February 2008 - Freeradius-Users - lists.freeradius.org

Can use "auth" with radclient but not "status"
by Stephane Bortzmeyer 06 Feb '08

06 Feb '08

I believe that my Free Radius server is working, since I can query it successfully with "auth": % echo "User-Name = bortzmeyer\nUser-Password = foobar" | radclient jezabel auth mysharedsecret Received response ID 187, code 2, length = 44 Service-Type = Framed-User ... % echo "User-Name = bortzmeyer\nUser-Password = wrong" | radclient jezabel auth mysharedsecret Received response ID 189, code 3, length = 20 But "status" always fail: % echo "NAS-port = 1" | radclient jezabel status mysharedsecret radclient: no response from server for ID 198 (Same thing with 12 instead of status) On the server, running with -X, I just get: WARNING: Insecure packet from host 10.1.82.1: Packet does not contain required Message-Authenticator attribute Free Radius 1.1.7, Debian "lenny" OS

2 3

New bee to FreeRadius; need help in configuration
by Deepak Panigrahy 06 Feb '08

06 Feb '08

Hi, I have successfully configured the Freeradius server. The one thing that I noticed is: Everytime I modify the Clients.conf file to include a client, I have to stop the server and then start it gain so that the client is picked up. I am wondering if there is any other way so that the server can refresh itself everytime I add a client, automatically. Can anybody help me out? Thanks, Deepak

6 6

Detail cisco logging
by Vijay Avarachen 05 Feb '08

05 Feb '08

Hello, I have successfully configured freeradius 2.x to do AAA for my Cisco Catalyst 3560. Using modules rlm_detail I am able to log when the session starts and ends, however I am also interested in logging exactly what commands were issued by the user. Does anyone know how I can accomplish this? Thank you, Vijay Avarachen -- "Knowledge is the only wealth that grows as you spend it, and diminishes as you save it."

4 7

freeradius v.2.0.1 and Cisco 1200AP IOS V.12.3
by Dave Cummings 05 Feb '08

05 Feb '08

Greetings I have been working with freeradius v.2.0.1 and a Cisco 1200 Series Access Point (version 12.3 IOS) for many months now with no success to getting this working. I am doing research on freeradius product for a univeristy campus that I go to for implementation in the near future. I am out of ideas of how to configure this correctly. I still to this day do not have my Cisco 1200 AP authenticating with freeradius version 2.0.1. Does anyone have a configuration setup of this type of scheme or are willing to tell me how to start from ground up to make this work. My plan is simple at this point. I want to use freeradius, a Cisco 1200 Series Access Point, and one windows xp pro client to connect to the AP and authenticate against freeradius. I appreciate any input on this matter. Thanks again open source community. Dave _________________________________________________________________ Shed those extra pounds with MSN and The Biggest Loser! http://biggestloser.msn.com/

4 4

wiki
by Phil Mayers 05 Feb '08

05 Feb '08

I assume account creation is deliberately disabled on the wiki; could whoever runs/has access create me one?

2 1

Re: FreeRADIUS and RSA RADIUS Server
by David Mitton 05 Feb '08

05 Feb '08

1 0

Cisco 1200 AP
by John Melton 05 Feb '08

05 Feb '08

I have configured a Cisco 1200 AP for WPA2-PSK which is working with a wireless device able to connect OK. I have tried to add MAC authentication using the FreeRadius server, but have not been able to get it working. I can see from the FreeRadius log that the AP is sending the Access-Request packet and an Access-Accept response is being returned but the wireless device is unable to connect. Has anyone setup this configuration and got it working? Regards, John

3 4

Attributes sent to proxy servers ...
by Arran Cudbard-Bell 05 Feb '08

05 Feb '08

Hi, Noticed with CVS head that all attributes (including internal ones) appear to be getting proxied. Is this just a cosmetic thing ? Sending Access-Request of id 11 to 194.82.174.185 port 1812 Framed-MTU = 1480 NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221(a)loopback.sussex.ac.uk" Event-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001438fb9400" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x00000000064419000000000000000000 EAP-Message = 0x0244002b19001703010020c006fdcd03d0e15b7001c3e94e1a45340325626fed36c7c97450769dc33c587f Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313035 Proxying request 60 to home server 194.82.174.185 port 1812 Sending Access-Request of id 11 to 194.82.174.185 port 1812 Framed-MTU = 1480 NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221(a)loopback.sussex.ac.uk" Event-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001438fb9400" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x00000000064419000000000000000000 EAP-Message = 0x0244002b19001703010020c006fdcd03d0e15b7001c3e94e1a45340325626fed36c7c97450769dc33c587f Message-Authenticator = 0x00000000000000000000000000000000 Stripped-User-Name = "ac221(a)loopback.sussex.ac.uk" Realm = "jrs" EAP-Type = PEAP Called-Station-SSID = "" Packet-Src-Ip-Address-Oct1 = 139 Packet-Src-Ip-Address-Oct2 = 184 Packet-Src-Ip-Address-Oct3 = 8 Packet-Src-Ip-Address-Oct4 = 16 SS-Flags = "0100000000" NAS-Flags = "010010110000000" Supplicant-Flags = "0001000000" SQL-User-Name = "ac221(a)loopback.sussex.ac.uk" Realm = "jrs" Proxy-State = 0x313035 Going to the next request Thanks Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 8

Re: Quick question RE: FreeRADIUS Trusted Root CA List
by Cerney, Lawrence 05 Feb '08

05 Feb '08

Thanks Sebastian, Moving all the Trusted CA's into one file, as you suggested, fixed my problem. I still only use one server-cert. I have been testing with different sized user-certs signed by CA's of various sizes. That's the reason for the 8 different CA's. It would be the same if I wanted to authenticate user-certs signed by different commercial certificate vendors. Again thanks Larry To trust more than one CA, you simply have to copy all the root-certificates into one file: for example: CA_file = /etc/1x/trustedcas.pem I tested this with 3 CAs, and it works. Do you really need 8 different server-certificates? So, how should the server decide which certificate he must send the client? Sebastian -- Psssst! Schon vom neuen GMX MultiMessenger geh?rt? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger - This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee. Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately.

3 2

Error on radius
by Ackbar Joolia 05 Feb '08

05 Feb '08

Hi, I am getting this error in my radius log, do you know why this is so and how to get this resolved? 'The maximum number of threads (32) are active, cannot spawn new thread to handle request' Also, do people know what is the maximum simultaneous incoming authentication calls that the radius process can handle? Or what ways can be adopted to deal with this? Thanks Ackbar No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55

7 17