curious network problem

[Antony King]

On Wednesday 11 August 2010 01:38:22 Alan DeKok wrote:
> Antony King wrote:
> > The 'live' server is a centos5.5 box. I've tried with the standard
> > freeradius2 package (version 2.1.7) and a version compiled from SRPMS in
> > case there was a problem with ttls in that version. The configuration
> > was copied over from the test server, with new keys generated but
> > otherwise unchanged.
> 
>   Were the certs re-generated?  They depend on the keys.

I did 'make destroycerts', then 'make' in the certs directory. It should all 
be new in there.

> 
> > Locally, it authenticates correctly, using the first of the two commands
> > above. If I try and authenticate from a remote system (eg, a NAS or my
> > test server), it refuses to do the ttls negotiation.
> 
>   This is the kind of problem where I would suggest "don't even try to
> debug it."  Instead, follow the EAP howto on my web site
> (http://deployingradius.com).  It will be faster and less work to
> re-create a working system, than to debug a broken one.

I guess so; it's just very frustrating that it all works perfectly if you are 
localhost, but not if you are a remote host. I'm tempted to compile it up from 
scratch on this box too (not using the SRPM) - I spotted that it was looking 
in the wrong place for some libraries in radiusd.conf (not that fixing it made 
any difference, and it presumably found the libs OK when localhost made the 
query) so there may well be other peculiarities.

Thanks,

Antony.