Re: radius authentication via TCP/TLS

I would second Alex's suggestion. I use socat in a similar fashion to run a=
 Status-Server check for a series of hosts (given that I cannot proxy a Sta=
tus-Server check).

It works fine :-)

Kind regards

Stefan Paetow
Federated Roaming Technical Specialist
eduroam(UK), Jisc =96 20 years of free Wi-Fi for the UK R&E sector

email/teams: [email protected]
gpg: 0x3FCE5142

For eduroam support, please contact the eduroam team via [email protected] an=
d mark it for eduroam=92s attention.
I am not available on Mondays and Fridays between 12:00 and 15:00 London ti=
me (UTC in winter, UTC+0100 in summer).

Note: I don=92t expect a reply outside of your working hours, since I work =
internationally with colleagues in different nationalities with different r=
eligions, customs, and holidays. Reply when it is convenient for you.

Jisc is a registered charity (in England and Wales under charity number 114=
9740; in Scotland under charity number SC053607) and a company limited by g=
uarantee registered in England under company number 05747339, VAT number GB=
 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6N=
B. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limit=
ed by guarantee which is registered in England under company number 0288102=
4, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Br=
istol, BS1 6NB. T 0203 697 5800.

For more details on how Jisc handles your data see our privacy notice here:=
 https://www.jisc.ac.uk/website/privacy-notice

From: Freeradius-Users <freeradius-users-bounces+stefan.paetow=3Djisc.ac.uk=
@lists.freeradius.org> on behalf of Alexander Clouter via Freeradius-Users =
<[email protected]>
Date: Thursday, 2 July 2026 at 06:42
To: Freeradius-Users <[email protected]>
Cc: Alexander Clouter <[email protected]>
Subject: Re: radius authentication via TCP/TLS

On Wed, 1 Jul 2026, at 10:00, Alan Smith via Freeradius-Users wrote:
> I would like to check the use of Radius over TLS on TCP 2083 for some
> of the clients.

One option is to run a TLS proxy.

Run in one terminal:

socat -d TCP-LISTEN:1812 OPENSSL:192.0.2.1:2083,cafile=3D...,commonname=3D.=
..,certificate=3D...

Then run your RADIUS checks in another with:

printf 'User-Name =3D bob\nUser-Password =3D hello\n' | radclient -x -P tcp=
 127.0.0.1 auth radsec

It is a little 'ghetto', but can help you avoid writing a bunch of Python o=
r running another RADIUS server.

Cheers
-
List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.out=
look.com/?url=3Dhttp%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=3D=
05%7C02%7Cstefan.paetow%40jisc.ac.uk%7C7b35b430fec24626bf0908ded7fcb016%7C4=
8f9394d8a144d2782a6f35f12361205%7C0%7C0%7C639185677476220725%7CUnknown%7CTW=
FpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOI=
joiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=3DjjJzD1M7yJg86qLLGN9RijCjwW=
8bKadnHRaYnh1I1UY%3D&reserved=3D0<http://www.freeradius.org/list/users.html>
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.h=
tml