July 2006 - Freeradius-Users - lists.freeradius.org

Droping clients from radius (they are connected into radius but they are not connected in their houses)
by Nataniel Klug 21 Jul '06

21 Jul '06

Hello all, I am with a very big problem. I have a system that uses PPPoE server to authenticate my clients into an FreeRadius server. The server is running ok but when something not expected happens in my clients (like a enery blackout or something like that) the user remains connected into my radius server. There is anyway I could make a test to see if the user is not online and them drop it? Att, Nataniel Klug

2 4

Where to find info about DEFAULT value
by rabbtux rabbtux 21 Jul '06

21 Jul '06

All, I see reference to setting DEFAULT in mysql database tables. I need to set the default value of Acct-Interim-Interval = 60s for all users. Can I just put this in my radreply table: user attribute op value ----------------------------------- DEFAULT, Acct-Interim-Interval, :=, 60 Will this make sure that any user that doesn't have this attribute set elswhere, will get 60? Thanks

1 0

freeradius wireless authentication
by Lisa Casey 21 Jul '06

21 Jul '06

Hi, Can anyone point me to some good tutorials for using Freeradius to authenticate wireless users in a WISP environment? Thanks, Lisa Casey

1 0

Using mschap authentication without EAP
by Giuseppina Venezia 21 Jul '06

21 Jul '06

Hi, i'm using freeradius-1.1.2 with openldap for storing users account, for authenticate a WI-FI LAN. I need of a transparent authentication method since for the clients are heterogeneous so i can't use any type of EAP* authentication because I cannot install Xsupplicant on every Client. Can I use mschap authentication for this and there are some specific documentation ?,i've searched a lot but i haven't found exhaustive documentation. And if I cannot use mschap, are there others solution for wi-fi authentication via LDAP? Excuse my bad english. Giusy Venezia

4 13

unsubscribe
by Sudhananda 21 Jul '06

21 Jul '06

unsubscribe This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message.Global Edge Software Ltd has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Global Edge Software Ltd reserves the right to monitor and review the content of all messages sent to or from this e-mail address

1 0

Unsubscribe
by Paul-Hus Diane 21 Jul '06

21 Jul '06

Unsubscribe

1 0

users file for NULL realm, LDAP for another
by John Keimel 21 Jul '06

21 Jul '06

I have two Freeradius servers, one of which authenticates MAC addresses for wireless, the other usernames(a)myrealm.com for some other network access. I'd like to combine the two of them into one server. If the username comes through without a realm (a MAC address) I'd like it to check the users file. If it comes through with a realm, just check LDAP. If the MAC address fails, it should never ever check LDAP. That just beats up the LDAP server and the LDAP admin yells (with good reason!). Should I be looking to do this just in the radiusd.conf? Or should I be attempting to mangle some kind of proxy arrangement? Would anyone care to share any sample configs for such a thing? It looks to me like there may be several ways to do this and I'd like to spend the time building up the best method. Proxy? Autz-type? I am running Freeradius 1.0.2 from Debian Sarge. I did some mailing list archive searching but I just might be checking the wrong search terms, as I'm not finding a good result. Thanks for any suggestions. j

2 1

[Fwd: IP Pool management]
by darshak＠elitecore.com 21 Jul '06

21 Jul '06

---------------------------- Original Message ---------------------------- Subject: IP Pool management From: darshak(a)elitecore.com Date: Fri, July 21, 2006 10:16 am To: freeradius-users(a)lists.freeradius.org -------------------------------------------------------------------------- Hi, I am new to radius. I want to understand functionality of IP Pool management and 802.1x,means EAP,EAP-MD5,LEAP . How can I customize the same using free radius ? Thanxs to all Darshak

1 0

Need help setting up PEAP authentication
by Reynald Borer 21 Jul '06

21 Jul '06

Hi, I'm trying to setup freeradius to authenticate users of my wireless networks and I'm facing some problems. I've tried to follow the guide located at http://www.tldp.org/HOWTO/8021X-HOWTO/ , which explains exactly the setup I would like (that is, authentication with username / password credentials). So I've setup freeradius like explained (I've already have everything needed for ssl, CA root certificate and server certificate), and I've configured my access point to use my radius server. So when I try to login, for example with wpa_supplicant, it tolds me that authentication with MSCHAPv2 went ok, and then 30 seconds later it says "Authentication timed out", and it tries to re authenticate. So I'm able to use my wireless network 30 seconds only (for example if I start up a dhcp client then I get an IP) before I'm re authenticated. I've also tried with a Windows XP client, and it continues asking me my credentials. Here is what is displayed in the logs (without verbose mode): Error: TLS_accept:error in SSLv3 read client certificate A Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Info: rlm_eap_mschapv2: Issuing Challenge So does someone have a working freeradius configuration to share with me ? Or some tips to get it working ? Thanks in advance, Reynald Borer P.S: I'm using debian so I've recompiled freeradius to link against libssl P.S2: I've attached my freeradius config files (modified parts only). Complete files are available at http://www.borer.name/files/index.php?dir=radius/ eap { default_eap_type = peap ## default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no tls { #private_key_password = whatever private_key_file = ${raddbdir}/certs/bob.keyunsecure.pem certificate_file = ${raddbdir}/certs/newcert.pem CA_file = ${raddbdir}/certs/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes } ttls { default_eap_type = md5 use_tunneled_reply = no } peap { default_eap_type = mschapv2 } mschapv2 { } } mschap { use_mppe = yes require_encryption = yes require_strong = yes #with_ntdomain_hack = no #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" authtype = MS-CHAP } authorize { preprocess mschap suffix # ntdomain eap files } authenticate { Auth-Type MS-CHAP { mschap } eap }

6 8

Pasword check failed [sic]
by Paul Long 21 Jul '06

21 Jul '06

Anybody know what could be wrong? This is the relevant entry in my users file: plong Auth-Type = Local, User-Password := "123" and this is a snippet of the debug output: rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 123 for user plong authentication. rlm_chap: Pasword check failed Why might the CHAP password check fail? Paul

2 3