January 2007 - Freeradius-Users - lists.freeradius.org

Freeradius, wireless access point and password authentication
by Roberto 21 Jan '07

21 Jan '07

Hello, I'm new to freeradius... I want to realize a sort of hot spot using freeradius, mysql (with a graphical interface creating users on it) and some access points (linksys, d-link, etc...). I correctly installed and integrated freeradius and mysql. Now the problem is to use the access points as NASes, and to realize an authentication system which prompts the client computers ( with Windows XP ) for a password in order to associate with the AP. I cannot use certificates to join the AP, because the client computers belongs to occasional visitors, and installing certificates on each client would be little practical. I made different trials, with no success. Thank you in advance for any help, and sorry for my bad english.... :-)

4 6

Freeradius Postgres and Pap problem
by Jack Allan 21 Jan '07

21 Jan '07

Hi To All If in postgressql.conf, I set num_sql_socks to a number x, then when I run NTRadPing (or any other Radius client), I am only able to successfully authenticate a user x times. After this, rlm_sql gives up the ghost (at least I think???) and I need to restart the freeradius server for anything to work. When I run in debug mode, it seems as if the sockets are being closed once used (at least thats what it says on the output). What is happening is that no attributes are being passed to rlm_pap. I am currently using freeradius version 1.1.3. I should also mention that I have two instances of the SQL module - one for authentication, the other for accounting. Also, I am using postgresql 8.2. This is baffling me, and trawling through the mailing lists is not yielding an answer. Thanks in advance to anyone that can help me out. Jack

6 7

3Com-User-Access-Level Not Applied
by Alexandre Soares 20 Jan '07

20 Jan '07

Hi All, I using the freeradius version 1.1.4 + a switch 5500-EI from 3Com to apply a resource called switch login. But the attribute 3Com-User-Access-Level is not applied after Authorization processes to valid user, the dictionay used is correct and configuration too, see in attach file, please help me. thks

3 11

rate-limit entry in mysql
by satish patel 20 Jan '07

20 Jan '07

dear all I have tested rate-limit with user file but whn i was try it with mysql but i didnt get respond it is not working with mysql is any op code for it or any special configuartion for this URGENT my mysql entry is mysql> select * from radgroupcheck; +----+-----------+------------------+----+------------------------------------------------------------------------------------------------------------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+------------------------------------------------------------------------------------------------------------+ | 1 | 64KB | Simultaneous-Use | = | 1 | | 2 | 64KB | Cisco-Avpair | := | \"lcp:interface-config#1=rate-limit output 128000 10000 10000 conform-action continue exceed-action drop\" | +----+-----------+------------------+----+------------------------------------------------------------------------------------------------------------+ i have test it with diff , diff op code = := == += but it is not working :( Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Re: Best practices for redundant servers
by Aaron Paetznick 19 Jan '07

19 Jan '07

Thanks, this was helpful. I would rather not use LVS. I would prefer to use the built-in functionality of the NAS to fall back from a primary to secondary or tertiary auth/accounting servers. This whole setup would be far simpler and more robust if I could just do master-master replication with the MySQL servers. Oh well. I was not aware of radsqlrelay. I think this gets me closer to what I need than anything else. I can't guarantee which server the NAS will choose to log to at any given time. Therefore, I may need to use radsqlrelay on each server to keep the others in sync. Does this seem like a sensible plan? --Aaron Nicolas Baradakis wrote: > Aaron Paetznick wrote: > >> I've been struggling with this problem for a couple of weeks, and I >> thought I'd pass it along to the mailing list. Basically I'm trying to >> answer the following question. Given multiple identical dedicated >> servers each running Linux and MySQL, how can I configure FreeRADIUS for >> maximum stability, reliability, and performance? The question, it >> seems, is not as easy as is sounds. > > I've already setup FreeRADIUS on multiple redundant servers, but never > had the time to write a HOWTO. The main guideline is: > > 1. Use LVS in a "direct routing" setup to dispatch the RADIUS requests. > http://www.linuxvirtualserver.org/VS-DRouting.html > > 2. Use MySQL replication for the authorize database, so each FreeRADIUS > server connects to a local, read only database. > http://dev.mysql.com/doc/refman/5.1/en/replication.html > > 3. Use radsqlrelay for the accounting database, so the accounting data > is written to a central database without slowing down the RADIUS > servers. radsqlrelay is to be found in the FreeRADIUS source tarball, > you could read the "rlm_sql_log" and "radsqlrelay" manpages for more > details. >

8 10

CA Dir
by Jeffrey Sewell 19 Jan '07

19 Jan '07

In the eap.conf, tls section, the comments say to use the 'CA_path' variable in the radiusd.conf file to indicate where the trusted CA chain will reside. However, this variable isn't in the tls section of the radiusd.conf (it is in the LDAP section, but I'm pretty sure that won't help me) file or the eap.conf file (where I thought it might have moved). As an experiment, I added it to eap.conf and it loaded ok with the following output: tls: CA_path = "/usr/local/etc/raddb/certs/rootCA" ... tls: CA_file = "(null)" Unfortunately the CA_file is the imporant one as I discovered when I tested the link: Fri Jan 19 09:51:05 2007 : Error: TLS Alert write:fatal:unknown CA So where is the appropriate place for the root chain? --Jeffrey

1 0

Restrict Password from detail file , accounting
by Ellis, Scott 1 (N-Comptel Inc.) 19 Jan '07

19 Jan '07

Is there a way to eliminate the password from being written to the accounting log files? Either not in clear text or altogether? I know that read access is restricted to Root access only.

3 4

Freeradius - Chillispot - ??? for WLAN + terminal-access
by Jens Meyer 19 Jan '07

19 Jan '07

Hi! I am looking for a small hotspot-solution (and found Freeradius + Chillispot - great!). But I want to connect (authenticate) 2-3 LAN-Kiosk-terminals (wired) additional (small Internet-Cafe). I found your description of "NAS"/"RAS" in the WIKI but I can't find any solution for this on the net. Is it possible to do this with Chillispot, too? Have you any tipps for me for this kind of setup? Any hint would be great - thank you! Kind regards, Jens

1 0

One question about Access-Request packet
by Rafał Kamiński 19 Jan '07

19 Jan '07

Hi, i have one question: Why when i try auth. by laptop-wifi over linksys then it's send that request: rad_recv: Access-Request packet from host 192.168.1.245:3072, id=0, length=119 User-Name = "rka" NAS-IP-Address = 192.168.1.245 Called-Station-Id = "001217694588" Calling-Station-Id = "0014a41e7112" NAS-Identifier = "001217694588" NAS-Port = 61 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000801726b61 Message-Authenticator = 0x794e9d729e673a6c41b875855ae5a464 Request without User-Password -> and that is problem with auth. When i try auth. over lan my PC send request: rad_recv: Access-Request packet from host 10.44.3.15:62963, id=66, length=55 User-Name = "rka" User-Password = "qazwsxedc" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 And the auth. is correct. Where is the problem? Maybe with Linksys? This is WPA54G. Thanks a lot for help BR, -- Rafal Kaminski http://blstream.com email: rafal.kaminski(a)blstream.com jid: rka(a)im.blstream.com

4 5

EAP-TLS certificate question
by kemas 19 Jan '07

19 Jan '07

Hi all, I've install freeradius-1.1.3,use it with AP Aironet 1100 doing EAP-TLS and works very well. I still confuse about certificate, is all client certificate created under 1 root ca, can be authenticated against freeradius that started with different server certificate? is it possible to set things like this root ca ------------ / | \ / | \ / | \ server1 server2 server3 ------- ------- ------- | | | | | | client1 client2 client3 I don't want client1 to be authenticated against server2 or server3. thanks

3 3