- Freeradius-Users - lists.freeradius.org

Freeradius 3.2.x TEAP Support for Machine Only Authentication
by Suriya Shankar 16 Jun '26

16 Jun '26

Hi Alan, With the current EAP-TEAP implementation, we don't have the option to support devices that only want to use Machine Auth. I implemented and tested this on my machine and it works as expected. The changes I made as follows diff --git a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c index b30ab7e3d3..36b2dbdfa3 100644 --- a/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c +++ b/src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c @@ -1217,6 +1217,7 @@ static PW_CODE eap_teap_phase2(REQUEST *request, eap_handler_t *eap_session, { PW_CODE code = PW_CODE_ACCESS_REJECT; rlm_rcode_t rcode; + bool machine_only = false; VALUE_PAIR *tvp; teap_tunnel_t *t = (teap_tunnel_t *)tls_session->opaque; int eap_method = 0; @@ -1253,6 +1254,17 @@ static PW_CODE eap_teap_phase2(REQUEST *request, eap_handler_t *eap_session, RDEBUG("Phase 2: Got tunneled identity of %s", t->username->vp_strvalue); + } else if (tvp && + (tvp->vp_length == EAP_HEADER_LEN + 1) && + (tvp->vp_strvalue[0] == PW_EAP_RESPONSE) && + (tvp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY)) { + /* + * Empty inner EAP-Identity indicates machine-only auth: finish + * with final TEAP Result TLV, then wait for client Result echo. + */ + RDEBUG2("Phase 2: Received empty inner EAP-Identity; treating as machine-only TEAP completion"); + machine_only = true; + } else if (!fake->username) { /* * Don't reject the request outright, @@ -1556,12 +1568,14 @@ done: * Call authentication recursively, which will * do PAP, CHAP, MS-CHAP, etc. */ - rad_virtual_server(fake, true); + if (!machine_only) { + rad_virtual_server(fake, true); + } /* * Decide what to do with the reply. */ - switch (fake->reply->code) { + switch (machine_only ? PW_CODE_ACCESS_CHALLENGE : fake->reply->code) { case 0: tvp = fr_pair_find_by_num(fake->config, PW_RESPONSE_PACKET_TYPE, 0, TAG_ANY); if (tvp && (tvp->vp_integer == PW_CODE_ACCESS_CHALLENGE)) { @@ -1573,6 +1587,15 @@ done: code = PW_CODE_ACCESS_REJECT; break; + case PW_CODE_ACCESS_CHALLENGE: + if (machine_only) { + t->result_final = true; + eap_teap_append_result(request, tls_session, PW_CODE_ACCESS_ACCEPT); + code = PW_CODE_ACCESS_CHALLENGE; + break; + } + /* FALL-THROUGH */ + case PW_CODE_ACCESS_ACCEPT: tvp = fr_pair_find_by_num(fake->packet->vps, PW_EAP_TYPE, 0, TAG_ANY); if (tvp) { *And the logs from my testing * *From the client we received after authenticating the Machine Certificate* Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Session established. Proceeding to decode tunneled attributes Mon Jun 15 22:14:10 2026 : Debug: TEAP tunnel data total 101 TEAP tunnel data in 00: 80 0c 00 4c 00 01 01 21 9a 89 af 0a 7d e6 5d b1 TEAP tunnel data in 10: 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 a3 TEAP tunnel data in 20: 22 3b 6e c8 31 c8 9b e5 00 00 00 00 00 00 00 00 TEAP tunnel data in 30: 00 00 00 00 00 00 00 00 00 00 00 00 b6 0e 4f 32 TEAP tunnel data in 40: 5f ab f5 f7 28 37 3d cd 9e 1c ee 0b 6a ab c8 05 TEAP tunnel data in 50: 80 0a 00 02 00 01 00 02 00 02 00 01 80 09 00 05 TEAP tunnel data in 60: 02 82 00 05 01 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Got Tunneled TEAP TLVs Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Found the pair by TEAP_TLV_IDENTITY copying the value to t->identity Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: FreeRADIUS-EAP-TEAP-Crypto-Binding = 0x000101219a89af0a7de65db1229b2aebad14809a0b721fa4876b65a3223b6ec831c89be50000000000000000000000000000000000000000b60e4f325fabf5f728373dcd9e1cee0b6aabc805 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: FreeRADIUS-EAP-TEAP-Intermediate-Result = Success Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: FreeRADIUS-EAP-TEAP-EAP-Payload = 0x0282000501 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: BUFFER for Compound MAC calculation - hexdump(len=123): 80 0c 00 4c 00 01 01 21 9a 89 af 0a 7d e6 5d b1 22 9b 2a eb ad 14 80 9a 0b 72 1f a4 87 6b 65 a3 22 3b 6e c8 31 c8 9b e5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 37 00 01 00 26 53 5f 39 34 64 65 36 36 65 38 2d 35 35 36 61 2d 34 64 35 36 2d 38 37 38 30 2d 61 31 31 34 36 32 30 61 35 63 34 32 Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: S-IMCK[j] - hexdump(len=40): 68 d4 a1 17 ad bb de f1 4b fb cb 4c 94 71 95 63 60 b2 f7 91 24 c4 6d ca ef 7d c8 13 56 a5 47 d4 b3 fd 0a 0a 18 ad 68 4d Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (MSK) - hexdump(len=64): f3 93 64 e5 bd 76 78 39 ff c6 b6 8f 85 ad 95 ff 56 9e 60 ae 4e c9 51 c1 8b 55 20 5b 4a 59 ec a9 9e 58 9c d8 63 1c 4a b6 f4 3d cb f5 6f 07 14 13 ea 91 ff fb 7c b8 52 89 fd fa 5a f9 b5 ff 3f 9e Mon Jun 15 22:14:10 2026 : Debug: (135) eap_teap: Derived key (EMSK) - hexdump(len=64): 9b e4 9d 86 ff c5 f1 fa f0 16 62 11 ca 09 ed d7 39 6b c0 90 03 22 ac bd d4 6b b9 35 eb 26 5c b9 9f 20 c0 6b f7 a8 ec 5b 7f a7 4e 14 97 86 95 9e de 9f c4 e5 04 dc 85 dd 96 0f 8d 6e 68 27 30 56 02 82 00 05 01 -> Sending the identity packet without any username for the client preferring Machine Only Authentication. *When challenged by Accept as the changes shown in the diff, client accepts the connection* Debug: TEAP tunnel data total 6 TEAP tunnel data in 00: 80 03 00 02 00 01 Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap: Got Tunneled TEAP TLVs Mon Jun 15 22:14:10 2026 : Debug: (136) eap_teap: FreeRADIUS-EAP-TEAP-Result = Success Mon Jun 15 22:14:10 2026 : Debug: (136) eap_S_94de66e8-556a-4d56-8780-a114620a5c42: Sending If you find this good, I would like to raise a PR. If any changes required or if it's not the way as expected, will update it accordingly Thanks, Suriya

2 2

Windows 11 and Session Resumption
by Alan DeKok 15 Jun '26

15 Jun '26

I've attached a file with instructions for how to test session resumption with Windows 11 (Insider preview) and PEAP / TTLS. Until now, session resumption has only been supported in EAP-TLS. This change should make a noticeable difference for the university crowd. The load on the RADIUS server will drop significantly once this feature is available. Please test and report back. It's easier to check things now, rather than trying to work out what's wrong after something gets shipped in an official release. These instructions are direct from Microsoft. There's no ETA on when it will be in Windows 11, but any and all feedback on testing will help to move this forward.

2 3

Upgrading to 3.2.10 Breaks EAP-TLS
by Hector Rodriguez 14 Jun '26

14 Jun '26

Community, After upgrading to the latest and greatest, I have authentication issues again with EAP-TLS. TLS handshake has no issues, but my Windows 11 client does not want to authenticate anymore. Certs were checked, no warning , successful handshakes. Should I revert back 3.2.9 ? Everything worked in the last version, but release notes stated there were memory leak issues. [cid:c71a9768-dc21-43c6-bb02-45e1deeb48a4] Hector Rodriguez Cloud Administrator WestCare Foundation Phone (702) 482 0922 Web westcare.com Email hector.rodriguez(a)westcare.com<mailto:hector.rodriguez@westcare.com> Office 1711 Whitney Mesa, Henderson, NV 89014 [cid:a0282c75-4d2b-465b-a672-a3770b4237b0]<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> Book time to meet with me<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> -- CONFIDENTIALITY NOTICE: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. This communication may contain material protected by HIPAA legislation (45 CFR, Parts 160 & 164) or by 42 CFR Part 2. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is strictly prohibited. If you have received this email in error, please notify the sender by reply email and destroy all copies of the original message.

2 2

Version 3.2.10 and 3.0.28 have been released
by Matthew Newton 08 Jun '26

08 Jun '26

We have released FreeRADIUS versions 3.2.10 (and 3.2.9, ahem), and 3.0.28. These releases contain bug fixes for a number of overflows and memory leaks. Please see the announcement at https://www.freeradius.org/security/ There are also a lot of other updates and improvements. Please see the changelog. We recommend that everyone upgrades to these new versions. Those still on 3.0.x should consider making the move to 3.2.10. There are now few reasons to stay on 3.0. Except for critical security issues, this is likely to be the last release in the 3.0 branch. Packages are not available for 3.0.28 on several newer distributions as it will no longer build - please upgrade to 3.2.10. Download from the usual places: https://www.freeradius.org/releases/ https://www.freeradius.org/ftp/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_10 Pre-built packages for common Linux distributions are available from InkBridge Networks: https://packages.inkbridgenetworks.com/ -- Matthew

5 5

detail listener is broken in the 3.2.9 release
by Bjørn Mork 02 Jun '26

02 Jun '26

I bisected it down to https://github.com/FreeRADIUS/freeradius-server/commit/5691cbc615e515490fc4… It didn't revert cleanly so I looked a bit closer and noticed that it ends up changing if (!request->packet->vps) { .. } else { rcode = 0; } .. return 1; into a more direct if (request->packet->vps) return 0; The problem is obviously that the return value changes from 1 to 0. Simple fix ready for pulling at https://github.com/FreeRADIUS/freeradius-server/pull/5870 (yes, I found this and verified the fix in a real world installation) Bjørn

2 1

Heads-up: Debian/Ubuntu repository update
by Matthew Newton 29 May '26

29 May '26

The metadata on the FreeRADIUS Debian and Ubuntu package repositories is being updated, specifically the Origin and Label fields. The Origin field will change from 'Network RADIUS SARL' to 'InkBridge Networks'. The Label field will change from 'Network RADIUS SARL' to the name of the repository, for example 'freeradius-3.2', 'freeradius-3.0', or 'freeradius-devel-3.2'. apt/apt-get will likely complain about this. To update the repository you may need, as a one-off: apt-get update --allow-releaseinfo-change If you are using apt pinning rules in /etc/apt/preferences.d that match based on these fields then you may also need to update them as well, for example: Package: /freeradius/ Pin: release o=InkBridge Networks,l=freeradius-3.2 Pin-Priority: 999 -- Matthew

1 0

Version 4 rlm_cache and LDAP cacheable_name
by Brian Julin 21 May '26

21 May '26

TLDR: should I be using a different update block in the following for version 4? cache ad-my-ldap-group-cache { driver = "rbtree" key = "%{User-Name}" ttl = 5 add_stats = "no" cacheable_name = "yes" update { control.ad-my-ldap-LDAP-Group := control.ad-my-ldap-LDAP-Group } } ... I ask because it seems that when loading the cache again, it copies the *same* value into multiple elements in the restored attribute, giving me [n] copies of whatever value ended up first in this list. So either something is broken or this is a subtle behavior of := in list assignments conflicting with the special currying of the rhs in this module and I need an alternate operator. (a few values munged to protect internal identfiers) (6.0) ad-my-ldap-group-cache - Found entry for "my.user.name" (6.0) ad-my-ldap-group-cache - Merging cache entry into request (6.0) ad-my-ldap-group-cache - control.ad-my-ldap-LDAP-Group := 'Group1' (6.0) ad-my-ldap-group-cache - control.ad-my-ldap-LDAP-Group := 'Group2' (6.0) ad-my-ldap-group-cache.load (updated) (6.0) if (!control.ad-my-ldap-LDAP-Group) { (6.0) | ! (6.0) | control.ad-my-ldap-LDAP-Group (6.0) | %exists() (6.0) | --> true (6.0) | %unary_not({true}) (6.0) | --> false (6.0) ... (6.0) } (6.0) if ("%{control.ad-my-ldap-LDAP-Group[0]}/%{control.ad-my-ldap-LDAP-Group[1]}/%{control.ad-my-ldap-LDAP-Group[2]}/%{control.ad-my-ldap-LDAP-Group[n]}" == "foo") { (6.0) | control.ad-my-ldap-LDAP-Group[0] (6.0) | control.ad-my-ldap-LDAP-Group[0] (6.0) | --> Group2 (6.0) | control.ad-my-ldap-LDAP-Group[1] (6.0) | --> Group2 (6.0) | control.ad-my-ldap-LDAP-Group[2] (6.0) (null) (6.0) | control.ad-my-ldap-LDAP-Group[n] (6.0) | --> Group2 (6.0) | ({ngt_top/ngt_top//ngt_top} == {foo}) (6.0) | --> false (6.0) ... (6.0) }

1 0

Version 4
by Munroe Sollog 20 May '26

20 May '26

I’ve been trying to follow the FreeRADIUS v4 development process and wanted to ask about the current project status. I haven’t seen much recent activity on the mailing lists, including the developer and announcement lists, and I noticed that the latest tarballs available on freeradius.org/ftp appear to be from 2023. At the same time, it does look like there is still ongoing activity in the GitHub repository. Is there currently a status page, roadmap, or compatibility matrix for v4 that outlines what is considered stable, what is still in progress, and any known limitations or unsupported features? We are considering adding a FreeRADIUS v4 proof-of-concept effort to our project calendar for the next fiscal year, and having a clearer understanding of the current maturity level and known gaps would help us better assess the scope and potential impact of that work. Any guidance or pointers to current documentation would be greatly appreciated. -- Munroe Sollog (He/Him/His) Network Architect munroe(a)lehigh.edu

2 1

Suppress radpostauth password logging with unlang variable reference
by Sam Hutchings 18 May '26

18 May '26

Hi All, PostgreSQL datastore is logging passwords in plain text in the 'radpostauth' table for accepted and rejected requests. This is occurring even when 'auth_goodpass' and 'auth_badpass' are set to 'no' - which this looks to be only relevant to logging to radius.log. I could comment out '-sql' in the 'post-auth' section of the server or amend the queries.conf for sql to remove the password. However, for flexibility/simplicity I have looked into using unlang to suppress the attribute. I would like to use the variable reference from radiusd.conf for auth_goodpass/auth_badpass to control whether the User-Password is suppressed ideally for efficiency. The unlang is as follows in the 'post-auth' section of the default server: if (${log.auth_goodpass}) { -sql } else { suppress { User-Password } -sql } This throws the below error: /etc/freeradius/sites-enabled/default[919]: Parse error in condition /etc/freeradius/sites-enabled/default[919]: (${log.auth_goodpass}) { /etc/freeradius/sites-enabled/default[919]: ^ Expected a module return code I have then attempted to set a variable called 'auth_good' as 'false' in the default server and referenced it as ${.auth_good} instead but encountered the same issue. If anyone has any advice on how to achieve this or where I am going wrong, it would be much appreciated. Kind regards, Sam FreeRADIUS Version 3.2.8 Copyright (C) 1999-2025 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT FreeRADIUS is developed, maintained, and supported by InkBridge Networks. For commercial support, please email sales(a)inkbridgenetworks.com https://inkbridgenetworks.com/ Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/proxy_rate_limit including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/totp including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/postgresql/queries.conf including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/rfc7542 including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default /etc/freeradius/sites-enabled/default[919]: Parse error in condition /etc/freeradius/sites-enabled/default[919]: (${.auth_good}) { /etc/freeradius/sites-enabled/default[919]: ^ Expected a module return code Errors reading or parsing /etc/freeradius/radiusd.conf

2 2

Some modules .so are stripped while others are not
by g4-lisz＠tonarchiv.ch 18 May '26

18 May '26

Hi there, I wonder why some modules are stripped of their text symbols, others are not. For example >nm -D /opt/rad/lib/rlm_rest.so | grep -i " T " gives the expected list for -g cflag. >nm -D /opt/cpr/lib/rlm_realm.so | grep -i " T " doesn't show anything, even when using ./configure --enable-developer How is this configured? I couldn't find the "magic"... Thanks in advance Till

2 5