- Freeradius-Users - lists.freeradius.org

post proxy problem
by VannMann32 . 09 Mar '06

09 Mar '06

Hi ! I'm trying to set up Freeradius (1.1.0) to proxy ms-chap-v2 and when I get the "accept" from ms-win2k3-ias server, then i want to assign a static ip address. Reading the doc/proxy file, i read that the user file is processed as usual after accept is received ms radius server. users : DEFAULT Service-Type == Framed-User, User-Name == "username" Framed-IP-Address = 192.168.1.100 Running radius in debug mode i alway get this : Error: Warning: Found 2 auth-types on request for user 'username@domain' Is it possible to assign a ip address after a ack (accept) is received from the proxy radius server ? If yes, anybody have a config example for me ?

2 4

RE: mysql 4.1.0 can not run normally in Freeradius 1.0.5
by yao guoxian 09 Mar '06

09 Mar '06

>Are you sure that you have compiled FR with mysql support ? >Recompile it >with sql_mysql driver and it should work. I am not family with FR. I just use ./configure make make install Howerver when I input : radiusd -X The same error appears. Is it the correct way to recompile FR? If not , will you please tell me the correct way?

1 0

accounting of MAC of the NAS
by Alex M 08 Mar '06

08 Mar '06

Hi I've noticed while running in debug mode, I can see the MAC of the NAS, but when I go to the Accounting logs (that are stored in MySQL) I don't see any place for MAC of the NAS, it only has the space for NAS IP. So is it possible to make freeradius to log the MAC address of the nas too? Thanks!

2 4

nas table in SQL backend
by trs 08 Mar '06

08 Mar '06

The SQL scripts have a comment for the nas table that says it isn't used by freeradius. Is this still the case? How is it populated otherwise?

2 3

Cert Generation Script
by Stephen Walsh 08 Mar '06

08 Mar '06

Apologies if this is off-topic, but for those that may need it, I've written a small bash script (called cascript) to extend the certificate generation script supplied with FR (CA.all). It was written as part of the EDUROAM project in Australia (http://www.eduroam.edu.au) and can be downloaded from http://www.eduroam.edu.au/tech.index.html Please feel free to test it and let me know (off list, of course) if you have any problems with it. many thanks Stephen Walsh s.walsh(a)signadou.acu.edu.au Client Support Officer (Technology) Australian Catholic University (Limited) PO Box 256, Dickson ACT 2602 Phone: +61 2 6209 1133 Fax: +61 2 6209 1179 Mobile: +61 419 496796 +++++++++++++++++++++++++++++++++++++++++++++++++ CRICOS Registration: 00004G, 00112C, 00873F, 00885B ABN 15 050 192 660 +++++++++++++++++++++++++++++++++++++++++++++++++

2 2

RE: eap don't work
by pelusa vali 08 Mar '06

08 Mar '06

first of all, thanks so much alan for your quick response >Hi, > > hi everybody, i have problems using freeradius 1.0.5, i cann't get it >works > > as i hope. well i installed freeradius in my server and tried to see if > > clients can authenticate, so first tried test over server, my ip is > > 192.168.10.1, i generate certificates to use TLS. > > > > this is my users file: > > > > "mec01" Auth-Type := EAP > >dont do this. just dont do this at all. read the docs. > excuse me, i read many tutorials and all of them says this is correct, so please could you refer me to right doc?? may be freeradius docs? exactly which? and again thanks for your answer. _________________________________________________________________ Charla con tus amigos en línea mediante MSN Messenger: http://messenger.latam.msn.com/

4 3

Realms default problem
by Vasco Santos 08 Mar '06

08 Mar '06

Hi folks, I what to put a new service in my radius server and I have this configuration in realms file: mycompany.com LOCAL nostrip NULL LOCAL nostrip DEFAULT XXX.XXX.XXX.XXX:1600 nostrip I actualy have one default server to default domains that are unknown in my server, but I want to implement a new service with clients that I dont know the domain, this is a new default server. Its is possible to put a priotity in servers? someting like this: DEFAULT1 XXX.XXX.XXX.XXX:1700 nostrip DEFAULT XXX.XXX.XXX.XXX:1600 nostrip if the login fail in the server nº1 going to the server nº2. This its possible? If not possible, give-me solutions to my problem or ways to resolve. Thanks.

2 1

"Dropping conflicting packet" and "Rejecting request"
by Takeshi Yoshida 08 Mar '06

08 Mar '06

I am moving FreeRadius(1.1.0 Sparc Solaris9) by the following compositions. (Target is "* Proxy *") ------------ --------------- | Radius-1 |--> -->| HomeRadius1 |---RDB ------------ | ----------- | --------------- |-->|* Proxy *|-->| ------------ | ----------- | --------------- | Radius-2 |--> -->| HomeRadius2 |---RDB ------------ --------------- The role of this server is only a Proxy server. The occasionally following errors are output by "radius.log" Wed Feb 22 11:53:38 2006 : Error: Dropping conflicting packet from client Radus-1:1039 - ID: 246 due to unfinished request 7101301 and Wed Feb 22 11:53:38 2006 : Error: Rejecting request 7101299 due to lack of any response from home server Radius-1:1039 Why are these messages output? The number of requests that *Proxy* receive is AUTH=10 and ACCT=15 in about one second. It is a setting as follows. --- radiusd.conf --- max_request_time = 12 delete_blocked_requests = no cleanup_delay = 6 max_requests = 20480 hostname_lookups = no reject_delay = 3 proxy_requests = yes --- proxy.conf --- proxy server { synchronous = no retry_delay = 0 retry_count = 0 dead_time = 60 default_fallback = yes post_proxy_authorize = no } When the examination on which I put the load is done, this error is fully output. However, it is output when the load is low. There is always one kind of UDP transmission Port of "Radius-1" and "Radius-2". (It is not unique at each request. ) Because this server is being operated, it is not possible to do in debug mode. Please give something a good idea to me. I'm sorry in strange English. My best regards. ######################################### # # # Takeshi Yoshida # # # ######################################### --------------------------------- TSUKAME EIKOU! KAGAYAKE EGAO! Yahoo! JAPAN JPC OFFICIAL PARTNER INTERNET PORTAL SITE

2 1

freeradius hangs, using 98% CPU
by George C. Kaplan 08 Mar '06

08 Mar '06

For some time we've had an intermittent problem where freeradius becomes unresponsive, consuming at least 98% of the CPU. A 'kill -TERM' will sometimes kill the daemon, but usually a 'kill -9' is needed. This always seems to happen right about when we reload the config (with a HUP), or stop and restart the daemon. We're using freeradius 1.0.5 on FreeBSD 5.5-PRERELEASE, but we also saw this problem with FR 1.0.1 on FreeBSD 5.3 and 5.4. We recently added an authorization step (using LDAP and perl) to our Kerberos-authenticated wireless service, and this might offer some clues about the timing of the problem. A sample from our radius.log is attached. At 14:12:04, two users (user1 and user2) connect at about the same time, are authorized by rlm_perl, and then authenticated with Kerberos. Then, at 14:12:06, user3 connects just as the daemon gets the HUP signal. User3 is authorized, but never gets authenticated; the daemon reloads, but is unresponsive until I kill and restart it at 14:30:01 I'm guessing that the daemon can hang if it gets a signal just as the rlm_krb5 module is called. It's marked RLM_TYPE_THREAD_UNSAFE, so it gets a mutex, and attaching gdb to the hung daemon showed: [Switching to LWP 100171] 0x28205940 in pthread_mutexattr_init () from /usr/lib/libpthread.so.1 (gdb) where #0 0x28205940 in pthread_mutexattr_init () from /usr/lib/libpthread.so.1 Is anyone aware of any freeradius thread problems (especially related to the FreeBSD thread libraries) that might explain this? Any suggestions for avoiding the problem or tracking it down in more detail? Thanks, -- George C. Kaplan gckaplan(a)ack.berkeley.edu Communication & Network Services 510-643-0496 University of California at Berkeley Tue Mar 7 14:12:04 2006 : rlm_perl: [user1] EMPLOYEE-TYPE-ACADEMIC OK Tue Mar 7 14:12:04 2006 : rlm_perl: [user2] STUDENT-TERM-SPRING OK Tue Mar 7 14:12:04 2006 : Auth: Login OK: [user1] (from client wireless-gw1 port 3002 cli 000e35a87f43) Tue Mar 7 14:12:04 2006 : Auth: Login OK: [user2] (from client wireless-gw1 port 1002 cli 00904b5de43b) Tue Mar 7 14:12:06 2006 : rlm_perl: [user3] STUDENT-TERM-SPRING OK Tue Mar 7 14:12:06 2006 : Info: Reloading configuration files. Tue Mar 7 14:12:06 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Mar 7 14:12:06 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Mar 7 14:12:06 2006 : Auth: rlm_krb5: krb5_init ok Tue Mar 7 14:12:06 2006 : Info: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no Tue Mar 7 14:12:06 2006 : Info: rlm_passwd: nfields: 6 keyfield 0(User-Name) listable: no Tue Mar 7 14:12:06 2006 : Info: rlm_passwd: nfields: 2 keyfield 0(User-Name) listable: no Tue Mar 7 14:12:07 2006 : Info: Ready to process requests. Tue Mar 7 14:30:01 2006 : Error: WARNING: Unresponsive child (id 136453120) for request 31420 Tue Mar 7 14:30:03 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Mar 7 14:30:03 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Mar 7 14:30:03 2006 : Auth: rlm_krb5: krb5_init ok Tue Mar 7 14:30:03 2006 : Info: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no Tue Mar 7 14:30:03 2006 : Info: rlm_passwd: nfields: 6 keyfield 0(User-Name) listable: no Tue Mar 7 14:30:03 2006 : Info: rlm_passwd: nfields: 2 keyfield 0(User-Name) listable: no Tue Mar 7 14:30:03 2006 : Info: Ready to process requests.

2 1

unsubscribe
by John Peebles 08 Mar '06

08 Mar '06

1 0