April 2010 - Freeradius-Users - lists.freeradius.org

DHCP Sending NAK in reply to Discover (BUG)
by sergey 07 Apr '10

07 Apr '10

--- dhcpd.c.old 2010-04-06 12:35:28.000000000 +0300 +++ dhcpd.c 2010-04-06 12:55:43.000000000 +0300 @@ -150,7 +150,11 @@ case RLM_MODULE_INVALID: case RLM_MODULE_NOOP: case RLM_MODULE_NOTFOUND: - request->reply->code = PW_DHCP_NAK; + if (request->packet->code == PW_DHCP_DISCOVER) { + request->reply->code = 0; + } else { + request->reply->code = PW_DHCP_NAK; + } break; case RLM_MODULE_HANDLED:

2 1

User enabled for one only NAS
by Sergio Belkin 07 Apr '10

07 Apr '10

Hi, I've enabled on users file something like that: guest Cleartext-Password := "guest" How can I limit that user to one only NAS IP Address? Thanks in advance! -- -- Open Kairos http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 2

RE: Permanent mysql connection in mod_perl
by Nasser Heidari 07 Apr '10

07 Apr '10

> -----Original Message----- > From: freeradius-users-bounces+nasser=rasana.net(a)lists.freeradius.org > [mailto:freeradius-users-bounces+nasser=rasana.net@lists.freeradius.org] > On Behalf Of Apostolos Pantsiopoulos > Sent: Wednesday, April 07, 2010 13:37 > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Permanent mysql connection in mod_perl > > Have a look at the CLONE special function in rlm_perl documentation. > Initiate your db connections in that function. > Unfortunately I'm not familiar with this function, as I have searched , I think that only change that I need is to enclose my db connection part in Perl script into sub CLONE {} . Is that correct? > -- > ------------------------------------------- > Apostolos Pantsiopoulos > Kinetix Tele.com R & D > email: regs(a)kinetix.gr > ------------------------------------------- > > On 7/4/2010 12:01 μμ, Nasser Heidari wrote: > > Hi, > > I'm using mod_perl in my radius configuration and using it I write some > > logs to database. > > Today I noticed that, there are lots of mysql connections in TIME_WAIT > > state. > > > > # netstat -epn --tcp | grep TIME_WAIT | wc -l > > 15015 > > > > netstat -epn --tcp | grep TIME_WAIT | tail -1 > > tcp 0 0 192.168.1.4:49060 192.168.1.6:3306 TIME_WAIT > > > > I'm sure it is because of mod_perl, and I'm looking forward to force > > radius to use permanent mysql connections. > > Has anyone any idea? > > > > Thanks in advance > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Permanent mysql connection in mod_perl
by Nasser Heidari 07 Apr '10

07 Apr '10

Hi, I'm using mod_perl in my radius configuration and using it I write some logs to database. Today I noticed that, there are lots of mysql connections in TIME_WAIT state. # netstat -epn --tcp | grep TIME_WAIT | wc -l 15015 netstat -epn --tcp | grep TIME_WAIT | tail -1 tcp 0 0 192.168.1.4:49060 192.168.1.6:3306 TIME_WAIT I'm sure it is because of mod_perl, and I'm looking forward to force radius to use permanent mysql connections. Has anyone any idea? Thanks in advance

2 1

(no subject)
by Richie Lee 06 Apr '10

06 Apr '10

http://membres.multimania.fr/pmtwiik/ _________________________________________________________________ Hotmail & Messenger. Get them on your phone now. http://go.microsoft.com/?linkid=9724463

1 0

(no subject)
by Richie Lee 06 Apr '10

06 Apr '10

http://uqosobupafiz.moy.su _________________________________________________________________ Videos that have everyone talking! Now also in HD! http://go.microsoft.com/?linkid=9724465

1 0

Multiple EAP-TLS modules with different certificates
by Thibault Le Meur 06 Apr '10

06 Apr '10

Hi, I'm about to change the CA of my radius server certificate. At the same time I've installed a new wifi network and plan to change the SSID as well (authentication is EAP-TTLS or EAP-PEAP). In order to avoid a complete breakout when I change the certificate of my radius server (because a manual operation is required on the supplicant side to select the new CA), I'd like to configure FR so that: * when the WiFi client connects to the SSID1, the server uses the old certificate and key, * and when the client uses the SSID2, the radius server uses the new certificate and key Is this possible ? I've already tried such a configuration by: * defining 2 eap modules let's say "eapOld" and "eapNew" (each with its own key and cert) * making sure that depending on the SSID, the access-point sets a different NAS-Identifier (let's say ID1 and ID2) in the Access-request * in the virtual FR server, I've used unlang to run either eap module: in authorize: if ("%{request:NAS-Identifier}" == ID1) { eapOld { ok = return } if ("%{request:NAS-Identifier}" == ID2) { eapNew { ok = return } in authenticate: Auth-Type eapNew { eapNew } Auth-Type eapOld { eapOld } in eap.conf: the two eap modules only differ from their certificate/key, they redirect to the same inner-tunnel virtual server. The result so far is that with such setup my wireless clients can't connect at all when they check the certificate, but can connect when they don't (no matter what setup is done on the client side). Of course I've installed the 2 certificates on the client to check this. A quick look at FR debug logs confirms, as far as I can read them, that the client is refusing the radius server certificate. Is there a client tool to check which certificate is used by FR ? Have I missed something in the setup ? I've tried to turn on Windows EAP log, but they aren't very easy to read as far as TLS/TTLS/PEAP authentication is concerned ! Environement: FR is 2.1.1, client used Windows XP SP3 and Windows 7. Thanks a lot for your ideas, proposals, ... Best regards, Thibault

2 3

(no subject)
by Richie Lee 05 Apr '10

05 Apr '10

http://penepymibasok.moy.su _________________________________________________________________ Got a phone? Get Hotmail & Messenger for mobile! http://go.microsoft.com/?linkid=9724464

1 0

I have a question about freeradius-client-1.1.6.
by Bryant 05 Apr '10

05 Apr '10

Hi, I download freeradius-client-1.1.6 from your website.Now,I have installed and configured the freeradius server 2.1.8 and freeradius-client-1.1.6 successfully. I use the mysql to store the user and I create a user whose username is test,Auth_Type is Local,Cleartext-Password is test. Then I run the command: #radtest test test lcoalhost 0 testing123 This can authorize successfully. But when I compile freeradius-client-1.1.6/src/radexample.c or run radlogin. #login:test #passoword:test This don't authorize successfully. When I see the server's display ,I find the password is encryped. What should I do? Thanks!

2 1

(no subject)
by Richie Lee 04 Apr '10

04 Apr '10

http://olepidinuqa.ucoz.es _________________________________________________________________ Live connected. Get Hotmail & Messenger on your phone. http://go.microsoft.com/?linkid=9724462

1 0