August 2006 - Freeradius-Users - lists.freeradius.org

Bandwidth control...
by Wagner 09 Aug '06

09 Aug '06

What the best solution for "Bandwidth control + freeradius" for a WISP?... can i use freeradius to set this? what i need ? How work? Tks so much Wagner Caixeta Rodrigues

3 2

Answer
by Stefan Winter 08 Aug '06

08 Aug '06

> Does Freeradius have the ability to use multiple nodes in similar fashion > to name servers? An example of this would be a situation when the master > freeradius server is down for some reason, but the slave freeradius > server(s) continue to grant & deny access but do not receive any updates > until the master is back up. You can simply set up more than one FreeRADIUS instance. Then you have to tell your clients that more than one authentication server exists - pretty much the same as with DNS. But as with DNS, you should pay attention on how your clients will recover in case of a failure. Some may for example eternally use the "slave" even when the "master" is back up again. The reasons I use quotes is that there is no concept of superiority of one server vs. the other - they are just two equal alternatives to the client. For the "won't receive any updates" I'm not sure what you mean. > Also, if there are any HOWTO or example configurations of this type of > setup, those would be very helpful. Just setup the server twice (ideally both using _one_ authentication backend, e.g. a mySQL db on a different host that both can access) and tell your client devices about it. Greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche - Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg

3 2

Question
by Scott Hughes 08 Aug '06

08 Aug '06

I've searched around for a few weeks now and can't seem to find a clear answer to this question: Does Freeradius have the ability to use multiple nodes in similar fashion to name servers? An example of this would be a situation when the master freeradius server is down for some reason, but the slave freeradius server(s) continue to grant & deny access but do not receive any updates until the master is back up. Also, if there are any HOWTO or example configurations of this type of setup, those would be very helpful. Thanks in advance, Scott

4 4

Confused with FreeRadius + Win2000 + Linksys + EAP + Certs
by Alexandros Gougousoudis 08 Aug '06

08 Aug '06

Hi, I'am working on a FreeRadius Setup für our network since 3 weeks and I get more and more confused, even after days of RTFM. If someone could help me, I'd owe you a beer. :-) This is what I want to do: We have a Linksys Switch which can be an AP for Radius. If a PC is authenticated the Port of the Switch will work. I want to install a certificate on every PC in our network. The Supplicant should contact the AP using eap and the AP the Radius-Server (I use freeradius 1.1.0 on Suse 10.1). So the PC should have access to the network, regardless of the user which will work on it. I configured Freeradius' eap.conf to use TLS, did all certificates and installed it on the client and server. radiusd -X -A does't report an error. All Servers and Clients are in the DNS. The problem is, if I setup the authentification with EAP-Type "Smartcard or Certificate" in W2K simply nothing happens, there is no request coming to the radius server, nor an error message on the client. If I configure on the client PEAP with protected Password (and say that it should not use the Windows-Logonname in the EAP-MSCHAPv2 Dialog) I get a logon-screen and can authentify the computer (I've put a dummyuser in users files) and I see the conversation in the server-debug. If I say it should use the Windowslogonname, again nothing happens to the radius server (there is even no request to that server). I even took SecureW2 to test, with the same result. I'm doing something terribly wrong, but what could it be? Every hint is welcome! In the future I want to check also in our LDAP-Directory (we have a Samba-Domain there) if the computer exists in the domain and only then accept the certificate for authentification. But I'am lightyears away from it, did anybody do this before? thanks in advance Alex -- ServiceCenter IT - Alexandros Gougousoudis (Leiter) Gemeinsame Einrichtung der Kunsthochschule Berlin-Weissensee, Hochschule für Musik "Hanns Eisler" und der Hochschule für Schauspielkunst "Ernst Busch". Tel.: 030 / 477 05 - 444 * Fax.: 030 / 477 05 - 445

3 3

Error: TLS_accept:error in SSLv3 read client certificate A
by Özgür Kaya 08 Aug '06

08 Aug '06

Hi everybody My radius server version is 1.04 My kernel 2.6.15.1 Debian The server gave following errors: Tue Aug 8 09:55:55 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Thank you -ozgur Tue Aug 8 09:56:26 2006 : Info: rlm_eap_tls: Length Included Tue Aug 8 09:56:26 2006 : Error: TLS_accept:error in SSLv3 read client certificate A

1 0

Error: TLS_accept:error in SSLv3 read client certificate A
by Özgür Kaya 08 Aug '06

08 Aug '06

Hi everyone I have freradius server on debian linux. The server gave such error two days ago Tue Aug 8 09:29:19 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Tue Aug 8 09:29:20 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Tue Aug 8 09:29:40 2006 : Info: rlm_eap_tls: Length Included Tue Aug 8 09:29:40 2006 : Error: TLS_accept:error in SSLv3 read client certificate A What is the problem Please help me

2 1

Re: Missing Attributes
by Graham Beneke 08 Aug '06

08 Aug '06

Alan DeKok wrote: > Graham Beneke <graham(a)apolix.co.za> wrote: > >>> Add it... where? >>> >>> >> The chillispot daemon is not locking the user out once their transfer >> limit has been reached... >> > > Huh? You said you added the dictionary, and I asked where. > > Your answer makes no sense, other than as a statement unrelated to > my question. > sorry - missunderstood the question... was refering to 'it' from the origonal text... I added the dictionary file in the /etc/freeradius/ directory and then added a $include into 'dictionary' Also tried 'cut-n-pasting' the contents of the additional dictionary to 'dictionary' and that also made no differnence. >>> Did you tell the server to send the attributes in the reply? >>> >>> >> Ok so how do i go about doing that? >> > > See the "users" file. > Correct me if I am wrong - but 'users' is not parsed when i'm using a MySQL backend? Pretty sure I disabled it in my setup.

2 2

Access to wiki?
by John Horne 07 Aug '06

07 Aug '06

Hello, Is there a problem with the freeradius wiki (http://wiki.freeradius.org)? I am trying to sort out a problem and came across a reference to the wiki page. However my browser just sits there when trying to access the page. I can resolve the DNS name and ping it; just not access it. Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

3 2

EAP-TTLS + LDAP + PAP with encrypted password
by wekz 07 Aug '06

07 Aug '06

Hi all, I've been trying to get over this configuration but without any success. I'm using freeradius-1.1.1. First I had this working with eap-tls and peap for authentication and ldap for authorization, it was working quite well. As I have to integrate this configuration with an ldap that has encrypted passwords I decide to change authtype to pap over eap-ttls after watching Protocol and Password Compatibility in Alan's site. The authorization part of ldap does the following: A user will be authorized to use remote access if he is in the ldap and depending on the access policy defined if he belongs to a white or blacklist. After being authorized within the authorize section the user find these lines: users_branch eap user-branch is the users file I use that has entries by the form (and nothing else ): DEFAULT ldap11-Ldap-Group == Local Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-Id=Local, Fall-Through = No This, as I said, was working right. Now the only things I've added to radiusd.conf is modules { ( I've commented any other type like chap, mschap, peap, leap... only the onse listed here are set ) ldap-modules-stuff pap { encryption_scheme = sha1 } eap { default_eap_type = ttls ... gtc { auth_type = PAP # I've test without configuring gtc too and setting default_eap_type in ttls to md5 and commenting it out } tls { my old configuration that works } ttls { default_eap_type = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes } } } authorize { ... ldap stuff user_branch eap } authenticate { Auth-Type PAP { pap } eap } Then in the logs I can see that ( I don't put them because they are nearly endless ): The user is authorized and the password is got from the ldap (rlm_ldap: Adding userPassword as User-Password, value {sha}rur+4yJuecpmc8vxS/8wAyAMNHM= & op=21) ......... rad_check_password: Found Auth-Type EAP auth: type "EAP" ........... The eap-ttls tunnel is ok .......... And after matching the group Local in my users-file: auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Access-reject When I try this with clear-text passwords it works quite well but I don't know if it is working the way I want or not (with pap), because neither with encrypted nor with clear-text I can't see in the logs a reference to rlm_pap or gtc... I imagine I'm doing something wrong but can't figure out what it is. I've googled on the internet and in the mailing list but I don't make any progress with what I've found. So any comments are welcome Thanks

2 3

Web page for setting up the server for the first time
by Alan DeKok 07 Aug '06

07 Aug '06

http://deployingradius.com/documents/configuration/setup.html The page has two simple rules for getting the server to do what you want. It *doesn't* get into details of what modules to touch or how they work. Instead, it describes higher-level processes that help you along the way, and ensure you reach your goal. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 2