- Freeradius-Users - lists.freeradius.org

TEAP Chaining and Partial Success Policies
by Jan Kříž 10 Feb '26

10 Feb '26

Hello everyone, I'm following up on a thread from with the subject of "EAP-TEAP not doing 2nd inner Method" from December 2024 (https://lists.freeradius.org/pipermail/freeradius-users/2024-December/10515…) about TEAP and setting network policies based on partial success (e.g., Machine cert succeeds, but User cert fails). I would specifically like to ask for clarification about something Alan DeKok wrote in the mentioned thread: > Exactly. None of the implementations (even Windows) support this workflow. I agree that the client side is a huge hurdle here, but I’m confused because some commercial platforms like Cisco ISE and Aruba ClearPass explicitly advertise and allow admins to configure different VLANs/ACLs precisely for that partial success scenario. Since the commercial vendors seem to have found a way to achieve this, are they relying on some vendor-specific extensions or a different, non-TEAP chaining method entirely? Is it possible to configure this in FreeRADIUS at all? Any insight into how FreeRADIUS could be configured to accurately process the final result and differentiate between Machine-only, User-only success and Full success would be hugely helpful. Thanks for the clarification! Best regards, Jan K.

3 5

question regarding the Framed-MTU and the fragment_size in EAP
by Dave Wang 09 Feb '26

09 Feb '26

Hi, I noticed that in our aruba switch, it refused to work after eap-tls if I left the default config for EAP-TLS fragment_size. And what happened is, aruba switch does not send Framed-MTU in radius request, freeradius uses the fragment_size to do calculation, but in the Access-Accept response, it sends a radius attribute Framed-MTU, with value calculated based on fragment_size. However, I do not understand why freeradius sends the Framed-MTU based on the fragment_size, as it seems these two are not directly linked. The Framed-MTU is more or less used to set the MTU for this user for the following traffic. but the fragment_size is used to decide how we do the fragment in eap, and the value is restricted by the link between NAS and freeradius. Suppose the max-MTU between NAS and freeradius is 1000, so we need to set the fragment_size to be a smaller value in order to make the EAP works, but if the other links the NAS used have a higher max-MTU (say 1500), there is no reason to restrict the max-MTU to be 1000 in the end. Any reason behind how the Framed-MTU is set in the EAP-TLS case based on the fragment_size? Regards, Dave

2 1

Guidelines for upgrading freeradius installation? (3.0.19 -> 3.2.8)
by uj2.hahn＠posteo.de 29 Jan '26

29 Jan '26

Hi, all! Years ago (2020) I implemented a pretty basic freeradius installation (authentication only) in a school for WLAN access. That time I installed version 3.0.19 on a virtual server (Ubuntu 19.04) and used Samba to connect to Active Directory on Windows Server. This is still working fine but I think it is time for a larger upgrade of all involved components. Is there any recommendation/cookbook/guideline how to do that upgrade in the most efficient way with minimal effort? Of course I can do everything from scratch on a second virtual machine. Is that the preferred way? Or can I copy the freeradius configuration over? Any changes I have to do then? Your help is very welcome! Regards Uwe

3 3

Re: Freeradius-Users Digest, Vol 249, Issue 17
by Ciummi 26 Jan '26

26 Jan '26

Hi, When is version 3.2.9 expected to be officially released? BR Andrea Il giorno sab 24 gen 2026 alle ore 13:00 < freeradius-users-request(a)lists.freeradius.org> ha scritto: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: FreeRADIUS v.3.2.8 - preprocess: ERROR: regex evaluation > failed with code (-51): NULL argument passed with non-zero length > (Alan DeKok) > 2. Policy on AI Agents (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 23 Jan 2026 07:59:45 -0500 > From: Alan DeKok <alan.dekok(a)inkbridge.io> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Cc: luciana.coppola(a)yahoo.it > Subject: Re: FreeRADIUS v.3.2.8 - preprocess: ERROR: regex evaluation > failed with code (-51): NULL argument passed with non-zero length > Message-ID: <57D78A3C-62EC-47E5-906A-6DBB00C784AD(a)inkbridge.io> > Content-Type: text/plain; charset="utf-8" > > On Jan 23, 2026, at 3:57?AM, Ciummi <ciummi(a)gmail.com> wrote: > > I was using FreeRADIUS version 3.2.6 for x86_64-redhat-linux-gnu (Red Hat > > Enterprise Linux release 9.4), > > with Oracle Database 19 as the backend. > > > > I encountered some memory issues, so I upgraded to version 3.2.8, > > ... > > Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation > > failed with code (-51): NULL argument passed with non-zero length > > The PCRE libraries use a JIT, and the local OS has disabled JIT > compilation. You can either enable that (somehow) locally, or just the > v3.2.x branch from GitHub. > > We've already pushed a fix for this, which will be in 3.2.9. > > Alan DeKok. > > >

2 1

Freeradius Binary for Debian 13 trixie
by Conrad Classen 26 Jan '26

26 Jan '26

Hi I would like to to know when/if the binary for Freeradius will be provided that will install on Debian 13 trixie? The version for Debian 12 bookworm fails using the packages.inkbridgenetworks.com provided. The following packages have unmet dependencies: freeradius : Depends: libperl5.36 (>= 5.36.0) but it is not installable Recommends: freeradius-python3 but it is not going to be installed freeradius-utils : Depends: libpcre3 but it is not installable libfreeradius3 : Depends: libpcre3 but it is not installable Many Thanks Con

2 1

I want to contribute to the project
by Agung Riyadi 24 Jan '26

24 Jan '26

First contribution I want to share my docker setup for anyone who need quick Freeradius+postgresql+backend(nodejs)+adminer in ~5 minutes. Just run the script from terminal. : Ready OUT-OF-THE-BOX to use packages bundle, with 4 services in docker-compose.yml configuration: 1. freeradius server 3.2.7 as radius server. 2. postgresql 17 3. nodejs backend (akses: http://host_ip_address:5000) as basic custom UI that can be use as basis of developing. 4. adminer (http://host_ip_address:8082) as additional general UI that can directly access the database. Requirement: 1. Internet connection ON the host. 2. Linux host with sudo or root access. 3. docker and docker compose must be installed. I use docker -v Docker version 29.1.5, build 0e6fee6 and I was using this script to install docker : curl -fsSL https://get.docker.com | sh 4. bash terminal 5. git must be installed. JUST COPY ALL THE SCRIPT TO THE TERMINAL. Usage : ```bash # Must run in bash shell because of hostip.sh need it (cant use sh shell). # Store the directory name in a variable project_name="radiusapp" target_dir=$project_name # you can change to any literal string as directory name # Check if the directory exists, and create it if it doesn't if [ ! -d "$target_dir" ]; then mkdir -p "$target_dir" cd "$target_dir" || exit 1 git clone https://github.com/lfsegoro/"$project_name".git . else cd "$target_dir" || exit 1 git pull # !!WARNING!! this will overwrite the directory content fi # to get the variable needed set HOST_IP=$(bash ./backend/hostip.sh) #export HOST_IP echo "HOST_IP=$HOST_IP" > ./.env # build process docker compose build --no-cache ################################################### # If you already do above you can also run below # so you dont need to git clone and build again # optional : docker rm -f $(docker ps -aq -f status=exited) >/dev/null 2>&1 || true docker network prune -f >/dev/null 2>&1 || true docker compose up true ``` 4. Let the the script do autmatic pull and installing. 5. access from the UI. http://host_ip_address:5000 or http://host_ip_address:8082 6. test using Ntradping or directly from NAS like mikrotik. You can learn the detail on the docker-compose.yml if you want to see the password or make modification. The database already have sample username for testing. you can check the radcheck table. You can test using ntradping or directly from a NAS like mikrotik. Detailed note: - username and password user testing, 1 entry in 'radcheck' table. - all host/nas allowed, to see the secret: 1 entry in 'nas' table. - adminer can have access to all table, make sure choose Postgresql, dbHost ip ADDRESS, username/password you can see in docker-compose.yml - the only difference with default freeradius config is modified modules only 'sql' inside the /etc/freeradius/mods-enable - it collude many ports udp and tcp, 1812, 1813, 3799, 5432, 5000, 8082, 8080. if you doing this kind of thing over and over you will learn a lot backend, frontend and tcp/ip etc.

1 0

Policy on AI Agents
by Alan DeKok 23 Jan '26

23 Jan '26

We've started to get PRs which are untested AI slop. As such, we've created a policy to clarify when / where AI can be used. In short, AI is good for API completion, summaries, suggesting certain docs. PRs which are clearly untested AI slop will result in the submitter being banned from the GitHub repository. There isn't enough time in the day to review untested garbage code. https://github.com/FreeRADIUS/freeradius-server/blob/master/AGENTS.md

1 0

FreeRADIUS v.3.2.8 - preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length
by Ciummi 23 Jan '26

23 Jan '26

Hi everyone, I was using FreeRADIUS version 3.2.6 for x86_64-redhat-linux-gnu (Red Hat Enterprise Linux release 9.4), with Oracle Database 19 as the backend. I encountered some memory issues, so I upgraded to version 3.2.8, but the configuration in the preprocessing hints file, which was working perfectly with version 3.2.6, no longer works. DEFAULT Called-Station-Id =~ ".*491113$", User-Name =~ "^([^@]*)@((?i)libero.*)", Strip-User-Name = Yes Hint = "Access", Stripped-User-Name = "%{1}", Realm = "%{2}" 1) Version 3.2.6 echo "User-Name=brignani@libero.it,User-Password=******,Calling-Station-Id=_TEST-SDWAN-A0001,Called-Station-Id=755491113" | radclient -x 10.10.0.221:1812 auth "pippo" Sent Access-Request Id 3 from 0.0.0.0:55865 to xx.xx.x.xxx:1812 length 106 Message-Authenticator = 0x User-Name = "brignani(a)libero.it" User-Password = "******" Calling-Station-Id = "_TEST-SDWAN-A0001" Called-Station-Id = "755491113" Cleartext-Password = "******" Received Access-Accept Id 3 from xx.xx.x.xxx:1812 to xx.xx.x.xxx:55865 length 138 Service-Type = Framed-User Framed-Protocol = PPP Class = 0x415f313736393030393530385f4e413d554e4b4e4f574e5f313030303232375f323235373832365f313030303038385f313030303030305f313030305f595f4e5f305f313030303330385f305f4141413a7261643031 Message-Authenticator = 0xa0a3af25b5ebba0db2ad8f374aa7f5b4 Wed Jan 21 16:31:48 2026 : Debug: (0) EXPAND %{debug:3} Wed Jan 21 16:31:48 2026 : Debug: (0) --> 0 Wed Jan 21 16:31:48 2026 : Debug: (0) } # update control = noop Wed Jan 21 16:31:48 2026 : Debug: (0) } # if (true == "true") = noop Wed Jan 21 16:31:48 2026 : Debug: (0) } # policy debug-rule = noop Wed Jan 21 16:31:48 2026 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND ^([^@]*)@((?i) greenlake.it)$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> ^([^@]*)@((?i) greenlake.it)$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND ^([^@]*)@((?i) noise.it)$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> ^([^@]*)@((?i) noise.it)$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0000$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0000$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*2990$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*2990$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*1010$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*1010$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*491113$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*491113$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND ^([^@]*)@((?i)libero.*) Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> ^([^@]*)@((?i)libero.*) Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: hints: Matched DEFAULT at 138 Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND %{1} Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> brignani Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND %{2} Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> libero.it Wed Jan 21 16:31:48 2026 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Jan 21 16:31:48 2026 : Debug: (0) [preprocess] = ok Wed Jan 21 16:31:48 2026 : Debug: (0) if (!&request:User-Name) { Wed Jan 21 16:31:48 2026 : Debug: (0) if (!&request:User-Name) -> FALSE Wed Jan 21 16:31:48 2026 : Debug: (0) policy nas-info { Wed Jan 21 16:31:48 2026 : Debug: (0) update control { Wed Jan 21 16:31:48 2026 : Debug: (0) } # update control = noop Wed Jan 21 16:31:48 2026 : Debug: (0) modsingle[authorize]: calling cache-nas (rlm_cache) Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: EXPAND %{NAS-IP-Address} Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: --> xx.xx.x.xxx Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: Mutex acquired Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: No cache entry found for "xx.xx.x.xxx" Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: Mutex released Wed Jan 21 16:31:48 2026 : Debug: (0) modsingle[authorize]: returned from cache-nas (rlm_cache) Wed Jan 21 16:31:48 2026 : Debug: (0) [cache-nas] = notfound Wed Jan 21 16:31:48 2026 : Debug: (0) if (notfound) { Wed Jan 21 16:31:48 2026 : Debug: (0) if (notfound) -> TRUE Wed Jan 21 16:31:48 2026 : Debug: (0) if (notfound) { Wed Jan 21 16:31:48 2026 : Debug: (0) update control { Wed Jan 21 16:31:48 2026 : Debug: (0) EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed Jan 21 16:31:48 2026 : Debug: (0) --> brignani Wed Jan 21 16:31:48 2026 : Debug: (0) SQL-User-Name set to 'brignani' 2) Version 3.2.8 [root@glaaarad01 ~]# echo "User-Name=brignani@libero.it,User-Password=******,Calling-Station-Id=_TEST-SDWAN-A0001,Called-Station-Id=755491113" | radclient -x 10.10.1.217:1812 auth "pippo" Sent Access-Request Id 9 from 0.0.0.0:48083 to xx.xx.x.xxx:1812 length 106 User-Name = "brignani(a)libero.it" User-Password = "******" Calling-Station-Id = "_TEST-SDWAN-A0001" Called-Station-Id = "755491113" Cleartext-Password = "******" Received Access-Reject Id 9 from xx.xx.x.xxx:1812 to xx.xx.x.xxx:48083 length 38 Message-Authenticator = 0xbca819113f66bc3aa5b2f79c3aef6ecc (0) -: Expected Access-Accept got Access-Reject Wed Jan 21 16:36:50 2026 : Debug: (0) EXPAND %{debug:3} Wed Jan 21 16:36:50 2026 : Debug: (0) --> 0 Wed Jan 21 16:36:50 2026 : Debug: (0) } # update control = noop Wed Jan 21 16:36:50 2026 : Debug: (0) } # if (true == "true") = noop Wed Jan 21 16:36:50 2026 : Debug: (0) } # policy debug-rule = noop Wed Jan 21 16:36:50 2026 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length ... Wed Jan 21 16:36:50 2026 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Jan 21 16:36:50 2026 : Debug: (0) [preprocess] = ok Wed Jan 21 16:36:50 2026 : Debug: (0) if (!&request:User-Name) { Wed Jan 21 16:36:50 2026 : Debug: (0) if (!&request:User-Name) -> FALSE Wed Jan 21 16:36:50 2026 : Debug: (0) policy nas-info { Wed Jan 21 16:36:50 2026 : Debug: (0) update control { Wed Jan 21 16:36:50 2026 : Debug: (0) } # update control = noop Wed Jan 21 16:36:50 2026 : Debug: (0) modsingle[authorize]: calling cache-nas (rlm_cache) Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: EXPAND %{NAS-IP-Address} Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: --> xx.xx.x.xxx Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: Mutex acquired Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: No cache entry found for "xx.xx.x.xxx" Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: Mutex released Wed Jan 21 16:36:50 2026 : Debug: (0) modsingle[authorize]: returned from cache-nas (rlm_cache) Wed Jan 21 16:36:50 2026 : Debug: (0) [cache-nas] = notfound Wed Jan 21 16:36:50 2026 : Debug: (0) if (notfound) { Wed Jan 21 16:36:50 2026 : Debug: (0) if (notfound) -> TRUE Wed Jan 21 16:36:50 2026 : Debug: (0) if (notfound) { Wed Jan 21 16:36:50 2026 : Debug: (0) update control { Wed Jan 21 16:36:50 2026 : Debug: (0) EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed Jan 21 16:36:50 2026 : Debug: (0) --> brignani(a)libero.it Kind regards, Andrea

2 1

Forward copy of accounting events
by Karl Frauendienst 21 Jan '26

21 Jan '26

Good morning, I'm on my second FreeRADIUS installation, so I'm still getting a feel for how it works. It's authenticating WiFi users against Active Directory using the winbind + LDAP method described on the website. I have the winbind authentication and LDAP attribute checks working, and users are able to successfully connect, but I'm stuck on something with the accounting. This network has a device that tracks user logon events by receiving RADIUS accounting events (essentially keeps up with what user is on what IP address), but it's not really suitable as the only accounting server when it comes to troubleshooting or other matters. What I need is for FreeRADIUS to continue logging accounting events to disk as it is currently, but I need an additional copy of accounting events forwarded to another IP address. I know how to do this in Windows NPS, but I'm still trying to wrap my head around how to configure that in FreeRADIUS. I'm running FreeRADIUS 3.2.8 on Ubuntu Server 24.0.3. Thanks Karl > FreeRADIUS Version 3.2.8 > Copyright (C) 1999-2025 The FreeRADIUS server project and contributors > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License > For more information about these matters, see the file named COPYRIGHT > > FreeRADIUS is developed, maintained, and supported by InkBridge > Networks. > For commercial support, please email sales(a)inkbridgenetworks.com > https://inkbridgenetworks.com/ > Starting - reading configuration files ... > including dictionary file /usr/share/freeradius/dictionary > including dictionary file /usr/share/freeradius/dictionary.dhcp > including dictionary file /usr/share/freeradius/dictionary.vqp > including dictionary file /etc/freeradius/dictionary > including configuration file /etc/freeradius/radiusd.conf > including configuration file /etc/freeradius/proxy.conf > including configuration file /etc/freeradius/clients.conf > including files in directory /etc/freeradius/mods-enabled/ > including configuration file /etc/freeradius/mods-enabled/detail > including configuration file /etc/freeradius/mods-enabled/pap > including configuration file /etc/freeradius/mods-enabled/detail.log > including configuration file /etc/freeradius/mods-enabled/eap > including configuration file > /etc/freeradius/mods-enabled/proxy_rate_limit > including configuration file /etc/freeradius/mods-enabled/files > including configuration file /etc/freeradius/mods-enabled/date > including configuration file /etc/freeradius/mods-enabled/digest > including configuration file /etc/freeradius/mods-enabled/realm > including configuration file /etc/freeradius/mods-enabled/cache_auth > including configuration file /etc/freeradius/mods-enabled/attr_filter > including configuration file /etc/freeradius/mods-enabled/exec > including configuration file /etc/freeradius/mods-enabled/preprocess > including configuration file /etc/freeradius/mods-enabled/radutmp > including configuration file /etc/freeradius/mods-enabled/sradutmp > including configuration file /etc/freeradius/mods-enabled/utf8 > including configuration file /etc/freeradius/mods-enabled/ntlm_auth > including configuration file /etc/freeradius/mods-enabled/mschap > including configuration file /etc/freeradius/mods-enabled/unpack > including configuration file /etc/freeradius/mods-enabled/ldap > including configuration file /etc/freeradius/mods-enabled/soh > including configuration file /etc/freeradius/mods-enabled/logintime > including configuration file /etc/freeradius/mods-enabled/passwd > including configuration file /etc/freeradius/mods-enabled/always > including configuration file /etc/freeradius/mods-enabled/echo > including configuration file /etc/freeradius/mods-enabled/expiration > including configuration file /etc/freeradius/mods-enabled/unix > including configuration file > /etc/freeradius/mods-enabled/dynamic_clients > including configuration file /etc/freeradius/mods-enabled/linelog > including configuration file /etc/freeradius/mods-enabled/expr > including configuration file /etc/freeradius/mods-enabled/replicate > including configuration file /etc/freeradius/mods-enabled/totp > including configuration file /etc/freeradius/mods-enabled/chap > including files in directory /etc/freeradius/policy.d/ > including configuration file /etc/freeradius/policy.d/eap > including configuration file /etc/freeradius/policy.d/dhcp > including configuration file /etc/freeradius/policy.d/accounting > including configuration file /etc/freeradius/policy.d/debug > including configuration file /etc/freeradius/policy.d/filter > including configuration file /etc/freeradius/policy.d/abfab-tr > including configuration file /etc/freeradius/policy.d/canonicalization > including configuration file /etc/freeradius/policy.d/control > including configuration file /etc/freeradius/policy.d/operator-name > including configuration file /etc/freeradius/policy.d/rfc7542 > including configuration file > /etc/freeradius/policy.d/moonshot-targeted-ids > including configuration file /etc/freeradius/policy.d/cui > including files in directory /etc/freeradius/sites-enabled/ > including configuration file > /etc/freeradius/sites-enabled/inner-tunnel > including configuration file /etc/freeradius/sites-enabled/default > main { > security { > user = "freerad" > group = "freerad" > allow_core_dumps = no > } > name = "freeradius" > prefix = "/usr" > localstatedir = "/var" > logdir = "/var/log/freeradius" > run_dir = "/var/run/freeradius" > } > main { > name = "freeradius" > prefix = "/usr" > localstatedir = "/var" > sbindir = "/usr/sbin" > logdir = "/var/log/freeradius" > run_dir = "/var/run/freeradius" > libdir = "/usr/lib/freeradius" > radacctdir = "/var/log/freeradius/radacct" > hostname_lookups = no > max_request_time = 30 > proxy_dedup_window = 1 > cleanup_delay = 5 > max_requests = 16384 > max_fds = 512 > postauth_client_lost = no > pidfile = "/var/run/freeradius/freeradius.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > colourise = yes > msg_denied = "You are already logged in - access denied" > } > resources { > } > security { > max_attributes = 200 > reject_delay = 1.000000 > delay_proxy_rejects = no > status_server = yes > require_message_authenticator = "auto" > limit_proxy_state = "auto" > } > unlang { > group_stop_return = no > policy_stop_return = no > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > nonblock = no > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = <<< secret >>> > response_window = 20.000000 > response_timeouts = 1 > max_outstanding = 65536 > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > check_timeout = 4 > num_answers_to_alive = 3 > revive_interval = 120 > limit { > max_connections = 16 > max_requests = 0 > lifetime = 0 > idle_timeout = 0 > } > coa { > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > } > home_server linewize { > nonblock = no > ipaddr = <<< secret >>> > port = 1813 > type = "acct" > secret = <<< secret >>> > response_window = 30.000000 > response_timeouts = 1 > max_outstanding = 65536 > zombie_period = 40 > status_check = "none" > ping_interval = 30 > check_timeout = 4 > num_answers_to_alive = 3 > revive_interval = 300 > limit { > max_connections = 16 > max_requests = 0 > lifetime = 0 > idle_timeout = 0 > } > coa { > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client access_points { > ipaddr = <<< secret >>> > require_message_authenticator = "no" > secret = <<< secret >>> > proto = "*" > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > client localhost { > ipaddr = 127.0.0.1 > secret = <<< secret >>> > nas_type = "other" > proto = "*" > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 900 > } > } > Shared secret for client localhost is short, and likely can be > broken by an attacker. > client localhost_ipv6 { > ipv6addr = ::1 > secret = <<< secret >>> > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > Shared secret for client localhost_ipv6 is short, and likely can > be broken by an attacker. > Debugger not attached > Configuration version: 77e6-bd6c-9d72-6756 > # Creating Auth-Type = mschap > # Creating Auth-Type = eap > # Creating Auth-Type = PAP > # Creating Auth-Type = CHAP > # Creating Auth-Type = MS-CHAP > # Creating Auth-Type = digest > # Creating Autz-Type = New-TLS-Connection > radiusd: #### Instantiating modules #### > modules { > # Loaded module rlm_detail > # Loading module "detail" from file > /etc/freeradius/mods-enabled/detail > detail { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loaded module rlm_pap > # Loading module "pap" from file /etc/freeradius/mods-enabled/pap > pap { > normalise = yes > } > # Loading module "auth_log" from file > /etc/freeradius/mods-enabled/detail.log > detail auth_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loading module "reply_log" from file > /etc/freeradius/mods-enabled/detail.log > detail reply_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loading module "pre_proxy_log" from file > /etc/freeradius/mods-enabled/detail.log > detail pre_proxy_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loading module "post_proxy_log" from file > /etc/freeradius/mods-enabled/detail.log > detail post_proxy_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loaded module rlm_eap > # Loading module "eap" from file /etc/freeradius/mods-enabled/eap > eap { > default_eap_type = "md5" > timer_expire = 60 > max_eap_type = 52 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 16384 > dedup_key = "" > } > # Loaded module rlm_proxy_rate_limit > # Loading module "proxy_rate_limit" from file > /etc/freeradius/mods-enabled/proxy_rate_limit > proxy_rate_limit { > max_entries = 2048 > idle_timeout = 10 > num_subtables = 256 > window = 1 > } > # Loaded module rlm_files > # Loading module "files" from file > /etc/freeradius/mods-enabled/files > files { > filename = "/etc/freeradius/mods-config/files/authorize" > acctusersfile = "/etc/freeradius/mods-config/files/accounting" > preproxy_usersfile = > "/etc/freeradius/mods-config/files/pre-proxy" > } > # Loaded module rlm_date > # Loading module "date" from file /etc/freeradius/mods-enabled/date > date { > format = "%b %e %Y %H:%M:%S %Z" > utc = no > } > # Loading module "wispr2date" from file > /etc/freeradius/mods-enabled/date > date wispr2date { > format = "%Y-%m-%dT%H:%M:%S" > utc = no > } > # Loaded module rlm_digest > # Loading module "digest" from file > /etc/freeradius/mods-enabled/digest > # Loaded module rlm_realm > # Loading module "IPASS" from file > /etc/freeradius/mods-enabled/realm > realm IPASS { > format = "prefix" > delimiter = "/" > ignore_default = no > ignore_null = no > } > # Loading module "suffix" from file > /etc/freeradius/mods-enabled/realm > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > # Loading module "bangpath" from file > /etc/freeradius/mods-enabled/realm > realm bangpath { > format = "prefix" > delimiter = "!" > ignore_default = no > ignore_null = no > } > # Loading module "realmpercent" from file > /etc/freeradius/mods-enabled/realm > realm realmpercent { > format = "suffix" > delimiter = "%" > ignore_default = no > ignore_null = no > } > # Loading module "ntdomain" from file > /etc/freeradius/mods-enabled/realm > realm ntdomain { > format = "prefix" > delimiter = "\" > ignore_default = no > ignore_null = no > } > # Loaded module rlm_cache > # Loading module "cache_auth_accept" from file > /etc/freeradius/mods-enabled/cache_auth > cache cache_auth_accept { > driver = "rlm_cache_rbtree" > key = > "%{md5:%{%{Stripped-User-Name}:-%{User-Name}}%{User-Password}}" > ttl = 7200 > max_entries = 0 > epoch = 0 > add_stats = no > } > # Loading module "cache_auth_reject" from file > /etc/freeradius/mods-enabled/cache_auth > cache cache_auth_reject { > driver = "rlm_cache_rbtree" > key = > "%{md5:%{Calling-Station-Id}%{Stripped-User-Name}%{User-Password}}" > ttl = 3600 > max_entries = 0 > epoch = 0 > add_stats = no > } > # Loading module "cache_ldap_user_dn" from file > /etc/freeradius/mods-enabled/cache_auth > cache cache_ldap_user_dn { > driver = "rlm_cache_rbtree" > key = "%{Stripped-User-Name}" > ttl = 86400 > max_entries = 0 > epoch = 0 > add_stats = no > } > # Loaded module rlm_attr_filter > # Loading module "attr_filter.post-proxy" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.post-proxy { > filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" > key = "%{Realm}" > relaxed = no > } > # Loading module "attr_filter.pre-proxy" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.pre-proxy { > filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" > key = "%{Realm}" > relaxed = no > } > # Loading module "attr_filter.access_reject" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.access_reject { > filename = > "/etc/freeradius/mods-config/attr_filter/access_reject" > key = "%{User-Name}" > relaxed = no > } > # Loading module "attr_filter.access_challenge" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.access_challenge { > filename = > "/etc/freeradius/mods-config/attr_filter/access_challenge" > key = "%{User-Name}" > relaxed = no > } > # Loading module "attr_filter.accounting_response" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.accounting_response { > filename = > "/etc/freeradius/mods-config/attr_filter/accounting_response" > key = "%{User-Name}" > relaxed = no > } > # Loading module "attr_filter.coa" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.coa { > filename = "/etc/freeradius/mods-config/attr_filter/coa" > key = "%{User-Name}" > relaxed = no > } > # Loaded module rlm_exec > # Loading module "exec" from file /etc/freeradius/mods-enabled/exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > timeout = 10 > } > # Loaded module rlm_preprocess > # Loading module "preprocess" from file > /etc/freeradius/mods-enabled/preprocess > preprocess { > huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" > hints = "/etc/freeradius/mods-config/preprocess/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > # Loaded module rlm_radutmp > # Loading module "radutmp" from file > /etc/freeradius/mods-enabled/radutmp > radutmp { > filename = "/var/log/freeradius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > permissions = 384 > caller_id = yes > } > # Loading module "sradutmp" from file > /etc/freeradius/mods-enabled/sradutmp > radutmp sradutmp { > filename = "/var/log/freeradius/sradutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > permissions = 420 > caller_id = no > } > # Loaded module rlm_utf8 > # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 > # Loading module "ntlm_auth" from file > /etc/freeradius/mods-enabled/ntlm_auth > exec ntlm_auth { > wait = yes > program = "/path/to/ntlm_auth --request-nt-key > --domain=MYDOMAIN --username=%{mschap:User-Name} > --password=%{User-Password}" > shell_escape = yes > } > # Loaded module rlm_mschap > # Loading module "mschap" from file > /etc/freeradius/mods-enabled/mschap > mschap { > use_mppe = yes > require_encryption = yes > require_strong = yes > with_ntdomain_hack = yes > passchange { > } > allow_retry = yes > winbind_retry_with_normalised_username = no > } > # Loaded module rlm_unpack > # Loading module "unpack" from file > /etc/freeradius/mods-enabled/unpack > # Loaded module rlm_ldap > # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap > ldap { > server = <<< secret >>> > identity = <<< secret >>> > password = <<< secret >>> > sasl { > } > user_dn = "LDAP-UserDn" > user { > scope = "sub" > access_positive = yes > sasl { > } > } > group { > filter = "(objectClass=posixGroup)" > scope = "sub" > name_attribute = "cn" > membership_attribute = "memberOf" > cacheable_name = yes > cacheable_dn = yes > allow_dangling_group_ref = no > } > client { > filter = "(objectClass=radiusClient)" > scope = "sub" > base_dn = <<< secret >>> > } > profile { > } > options { > ldap_debug = 40 > chase_referrals = yes > rebind = yes > net_timeout = 1 > res_timeout = 10 > srv_timelimit = 3 > idle = 60 > probes = 3 > interval = 3 > } > tls { > cipher_list = "DEFAULT" > check_crl = no > start_tls = no > } > } > Creating attribute LDAP-Group > # Loaded module rlm_soh > # Loading module "soh" from file /etc/freeradius/mods-enabled/soh > soh { > dhcp = yes > } > # Loaded module rlm_logintime > # Loading module "logintime" from file > /etc/freeradius/mods-enabled/logintime > logintime { > minimum_timeout = 60 > } > # Loaded module rlm_passwd > # Loading module "etc_passwd" from file > /etc/freeradius/mods-enabled/passwd > passwd etc_passwd { > filename = "/etc/passwd" > format = "*User-Name:Crypt-Password:" > delimiter = ":" > ignore_nislike = no > ignore_empty = yes > allow_multiple_keys = no > hash_size = 100 > } > # Loaded module rlm_always > # Loading module "reject" from file > /etc/freeradius/mods-enabled/always > always reject { > rcode = "reject" > simulcount = 0 > mpp = no > } > # Loading module "fail" from file > /etc/freeradius/mods-enabled/always > always fail { > rcode = "fail" > simulcount = 0 > mpp = no > } > # Loading module "ok" from file /etc/freeradius/mods-enabled/always > always ok { > rcode = "ok" > simulcount = 0 > mpp = no > } > # Loading module "handled" from file > /etc/freeradius/mods-enabled/always > always handled { > rcode = "handled" > simulcount = 0 > mpp = no > } > # Loading module "invalid" from file > /etc/freeradius/mods-enabled/always > always invalid { > rcode = "invalid" > simulcount = 0 > mpp = no > } > # Loading module "userlock" from file > /etc/freeradius/mods-enabled/always > always userlock { > rcode = "userlock" > simulcount = 0 > mpp = no > } > # Loading module "notfound" from file > /etc/freeradius/mods-enabled/always > always notfound { > rcode = "notfound" > simulcount = 0 > mpp = no > } > # Loading module "noop" from file > /etc/freeradius/mods-enabled/always > always noop { > rcode = "noop" > simulcount = 0 > mpp = no > } > # Loading module "updated" from file > /etc/freeradius/mods-enabled/always > always updated { > rcode = "updated" > simulcount = 0 > mpp = no > } > # Loading module "echo" from file /etc/freeradius/mods-enabled/echo > exec echo { > wait = yes > program = "/bin/echo %{User-Name}" > input_pairs = "request" > output_pairs = "reply" > shell_escape = yes > } > # Loaded module rlm_expiration > # Loading module "expiration" from file > /etc/freeradius/mods-enabled/expiration > # Loaded module rlm_unix > # Loading module "unix" from file /etc/freeradius/mods-enabled/unix > unix { > radwtmp = "/var/log/freeradius/radwtmp" > } > Creating attribute Unix-Group > # Loaded module rlm_dynamic_clients > # Loading module "dynamic_clients" from file > /etc/freeradius/mods-enabled/dynamic_clients > # Loaded module rlm_linelog > # Loading module "linelog" from file > /etc/freeradius/mods-enabled/linelog > linelog { > filename = "/var/log/freeradius/linelog" > escape_filenames = no > syslog_severity = "info" > permissions = 384 > format = "This is a log message for %{User-Name}" > reference = "messages.%{%{reply:Packet-Type}:-default}" > } > # Loading module "log_accounting" from file > /etc/freeradius/mods-enabled/linelog > linelog log_accounting { > filename = "/var/log/freeradius/linelog-accounting" > escape_filenames = no > syslog_severity = "info" > permissions = 384 > format = "" > reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" > } > # Loaded module rlm_expr > # Loading module "expr" from file /etc/freeradius/mods-enabled/expr > expr { > safe_characters = > "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: > /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" > } > # Loaded module rlm_replicate > # Loading module "replicate" from file > /etc/freeradius/mods-enabled/replicate > # Loaded module rlm_totp > # Loading module "totp" from file /etc/freeradius/mods-enabled/totp > totp { > time_step = 30 > otp_length = 6 > lookback_steps = 1 > lookback_interval = 30 > lookforward_steps = 0 > } > # Loaded module rlm_chap > # Loading module "chap" from file /etc/freeradius/mods-enabled/chap > instantiate { > } > # Instantiating module "detail" from file > /etc/freeradius/mods-enabled/detail > # Instantiating module "pap" from file > /etc/freeradius/mods-enabled/pap > # Instantiating module "auth_log" from file > /etc/freeradius/mods-enabled/detail.log > rlm_detail (auth_log): 'User-Password' suppressed, will not appear > in detail output > # Instantiating module "reply_log" from file > /etc/freeradius/mods-enabled/detail.log > # Instantiating module "pre_proxy_log" from file > /etc/freeradius/mods-enabled/detail.log > # Instantiating module "post_proxy_log" from file > /etc/freeradius/mods-enabled/detail.log > # Instantiating module "eap" from file > /etc/freeradius/mods-enabled/eap > # Linked to sub-module rlm_eap_md5 > # Linked to sub-module rlm_eap_gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > # Linked to sub-module rlm_eap_tls > tls { > tls = "tls-common" > } > tls-config tls-common { > verify_depth = 0 > ca_path = "/etc/freeradius/certs" > pem_file_type = yes > private_key_file = "/etc/freeradius/certs/server.key" > certificate_file = "/etc/freeradius/certs/server.pem" > ca_file = "/etc/freeradius/certs/ca.pem" > private_key_password = <<< secret >>> > fragment_size = 1024 > include_length = yes > auto_chain = yes > check_crl = no > check_all_crl = no > ca_path_reload_interval = 0 > cipher_list = "DEFAULT" > cipher_server_preference = no > reject_unknown_intermediate_ca = no > ecdh_curve = "" > tls_max_version = "1.2" > tls_min_version = "1.2" > cache { > enable = yes > lifetime = 24 > max_entries = 255 > } > verify { > skip_if_ocsp_ok = no > } > ocsp { > enable = no > override_cert_url = yes > url = "http://127.0.0.1/ocsp/" > use_nonce = yes > timeout = 0 > softfail = no > } > } > # Linked to sub-module rlm_eap_ttls > ttls { > tls = "tls-common" > default_eap_type = "md5" > copy_request_to_tunnel = yes > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > require_client_cert = no > } > tls: Using cached TLS configuration from previous invocation > # Linked to sub-module rlm_eap_peap > peap { > tls = "tls-common" > default_eap_type = "mschapv2" > copy_request_to_tunnel = yes > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > soh = no > require_client_cert = no > } > tls: Using cached TLS configuration from previous invocation > # Linked to sub-module rlm_eap_mschapv2 > mschapv2 { > with_ntdomain_hack = no > send_error = no > identity = "CMSD-AAA" > } > # Instantiating module "proxy_rate_limit" from file > /etc/freeradius/mods-enabled/proxy_rate_limit > # Instantiating module "files" from file > /etc/freeradius/mods-enabled/files > reading pairlist file /etc/freeradius/mods-config/files/authorize > reading pairlist file /etc/freeradius/mods-config/files/accounting > reading pairlist file /etc/freeradius/mods-config/files/pre-proxy > # Instantiating module "IPASS" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "suffix" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "bangpath" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "realmpercent" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "ntdomain" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "cache_auth_accept" from file > /etc/freeradius/mods-enabled/cache_auth > rlm_cache (cache_auth_accept): Driver rlm_cache_rbtree (module > rlm_cache_rbtree) loaded and linked > # Instantiating module "cache_auth_reject" from file > /etc/freeradius/mods-enabled/cache_auth > rlm_cache (cache_auth_reject): Driver rlm_cache_rbtree (module > rlm_cache_rbtree) loaded and linked > # Instantiating module "cache_ldap_user_dn" from file > /etc/freeradius/mods-enabled/cache_auth > rlm_cache (cache_ldap_user_dn): Driver rlm_cache_rbtree (module > rlm_cache_rbtree) loaded and linked > # Instantiating module "attr_filter.post-proxy" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/post-proxy > # Instantiating module "attr_filter.pre-proxy" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/pre-proxy > # Instantiating module "attr_filter.access_reject" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/access_reject > # Instantiating module "attr_filter.access_challenge" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/access_challenge > # Instantiating module "attr_filter.accounting_response" from > file /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/accounting_response > # Instantiating module "attr_filter.coa" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file /etc/freeradius/mods-config/attr_filter/coa > # Instantiating module "preprocess" from file > /etc/freeradius/mods-enabled/preprocess > reading pairlist file > /etc/freeradius/mods-config/preprocess/huntgroups > reading pairlist file /etc/freeradius/mods-config/preprocess/hints > # Instantiating module "mschap" from file > /etc/freeradius/mods-enabled/mschap > rlm_mschap (mschap): Initialising connection pool > pool { > start = 5 > min = 3 > max = 32 > spare = 10 > uses = 0 > lifetime = 86400 > cleanup_interval = 300 > idle_timeout = 600 > retry_delay = 30 > max_retries = 5 > spread = no > } > rlm_mschap (mschap): authenticating directly to winbind > # Instantiating module "ldap" from file > /etc/freeradius/mods-enabled/ldap > rlm_ldap: libldap vendor: OpenLDAP, version: 20607 > accounting { > reference = "%{tolower:type.%{Acct-Status-Type}}" > } > post-auth { > reference = "." > } > rlm_ldap (ldap): Initialising connection pool > pool { > start = 5 > min = 3 > max = 32 > spare = 10 > uses = 0 > lifetime = 0 > cleanup_interval = 30 > idle_timeout = 60 > retry_delay = 30 > max_retries = 5 > spread = no > } > # Instantiating module "logintime" from file > /etc/freeradius/mods-enabled/logintime > # Instantiating module "etc_passwd" from file > /etc/freeradius/mods-enabled/passwd > rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no > # Instantiating module "reject" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "fail" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "ok" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "handled" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "invalid" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "userlock" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "notfound" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "noop" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "updated" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "expiration" from file > /etc/freeradius/mods-enabled/expiration > # Instantiating module "linelog" from file > /etc/freeradius/mods-enabled/linelog > # Instantiating module "log_accounting" from file > /etc/freeradius/mods-enabled/linelog > # Instantiating module "totp" from file > /etc/freeradius/mods-enabled/totp > } # modules > radiusd: #### Loading Virtual Servers #### > server { # from file /etc/freeradius/radiusd.conf > } # server > server inner-tunnel { # from file > /etc/freeradius/sites-enabled/inner-tunnel > # Loading authenticate {...} > Compiling Auth-Type PAP for attr Auth-Type > Compiling Auth-Type CHAP for attr Auth-Type > Compiling Auth-Type MS-CHAP for attr Auth-Type > # Loading authorize {...} > Ignoring "sql" (see raddb/mods-available/README.rst) > # Loading post-proxy {...} > # Loading post-auth {...} > # Skipping contents of 'if' as it is always 'false' -- > /etc/freeradius/sites-enabled/inner-tunnel:389 > Compiling Post-Auth-Type REJECT for attr Post-Auth-Type > } # server inner-tunnel > server default { # from file /etc/freeradius/sites-enabled/default > # Loading authenticate {...} > Compiling Auth-Type PAP for attr Auth-Type > Compiling Auth-Type CHAP for attr Auth-Type > Compiling Auth-Type MS-CHAP for attr Auth-Type > # Loading authorize {...} > Compiling Autz-Type New-TLS-Connection for attr Autz-Type > # Loading preacct {...} > # Loading accounting {...} > # Loading post-auth {...} > Compiling Post-Auth-Type REJECT for attr Post-Auth-Type > Compiling Post-Auth-Type Challenge for attr Post-Auth-Type > Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type > } # server default > radiusd: #### Skipping IP addresses and Ports #### > listen { > type = "auth" > ipaddr = 127.0.0.1 > port = 18120 > } > listen { > type = "auth" > ipaddr = * > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 900 > } > } > listen { > type = "acct" > ipaddr = * > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > listen { > type = "auth" > ipv6addr = :: > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > listen { > type = "acct" > ipv6addr = :: > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > Configuration appears to be OK

2 2

debug tls connection
by Jim Shi 20 Jan '26

20 Jan '26

I am trying to figure out tls connection is failing. Here is freeradius server log:can someone please provide come clue? 6) session-state: No cached attributes (6) # Executing section authorize from file /ngs/app/idmspp/freeradius/etc/raddb/sites-enabled/default (6) authorize { (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) eap: Peer sent EAP Response (code 2) ID 7 length 1276 (6) eap: No EAP Start, assuming it's an on-going EAP conversation (6) [eap] = updated (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = noop (6) } # authorize = updated (6) Found Auth-Type = eap (6) # Executing group from file /ngs/app/idmspp/freeradius/etc/raddb/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x39f46d743cf36072 (6) eap: Finished EAP session with state 0x39f46d743cf36072 (6) eap: Previous EAP request found for state 0x39f46d743cf36072, released from the list (6) eap: Peer sent packet with method EAP TLS (13) (6) eap: Calling submodule eap_tls to process data (6) eap_tls: Continuing EAP-TLS (6) eap_tls: Peer indicated complete TLS record size will be 3550 bytes (6) eap_tls: Expecting 3 TLS record fragments (6) eap_tls: Got first TLS record fragment (1266 bytes). Peer indicated more fragments to follow (6) eap_tls: [eaptls verify] = first fragment (6) eap_tls: ACKing Peer's TLS record fragment (6) eap_tls: [eaptls process] = handled (6) eap: Sending EAP Request (code 1) ID 8 length 6 (6) eap: EAP session adding &reply:State = 0x39f46d743ffc6072 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge

2 1