freeradius -v | head -1
ls /etc/freeradius/

radiusd: FreeRADIUS Version 3.2.10 (git #9071ea041), for host x86_64-pc-linux-gnu
certs  clients.conf  dictionary  hints  huntgroups  mods-available  mods-config
mods-enabled  policy.d  proxy.conf  radiusd.conf  sites-available  sites-enabled  users

# 方式一：直接读配置文件（模块用 mods-enabled 下的软链文件）
grep -n "max_attributes\|reject_delay\|status_server" /etc/freeradius/radiusd.conf

466:max_attributes = 200
472:reject_delay = 1
474:status_server = yes

# 方式二：调试模式启动，配置解析全过程逐行打印（含每个模块加载与参数展开）
freeradius -X 2>&1 | head -25

FreeRADIUS Version 3.2.10
Copyright (C) 1999-2026 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT

FreeRADIUS is developed, maintained, and supported by InkBridge Networks.
For commercial support, please email sales@inkbridgenetworks.com
https://inkbridgenetworks.com/
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/freeradius/dictionary
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/mods-enabled/

# 修改后先做配置校验（不监听端口，纯解析）
freeradius -C
echo $?

0

# 实测：向 radiusd.conf 追加一个多余的 '}' 后
freeradius -X 2>&1 | tail -1

Errors reading or parsing /etc/freeradius/radiusd.conf

systemctl restart freeradius
systemctl is-active freeradius

active

log {
	destination = files          # 日志去向：files/syslog/stdout/null
	colourise = yes              # 终端着色（仅 destination=stdout 时有意义）
	file = ${logdir}/radius.log  # 主日志文件，${logdir} 引用上文变量 /var/log/freeradius
	syslog_facility = daemon     # destination=syslog 时的 facility
	stripped_names = no          # 日志中是否隐藏用户名
	auth = no                    # 是否记录每个认证请求的摘要（排障时改 yes）
	auth_badpass = no            # 失败认证是否记录密码（安全敏感，保持 no）
	auth_goodpass = no           # 成功认证是否记录密码（同上，严禁生产开启）
	msg_denied = "You are already logged in - access denied"
}

security {
	user = freerad            # 启动后降权到的运行用户
	group = freerad           # 运行组（读取 /etc/freeradius 需要 freerad 属组）
	allow_core_dumps = no     # 崩溃转储开关
	max_attributes = 200      # 单个请求允许的最大属性数（防御畸形包）
	reject_delay = 1          # Access-Reject 延迟秒数（抗爆破，0 会放大字典攻击面）
	status_server = yes       # 响应 Status-Server 心跳包（radclient status 用）
	require_message_authenticator = yes   # Blast-RADIUS 防护：强制校验 Message-Authenticator
	limit_proxy_state = auto  # Blast-RADIUS 防护：对非代理请求强制 Proxy-State 校验
}

client localhost {
	ipaddr = 127.0.0.1        # 匹配的客户端来源 IP（单 IP 用 ipaddr，网段用 ipaddr = a.b.c.d/24）
	proto = *                 # 同时接受 udp 与 tcp
	secret = testing123       # 共享密钥，NAS 侧必须与此完全一致
	nas_type	 = other      # NAS 厂商类型（cisco/mikrotik/other），影响部分属性语义
	limit {
		max_connections = 16  # 该 client 的最大并发连接
		lifetime = 0          # 连接最长寿命（0 不限）
		idle_timeout = 900    # 空闲超时秒数
	}
}
client localhost_ipv6 {
	ipv6addr	= ::1
	secret		= testing123
}
client office-nas {
	ipaddr		= 10.89.56.0/24   # 按网段授权一整组接入设备
	secret		= nasSecret2026
	shortname	= office-switch   # 日志与计费明细里显示的短名
	nastype		= other
}

Dropping packet without response because of error: Received packet from 10.89.56.2
with invalid Message-Authenticator!  (Shared secret is incorrect.) (from client office-switch)

admin	Cleartext-Password := "q1w2e3r4"
	Reply-Message = "Welcome, admin"

(0)   authorize {
(0)     policy filter_username { ... }        # 用户名合法性过滤（空格/双@/连续点）
(0)     [preprocess] = ok                     # 剥 hints、规范化属性
(0)     [chap] = noop                         # 探测 CHAP 密码属性
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: No '@' in User-Name = "admin", looking up realm NULL
(0)     [suffix] = noop                       # Realm 域分离
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop                          # EAP 探测（PAP 请求无 EAP 属性则跳过）
(0) files: users: Matched entry admin at line 209
(0)     [files] = ok                          # 平面文件命中
(0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'admin' ORDER BY id
(0) sql: WARNING: User not found in radcheck table.
(0)     [sql] = notfound                      # SQL 未命中继续走下一模块
(0)     [expiration] = noop
(0)     [logintime] = noop
(0)     [pap] = updated                       # 依据已有密码属性确定 Auth-Type = PAP
(0)   } # authorize = updated

(0)   Auth-Type PAP {
(0) pap: Login attempt with password
(0) pap: Comparing with "known good" Cleartext-Password
(0) pap: User authenticated successfully
(0)     [pap] = ok
(0)   } # Auth-Type PAP = ok

(0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )
(0) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'admin', 'q1w2e3r4', 'Access-Accept', '2026-10-27 06:27:54.014642' )
(0) sql: SQL query returned: success

eap {
	default_eap_type = md5      # 默认 EAP 方法（实验用 md5，生产 Wi-Fi 用 peap/tls）
	timer_expire = 60           # EAP 会话状态保留秒数
	ignore_unknown_eap_types = no
	cisco_accounting_username_bug = no
	max_sessions = ${max_requests}
	md5 {                       # EAP-MD5 子段（ challenge-response 校验）
	}
	gtc {                       # EAP-GTC（明文口令质询，常配 PAP 语义）
		auth_type = PAP
	}
	tls-config tls-common {     # 所有 TLS 系方法共用的证书配置
		private_key_password = whatever
		private_key_file = ${certdir}/server.pem
		...
	}
}

sql {
	dialect = "mysql"           # 方言：mysql/postgresql/sqlite/mssql 等
	driver = "rlm_sql_mysql"    # 驱动（包 freeradius-mysql 提供）
	server = "localhost"        # 数据库地址
	port = 3306
	login = "radius"            # 连接账号
	password = q1w2e3r4         # 连接密码（生产用强密钥并收紧权限）
	radius_db = "radius"        # 库名，radcheck/radreply/radusergroup/radacct 所在库
	...
}

(0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
(0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'admin' ORDER BY id
(0) sql: WARNING: User not found in radcheck table.
(0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
(0) sql: User not found in any groups

ldap {
	server = 'localhost'        # 目录服务器，可空格分隔多个
	base_dn = 'dc=example,dc=org'
	sasl {                      # SASL 绑定（GSSAPI/Kerberos 场景）
	}
	update {
		control:Password-With-Header	+= 'userPassword'   # 把 userPassword 带入服务端比对
		control:			+= 'radiusControlAttribute'
		request:			+= 'radiusRequestAttribute'
		reply:				+= 'radiusReplyAttribute'
	}
	user_dn = "LDAP-UserDn"
	user {
		base_dn = "${..base_dn}"
		filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"   # 用户查找过滤器
		...
	}
}

proxy server {
	default_fallback = no       # realm 无匹配时是否回落默认转发
}
home_server localhost {         # 上游服务器定义
	type = auth                 # auth/acct/auth+acct
	ipaddr = 127.0.0.1
	port = 1812
	secret = testing123         # 与上游的共享密钥
	response_window = 20        # 等响应窗口秒数
	zombie_period = 40          # 判定上游僵尸的观察期
	...
}

# /etc/freeradius/radiusd.conf —— 仅列需要改动的键
security {
	require_message_authenticator = yes   # 保持 3.2 默认，Blast-RADIUS 防护
	reject_delay = 1                      # 保持默认，抗在线爆破
}
log {
	auth = yes                            # 排障期开启；稳定后改回 no
	auth_badpass = yes                    # 记录失败尝试（不含密码），便于告警联动
}

# /etc/freeradius/clients.conf —— 每类接入设备一段，密钥 22 字符以上
client wifi-controllers {
	ipaddr    = 10.20.0.0/22
	secret    = <22+位强密钥，用 radsecret 生成>
	shortname = wlc-hq
	nastype   = other
}

# mods-enabled/sql —— 用户入库，files 只留应急账号
sql {
	dialect = "mysql"
	server = "10.20.1.50"
	login = "radius"
	password = <数据库强口令>
	radius_db = "radius"
	# mysql 段的 tls{} 块：不用数据库 TLS 就整段注释，避免实例化失败
}

# mods-enabled/eap —— 生产 Wi-Fi 用 PEAP
eap {
	default_eap_type = peap
	peap {
		default_eap_type = mschapv2
	}
	tls-config tls-common {
		private_key_file = /etc/freeradius/certs/server.pem   # 换成正式证书
		certificate_file = /etc/freeradius/certs/server.pem
		ca_file = /etc/freeradius/certs/ca.pem
	}
}