If fall-backed worked, as long as the radius server was responding that admin password is useless.  I have to worry a lot less that all my pfsense's admin passwords are secure because they won't work if radius is responding.

The only proper solution i see currently is have all my pfsense's admin password be different. This is like 100+ for me, so that's another database i have to manage and keep secure. Even if i did do this, i still think it's slightly more secure to have radius be the primary and fall back to local, as it's one or more less account's that can be used to access the system.

I'm interchanging admin/local users here, if admin was a special account and all other local users were fall-backed that would be fine too, as i would never give out the admin account to anyone.

If you don't have any other local accounts and keep the admin password synchronized (or randomized for that matter, and secured properly) there is no downside to the current method.

the usual way this happens is, try to login, get a failure from the RADIUS server (e.g. auth failed because the password is wrong or that user doesn't exist), at which point it allows the local login.

So all i have to do is try a random login that fails with radius and it will fall back to local?

If the admin user is a special case that makes sense.  If all local users allowed to login after a failed radius login attempt, that seems a bit too vulnerable to me. I can understand if the radius server is not responding to allow ALL local users, but a failed attempt is a bit too much IMO.

The usual way this happens is, try to login, get a failure from the RADIUS server (e.g. auth failed because the password is wrong or that user doesn't exist), at which point it allows the local login.

Looking at the system log i do not see any radius errors. Is there somewhere else i should be looking? Authentication in diag. also works perfectly fine and shows my account assigned to "admins" group.