- Freeradius-Users - lists.freeradius.org

freeradius for ubuntu 22.04
by SIMON BABY 24 Apr '25

24 Apr '25

Hello Team, I am looking to set up a freeradius server on my ubuntu 22.04 and the sample test certs for server and client for testing wired 802.1x authentication. Can someone please help. Regards Simon

1 0

Not able to block a specific TLS1.3 cipher
by Akhil Pillai 24 Apr '25

24 Apr '25

Hello All, I have been trying to use only a specific tls1.3 cipher but it fails. I want to use only SHA256. Below is the debug out. root@WIFI_TLS1:~# vi /etc/freeradius3/mods-enabled/eap root@WIFI_TLS1:~# radiusd -Xf FreeRADIUS Version 3.2.5 Copyright (C) 1999-2023 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius3/dictionary including dictionary file /etc/freeradius3/dictionary including configuration file /etc/freeradius3/radiusd.conf including configuration file /etc/freeradius3/clients.conf including files in directory /etc/freeradius3/mods-enabled/ including configuration file /etc/freeradius3/mods-enabled/eap including configuration file /etc/freeradius3/mods-enabled/pap including configuration file /etc/freeradius3/mods-enabled/preprocess including configuration file /etc/freeradius3/mods-enabled/chap including configuration file /etc/freeradius3/mods-enabled/exec including configuration file /etc/freeradius3/mods-enabled/expr including configuration file /etc/freeradius3/mods-enabled/unix including configuration file /etc/freeradius3/mods-enabled/radutmp including configuration file /etc/freeradius3/mods-enabled/attr_filter including configuration file /etc/freeradius3/mods-enabled/mschap including configuration file /etc/freeradius3/mods-enabled/logintime including configuration file /etc/freeradius3/mods-enabled/passwd including configuration file /etc/freeradius3/mods-enabled/files including configuration file /etc/freeradius3/mods-enabled/realm including configuration file /etc/freeradius3/mods-enabled/sradutmp including configuration file /etc/freeradius3/mods-enabled/always including configuration file /etc/freeradius3/mods-enabled/detail including configuration file /etc/freeradius3/mods-enabled/digest including configuration file /etc/freeradius3/mods-enabled/expiration including files in directory /etc/freeradius3/policy.d/ including configuration file /etc/freeradius3/policy.d/eap including configuration file /etc/freeradius3/policy.d/accounting including configuration file /etc/freeradius3/policy.d/filter including files in directory /etc/freeradius3/sites-enabled/ including configuration file /etc/freeradius3/sites-enabled/default including configuration file /etc/freeradius3/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius3" radacctdir = "/var/db/radacct" hostname_lookups = no max_request_time = 30 proxy_dedup_window = 1 cleanup_delay = 5 max_requests = 16384 max_fds = 512 postauth_client_lost = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes require_message_authenticator = "auto" limit_proxy_state = "auto" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client abc81 { ipaddr = 192.168.1.81 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client abc83 { ipaddr = 192.168.1.83 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client abcnet { ipaddr = 192.168.1.0/24 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client abcBL020 { ipaddr = 192.168.1.20 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client abcBL002 { ipaddr = 192.168.1.92 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client abcBL016 { ipaddr = 192.168.1.96 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client abcnet { ipaddr = 172.27.70.0/24 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client abcnet { ipaddr = 172.27.80.0/24 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipv4addr = * require_message_authenticator = "no" secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client routertest { ipaddr = 172.27.70.15 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = eap # Creating Autz-Type = New-TLS-Connection # Creating Auth-Type = mschap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius3/mods-enabled/eap eap { default_eap_type = "tls" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 dedup_key = "" } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius3/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius3/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius3/mods-config/preprocess/huntgroups" hints = "/etc/freeradius3/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius3/mods-enabled/chap # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius3/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius3/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius3/mods-enabled/unix unix { radwtmp = "/var/log/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius3/mods-enabled/radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius3/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius3/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius3/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius3/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius3/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius3/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius3/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius3/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius3/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius3/mods-enabled/files files { filename = "/etc/freeradius3/mods-config/files/authorize" acctusersfile = "/etc/freeradius3/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius3/mods-config/files/pre-proxy" } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius3/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius3/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius3/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius3/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius3/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loading module "sradutmp" from file /etc/freeradius3/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius3/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius3/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius3/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius3/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius3/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius3/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius3/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius3/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius3/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius3/mods-enabled/detail detail { filename = "/var/db/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius3/mods-enabled/digest # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius3/mods-enabled/expiration instantiate { } # Instantiating module "eap" from file /etc/freeradius3/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius3/certs" pem_file_type = yes private_key_file = "/etc/freeradius3/certs/hostapd.server.prv" certificate_file = "/etc/freeradius3/certs/hostapd.server.pem" ca_file = "/etc/freeradius3/certs/hostapd.ca.pem" private_key_password = <<< secret >>> fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "TLS_AES_128_GCM_SHA256" cipher_server_preference = yes reject_unknown_intermediate_ca = no ecdh_curve = "" tls_max_version = "1.3" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } tls: (TLS) Failed setting cipher list: error:0A0000B9:SSL routines::no cipher match rlm_eap_tls: Failed initializing SSL context rlm_eap (EAP): Failed to initialise rlm_eap_tls /etc/freeradius3/mods-enabled/eap[14]: Instantiation failed for module "eap" Any idea why this fails?

2 5

RADsec (TLS) based communication from Cisco Wireless Controllers to FreeRadius
by Thorsten Fritsch 24 Apr '25

24 Apr '25

Dear colleagues, we plan to implement RADsec for secure TLS-based communication between our Cisco 9800-80 Wireless Controller and our FreeRadius 3.x server to enhance security both for management access to the wireless controllers and for our wifi clients using 802.1x based SSIDs (including Identity PSK which does rely on the AAA servers as well). Does anyone already have such a setup in place ? What has been your experience in implanting it ? We'd be very interested in your feedback how it worked. Thanks and best regards, Thorsten Thorsten Fritsch | Network Engineer University of Basel | Direktion Infrastruktur & Betrieb | IT Services Spitalstrasse 41 | 4056 Basel | Switzerland Tel. +41 61 207 16 07 | Mobil +41 79 720 8150 Mail: Thorsten.fritsch(a)unibas.ch<mailto:Thorsten.fritsch@unibas.ch> | https://www.unibas.ch<https://www.unibas.ch/> Work Days: Mo. through Friday except on Wednesdays This e-mail and any attachments to it may contain confidential information, which is for the sole attention and use of the intended recipient. If you are not the correct addressee or have received this email in error, please notify us immediately and delete this email. Copying and forwarding this message without consent of the sender is not permitted.

1 0

Cisco Console Port Help
by Timothy M Butterworth 22 Apr '25

22 Apr '25

Hello, I have the following configuration and I am having an issue. Logging into a VTY line through SSH takes me immediately to enable privileged mode login. Logging into Console takes me to a non-privileged mode login and I have to enter the Enable Secret Password. How do I get the console to take me immediately to enable privileged mode login? ### Free RADIUS Configuration sudo vim /etc/freeradius/3.0/clients.conf client 10.0.0.0/8 { secret = REMOVED nastype = cisco shortname = Butter.net } ### FreeRADIUS User Config sudo vim /etc/freeradius/3.0/users tmb Cleartext-Password := "REMOVED" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" # FreeRADIUS group config DEFAULT Group == "cisco-rw" Service-Type = NAS-Prompt-User, Cisco-AVPair == 'shell:priv-lvl=15', User-Name = tmb Thanks Tim -- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/ ⠈⠳⣄⠀⠀

4 3

TLS Client Certificate Attributes with proxy
by jhbulk75 22 Apr '25

22 Apr '25

We use the rest module to call our backend server during post-auth for additional processing. When the request is locally terminated EAP-TLS, the request attribute list contains all of the TLS certificate attributes. We have a feature request that requires access to one of these TLS client cert attributes in post-auth (TLS-Client-Cert-Subject-Alt-Name-Uri). When the request is proxied this information is not available in post-auth. Does this mean it's not possible to see this data in a proxy configuration? Or does FreeRADIUS just not provide it because the eap module was not called. In other words, in lieu of FR not providing this for us, could EAP-Message be parsed to manually extract this data? Or is the information simply not there? We're trying to determine if this is still a viable option in a proxy environment. Thanks for any insights.

2 1

query on hostapd
by SIMON BABY 22 Apr '25

22 Apr '25

Hello Team, Do we have to enable anything in the bridge interface in Linux for processing EAPOL packets ? Currently the bridge in my setup cannot detect EAPOL packets. However the DSA lan ports are able to detect. The bridge interface contains the lan ports. Regards Simon

3 8

Bash automation for FreeRADIUS
by Travis Bean 21 Apr '25

21 Apr '25

Hello, I developed a Bash script to automate the installation and configuration of open-source software (i.e., launchpad.net/linuxha) I want to make sure the syntax of this script is perfect so I can use it as a teaching tool to educate people about Linux. I need to know if there is anything misconfigured with my FreeRADIUS syntax. If you find a bug in LinuxHA, please submit a bug report to bugs.launchpad.net/linuxha/+filebug. Kind regards, Travis Bean

1 0

Requesting guidance to understand all moving parts for RadSec + EAP-TLS
by Yoann Gini 20 Apr '25

20 Apr '25

Hello, As said on the other thread, I’m trying to use RadSec to provide EAP-TLS authentication for remote site. I’m mainly a NPS user during last years, it’s been a while since I haven’t used Freeradius. I’m a little bit lost in the set of configuration to do here, especially since some parts seems redundant between RadSec and EAP-TLS. Especially, I will have different intermediate certificates authority to authenticate access points on one side and wireless client on the other. Also, the configuration for EAP-TLS will need to be PKI based only (authenticate and authorize if certificate based authentication works and if the certificate is not revoked). No per-user authorization expected, and the FreeRadius server is expected to not know the list of valid users, solely relying on PKI for that. So if someone can lead me to a clean article about the use of RadSec + EAP-TLS in FreeRadius, or if someone can take the time to explain it to me, I’m really interested. Thanks a lot

4 8

Converting MAC address formats
by Mike Diggins 19 Apr '25

19 Apr '25

I'm using MAC address authentication against a FreeRADIUS Version 3.0.20 (RHEL8) server. My WLAN controller sends the MAC in the format 2c-7b-a0-2f-bb-f1 but FR seems to convert it to 2c7ba02fbbf1. My SQL database has the MACs in the 2c-7b-a0-2f-bb-f1 format. I added this to sites-enabled/default in the authorize section. I've tried many formats but can't seem to get it right. Can it be fixed or am I crazy and should just update the database with the expected format? # Check if User-Name is a MAC address in the correct format if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) { update request { # Convert to lowercase (optional) Tmp-String-0 := "%{tolower:%{User-Name}}" # Remove non-alphanumeric characters (colons, dashes) using expr Tmp-String-1 := "%{expr:%{Tmp-String-0}:s/[-:]//g}" # Assign cleaned MAC address to User-Name User-Name := "%{Tmp-String-1}" } } The debug output is: (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "2c7ba02fbbf1", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) { (0) EXPAND %{User-Name} (0) --> 2c7ba02fbbf1 (0) if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) -> TRUE (0) if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) { (0) update request { (0) EXPAND %{tolower:%{User-Name}} (0) --> 2c7ba02fbbf1 (0) Tmp-String-0 := 2c7ba02fbbf1 (0) Expected operator at "c7ba02fbbf1:s/[-:]//g" (0) EXPAND %{expr:%{Tmp-String-0}:s/[-:]//g} (0) --> (0) Tmp-String-1 := (0) EXPAND %{Tmp-String-1} (0) --> (0) User-Name := (0) } # update request = noop (0) } # if ("%{User-Name}" =~ /^([0-9A-Fa-f:-]{12,17})$/) = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} -Mike

2 1

Advanced usage of Radsec and PKI integration?
by Yoann Gini 18 Apr '25

18 Apr '25

Hello, I’m looking at the following Radsec documentation for FreeRadius and I’m lacking some details, maybe someone here can share some guidance? https://www.freeradius.org/documentation/freeradius-server/3.2.8/howto/prot… My goal here is to simplify the use of FreeRadius by solely relying on Certificate Based Authentication for the client, and so, finding a way to configure FreeRadius to accept all client, regardless of their IP, if they can authenticate with a certificate coming from a specific PKI and that is currently not revoked in the PKI’s CRL. My goal here is to easily provide Cloud Radius for remote network who might by on non static IP address or behind CG-NAT. Best regards Yoann

2 1