- Freeradius-Users - lists.freeradius.org

how to get module reply attributes in authenticate module
by bryan xiang 16 Oct '25

16 Oct '25

Hello Experts: I am testing customized rlm_jradius work with rlm_tacacs, the work flow is auth request go to rlm_jradius module firstly, if return the user should go to tacacs, then request will go to rlm_tacacs. below is the site config: server default { namespace = radius listen local{ type = Access-Request type = Status-Server transport = udp udp { ipaddr = 127.0.0.1 port = 1812 } } listen internal{ type = Access-Request type = Status-Server transport = udp udp { ipaddr = 169.254.195.0 port = 1812 } } listen external{ type = Access-Request type = Status-Server transport = udp udp { ipaddr = 10.76.56.89 port = 1812 } } authenticate JRADIUS { jradius if( ! ok && reply.Vendor-Specific.Lucent-VID.IsTacacsUser == "TRUE" ) { subrequest @tacacs::Authentication-Start { User-Name := parent.request.User-Name #User-Password := parent.request.User-Password Data := parent.request.User-Password Packet.Version-Major := 0xC Packet.Version-Minor := 0x1 Packet.Packet-Type := "Authentication" Packet.Sequence-Number := 1 Packet.Flags := "None" Packet.Session-Id := parent.request.Acct-Session-Id Packet.Length := 0 Authentication-Type := "PAP" Action := "Login" Authentication-Service := "Login" tacacs if (reply.Authentication-Status == "Pass") { parent.control.Auth-Type := "Accept" } else { parent.control.Auth-Type := "Reject" } } } } recv Access-Request { control.Auth-Type := ::JRADIUS } } The question is I want to get some reply attributes from jradius and decide if we should go to the subrequest for tacacs module, I tried some methods, but the reply is null. logs: (5) Thu Oct 16 09:56:15 2025 : Debug : Time tracking started in yielded state (5) Thu Oct 16 09:56:15 2025 : Debug : Request resuming (5) Thu Oct 16 09:56:15 2025 : Debug : default { (5) Thu Oct 16 09:56:15 2025 : Debug : Received Access-Request ID 125 from 169.254.131.0:38924 to 169.254.195.0:1812 via int0 (5) Thu Oct 16 09:56:15 2025 : Debug : User-Name = "bryantest" (5) Thu Oct 16 09:56:15 2025 : Debug : NAS-Identifier = "LCP_CLI" (5) Thu Oct 16 09:56:15 2025 : Debug : Service-Type = Authenticate-Only (5) Thu Oct 16 09:56:15 2025 : Debug : Calling-Station-Id = "10.76.89.53" (5) Thu Oct 16 09:56:15 2025 : Debug : NAS-IP-Address = 169.254.64.1 (5) Thu Oct 16 09:56:15 2025 : Debug : NAS-Port = 4021429 (5) Thu Oct 16 09:56:15 2025 : Debug : NAS-Port-Type = Virtual (5) Thu Oct 16 09:56:15 2025 : Debug : User-Password = "testpass" (5) Thu Oct 16 09:56:15 2025 : Debug : Net { (5) Thu Oct 16 09:56:15 2025 : Debug : Src { (5) Thu Oct 16 09:56:15 2025 : Debug : IP = 169.254.131.0 (5) Thu Oct 16 09:56:15 2025 : Debug : Port = 38924 (5) Thu Oct 16 09:56:15 2025 : Debug : } (5) Thu Oct 16 09:56:15 2025 : Debug : Dst { (5) Thu Oct 16 09:56:15 2025 : Debug : IP = 169.254.195.0 (5) Thu Oct 16 09:56:15 2025 : Debug : Port = 1812 (5) Thu Oct 16 09:56:15 2025 : Debug : } (5) Thu Oct 16 09:56:15 2025 : Debug : Timestamp = "2025-10-16T01:56:15Z" (5) Thu Oct 16 09:56:15 2025 : Debug : } (5) Thu Oct 16 09:56:15 2025 : Debug : Packet-Type = Access-Request (5) Thu Oct 16 09:56:15 2025 : Debug : No request.State attribute, can't restore session-state (5) Thu Oct 16 09:56:15 2025 : Debug : Running 'recv Access-Request' from file /etc/opt/LU3Pfreeradius-server/sites-cpm/cpm_radius_config (5) Thu Oct 16 09:56:15 2025 : WARN : Module default returned 3-7 (5) Thu Oct 16 09:56:15 2025 : Debug : recv Access-Request { (5) Thu Oct 16 09:56:15 2025 : Debug : control.Auth-Type := JRADIUS (5) Thu Oct 16 09:56:15 2025 : Debug : } # recv Access-Request (noop) (5) Thu Oct 16 09:56:15 2025 : Debug : Running 'authenticate JRADIUS' from file /etc/opt/LU3Pfreeradius-server/sites-cpm/cpm_radius_config (5) Thu Oct 16 09:56:15 2025 : Debug : authenticate JRADIUS { 2025-10-16T09:56:15.721544+08:00: Debug : rlm_jradius: mod_jradius_call: 0x7f3da0fcbb80, 0x1210d10, 0x15cc590, 0x172f060 2025-10-16T09:56:15.721580+08:00: Debug : rlm_jradius: Reserving JRadius socket id: 7 2025-10-16T09:56:15.721596+08:00: Debug : rlm_jradius: Got attribute User-Name (vendor: 0, id: 1; len: 9, type: 1) 2025-10-16T09:56:15.721609+08:00: Debug : rlm_jradius: Packing attribute User-Name (vendor: 0, id: 1; len: 9, type: 1) 2025-10-16T09:56:15.721664+08:00: Debug : rlm_jradius: Got attribute NAS-Port (vendor: 0, id: 5; len: 0, type: 14) 2025-10-16T09:56:15.721670+08:00: Debug : rlm_jradius: Packing attribute NAS-Port (vendor: 0, id: 5; len: 0, type: 14) 2025-10-16T09:56:15.721675+08:00: Debug : rlm_jradius: Got attribute NAS-Port-Type (vendor: 0, id: 61; len: 0, type: 14) 2025-10-16T09:56:15.721680+08:00: Debug : rlm_jradius: Packing attribute NAS-Port-Type (vendor: 0, id: 61; len: 0, type: 14) 2025-10-16T09:56:15.721685+08:00: Debug : rlm_jradius: Got attribute User-Password (vendor: 0, id: 2; len: 8, type: 1) 2025-10-16T09:56:15.721690+08:00: Debug : rlm_jradius: Packing attribute User-Password (vendor: 0, id: 2; len: 8, type: 1) 2025-10-16T09:56:15.721695+08:00: Debug : rlm_jradius: Got attribute Net (vendor: 0, id: 60; len: 0, type: 25) 2025-10-16T09:56:15.721700+08:00: Debug : rlm_jradius: Got attribute Packet-Type (vendor: 0, id: 1000; len: 0, type: 14) 2025-10-16T09:56:15.721705+08:00: Debug : rlm_jradius: packing packet with code: 1 (attr length: 147) 2025-10-16T09:56:15.721717+08:00: Debug : rlm_jradius: packing packet with code: 0 (attr length: 0) 2025-10-16T09:56:15.721722+08:00: Debug : rlm_jradius: Got attribute Auth-Type (vendor: 0, id: 12; len: 0, type: 14) 2025-10-16T09:56:15.721727+08:00: Debug : rlm_jradius: sending 192 bytes to socket 7 2025-10-16T09:56:15.790878+08:00: Debug : rlm_jradius: read 230 bytes at once 2025-10-16T09:56:15.790919+08:00: Debug : rlm_jradius: return code 8; receiving 2 packets 2025-10-16T09:56:15.790926+08:00: Debug : rlm_jradius: reading packet: code=1 len=147 2025-10-16T09:56:15.790939+08:00: Debug : rlm_jradius: reading attribute: type=1; len=9 2025-10-16T09:56:15.790955+08:00: Debug : rlm_jradius: attribute from dict: vendor=0; id=1, name=User-Name, type=1, vp_ptr=(nil) 2025-10-16T09:56:15.790971+08:00: Debug : rlm_jradius: attribute after strndup: vendor=0; id=1, name=User-Name, type=1, vp_ptr=0x7f3d88094dd0, buff=0x7f3da0fbb970 2025-10-16T09:56:15.790979+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d88091f18, vp=0x7f3d88099410 2025-10-16T09:56:15.790984+08:00: Debug : rlm_jradius: reading attribute: type=32; len=7 2025-10-16T09:56:15.791020+08:00: Debug : rlm_jradius: attribute from dict: vendor=0; id=32, name=NAS-Identifier, type=1, vp_ptr=(nil) 2025-10-16T09:56:15.791029+08:00: Debug : rlm_jradius: attribute after strndup: vendor=0; id=32, name=NAS-Identifier, type=1, vp_ptr=0x7f3d88098800, buff=0x7f3da0fbb970 2025-10-16T09:56:15.791152+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d88091f18, vp=0x7f3d88097fb0 2025-10-16T09:56:15.791157+08:00: Debug : rlm_jradius: reading packet: code=3 len=37 2025-10-16T09:56:15.791161+08:00: Info : rlm_jradius: changing packet code from 0 to 3 2025-10-16T09:56:15.791166+08:00: Debug : rlm_jradius: reading attribute: type=244383759; len=4 2025-10-16T09:56:15.791191+08:00: Debug : rlm_jradius: attribute from dict: vendor=3729; id=15, name=*IsTacacsUser*, type=1, vp_ptr=(nil) 2025-10-16T09:56:15.791199+08:00: Debug : rlm_jradius: attribute after strndup: vendor=3729; id=15, name=IsTacacsUser, type=1, vp_ptr=0x7f3d88097740, buff=0x7f3da0fbb970 2025-10-16T09:56:15.791205+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d88092008, vp=0x7f3d880980b0 2025-10-16T09:56:15.791210+08:00: Debug : rlm_jradius: reading attribute: type=244383760; len=9 2025-10-16T09:56:15.791215+08:00: Debug : rlm_jradius: attribute from dict: vendor=3729; id=16, name=TacacsUserName, type=1, vp_ptr=(nil) 2025-10-16T09:56:15.791221+08:00: Debug : rlm_jradius: attribute after strndup: vendor=3729; id=16, name=TacacsUserName, type=1, vp_ptr=0x7f3d880385b0, buff=0x7f3da0fbb970 2025-10-16T09:56:15.791227+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d88092008, vp=0x7f3d88097340 2025-10-16T09:56:15.791231+08:00: Debug : rlm_jradius: reading request: config_item: len=16 2025-10-16T09:56:15.791237+08:00: Debug : rlm_jradius: reading attribute: type=1000; len=4 2025-10-16T09:56:15.791242+08:00: Debug : rlm_jradius: attribute from dict: vendor=0; id=1000, name=Packet-Type, type=14, vp_ptr=(nil) 2025-10-16T09:56:15.791248+08:00: Debug : rlm_jradius: insert_tail, vps=0x7f3d880920f8, vp=0x7f3d88098870 2025-10-16T09:56:15.791252+08:00: Debug : rlm_jradius: Auth-type received - 4 2025-10-16T09:56:15.791270+08:00: Debug : rlm_jradius: Released JRadius socket id: 7 2025-10-16T09:56:15.791323+08:00: Debug : rlm_jradius: rejected: p_result=1, rcode=2 (5) Thu Oct 16 09:56:15 2025 : WARN : jradius - Module jradius returned 2-1 (5) Thu Oct 16 09:56:15 2025 : Debug : jradius (fail) (5) Thu Oct 16 09:56:15 2025 : Debug : if ( ! ok && reply.Vendor-Specific.Lucent-VID.IsTacacsUser == "TRUE" ) { (5) Thu Oct 16 09:56:15 2025 : Debug : | && (5) Thu Oct 16 09:56:15 2025 : Debug : | ! (5) Thu Oct 16 09:56:15 2025 : Debug : | %logical_and() (5) Thu Oct 16 09:56:15 2025 : Debug : | -- UNLANG (5) Thu Oct 16 09:56:15 2025 : Debug : | ok (5) Thu Oct 16 09:56:15 2025 : Debug : Request rcode is 'reject' (5) Thu Oct 16 09:56:15 2025 : Debug : | %expr.rcode() (5) Thu Oct 16 09:56:15 2025 : Debug : | --> false (5) Thu Oct 16 09:56:15 2025 : Debug : | %unary_not({false}) (5) Thu Oct 16 09:56:15 2025 : Debug : | --> true (5) Thu Oct 16 09:56:15 2025 : Debug : | == (5) Thu Oct 16 09:56:15 2025 : Debug : | %logical_and(...) (5) Thu Oct 16 09:56:15 2025 : Debug : | reply.Vendor-Specific.Lucent-VID.IsTacacsUser (5) Thu Oct 16 09:56:15 2025 : Debug : | %{reply.Vendor-Specific.Lucent-VID.IsTacacsUser} (5) Thu Oct 16 09:56:15 2025 : Debug : * (null)* (5) Thu Oct 16 09:56:15 2025 : Debug : | %cmp_eq({}{TRUE}) (5) Thu Oct 16 09:56:15 2025 : Debug : | --> false (5) Thu Oct 16 09:56:15 2025 : Debug : | %logical_and(...) (5) Thu Oct 16 09:56:15 2025 : Debug : | --> (null) (5) Thu Oct 16 09:56:15 2025 : Debug : ... (5) Thu Oct 16 09:56:15 2025 : Debug : } (5) Thu Oct 16 09:56:15 2025 : Debug : } # authenticate JRADIUS (noop) (5) Thu Oct 16 09:56:15 2025 : Debug : rcode: 7 (5) Thu Oct 16 09:56:15 2025 : Debug : Failed to authenticate the user 3 (5) Thu Oct 16 09:56:15 2025 : Debug : default (ok) (5) Thu Oct 16 09:56:15 2025 : Debug : Setting rcode to 'ok' (5) Thu Oct 16 09:56:15 2025 : Debug : } # default (ok) (5) Thu Oct 16 09:56:15 2025 : Debug : Setting rcode to 'ok' (5) Thu Oct 16 09:56:15 2025 : Debug : Enter unlang_interpret_request_done, typpe=0 (5) Thu Oct 16 09:56:15 2025 : Debug : Done request (5) Thu Oct 16 09:56:15 2025 : Debug : Time tracking ended (5) Thu Oct 16 09:56:15 2025 : Debug : XXXXXXXXXX (5) Thu Oct 16 09:56:15 2025 : Debug : Vendor-Specific.Lucent-VID.*IsTacacsUser *= "TRUE" (5) Thu Oct 16 09:56:15 2025 : Debug : Vendor-Specific.Lucent-VID.TacacsUserName = "bryantest" (5) Thu Oct 16 09:56:15 2025 : Debug : Packet-Type = Access-Reject so my subrequest for tacacs did not run, could you help me how to get the jradius replied attributes? regards, Bryan

2 1

Utterly confused about realms/proxies
by Stephen Mellor 05 Oct '25

05 Oct '25

A decade ago I setup up separate pairs of freeradius servers for wifi and for 802.1x switch port authentication (including VLAN switching), and they've worked very well - so well in fact that I've rarely had to make any changes and I've forgotten pretty much everything that I learned about radius at the time. But now we have a major change - another part of the organisation moving into our buildings, on our infrastructure, and we need to proxy out authentication for them to their Cisco ISE servers. I'm sure it's not difficult but I'm really struggling to achieve this (admittedly I have little time, and no dev/test system so I'm working on the live system out of hours). So let's say that using EAP-TLS I'm currently getting user-name in the form of host/device.US.example.com and host/device.THEM.example.com, how can I differentiate between US.example.com and THEM.example.com so that we continue to authenticate US, but proxy out to their Cisco ISE to authenticate THEM? Post-auth isn't a problem, I know how to switch VLANs and/or accept/reject according to wifi SSID and user-name domain. I'm not looking for someone else to do this for me, but I'm reading the configs and getting nowhere - a hint would be much appreciated (is realms even the correct thing to use?), or a link to any place where there are examples of similar configurations (google is failing me, but then I'm not sure what terms to use, "multi-tenant" or similar?). Thanks! -------------------------------------------------------------------------------------------------------------------------------------------------------- This email is intended for the named recipient only. If you have received it by mistake, please (i) contact the sender by email reply; (ii) delete the email from your system; . and (iii) do not copy the email or disclose its contents to anyone. --------------------------------------------------------------------------------------------------------------------------------------------------------

2 2

WiFi EAP authentication and iOS device setup options?
by Franta Hanzlík 04 Oct '25

04 Oct '25

I finally managed to set up very basic EAP-PEAP and EAP-TTLS MSCHAP2 authentication in a Freeradius + Mikrotik MT network (users and their passwords in cleartext in text file), with a Let's Encrypt certificate in the eap{tls-config tls-common {}} section). Connecting from a Linux NTB and Android (v9 and v11) phone is without problems for both TTLS and PEAP, in the WiFi network settings I can choose a whole range of parameters (EAP method, phase 2 authentication method, certificate selection, CRL usage, domain, identity and anonymous identity,...). And now I tried connecting an iOS (v15) tablet - and this device only requires a username and password. Then it asks if the user trusts Let's Encrypt certificate (which it says is untrusted), and then it connects to the network without any problems. Please excuse the possibly stupid questions, but I have no experience with Apple iOS devices at all - so I would like to ask for an explanation - is this normal with iOS? : - that you can't set basically any WiFi network parameters (after connecting, you can set automatic connection to the network, and randomization of the MAC address - but that's probably all) - when I used a certificate generated by the resources in raddb/certs/ instead of the Lets Encrypt certificate, both Linux and Android clients connected to the network, but the iOS tablet ended up with the error aka "Cannot connect to this network." - is that why? - why does marks the Let's Encrypt certificate as untrustworthy? -- Thanks again, Franta Hanzlik

3 4

which nas_type for Mikrotik WiFi AP NAS ?
by Franta Hanzlík 03 Oct '25

03 Oct '25

Hello, I'm trying FreeRadius with Mikrotik WiFi AP and EAP-PEAP/MSCHAPv2 authentication, so far with a user in mods-config/files/authorize and a cleartext password. So far unsuccessfully, I probably have more errors in the configuration that I'm trying to fix. One specific ambiguity: which NAS type should be listed in the NAS specification in clients.conf - "other", "mikrotik" or "mikrotik_snmp"? The original clients.conf template in the paragraph "The nas_type tells 'checkrad.pl' which NAS-specific method to use to query the NAS for simultaneous use. Permitted NAS types are" lists 13 types incl. "other", "mikrotik" is not among them. But the checkrad man page lists 25 types, including "mikrotik_snmp" and "mikrotik". From this it seems to me that nas_type should not be "other", but "mikrotik" or "mikrotik_snmp". Can anyone advise which one and what is the difference between them? -- Thanks in advance, Franta Hanzlik

3 5

EAP-TTLS/PAP failing: client NAKs and requests MSCHAPv2 inside inner-tunnel
by Arifia Hapsari 01 Oct '25

01 Oct '25

Hello, I am trying to configure FreeRADIUS for guest Wi-Fi authentication using *EAP-TTLS/PAP*. My backend is a custom REST API that validates the username and plain-text password. The Phase 1 TLS tunnel is established successfully, but the inner authentication (Phase 2) always fails. The debug log shows that my inner-tunnel server rejects the user. Here is the part of my debug log: (7) server inner-tunnel { (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authorize { (7) eap: Peer sent EAP Response (code 2) ID 1 length 6 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authenticate { (7) eap: Peer sent packet with method EAP NAK (3) (7) eap: Peer NAK'd asking for unsupported EAP type MSCHAPv2 (26), skipping... (7) eap: ERROR: No mutually acceptable types found (7) [eap] = invalid (7) } # authenticate = invalid (7) Failed to authenticate the user ... (7) eap_ttls: Got tunneled Access-Reject (7) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed My eap.conf is configured to use default_eap_type = "pap" inside the ttls section. *My questions are:* 1. Does the log line Peer NAK'd asking for unsupported EAP type MSCHAPv2 definitively mean that client requests MSCHAPv2 but the server is only configured to accept EAP-TTLS/PAP? 2. What is the recommended best practice to solve this for a guest network? Should I focus on forcing the client devices to use PAP, or is it more reliable to reconfigure my server and REST API to support MSCHAPv2 (by providing the NT-Password hash)? Thank you for your help

2 3

2 servers - frontend + backend: auth + attributes
by Andrei Katsuk 01 Oct '25

01 Oct '25

Hello! I want to implement next scheme (PAP protocol, FreeRADIUS 3.0.27): client sends request to frontend server , frontend server authenticates user , frontend server sends request to backend server, backend server authenticates user and adds attributes, frontend server returns extra attributes to client. It seems frontend server can proxy request after authorization, so the part with authentication on frontend server is missed. Is it possible to implement this approach? Regards Andrei

2 6

Option82 - question about sending sub-options
by Ľudovít Mikula 28 Sep '25

28 Sep '25

I have a question about sending Option82 - I am setting sub-options 1,2 and 9 in response to DISCOVER: update reply { &DHCP-Relay-Remote-Id := &request:DHCP-Relay-Remote-Id &DHCP-Relay-Circuit-Id := &request:DHCP-Relay-Circuit-Id &DHCP-Vendor-Specific-Information := &request:DHCP-Vendor-Specific-Information } and see it being set in the freeradius log: (1702) DHCP-Relay-Remote-Id := 0xacdb489f87af (1702) DHCP-Relay-Circuit-Id := 0xacdb489f87af (1702) DHCP-Vendor-Specific-Information := 0x0000118b060104010203010000061b34030a444d5a2d434f532d3032010e4554492d5250442d504f52542d300207756e69636173740e07000100000079000d040a666f07 and also in the packet capture of our OFFER packet: Agent-Information (82), length 8: Circuit-ID SubOption 1, length 6: M-,M-[HM-^_M-^GM-/ Agent-Information (82), length 8: Remote-ID SubOption 2, length 6: M-,M-[HM-^_M-^GM-/ Agent-Information (82), length 70: Unknown SubOption 9, length 68: 0x0000: 0000 118b 0601 0401 0203 0100 0006 1b34 0x0010: 030a 444d 5a2d 434f 532d 3032 010e 4554 0x0020: 492d 5250 442d 504f 5254 2d30 0207 756e 0x0030: 6963 6173 740e 0700 0100 0000 7900 0d04 0x0040: 0a66 6f07 END (255), length 0 it all looks ok to me. However the relay agent vendor requires the sub-options to be set in one Option 82 block (like they send it to us in DISCOVER): Agent-Information (82), length 86: Circuit-ID SubOption 1, length 6: M-,M-[HM-^_M-^GM-/ Remote-ID SubOption 2, length 6: M-,M-[HM-^_M-^GM-/ Unknown SubOption 9, length 68: 0x0000: 0000 118b 0601 0401 0203 0100 0006 1b34 0x0010: 030a 444d 5a2d 434f 532d 3032 010e 4554 0x0020: 492d 5250 442d 504f 5254 2d30 0207 756e 0x0030: 6963 6173 740e 0700 0100 0000 7900 0d04 0x0040: 0a66 6f07 END (255), length 0 Is this possible (or am I doing something wrong), we're using freeradius v3.2.3 ? -- Ludo

4 13

rlm_python3 behavior with multi-worker threads
by Erdal Emlik 25 Sep '25

25 Sep '25

Hi FreeRADIUS team, I’m using FreeRADIUS (version 3.2.4) with rlm_python3 for authentication. I have the following question: - Does FreeRADIUS’ thread pool affect rlm_python3 requests? - Specifically, does each RADIUS worker call the same Python interpreter instance, or does each worker get its own Python context?( i mean 28 workers uses trying to use single instance at the same time right as doc says “item is GLOBAL TO THE SERVER. That is, you cannot have two instances of the python module”) Additionally, within the Python module, I log requests and sometimes see “queue full” messages. However, even when these messages appear, I observe that the Python module still returns a response to FreeRADIUS. Within Python, I perform some comparisons and assign IPs accordingly, and even if a "queue full" exception occurs, FreeRADIUS still receives the IP assignment and returns a response without any issue. - Is this “queue full” behavior related to the Python module itself, or is it due to FreeRADIUS threading/queue management? I hope i made it clear. Thanks for your guidance. Best regards Sent from my iPhone

2 4

help with freeradius on u24 for eduroam with ntlm auth
by Rob Taylor 23 Sep '25

23 Sep '25

Hi all. I'm in the process of trying to set up a freeradius instance for eduroam. I'm using ubuntu24 with the pre-built radius packages, 3.2.5+dfsg-3~ubuntu24.04.3 I'm following the guide from here: https://wiki.freeradius.org/guide/eduroam and I got the files based authentication to work, but I'm having an issue with the ntlm authentication. I've tested the samba part and that works, but when I try to auth to radius using ntlm, it gets rejected, and from what I can tell using tcpdump, it's not even hitting the ad servers, so something is wrong before it even gets to that point. I'm not sure if I have the radius config wrong, or if I'm doing something wrong with the eapol test. I have nltm_auth in both the inner-tunnel and default in sites-enabled in the authenticate section. I think this is where it goes wrong: (8) mschap: Found Cleartext-Password, hashing to create NT-Password (8) mschap: Creating challenge hash with username: rgt(a)wi.mit.edu (8) mschap: Client is using MS-CHAPv2 (8) mschap: ERROR: MS-CHAP2-Response is incorrect (8) eap_mschapv2: [mschap] = reject Should it be stripping the domain here? It looks like it is doing that in other places in the config. can someone steer me in the right direction? Thanks. rgt

3 3

Clarification on proxy backend states (Zombie vs Dead) and possible packet loss
by Erdal Emlik 16 Sep '25

16 Sep '25

Hello FreeRADIUS team, We are running FreeRADIUS as a proxy setup, and we are trying to better understand how backend states (Alive, Zombie, Dead) behave in practice. In our current configuration: response_window = 5s (default is 20s) zombie_period = 20s (default is 40s) From what we observe: If a backend does not reply within response_window, the proxy marks it as Zombie. The backend remains Zombie until the zombie_period expires. If no valid responses are received during this time, it becomes Dead. If there are no Alive backends left, the proxy prefers sending to a Zombie backend instead of dropping requests. Periodic Status-Check packets can bring a Zombie backend back to Alive. 👉 My questions / doubts: In the Zombie state, we sometimes see packet loss (packets not reaching the backend). Is this the expected behavior, since the proxy still forwards traffic to a potentially unstable backend? When the documentation says “if the home servers are still down” in the context of robust-proxy-accounting, does “down” strictly mean Dead, or are Zombie servers also considered “down”? In our understanding, if a backend is in Zombie state, packets may still be sent but can get lost due to intermittent connectivity (before the backend ever becomes Dead). Is this correct? What would be the recommended approach to avoid accounting packet loss in such scenarios ( i know network must be stable but shit happens :(…)— should we rely on robust-proxy-accounting to queue locally until the backend is fully Alive again? Any clarification on this behavior would be very helpful. Thanks in advance,

2 2