October 2010 - Freeradius-Users - lists.freeradius.org

Freeradius 1.2.3 and Windows 7
by Krzysztof Srokowski 19 Oct '10

19 Oct '10

Hello, Before I ask detailed question I have one simple. Can Freeradius 1.2.3 cooperate successfully with Windows 7 ? I Mean in configuration WPA2-Enterprise (AES) + EAP-PEAP(MSCHAPv2) ? I cant get no information about it. Actually my configuration works fine with Windows XP, so after hours of fight with Windows 7 this must be my first question. Thanks for reply.

1 0

Redundant SQL
by Chesterfield McMillan 19 Oct '10

19 Oct '10

I'm trying to implement the redundant SQL feature into my freeradius setup. The one problem I am coming up against is when freeradius is starting, but not all the SQL servers are available. I have set up sql1 and sql2 as a single virtual module and would ideally like it to *try* to connect to all servers on start-up, but if an error occurs (can't connect to one), then just bypass and continue. Assuming the total failure to is what is meant to happen, I can understand why, but in my case I'd rather have it connect to at least one database server than fail if it can't connect to them all. Is this setup possible? Regards, Chester.

3 2

Limiting access to Cisco boces to certain users
by Richard D 18 Oct '10

18 Oct '10

We have numerous routers that all our NEs need access to, so that's no issue. However, there is a developer that needs full access to one particular router. I've added him to the users file, but he has access to everything right now. I've tried using huntgroups but that completely locks him out of everything. What's the best way to limit a user or users to access only particular Cisco boxes? Thanks.

1 0

Cisco LNS with Freeradius and MySQL
by Stephane MAGAND 18 Oct '10

18 Oct '10

Hi I request a small help for my configuration, sorry for my english: I have a cisco router with VRF I have a Freeradius server with sql I have a lot of Adsl user in L2TP. I want add one user to a specific vrf, i have added to the mysql table: INSERT INTO `radgroupreply` VALUES (9, 'IAccess', 'cisco-avpair', '+=', '"lcp:interface-config=ip vrf forwarding INT002\\n ip unnumbered Loopback250"'); but when the user connect, that's don't work ... On my cisco router, i have: One Loopback: interface Loopback250 ip vrf forwarding INT002 no ip address One Vrf: ip vrf INT002 rd 65509:501 route-target export 65509:101 route-target import 65509:100 route-target import 65509:50 where is my error ? Second question: I use sqlippool for dynamic IP, if i want specify a IP to a username (static) what is the process ? create a specific group ? thanks for your help stephane

2 4

DHCP with option 82 best practice
by Zietz, Marco 18 Oct '10

18 Oct '10

Hi everybody, at first I want to thank Arran and Alan for their help with my last post. Good job! Had trouble getting the lists reply's, but solved now. I am curious if somebody could share information how to get FR as DHCP with option 82 authentication up and running. Couldn't find much information in provided sample files and on the net. My own experiments with auth configs were not particularly successful. The key I am missing is the link between having DHCP-Relay-Circuit-Id in DHCP-Request and DHCP-Discover messages and kicking in some kind of auth in order to return a DHCP-Offer/Ack message including a client IP out of the configured IP pools. Backend is mysql. I have the feeling that most users straight heading for rlm_perl and not using the ppp/chap/pap alike chain. This I would understand since the handshakes differ. Confirmation of this thesis would help me as well, so I can stop searching and start coding ;o) Any comment much appreciated! Cheers, Marco

3 2

Radiusd error + libfreeradius-radius-2.1.10.so
by Octavio Ramirez 18 Oct '10

18 Oct '10

Hi all, I try to install freeradius server 2.1.10. After the commands #./configure #make #make install everything is ok. Then, when I try to execute radiusd -X, I have this error: radiusd: error while loading shared libraries: libfreeradius-radius-2.1.10.so: cannot open shared object file: No such file or directory Where can I find these shared libraries?? I have to modify the PATH library? Thanks in advance. Octavio

2 1

Proxy Issue
by Garber, Neal 17 Oct '10

17 Oct '10

I'm testing proxying of authentications (it's not something I've done before so this could be my problem). I have a pool with 2 home servers defined in proxy.conf. For now, both servers are unreachable (blocked by a firewall). I'm using git head 2.1.x branch and I'm testing using eapol_test. The failure is repeatable, while the server is performing no other work, and occurs after the client retries twice (so three Access-Requests are sent to FR) and after the 3rd request, it wakes up from sleeping and dies: Wed Oct 13 14:44:17 2010 : Debug: Waking up in 11.3 seconds. Wed Oct 13 14:44:28 2010 : Error: ASSERT FAILED event.c[1175]: "We do not have threads, but the request is marked as queued or running in a child thread" == NULL [1]+ Abort trap: 6 radiusd -X (wd: /usr/local/etc/raddb) Any ideas? I can post complete debug output if needed and/or parts of my config.

2 6

Toggle Calling-Station-Id check item based on Framed-Protocol?
by William Burnett 15 Oct '10

15 Oct '10

Hello all.. I'm trying to setup my Radius server so that it will map MAC addresses to TTLS user/pass for 802.1x. I have that part working fine. The problem is, the same user/pass pair I'm also using for the clients PPPoE authentication. I want the Calling-Station-Id to be verified when an EAP/TTLS session is being authenticated, but I don't want to check the Calling-Station-Id when the PPPoE session is authenticating. This is because the TTLS device is known and controlled by me, the PPPoE device may be any MAC address that I don't want to have to maintain a list of. My question is, using unlang is there an option do delete a check item attribute based on another attribute? IE: if (Framed-Protocol == PPP) { update-control { Calling-Station-Id !* # Not sure if I'm using the !* operator properly here } } That code just yields errors, but thats essentially what I'm trying to do... Sincerely, William Burnett burnett.w(a)gmail.com

1 1

radtest issue
by Sujith Paily K 15 Oct '10

15 Oct '10

I have installed freeradius2 & freeradius2-utils on centos5.5 using yum. I did the basic configuration and test with radtest ----------------------------------------------------------------- radtest testing password 127.0.0.1 10 testing123 Sending Access-Request of id 221 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "password" NAS-IP-Address = 216.34.94.184 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=221, length=2 ----------------------------------------------------------------------------------------------------- I dont understand "NAS-IP-Address = 216.34.94.184" my hostname is node3.localhost. So expected NAS-IP-Address is node3.localhos right? What is wrong?I dont find an the ip 216.34.94.184 in my machine -- Thanks and Regards, Sujith Paily K http://SparkSupport.com<http://www.google.com/url?sa=D&q=http://SparkSupport.com&usg=AFQjCNEs6_09Bz…>| http://migrate2cloud.com<http://www.google.com/url?sa=D&q=http://migrate2cloud.com&usg=AFQjCNHfkXv1L…>

2 1

Combining ntlm_auth and mac address verification in freeradius
by Langen Mike 15 Oct '10

15 Oct '10

Hi there. I've got the problem that I want to combine active directory authentication with mac address verification. So only user can log in which hardware is listed in a text file or similar. In the whole world wide web I didn't find a hint how to combine multiple authentication methods in serial. One possibility, but there I didn't find anything at all, seems to be using the perl module. Is it possible to run a perl script before ntlm_auth will take place ? Thanks for your answer. Greetings from Switzerland. Mike

2 4