- Freeradius-Users - lists.freeradius.org

FTP Site will be going away
by Alan DeKok 22 May '25

22 May '25

This is advance notice that the FreeRADIUS anonymous FTP service (ftp.freeradius.org) will be discontinued on Thursday 19th June. The same contents will continue to be served over HTTPS on the www.freeradius.org website https://www.freeradius.org/ftp/ <https://www.freeradius.org/ftp> Please ensure that you update any automation that currently uses the FTP service to instead fetch assets from the HTTPS website, which is secure, highly-available and is backed by a CDN. Alan DeKok.

1 0

Can Post-Auth-Type REJECT log LDAP user not found
by thomas 19 May '25

19 May '25

Hello everyone, I have setup up a FreeRADIUS server with EAP-TTLS/PAP and OpenLDAP, the setup works fine. I have a question regarding Post-Auth-Type REJECT, it correctly logs Login incorrect, but the &Module-Failure-Message is ambiguous for our needs when it comes to troubleshooting. I get the following log if a user types their username incorrectly : `Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [johndo(a)lab.local] (from client localhost port 0 via TLS tunnel)` Is it possible to log something along the lines of "LDAP user not found" without making custom loglines? I believe this was possible on FreeRADIUS 2.x.x. You can find the debug info below. Thanks in advance ! --Thomas (5) Received Access-Request Id 5 from 127.0.0.1:47099 to 127.0.0.1:1812 length 229 (5) User-Name = "anonymous(a)lab.local" (5) NAS-IP-Address = 127.0.0.1 (5) Calling-Station-Id = "02-00-00-00-00-01" (5) Framed-MTU = 1400 (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) Connect-Info = "CONNECT 11Mbps 802.11b" (5) EAP-Message = 0x02b2005315001703030048688da1ee57de5c653ec5b3ddb3fddaf954b25a2814726949f8960b9c81902198bf3054cc85cee621707608ab4bb4fecdd2dd6c1c55b33338264afb10435abffeb1198b43490adde2 (5) State = 0x5cf4dd435846c8abb4f3a6e2030e9f16 (5) Message-Authenticator = 0x161a97e6923da68704ab1e2c3048d6af (5) Restoring &session-state (5) &session-state:Framed-MTU = 1004 (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (5) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (5) &session-state:TLS-Session-Version = "TLS 1.2" (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) if !("%{User-Name}" =~ /(a)lab.local$/) { (5) EXPAND %{User-Name} (5) --> anonymous(a)lab.local (5) if !("%{User-Name}" =~ /(a)lab.local$/) -> FALSE (5) suffix: Checking for suffix after "@" (5) suffix: Looking up realm "lab.local" for User-Name = "anonymous(a)lab.local" (5) suffix: Found realm "lab.local" (5) suffix: Adding Realm = "lab.local" (5) suffix: Authentication realm is LOCAL (5) [suffix] = ok (5) eap: Peer sent EAP Response (code 2) ID 178 length 83 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x5cf4dd435846c8ab (5) eap: Finished EAP session with state 0x5cf4dd435846c8ab (5) eap: Previous EAP request found for state 0x5cf4dd435846c8ab, released from the list (5) eap: Peer sent packet with method EAP TTLS (21) (5) eap: Calling submodule eap_ttls to process data (5) eap_ttls: Authenticate (5) eap_ttls: (TLS) EAP Done initial handshake (5) eap_ttls: Session established. Proceeding to decode tunneled attributes (5) eap_ttls: Got tunneled request (5) eap_ttls: User-Name = "johndo(a)lab.local" (5) eap_ttls: User-Password = "johndoe" (5) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (5) eap_ttls: Sending tunneled request (5) Virtual server inner-tunnel received request (5) User-Name = "johndo(a)lab.local" (5) User-Password = "johndoe" (5) FreeRADIUS-Proxied-To = 127.0.0.1 (5) server inner-tunnel { (5) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) suffix: Checking for suffix after "@" (5) suffix: Looking up realm "lab.local" for User-Name = "johndo(a)lab.local" (5) suffix: Found realm "lab.local" (5) suffix: Adding Realm = "lab.local" (5) suffix: Authentication realm is LOCAL (5) [suffix] = ok (5) update control { (5) &Proxy-To-Realm := LOCAL (5) } # update control = noop (5) eap: No EAP-Message, not doing EAP (5) [eap] = noop (5) [expiration] = noop (5) [logintime] = noop rlm_ldap (ldap): Reserved connection (0) (5) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (5) ldap: --> (uid=johndo(a)lab.local) (5) ldap: Performing search in "o=univ,dc=lab,dc=local" with filter "(uid=johndo(a)lab.local)", scope "sub" (5) ldap: Waiting for search result... (5) ldap: Search returned no results rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.lab.local:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (5) [ldap] = notfound (5) } # authorize = ok (5) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> johndo(a)lab.local (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) update outer.session-state { (5) &Module-Failure-Message := &request:Module-Failure-Message -> 'No Auth-Type found: rejecting the user via Post-Auth-Type = Reject' (5) } # update outer.session-state = noop (5) } # Post-Auth-Type REJECT = updated (5) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [johndo(a)lab.local] (from client localhost port 0 via TLS tunnel) (5) } # server inner-tunnel (5) Virtual server sending reply (5) eap_ttls: Got tunneled Access-Reject (5) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (5) eap: Sending EAP Failure (code 4) ID 178 length 4 (5) eap: Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> anonymous(a)lab.local (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) policy remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) { (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else { (5) [noop] = noop (5) } # else = noop (5) } # policy remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Login incorrect (eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [anonymous(a)lab.local] (from client localhost port 0 cli 02-00-00-00-00-01) (5) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (5) Sending delayed response (5) Sent Access-Reject Id 5 from 127.0.0.1:1812 to 127.0.0.1:47099 length 44 (5) EAP-Message = 0x04b20004 (5) Message-Authenticator = 0x00000000000000000000000000000000

2 1

Feature request about rlm_rest
by Bino Oetomo 18 May '25

18 May '25

This is not an Issue. It's more to a feature request , specially about rlm_rest. Currently I Always use 'POST' method with JSON body. I did this because my FreeRadius installation need to serve different kind of Radius client, that each client send different set of attribute. For example a single Mikrotik router that act as a VPN server and A Captive portal (they name it "hotspot". Each of it sent different set of attribute. my only concern is that a creating a http backend that handle a post request need to allow XSRF at first and make a second step to validate if request come from allowed host. So I think it'll be great if rlm_rest have an option that use GET method that encode all attributes as query parameters. Thats all My salute to all FreeRadius developers and contributors

2 1

aws-nlb “status” virtual-server ⇒ “Failed inserting TCP socket into parent list / max_connections (16)”
by Pavels Veretennikovs 17 May '25

17 May '25

Hello list, WHAT / WHY ---------- I am running FreeRADIUS 3.2.7 (official docker image) behind an AWS Network Load Balancer. The NLB performs a TCP health-check against the "status" virtual-server on port 8000 every 10 seconds. After ±16 probes the server starts logging: Failed inserting TCP socket into parent list. Ignoring new connection due to client max_connections (16) Health checks continue to be successful (because they are just TCP, I assume). SET-UP ------ Can be reproduced on following Dockerfile: FROM freeradius/freeradius-server:3.2.7 RUN cp /etc/freeradius/sites-available/aws-nlb /etc/freeradius/sites-enabled/aws-nlb RUN sed -i 's/192\.0\.2\.1/*/' /etc/freeradius/sites-enabled/aws-nlb EXPOSE 8000/tcp CMD ["-f", "-X"] The only change is wildcard IP on healthcheck server. All other configuration is untouched vanilla 3.2.7. DEBUG LOGS ------ … [initialisation omitted – identical to stock container, including last 2 probes output] … 20:23:49+03:00 Ready to process requests 20:23:50+03:00 ... new connection request on TCP socket 20:23:50+03:00 Failed inserting TCP socket into parent list. <--- THIS ONE 20:23:50+03:00 Listening on status from client (10.88.0.20, 41252) -> (*, 8000, virtual-server=aws-nlb) 20:23:50+03:00 Waking up in 0.8 seconds. 20:23:50+03:00 Client has closed connection 20:23:50+03:00 ... shutting down socket status from client (10.88.0.20, 41252) -> (*, 8000, virtual-server=aws-nlb) 20:23:50+03:00 Ready to process requests 20:23:51+03:00 ... new connection request on TCP socket 20:23:51+03:00 Failed inserting TCP socket into parent list. 20:23:51+03:00 Listening on status from client (10.88.0.20, 41254) -> (*, 8000, virtual-server=aws-nlb) 20:23:51+03:00 Waking up in 0.7 seconds. 20:23:51+03:00 Client has closed connection 20:23:51+03:00 ... shutting down socket status from client (10.88.0.20, 41254) -> (*, 8000, virtual-server=aws-nlb) 20:23:51+03:00 Ready to process requests 20:23:52+03:00 ... new connection request on TCP socket 20:23:52+03:00 Ignoring new connection due to client max_connections (16) <--- AND THIS ONE 20:23:52+03:00 Ready to process requests 20:23:53+03:00 ... new connection request on TCP socket 20:23:53+03:00 Ignoring new connection due to client max_connections (16) 20:23:53+03:00 Ready to process requests QUESTIONS --------- How harmful is this? And I doing something wrong? Can this be fixed? Thanks in advance for any insight. Happy to provide an untrimmed **radiusd -X** log or additional details if required. Best regards, — Pavels

1 0

detail log permissions warning
by BuzzSaw Code 17 May '25

17 May '25

I'm getting this error in the logs when a COA packet is being processed by the coa-relay server: File /var/log/radius/radacct/detail_coa permissions are 0640 (rw-r-----) not 0660 (rw-rw----)) The configuration for that detail log is: detail detail_coa { permissions = 0660 group = ${security.group} filename = ${radacctdir}/detail_coa escape_filenames = no header = "%t" locking = yes } Is that permission setting possibly being affected by the system umask ? It seems to work, but throws that error regardless.

2 1

Help with Radius Tech Change
by Leonardo Gotardo Araujo 13 May '25

13 May '25

Hi, could you share this message to the community? Thanks in advance, have a great day "Hello everyone, I work at a telecommunications company, and we are planning to migrate our RADIUS service to another RADIUS Tech, though we haven't decided yet which one to migrate to. We are looking for someone with experience in FreeRADIUS who can assist us with this process. If you're interested, please get in touch so we can discuss the details and associated costs. Thank you in advance for your attention."

1 0

Matching multiple realms in post-proxy with single configuration
by Dominic ＠ Bluewin 12 May '25

12 May '25

Hi guys Short question, which I wasn‘t able to extract out of documentation or the source on github. When I would like to match a single realm configuration in post-proxy for multiple realms like this: @ABC.COM @STUDENT.ABC.COM Do I have to configure each realm exact matching and add the RADIUS attribute configuration multiple times? Or can I use a wildcard? I tested with *ABC.COM and REGEX wildcarding, but that did not work. Or do I have to work with the fall-through option? Thanks and regards Dominic Von meinem iPhone gesendet...

2 1

Way to verify RADIUS status-server of proxy server over RadSec / TLS
by Dominic Stalder 09 May '25

09 May '25

Hi guys Recently, we migrated some of our RADIUS proxy servers from RADIUS (UDP) to RadSec (TCP) and I would like to still be able to monitor the upstream proxy servers. When we were still using RADIUS (UDP), I was able to send a status-server RADIUS message to the upstream server directly, like this and report that back to PRTG (our monitoring tool): echo 'Message-Authenticator = 0x00' | radclient -x 1.2.3.4 status secret Now I would like to achieve something similar, after we migrated the proxy server 1.2.3.4 to TLS only. My initial try was to setup something like this: 1. start a local socat listener on port UDP/11812 and tunnel it to socat -v OPENSSL:1.2.3.4:2083,cert=/etc/freeradius/certs/radsec.pem,key=/etc/freeradius/certs/radsec.key,cafile=/etc/freeradius/certs/edupki-root-ca-cert.pem,verify=0 UDP-RECV:11812 2. send a standard RADIUS (UDP) status-server packet to the localhost port UDP/11812: echo 'Message-Authenticator = 0x00' | radclient -x localhost:11812 status radsec -t 1 3. unfortunately, this isn’t straight forward: You’re trying to receive UDP packets on port 11812 and send them via TLS/TCP using socat. That conceptually makes sense — it’s what RADIUS-over-TLS (RadSec) does — but unfortunately, RADIUS over TLS is not just “UDP in TLS over TCP”. RadSec uses a specific framing: each RADIUS packet must be prefixed with a 2-byte length field when encapsulated over TCP/TLS (per RFC 6614). Based on the documentation of radclient, it does not support RadSEC / TLS natively. And no, I don’t know, how to implement it… Does anybody have an idea, how to implement a simple RadSec / TLS status-server test, maybe with a „workaround“ or a detour over the FreeRADIUS configuration? Regards Dominic

3 4

freeradius confuses switch
by Christoph Egger 09 May '25

09 May '25

Hello, In tcpdump I see the radius packets in the following order: switch -> freeradius: access-request (1), id: 0x2d freeradius -> switch: access-reject (3), id: 0x2d freeradius -> switch: access-accept (2), id: 0x2c In the last packet the switch receives all proper vlan attributes. In the tplink switch CLI I see it does *not* change the port state from unauthorized to authorized. Upgrading the switch to latest firmware did not change anything. I am not sure is the switch working correctly because of the access-reject package? Regards, Christoph

3 7

password not present in ttls inner-tunnel
by Evan Sharp 07 May '25

07 May '25

Hi list, I'm having difficulty understanding why &User-Password is not being found by my inner-tunnel virtual server. Desired outcome is EAP-TTLS/PAP for google's LDAP. New install of freeRADIUS 3.2.7. In my debug output, I see that the conditional check that would specify ldap as the Auth-Type is not passing. [eap setup success] [ttls setup success] ... (5) if (&User-Password && !control:Auth-Type) { (5) if (&User-Password && !control:Auth-Type) -> FALSE (5) } # authorize = updated (5) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (5) Failed to authenticate the user [post-auth-reject] I believe this check is the one in my customized module config "ldap-google" if (&User-Password && !control:Auth-Type) { update { &control:Auth-Type := ldap } Ok, so &User-password isn't found. Why not? The eap config looks like: eap{ default_eap_type = ttls ... ttls { copy_request_to_tunnel = yes virtual_server = "google-ldap" Does copy_request_to_tunnel not put the password into the tunnel as &User-Password ? Thanks, Evan

2 3