- Freeradius-Users - lists.freeradius.org

how to fix proxy source address
by Yusuke SAKAMOTO 24 Apr '11

24 Apr '11

Hi all. I'm using FreeRADIUS 2.1.10 on FreeBSD. May I ask about the freeradius's socket creation behavior? I set up the following environment, and I use FreeRADIUS as a radius proxy server. The host has two IP addresses (X.X.X.X and X.X.X.Y), but FreeRADIUS is running only on X.X.X.X because I start it by "radiusd -i X.X.X.X". +-------------------+ +-------------+ | client | ------------> X.X.X.X | | +-------------------+ | | | | | FreeRADIUS | +--------+ | 2.1.10 | +-----------------------+ | | | | another RADIUS server | <-+ X.X.X.Y | | +-----------------------+ +-------------+ In this environment, I expect the FreeRADIUS to use X.X.X.X as the source IP address when proxying the request, and FreeRADIUS usually works so. I found, however, when clients sent a lots of requests and they exhausted 256 IDs in proxied radius packet, FreeRADIUS created a new socket on X.X.X.Y in spite of "-i X.X.X.X" option. The log message was " ... adding new socket proxy address * port ZZZZZ". # Of course, the port on X.X.X.X was not exhausted. Could you tell me if I can fix the source address to X.X.X.X? # I know the listen section in radiusd.conf is available, but I'm # afraid that "-i" option overwrites it. Regards, -- Yusuke Sakamoto

2 2

How to fix the proxy source address
by Yusuke SAKAMOTO 24 Apr '11

24 Apr '11

Hi all. I'm using FreeRADIUS 2.1.10 on FreeBSD. May I ask about the freeradius's socket creation behavior? I set up the following environment, and I use FreeRADIUS as a radius proxy server. The host has two IP addresses (X.X.X.X and X.X.X.Y), but FreeRADIUS is running only on X.X.X.X because I start it by "radiusd -i X.X.X.X". +-------------------+ +-------------+ | client | ------------> X.X.X.X | | +-------------------+ | | | | | FreeRADIUS | +--------+ | 2.1.10 | +-----------------------+ | | | | another RADIUS server | <-+ X.X.X.Y | | +-----------------------+ +-------------+ In this environment, I expect the FreeRADIUS to use X.X.X.X as the source IP address when proxying the request, and FreeRADIUS usually works so. I found, however, when clients sent a lots of requests and they exhausted 256 IDs in proxied radius packet, FreeRADIUS created a new socket on X.X.X.Y in spite of "-i X.X.X.X" option. The log message was " ... adding new socket proxy address * port ZZZZZ". # Of course, the port on X.X.X.X was not exhausted. Could you tell me if I can fix the source address to X.X.X.X? # I know the listen section in radiusd.conf is available, but I'm # afraid that "-i" option overwrites it. Regards, -- Yusuke Sakamoto

1 1

how to fix proxy source address
by Yusuke SAKAMOTO 24 Apr '11

24 Apr '11

Hi all. I'm using FreeRADIUS 2.1.10 on FreeBSD. May I ask about the freeradius's socket creation behavior? I set up the following environment, and I use FreeRADIUS as a radius proxy server. The host has two IP addresses (X.X.X.X and X.X.X.Y), but FreeRADIUS is running only on X.X.X.X because I start it by "radiusd -i X.X.X.X". +-------------------+ +-------------+ | client | ------------> X.X.X.X | | +-------------------+ | | | | | FreeRADIUS | +--------+ | 2.1.10 | +-----------------------+ | | | | another RADIUS server | <-+ X.X.X.Y | | +-----------------------+ +-------------+ In this environment, I expect the FreeRADIUS to use X.X.X.X as the source IP address when proxying the request, and FreeRADIUS usually works so. I found, however, when clients sent a lots of requests and they exhausted 256 IDs in proxied radius packet, FreeRADIUS created a new socket on X.X.X.Y in spite of "-i X.X.X.X" option. The log message was " ... adding new socket proxy address * port ZZZZZ". # Of course, the port on X.X.X.X was not exhausted. Could you tell me if I can fix the source address to X.X.X.X? # I know the listen section in radiusd.conf is available, but I'm # afraid that "-i" option overwrites it. Regards, -- Yusuke Sakamoto

1 0

Help with simultaneous use and radutmp
by Rodrigo Yoshioka 24 Apr '11

24 Apr '11

Hi folks..... I have a FreeRadius server working with Mikrotik as NAS, and I'm often receiveing message of multiple connection at log, and the user is not able to connect. I found some solutions at google but it's to whom uses freeradius with sql as session manager. I'm using radutmp file and I couldn't find any solution to kill the session locked at the radutmp file. anyone can help me..?? The message I'm receiving is: Sat Apr 23 18:02:03 2011 : Auth: Multiple logins (max 1) : [#######@########/<no User-Password attribute>] (from client ###.##.0.0/24 port 35226 cli ##:##:##:##:##:##) My Freeradius version is 2.1. Thanks Rodrigo Yoshioka

2 3

Re: New to RASIUS
by Jahm 24 Apr '11

24 Apr '11

But when I enable the RADIUS server in Mac, it can only recognize AirPort devices and can't add my NetGear. Sent from my iPhone On Apr 24, 2011, at 8:31 AM, Arran Cudbard-Bell <a.cudbardb(a)gmail.com> wrote: Is FreeRADIUS is somehow the same as the RADIUS server offered in Snow Leopard Server? Snow leopard has an older version of FreeRADIUS but yes its essentially the same thing. -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

New to RASIUS
by Jahm 24 Apr '11

24 Apr '11

Hi, good day! I have 25% knowledge about servers (Win2k3 and Mac) and completely noob when it comes to RADIUS. I'll just ask a few things for me to get started. What are the things needed for me to set-up a RADIUS server? Is FreeRADIUS is somehow the same as the RADIUS server offered in Snow Leopard Server? Sent from my iPhone

2 1

Example of how to use caching (Cached-Session-Policy)?
by John Douglass 23 Apr '11

23 Apr '11

I am apparently using the Caching improperly in regards to configuration in eap.conf. The first authentication works great (EAP-PEAP-MSChapv2) and DB lookups. The second time (with caching enabled) it appears to only be adding the User-Name attribute to the reply. I see the comments in the file "eap.conf" but they don't go very far into explaining how to get certain attributes saved INTO the cache or pulled out of it. Does anyone have an example of how to use this "Cached-Session-Policy" which is applied to the cached session? eap.conf cache section reads: The "Cached-Session-Policy" is the name of a policy which should be applied to the cached session. This policy can be used to assign VLANs, IP addresses, etc. It serves as a useful way to re-apply the policy from the original Access-Accept to the subsequent Access-Accept for the cached session. What exactly am I supposed to store into the attribute "Cached-Session-Policy"? Is this referring to a policy within the file "policy.conf" that will run and extract attributes according to the function there or is it something else? The notes also say: # You probably also want "use_tunneled_reply = yes" when using fast session resumption. And I have turned that on everywhere I could find, but it doesn't appear to be even saving the 1st values of Tunnel-Private-Group-Id. Debug output: First time that responds correctly given a VLAN. [snipped] [peap] Using saved attributes from the original Access-Accept Tunnel-Private-Group-Id:0 = "316" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 User-Name = "jd187" [peap] Saving response in the cache [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /services/freeradius/etc/raddb//sites-enabled/dvlan-1x-working } # server dvlan-1x-test1 Sending Access-Accept of id 157 to 128.61.2.253 port 1645 Tunnel-Private-Group-Id:0 = "316" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 User-Name = "jd187" MS-MPPE-Recv-Key = 0xbdc694a560b3fc4e37385fe08bb9876e11d215add69317c704fa374f462bcb0a MS-MPPE-Send-Key = 0xa039b0c10a7ef3511a68cdd837f13747c7a4adcb86dc5d73a8506f0105a9ced4 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 7. Going to the next request After attempting a second auth which appears to bypass the logic to assign a VLAN but doesn't appear to be adding it to the response from the cache at all. [snipped] [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Adding cached attributes to the reply: User-Name = "jd187" [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /services/freeradius/etc/raddb//sites-enabled/dvlan-1x-working } # server dvlan-1x-test1 Sending Access-Accept of id 161 to 128.61.2.253 port 1645 User-Name = "jd187" MS-MPPE-Recv-Key = 0x0d398b0ed22899753eac37c8b308afb8a600a4be2b35d4260470148c6f4774cc MS-MPPE-Send-Key = 0x570045c77b56ef4d327189610f20f358038cea5bda215ded4ca32eefd2a72cf2 EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 11.

3 4

Limit Period time
by googerdi 23 Apr '11

23 Apr '11

Hi How can i limit a group or user to be logined in a specific time. for example i have night group that i want to be logined from 1 am to 7 am. Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Limit-Period-time-tp4333210p4333210… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Radius bug?
by duhvir＠ilimtimber.com 22 Apr '11

22 Apr '11

Hello. I use last git freeradius version. radiusd -v (3.0.0) All config in default state, except: proxy.conf --------------- realm xxx { authhost=192.168.1.1:18121 secret=test } modules/eap.conf ----------------------- default_eap_type = peap #Certificate definitions peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" } sites-enabled/proxy-inner-tunnel ------------------------------------------- authorize { update control { Proxy-To-Realm := "xxx" } sites-enabled/sql-auth ---------------------------------- server sql-auth { listen { type = auth ipaddr=192.168.1.1 port=18121 } client 192.168.1.1/32 { secret = test } authorize { Perl } authenticate { Perl } } modules/perl Realy don't matter, freeradius don't go here ( That's all i thing. radius -X All seems ok. If you need I'll post it. When I send request from WiFi client. I see: .... no matter what, I didn't see nothing what can help handle with problem. .... (17) # Executing group from file /usr/local/etc/raddb/sites-enabled/proxy-inner-tunnel (17) +- entering group authenticate {...} (17) [eap] Request found, released from the list (17) [eap] EAP/mschapv2 (17) [eap] processing type mschapv2 (17) [eap] Not-EAP proxy set. Not composing EAP (17) ++[eap] returns handled PEAP: Tunneled authentication will be proxied to ITI PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. (17) [eap] Tunneled session will be proxied. Not doing EAP. (17) ++[eap] returns handled (17) There was no response configured: rejecting request (17) Using Post-Auth-Type Reject ... reject and it's all over ... Main error is: There was no response configured: rejecting request. With that config on 2.1.10 in FreeBSD reps no such error, but there is 118 bug with eap proxification. What I do wrong? Do I need something add to config? Best regards, Andrey.

1 0

Documentation for Setting up Freeradius with MYSQL
by Jaikanth Krishnaswamy 21 Apr '11

21 Apr '11

Hi All, I have a requirement to set up freeradius with MySQL in my environment. I was able to find the DDL Script required for MYSQL Database to be built. Is there a complete How-to from Scratch for compiling free radius to work with MySQL on Ubuntu. Please advice. Thanks JK

1 0