August 2005 - Freeradius-Users - lists.freeradius.org

radius cache?
by Tariq Rashid 19 Aug '05

19 Aug '05

hi - i wonder what people's thoughts are on a radius cache that sits in frotn of a set of real radius servers and responds quickly with a set of cached reply attributes from a previous query? this may even be worthwhile even if the caching only applies to rejected queries - so that bad requests don't waste the backend resources. tariq

2 1

RE: mod_auth_radius values
by Ayres G.J. 19 Aug '05

19 Aug '05

Hi, I have written a php script that lists the request and response headers, the result of which is below: Request Headers Accept: */* Accept-Language: en-gb Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Host: xxxxxx Connection: Keep-Alive Authorization: Basic bHNreVJlZ2o6ZnSpZGF5Mw== Cookie: foo=bar Response Headers Set-Cookie: RADIUS=51f673efff8c5h235410d95289666de85305b928; path=/; X-Powered-By: PHP/4.4.0 After the cookie is set the 'Set-Cookie' header appears in the Request Header as 'Cookie: foo=bar; RADIUS=51f673efff8c5h235410d95289666de85305b928;'. (I have modified the values above slightly incase I am inadvertently sending a username/password to the list ;) Ive read through mod_auth_radius-2.0.c and it appears the cookie is a MD5 hash of the users information. So, is it possible to get the information from the cookie? Gareth. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 18 August 2005 16:25 To: FreeRadius users mailing list Subject: Re: mod_auth_radius values "Ayres G.J." <G.J.Ayres(a)swansea.ac.uk> wrote: > I am developing a web system that authenticates users to a web site > through free radius using the mod_auth_radius module for apache. It all > works fine, but I would like to get the username of the user that has > authenticated for use on pages once they have authenticated. It's in the HTTP headers. The username & password are sent in every request. > I am not sure how to go about this. I guess that the values are set in a > cookie or in the HTTP Headers by mod_auth_radius? Does anyone know a way I > could retrieve the values, either through HTML or PHP? Not HTML. Maybe PHP, if it allows you to get HTTP headers. See the module source code for where the headers are, and the PHP docs for how to get at them. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Required Clarification
by raghavendra.sadaramachandra＠wipro.com 19 Aug '05

19 Aug '05

Hi All, As I am using freeRADIUS I would like to know few of the following things. 1) What is the maximum length of username and password allowed in freeRADIUS ? 2) What is the maximum number of users allowed to authenticate? I mean, how many users does it maintains in its database? 3) How does it maintains database does it uses SQL, if so ? whether it provides any alternative to maintain database of username and password ? for example like by using files..... etc. 4) Is there any necessity or possibility to use secondary RADIUS server ? Thanx in advance. Regards, Raghu Confidentiality Notice The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain confidential or privileged information. If you are not the intended recipient, please notify the sender at Wipro or Mailadmin(a)wipro.com immediately and destroy all copies of this message and any attachments.

2 1

MPPE/PEAP support not in anything but CVS snapshots?
by Bill Carr 18 Aug '05

18 Aug '05

I have a quick question, I ran across a note in a document about 0.97 stating that MPPE support was only in the nightly snapshots and not in the normal releases. (http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html) If this changed since 2002, could someone let me know when? Otherwise I'm chasing my tail using a RHEL ES RPM which starts, runs but won't start the EAP piece, but a freshly compiled version works fine. I have a client who's a stickler for using the "vendor"-blessed versions and I've been trying to figure out why this has been more difficult to set up than most of my out-of-the-box configs. Thanks a bunch!

2 1

[solution] Received unexpected tunneled data after successful handshake
by Waba 18 Aug '05

18 Aug '05

Hello, I was stuck for a bit on this error message before finding the solution, so I thought I'd share and get it into the list archives for future reference. Context: Trying to get WindowsXP 802.1X supplicants to be authenticated on a FreeRADIUS server. After a successful TLS handshake, the rlm_eap_tls: Received unexpected tunneled data after successful handshake message would appear and abort the process. The solution is in http://www.freeradius.org/doc/EAPTLS.pdf - the client and server certificates must contain an Enhanced Key Usage. Look for "-extensions" in the generation script, and for the "OpenSSL extensions file" section. Taking this into account and regenerating the client & server certificates worked for me. I hope it helps, -Waba.

1 0

mod_auth_radius values
by Ayres G.J. 18 Aug '05

18 Aug '05

Hello all, I am developing a web system that authenticates users to a web site through free radius using the mod_auth_radius module for apache. It all works fine, but I would like to get the username of the user that has authenticated for use on pages once they have authenticated. I am not sure how to go about this. I guess that the values are set in a cookie or in the HTTP Headers by mod_auth_radius? Does anyone know a way I could retrieve the values, either through HTML or PHP? Thanks, Gareth. - - - - - - - - - - - - - - - - Gareth Ayres Wireless Network Officer Library & Information Services University of Wales Swansea, Singleton Park, Wales, UK SA2 8PP e-mail: g.j.ayres(a)swansea.ac.uk

3 3

General Question..
by Behzad Barzideh 18 Aug '05

18 Aug '05

Hello, I am new to Radius and Free Radius, so forgave me if this question has been asked or it is crazy. We are in process of change all our authentication and authorization. At the moment every "service" has it's own user-id/password database. Thus authentication/authorization per service is simple. want to deny access to a given user, disable his/her password or that service. As you can imagine this has a big overhead and users have to remember many user-id/password per. Can we use Radius/LDAP to do this. What I was hope we can do is as follow: everyone will get one user-id/password But for every service we will create a boolean attribute. All services, dialup/wireless/vpn/etc will use one radius server for both Auth(authenticate/authorize). The question is can FreeRadius(or any radius) be configured to as the LDAP for the correct service attribute and give access both base on the user-id/password and what the value of the services? Thank you all for your help.

3 2

Dial-up admin
by Allan Borman 18 Aug '05

18 Aug '05

Hi All, I have freeradius operational on a new X86 dell server platform running LINUX ES. I am having issues with Dialup-admin and PHP. Has anyone installed this interface successfully on LINUX ES. Is there any docs on this. I have read the docs that comes with Dialup-admin. Any help is appreciated in advance. Best Regards, Allan Borman.

1 0

RadZap Still given (negative Port)
by Sarkis Gabriel 18 Aug '05

18 Aug '05

After installing the CVS although not the latest one as of today but it was suppose to have the fix for the Negative port. radwho -ZR -N 192.116.123.118 -u74347 User-Name = "74347" Acct-Session-Id = "80a0000d" Acct-Status-Type = Stop NAS-IP-Address = 192.116.123.118 NAS-Port = -2136997875 Service-type = Login-User Framed-IP-Address = 10.10.13.254 Acct-Session-Time = 21495 Calling-Station-Id = "00:11:43:79:E7:" radwho -r 74347,74347,shell,S2157969421,Tue 08:58,192.116.123.118,10.10.13.254 The difference now is that a simple radwho -r used to show the S-21... but now it doesnt and if you do a radwho -ZR................ it shows a negative port. Thanks SArky

2 2

about authentication with PAP
by Lee Bobby 18 Aug '05

18 Aug '05

hi,all, I wanna use PAP to authenticate the users.But I don't know how to change the radiusd.conf. Can any one help me? Bobby from Beijing.

1 0