- Freeradius-Users - lists.freeradius.org

Robust Authentication Proxying
by Philip Molter 18 Jul '09

18 Jul '09

Hi, I'm trying to setup a robust RADIUS authentication proxy. All this radius will do is proxy all auth requests to a set of four backend RADIUS handlers. I have a 2.1.6 server that I've configured with four home_server entries and one home_server_pool that load-balances across the four. It works when all four backends are up, but if any 1 of the backend goes down, then requests that get directed to that backend result in an Access-Reject packet being returned to the NAS. Is there a way to configure freeradius so that instead of returning an Access- Reject packet, the server will instead switch to the next configured server and retry the request there? It may mean that it takes a little longer for the request to be handled, but that's better than it being rejected. Thanks for any advice or assistance. Philip

3 27

radius.log permissions issue
by Philip Molter 17 Jul '09

17 Jul '09

With freeradius 2.1.6, I have a configuration such as this in my radiusd.conf file: user = radiusd group = radiusd When I start up radiusd for the first time, the radius.log file gets created with 0640 permissions, owned by root:radiusd, instead of radiusd:radiusd. This doesn't prevent the RADIUS process from working, but it does prevent any useful information from being logged. Is this a known bug? Is there a workaround other than creating the file by hand and setting its ownership before starting freeradius? Philip

4 8

chase_referrals and rebind in 2.1.6
by Wegener, Norbert 17 Jul '09

17 Jul '09

I am having some problems with an AD and FreeRADIUS. rlm_ldap debug lets me assume that there might be a relation to chase_referrals and rebind. According to the Changelog there have been changes regarding this in 2.1.6: Added "chase_referrals" and "rebind" configuration to rlm_ldap. This helps with Active Directory. See raddb/modules/ldap Unfortunately I do not find anything about it in that file. ~/freeradius-server-2.1.6$ grep -r -l -i chase_ref * debian/changelog doc/ChangeLog src/modules/rlm_ldap/rlm_ldap.c Similar result for rebind. What options might be configured for chase_referrals and rebind? Norbert Wegener

2 1

radiusd -f flag - how it affects custom freeradius module
by George Chelidze 17 Jul '09

17 Jul '09

Hello, Recently I have developed a custom module for freeradius 2.1.6 following http://wiki.freeradius.org/Modules2 document. The purpose of this module is to translate authorization requests to Tibco Rendezvous messages (Commercial software - Message Bus), send them to some external application, get the reply back and accept or reject based on this reply. I use client libraries to communicate with tibco rendezvous daemon (rvd) through some IPC mechanism (I think it's tcp sockets). The problem is that when I start freeradius with -f flag client application can send and receive data without any problem. When I start freeradius without any arguments, it can send data but can't receive it, while sniffing the network indicates that response is actually delivered back from rvd. So what's so specific with -f? How can fork()/setsid() break something? Below is a piece of problematic code: rv_status = tibrvTransport_SendRequest(transport, tibrv_msg, &tibrv_msg_reply, request_timeout * 1.0 / 1000); if (rv_status != TIBRV_OK && rv_status != TIBRV_TIMEOUT) { radlog(L_ERR, "rlm_custom_auth: tibrvTransport_SendRequest() failed. Error = \"%s\"", tibrvStatus_GetText(rv_status)); tibrvMsg_destroy(tibrv_msg); return RLM_MODULE_REJECT; } if (rv_status == TIBRV_TIMEOUT) { radlog(L_ERR, "rlm_custom_auth: tibrvTransport_SendRequest() timed out"); tibrvMsg_destroy(tibrv_msg); return RLM_MODULE_REJECT; } so, every time I start freeradius without -f I get: rlm_custom_auth: tibrvTransport_SendRequest() timed out I understand that this problem is very specific to tibco rendezvous which isn't the open source. It will be great if you can share your ideas about the issue. Thanks in advance, George Chelidze

1 0

radiusd -X problem
by shivashankar 17 Jul '09

17 Jul '09

hi, when i run freeradius in solaris10 i am facing below problem miboss3# /usr/local/sbin/radiusd -x ld.so.1: radiusd: fatal: libgcc_s.so.1: open failed: No such file or directory Killed -- View this message in context: http://www.nabble.com/radiusd--X-problem-tp24532174p24532174.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Maximum number of instances of a package already met message while using pkgadd
by shivashankar 17 Jul '09

17 Jul '09

hi, while i am running pkgadd -d gcc-3.2************* showing Maximum number of instances of a package already met message while using pkgadd thax for advance -- View this message in context: http://www.nabble.com/Maximum-number-of-instances-of-a-package-already-met-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

how to get connection with server
by shivashankar 17 Jul '09

17 Jul '09

i installed freeradius 2.1.6 on solaris10. i am unable to start the server.when ever i type the radiusd -X it is saying command not found. plz help me -- View this message in context: http://www.nabble.com/how-to-get-connection-with-server-tp24528569p24528569… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Error: Thread 1 failed waiting for semaphore: Invalid argument: Exiting
by Tim Gustafson 17 Jul '09

17 Jul '09

Hi, I've had a FreeRADIUS 2.1.3 server running on FreeBSD 7.1 for a few months now. I logged in today to add a new group to my users file, and then re-started the RADIUS daemon. After re-starting, I'm getting this in my error log: Info: Ready to process requests. Error: Thread 1 failed waiting for semaphore: Invalid argument: Exiting Error: Thread 2 failed waiting for semaphore: Invalid argument: Exiting Error: Thread 3 failed waiting for semaphore: Invalid argument: Exiting Error: Thread 4 failed waiting for semaphore: Invalid argument: Exiting Error: Thread 5 failed waiting for semaphore: Invalid argument: Exiting When a user tries to log in, the first packet seems to go nowhere, and then the second and subsequent packets emit the following error in the log: Error: Discarding duplicate request from client foo port 65259 - ID: 111 due to unfinished request 0 I rebooted the server, but am still getting the same errors. Any idea what might be causing this? I'm doing a ports rebuild on the FreeBSD box just in case, but I figured I'd ask around a bit. Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 1

Leap + freeRADIUS + AD
by John 17 Jul '09

17 Jul '09

Hi, We are using freeRADIUS-1.1.6 talk with AD. It can work if we use EAP-peap(mschap-v2). Now I want to use Leap in client. But got failed. Can Leap + freeRADIUS + AD support in freeRADIUS-1.1.6 or new version? Thanks. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 1

wpa2-psk and radiusd possible?
by Stefan Jensen 17 Jul '09

17 Jul '09

Hi,... i'm pretty new to radiusd, so this may be a dump question. :-) Is it possible to use something like MAC-based WPA2-PSK's to- gether with radiusd? I have used a single "hostapd" installation as AP, configured with unique WPA2-PSK's for each MAC-Addr that should have access. (which prevents trading the PSK) Now i want extend our network with a couple of Linksys Router, so I've installed radiusd and got EAP,PEAP,802.1X to work so far. But my users find it complicated to mess around with the Certs, so i decided to use the same PSK on all NAS-Clients (dd-wrt) and only doing MAC-Auth with radiusd. Is there a way to have different PSK's for every MAC? I bed, it is not a job for radius and maybe a complete wrong concept? best regards stefan PS: sorry for bad english ;-) -- Stefan Jensen <sjensen(a)versanet.de>

2 3