July 2007 - Freeradius-Users - lists.freeradius.org

ldap auth based on user acc and dialupaccess attr
by Jacob Jarick 10 Jul '07

10 Jul '07

Hello, Im currently trying to setup FR to authenticate a user / machine regardless of password, provided that the account exists and that DialupAccess = 1. Im a bit stuck atm because I do not know how to ignore the passwd failing the ldap check. In the end I hope to have the ldap check if dialup access is allowed, if it is then check if user / pass is correct via ntlm. Once I have ldap working as I want it to then I will add ntlm auth. Running gentoo with 2.6.20 kernel freeradius 1.1.6 windows 2003 server radiusd.conf

3 4

None
by E. abdelghani 10 Jul '07

10 Jul '07

2 1

Logging failed authentications....
by Ackbar Joolia 10 Jul '07

10 Jul '07

Hi, I would like to be able to log failed authentications but I don't find it anywhere. And ideally I would like to put it into a MySQL table. Can anyone advice on this please? Thanks AJ

3 2

Recommended AP for test purposes.
by Garvin Haslett 10 Jul '07

10 Jul '07

Further to a previous I believe I'm using an AP that does not act as a NAS. In particular there are no aspects of the security page that ask for Radius configuration. I'm using a Belkin Wireless G Universal Range Extender/Access Point (FCC: K7SF5D7132A). Can anyone confirm my suspicions? If so, can anyone recommend a reliable AP suitable for doing some testing on. Thanks in anticipation of replies, Garvin.

6 5

Re : use_tunneled_reply
by Eshun Benjamin 10 Jul '07

10 Jul '07

It is explained in the config file. # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} # the PEAP module also has these configuration # items, which are the same as for TTLS. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Manuel Sanchez Cuenca <msc(a)dif.um.es> À : freeradius-users(a)lists.freeradius.org Envoyé le : Mardi, 10 Juillet 2007, 17h07mn 43s Objet : use_tunneled_reply Hello all, can anybody exaplain me the meaning of the attribute use_tunneled_reply in the peap configuration? what is the difference in the behaviour of PEAP if I set this option to yes or no? Thanks in advance. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

R: R: Cisco VRF + Radius
by Francesco Cristofori 10 Jul '07

10 Jul '07

> You don't need to set up vrf templates if everyone is going to use the > default radius server and default authentication and au6thorization > groups. It's optional. Thanks Ivan, now it's clear I don't need templates... > What does debug radius and debug ppp negotiation on Cisco say > about why > was the Framed-IP-Address rejected. If it fails on IPCP then > your route > is the problem. Since it all goes well without it ... Yes, the problem was on the nas side. Now it seems to understand and correctly assign the IP address to the cpe. > Ivan Kalik > Kalik Informatika ISP Thanks, Francesco Cristofori.

1 0

Re : Re : PEAP certificates, signing requirements and examples
by Eshun Benjamin 10 Jul '07

10 Jul '07

> I have read and used the make_cert_command = "${certdir}/bootstrap"; its > excellent tool but it only creates clientAuth and serverAuth and does > not add PEAP Huh? What do you mean by that? You have clarified, There's no need to post the OID's in every message. We've seen them before. > ... it usually pops up message > "the server certificate is not trusted because there no explicit trust > settings" - this seem to require the setting of eap oid. No. If you get that message, then the OID is in the certificate, and PEAP is working. The message simply says that the certificate isn't signed by a root CA your system knows about. I get this message even with certificate signed by root CA. And also by intermediate CA. Thanks Alan, I have to ask Apple. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mardi, 10 Juillet 2007, 14h55mn 34s Objet : Re: Re : PEAP certificates, signing requirements and examples Eshun Benjamin wrote: > I have read and used the make_cert_command = "${certdir}/bootstrap"; its > excellent tool but it only creates clientAuth and serverAuth and does > not add PEAP Huh? What do you mean by that? > ... it usually pops up message > "the server certificate is not trusted because there no explicit trust > settings" - this seem to require the setting of eap oid. No. If you get that message, then the OID is in the certificate, and PEAP is working. The message simply says that the certificate isn't signed by a root CA your system knows about. > The question is > what is the difference between web server and radius server certificates > with respect to ssl and wireless in the context of EAP, PEAP. Ask Microsoft. > [ PEAP ] ... There's no need to post the OID's in every message. We've seen them before. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

use_tunneled_reply
by Manuel Sanchez Cuenca 10 Jul '07

10 Jul '07

Hello all, can anybody exaplain me the meaning of the attribute use_tunneled_reply in the peap configuration? what is the difference in the behaviour of PEAP if I set this option to yes or no? Thanks in advance.

2 1

Re: Any successes with Belkin Wireless Access Point?
by Garvin Haslett 10 Jul '07

10 Jul '07

I've now configured the the clients as such: client 172.16.0.0/16 { secret = testing123 shortname = belkin-at-garvin } The IP address of the network card on my Windows machine is 172.16.1.1. While the corresponding value for the Access point is 172.16.1.2. Subnet masks in both cases is 255.255.0.0 However, still no sign of traffic destined for the Radius server. Garvin. ------------------------------ Message: 2 Date: Tue, 10 Jul 2007 11:24:01 +0100 From: <tnt(a)kalik.co.yu> Subject: RE: Freeradius-Users Digest, Vol 27, Issue 44 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <Yj5Lgl5G.1184063041.8496430.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 XP won't route to APIPA address. Make a /30 network in a different private IP range. Or you can switch on Internet Connection sharing on XP, NIC wil be fixed to 192.168.0.1 and it will behave like a mini-router (DHCP etc.). Just fix the IP address on AP (so you have a single address in clients.conf) and leave the rest on automatic. Ivan Kalik Kalik Informatika ISP Dana 10/7/2007, "Garvin Haslett" <Garvin.Haslett(a)Emccsoft.com> pi?e: >I've changed the client declaration thus so that the CIDR matches the >subnet mask for a Class B IP address: > >client 169.254.188.217/16 { > secret = testing123 > shortname = belkin-at-garvin >} > >But it still doesn't work. > >Is this what was meant or is it the 169.254.0.0 network number that is >at fault? > >Garvin. > >------------------------------ > >Message: 5 >Date: Mon, 09 Jul 2007 19:25:01 +0100 >From: <tnt(a)kalik.co.yu> >Subject: Re: Any successes with Belkin Wireless Access Point. >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: <TlD6aGsD.1184005501.8040110.tnt(a)kalik.co.yu> >Content-Type: text/plain; charset=ISO-8859-2 > >Your AP IP address is from Automatic Private IP Addressing range. >Routing is not going to work there. Make a "proper" /30 network between >AP and the PC. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 9/7/2007, "Garvin Haslett" <Garvin.Haslett(a)Emccsoft.com> pi?e: > >>I have a tiny test network consisting of a Belkin Wireless Access Point >>(FCC: K7SF5D7132A) connected by an ethernet cable to a Windows machine >>with an Intel network card. >> >>I'm running FreeRADIUS.net-1.1.5-r0.0.3 and configure the client thus: >> >>client 169.254.188.217 { >> secret = testing123 >> shortname = belkin-at-garvin >>} >> >>When I connect to the AP I can see packets getting through to the >>network card using ethereal but nothing appears in the radius.log. >> >>When I disconnect from the AP the device's MAC still appears in the >>AP's list and it is reported as being Authenticated! >> >>Can anyone tell me what I have missed in the configuration? >> >>Garvin. >> >>- >>List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html >> >>

1 0

Re : PEAP certificates, signing requirements and examples
by Eshun Benjamin 10 Jul '07

10 Jul '07

I have read and used the make_cert_command = "${certdir}/bootstrap"; its excellent tool but it only creates clientAuth and serverAuth and does not add PEAP which ofcourse one can add by himself. Eventhough freeradius will authenticate some supplicants will require users to first time save the cert. Windows supplicants the oids : xpclient_ext and xpserver_ext and on MAC supplicants ? ; it usually pops up message "the server certificate is not trusted because there no explicit trust settings" - this seem to require the setting of eap oid. The question is what is the difference between web server and radius server certificates with respect to ssl and wireless in the context of EAP, PEAP. Does it matter if the cn is the SSID of the wireless network for radius server auth and server domain name for webserver auth? [ PEAP ] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 extendedKeyUsage = 1.3.6.1.5.5.7.3.1 [ clientAuth ] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 [ serverAuth ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 9 Juillet 2007, 18h12mn 28s Objet : Re: PEAP certificates, signing requirements and examples Eshun Benjamin wrote: > Hi All, > I came across this infomation and tought it would be nice to drop it > here. Eventhough it is ssl issue it has to do with PEAP. Just to > discuss; any comments. This is documented in eap.conf, among other places. It's on the Wiki, in the script files that create the test certificates for the server, etc. In 2.0, a brand-new install of the server will automatically create test certificates with the right OID's for Windows. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1