- Freeradius-Users - lists.freeradius.org

tmp directory
by Kat 09 Jul '25

09 Jul '25

Gday, Looking at the documentation in the eap file, I find this: # A temporary directory where the client # certificates are stored. This directory # MUST be owned by the UID of the server, # and MUST not be accessible by any other # users. When the server starts, it will do # "chmod go-rwx" on the directory, for # security reasons. The directory MUST # exist when the server starts. # # You should also delete all of the files # in the directory when the server starts. # # Note that, on Linux systems with systemd, the # /tmp directory may be restricted. In this case # it may be best to use `${run_dir}/tmp` here # and create the temporary directory with the # systemd `RuntimeDirectory` unit option. # # tmpdir = /tmp/radiusd The directory (tmp/radiusd) does not exist in the freeradius docker image, as far as I can tell. 1. Do I need to make that directory for EAP-TLS to work? 2. If question 1 is yes, then is tmp/radiusd created in the root directory? 3. If question 2 is no, where should tmp/radiusd be created? 4. " You should also delete all of the files in the directory when the server starts." Is when before or after or either? So should the files be deleted before starting the server or after the server is started or it doesn't matter? Best regards, Kat -- The OpenPGP_*.asc file attached to this email is a digital certificate to show whether or not this email has been modified after it has been sent. It is a security measure to warn of any man in the middle cyber attack. Your email client should be checking it and warning if any modifications have been made. If you see this signature but not the file, please let me know.

2 1

Help with advanced FreeRADIUS + MySQL setup using EAP-TLS
by Ariel García Reyes 07 Jul '25

07 Jul '25

Hi everyone, I'm working on a FreeRADIUS setup connected to MySQL, and I need help configuring a stricter access validation process. Currently, *EAP-TLS authentication is working* — if a user has a valid certificate, they can connect successfully. However, I want to ensure that *three specific conditions* are met before granting access: 1. ✅ *The EAP-TLS certificate must be valid.* 2. ✅ *The user must exist in the database and be marked as active.* 3. ✅ *The device requesting access (by MAC address) must be registered and associated with that user.* A user may have multiple devices, but *all three conditions* must be satisfied to allow access. Could anyone guide me on how to implement this kind of validation in FreeRADIUS using MySQL? Thanks in advance for any help or examples you can share! -- ________________________________________________ Lic. Ariel García Reyes.

4 4

Tracking request / response packets
by tach yon 07 Jul '25

07 Jul '25

Hi all, Wondering please, does FreeRADIUS use only the packet identifier number to match request / response packets together? Or a combination of things - to further decrease the likelihood of mixing up two packets with matching identifier numbers? If the server is busy, 256 concurrent packets doesn't feel like a lot. I wondered if it might use a combo of packet code + identifier, or something like that, to help keep track of which client a request came from. Hope that makes sense? Thanks in advance for your time and consideration!

2 1

Accounting Tutorial scripts
by tach yon 07 Jul '25

07 Jul '25

Hi hi, I'm working through the tutorial on Accounting - to make sure I've set it properly etc; but I'm struggling to find the shell scripts that are mentioned for generating the test accounting packets. I searched the filesystem for "bob-acct-start.sh" and looked in github, but wasn't able to find them. Would someone be so kind as to point me in the right direction please? Thank you in advance for your time and consideration!

2 2

circled part a must?
by Christoph Egger 30 Jun '25

30 Jun '25

Hello, I configured freeradius 3.2.7. Authentication works for wired clients but not for wireless clients. I have contacted TP-Link for support. After some ping pong with them they finally managed to reproduce the issue. They tried various freeradius versions and report successful authentication with freeradius version 3.0.13. I tried various versions without success. Oldest version I could try is 3.0.16. They would like to know if the circled part shown in the attached screenshot is a must. Regards, Christoph

2 1

Freeradius in Docker
by Kat 30 Jun '25

30 Jun '25

Hi! I would like some data persistence in my Freeradius Docker container so I would like to add a volume of some kind (eg. bind mount) to persist the data. Which folders in the container can I safely choose to do this? I have experienced difficulties with some folders as others also appear to have experience the same thing (https://stackoverflow.com/questions/64105419/how-to-run-freeradius-using-do…) How can I have data persistence with configuration files and certificates? Admittedly I am starting to get a bit tired but I don't think I can find the answer here: https://hub.docker.com/r/freeradius/freeradius-server/ Best regards, Kat

2 1

Thank you, and freeradius mode?
by Kat 30 Jun '25

30 Jun '25

Firstly, 1. Thanks to Alan for letting me know that the freeradius image on Dockerhub does support EAP-TLS. That's very helpful :-) 2. Any by the process of logically writing out my question, I have solved my next problem. 3. Third problem: how can I tell if I have successfully started freeradius in debug mode? freeradius -v does not say which mode it is running in. Despite my attempts to start in debug mode, I suspect it is not in debug mode. This is how the Bob initial test result looks: Sent Access-Request Id 217 from 0.0.0.0:49095 to 127.0.0.1:1812 length 73 User-Name = "bob" User-Password = "test" NAS-IP-Address = 172.17.0.6 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "test" Received Access-Accept Id 217 from 127.0.0.1:1812 to 127.0.0.1:49095 length 38 Message-Authenticator = 0xdf169e01bb4399fada2b31bbde5e7ff3 So is it possible to tell from this whether freeradius is running in debug mode? Thank you! Kat

2 1

New vendor dictionary files - proper process to submit ?
by BuzzSaw Code 27 Jun '25

27 Jun '25

We found that F5 has updated their dictionary at the end of 2024 for some of their newest devices. What is the proper way to provide this so it can be added to future FreeRADIUS releases ? Reference - https://my.f5.com/manage/s/article/K14324 - A pull request on Github with the diff ? - An issue on Github attaching the updated dictionary ? - Have the vendor follow one of the above options so it comes direct from them ? - Something else ?

2 1

Problem with 802.1X and EAP-PEAP configuration
by Peter Sprenger 27 Jun '25

27 Jun '25

Hi, I have problem with 802.1X and after some time I am really desperated: - I am writing an Embedded Ansi C client that already supports EAP-TLS, EAP-TTLS PAP and EAP-TTLS CHAP. Now I thought EAP-PEAP would not be so hard. But with the FreeRadius config I cannot get the outer TLS-tunnel running. The TLS 1.2 connection gets rejected from my SSL library "ASN parsing error, invalid input". For EAP-TLS and EAP-TTLS I have no problem with TLS 1.2 and TLS 1.3 connections. - I tried to work with eapol_test and there is the same picture: EAP-TLS, EAP-TTLS PAP and EAP-TTLS CHAP are working, but for EAP-PEAP the outer TLS connection gets refused. - From ChatGPT I got the info, that TLS 1.3 may cause problems to EAP-PEAP. So I have restricted the client and the FreeRadius server to TLS 1.2. No success. Any help or idea what be very appreciated! Best Regards, Peter

2 1

Unlang policy to remove duplicate attributes from reply?
by tach yon 25 Jun '25

25 Jun '25

Hello, I've spent many hours searching the docs, examples, list posts, etc, plus AI generators - testing as many permutations I can think of - trying to find the correct syntax and method to do this with Unlang, but nothing seems to work 🙁 I'll try to explain in sudo-code what I mean: if (number of Framed-IP-Address attributes > 1) { update control { # Save the first Framed-IP-Address to a temporary String (because I read ipaddr type isn't available). &Tmp-String-0 := &reply:Framed-IP-Address[0] } update reply { # Remove all Framed-IP-Address entries currently in the reply. &Framed-IP-Address !* ANY # Re-create Framed-IP-Address with the first value we saved temporarily. # Cast as ipaddr because Framed-IP-Address needs that data type. &Framed-IP-Address := (ipaddr) &control:Tmp-String-0 } } Everything I've tried is either invalid syntax, or a comma is expected after the cast statement, or freeradius cannot resolve to IP address, or it just doesn't work. It's starting to drive me crazy 🙁 If anyone could please help me understand what I'm doing wrong, it would be very much appreciated. Thank you in advance for your time and consideration!

3 4