September 2007 - Freeradius-Users - lists.freeradius.org

EAP fragment size clarification needed
by Stefan Winter 24 Sep '07

24 Sep '07

Hi, eap.conf states: # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # # fragment_size = 1024 I wonder what the sentence about MAX packet size on APs is about. Is it their maximum allowed length of a RADIUS packet? Frankly, that would be quite stupid because packets can legitimately be much larger than that. (-> RADIUS implementation problem on AP) If it is about fragmented and re-assembled UDP: that would mean those APs can't re-assemble UDP properly (-> again implementation problem) finally, if it's about the max layer-2 size for the EAP conversation: then a fragment size of 1500 would be okay on a 1500 MTU on layer 2 (and if one only authenticates 802.3 LANs and 802.11 WLANs, both of them handle 1500 just fine). So I wonder, why does anything impose specifically 1500-1600 on the AP side, and why does that imply 1024 is an upper bound for the fragment size? That question doesn't come from thin air: higher fragment size reduces amount of round-trips for an EAP auth (even though it generates more UDP packets on the wire, sure). And with EAP-TLS, there are supplicants that fill their 1500 on the layer 2 unconfigurably, and it appears to work well - if there's no firewall that discards the second fragment of the RADIUS message. So if the above holds true, I would much rather set fragment size to 1500, and fix any upcoming impl problems that have nothing to do with EAP frag size, rather than yield with my frag size. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 2

simultaneous login
by Michael Ziemann 24 Sep '07

24 Sep '07

Hi ! I have a problem with simultaneous login. The user connects to the RADIUS Server, then the user appears in the MySQL-DB in the table radacct. But if the user disconnect, the user doesn't disappear in the table. If I remove the entry by myself, the user can connect again. In the table radreply i added an Idle-Timeout in the Attribut field with the value 5 and op = . I added also Idle-Timeout to radgroupreply to the group of user with the value 5. Regards Michael

2 1

RE: Vista Authentication
by Josh Howlett 24 Sep '07

24 Sep '07

Ensure that you're using a recent version of samba. Search the list for a value of 'recent'. josh. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: 23 September 2007 14:26 > To: FreeRadius users mailing list > Subject: Re: Vista Authentication > > Iain Ellis wrote: > > Are there any known gotcha's concerning Vista clients > authenticating? > > Not that I know of. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

1 0

RE: Support for SSO Active Directory & PEAP-MS-CHAP-v2
by Rakesh Jha 24 Sep '07

24 Sep '07

Can you please send steps, I am also trying to so the same. Rakesh ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of rick wiltshire Sent: Sunday, September 23, 2007 4:48 PM To: freeradius-users(a)lists.freeradius.org Subject: Support for SSO Active Directory & PEAP-MS-CHAP-v2 Dear All, I need help with dot1x implementation in an Enterprise LAN. Our target is to authenticate and authorize users based on their identities (domain user names) as well as applying GPOs on users. Our authentication Backend is: Active Directory Our Authorization & Accounting is done by: freeRADIUS Authorization Attributes control VLAN assignment (hence, IP address pool) Required Authentication EAP-Type : PEAP & MS-CHAP All Clients are using WinXP supplicant. I managed to implement PEAP&MS-CHAP with this setup however with users who have cached credentials on their PCs. If the user logs on the PC for the first time, he fails to reach the active directory to authenticate since the connection is not yet authorized. So what I need is get the computer authenticated and assigned an IP address and then authenticate the user in a following phase while the connection is up. Any clues with authenticating domain machines using freeradius and active directory implementation? Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

1 0

[newbie] radutmp question
by Cheng-Lin Yang 23 Sep '07

23 Sep '07

Hi all, I have encountered a problem with radutmp. The information of my environment is a vpn service and auth with freeradius 1.1.7. The problem happened as below: 1. start up the radiusd 2. user "abc" connect to vpn, and I can use radwho to see "abc" user 3. shutdown radiusd 4. user disconnect from vpn server (radiusd not start yet) 5. start up radiusd, and radwho still shows "abc" is connected Is there any way to solve this problem? any suggestion is extremely welcomed. Thank you. :) Regards, clyang

3 4

Re: EAP (PEAP) MS-CHAPv2b how to
by Piero Giobbi 23 Sep '07

23 Sep '07

Hi riky. I had exactly the same problem, upgrading to 1.1.7 solved my problem (debian package is only at 1.1.3, didn't get Cleartext-Password to work there either). Just upgrade, all of you whos not running 1.1.7!! : ) And why use :=? Not == (more secure)? Thx. On Sep 21, 2007, at 4:36 PM, freeradius-users- request(a)lists.freeradius.org wrote: > From: "riky.none" <riky.none(a)email.it> > Date: September 21, 2007 3:03:18 PM GMT+02:00 > To: FreeRadius users mailing list <freeradius- > users(a)lists.freeradius.org> > Subject: Re: EAP (PEAP) MS-CHAPv2b how to > Reply-To: FreeRadius users mailing list <freeradius- > users(a)lists.freeradius.org> > > > Alan DeKok ha scritto: >> riky.none wrote: >> >>> I configure freeradius on basic autentication mode (using file >>> /etc/freeradius/users) >>> >>> paperino Auth-Type := Local, User-Password == "paperino" >>> >>> topolino Auth-Type := EAP, User-Password == "topolino" >>> >> >> (1) DO NOT SET AUTH-TYPE >> (2) Use Cleartext-Password := ... >> NOT User-Password == >> >> >>> rlm_eap: No such EAP type peap >>> >> >> Read eap.conf. >> >> >>> I want use autentication without certificate >>> >> >> If you're using PEAP, you need a server certificate. >> >> >>> HOW TO configuration WIFI (cliente xp) and freeradius using EAP/ >>> PEAP ??? >>> >> >> See the Wiki. This is covered there. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html >> >> . >> >> > not hangry Alan > > I feel really stupid now... > > i insert in users file: > > myuser Cleartext-Password := "somepass" > > run freeradius -X > /etc/freeradius/users[219]: Parse error (check) for entry myuser: > Unknown attribute "Cleartext-Password" > > eap config is not easy to read (for newbie) > > There is one basic howto to configure freeradius using TTLS??? > > in wiki i not find one basic howto EAP-TTSL

2 1

Support for SSO Active Directory & PEAP-MS-CHAP-v2
by rick wiltshire 23 Sep '07

23 Sep '07

Dear All, I need help with dot1x implementation in an Enterprise LAN. Our target is to authenticate and authorize users based on their identities (domain user names) as well as applying GPOs on users. Our authentication Backend is: Active Directory Our Authorization & Accounting is done by: freeRADIUS Authorization Attributes control VLAN assignment (hence, IP address pool) Required Authentication EAP-Type : PEAP & MS-CHAP All Clients are using WinXP supplicant. I managed to implement PEAP&MS-CHAP with this setup however with users who have cached credentials on their PCs. If the user logs on the PC for the first time, he fails to reach the active directory to authenticate since the connection is not yet authorized. So what I need is get the computer authenticated and assigned an IP address and then authenticate the user in a following phase while the connection is up. Any clues with authenticating domain machines using freeradius and active directory implementation?

2 1

Vista Authentication
by Iain Ellis 23 Sep '07

23 Sep '07

Hello Are there any known gotcha's concerning Vista clients authenticating? I'm running 1.1.7 with my certificates compiled with xpextensions and I can't get a Vista client to go beyond Sending Access-Challenge when authenticating. XP clients are authenticating OK, just not Vista. I'm authenticating to NDS via LDAP. Any suggestions\thoughts gratefully received Rgds, Iain --------------------------------------------------------------------------- This email and any attachment(s) is intended for and confidential to the addressee. If you are neither the addressee nor an authorised recipient for the addressee please notify us of receipt, delete this message from your system and do not use, copy or disseminate the information in, or attached to it, in any way. Our messages are checked for viruses but please note that we do not accept liability for any viruses which may be transmitted in or with this message. --------------------------------------------------------------------------- The College of Law of England and Wales. Registered charity No 271297 ---------------------------------------------------------------------------

2 1

Configuration for Cisco DSL Users
by DFN Systems Office 22 Sep '07

22 Sep '07

I'm new both to freeradius and the *nix operating system. I have successfully implemented freeradius for users dialing in through Portmaster3 Access Servers using FreeRadius 1.0.1-1 on Fedora. I am currently authenticating DSL users locally on a Cisco 7206VXR Router. I would like to authenticate the DSL users on the FreeRadius Server, but attempts have been unsuccessful. The Accounting works. Even now with DSL Users set to Auth locally on the Router, Radius is faithfully logging the activity. With Radius Auth, the DSL modem will not connect and I get no entry in the Radius accounting log. AAA Debug is virtually Identical to the Local Auth output! The only difference was the line "Method=local" changed to "Method=Radius". Both log entry sets have Status = PASS and both show the virtual-access change to up! So now I'm thinking the AAA/Radius is working but I have a communications issue. When a DSL user authenticates locally, he then gets an IP address from the local pool on the Cisco. When the same DSL User authenticates on Radius, all communication seems to stop. Here are the relevant config sections from the Cisco. aaa new-model aaa authentication login default line [*currently set to local] aaa authentication ppp default group radius local [see*above] aaa authorization network default group radius local aaa accounting delay-start aaa accounting network default start-stop group radius interface Loopback1 description DSL ip address 206.206.89.1 255.255.255.0 secondary ip address 206.206.88.161 255.255.255.240 secondary ip address 206.206.86.1 255.255.255.0 interface Virtual-Template2 description DFN NEW Template ip unnumbered Loopback1 ip mroute-cache peer default ip address pool OsoGranDSL OsoGranDsl2 ppp authentication pap radius-server host [omitted] auth-port 1645 acct-port 1646 radius-server host [omitted] auth-port 1645 acct-port 1646 radius-server key [omitted] Heres an example entry from my users file: username Auth-Type := Local, User-Password == "omitted" User-Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-Netmask = 255.255.255.255, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP I think I'm close, and I have a hunch the users file settings that work for PortMasters may not be good for Cisco. Any suggestions or sample configs would be appreciated. Bill Green Dfn Systems

2 1

about FreeRADIUS password encrypt
by yangcuilin 22 Sep '07

22 Sep '07

Hello， I will appreciate it very much, if you do me a favour. My customer asks us to store the encrypted password into the FreeRADIUS (DB has Configured Mysql). The password I have passed to FreeRADIUS is clear text. Can the FreeRadius be configured like that? Pls give me some advice . Rock

2 1