September 2005 - Freeradius-Users - lists.freeradius.org

RE: Some questions about freeRADIUS implementation, PLEASE HELP ME!!
by Guy Davies 08 Sep '05

08 Sep '05

Hi Alfonso, See inline... >-----Original Message----- >We decide to use freeRADIUS as Radius Server on a Big >wireless Network (in a university ) >with about five hundred APs, but there are some >questions (maybe basic questions) >I need from your help to understand them better. > >1. About certificates >In the first stage we will use EAP-PEAP authentication >with Primary and backup Radius Servers. >I think to do next: >At the Primary Server, I will generate the root, >Primary Server and Backup Server certificates, > then I will copy the root and Backup Server >certificates to Backup server, That's correct?. >or I have to generate one more time the root and >backup server certificates >in the backup server. No, you don't need another root. I'd normally run the CA (root) on a different (highly secured) box but that's not mandatory. You really only need one (well backed up) root server. You also need to distribute the root cert to all the clients. They will use the root cert (used to sign the RADIUS servers' certs) to authenticate the RADIUS servers. If the root cert has been signed by a global root CA, then the clients only need the certificate from the global root CA. >2. At the second stage we will implement a PKI and >we'll use EAP-TLS and my doubt is about > LDAP data base and simultaneous-use, for example >with EAP-PEAP I add the next lines to users file : > >....... >DEFAULT Ldap-Group == group1, Simultaneous-Use >:= 1 > Aruba-User-Role = "ESTUDIANTE", > >DEFAULT Ldap-Group == group2, Simultaneous-Use >:= 1 > Aruba-User-Role = "PROFESORES", >DEFAULT .... >..... > >And work perfectly, But what happen if we use EAP-TLS >--> client certificates, exists any way to obtain the >same results? If you are providing each client with a certificate signed by your CA and the RADIUS servers both have the certificate of the root CA, then they'll be able to authenticate the clients based on the signature of the root CA. LDAP is used for authorization anyway so you'll use that independently based on the username in the certificate CN. >,if it is affirmative, how can I do it (some >references, howto's) >!!because when I use EAP-TLS I don't need to add >nothing at users file nor in LDAP data base!!. You can add authorization in the LDAP database. It is not used (by EAP-TLS or PEAP/MS-CHAPv2) for authentication. Note, if you're using PEAP/MS-CHAPv2 and LDAP and you want to store the password in the LDAP database, it *must* be in plain text. > >3. Finaly exists some advantages If I use Solaris >instead a Normal PC with Linux(Debian). Hardware and OS support, maybe. There are certainly PCs out there that can match a (probably much more expensive) Solaris box for performance. You'll need to ensure that you've got GCC compiled for your Solaris box (AFAIK, it's not supplied in the base OS) so it's a bit of a pain to get going. In that respect, a good Linux or BSD distribution on a high spec server PC may be the better bet. >Your help will be very important for me!! >Thanks in advance > >NOTE: simultaneous-use work perfectly with some NAS, >with ARUBA NAS don't do it, but I thing need some >little changes in the checkrad.pl script. > >Alfonso Celestino >DGSCA,UNAM > > >__________________________________________________ >Correo Yahoo! >Espacio para todos tus mensajes, antivirus y antispam ¡gratis! >Regístrate ya - http://correo.yahoo.com.mx/ >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1

Digest test
by Iandc Davies 08 Sep '05

08 Sep '05

All, Have run the test as suggested in the doc/rlm_digest file and have got an odd output message from freeradius saying it can't find the Digest-Nonce element. In the radiusd.conf file I'm authenticating but not authorizing digest. Users file has the following: #--- test Auth-Type := Digest, User-Password := "test" Reply-Message = "Hello, reply with digest." #--- Any ideas ? I've enabled debug on radclient with the following output. ================================================== ./client.sh Sending Access-Request of id 178 to 127.0.0.1:1812 User-Name = "test" Digest-Response = "631d6d73147add2f9e437f59bbc3aeb7" Digest-Realm = "\001\013testrealm" Digest-Nonce = "\002\n1234abcd" Digest-Method = "\003\010INVITE" Digest-URI = "\004\034sip:5555551212@example.com" Digest-Algorithm = "\006\005MD5" Digest-User-Name = "\n\006test" rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=178, length=47 Reply-Message = "Hello, reply with digest." Total approved auths: 0 Total denied auths: 1 Total lost auths: 0 ================================================ Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32943, id=178, length=140 User-Name = "test" Digest-Response = "631d6d73147add2f9e437f59bbc3aeb7" Digest-Attributes = 0x010b746573747265616c6d Digest-Attributes = 0x020a3132333461626364 Digest-Attributes = 0x0308494e56495445 Digest-Attributes = 0x041c7369703a35353535353531323132406578616d706c652e636f6d Digest-Attributes = 0x06054d4435 Digest-Attributes = 0x0a0674657374 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry test at line 19 modcall[authorize]: module "files" returns ok for request 0 rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 ERROR: No Digest-Nonce: Cannot perform Digest authentication modcall[authenticate]: module "digest" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 178 to 127.0.0.1:32943 Reply-Message = "Hello, reply with digest." Waking up in 4 seconds... ===================================================================== Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

Some questions about freeRADIUS implementation, PLEASE HELP ME!!
by alfonso celestino 08 Sep '05

08 Sep '05

Hi, I need your help We decide to use freeRADIUS as Radius Server on a Big wireless Network (in a university ) with about five hundred APs, but there are some questions (maybe basic questions) I need from your help to understand them better. 1. About certificates In the first stage we will use EAP-PEAP authentication with Primary and backup Radius Servers. I think to do next: At the Primary Server, I will generate the root, Primary Server and Backup Server certificates, then I will copy the root and Backup Server certificates to Backup server, That's correct?. or I have to generate one more time the root and backup server certificates in the backup server. 2. At the second stage we will implement a PKI and we'll use EAP-TLS and my doubt is about LDAP data base and simultaneous-use, for example with EAP-PEAP I add the next lines to users file : ....... DEFAULT Ldap-Group == group1, Simultaneous-Use := 1 Aruba-User-Role = "ESTUDIANTE", DEFAULT Ldap-Group == group2, Simultaneous-Use := 1 Aruba-User-Role = "PROFESORES", DEFAULT .... ..... And work perfectly, But what happen if we use EAP-TLS --> client certificates, exists any way to obtain the same results? ,if it is affirmative, how can I do it (some references, howto's) !!because when I use EAP-TLS I don't need to add nothing at users file nor in LDAP data base!!. 3. Finaly exists some advantages If I use Solaris instead a Normal PC with Linux(Debian). Your help will be very important for me!! Thanks in advance NOTE: simultaneous-use work perfectly with some NAS, with ARUBA NAS don't do it, but I thing need some little changes in the checkrad.pl script. Alfonso Celestino DGSCA,UNAM __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.yahoo.com.mx/

1 0

RE: Mixed-mode authentication enviornment
by Jonathan De Graeve 08 Sep '05

08 Sep '05

Is this also possible with EAP or MS-CHAP authentication? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Alan DeKok Verzonden: woensdag 7 september 2005 23:59 Aan: FreeRadius users mailing list Onderwerp: Re: Mixed-mode authentication enviornment Daniel Corbe <daniel.junkmail(a)gmail.com> wrote: > Since the SIP server requires DIGEST authentication, the Auth-Type > attribute is present and it is set to DIGEST which forces FreeRADIUS > to attempt a digest authentication. Once this fails an Access-Reject > packet is sent back to the RADIUS client You don't say who's setting Auth-Type. In the example config, the "digest" module sets it. If you're setting it yourself, there's a high likelihood that something will go wrong. > Is there a way to configure FreeRADIUS so it first attempts a DIGEST > authentication, and when that fails, we go ahead and attempt normal > authentication? No. That doesn't make sense. There IS a way to configure the server to try digest authentication only when the RADIUS packet contains digest attributes. Uncomment the lines referring to "digest" in radiusd.conf. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Freeradius
by Jonathan De Graeve 08 Sep '05

08 Sep '05

Is it also possible to add multiple 'Huntgroup-Name's into the database? In my first test it doesn't seemed to be possible -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 -----Oorspronkelijk bericht----- Van: Tobias Frank [mailto:frank@synergysystems.de] Verzonden: donderdag 8 september 2005 12:36 Aan: Jonathan De Graeve Onderwerp: Re: Freeradius Hello again Jonathan De Graeve schrieb: > > What I want to do is distinct users from NASSes. Lets say, users in the > mysqlgroup IT can connect to the NASSES 1 & 2 & 3 while patients only > can connect to NAS 3. This can be done with huntgroups but don't know > how to do this with an SQL based implementation forget my last mail. it is quite simpler. create your huntgroups and insert into radcheck (username, attribute, op, value) values ('Tobi', 'Huntgroup-Name', '==', 'IT'); -- ******************************************** Synergy Systems GmbH Tobias Frank Leiter Entwicklung Konrad-Zuse-Platz 8 81829 München Fon +49 (0)89 89080-500 Fax +49 (0)89 89080-600 mailto:frank@synergysystems.de ******************************************** Best Connections - www.synergysystems.de ********************************************

1 0

Handling Radius Events with Client
by Ali Koyuncu 08 Sep '05

08 Sep '05

Hi to all, Let's say we have a switch and two (free) Radius servers backing up each other. I want to implement a client, that listens to the call-related events (such as accest-accept, call started, call finished, failed, and etc.) received from the target Radius server, and process these data based on some rules. Here comes my questions: 1. Is it possible to handle Radius call-relaed events over UDP or TCP? -- because i am newbie to the subject, please excuse me if i am asking something stupid. 2. If it's, how? Any sample source code can be provided? Thank you and regards, Ali Koyuncu R&D Director "I'm not Anti-Business, I'm Anti-Idiot! (Dilbert)"

2 1

huntgroups and bad_logins
by Jonathan De Graeve 08 Sep '05

08 Sep '05

Hello, I bought the radius book from O'Reilly and its a good book except when you want to use freeradius mainly with an SQL backend. (default users profiles in SQL) Also the principle of huntgroups isn't very well explained. What I want to do is the following: NAS1: 10.1.1.1 NAS2: 10.1.1.2 SQL usergroups: patients, it IT may connect to NAS1&2, patients only to NAS2. I've been looking on the internet how to do this but didn't found it. I also have problems with the bad_login perlscript. When I run this script, it doesn't do anything (just hangs with no given output) Kind Regards

2 1

different EAP type
by FeLiX 07 Sep '05

07 Sep '05

Hi all, I want to control my WLAN whit authorization based on LDAP and authenticathion based on EAP-TLS. But on the same WLAN there is a VLAN for the voip. The mobile phones don't support TLS but only LEAP. it is possible to insert this in users file? DEFAULT Auth-Type := EAP Fall-Through = 1 "phone" EAP-Type := LEAP, User-Password == "123456" Fall-Through = 1 whit this I have: Unexpected trailing comma in check item list for entry phone. it's wrong the attribute eap-type or it'impossible to do? Thanks, Felice

1 0

can not link to oracle DB
by Lee Bobby 07 Sep '05

07 Sep '05

system:RH9 DB:oracle9i freeradius0.9.3 I have complied the freeradius on RH9 and have setup the DB.But the failed to connect oracle9i the error codes are below: ...... rlm_sql (/tmp/bobby//var/log/radius/sqltrace.sql): Ignoring unconnected handle 0.. rlm_sql (/tmp/bobby//var/log/radius/sqltrace.sql): There are no DB handles to use! skipped 1, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 0 modcall: group authorize returns fail for request 0 ...... I am confirmed that the radius.conf and oraclesql.conf is right: the right DB user and password,the right DB server address. I am really confused,Can anyone help me?

2 1

LEAP Protocol
by Juan Daniel Moreno 07 Sep '05

07 Sep '05

Hi everyone, is me again!! I have a question about freeradius 1.0.4. With LEAP protocol, the last packet sent by the server has a "leap-session-key". Does anybody knows how this key is generated? Thank you very much!!! Juan Daniel MORENO

2 1