- Freeradius-Users - lists.freeradius.org

wrong DNS IP address for dialup clients
by mnisay 29 Jun '05

29 Jun '05

hello. before, the assigned DNS IP address are being properly assigned to dialup customers, now that we have changed our IP block addresses, 10% of the dialup customers are still getting the OLD DNS IP addresses, which is wrong. i have checked all the routers and servers and did not found any devices that uses the OLD IP block nor the old DNS IP addresses. i have tried restarting routers, clearing DNS caches from DNS servers as well. i have tried testing different dns attributes like Client-DNS-Pri / Client-DNS-Pri pairs Ascend-Client-Primary-DNS / Ascend-Client-Secondary-DNS pairs i double checked name-servers declaration in the router level , what could it be? my resources says: freeradius-0.9.1-1 under FC2 would appreciate advises pls. thanks in advance. msn

2 3

RE: sql counter clarification and issues
by Ross Tsolakidis 29 Jun '05

29 Jun '05

Thanks for responding. Can you give me an example of how to set the counter to reset in SQL ? This is my config for the counter. counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } Thanks again. Regards, -- Ross -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, 29 June 2005 12:58 AM To: FreeRadius users mailing list Subject: Re: sql counter clarification and issues "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > Looking at that debug, where exactly is it resetting the counter ? The "counter" module is resetting the counter. > In the db.daily ? Because it's not resetting in SQL. Yes, the counter module doesn't say it's using SQL. > Also what is the db.daily ? How do you read that file ? You don't. Its used by the counter module to keep it's count. > What I'm trying to achieve here is to get mysql to reset the counters > its doing, and then start a new row if possible. > Within the table radacct. AcctInputOctets AcctOutputOctets. > Is it possible to do this ? > Does the counter actually do that ? You want sqlcounter. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

RE: Win2k and Freeradius, newbe plz help
by Guy Davies 29 Jun '05

29 Jun '05

Upgrade to win2k SP4. Before that, the M$ supplicant was broken. If you're doing PEAP, I'm assuming you're doing PEAP/MS-CHAPv2. If so, why do you need a client cert? You only need a client cert if you're doing EAP/TLS. PEAP/MS-CHAPv2 uses MS-CHAPv2 to exchange a user's credentials based on a username and password. Rgds, Guy > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Michael Langer > Sent: 29 June 2005 13:45 > To: Freeradius-Users > Subject: Win2k and Freeradius, newbe plz help > > > Hi, > > i try to configure freeradius and win2k(SP2) client for PEAP. > But the client doesnt connect to server or send any packages :( > > I have create the certificates (root,client,server) and > install root.der and client.d12 on the windows machine. Further i do: > > Select the Authentication tab > Select Protected EAP on the drop-down list > Click Properties > Enable "Validate server certificate" > In Trusted Root Certification Authorities list, enable the > root.der certificate. In Select Authentication Method, select > "Secured password (EAP-MSCHAPv2)" > > freeradius (1.0.4): > > Change the default_eap_type from tls to peap: > > eap { default_eap_type = peap > > Move to the PEAP section below the TLS section and uncomment > the following > lines: > > peap { > default_eap_type = mschapv2 > } > > After i start radiusd -X all go fine, and i get: waiting for ... > > > This should work, doesnt it? > > mfg Michael > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

Win2k and Freeradius, newbe plz help
by Michael Langer 29 Jun '05

29 Jun '05

Hi, i try to configure freeradius and win2k(SP2) client for PEAP. But the client doesnt connect to server or send any packages :( I have create the certificates (root,client,server) and install root.der and client.d12 on the windows machine. Further i do: Select the Authentication tab Select Protected EAP on the drop-down list Click Properties Enable "Validate server certificate" In Trusted Root Certification Authorities list, enable the root.der certificate. In Select Authentication Method, select "Secured password (EAP-MSCHAPv2)" freeradius (1.0.4): Change the default_eap_type from tls to peap: eap { default_eap_type = peap Move to the PEAP section below the TLS section and uncomment the following lines: peap { default_eap_type = mschapv2 } After i start radiusd -X all go fine, and i get: waiting for ... This should work, doesnt it? mfg Michael

1 0

Re: help me
by rashad 29 Jun '05

29 Jun '05

Most probably your freeradius built without mysql drivers. Run ./configure and check output. If you can find 'mysql module disabled' then mysql drivers are not built. Check whether libmysqlclient and libmysqlclient-dev packages are installed. > rlm_sql (sql): Could not link driver rlm_sql_mysql: > rlm_sql_mysql.so: cannot open shared object file:No > such file or directory > rlm_sql (sql): Make sure it (and all its dependent > libraries!) are in the search path of your system's > ld. > radiusd.conf[14]: sql: Module instantiation failed. > > i found rlm_sql_mysql.so file in my pc but this file > not found so please help me what i can to do? > > regards > > Umar Draz > > > > ____________________________________________________ > Yahoo! Sports > Rekindle the Rivalries. Sign up for Fantasy Football > http://football.fantasysports.yahoo.com > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 2, Issue 127 > ************************************************ > >

1 0

PEAP and NT domain logon problem
by Jérémy Cluzel 29 Jun '05

29 Jun '05

Hi, I have a freebsd box with a working freeradius 1.0.4 on it. PEAP works fine but I have to be logged before... Here is my problem, when I try to log on my domain, Windows complains about the fact that it is "unable to find my profile on the server" (or sometimes that "the domain XXXXX is unreachable"). Is there any solution to tell windows XP supplicant to wait for auth before trying to download profile ? I think this will be solve by switching to EAP/TLS or EAP/TTLS... but I'm not sure. Regards, Jeremy

1 0

help me
by Umar Draz 29 Jun '05

29 Jun '05

hi dear members! i have install Freeradius-1.0.4 on my linux machine now i want authuntication with Mysql so i have change radiusd.conf file regarding mysql setting when i start the radius i got these errors rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file:No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. i found rlm_sql_mysql.so file in my pc but this file not found so please help me what i can to do? regards Umar Draz ____________________________________________________ Yahoo! Sports Rekindle the Rivalries. Sign up for Fantasy Football http://football.fantasysports.yahoo.com

1 0

MAX_PACKET_LEN setting limiting number of Cisco- Avpair's
by Niall Browne 29 Jun '05

29 Jun '05

Hi After looking through the source code on v 1.148.2.3 I can see that the reason that cisco-avpair += within the users file is not being sent to the firewall for ACL's above a certain number is due to the fact that the maximum Radius Packet size is 4k. This is coded under radius.c for max_packet_len 4096 I can modify the entry to increase the packets size and recompile, which may work in that further cisco-avpair += may be pushed to the firewall, but this will probably cause a number of other problems. Apart from this is there any other way to increase the number of Cisco-Avpair's within freeradius to be pushed to a firewall or is this the maximum ? Thanks, Niall > _____________________________________________ > From: Niall Browne > Sent: Tuesday, June 28, 2005 10:20 AM > To: 'freeradius-users(a)lists.freeradius.org' > Subject: RE: Issue with increasing the number of ACL's in users file > > I sent this week and did not receive a response. > > Since then I have again gone through all files in detail, viewed countless > debugs, and searched all past posts re freeradius, with no success. > > Anyone have any idea what may be causing this or have seen a similar > problem in the past ? > > Thanks, > Niall > > > > _____________________________________________ > From: Niall Browne > Sent: Wednesday, June 22, 2005 8:49 PM > To: 'freeradius-users(a)lists.freeradius.org' > Subject: Issue with increasing the number of ACL's in users file > > Hi > > I am having a problem with an apparent limit on ACL's on my freeradius > servers. I have been running this servers for a number of years, and have > always had the number of ACL's on the users file below 52, and have never > had any problems. > > I noticed as soon as I increased the ACL's above 52 it appeared to > authenticate in the logs, however the auth connection through Cisco VPN > simply continued to try to authenticate and nothing happened. As soon as I > removed the ACL's below 52 and restarted it works fine. > > I dumped the logs > > /usr/local/freeradius/sbin/radiusd -p 1647 -sfxxyz -l stdout > > When I then auth'd and viewed the stdout logs, they are identical for > <52 and then >52 (when compared). The only difference is that the ACL's > after the magic 52 mark do not show in the stout, and this causes my > timeout to fail. When I revert to <52 I can see the last ACL's and all > works fine. > > I have checked through the configs including radiusd.conf however I > cannot find a hard coded limitation on ACL's anywhere. > > Is anyone aware of how to resolve this ? > > Thanks in advance, > Niall > > >

3 2

external script in <defunct> state after execution
by rashad 29 Jun '05

29 Jun '05

Dear developers. Downgrading from 1.0.4 to 1.0.1 without touching anything else solves the problem. So, which version I must use? Is it a bug? Regards, Rashad

2 1

user-profiles
by alan walters 28 Jun '05

28 Jun '05

Radius does not seem to be searching or adding my reply items for my user-profiles from ldap. It does not even look for them?? Does someone have a wonderful solution for how to remedy this DEFAULT Huntgroup-Name == internet, Ldap-Group == ballyvaughan, User-Profile := "cn=ballyvaughan,ou=profiles,o=radius,dc=radiowave,dc=net", Simultaneous-Use := 2 Fall-Through = 0

3 2