December 2006 - Freeradius-Users - lists.freeradius.org

Long authentication times
by Umberto Ferraro Petrillo 19 Dec '06

19 Dec '06

Good morning to all, I am coordinating a project for installing a wireless network at the Faculty of Statistics of University of Rome. We have been using freeradius with PEAP and EAP-TTLS enabled. All seems to work fine except for the very long authentication times (about one minutes) we are experiencing when using the default Windows XP supplicant. After doing some searches on the previous discussions, I found the following thread where it is said that such a problem may be due to the way the Windows supplicant handles the EAP negotiation: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg30473.… I performed some further searches and discovered that this delay may be due to the four-way handshake protocol used by the client machine to establish a new connection with the AP. Do someone knows if there exists any tuning in the implementation of this protocol able to reduce the waiting time? Thanks in advance for any help! -- Umberto Ferraro Petrillo PhD Dipartimento di Statistica, Probabilita' e Statistiche Applicate Universita' di Roma -- La Sapienza P.le Aldo Moro, 5 00185 - Rome, Italy phone: +39 06 499 10513 e-mail: Umberto.Ferraro(a)uniroma1.it

3 4

need help
by Zion Somech 19 Dec '06

19 Dec '06

Subject: help Hi Team I need your help to set the following setup: Machine 1: freeradius server ---> working and running freeradius OS sled 10 (Suse) Machine 2: pam server ---> pam module foe radius install under /lib64/security I need your help to configure the files which file I need to add under /etc/pam.d (can tou send me an example file(s)) OS sles 10 (Suse) Machine 3: running radius client --- > tested with radclinet directly to the radius server I want to use for now ssh / su to the radius server thru machine #2 OS rdas 4 u4 (redhat How can I bring the above setup to work???? I hope you can help /advice Thanks in advance Zion

1 0

Bridging RADIUS Servers
by Jack Jackson 19 Dec '06

19 Dec '06

Dear All- Excuse my ignorance. Our company uses RADIUS today for network (802.1x) authentication. We're merging with another company who also uses RADIUS for the same purpose. Is there a config document which shows how I can configure Free Radius to proxy 2 completely different, existing RADIUS servers to authenticate users. The idea is that if one existing RADIUS server doesn't contain user information, a second RADIUS server can be queried for user info. Failing both lookups, the user will be declined. I'd appreciate any helpful tips. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

RE: dialupadmin date woes
by Cory Robson 18 Dec '06

18 Dec '06

Now that Western Australia has daylight savings my dialup admin interface is showing the incorrect dates in user times. My server is sycronised with one of the local time servers and is correctly showing the valid time. How and where can I change this so that users usage is displayed and logged correctly, the data in the backend sql is being logged with the correct information it is only the dialup admin interface that is showing online usage calculated incorrectly. Cory

1 0

New Setup
by Scott Hughes 18 Dec '06

18 Dec '06

I am looking to change my freeradius setup. I would like to use EAP-TTLS, MySQL, and dialup-admin. All of these are installed and functioning. Is there a HOWTO, web page, etc that will guide me on this. Thanks, Scott

1 0

chap requests and users file
by Thor Spruyt 17 Dec '06

17 Dec '06

Hi, I was wondering how I should create an entry in the users file for a user that authenticates with CHAP. Normally I have entries like this: ausername Auth-Type := Local, User-Password == "apassword" This works for PAP requests, but is it also fine for CHAP? I actually need a method to let both PAP and CHAP succeed, it's up to the user to decide what to use. -- Thor Spruyt M: +32 475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com

2 1

Faisal Butt is out of the office.
by Faisal Butt 17 Dec '06

17 Dec '06

I will be out of the office starting 12/17/2006 and will not return until 12/26/2006. Please send all your queries to sales(a)sbm.net.sa. For any technical support, please send your emails to tech-support(a)sbm.net.sa.

1 0

EAP-TLS authentication error
by Rafiqul Ahsan 16 Dec '06

16 Dec '06

Hi All, I am using wpa_supplicant-0.5.5 against freeradius - v1.1.3 . I am getting following error : TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:0D07209B:asn1 encoding routines:ASN1_get_object:too long rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap: SSL error error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header rlm_eap_tls: BIO_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 23 modcall: leaving group authenticate (returns reject) for request 23 auth: Failed to validate the user. Login incorrect: [rafi/<no User-Password attribute>] (from client 192.168.1.102 port 19801 cli ) Delaying request 23 for 2 seconds Finished request 23 Here are my configs : test.conf (wpa_supplicant config) linux:/home/admin/wpa_supplicant-0.5.5 # cat test.conf ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel ap_scan=0 network={ scan_ssid=0 key_mgmt=IEEE8021X eap=TLS identity="rafi" eapol_flags=0 ca_cert="/etc/1x/eap_tls/certs/cacert.pem" client_cert="/etc/1x/eap_tls/certs/clientcert.pem" private_key="/etc/1x/eap_tls/certs/clientkey.pem" private_key_passwd="wimax i2 test certs" } eap.conf : eap { default_eap_type = tls timer_expire = 120 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { rsa_key_exchange = yes dh_key_exchange = no rsa_key_length = 1024 dh_key_length = 1024 verify_depth = 2 pem_file_type = yes private_key_password = "wimax i2 test certs" private_key_file = /usr/local/etc/raddb/certs/rafi/eap_tls_certs/serverkey.pem certificate_file = /usr/local/etc/raddb/certs/rafi/eap_tls_certs/servercert.pem CA_file = /usr/local/etc/raddb/certs/rafi/eap_tls_certs/cacert.pem dh_file = /usr/local/etc/raddb/certs/rafi/dh random_file = /usr/local/etc/raddb/certs/rafi/random fragment_size = 1024 include_length = yes check_cert_cn = %{User-Name} } } users : rafi Auth-Type := EAP -- Rafiqul Ahsan 630-717-1698(h) 2120 Periwinkle Ln 630-689-1457(h) Naperville, IL 60540 847-812-6176(c)

1 0

Properly using the operators?
by Mike 16 Dec '06

16 Dec '06

Dear list, I'm having a hard time learning how to use the attribute properties correctly in my mysql/radius database and my test enviroment is freeradius 1.1.3 / debian etch. What I'm trying to do is to establish a 'suspended' user group which receives a Framed-IP-Address attribute of 10.10.0.2+, and which overrides any previously assigned Famed-IP-Address, if present. I know that group processing is happening, because I can add attributes to the suspended group and my test user gets those attributes. I am adding the Framed-IP-Address attribute in the radreply table, but it is not being overwritten from the one set by radgroupreply. If I remove this from radreply, then the ip assigned in suspended group is applied. If I change the one in radgroupreply to use the += operator, then it returns both ip addresses in the reply. But I can't seem to get := to overwrite like the docs says it does. Here is a dump of my sample sql tables: mysql> select * from radcheck ; +----+----------+---------------+----+-----------------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-----------------+ | 2 | joe.user | User-Password | == | ididntpaymybill | +----+----------+---------------+----+-----------------+ mysql> select * from radreply ; +----+----------+-------------------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------+-------------------+----+---------+ | 2 | joe.user | Framed-IP-Address | = | 1.2.3.4 | +----+----------+-------------------+----+---------+ mysql> select * from usergroup ; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | joe.user | suspended | 1 | +----------+-----------+----------+ mysql> select * from radgroupcheck ; +----+-----------+-----------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------------+----+-------+ | 3 | dynamic | Framed-Protocol | == | PPP | | 4 | suspended | Framed-Protocol | == | PPP | +----+-----------+-----------------+----+-------+ mysql> select * from radgroupreply ; +----+-----------+-------------------+----+-----------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------+----+-----------------+ | 6 | suspended | Framed-Netmask | = | 255.255.255.255 | | 5 | suspended | Framed-IP-Address | = | 10.10.0.2+ | | 7 | dynamic | Framed-IP-Address | := | 255.255.255.255 | +----+-----------+-------------------+----+-----------------+ Here is the results of running radtest on this user: > radtest joe.user ididntpaymybill localhost 0 testing123 Sending Access-Request of id 140 to 127.0.0.1 port 1812 User-Name = "joe.user" User-Password = "ididntpaymybill" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=140, length=32 Framed-IP-Address = 1.2.3.4 Framed-IP-Netmask = 255.255.255.255 What I am trying to accomplish is simply to allow us to put overdue users into the 'suspended' group, which will hand out a different set of ip addresses than their normal non-suspended configuration. I realise I could be approaching this all wrong but right now I simply set those items (framed-ip-address, framed-route, and etc) in the radreply table and I don't want to remove those items from the database, just override them. Any pointers would be greatly appreciated. Mike-

1 0

Accounts staying online past Session Timeout value
by Mike Jakubik 16 Dec '06

16 Dec '06

Hello, I am having some problems lately with freeradius 1.1.2 + mysql, and users staying online past their session timeout value (4 hours). Can anyone shed some light on the matter? I can not find any problems with the server itself, the loads are low and everything seems to be functioning OK. Would this be a function of the NAS to disconnect the user and send a stop packet or is it up to freeradius? Also, sometimes i have users who are getting disconnected and can not reconnect because they are still shown to be online, and i am limiting the sessions to 1. Again, would this be a problem with the NAS/network because freeradius is not receiving the stop packet? This setup has been running for over 80 days without a problem, so it leads me to believe that the problem is not on the radius server, but i would like some second opinions. Thank You.

4 6