- Freeradius-Users - lists.freeradius.org

3.2.8 | ^ Pattern JIT failed: no more memory
by Cyrus Humphreville 21 Aug '25

21 Aug '25

Hi All, Spun up a new RHEL 9 VM and installed below RPMs for 3.2.8: freeradius-utils-3.2.8-1.el9.x86_64.rpm freeradius-config-3.2.8-1.el9.x86_64.rpm freeradius-3.2.8-1.el9.x86_64.rpm After installation, no configuration changes were made (kept at default). We then ran "systemctl start radiusd" and saw the below error via "journalctl -u radiusd": Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24178]: Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24178]: /etc/raddb/policy.d/filter[31]: Invalid regular expression: Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24178]: /etc/raddb/policy.d/filter[31]: Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24178]: /etc/raddb/policy.d/filter[31]: ^ Pattern JIT failed: no more memory Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com systemd[1]: radiusd.service: Failed with result 'exit-code'. Aug 21 23:58:45 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. We also tried upgrading an existing RHEL 8 VM running 3.2.7 (used el8 RPMs) with our custom configs and encountered the same error. If we run radiusd in debug mode, it appears to start up without issue, so issue is only when trying to start via systemd. We have plenty of memory/RAM allocated to both VMs. Many thanks. Kind regards, Cyrus Humphreville

1 0

Error: Unresponsive child for request in component authorize module cache
by James Fan 20 Aug '25

20 Aug '25

Hi Alan, We recently did a stress test for the home server proxy. However, we found these two kinds of errors that block the server: Wed Aug 20 06:58:04 2025 : Error: Unresponsive child for request 396685, in component authorize module cache Wed Aug 20 06:58:04 2025 : Error: Unresponsive child for request 396689, in component <core> module I know it could be slow SQL queries causing these errors. But I wonder if the slow SQL queries cause the cache module to be unresponsive? Because the errors of the cache module are more than the core module. And I can't see the SQL module being unresponsive. So, I'm unsure where to find the root cause. The SQL server is working fine. We are conducting a stress test with 150 reqs/sec, but I'm unsure if a deadlock issue arises due to setting the max_requests to 50000 and utilizing the rlm_cache_tree driver for the local cache. Please advise how to find the root cause, and I can provide more details if needed. Thank you. Regards, James

3 2

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Wiki - Search broken?
by Sven Anders 14 Aug '25

14 Aug '25

Hello! I tried to use the search on https://wiki.freeradius.org/ I only get an "404 Not Found ----- - openresty" Is it broken? Can you repair it? Regards Sven

2 1

DELL S3148P with OS9 - Egress-VLANID-Support?
by Sven Anders 12 Aug '25

12 Aug '25

Hello! I'm trying to find out, if the DELL switch S3148P with OS9 (9.14.2.23) supports dynamically setting of tagged VLAN-IDs. Setting the untagged VLAN-ID with "Tunnel-Private-Group-Id" attribute works. I tried setting the tagged (and untagged) VLAN-IDs with the "Egress-VLANID" attribute, but without success. This still can be a configuration problem on my side. If I execute the "show vlan" command, I see the following: ASW01# show vlan Codes: * - Default VLAN, G - GVRP VLANs, R - Remote Port Mirroring VLANs, P - Primary, C - Community, I - Isolated O - Openflow, Vx - Vxlan Q: U - Untagged, T - Tagged x - Dot1x untagged, X - Dot1x tagged o - OpenFlow untagged, O - OpenFlow tagged G - GVRP tagged, M - Vlan-stack i - Internal untagged, I - Internal tagged, v - VLT untagged, V - VLT tagged NUM Status Description Q Ports * 1 Active U Po49(Te 1/49) U Gi 1/48 U Gi 2/1,2/14,2/16-2/17,2/19-2/22,2/24,2/38-2/39,2/41-2/45,2/48 1004 Active ANS-LAN-WLMGM01 T Po49(Te 1/49) x Gi 2/44 <------ HERE 1053 Active LAN-ZUK02 T Po49(Te 1/49) In this case (HERE) the untagged VLAN was correctly set via Radius. If you take a look at the legend above, you will see: x - Dot1x untagged, X - Dot1x tagged So, I suspect in general the assigning of untagged AND tagged is supported. Because I cannot find any further information in the internet, I hope some user here can help me... Regards Sven

5 7

DELL S3148P with OS9 - Egress-VLANID-Support?
by Sven Anders 11 Aug '25

11 Aug '25

1 0

DHCP
by Rodrigo Prieto 03 Aug '25

03 Aug '25

Hello, I wanted to know if there is any way to configure the DHCP server to send DDNS updates to a Bind9 server, similar to how Kea updates the forward and reverse zones. I am testing the DHCP server function and it is easier to configure than Kea — with medium-complexity configurations, Kea already requires a large JSON file — so I am looking into this alternative. Thank you.

2 2

RadSec | Status-Server Support
by Cyrus Humphreville 02 Aug '25

02 Aug '25

Hi All! Does RadSec support Status-Server (I only see reference to UDP in RFC 5997)? In RFC 6614 for RadSec, however, I do see reference to Status-Server, but in practice, we can't seem to get it to work (probably PEBKAC). NAS (standalone Aruba AP) --> FreeRADIUS Proxy (macOS) --> Nginx VIP (TCP 2083) --> FreeRADIUS Servers (RHEL 9) The NAS sends RADIUS via UDP to the proxy, which then proxies it to TCP for RadSec. We were expecting the proxy itself to send Status-Server requests to the FreeRADIUS VIP, but it doesn't seem to do so, and we don't see any Status-Server attempts when the proxy is in debug. Many thanks in advance for any guidance!

2 1

Prevent FreeRADIUS from Writing to radpostauth Table
by Mike Diggins 31 Jul '25

31 Jul '25

I'm running FreeRADIUS 3 on Red Hat Linux with a MySQL backend. I want FreeRADIUS to only read from the database-no writes-since I'm syncing it to another server for redundancy and using a separate interface to manage user accounts. Everything works, but I see Access-Accept and Access-Reject entries being written to radpostauth. How can I stop this? -Mike

2 1

Unsure of linelog configuration
by David Lake 31 Jul '25

31 Jul '25

Hi I am trying to see all DHCP interactions (allocated, ack, remove, etc) and I have configured linelog. Radiusd -X shows all DHCP (lease time set to 7200 so I see an ACK every 2 hours). But my line log is only showing the first successful allocate. I have obviously mis-understood the syntax and positioning of linelog because it is basically working but not as I expected. Would welcome a pointer or two? I have this (and nothing else) in my linelog file: linelog linelog_dhcp{ filename = ${logdir}/dhcp.log escape_filenames = no permissions = 0600 format = "%t %{control:Module-Success-Message}" } … and this in my dhcp file: server dhcp { listen { # This is a dhcp socket. type = dhcp ipaddr = 192.168.1.1 src_ipaddr = 192.168.1.1 reply:DHCP-DHCP-Server-Identifier port = 67 interface = eth0 broadcast = no performance { skip_duplicate_checks = no } } dhcp DHCP-Discover { # The DHCP Server Identifier is set here since is returned in OFFERs update control { &DHCP-DHCP-Server-Identifier = 192.168.1.1 } dhcp_network dhcp_sqlippool linelog_dhcp update reply { DHCP-Message-Type = DHCP-Offer Packet-Dst-Port = 68 } } dhcp DHCP-Request { update control { &DHCP-DHCP-Server-Identifier = 192.168.1.1 } if (&request:DHCP-DHCP-Server-Identifier && \ &request:DHCP-DHCP-Server-Identifier != &control:DHCP-DHCP-Server-Identifier) { do_not_respond } update reply { &DHCP-Message-Type = DHCP-Ack Packet-Dst-Port = 68 } root@FreeRadius:/usr/local/etc/raddb/sites-enabled# cat dhcp # -*- text -*- server dhcp { listen { # This is a dhcp socket. type = dhcp ipaddr = 192.168.1.1 src_ipaddr = 192.168.1.1 reply:DHCP-DHCP-Server-Identifier port = 67 interface = eth0 broadcast = no performance { skip_duplicate_checks = no } } dhcp DHCP-Discover { # The DHCP Server Identifier is set here since is returned in OFFERs update control { &DHCP-DHCP-Server-Identifier = 192.168.1.1 } dhcp_network dhcp_sqlippool linelog_dhcp update reply { DHCP-Message-Type = DHCP-Offer Packet-Dst-Port = 68 } } dhcp DHCP-Request { update control { &DHCP-DHCP-Server-Identifier = 192.168.1.1 } if (&request:DHCP-DHCP-Server-Identifier && \ &request:DHCP-DHCP-Server-Identifier != &control:DHCP-DHCP-Server-Identifier) { do_not_respond } update reply { &DHCP-Message-Type = DHCP-Ack Packet-Dst-Port = 68 } dhcp_network dhcp_sqlippool_request linelog_dhcp } dhcp DHCP-Decline { dhcp_network update reply { &DHCP-Message-Type = DHCP-Do-Not-Respond } reject linelog_dhcp } dhcp DHCP-Inform { dhcp_network linelog_dhcp ok } # # For Windows 7 boxes # dhcp DHCP-Inform { update reply { Packet-Dst-Port = 68 DHCP-Message-Type = DHCP-ACK DHCP-DHCP-Server-Identifier = "%{Packet-Dst-IP-Address}" DHCP-Site-specific-28 = 0x0a00 } linelog_dhcp ok } dhcp DHCP-Release { dhcp_network update reply { &DHCP-Message-Type = DHCP-Do-Not-Respond } reject linelog_dhcp } dhcp DHCP-Lease-Query { if (&DHCP-Client-Hardware-Address) { } elsif (&DHCP-Your-IP-Address) { } elsif (&DHCP-Client-Identifier) { } else { update reply { &DHCP-Message-Type = DHCP-Lease-Unknown } ok return } if (notfound) { update reply { &DHCP-Message-Type = DHCP-Lease-Unknown } ok return } update reply { &DHCP-Message-Type = DHCP-Lease-Unassigned } linelog_dhcp } } Thank you David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

2 6