Help with advanced FreeRADIUS + MySQL setup using EAP-TLS
Hi everyone, I'm working on a FreeRADIUS setup connected to MySQL, and I need help configuring a stricter access validation process. Currently, *EAP-TLS authentication is working* — if a user has a valid certificate, they can connect successfully. However, I want to ensure that *three specific conditions* are met before granting access: 1. ✅ *The EAP-TLS certificate must be valid.* 2. ✅ *The user must exist in the database and be marked as active.* 3. ✅ *The device requesting access (by MAC address) must be registered and associated with that user.* A user may have multiple devices, but *all three conditions* must be satisfied to allow access. Could anyone guide me on how to implement this kind of validation in FreeRADIUS using MySQL? Thanks in advance for any help or examples you can share! -- ________________________________________________ Lic. Ariel García Reyes.
On 04/07/2025 07:05, Ariel García Reyes wrote:
Currently, *EAP-TLS authentication is working* — if a user has a valid certificate, they can connect successfully.
OK that's good.
However, I want to ensure that *three specific conditions* are met before granting access:
1. ✅ *The EAP-TLS certificate must be valid.* 2. ✅ *The user must exist in the database and be marked as active.* 3. ✅ *The device requesting access (by MAC address) must be registered and associated with that user.*
A user may have multiple devices, but *all three conditions* must be satisfied to allow access.
Could anyone guide me on how to implement this kind of validation in FreeRADIUS using MySQL?
You'll need to put something together as this isn't covered by the default config, but it shouldn't be too hard. The 'user' with EAP-TLS is probably going to come from the client certificate, rather than the RADIUS User-Name attribute. Easiest way is likely to configure the check-eap-tls virtual server which will get the certificate information. In there you can make calls to SQL to check the specifics that you want and then accept or reject based on those. Either call the 'sql' module, or more likely due to your use case just use sql xlats to do the checks that you need. One SQL query should be able to cover both the latter two conditions (using the relevant TLS client certificate attribute(s) and Calling-Station-Id attribute), and validation of the certificate will happen automatically anyway. -- Matthew
On 7/5/2025 7:19 PM, Matthew Newton via Freeradius-Users wrote:
On 04/07/2025 07:05, Ariel García Reyes wrote:
Currently, *EAP-TLS authentication is working* — if a user has a valid certificate, they can connect successfully.
OK that's good.
However, I want to ensure that *three specific conditions* are met before granting access:
1. ✅ *The EAP-TLS certificate must be valid.* 2. ✅ *The user must exist in the database and be marked as active.* 3. ✅ *The device requesting access (by MAC address) must be registered and associated with that user.*
A user may have multiple devices, but *all three conditions* must be satisfied to allow access.
Could anyone guide me on how to implement this kind of validation in FreeRADIUS using MySQL?
You'll need to put something together as this isn't covered by the default config, but it shouldn't be too hard.
The 'user' with EAP-TLS is probably going to come from the client certificate, rather than the RADIUS User-Name attribute.
Easiest way is likely to configure the check-eap-tls virtual server which will get the certificate information. In there you can make calls to SQL to check the specifics that you want and then accept or reject based on those.
Either call the 'sql' module, or more likely due to your use case just use sql xlats to do the checks that you need. One SQL query should be able to cover both the latter two conditions (using the relevant TLS client certificate attribute(s) and Calling-Station-Id attribute), and validation of the certificate will happen automatically anyway.
Okay, thanks for the explanation. I'm not very good at configuring FreeRadius. Is there a manual or guide that can help me understand how it works? What are the default modules or what can I do with them? How do I create functions, how do I pass parameters to them, and how do I get or return results?
On Jul 6, 2025, at 4:25 PM, Ariel Garcia Reyes <ariel100cfg@gmail.com> wrote:
I'm not very good at configuring FreeRadius.
Everyone started somewhere.
Is there a manual or guide that can help me understand how it works?
The server comes with a large amount of documentation. Every configuration file contains extensive comments which describe what it does, and how it works. There's also a lot of documentation online: https://www-fr.freeradius.org/documentation/freeradius-server/3.2.8/ That site is built from the FreeRADIUS source. It includes documentation on how FreeRADIUS works, RADIUS / AAA concepts, tutorials on how to configure the server, and many more.
What are the default modules or what can I do with them?
$ ls raddb/mods-enabled And then read the files. There is extensive documentation.
How do I create functions, how do I pass parameters to them, and how do I get or return results?
You don't. You read raddb/sites-available/default, and edit it for your needs. Again, it contains extensive documentation. For basic introduction, see https://www-fr.freeradius.org/documentation/freeradius-server/3.2.8/concepts... Most beginning questions are answered in the documentation. If you have specific questions that aren't addressed there, then ask a question here. But basic questions about modules / operation are all documented. It's best to spend some time reading that. We're not going to "cut and paste" documentation from the web site onto the mailing list. That isn't helpful. Alan DeKok.
Thanks a lot for the support! I’ll reach out to the list again if anything else comes up. El dom, 6 jul 2025 a la(s) 4:32 p.m., Alan DeKok via Freeradius-Users ( freeradius-users@lists.freeradius.org) escribió:
On Jul 6, 2025, at 4:25 PM, Ariel Garcia Reyes <ariel100cfg@gmail.com> wrote:
I'm not very good at configuring FreeRadius.
Everyone started somewhere.
Is there a manual or guide that can help me understand how it works?
The server comes with a large amount of documentation. Every configuration file contains extensive comments which describe what it does, and how it works.
There's also a lot of documentation online: https://www-fr.freeradius.org/documentation/freeradius-server/3.2.8/
That site is built from the FreeRADIUS source. It includes documentation on how FreeRADIUS works, RADIUS / AAA concepts, tutorials on how to configure the server, and many more.
What are the default modules or what can I do with them?
$ ls raddb/mods-enabled
And then read the files. There is extensive documentation.
How do I create functions, how do I pass parameters to them, and how do I get or return results?
You don't. You read raddb/sites-available/default, and edit it for your needs. Again, it contains extensive documentation.
For basic introduction, see https://www-fr.freeradius.org/documentation/freeradius-server/3.2.8/concepts...
Most beginning questions are answered in the documentation. If you have specific questions that aren't addressed there, then ask a question here. But basic questions about modules / operation are all documented. It's best to spend some time reading that. We're not going to "cut and paste" documentation from the web site onto the mailing list. That isn't helpful.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ________________________________________________ Lic. Ariel García Reyes.
participants (4)
-
Alan DeKok -
Ariel Garcia Reyes -
Ariel García Reyes
-
Matthew Newton