- Freeradius-Users - lists.freeradius.org

Documentation Feature Compare Releases
by Douglas Fischer 06 Apr '26

06 Apr '26

Hello all! https://www.freeradius.org/documentation/freeradius-server/ How difficult would it be to add some resource that could allow comparing the documentation of two releases of freeRADIUS? This is just a suggestion to perhaps try to smooth the learning curve for those who don't have extensive experience with AAA or with freeRADIUS specifically. I'm not sure (I'm not a programmer), but I believe Sphinx has some plugin that allows this comparison of release documentation. I'm making this suggestion because I believe this possibility would be particularly useful at transition points between major releases, or when adding more impactful features. Thank you in advance for your understanding! -- Douglas Fernando Fischer Engº de Controle e Automação

2 3

v4 - linelog taking 1 second to write to local file
by James Wood 04 Apr '26

04 Apr '26

Hi, I have the following config in radiusd.conf: log { destination = file file = ${logdir}/radius.log } When configured with destination = file, it's taking 1 second to write to the file exactly for any linelog configured output. If I change it to syslog instead of file, it's instant. This results in a one-second delay in the reply back to the client. Here is the verbose log output: 2026-04-02T21:31:26.150850Z: (0) [4] unlang_module - linelog (log_auth_access_accept) 2026-04-02T21:31:26.150900Z: (0) ** [5] frame_eval << pushed-child (noop not-set) 2026-04-02T21:31:26.150942Z: (0) ** [5] unlang_interpret - frame action next 2026-04-02T21:31:26.151011Z: (0) ** [5] frame_eval >> function 2026-04-02T21:31:26.151055Z: (0) Calling function 0x7f65be0b9924 (call_env_expand_start) 2026-04-02T21:31:26.151154Z: (0) Calling repeat function 0x7f65be0ba182 (call_env_expand_repeat) 2026-04-02T21:31:26.151239Z: (0) ** [5] frame_eval << calculate-result (... not-set) 2026-04-02T21:31:26.151255Z: (0) ** [5] result_calculate - skipping frame, no result set 2026-04-02T21:31:26.151323Z: (0) ** [5] frame_eval - done current subsection with (noop not-set), will NOT set higher frame rcode (p_result) 2026-04-02T21:31:26.151379Z: (0) ** [5] unlang_interpret - frame action pop 2026-04-02T21:31:26.151393Z: (0) ** [5] unlang_interpret - frame popped 2026-04-02T21:31:26.151441Z: (0) ** [4] unlang_interpret - frame action next 2026-04-02T21:31:26.151486Z: (0) ** [4] frame_eval >> module 2026-04-02T21:31:26.151559Z: (0) [4] unlang_module - linelog (log_auth_access_accept) 2026-04-02T21:31:26.151581Z: (0) log_auth_access_accept - Using default message 2026-04-02T21:31:26.151656Z: (0) log_auth_access_accept - ** [5] frame_eval << pushed-child (noop not-set) 2026-04-02T21:31:26.151867Z: (0) log_auth_access_accept - ** [5] unlang_interpret - frame action next 2026-04-02T21:31:26.151915Z: (0) log_auth_access_accept - ** [5] frame_eval >> tmpl 2026-04-02T21:31:26.151964Z: (0) log_auth_access_accept - ** [5] frame_eval << calculate-result (ok not-set) 2026-04-02T21:31:26.152036Z: (0) log_auth_access_accept - ** [5] result_calculate - have (... not-set) frame or module returned (ok not-set) 2026-04-02T21:31:26.152082Z: (0) log_auth_access_accept - ** [5] result_calculate - using default instruction priority for ok, not-set 2026-04-02T21:31:26.152156Z: (0) log_auth_access_accept - ** [5] result_calculate - overwriting existing result (... not-set) with higher priority (ok not-set) 2026-04-02T21:31:26.152174Z: (0) log_auth_access_accept - ** [5] frame_eval - done current subsection with (ok not-set), will set higher frame rcode 2026-04-02T21:31:26.152271Z: (0) log_auth_access_accept - ** [5] unlang_interpret - frame action pop 2026-04-02T21:31:26.152289Z: (0) log_auth_access_accept - ** [5] unlang_interpret - frame popped 2026-04-02T21:31:26.152325Z: (0) log_auth_access_accept - ** [4] result_pop - using instruction priority for higher frame (ok, 3) 2026-04-02T21:31:26.152399Z: (0) log_auth_access_accept - ** [4] result_calculate - have (ok 3) frame or module returned (ok 3) 2026-04-02T21:31:26.152444Z: (0) log_auth_access_accept - Setting request->rcode to 'ok' 2026-04-02T21:31:26.152459Z: (0) log_auth_access_accept - ** [4] result_calculate - overwriting existing result (ok 3) with higher priority (ok 3) 2026-04-02T21:31:26.152534Z: (0) log_auth_access_accept - ** [4] unlang_interpret - frame action next 2026-04-02T21:31:26.152553Z: (0) log_auth_access_accept - ** [4] frame_eval >> module 2026-04-02T21:31:26.152711Z: (0) log_auth_access_accept - ** [4] frame_eval << yield (noop not-set) 2026-04-02T21:31:26.152851Z: (0) log_auth_access_accept - ** [4] frame_eval - yielding with current (noop not-set) 2026-04-02T21:31:26.152983Z: (0) log_auth_access_accept - ** [4] unlang_interpret - frame action yield 2026-04-02T21:31:26.153089Z: (0) log_auth_access_accept - ** [4] unlang_interpret - interpret yielding 2026-04-02T21:31:26.153136Z: (0) log_auth_access_accept - _worker_request_yield - Request yielded 2026-04-02T21:31:27.155378Z: (0) log_auth_access_accept - Interpreter - Request marked as runnable 2026-04-02T21:31:27.155422Z: (0) log_auth_access_accept - _worker_request_runnable - Request marked as runnable 2026-04-02T21:31:27.155484Z: (0) log_auth_access_accept - ** [4] unlang_interpret - interpret entered 2026-04-02T21:31:27.155494Z: (0) log_auth_access_accept - _worker_request_resume - Request resuming 2026-04-02T21:31:27.155503Z: (0) log_auth_access_accept - ** [4] unlang_interpret - frame action next 2026-04-02T21:31:27.155514Z: (0) log_auth_access_accept - log_auth_access_accept - Resuming execution 2026-04-02T21:31:27.155523Z: (0) log_auth_access_accept - ** [4] frame_eval >> module 2026-04-02T21:31:27.155536Z: (0) log_auth_access_accept - log_auth_access_accept (noop) 2026-04-02T21:31:27.155544Z: (0) ** [4] frame_eval << next (noop not-set) 2026-04-02T21:31:27.155556Z: (0) ** [4] frame_eval - done current subsection with (ok 3), will set higher frame rcode 2026-04-02T21:31:27.155564Z: (0) ** [4] unlang_interpret - frame action pop 2026-04-02T21:31:27.155571Z: (0) ** [4] unlang_interpret - frame popped 2026-04-02T21:31:27.155580Z: (0) ** [3] result_pop - using instruction priority for higher frame (ok, not-set) 2026-04-02T21:31:27.155589Z: (0) ** [3] result_calculate - have (noop not-set) frame or module returned (ok not-set) 2026-04-02T21:31:27.155597Z: (0) ** [3] result_calculate - using default instruction priority for ok, not-set 2026-04-02T21:31:27.155606Z: (0) ** [3] result_calculate - overwriting existing result (noop not-set) with higher priority (ok not-set) 2026-04-02T21:31:27.155621Z: (0) } # send Access-Accept ((ok)) 2026-04-02T21:31:27.155629Z: (0) ** [3] unlang_interpret - done current subsection with (... not-set) 2026-04-02T21:31:27.155636Z: (0) ** [3] unlang_interpret - frame action pop 2026-04-02T21:31:27.155643Z: (0) ** [3] unlang_interpret - frame popped 2026-04-02T21:31:27.155650Z: (0) ** [2] unlang_interpret - frame action next 2026-04-02T21:31:27.155658Z: (0) ** [2] frame_eval >> module 2026-04-02T21:31:27.155674Z: (0) Entered state resume_access_accept 2026-04-02T21:31:27.155685Z: (0) request_data_reference: No request data found at 0x5608d64308d0:0 2026-04-02T21:31:27.155693Z: (0) Adding Proxy-State attributes from request 2026-04-02T21:31:27.155703Z: (0) default (noop) 2026-04-02T21:31:27.155710Z: (0) ** [2] frame_eval << calculate-result (noop not-set) 2026-04-02T21:31:27.155718Z: (0) ** [2] result_calculate - have (... not-set) frame or module returned (noop not-set) 2026-04-02T21:31:27.155727Z: (0) Setting request->rcode to 'noop' 2026-04-02T21:31:27.155734Z: (0) ** [2] result_calculate - using default instruction priority for noop, not-set 2026-04-02T21:31:27.155742Z: (0) ** [2] result_calculate - overwriting existing result (... not-set) with higher priority (noop not-set) 2026-04-02T21:31:27.155751Z: (0) ** [2] frame_eval - done current subsection with (noop not-set), will set higher frame rcode 2026-04-02T21:31:27.155759Z: (0) ** [2] unlang_interpret - frame action pop 2026-04-02T21:31:27.155766Z: (0) ** [2] unlang_interpret - frame popped 2026-04-02T21:31:27.155774Z: (0) ** [1] result_pop - using instruction priority for higher frame (noop, not-set) 2026-04-02T21:31:27.155782Z: (0) ** [1] result_calculate - have (... not-set) frame or module returned (noop not-set) 2026-04-02T21:31:27.155790Z: (0) ** [1] result_calculate - using default instruction priority for noop, not-set 2026-04-02T21:31:27.155798Z: (0) ** [1] result_calculate - overwriting existing result (... not-set) with higher priority (noop not-set) 2026-04-02T21:31:27.155806Z: (0) ** [1] unlang_interpret - frame action next 2026-04-02T21:31:27.155815Z: (0) ** [1] frame_eval >> call 2026-04-02T21:31:27.155822Z: (0) ** [1] frame_eval << calculate-result (... not-set) 2026-04-02T21:31:27.155830Z: (0) ** [1] result_calculate - skipping frame, no result set 2026-04-02T21:31:27.155837Z: (0) } # default (noop) 2026-04-02T21:31:27.155844Z: (0) ** [1] frame_eval - done current subsection with (noop not-set), will set higher frame rcode 2026-04-02T21:31:27.155852Z: (0) ** [1] unlang_interpret - frame action pop 2026-04-02T21:31:27.155859Z: (0) ** [1] unlang_interpret - frame popped 2026-04-02T21:31:27.155866Z: (0) ** [0] result_calculate - have (... not-set) frame or module returned (noop not-set) 2026-04-02T21:31:27.155874Z: (0) ** [0] result_calculate - using default instruction priority for noop, not-set 2026-04-02T21:31:27.155882Z: (0) ** [0] result_calculate - overwriting existing result (... not-set) with higher priority (noop not-set) 2026-04-02T21:31:27.155891Z: (0) ** [0] unlang_interpret - interpret exiting, returning (noop) 2026-04-02T21:31:27.155914Z: (0) Done request 2026-04-02T21:31:27.155920Z: (0) Time tracking ended 2026-04-02T21:31:27.155974Z: stk: Currently in fr_radius_encode_pair 2026-04-02T21:31:27.156041Z: stk: > [0] uint32: Acct-Interim-Interval, vendor: 0x0 (0), attr: 0x55 (85) 2026-04-02T21:31:27.156050Z: stk: 2026-04-02T21:31:27.156056Z: stk: Currently in encode_rfc 2026-04-02T21:31:27.156061Z: stk: > [0] uint32: Acct-Interim-Interval, vendor: 0x0 (0), attr: 0x55 (85) 2026-04-02T21:31:27.156069Z: stk: 2026-04-02T21:31:27.156074Z: stk: Currently in encode_child 2026-04-02T21:31:27.156079Z: stk: > [0] uint32: Acct-Interim-Interval, vendor: 0x0 (0), attr: 0x55 (85) 2026-04-02T21:31:27.156086Z: stk: 2026-04-02T21:31:27.156091Z: stk: Currently in encode_value 2026-04-02T21:31:27.156096Z: stk: > [0] uint32: Acct-Interim-Interval, vendor: 0x0 (0), attr: 0x55 (85) 2026-04-02T21:31:27.156104Z: stk: 2026-04-02T21:31:27.156115Z: hex: -- value uint32 -- 2026-04-02T21:31:27.156123Z: hex: 0000: 00 00 00 f0 2026-04-02T21:31:27.156131Z: hex: -- header rfc -- 2026-04-02T21:31:27.156137Z: hex: 0000: 55 06 2026-04-02T21:31:27.156143Z: stk: Currently in fr_radius_encode_pair 2026-04-02T21:31:27.156148Z: stk: > [0] string: User-Name, vendor: 0x0 (0), attr: 0x1 (1) 2026-04-02T21:31:27.156155Z: stk: 2026-04-02T21:31:27.156160Z: stk: Currently in encode_rfc 2026-04-02T21:31:27.156166Z: stk: > [0] string: User-Name, vendor: 0x0 (0), attr: 0x1 (1) 2026-04-02T21:31:27.156172Z: stk: 2026-04-02T21:31:27.156177Z: stk: Currently in encode_child 2026-04-02T21:31:27.156182Z: stk: > [0] string: User-Name, vendor: 0x0 (0), attr: 0x1 (1) 2026-04-02T21:31:27.156189Z: stk: 2026-04-02T21:31:27.156200Z: stk: Currently in encode_value 2026-04-02T21:31:27.156205Z: stk: > [0] string: User-Name, vendor: 0x0 (0), attr: 0x1 (1) 2026-04-02T21:31:27.156212Z: stk: 2026-04-02T21:31:27.156217Z: hex: -- value string -- 2026-04-02T21:31:27.156224Z: hex: 0000: 6d 61 63 61 75 74 68 40 34 41 2d 39 42 2d 44 42 2026-04-02T21:31:27.156231Z: hex: 0010: 2d 37 36 2d 44 36 2d 35 33 2026-04-02T21:31:27.156238Z: hex: -- header rfc -- 2026-04-02T21:31:27.156243Z: hex: 0000: 01 1b 2026-04-02T21:31:27.156249Z: hex: -- fr_radius_encode encoded packet -- 2026-04-02T21:31:27.156256Z: hex: 0000: 02 94 00 47 19 d6 f5 64 9e 8d 68 bf d1 e9 f5 3b 2026-04-02T21:31:27.156264Z: hex: 0010: b5 ed df 2c 50 12 00 00 00 00 00 00 00 00 00 00 2026-04-02T21:31:27.156272Z: hex: 0020: 00 00 00 00 00 00 55 06 00 00 00 f0 01 1b 6d 61 2026-04-02T21:31:27.156280Z: hex: 0030: 63 61 75 74 68 40 34 41 2d 39 42 2d 44 42 2d 37 2026-04-02T21:31:27.156286Z: hex: 0040: 36 2d 44 36 2d 35 33 2026-04-02T21:31:27.156477Z: (0) Sending Access-Accept ID 148 from 0.0.0.0/0:1812 to 127.0.0.1:33797 length 71 via socket radius_udp server * port 1812 2026-04-02T21:31:27.156509Z: (0) Acct-Interim-Interval = 240 2026-04-02T21:31:27.156499Z: (0) Packet-Type = Access-Accept 2026-04-02T21:31:27.156531Z: (0) Finished request 2026-04-02T21:31:27.156547Z: (0) Request deinitialising (0x5608d7a25220) In particular, you can see the exact one-second gap: 2026-04-02T21:31:26.153136Z: (0) log_auth_access_accept - _worker_request_yield - Request yielded 2026-04-02T21:31:27.155378Z: (0) log_auth_access_accept - Interpreter - Request marked as runnable Any thoughts on why this would be the case? Thanks, James -- Visit purple.ai <https://purple.ai/> Purple on LinkedIn <https://uk.linkedin.com/company/purple-wifi> Email disclaimer <http://www.purple.ai/email-disclaimer/>

2 1

DHCPv6 - MySQL Reservations
by David Lake 02 Apr '26

02 Apr '26

Hi I’m setting up FreeRadius v4 and so far, all working very nicely with a MariaDB Galera datastore. I’d like to fix reservations in IPv6 to statically-assigned v6 prefixes in the same database. How do I do that please? I can’t find anything in the documentation on v6 lease allocation other than to exclude link-local. Thanks David David Lake Visiting Professor 5G Innovation Centre (5GIC and 6GIC) Tel: +44 (0)7711 736784 Email: d.lake(a)surrey.ac.uk<mailto:%20d.lake@surrey.ac.uk> Web: surrey.ac.uk<http://www.surrey.ac.uk/?utm_medium=internal&utm_source=emailsignature&utm_…> [A blue text on a black background Description automatically generated]<http://www.surrey.ac.uk/?utm_source=emailsignature&utm_medium=internal&utm_…> James Clerk Maxwell Building, University of Surrey, Guildford, Surrey, GU2 7XH, UK

2 2

Existing tags being modified on 2026-04-01
by Bjørn Mork 02 Apr '26

02 Apr '26

Stuff like this worries me with all the supply chain attacks going around. We are still expecting lots of fallout from the Trivy compromise. There's no reason to believe the LiteLLM was the only one. bjorn@canardo:/usr/local/src/git/freeradius$ git fetch --all --tags --prune Fetching origin remote: Enumerating objects: 265, done. remote: Counting objects: 100% (137/137), done. remote: Compressing objects: 100% (18/18), done. remote: Total 265 (delta 119), reused 137 (delta 119), pack-reused 128 (from 3) Receiving objects: 100% (265/265), 92.91 KiB | 2.02 MiB/s, done. Resolving deltas: 100% (129/129), completed with 14 local objects. >From https://github.com/FreeRADIUS/freeradius-server 0e6dc8c2bde7..fa8ca050f3d7 v3.2.x -> origin/v3.2.x ! [rejected] branch_3_1_x -> branch_3_1_x (would clobber existing tag) ! [rejected] branch_4_0_0 -> branch_4_0_0 (would clobber existing tag) ! [rejected] first-build -> first-build (would clobber existing tag) ! [rejected] release_0_1_0 -> release_0_1_0 (would clobber existing tag) ! [rejected] release_0_2_0 -> release_0_2_0 (would clobber existing tag) ! [rejected] release_0_3_0 -> release_0_3_0 (would clobber existing tag) ! [rejected] release_0_4_0 -> release_0_4_0 (would clobber existing tag) ! [rejected] release_0_5_0 -> release_0_5_0 (would clobber existing tag) ! [rejected] release_0_6_0 -> release_0_6_0 (would clobber existing tag) ! [rejected] release_0_7_0 -> release_0_7_0 (would clobber existing tag) ! [rejected] release_0_7_1 -> release_0_7_1 (would clobber existing tag) ! [rejected] release_0_8_1 -> release_0_8_1 (would clobber existing tag) ! [rejected] release_0_9_0 -> release_0_9_0 (would clobber existing tag) ! [rejected] release_0_9_0_final -> release_0_9_0_final (would clobber existing tag) ! [rejected] release_0_9_0_pre2 -> release_0_9_0_pre2 (would clobber existing tag) ! [rejected] release_0_9_0_pre3 -> release_0_9_0_pre3 (would clobber existing tag) ! [rejected] release_0_9_1 -> release_0_9_1 (would clobber existing tag) ! [rejected] release_0_9_2 -> release_0_9_2 (would clobber existing tag) ! [rejected] release_0_9_3 -> release_0_9_3 (would clobber existing tag) ! [rejected] release_1_0_0 -> release_1_0_0 (would clobber existing tag) ! [rejected] release_1_0_0_pre1 -> release_1_0_0_pre1 (would clobber existing tag) ! [rejected] release_1_0_0_pre2 -> release_1_0_0_pre2 (would clobber existing tag) ! [rejected] release_1_0_0_pre3 -> release_1_0_0_pre3 (would clobber existing tag) ! [rejected] release_1_0_1 -> release_1_0_1 (would clobber existing tag) ! [rejected] release_1_0_2 -> release_1_0_2 (would clobber existing tag) ! [rejected] release_1_0_3 -> release_1_0_3 (would clobber existing tag) ! [rejected] release_1_0_4 -> release_1_0_4 (would clobber existing tag) ! [rejected] release_1_0_5 -> release_1_0_5 (would clobber existing tag) ! [rejected] release_1_1_0 -> release_1_1_0 (would clobber existing tag) ! [rejected] release_1_1_0_pre0 -> release_1_1_0_pre0 (would clobber existing tag) ! [rejected] release_1_1_1 -> release_1_1_1 (would clobber existing tag) ! [rejected] release_1_1_2 -> release_1_1_2 (would clobber existing tag) ! [rejected] release_1_1_3 -> release_1_1_3 (would clobber existing tag) ! [rejected] release_1_1_4 -> release_1_1_4 (would clobber existing tag) ! [rejected] release_1_1_5 -> release_1_1_5 (would clobber existing tag) ! [rejected] release_1_1_6 -> release_1_1_6 (would clobber existing tag) ! [rejected] release_1_1_7 -> release_1_1_7 (would clobber existing tag) ! [rejected] release_1_1_8 -> release_1_1_8 (would clobber existing tag) ! [rejected] release_2_0_0 -> release_2_0_0 (would clobber existing tag) ! [rejected] release_2_0_0_pre1 -> release_2_0_0_pre1 (would clobber existing tag) ! [rejected] release_2_0_0_pre2 -> release_2_0_0_pre2 (would clobber existing tag) ! [rejected] release_2_0_1 -> release_2_0_1 (would clobber existing tag) ! [rejected] release_2_0_2 -> release_2_0_2 (would clobber existing tag) ! [rejected] release_2_0_3 -> release_2_0_3 (would clobber existing tag) ! [rejected] release_2_0_4 -> release_2_0_4 (would clobber existing tag) ! [rejected] release_2_0_5 -> release_2_0_5 (would clobber existing tag) ! [rejected] release_2_1_0 -> release_2_1_0 (would clobber existing tag) ! [rejected] release_2_1_1 -> release_2_1_1 (would clobber existing tag) ! [rejected] release_2_1_10 -> release_2_1_10 (would clobber existing tag) ! [rejected] release_2_1_11 -> release_2_1_11 (would clobber existing tag) ! [rejected] release_2_1_12 -> release_2_1_12 (would clobber existing tag) ! [rejected] release_2_1_2 -> release_2_1_2 (would clobber existing tag) ! [rejected] release_2_1_3 -> release_2_1_3 (would clobber existing tag) ! [rejected] release_2_1_4 -> release_2_1_4 (would clobber existing tag) ! [rejected] release_2_1_6 -> release_2_1_6 (would clobber existing tag) ! [rejected] release_2_1_7 -> release_2_1_7 (would clobber existing tag) ! [rejected] release_2_1_8 -> release_2_1_8 (would clobber existing tag) ! [rejected] release_2_1_9 -> release_2_1_9 (would clobber existing tag) ! [rejected] release_2_2_0 -> release_2_2_0 (would clobber existing tag) ! [rejected] release_2_2_1 -> release_2_2_1 (would clobber existing tag) ! [rejected] release_2_2_10 -> release_2_2_10 (would clobber existing tag) ! [rejected] release_2_2_2 -> release_2_2_2 (would clobber existing tag) ! [rejected] release_2_2_3 -> release_2_2_3 (would clobber existing tag) ! [rejected] release_2_2_4 -> release_2_2_4 (would clobber existing tag) ! [rejected] release_2_2_5 -> release_2_2_5 (would clobber existing tag) ! [rejected] release_2_2_6 -> release_2_2_6 (would clobber existing tag) ! [rejected] release_2_2_7 -> release_2_2_7 (would clobber existing tag) ! [rejected] release_2_2_8 -> release_2_2_8 (would clobber existing tag) ! [rejected] release_2_2_9 -> release_2_2_9 (would clobber existing tag) ! [rejected] release_3.0.8 -> release_3.0.8 (would clobber existing tag) ! [rejected] release_3_0_0 -> release_3_0_0 (would clobber existing tag) ! [rejected] release_3_0_0_beta0 -> release_3_0_0_beta0 (would clobber existing tag) ! [rejected] release_3_0_0_beta1 -> release_3_0_0_beta1 (would clobber existing tag) ! [rejected] release_3_0_0_rc0 -> release_3_0_0_rc0 (would clobber existing tag) ! [rejected] release_3_0_0_rc1 -> release_3_0_0_rc1 (would clobber existing tag) ! [rejected] release_3_0_1 -> release_3_0_1 (would clobber existing tag) ! [rejected] release_3_0_10 -> release_3_0_10 (would clobber existing tag) ! [rejected] release_3_0_11 -> release_3_0_11 (would clobber existing tag) ! [rejected] release_3_0_12 -> release_3_0_12 (would clobber existing tag) ! [rejected] release_3_0_13 -> release_3_0_13 (would clobber existing tag) ! [rejected] release_3_0_14 -> release_3_0_14 (would clobber existing tag) ! [rejected] release_3_0_15 -> release_3_0_15 (would clobber existing tag) ! [rejected] release_3_0_16 -> release_3_0_16 (would clobber existing tag) ! [rejected] release_3_0_17 -> release_3_0_17 (would clobber existing tag) ! [rejected] release_3_0_18 -> release_3_0_18 (would clobber existing tag) ! [rejected] release_3_0_19 -> release_3_0_19 (would clobber existing tag) ! [rejected] release_3_0_2 -> release_3_0_2 (would clobber existing tag) ! [rejected] release_3_0_20 -> release_3_0_20 (would clobber existing tag) ! [rejected] release_3_0_21 -> release_3_0_21 (would clobber existing tag) ! [rejected] release_3_0_22 -> release_3_0_22 (would clobber existing tag) ! [rejected] release_3_0_23 -> release_3_0_23 (would clobber existing tag) ! [rejected] release_3_0_24 -> release_3_0_24 (would clobber existing tag) ! [rejected] release_3_0_25 -> release_3_0_25 (would clobber existing tag) ! [rejected] release_3_0_26 -> release_3_0_26 (would clobber existing tag) ! [rejected] release_3_0_27 -> release_3_0_27 (would clobber existing tag) ! [rejected] release_3_0_3 -> release_3_0_3 (would clobber existing tag) ! [rejected] release_3_0_4 -> release_3_0_4 (would clobber existing tag) ! [rejected] release_3_0_4_rc0 -> release_3_0_4_rc0 (would clobber existing tag) ! [rejected] release_3_0_4_rc1 -> release_3_0_4_rc1 (would clobber existing tag) ! [rejected] release_3_0_4_rc2 -> release_3_0_4_rc2 (would clobber existing tag) ! [rejected] release_3_0_5 -> release_3_0_5 (would clobber existing tag) ! [rejected] release_3_0_6 -> release_3_0_6 (would clobber existing tag) ! [rejected] release_3_0_7 -> release_3_0_7 (would clobber existing tag) ! [rejected] release_3_0_8 -> release_3_0_8 (would clobber existing tag) ! [rejected] release_3_0_9 -> release_3_0_9 (would clobber existing tag) ! [rejected] release_3_2_0 -> release_3_2_0 (would clobber existing tag) ! [rejected] release_3_2_1 -> release_3_2_1 (would clobber existing tag) ! [rejected] release_3_2_2 -> release_3_2_2 (would clobber existing tag) ! [rejected] release_3_2_3 -> release_3_2_3 (would clobber existing tag) ! [rejected] release_3_2_4 -> release_3_2_4 (would clobber existing tag) ! [rejected] release_3_2_5 -> release_3_2_5 (would clobber existing tag) ! [rejected] release_3_2_6 -> release_3_2_6 (would clobber existing tag) ! [rejected] release_3_2_7 -> release_3_2_7 (would clobber existing tag) ! [rejected] release_3_2_8 -> release_3_2_8 (would clobber existing tag) error: could not fetch origin Fetching bmork@github Comparing a small subset of the tags on github with my local copies, I see this on github: bjorn@canardo:/usr/local/src/git/freeradius$ git ls-remote --tags origin refs/tags/release_3_2_* 69c4b9c4e6e40a69db27049cb6ea65568c1f8c50 refs/tags/release_3_2_0 87528a85decda00b86cf00ad640dc14558e1ca88 refs/tags/release_3_2_0^{} 795def425e5902a714567a14cbaf36717a199765 refs/tags/release_3_2_1 3b86b8fab3574bc860688a55b4c8f70ebc054f15 refs/tags/release_3_2_1^{} 723efbe8846e32852e4a0552400db932ed119913 refs/tags/release_3_2_2 b9ed73ef2d2628fa6e2a6d15a7782f8217966be0 refs/tags/release_3_2_2^{} 902152f616f6c67f91152707663258edaf3dae75 refs/tags/release_3_2_3 db3d1924d9a2e8d37c43872932621f69cfdbb099 refs/tags/release_3_2_3^{} 4f0566bed21fd88c4c93a18094a666cd04573049 refs/tags/release_3_2_4 7e8f34ec57ca854709672f7f3e4a341ff2f0b550 refs/tags/release_3_2_4^{} 64440a14ca3c666883aeb5e0a47ae226448b4a30 refs/tags/release_3_2_5 a7acce80f5ba2271d9aeb737a4a91a5bf8317f31 refs/tags/release_3_2_5^{} e23d0f459b893f8e09eb4423e947f64a2caf6cf0 refs/tags/release_3_2_6 a696279897f9e87c2fb2b1b8388da5a4aa09835f refs/tags/release_3_2_6^{} daf925decd4873c252839de116778c90c2e5d97c refs/tags/release_3_2_7 694a97dddbdd26423504afe7c530e8e1502b7354 refs/tags/release_3_2_7^{} 004dafca9f3601453cd3cc08f36493b708ce55cf refs/tags/release_3_2_8 032be31bb52646171099617928ec1703335bcf73 refs/tags/release_3_2_8^{} While I've got: bjorn@canardo:/usr/local/src/git/freeradius$ git tag --list --format='%(objectname) %(refname)' release_3_2_* 87528a85decda00b86cf00ad640dc14558e1ca88 refs/tags/release_3_2_0 3b86b8fab3574bc860688a55b4c8f70ebc054f15 refs/tags/release_3_2_1 b9ed73ef2d2628fa6e2a6d15a7782f8217966be0 refs/tags/release_3_2_2 db3d1924d9a2e8d37c43872932621f69cfdbb099 refs/tags/release_3_2_3 7e8f34ec57ca854709672f7f3e4a341ff2f0b550 refs/tags/release_3_2_4 a7acce80f5ba2271d9aeb737a4a91a5bf8317f31 refs/tags/release_3_2_5 a696279897f9e87c2fb2b1b8388da5a4aa09835f refs/tags/release_3_2_6 694a97dddbdd26423504afe7c530e8e1502b7354 refs/tags/release_3_2_7 032be31bb52646171099617928ec1703335bcf73 refs/tags/release_3_2_8 So my tags match the odd tag names with a '^{}' suffix. The new tags seem to all be gpg signed objects referencing the same object as the old tag. For example: bjorn@canardo:/usr/local/src/git/freeradius$ git show 004dafca9f3601453cd3cc08f36493b708ce55cf tag release_3_2_8 Tagger: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Apr 1 18:35:01 2026 -0400 release_3_2_8 -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEE8n1lTTL4FC4LtEWpfQ55zXdiHs0FAmnNnZUACgkQfQ55zXdi Hs0VJQf/fcukNADXI9Nc1iP2xEWok0T9yKD/IsXNp27kKzvdItXDT4WSAJRV454f FObLabOcMAfvomBiBGZfVLoNoCFrnG0hOF+cBGCRMYFqRDFTt65UXxb9NWAF0Dw+ kJznNS02Ds/bWxgMA1r7GYkoLqs+Klwg79DuBhmwnXNcj4sr6ifx9NVxOugab+YC c7X+aunFfDonj6UGJYfAITjlkvdHgvenK15e1UDzYtDzPRsw41Eesa7E0ea+ZlMo 44SNFWcyXuXyXukQhgr12tdtgOvBQ8GYGwDt/2DUAVz4wUrM7rcq+6y+8LJM77ef sCqvUF4RNdR2SiZAMbqy+gUe98DJYg== =7bE2 -----END PGP SIGNATURE----- commit 032be31bb52646171099617928ec1703335bcf73 (tag: release_3_2_8) gpg: Signature made Wed Aug 20 18:29:15 2025 CEST gpg: using RSA key A5C5E99DFB9B5C1F70A7A2FFD9B933C12AED74F0 gpg: issuer "matthew-git(a)newtoncomputing.co.uk" gpg: Good signature from "Matthew Newton (git signing key) <matthew-git(a)newtoncomputing.co.uk>" [full] gpg: matthew-git(a)newtoncomputing.co.uk: Verified 284 signatures in the past 2 months. Encrypted 0 messages. Primary key fingerprint: A5C5 E99D FB9B 5C1F 70A7 A2FF D9B9 33C1 2AED 74F0 Author: Matthew Newton <matthew-git(a)newtoncomputing.co.uk> Date: Wed Aug 20 17:29:15 2025 +0100 release 3.2.8 diff --git a/debian/changelog b/debian/changelog index a004b9adecca..d24614ea2720 100644 --- a/debian/changelog +++ b/debian/changelog @@ -2,7 +2,7 @@ freeradius (3.2.8+git) unstable; urgency=medium * New upstream version. - -- Alan DeKok <aland(a)freeradius.org> Fri, 31 Jan 2025 12:00:00 +0000 + -- Alan DeKok <aland(a)freeradius.org> Wed, 20 Aug 2025 12:00:00 +0000 freeradius (3.2.7+git) unstable; urgency=medium diff --git a/doc/ChangeLog b/doc/ChangeLog index c7e59bef42c8..b7ec777822c4 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,4 +1,4 @@ -FreeRADIUS 3.2.8 Fri 31 Jan 2025 12:00:00 UTC urgency=low +FreeRADIUS 3.2.8 Wed 20 Aug 2025 12:00:00 UTC urgency=low Configuration changes * Replace dictionary.infinera with the correct one. * Update dictionary.alteon @@ -25,11 +25,9 @@ FreeRADIUS 3.2.8 Fri 31 Jan 2025 12:00:00 UTC urgency=low * Added kafka module. See mods-available/kafka. * json module can now print dates as integers. See mods-available/json - * The debug output now points to the online documentation - in many cases, when there are syntax errors in the - configuration. - * Add support for 389ds password hashes. Patch from - Gerald Vogt. + * The debug output now points to the online documentation in + many cases, when there are syntax errors in the configuration. + * Add support for 389ds password hashes. Patch from Gerald Vogt. * reject_delay does not _add_ a delay, but instead ensures that the reject is delayed for _at least_ that time. This change means that reject_delay can be set in more situations, including So that looks fine. Except this sudden appearance of signatures on all the old tags, reusing the same names. That's very messy. Could anyone please confirm that this intentional and the everything is OK with the github repo? Yes, I can see that the tags are signed by an entity which normally would be trusted.. But these days I have to assume that *any* release credentials could be compromised. The only protection left is the sanity of local clones. And tag updates are as unexpected as any other object modifcations. Bjørn

2 2

FreeRADIUS PostgreSQL sslrootcert only
by Sam Hutchings 31 Mar '26

31 Mar '26

Hi Everyone, Hope this finds you well. I am looking into hosting options for running a PostgreSQL database in Azure for FreeRADIUS, which I am currently evaluating using Azure PostgreSQL Flexible Server. This connects without SSL no problem and is functioning as needed (authentication and accounting). However, this will not connect with SSL enabled from FreeRADIUS due to expecting the sslcert and sslkey, which is not supported by Azure PostgreSQL Flexible Server or Azure Database for PostgreSQL (i.e. mutual TLS not supported). This is as per: https://learn.microsoft.com/en-us/azure/postgresql/security/security-tls#ot… If I attempt to connect using the psql client with only the sslrootcert PEM file specified, this is working: psql "port=5432 host=psqlfreeradius.postgres.database.azure.com user=radius dbname=radius sslmode=verify-full sslrootcert=/etc/ssl/certs/MSCerts.pem" Password for user radius: psql (16.13 (Ubuntu 16.13-0ubuntu0.24.04.1), server 18.2) WARNING: psql major version 16, server major version 18. Some psql features might not work. SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off) Type "help" for help. On reading into libpq, these parameters are only ignored (sslcert/sslkey) when SSL is not attempted. Therefore, I suspect this is a limitation of using libpq but I am by no means a developer! My query is whether there is a solution to allow FreeRADIUS to ignore the sslcert/sslkey being missing from the connection string to enable this to function similarly to the above or whether this is a limitation of the Azure service that I am using and I should query with Microsoft Support. Please find the debug output below: FreeRADIUS Version 3.2.8 Copyright (C) 1999-2025 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT FreeRADIUS is developed, maintained, and supported by InkBridge Networks. For commercial support, please email sales(a)inkbridgenetworks.com https://inkbridgenetworks.com/ Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/postgresql/queries.conf including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/proxy_rate_limit including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/totp including configuration file /etc/freeradius/mods-enabled/dynamic_clients including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/rfc7542 including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/filter including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 proxy_dedup_window = 1 cleanup_delay = 5 max_requests = 16384 max_fds = 512 postauth_client_lost = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 delay_proxy_rejects = no status_server = yes require_message_authenticator = "auto" limit_proxy_state = "auto" } unlang { group_stop_return = no policy_stop_return = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 900 } } Shared secret for client localhost is short, and likely can be broken by an attacker. client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Shared secret for client localhost_ipv6 is short, and likely can be broken by an attacker. client org_10 { ipaddr = 10.0.0.0/8 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client org_172_16 { ipaddr = 172.16.0.0/12 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client org_192_168 { ipaddr = 192.168.0.0/16 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached Configuration version: 7513-5adf-1687-8734 systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/mods-enabled/sql sql { driver = "rlm_sql_postgresql" server = "" port = 0 login = "" password = <<< secret >>> radius_db = "host=psqlfreeradius.postgres.database.azure.com port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslrootcert=/etc/ssl/certs/MSCerts.pem" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(RadAcctId) FROM radacct a LEFT OUTER JOIN nasreload n USING (NASIPAddress) WHERE UserName='%{SQL-User-Name}' AND AcctStopTime IS NULL AND (a.AcctStartTime > n.ReloadTime OR n.ReloadTime IS NULL)" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct a LEFT OUTER JOIN nasreload n USING (nasipaddress) WHERE UserName='%{SQL-User-Name}' AND AcctStopTime IS NULL AND (a.AcctStartTime > n.reloadtime OR n.reloadtime IS NULL)" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no record_query_number = no accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" type { accounting-on { query = "UPDATE radacct SET AcctStopTime = TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), AcctUpdateTime = TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), AcctSessionTime = (%{%{integer:Event-Timestamp}:-%l} - EXTRACT(EPOCH FROM(AcctStartTime))), AcctTerminateCause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE AcctStopTime IS NULL AND NASIPAddress= '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' AND AcctStartTime <= TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l})" } accounting-off { query = "UPDATE radacct SET AcctStopTime = TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), AcctUpdateTime = TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), AcctSessionTime = (%{%{integer:Event-Timestamp}:-%l} - EXTRACT(EPOCH FROM(AcctStartTime))), AcctTerminateCause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE AcctStopTime IS NULL AND NASIPAddress= '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' AND AcctStartTime <= TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l})" } start { query = "INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_Stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIpAddress, FramedIpv6Address, FramedIpv6Prefix, FramedInterfaceId, DelegatedIpv6Prefix ) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}', NULLIF('%{%{NAS-Port-ID}:-%{NAS-Port}}', ''), '%{NAS-Port-Type}', TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), NULL, 0, '%{Acct-Authentic}', '%{Connect-Info}', NULL, 0, 0, '%{Called-Station-Id}', '%{Calling-Station-Id}', NULL, '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, NULLIF('%{Framed-IPv6-Address}', '')::inet, NULLIF('%{Framed-IPv6-Prefix}', '')::inet, NULLIF('%{Framed-Interface-Id}', ''), NULLIF('%{Delegated-IPv6-Prefix}', '')::inet ) ON CONFLICT (AcctUniqueId) DO UPDATE SET AcctStartTime = TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), AcctUpdateTime = TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), ConnectInfo_start = '%{Connect-Info}' WHERE radacct.AcctUniqueId = '%{Acct-Unique-Session-Id}' AND radacct.AcctStopTime IS NULL" } interim-update { query = "UPDATE radacct SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, FramedIPv6Address = NULLIF('%{Framed-IPv6-Address}', '')::inet, FramedIPv6Prefix = NULLIF('%{Framed-IPv6-Prefix}', '')::inet, FramedInterfaceId = NULLIF('%{Framed-Interface-Id}', ''), DelegatedIPv6Prefix = NULLIF('%{Delegated-IPv6-Prefix}', '')::inet, AcctSessionTime = %{%{Acct-Session-Time}:-NULL}, AcctInterval = (%{%{integer:Event-Timestamp}:-%l} - EXTRACT(EPOCH FROM (COALESCE(AcctUpdateTime, AcctStartTime)))), AcctUpdateTime = TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND AcctStopTime IS NULL" } stop { query = "UPDATE radacct SET AcctStopTime = TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), AcctUpdateTime = TO_TIMESTAMP(%{%{integer:Event-Timestamp}:-%l}), AcctSessionTime = COALESCE(%{%{Acct-Session-Time}:-NULL}, (%{%{integer:Event-Timestamp}:-%l} - EXTRACT(EPOCH FROM(AcctStartTime)))), AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), AcctTerminateCause = '%{Acct-Terminate-Cause}', FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, FramedIPv6Address = NULLIF('%{Framed-IPv6-Address}', '')::inet, FramedIPv6Prefix = NULLIF('%{Framed-IPv6-Prefix}', '')::inet, FramedInterfaceId = NULLIF('%{Framed-Interface-Id}', ''), DelegatedIPv6Prefix = NULLIF('%{Delegated-IPv6-Prefix}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND AcctStopTime IS NULL" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES('%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )" } } rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 dedup_key = "" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_proxy_rate_limit # Loading module "proxy_rate_limit" from file /etc/freeradius/mods-enabled/proxy_rate_limit proxy_rate_limit { max_entries = 2048 idle_timeout = 10 num_subtables = 256 window = 1 } # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_totp # Loading module "totp" from file /etc/freeradius/mods-enabled/totp totp { time_step = 30 otp_length = 6 lookback_steps = 1 lookback_interval = 30 lookforward_steps = 0 } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients instantiate { # Instantiating module "sql" from file /etc/freeradius/mods-enabled/sql postgresql { send_application_name = yes } rlm_sql (sql): Attempting to connect to database "host=psqlfreeradius.postgres.database.azure.com port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslrootcert=/etc/ssl/certs/MSCerts.pem" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 max_retries = 5 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_postgresql: Connecting using parameters: host=psqlfreeradius.postgres.database.azure.com port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslrootcert=/etc/ssl/certs/MSCerts.pem application_name='FreeRADIUS 3.2.8 - radiusd (sql)' rlm_sql_postgresql: Connection failed: connection to server at "psqlfreeradius.postgres.database.azure.com" (10.86.36.196), port 5432 failed: could not open certificate file "/root/.postgresql/postgresql.crt": Permission denied rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /etc/freeradius/mods-enabled/sql[27]: Instantiation failed for module "sql" Thank you in advance for any guidance. Kind regards Sam

2 2

v4 include v3 dictionary alias file - error
by James Wood 30 Mar '26

30 Mar '26

On the latest v4 dev version I am trying to include a v3 ALIAS dictionary file (shipped with the source) for some testing. In the main dictionary file, I am using: $INCLUDE dict/v3/dictionary.aruba # cat dict/v3/dictionary.aruba ALIAS Aruba-User-Role 26.14823.1 ALIAS Aruba-User-Vlan 26.14823.2 ALIAS Aruba-Priv-Admin-User 26.14823.3 ALIAS Aruba-Admin-Role 26.14823.4 ALIAS Aruba-Essid-Name 26.14823.5 ALIAS Aruba-Location-Id 26.14823.6 ALIAS Aruba-Port-Identifier 26.14823.7 ALIAS Aruba-MMS-User-Template 26.14823.8 ALIAS Aruba-Named-User-Vlan 26.14823.9 [snip] But the server errors upon start: Failed reading site-local dictionary: Out of memory Failed parsing dictionary at /usr/local/etc/raddb/dict/v3/dictionary.aruba[1] from $INCLUDE at /usr/local/etc/raddb/dictionary[181] Failed parsing dictionary at /usr/local/etc/raddb/dictionary[181] I tried other v3 ALIAS files and the same so not Aruba specific. Any ideas? The server starts and runs perfectly fine without this include line. Thanks, James -- Visit purple.ai <https://purple.ai/> Purple on LinkedIn <https://uk.linkedin.com/company/purple-wifi> Email disclaimer <http://www.purple.ai/email-disclaimer/>

2 5

v4 how to insert reply attributes in the radpostauth sql query?
by James Wood 25 Mar '26

25 Mar '26

I'm playing around with v4 and one thing I can't get working is how to insert all of the mapped reply attributes when I insert into the SQL radpostauth table. Just before we perform the insert, I am trying to get all of the reply attributes we're sending as described here: https://www.freeradius.org/documentation/freeradius-server/4.0.0/reference/… &control.Tmp-String-9 := "%pairs.print(reply.[*])" and then referencing the tmp string on the query. I get: %pairs.print(reply.[*]) ^: Unresolved expansion functions are not allowed here Any thoughts? If this isn't the right way, please advise how I can get these reply attributes into a string ready for the sql insert. Thanks James -- Visit purple.ai <https://purple.ai/> Purple on LinkedIn <https://uk.linkedin.com/company/purple-wifi> Email disclaimer <http://www.purple.ai/email-disclaimer/>

2 4

rlm_rest: update attributes on http/401 response?
by GIRSTMAIR Tobias 25 Mar '26

25 Mar '26

Hi all, we are using the rlm_rest module to make authentication decisions. we would like to pass the rejection reason our REST API came up with back to FreeRadius for logging with rlm_sqllog. We managed to pass attributes back when returning a JSON payload with http/200 (accept), but it doesn't work for http/401 (reject). Is there a way during a reject to signal some log message from the REST API back to freeradius (like it works during accept)? I've noticed that the documentation says the following: # Authorize/Authenticate # # Code Meaning Process body Module code # 401 unauthorized yes reject # 2xx successful yes ok/updated but also: # If the body is processed and found to contain attribute updated will be returned, # except in the case of a 401 code. As far as I understand, "Process body = yes" should mean that attributes are updated, except for the case of 401, where this doesn't happen. Here's a rough sketch of our setup and what we tried: We have configured a REST request in the authorize and post-auth sections. When a client is allowed into the network, a http/200 message with this payload (and corresponding content-type header) is returned from our REST API: { "Extreme-Netlogin-Extended-Vlan":"UvlanWhatever", "control:mycompany-vlan":"vlanWhatever" } FreeRADIUS correctly parses this and adds the VLAN tag in the response headed to the NAS, and the "control:" are available for use, like in the snippet below. server default { post-auth { if (&control:mycompany-vlan == "vlanSpecialCase") { update control { Auth-Type := Accept mycompany-reject-reason := "none" } } else { eap } } } we save some extra detail in `mycompany-reject-reason`. This is then stored in our logs. That works beautifully. However, when a client is rejected, we would like to also update `mycompany-reject-reason` but with the rejection message coming from the REST call, which returns a http/401 like this: { "control:mycompany-reason": "why the client was rejected" } we have tried to then update the `mycompany-reason` unlang attribute: server default { post-auth { Post-Auth-Type REJECT { update control { mycompany-reject-reason := &control:mycompany-reason } } } However, this does not work: no attributes are updated, and this gets pritned to the logs: Tue Mar 24 15:07:29 2026 : ERROR: (822634) rest: ERROR: Server returned: Tue Mar 24 15:07:29 2026 : ERROR: (822634) rest: ERROR: {"control:mycompany-reason":"the failure message"} Tue Mar 24 15:07:29 2026 : Auth: (822634) Rejected in post-auth: [user(a)example.com/<via Auth-Type = eap>] (from client nas01.example.com port 0 cli aabbccddeeff)

3 4

Error: Failed reading DHCP socket: No child processes
by Ľudovít Mikula 24 Mar '26

24 Mar '26

Hi all, I have migrated my freeradius 3.2.3 setup to a new RHEL9 server and am seeing this error message sometimes after a request is finished: (0) Finished request (0) Cleaning up request packet ID 3401348380 with timestamp +7 due to done Ready to process requests Failed reading DHCP socket: No child processes Ready to process requests Failed reading DHCP socket: No child processes Ready to process requests Any hints or clues to what might be causing it or what to check/configure? -- Ľudo Mikula

3 3

Simultaneous-Use with EAP
by Matthew 19 Mar '26

19 Mar '26

I'm very new to using FreeRadius and apologize I don't have a lot of technical knowledge about it. I am setting up FreeRadius with a WAP2-Enterprise wifi network, with the FreeRadius server configured from my Ubiquiti access points. I set up the sql module, and made sure "sql" was listed under the "authorize" and "session" sections of by site's (default) configuration. I also enabled accounting and everything seemed to be working. I added users to the radcheck table with cleartext passwords. I added a Simultaneous-Use line for my user, but it always seemed to be ignored. After a lot of searching, I've discovered that my 'default' config was being used for the 'outer' authentication (eap), and then the "inner-tunnel" config was being used for actual authentication. This already has the sql option under "authorize", but not in "session". Adding "sql" to the "session" section of /etc/freeradius/sites-enabled/inner-tunnel is what finally allowed Simultaneous-Use checking. I'm posting this because this didn't seem to be documented (here: https://www.freeradius.org/documentation/freeradius-server/3.2.9/howto/simu…) It would have been helpful to have a hint about the inner-tunnel configuration when using eap authentication. I'm not looking for more help at the moment, other than that I am wondering if there is a way to constrain simultaneous connections for all users at once. The Simultaneous-Use query doesn't look for a DEFAULT line in the mysql database. Matthew

2 3