my side. If I execute the "show vlan" command, I see the following: ASW01# show vlan Codes: * - Default VLAN, G - GVRP VLANs, R - Remote Port Mirroring VLANs, P - Primary, C - Community, I - Isolated O - Openflow, Vx - Vxlan Q: U - Untagged, T - Tagged x - Dot1x untagged, X - Dot1x tagged o - OpenFlow untagged, O - OpenFlow tagged G - GVRP tagged, M - Vlan-stack i - Internal untagged, I - Internal tagged, v - VLT untagged, V - VLT tagged NUM Status Description Q Ports * 1 Active U Po49(Te 1/49) U Gi 1/48 U Gi 2/1,2/14,2/16-2/17,2/19-2/22,2/24,2/38-2/39,2/41-2/45,2/48 1004 Active ANS-LAN-WLMGM01 T Po49(Te 1/49) x Gi 2/44 <------ HERE 1053 Active LAN-ZUK02 T Po49(Te 1/49) In this case (HERE) the untagged VLAN was correctly set via Radius. If you take a look at the legend above, you will see: x - Dot1x untagged, X - Dot1x tagged So, I suspect in general the assigning of untagged AND tagged is supported. Because I cannot find any further information in the internet, I hope some user here can help me... Regards Sven

5 7

DELL S3148P with OS9 - Egress-VLANID-Support?
by Sven Anders 11 Aug '25

11 Aug '25

1 0