- Freeradius-Users - lists.freeradius.org

How to configure FreeRadius to proxy out a PoD packet to a NAS
by Suparna Kumar 14 Jan '06

14 Jan '06

Here is my situation.. 1. I am creating the PoD packet according to RFC 3799(using a radClient, or my custom program) 2. Sending the PoD Packets to FreeRadius (which port should I send it to, port 1812 reports "Unknown packet code 40" ) 3. I would like FreeRadius to proxy the PoD packets to the NAS in the PoD packet identified by the NAP-IP-ADDRESS Is this something that can be done in FreeRadius? If yes then how do I need to setup the proxy? Thanks Suparna

2 1

openLDAP vs.mySQL
by Carlo Prestopino 14 Jan '06

14 Jan '06

Hi all, this is a "theoretical" post. As written in the object: LDAP or mySQL in the backend for a remote access control system? I've seen that that for remote access control, e.g. Wi-Fi prepaid access solution, it is widely used freeRADIUS+captive portal+mySQL. There are several implementation of capitve portals, but they all do the same thing: act as NAS towards RADIUS providing AAA attributes. User data are stored in the backend in a database, but for usage characteristics this database should be a directory server (LDAP server); such a solution, in fact, requires features typical for a directory server: optimization for read operation, distributed model for storage of information, advanced search capabilities. So the best solution should be LDAP (openLDAP) for users' data and SQL (mySQL) for accounting data (these data are overwritten so number of write operations are almost equal to number of read operations). Despite this, I've seen that LDAP is not widely used. Is this for its complexity or are there deeper reasons that suggest to use SQL database for both (user data, accounting) purposes? Does anybody have links that might help to build a system made using this architecture? Regards, Carlo

5 10

set up consulting
by clark 14 Jan '06

14 Jan '06

I have some experience with Linux, but none with freeradius. I want to set up a freeradius server for mac address authentication. I am a wisp with over 200 customers. I would like to set up dialupadmin also. I have a Linux server running Fedora 4. I am willing to pay consulting fees to someone that can help. My email address is creid(a)gulfshorecomputers.com.

1 0

Info
by Amin Amer 13 Jan '06

13 Jan '06

Hi, i have a WISP, and i want to add a radius server so i could gain more security, and my APs supports radius. My question is: does the radius only works on linux?or does it work on windows too? i have a fedora core 2 working as a billing server, i don't want to mess it up. Please HELP!! Amin --------------------------------- Yahoo! Photos Ring in the New Year with Photo Calendars. Add photos, events, holidays, whatever.

1 0

info
by Amin Amer 13 Jan '06

13 Jan '06

Hi, i have a WISP, and i want to add a radius server so i could gain more security, and my APs supports radius. My question is: does the radius only works on linux?or does it work on windows too? i have a fedora core 2 working as a billing server, i don't want to mess it up. Please HELP!! Amin --------------------------------- Yahoo! Photos Got holiday prints? See all the ways to get quality prints in your hands ASAP.

1 0

Where are these "Client-IP-Address = 127.0.0.1" messages coming from?
by Matthew Schumacher 13 Jan '06

13 Jan '06

I'm getting accounting messages like these that seem to be coming from the loopback interface, but `tcpdump -i lo` doesn't see them so they are not coming from a local client. If they are not coming from a local client then how can I figure out where they are coming from? Thu Jan 12 07:19:58 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "user" NAS-Port = 536936515 Acct-Session-Id = "0A000067" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "1cc41474b27ed376" Timestamp = 1137082798 Thu Jan 12 07:23:50 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "anotheruser" NAS-Port = 268501111 Acct-Session-Id = "0D008123" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "4ed0aac222580a10" Timestamp = 1137083030

4 11

help me
by trioka.dudi.p 13 Jan '06

13 Jan '06

Im newbie feeradius... error in madake 10.2 pls help my, configur in linux madrake thks oka

3 2

SIGHUP disables debugging
by Kenneth Lee 13 Jan '06

13 Jan '06

Hi there, The problem seems to be around the lines in mainconfig.c, read_mainconfig(): if ((mainconfig.debug_level > debug_flag) || (mainconfig.debug_level <= old_debug_level)) { debug_flag = mainconfig.debug_level; } librad_debug = debug_flag; old_debug_level = mainconfig.debug_level; When read_mainconfig() is called the second time, debug_flag is reset to that specified in config file. The problem is minor, but looks funny to me. I expect -X to be sticky. Kenneth

2 1

EAP-TLS and EAP-TTLS problem in my config
by Riccardo.Veraldi 13 Jan '06

13 Jan '06

Hello, I need to authenticate users with EAP-TTLS but I do not want at hte same time users who has a certificate to being able to use it to authenticate themself. I have seen that to enable eap-ttls also eap-tls modue need to be configured in eap.conf everyhing works with EAP-TTLS, but users can authenticate with EAP-TLS also using a personal certificate. I want to forbid authentication via EAP-TLS with the certificate, and allow only EAP-TTLS how can I do it ? I Was not able to find a solution unless to list all the login name of the users in the users file, but this is not very scalable... I would like to do it with a DEFAULT stanza but was unable to achieve what I need thank you very much Rick

2 1

Compiling FR 1.1.0
by Rohaizam Abu Bakar 13 Jan '06

13 Jan '06

Tested with FBSD 4.11 error with rlm_attr_rewrite... After remove the folder... then error with rlm_otp ####################################### Making all in cardops ... gmake[6]: Entering directory `/var/src/freeradius-1.1.0/src/modules/rlm_otp/cardops' gcc -g -O2 -pthread -D_THREAD_SAFE -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../../../include -DOTP_MODULE_NAME="rlm_otp" -DFREERADIUS -c cryptocard.c -o cryptocard.o In file included from /usr/include/openssl/des.h:66, from ../otp.h:32, from cryptocard.c:26: /usr/include/openssl/opensslconf.h:177: warning: `OPENSSL_NO_KRB5' redefined *Initialization*:1: warning: this is the location of the previous definition cryptocard.c: In function `cryptocard_updatecsd': cryptocard.c:230: syntax error before `PRIx32' cryptocard.c: In function `cryptocard_isconsecutive': cryptocard.c:255: syntax error before `SCNx32' cryptocard.c:252: warning: unused variable `nextewin' cryptocard.c: At top level: cryptocard.c:260: syntax error before `++' cryptocard.c:58: warning: `cryptocard_name2fm' defined but not used cryptocard.c:78: warning: `cryptocard_keystring2keyblock' defined but not used cryptocard.c:110: warning: `cryptocard_nullstate' defined but not used cryptocard.c:139: warning: `cryptocard_challenge' defined but not used cryptocard.c:184: warning: `cryptocard_response' defined but not used cryptocard.c:226: warning: `cryptocard_updatecsd' defined but not used cryptocard.c:251: warning: `cryptocard_isconsecutive' defined but not used cryptocard.h:59: warning: `cryptocard_maxtwin' declared `static' but never defined cryptocard.h:62: warning: `cryptocard_printchallenge' declared `static' but never defined gmake[6]: *** [cryptocard.o] Error 1 gmake[6]: Leaving directory `/var/src/freeradius-1.1.0/src/modules/rlm_otp/cardops' gmake[5]: *** [cardops/cryptocard.lo] Error 2 gmake[5]: Leaving directory `/var/src/freeradius-1.1.0/src/modules/rlm_otp' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/var/src/freeradius-1.1.0/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/var/src/freeradius-1.1.0/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/var/src/freeradius-1.1.0/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/var/src/freeradius-1.1.0/src' gmake: *** [common] Error 2 *** Error code 2 ###########################################3 Tested with FBSD 6.0... OK with rlm_attr_rewrite .... but problem with rlm_otp with different from FBSD4.11 ############# otp_state.c: In function `otp_state_connect': otp_state.c:482: error: storage size of 'sa' isn't known otp_state.c:482: warning: unused variable `sa' gmake[5]: *** [otp_state.o] Error 1 gmake[5]: Leaving directory `/var/src/freeradius-1.1.0/src/modules/rlm_otp' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/var/src/freeradius-1.1.0/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/var/src/freeradius-1.1.0/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/var/src/freeradius-1.1.0/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/var/src/freeradius-1.1.0/src' gmake: *** [common] Error 2 *** Error code 2 ############################## --haizam

3 2