- Freeradius-Users - lists.freeradius.org

RE: Re: Proxying question for Eduroam
by Peter Kruppa 20 Oct '10

20 Oct '10

Hi, > what is your MTU set to for EAP packets - you may need to reduce this to eg 1024 > to stop UDP fragmentation of such traffic Bingo, thanks Alan Best regards, Peter -----Oorspronkelijk bericht----- Date: Thu, 14 Oct 2010 09:35:25 +0100 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Proxying question for Eduroam To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20101014083525.GA4395(a)lboro.ac.uk> Content-Type: text/plain; charset=utf-8 Hi, > I managed to reproduce that situation by using eapol_test, in that case > requests to IAS aren?t logged and it never replies with a > Access-Challenge. if you run wireshark on the IAS host - of eg RSPAN its port to sniff traffic, fo you see the RADIUS traffic going to the IAS box and its daemon? does nothing log at all in IAS? what is your MTU set to for EAP packets - you may need to reduce this to eg 1024 to stop UDP fragmentation of such traffic ..and, finally, is 'Framed-MTU' RADIUS attribute being proxied through or is it being filtered? alan

1 0

Re: Freeradius 1.2.3 and Windows 7
by Alan DeKok 20 Oct '10

20 Oct '10

Krzysztof Srokowski wrote: > Before I ask detailed question I have one simple. Can Freeradius 1.2.3 What's that? There is no version "1.2.3". > cooperate successfully with Windows 7 ? I Mean in configuration > WPA2-Enterprise (AES) + EAP-PEAP(MSCHAPv2) ? I cant get no information > about it. Actually my configuration works fine with Windows XP, so after > hours of fight with Windows 7 this must be my first question… The latest version is 2.1.10, and works fine with Windows 7. Alan DeKok.

2 1

Freeradius 1.2.3 and Windows 7
by Krzysztof Srokowski 19 Oct '10

19 Oct '10

Hello, Before I ask detailed question I have one simple. Can Freeradius 1.2.3 cooperate successfully with Windows 7 ? I Mean in configuration WPA2-Enterprise (AES) + EAP-PEAP(MSCHAPv2) ? I cant get no information about it. Actually my configuration works fine with Windows XP, so after hours of fight with Windows 7 this must be my first question. Thanks for reply.

1 0

Redundant SQL
by Chesterfield McMillan 19 Oct '10

19 Oct '10

I'm trying to implement the redundant SQL feature into my freeradius setup. The one problem I am coming up against is when freeradius is starting, but not all the SQL servers are available. I have set up sql1 and sql2 as a single virtual module and would ideally like it to *try* to connect to all servers on start-up, but if an error occurs (can't connect to one), then just bypass and continue. Assuming the total failure to is what is meant to happen, I can understand why, but in my case I'd rather have it connect to at least one database server than fail if it can't connect to them all. Is this setup possible? Regards, Chester.

3 2

Limiting access to Cisco boces to certain users
by Richard D 19 Oct '10

19 Oct '10

We have numerous routers that all our NEs need access to, so that's no issue. However, there is a developer that needs full access to one particular router. I've added him to the users file, but he has access to everything right now. I've tried using huntgroups but that completely locks him out of everything. What's the best way to limit a user or users to access only particular Cisco boxes? Thanks.

1 0

Cisco LNS with Freeradius and MySQL
by Stephane MAGAND 18 Oct '10

18 Oct '10

Hi I request a small help for my configuration, sorry for my english: I have a cisco router with VRF I have a Freeradius server with sql I have a lot of Adsl user in L2TP. I want add one user to a specific vrf, i have added to the mysql table: INSERT INTO `radgroupreply` VALUES (9, 'IAccess', 'cisco-avpair', '+=', '"lcp:interface-config=ip vrf forwarding INT002\\n ip unnumbered Loopback250"'); but when the user connect, that's don't work ... On my cisco router, i have: One Loopback: interface Loopback250 ip vrf forwarding INT002 no ip address One Vrf: ip vrf INT002 rd 65509:501 route-target export 65509:101 route-target import 65509:100 route-target import 65509:50 where is my error ? Second question: I use sqlippool for dynamic IP, if i want specify a IP to a username (static) what is the process ? create a specific group ? thanks for your help stephane

2 4

DHCP with option 82 best practice
by Zietz, Marco 18 Oct '10

18 Oct '10

Hi everybody, at first I want to thank Arran and Alan for their help with my last post. Good job! Had trouble getting the lists reply's, but solved now. I am curious if somebody could share information how to get FR as DHCP with option 82 authentication up and running. Couldn't find much information in provided sample files and on the net. My own experiments with auth configs were not particularly successful. The key I am missing is the link between having DHCP-Relay-Circuit-Id in DHCP-Request and DHCP-Discover messages and kicking in some kind of auth in order to return a DHCP-Offer/Ack message including a client IP out of the configured IP pools. Backend is mysql. I have the feeling that most users straight heading for rlm_perl and not using the ppp/chap/pap alike chain. This I would understand since the handshakes differ. Confirmation of this thesis would help me as well, so I can stop searching and start coding ;o) Any comment much appreciated! Cheers, Marco

3 2

Radiusd error + libfreeradius-radius-2.1.10.so
by Octavio Ramirez 18 Oct '10

18 Oct '10

Hi all, I try to install freeradius server 2.1.10. After the commands #./configure #make #make install everything is ok. Then, when I try to execute radiusd -X, I have this error: radiusd: error while loading shared libraries: libfreeradius-radius-2.1.10.so: cannot open shared object file: No such file or directory Where can I find these shared libraries?? I have to modify the PATH library? Thanks in advance. Octavio

2 1

Proxy Issue
by Garber, Neal 17 Oct '10

17 Oct '10

I'm testing proxying of authentications (it's not something I've done before so this could be my problem). I have a pool with 2 home servers defined in proxy.conf. For now, both servers are unreachable (blocked by a firewall). I'm using git head 2.1.x branch and I'm testing using eapol_test. The failure is repeatable, while the server is performing no other work, and occurs after the client retries twice (so three Access-Requests are sent to FR) and after the 3rd request, it wakes up from sleeping and dies: Wed Oct 13 14:44:17 2010 : Debug: Waking up in 11.3 seconds. Wed Oct 13 14:44:28 2010 : Error: ASSERT FAILED event.c[1175]: "We do not have threads, but the request is marked as queued or running in a child thread" == NULL [1]+ Abort trap: 6 radiusd -X (wd: /usr/local/etc/raddb) Any ideas? I can post complete debug output if needed and/or parts of my config.

2 6

Toggle Calling-Station-Id check item based on Framed-Protocol?
by William Burnett 16 Oct '10

16 Oct '10

Hello all.. I'm trying to setup my Radius server so that it will map MAC addresses to TTLS user/pass for 802.1x. I have that part working fine. The problem is, the same user/pass pair I'm also using for the clients PPPoE authentication. I want the Calling-Station-Id to be verified when an EAP/TTLS session is being authenticated, but I don't want to check the Calling-Station-Id when the PPPoE session is authenticating. This is because the TTLS device is known and controlled by me, the PPPoE device may be any MAC address that I don't want to have to maintain a list of. My question is, using unlang is there an option do delete a check item attribute based on another attribute? IE: if (Framed-Protocol == PPP) { update-control { Calling-Station-Id !* # Not sure if I'm using the !* operator properly here } } That code just yields errors, but thats essentially what I'm trying to do... Sincerely, William Burnett burnett.w(a)gmail.com

1 1