- Freeradius-Users - lists.freeradius.org

detail log permissions warning
by BuzzSaw Code 17 May '25

17 May '25

I'm getting this error in the logs when a COA packet is being processed by the coa-relay server: File /var/log/radius/radacct/detail_coa permissions are 0640 (rw-r-----) not 0660 (rw-rw----)) The configuration for that detail log is: detail detail_coa { permissions = 0660 group = ${security.group} filename = ${radacctdir}/detail_coa escape_filenames = no header = "%t" locking = yes } Is that permission setting possibly being affected by the system umask ? It seems to work, but throws that error regardless.

2 1

Help with Radius Tech Change
by Leonardo Gotardo Araujo 13 May '25

13 May '25

Hi, could you share this message to the community? Thanks in advance, have a great day "Hello everyone, I work at a telecommunications company, and we are planning to migrate our RADIUS service to another RADIUS Tech, though we haven't decided yet which one to migrate to. We are looking for someone with experience in FreeRADIUS who can assist us with this process. If you're interested, please get in touch so we can discuss the details and associated costs. Thank you in advance for your attention."

1 0

Matching multiple realms in post-proxy with single configuration
by Dominic ＠ Bluewin 12 May '25

12 May '25

Hi guys Short question, which I wasn‘t able to extract out of documentation or the source on github. When I would like to match a single realm configuration in post-proxy for multiple realms like this: @ABC.COM @STUDENT.ABC.COM Do I have to configure each realm exact matching and add the RADIUS attribute configuration multiple times? Or can I use a wildcard? I tested with *ABC.COM and REGEX wildcarding, but that did not work. Or do I have to work with the fall-through option? Thanks and regards Dominic Von meinem iPhone gesendet...

2 1

Way to verify RADIUS status-server of proxy server over RadSec / TLS
by Dominic Stalder 09 May '25

09 May '25

Hi guys Recently, we migrated some of our RADIUS proxy servers from RADIUS (UDP) to RadSec (TCP) and I would like to still be able to monitor the upstream proxy servers. When we were still using RADIUS (UDP), I was able to send a status-server RADIUS message to the upstream server directly, like this and report that back to PRTG (our monitoring tool): echo 'Message-Authenticator = 0x00' | radclient -x 1.2.3.4 status secret Now I would like to achieve something similar, after we migrated the proxy server 1.2.3.4 to TLS only. My initial try was to setup something like this: 1. start a local socat listener on port UDP/11812 and tunnel it to socat -v OPENSSL:1.2.3.4:2083,cert=/etc/freeradius/certs/radsec.pem,key=/etc/freeradius/certs/radsec.key,cafile=/etc/freeradius/certs/edupki-root-ca-cert.pem,verify=0 UDP-RECV:11812 2. send a standard RADIUS (UDP) status-server packet to the localhost port UDP/11812: echo 'Message-Authenticator = 0x00' | radclient -x localhost:11812 status radsec -t 1 3. unfortunately, this isn’t straight forward: You’re trying to receive UDP packets on port 11812 and send them via TLS/TCP using socat. That conceptually makes sense — it’s what RADIUS-over-TLS (RadSec) does — but unfortunately, RADIUS over TLS is not just “UDP in TLS over TCP”. RadSec uses a specific framing: each RADIUS packet must be prefixed with a 2-byte length field when encapsulated over TCP/TLS (per RFC 6614). Based on the documentation of radclient, it does not support RadSEC / TLS natively. And no, I don’t know, how to implement it… Does anybody have an idea, how to implement a simple RadSec / TLS status-server test, maybe with a „workaround“ or a detour over the FreeRADIUS configuration? Regards Dominic

3 4

freeradius confuses switch
by Christoph Egger 09 May '25

09 May '25

Hello, In tcpdump I see the radius packets in the following order: switch -> freeradius: access-request (1), id: 0x2d freeradius -> switch: access-reject (3), id: 0x2d freeradius -> switch: access-accept (2), id: 0x2c In the last packet the switch receives all proper vlan attributes. In the tplink switch CLI I see it does *not* change the port state from unauthorized to authorized. Upgrading the switch to latest firmware did not change anything. I am not sure is the switch working correctly because of the access-reject package? Regards, Christoph

3 7

password not present in ttls inner-tunnel
by Evan Sharp 07 May '25

07 May '25

Hi list, I'm having difficulty understanding why &User-Password is not being found by my inner-tunnel virtual server. Desired outcome is EAP-TTLS/PAP for google's LDAP. New install of freeRADIUS 3.2.7. In my debug output, I see that the conditional check that would specify ldap as the Auth-Type is not passing. [eap setup success] [ttls setup success] ... (5) if (&User-Password && !control:Auth-Type) { (5) if (&User-Password && !control:Auth-Type) -> FALSE (5) } # authorize = updated (5) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (5) Failed to authenticate the user [post-auth-reject] I believe this check is the one in my customized module config "ldap-google" if (&User-Password && !control:Auth-Type) { update { &control:Auth-Type := ldap } Ok, so &User-password isn't found. Why not? The eap config looks like: eap{ default_eap_type = ttls ... ttls { copy_request_to_tunnel = yes virtual_server = "google-ldap" Does copy_request_to_tunnel not put the password into the tunnel as &User-Password ? Thanks, Evan

2 3

Inner Tunnel User-Name
by Christoph Egger 07 May '25

07 May '25

Hi, I have configured EAP-TTLS+PAP using sites-enabled/proxy-inner-tunnel. After I get the Access-Accept message, I do dynamic VLAN assignment in sites-enabled/default in the post-auth section. The one thing is: the dynamic VLAN assignment uses the outer User-Name. It works if the outer-tunnel matches the inner-tunnel username. I want to do the dynamic VLAN assignment using the Inner-Tunnel User-Name. Where can I access the inner-tunnel %{request.User-Name} with ulang after the Access-Accept message ? Regards, Christoph

2 5

How to Remove Framed-MTU from Access-Accept in PEAP Authentication
by 早川拓人 06 May '25

06 May '25

Hi! I noticed that when performing PEAP authentication using FreeRADIUS, an unintended "Framed-MTU" attribute is included in the Access-Accept. Could you please advise on how to remove this "Framed-MTU" from the Access-Accept? After some investigation, I found that adding the following code at the beginning of the post-auth section allows for its removal: ========================================================================== sites-enabled/default.in<http://default.in/> ----- post-auth { + if ( &session-state:Framed-MTU ) { + update session-state { + &Framed-MTU !* ANY + } + } ========================================================================== Is this method correct? Additionally, is there a simpler and safer way to remove the "Framed-MTU"? Thank you for your assistance. Please find the debug log below for your reference. Due to email size constraints, I have included an excerpt in the email. For the full log, please refer to the attached FreeRadiusv3_2_7_PEAP_Accept.log. ========================================================================== FreeRADIUS Version 3.2.7 Copyright (C) 1999-2023 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/exec including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/accounting including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (10) Received Access-Request Id 10 from 10.27.51.116:57794 to 10.27.253.187:1812 length 181 (10) User-Name = "testuser" (10) NAS-IP-Address = 127.0.0.1 (10) Calling-Station-Id = "02-00-00-00-00-01" (10) Framed-MTU = 1400 (10) NAS-Port-Type = Wireless-802.11 (10) Service-Type = Framed-User (10) Connect-Info = "CONNECT 11Mbps 802.11b" (10) EAP-Message = 0x02db002e1900170303002310158c7451c89b82dd9648b451912651938c789a7c0457355d16f4c534c4ececc8d968 (10) State = 0xb7ba80b5be61993f874d82a0836e8f2a (10) Message-Authenticator = 0x6fdfa7aec2e249db346658bdd5d27b5b (10) Restoring &session-state (10) &session-state:Framed-MTU = 994 (10) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (10) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (10) &session-state:TLS-Session-Version = "TLS 1.2" (10) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (10) authorize { (10) policy filter_username { (10) if (&User-Name) { (10) if (&User-Name) -> TRUE (10) if (&User-Name) { (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@[^@]*@/ ) { (10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /(a)\./) { (10) if (&User-Name =~ /(a)\./) -> FALSE (10) } # if (&User-Name) = notfound (10) } # policy filter_username = notfound (10) [preprocess] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "testuser", looking up realm NULL (10) suffix: No such realm "NULL" (10) [suffix] = noop (10) eap: Peer sent EAP Response (code 2) ID 219 length 46 (10) eap: Continuing tunnel setup (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = eap (10) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (10) authenticate { (10) eap: Removing EAP session with state 0xb7ba80b5be61993f (10) eap: Previous EAP request found for state 0xb7ba80b5be61993f, released from the list (10) eap: Peer sent packet with method EAP PEAP (25) (10) eap: Calling submodule eap_peap to process data (10) eap_peap: (TLS) EAP Done initial handshake (10) eap_peap: Session established. Decoding tunneled attributes (10) eap_peap: PEAP state send tlv success (10) eap_peap: Received EAP-TLV response (10) eap_peap: Success (10) eap: Sending EAP Success (code 3) ID 219 length 4 (10) eap: Freeing handler (10) [eap] = ok (10) } # authenticate = ok (10) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (10) post-auth { (10) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (10) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (10) update { (10) &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 994 (10) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello' (10) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) PEAP - send TLS 1.2 Handshake, ServerHello' (10) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) PEAP - send TLS 1.2 Handshake, Certificate' (10) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange' (10) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone' (10) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange' (10) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) PEAP - recv TLS 1.2 Handshake, Finished' (10) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) PEAP - send TLS 1.2 ChangeCipherSpec' (10) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) PEAP - send TLS 1.2 Handshake, Finished' (10) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-RSA-AES256-GCM-SHA384' (10) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2' (10) } # update = noop (10) [exec] = noop (10) policy remove_reply_message_if_eap { (10) if (&reply:EAP-Message && &reply:Reply-Message) { (10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (10) else { (10) [noop] = noop (10) } # else = noop (10) } # policy remove_reply_message_if_eap = noop (10) if (EAP-Key-Name && &reply:EAP-Session-Id) { (10) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (10) } # post-auth = noop (10) Sent Access-Accept Id 10 from 10.27.253.187:1812 to 10.27.51.116:57794 length 176 (10) MS-MPPE-Recv-Key = 0x608f9a06f91c5f0e78718d27476ba06fd7f1bcf07327ba08e25eff6a611ac05b (10) MS-MPPE-Send-Key = 0xb34c7fbf7ee95be27291e9949dd47b3cbd9bb9e933ebe2a518adc990d5bf854c (10) EAP-Message = 0x03db0004 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) User-Name = "testuser" (10) Framed-MTU += 994 (10) Finished request Waking up in 4.9 seconds. EXIT(2) CALLED src/main/radiusd.c[792] ==========================================================================

2 2

Accounting drop when authentication
by Ibrahemoo Ghost 03 May '25

03 May '25

I use FreeRADIUS Version 3.0.20 as both proxy and (auth/acct) server. I have more than 200 realms. Every one of them is redirecting to a different site file with a separate sql module but with a shared sql_pool. I recently had a strange problem, every time the system hits 150 auth requests per second accounting packets drop from 1000 req/s to about 200 req/s and the system begins to delay accounting requests and accounting no response log messages arise in connected clients. The system operates normally under heavy load and no stress is visible to me in the sql server. I am using a monitor system and it shows no drop or increase in sql load. During accounting drop the ssd usage drops from 80% to 20%. My radiusd thread pool configuration for 36 cores and 256GB ram and enterprise ssd is: thread pool { start_servers = 60 max_servers = 144 min_spare_servers = 20 max_spare_servers = 60 max_requests_per_server = 0 auto_limit_acct = no } My shared sql_pool around all 200 sql modules is: pool { start = 36 min = 18 max = 72 spare = 36 uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } I have already checked and tuned mysql server to best values and checked the indices for the tables and everything is pretty well configured I am 80% sure the problem is with freeradius configuration because what solve the problem temporarily is restarting freeradius service until it rehits 150 auth req/s and problem rearise. Do you agree with me that the problem is from freeradius or it could be something else and what can I do to solve it ? Thanks in advance Ibrahem

2 3

Some notes on v4
by Alan DeKok 03 May '25

03 May '25

I've pushed some notes on v4 to github: https://github.com/FreeRADIUS/freeradius-server/blob/eb234d6bd979218367e463… As for updates, we're still working on it. The only remaining feature to re-implement in v4 is RADIUS/TLS. Alan DeKok.

1 0