- Freeradius-Users - lists.freeradius.org

New module - Native .NET policy support for FreeRADIUS
by Chris Knipe 15 May '26

15 May '26

Hi everyone, I'm pleased to announce that I have submitted a new module for FreeRADIUS called rlm_dotnet, which enables writing FreeRADIUS policies and modules in C# and other .NET languages. Pull Request: https://github.com/FreeRADIUS/freeradius-server/pull/5852 rlm_dotnet hosts the Microsoft .NET runtime using hostfxr and allows FreeRADIUS to call managed code directly. This makes it possible to implement FreeRADIUS policies in: - C# - F# - VB.NET - Any other language targeting the .NET runtime The design supports both synchronous and asynchronous policies, and provides strongly typed access to RADIUS requests and replies. - Native integration with the .NET runtime (hostfxr) - Strongly typed request and reply objects - Support for all major FreeRADIUS processing sections - Async/await support using ValueTask - Structured binary request/reply formats (RDb1 / RDr1) - Structured JSON error reporting - Access to native FreeRADIUS logging (radlog) - Per-thread or shared policy instances - Comprehensive XML documentation and examples - Unit tests and smoke tests - Full C# Sdk included A minimal policy can be as simple as: public sealed class MyPolicy : IRadiusPolicy { public (int Rcode, string ReplyPairList) Authorize(RadiusRequest request) => (RlmRcode.Ok, IRadiusPolicy.EmptyReply); } Async policies are also supported for database, HTTP, Redis, LDAP, or other I/O-bound operations. The .NET CLR is shared across all instances initiated by FreeRADIUS, and as such memory is shared across all instances and not destroyed each time FreeRADIUS recycles the process. This makes extensive in-memory usage highly viable and was one of the main reasons why the module was developed (in memory, shared session-db). FreeRADIUS has long supported embedded languages such as Python and Perl. rlm_dotnet brings modern .NET capabilities to the platform, including: - Strong typing - Excellent tooling and debugging - High performance - Rich ecosystem libraries - Modern asynchronous programming This makes it easier for organizations with existing .NET expertise to build custom AAA logic directly within FreeRADIUS. The pull request includes: - Full and comprehensive documentation - Assembly-level XML documentation - A comprehensive ExamplePolicy - Unit tests and smoke tests - Full C# Sdk - Feedback Welcome Thank you to the FreeRADIUS team for building such a powerful and extensible platform. Kind regards, Chris Knipe

2 2

RadGraph - a tool to return VLAN ID and Class attributes based on Entra Groups
by John Cleary 11 May '26

11 May '26

Hi all, First, I have to say THANK-YOU to the whole FreeRADIUS team. I love this product!! :) I hope this is an appropriate place to share this! I’ve been using FreeRADIUS with great success for the past 6 months to do wired and wireless auth for the school network I managed. We’re a Microsoft 365 house, and I’m trying to deprecate on-prem NPS, hence the move to FreeRADIUS. We’re using EAP-TLS with user certs issued via Intune (from an on-prem NDES for now, hopefully sth else soon!). Because I need users dropped into different VLANs during the Wi-Fi auth, and to also supply RADIUS “Class” attributes to my Fortigate for RSSO based internet filtering, I built a ‘plugin’ solution for FreeRADIUS that uses the “exec” module to run a lookup during auth. I thought I’d share it here in case it’s useful to others! https://github.com/johnclearyconsulting/radgraph Thanks again, John -- John Cleary Melbourne, Australia +61 417 143 312 john(a)cleary.au

4 3

Support for python free threading
by The2nd 09 May '26

09 May '26

Hello list, i want to ask, if there are plans to support python in free threading mode (https://docs.python.org/3/howto/free-threading-python.html) Regards The2nd

3 2

Re: [EXTERNAL] Re: Intermediate-Trust certificate issues
by Hector Rodriguez 02 May '26

02 May '26

Alan, Thank you for replying, it means a lot to me. The version installed is 3.2.5. Are you saying that upgrading to version 3.2.9 should fix the issue ? (Yes || no) I currently see the version on the site. Unsure based on the response if it's already committed into the new version. ________________________________ From: Alan DeKok Sent: Friday, May 1, 2026 3:20 PM To: FreeRadius users mailing list Cc: Hector Rodriguez Subject: Re: [EXTERNAL] Re: Intermediate-Trust certificate issues On May 1, 2026, at 2:35 PM, Hector Rodriguez via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > I hope everyone is well. Currently I have implemented Free Radius in a test environment with EAP-TLS mode enabled. Which version? > My environment currently has a two tier PKI (CA Root and Ca Issuer within the Intune Microsoft Cloud PKI environment) . Our Free Radius server is configured to have an SSL from the CA server installed within my Free Radius Server, which is generated by the CA config. Our Root CA and Issuer CA certificates have been imported from Intune, and converted from Cer to PEM/CRT file formats, and the EAP config file has been edited to point to a bundled (full chain ) Issuer CA cert. The server's certificate store has been updated to trust the Microsoft CA and Issuer CA for our environment . I have created a configuration profile within Intune to grant machines (in my case, just a test machine) to install both CA ROOT and Issuer certs to their prespective certificate store. Public certs are owned by the freerad user and currently have the 755 permissions OK. There's always some magic fighting with certificates, but that sounds reasonable. > Another thing to note is that we are currently using a Unifi switch and we have set the controller profile to authenticate with Radius. I have been going a bit insane trying to figure out why the Free Radius server is not trusting my intermediate certificate when I have clearly followed the appropriate instructions. No matter what I do the intermediate cert is not trusted. Authentication only occurs when I set:reject_unknown_intermediate_ca to No. I have been notciing that other users have a similar issue, with PKI's related to Microsoft Cloud PKI. Do you thing there will be a fix. Is there anything that I can do for this issue ? Although it seems unsafe, do you think it would be Ok, to set reject_unknown_intermediate_ca =no ? IIRC there were issues with intermediate certs at one point. The fix is likely in commit aca3a5955d4e i.e. it will be in 3.2.9, which we expect to release shortly. Alan DeKok. [cid:54071d05-fdb4-47e4-863c-76f80c12afcc] Hector Rodriguez Cloud Administrator WestCare Foundation Phone (702) 482 0922 Web westcare.com Email hector.rodriguez(a)westcare.com<mailto:hector.rodriguez@westcare.com> Office 1711 Whitney Mesa, Henderson, NV 89014 [cid:e1e62e03-511d-42d2-a611-01b18262a642]<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> Book time to meet with me<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> -- CONFIDENTIALITY NOTICE: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. This communication may contain material protected by HIPAA legislation (45 CFR, Parts 160 & 164) or by 42 CFR Part 2. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is strictly prohibited. If you have received this email in error, please notify the sender by reply email and destroy all copies of the original message.

2 1

Intermediate-Trust certificate issues
by Hector Rodriguez 01 May '26

01 May '26

Hello, I hope everyone is well. Currently I have implemented Free Radius in a test environment with EAP-TLS mode enabled. My environment currently has a two tier PKI (CA Root and Ca Issuer within the Intune Microsoft Cloud PKI environment) . Our Free Radius server is configured to have an SSL from the CA server installed within my Free Radius Server, which is generated by the CA config. Our Root CA and Issuer CA certificates have been imported from Intune, and converted from Cer to PEM/CRT file formats, and the EAP config file has been edited to point to a bundled (full chain ) Issuer CA cert. The server's certificate store has been updated to trust the Microsoft CA and Issuer CA for our environment . I have created a configuration profile within Intune to grant machines (in my case, just a test machine) to install both CA ROOT and Issuer certs to their prespective certificate store. Public certs are owned by the freerad user and currently have the 755 permissions Another thing to note is that we are currently using a Unifi switch and we have set the controller profile to authenticate with Radius. I have been going a bit insane trying to figure out why the Free Radius server is not trusting my intermediate certificate when I have clearly followed the appropriate instructions. No matter what I do the intermediate cert is not trusted. Authentication only occurs when I set:reject_unknown_intermediate_ca to No. I have been notciing that other users have a similar issue, with PKI's related to Microsoft Cloud PKI. Do you thing there will be a fix. Is there anything that I can do for this issue ? Although it seems unsafe, do you think it would be Ok, to set reject_unknown_intermediate_ca =no ? Piece of my log errors: Certificate chain - 1 intermediate CA cert(s) untrusted To forbid these certificates see 'reject_unknown_intermediate_ca' (TLS) untrusted certificate with depth [1] subject name /C=US/ST=test/L=testn/OU=Information Technology/O=test-site Inc/CN=Test-Issuing-Cloud-CA1 (TLS) untrusted certificate with depth [0] subject name /CN=AP-tesetmachine tls: There are untrusted certificates in the certificate chain. Rejecting. (13) eap_tls: (TLS) TLS - send TLS 1.3 Alert, fatal internal_error (13) eap_tls: ERROR: (TLS) TLS - Alert write:fatal:internal error (13) eap_tls: ERROR: (TLS) TLS - Server : Error in error (13) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:0A000086:SSL routines::certificate verify failed (13) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (13) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (13) eap_tls: ERROR: [eaptls process] = fail (13) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (13) eap: Sending EAP Failure (code 4) ID 10 length 4 (13) eap: Failed in EAP select (13) [eap] = invalid (13) } # authenticate = invalid (13) Failed to authenticate the user (13) Using Post-Auth-Type Reject (13) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (13) Post-Auth-Type REJECT { (13) attr_filter.access_reject: EXPAND %{User-Name} Thank you ! [cid:59049752-c8e4-4c9b-8b16-c6e2ede5715f]<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> Book time to meet with me<https://outlook.office.com/bookwithme/user/af4e411e9f3847489776fafebd3877b9…> -- CONFIDENTIALITY NOTICE: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. This communication may contain material protected by HIPAA legislation (45 CFR, Parts 160 & 164) or by 42 CFR Part 2. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is strictly prohibited. If you have received this email in error, please notify the sender by reply email and destroy all copies of the original message.

2 1

Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...' even when setting explicitly Attr-26 (or vendor data type)
by Francesco Di Nucci 29 Apr '26

29 Apr '26

Hi, I am using FreeRADIUS 3.0.27 on EL9, and I'm trying to set a Vendor Attribute in replies. For context, I am trying to authenticate SuperMicro BMCs with LDAP (see thread https://lists.freeradius.org/pipermail/freeradius-users/2018-March/091085.h…) So in my enabled site I edited the post-auth section post-auth { update { reply:Attr-26 := "0x483D342C20493D34" } } This results in "Cannot parse RHS hex as the data type of the attribute Vendor-Specific" As it's missing Vendor ID, I tried to add it. Super Micro PEN on IANA is 10876, so full vendor attribute should be 1A1200002A7C483D342C20493D34 if I am correct: post-auth { update { reply:Attr-26 := "1A1200002A7C483D342C20493D34" } } And here the result is Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...' , even if I am setting reply:Attr-26 Does anyone have a suggestion? I'd like to add it to post-auth (and not to mods-enabled/ldap) to then add a conditional on NAS-Identifier = "SUPERMICRO BMC" Thanks in advance Francesco -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email: francesco.dinucci(a)na.infn.it

3 7

FreeRADIUS RadSec TCP connection plateau at 505
by Tayyab Elahi 22 Apr '26

22 Apr '26

Hi all, We're running FreeRADIUS 3.x as a RadSec terminator (TLS/TCP on port 2083) in a Linux container, and we hit a hard ceiling at ~505 concurrent TLS connections. Looking for guidance on the recommended path forward. *Symptom (full logs attached):* Every new connection above ~505 is rejected. *Root cause: *The #ifndef HAVE_KQUEUE branch in event.c uses select() + fd_set. On glibc, FD_SETSIZE and __FD_SETSIZE are hard-coded to 1024 in <bits/typesizes.h>, and sizeof(fd_set) is 128 bytes (1024 bits). Since each RadSec peer holds a persistent TCP FD, we run out at ~1000. *What we tried (none of it gets past 1024):* 1. Raised FR_EV_MAX_FDS 512 → 2048 (event.c) 2. Raised MAX_SOCKETS 1024 → 2048 (packet.c) 3. Added -DFD_SETSIZE=65536 to CFLAGS — verified as a no-op: glibc redefines 4. FD_SETSIZE back to 1024 in <sys/select.h>, and sizeof(fd_set) stays 128 bytes 5. Raised ulimit -n / LimitNOFILE to 65536 6. Raised max_connections on the listener and per client *Questions:* 1. Is there any supported way on v3.x to use an event backend other than select() on Linux? I see the kqueue branch but no epoll branch. 2. Does upgrading to v4 solve this — i.e., can v4 handle 5k–10k concurrent RadSec sessions on Linux out of the box? 3. Would an epoll backend patch for v3 (new #elif defined(HAVE_EPOLL) branch in event.c, replacing fd_set with an fd-indexed array) be of interest upstream, or is that out of scope for v3 maintenance? 4. Any deployment patterns people use to stretch v3 further, beyond tight idle_timeout / lifetime / cleanup_delay and sharding across multiple FR instances? *Environment:* - FreeRADIUS 3.x (event.c commit 92ab704b) - Linux, glibc (Debian-based container), Kubernetes - Single radiusd process, multi-threaded - TLS listener on 0.0.0.0:2083, virtual-server=radius-tls - ~1000 long-lived RadSec sessions at steady state - Container confirms __FD_SETSIZE=1024, sizeof(fd_set)=128 Logs attached. Any pointers appreciated. Thanks, Tayyab Elahi

2 1

LSP - Language Server Protocol - FreeRADIUS and or unlang
by Douglas Fischer 22 Apr '26

22 Apr '26

There is any thing on roadmap related to some kind data model of the possible attributes and correlates for FreeRadius. I saw something on pararel projects pyfreeradius and freeradius-api But the docs could be better... Talking about LSP I had an opportunity of creating a "ugly web-gui" for a software just using the LSP. Using that to propose suggestions instead os just parsing what was writed. So, considering that, any plans to something like LSP for freeradius? Douglas Fernando Fischer Engº de Controle e Automação

2 1

Compile on RHEL9: No libtalloc-devel
by g4-lisz＠tonarchiv.ch 17 Apr '26

17 Apr '26

Hi there, We had to do a upgrade our RHEL 9 VM (dnf update). And now it seems there is no libtalloc-devel package anymore. dnf provides '*talloc.h' cant find anything. Has anyone managed to compile under the latest RHEL 9 using libraries from the official RHEL repositories? Or do I also have to compile talloc from the source code? Cheers, Till

2 2

FreeRadius Mythos Scan
by Karlo Zatylny 17 Apr '26

17 Apr '26

Sorry if this has been asked before but I couldn’t find it in the archive. Has FreeRadius been scanned by Mythos and have any bugs been reported and or fixed by this scan? If so, is it only on the latest code base or have older versions also been scanned? I am unsure how to reach out to Anthropic to have this happen but am willing to help if needed. Thanks Karlo

3 3