May 2007 - Freeradius-Users - lists.freeradius.org

Re : Multiple server certificates in EAP-TLS or EAP-TTLS
by Eshun Benjamin 30 May '07

30 May '07

There was a post on this by Mike; You'll have to set up two instances of the EAP module. The first instance will have the TLS submodule set up with the information for Cert1.pem (and the appropriate key and CA cert). The second instance will have its TLS submodule set with the info for Cert2.pem. It will look something like this: modules { ... eap eap1 { ... tls { certificate = Cert1.pem ... } } eap eap2 { ... tls { certificate = Cert2.pem ... } } } authorize { ... eap1 } authenticate { ... eap1 eap2 } Then, this is one of the few instances where you'll need to manually specify the Auth-Type in the users file, like this: DEFAULT Called-Station-ID = "00112233445566:SSID1", Auth-Type := eap1 DEFAULT Called-Station-ID = "00112233445566:SSID2", Auth-Type := eap2 Or, better yet, use regexes (this should work): DEFAULT Called-Station-ID =~ ":SSID1$", Auth-Type := eap1 ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Don Peoples <dpeoples(a)NAVINI.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Mardi, 29 Mai 2007, 23h27mn 06s Objet : Multiple server certificates in EAP-TLS or EAP-TTLS Multiple RADIUS clients can be defined in the clients.conf file. Is there a way to define the location of a server certificate for each client? I'm envisioning a single freeRadius server supporting multiple client authenticators. I want each authenticator to be able to send a unique certificate to identify itself to its supplicants. It appears that the "certificate_file" parameter in the eap.conf file would only support a single certificate. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

DDNS problem
by Mati Katz 29 May '07

29 May '07

hello i'm using the 1.1.5 version of freeradius. i have problem i setup a client in clients.conf that is a host name like fkatz.dyndns.org because my NAS has dynamic ip. When i try to login at first time (i use DD-WRT + chillispot built-in) i succeeded but after i receive new dynamic ip from my ISP the radius reject it because he doesn't know the new ip. The radius server works fine with IP static i tested. Also i checked lookup and ping to the fkatz.dyndns.org after the dynamic ip has changed and very fast it refreshs. thanks and sorry about my english. -- ICQ#: 40226462 Skype: katonidas Email: matikatz(a)gmail.com

3 3

Multiple server certificates in EAP-TLS or EAP-TTLS
by Don Peoples 29 May '07

29 May '07

Multiple RADIUS clients can be defined in the clients.conf file. Is there a way to define the location of a server certificate for each client? I'm envisioning a single freeRadius server supporting multiple client authenticators. I want each authenticator to be able to send a unique certificate to identify itself to its supplicants. It appears that the "certificate_file" parameter in the eap.conf file would only support a single certificate.

1 0

RE: JRS Service configurations + Wiki
by Josh Howlett 29 May '07

29 May '07

> > Alan D, > > > > Would you mind having configuration documents for 3rd party > services > > like JRS on the FreeRADIUS wiki ? > > > > Alan B, > > > > Would JANET mind having configuration documents for JRS on the > > FreeRADIUS wiki ? > > > > It is meant to be a repository for everything FreeRADIUS > after all ... > > and it's easier if all this stuff is in one place. > > personally I would prefer such configuration to be on the JRS > support / UKERNA document site. What should be on the main FR > wiki is the fundamental 'how to proxy' and 'how to attribute filter' > type documents. I believe that special service cases could > otherwise overrun the freeradius site (as they do the > freeradius users list) While UKERNA would have absolutely no problem with this, I empathise with Alan B's view that such documentation might be 'clutter' on the FreeRADIUS Wiki and might be better located on a JRS-specific website. It might also be more visible to JRS participants. Perhaps a link from the Wiki to the JRS website might be more appropriate? If you'd like to contribute some JRS documentation formally, then please get in touch with me directly! We're particularly interested in documentation covering the 'complete solution' (auth db, radius, WAPs, PR, etc). This is obviously a lot of work, but we should be able to compensate your Institution for this effort. best regards, josh.

1 0

variables expansion in config files
by Milan Holub 29 May '07

29 May '07

Hi Alan, it looks like latest CVS head has problems with expansion of ${var} in assignments: rlm_sql (sql): database query error, SELECT id, ipaddr, shortname, type, secret FROM ${nas_table} where secret <> 'DISABLED' group by ipaddr: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '{nas_table} where secret <> 'DISABLED' group by ipaddr' at line 1 where "nas_table" is defined properly in sql.conf(which is included by server) but it's not expanded in sql/mysql-dialup.conf" ... nas_query = "SELECT id, ipaddr, shortname, type, secret FROM ${nas_table} where secret <> 'DISABLED' group by ipaddr" ... It's related at least to all variables defined in sql.conf. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

Re: log file for free radius 1.1.6 eap-tls authentication
by anoop_c＠sifycorp.com 29 May '07

29 May '07

Hi 1 I know its eap-tls and certificate based. Earlier i was using Navis radius .In that for eap-tls we have to add certificate name to a specific user file. Like that here also user file is there can i make use of the user file so that only that user get authenticated, 2 Logs are not happening.In config changes required to get the same? Regards Anoop > > > Message: 2 > Date: Mon, 28 May 2007 15:07:06 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: log file for free radius 1.1.6 eap-tls authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <a8emGRAP.1180361226.4861000.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > This is EAP-TLS. This user has a valid user certificate and is > accepted. > If you don\'t want to go via certificates but use user/password, use > EAP-TTLS with MS-CHAPv2 (or PAP or any other auth protocol). > > Ivan Kalik > Kalik Informatika ISP > > >

2 1

2.0.0-pre2 has "Magic feature number one" :)
by Alan Dekok 29 May '07

29 May '07

I've just committed a preliminary patch to add "magic feature #1" that I've mentioned a few times. The feature is VMPS support. :) ... listen { type = vmps ipaddr = 10.1.2.3 port = 1589 clients = vmps_clients } vmps_clients { client foo { ipaddr = 1.2.3.4 ... } } ... The preliminary functionality is there. It's not ready for production use, but it can receive VMPS packets, and then complain that it doesn't know what to do with them. The goal for 2.0.0 is to have full support for VMPS. :) Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

5 12

Re: Rlm_python - need documentation
by UriCALL Support 29 May '07

29 May '07

Peter, thank you for your fast response. Can u also provide me some example of script, so I could understand how the module works? Again, it is bit difficult for me to find it out from the documentation which comes with freeradius. Ta, Dan > > On Mon 28 May 2007, UriCALL Support wrote: >> Hi All, >> >> I am in need of developing my own application using rlm_python. Can >> anybody inform me about some documentation available? From what I have >> found on Internet it looks like an isolate project with lack of users > ... >> Anybody able to share the experience with me? Is it stable for > production? > > Some patches went in recently to make it better based on code that > reportedly > has been running in production for over 12 months. YMMV. > > Cheers > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > > > ------------------------------ > >

1 0

Denying access without restarting radiusd
by Emmanuel A Kwarteng 29 May '07

29 May '07

Hello All, I have a freeradius v1.51 as can be seen bellow ranning on a linux server. [root@isp4 raddb]# radclient -v radclient: $Id: radclient.c,v 1.51 2002/10/28 21:11:29 aland Exp $ built on May 9 2003 at 09:18:10 I have included a file access.deny in the users file and wants to deny access to all users in the access.deny file. What I have realised is that I have to restart radius anytime i update this file. Can someone show me how to deny a set of users like this without restarting radius? kwarteng

3 2

howto limit the acces of users
by vik 28 May '07

28 May '07

Ok, but when i create a new user, using dialup admin, how do i define how long could he stay connected. In the mysql db where could i find the correspondance User-Name <-> Time spent ot time left. Is it stored in the db ? Sorry for all those stupid questions but i didn't manage to find any documentation on that, if you have a link in your mind :) Thx once again. >Have a look at Login-Time, Session-Timeout and counters (daily and SQL >daily and monthly are in radiusd.conf). >user1 - Session-Timeout or no reset counter >user2 - daily counter or Login-Time (if it is particular time of day) >Ivan Kalik >Kalik Informatika ISP >Dana 28/5/2007, "vik" <vik_viktor at yahoo.com> piše: >>Hello, >> >>I would like to have for each user a time limit, for instance: >> >>user1 4 hours >>user2 2 hours/day >>user3 illimited >>etc... >> >>Thx in advance. >> ____________________________________________________________________________________Got a little couch potato? Check out fun summer activities for kids. http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&…

2 1