- Freeradius-Users - lists.freeradius.org

accounting packets
by VU VAN HUNG 27 Apr '10

27 Apr '10

Hi all, I'm trying to implement radius accounting. I want to ask how I can know whether accounting packets are sent and received ? Hung,

2 4

Proxy EAP-TLS as non-EAP
by Alok Shingala 27 Apr '10

27 Apr '10

I am trying to setup FreeRadius server to handle EAP-TLS authentication with a WiMAX ASN GW. I have another Radius server which does not support EAP-TLS but stores the WiMAX QoS attribute values that need to be assigned to the user (user is identified by Calling-Station-ID). I have been going through all post archive for few days but have NOT been able to find a thread that directly answers my question. 1. How can I proxy the EAP-TLS request to a radius server which does not support EAP ? (I only need the Radius Attributes in the outer tunnel) 2. How can I add QoS attributes from the proxy-radius response to the outer-tunnel of the EAP-TLS response ? Highly appreciate any help from the community. Thanks and Regards, Alok

2 1

More complex Proxying
by Rosario Lumia 27 Apr '10

27 Apr '10

Hi to all, I'm not sure how can I configure freeradius to have this kind of configuration: try to account to home_server1; if fails try home_server2; else fail; A kind of failover but not exactly; my goal is to have one @realm for more authentication server. I read the "more complex configuration" but I'm not sure that I can apply this rule in proxy.conf and how. Thanks in advance. -- Rosario L.

2 3

Remote MySQL backend encryption
by Eric.Hernandez＠allegiantair.com 27 Apr '10

27 Apr '10

I see thats what I thought, I also confirmed its all clear text with tcpdump. If I were to switch my backend to an ldap system would I have encrypted traffic for user authentication with freeradius remote ldap/backend setup? Also is there a nas/radacct table equivalent in the ldap solution or is it strictly for user authentication? Message: 9 Date: Mon, 26 Apr 2010 15:04:17 -0400 From: John Dennis <jdennis(a)redhat.com> Subject: Re: Remote MySQL backend encryption To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4BD5E3B1.8060706(a)redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed On 04/26/2010 01:57 PM, Eric.Hernandez(a)allegiantair.com wrote: > Hi, > > I am trying to figure out if need to encrypt my traffic from a > FreeRadius server to a remote MySQL backend. > > I have the following setup. > > FreeRadius/MySQL (Server1) > > FreeRadius/MySQL (Server2) Both Server1 and Server2 are doing MySQL > Master to Master (ssl) Replication > > Now I want to add a third FreeRadius server without a local MySQL Backend. > > So this third server will point to either Server1 or Server2 which runs > MySQL but will these request be sent to the remote MySQL Servers in > clear text? This has nothing to do with how many MySQL servers you've got or how you're doing replication, encryption occurs on a per connection basis (e.g. connections established via rlm_sql_mysql). rlm_sql_mysql never opens an encrypted session with it's server because rlm_sql_mysql does not have an option to set SSL/TLS transport (e.g. does not call mysql_ssl_set()). That probably would be a good feature to add. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Dynamic VLAN with AD/LDAP - Best Practice / preferred option?
by Gary Gatten 27 Apr '10

27 Apr '10

Hello all, I currently have FR v2.1.6 (Yes, I'll upgrade...) running on RHEL5. I'm authenticating VPN users and Ci$co device shell access using SAMBA/ntlm_auth integration. "Everything" is working fine. My next task is assigning Dynamic VLAN ID's. I have some test accounts/ports working using the "users" file, but I'm ready to take the next step to deploy DVLANs company wide, and want to assign the ID based on an AD/LDAP attribute. I prefer not to extend the schema and ideally would be able to assign the VLAN ID based on a "Group" attribute - so I don't have to go back and populate some attribute for a couple thousand users. Anyway, there are numerous posts about this issue / similar issues. I'm wondering if there is a "Best Practice" method or "Preferred" method to accomplish this? A method known to work better than another or works as well as anything but is "easy" to implement, etc. Or, is this one of those things where there is a dozen right answers and I just need to pick one and do it? Any thoughts appreciated! TIA! Gary

2 1

Freeradius against NAS Cisco 7206-VXR
by Wagner Pereira 26 Apr '10

26 Apr '10

Hi, all. Is there a How-To explaining how to implement Radius in this NAS? The IOS version is 12.2 Thanks. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Tel. (11) 3091-8901

2 2

Remote MySQL backend encryption
by Eric.Hernandez＠allegiantair.com 26 Apr '10

26 Apr '10

Hi, I am trying to figure out if need to encrypt my traffic from a FreeRadius server to a remote MySQL backend. I have the following setup. FreeRadius/MySQL (Server1) FreeRadius/MySQL (Server2) Both Server1 and Server2 are doing MySQL Master to Master (ssl) Replication Now I want to add a third FreeRadius server without a local MySQL Backend. So this third server will point to either Server1 or Server2 which runs MySQL but will these request be sent to the remote MySQL Servers in clear text? -Thanks Eric

3 2

Using Radiusclient to implement a radius client on Windows platform?
by Joshua Lim 26 Apr '10

26 Apr '10

Hi I'm a newbie, hope someone can help me. I'm trying to implementing a radius client on Windows platform to work with freeradius. I intend to use VC++ or Delphi. radiusclient is for linux platform, can i adapt it for Windows? Grateful for any pointers. :) Rgds, Joshua

2 3

cannot get core dump of crashing freeradius
by Jakob Hirsch 26 Apr '10

26 Apr '10

Hi, we have freeradius 2.1.8 running on a couple of servers and are very happy with it. But every few days FR crashes on one of the servers (a random one, not always the same). The load is significant (average 150 requests/s per server, 400/s peak) but sureley not too high. So everything seems to run fine besides the annoying crashes, which alarms people and make the weekly availibility reports look bad (even though FR is restarted automatically, of course). The previous 1.1.8 installation we upgraded 6 months ago from did not have this problem. Anyways, I really want to find out what's going wrong, so I wanted to get core dumps of these crashes. Only that I just don't get them. - radiusd.conf has allow_core_dumps = yes (and FR says "Info: Core dumps are enabled." at startup) - /proc/sys/kernel/core_pattern is set to '/tmp/core.%t.%e.%p', so core dumps can be written to disk (tested with a little programm that forces a segfault) - I put "ulimit -c unlimited" in the startup script. cat /proc/$(pidof freeradius)/limits shows "unlimited" for soft and hard limit of "Max core file size" So what's missing? The only indication of the crash is this line in syslog: > Apr 10 17:57:19 xxxxxxxx kernel: [12268615.000288] freeradius[14846]: segfault at 73818 ip 00007f0cb40e875e sp 00007fff9c6304c0 error 4 in libfreeradius-radius-2.1.8.so[7f0cb40d1000+1f000] (This is debian lenny x86_64, btw.) Any hints? I even thought about running FR as a foreground process or even with gdb, but I wanted to check here first. Regards and thanks in advance, Jakob

5 12

Compiling freeradius
by Kristoffer Milligan 26 Apr '10

26 Apr '10

I'm trying to compile a fresh version of FreeRADIUS. I fetched the latest stable from git://git.freeradius.org/freeradius-server.git using the information provided at http://git.freeradius.org/. I am using the following configuration string: ./configure --with-experimental-modules I want the experimental modules to support WiMAX. Configuration works perfectly, but when building I get the following error: make[6]: Leaving directory `/root/freeradius-server/src/modules/rlm_wimax' make[5]: Leaving directory `/root/freeradius-server/src/modules' make[4]: Leaving directory `/root/freeradius-server/src/modules' Making all in main... /usr/bin/make -w -C main all make[4]: Entering directory `/root/freeradius-server/src/main' /root/freeradius-server/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/freeradius-server/src -DHOSTINFO=\"x86_64-unknown-linux-gnu\" -DRADIUSD_VERSION=\"2.2.0\" -DOPENSSL_NO_KRB5 -c event.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/freeradius-server/src -DHOSTINFO=\"x86_64-unknown-linux-gnu\" -DRADIUSD_VERSION=\"2.2.0\" -DOPENSSL_NO_KRB5 -c event.c -fPIC -DPIC -o .libs/event.o event.c:634: warning: no previous prototype for 'revive_home_server' event.c:852: warning: no previous prototype for 'mark_home_server_dead' event.c: In function 'wait_a_bit': event.c:1192: error: label 'stop_processing' used but not defined event.c: In function 'radius_signal_self': event.c:3819: warning: ignoring return value of 'write', declared with attribute warn_unused_result make[4]: *** [event.lo] Error 1 make[4]: Leaving directory `/root/freeradius-server/src/main' make[3]: *** [main] Error 2 make[3]: Leaving directory `/root/freeradius-server/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/freeradius-server/src' make[1]: *** [src] Error 2 make[1]: Leaving directory `/root/freeradius-server' make: *** [all] Error 2 Any suggestions to what I am messing up? Thanks in advance, Kristoffer Milligan

3 2