March 2008 - Freeradius-Users - lists.freeradius.org

Re: virtual server configuration
by usawebbox＠fastmail.fm 13 Mar '08

13 Mar '08

> It also says: > # If CA_file (below) is not used, then the > # certificate_file below MUST include not > # only the server certificate, but ALSO all > # of the CA certificates used to sign the > # server certificate. > > Please read ALL of the comments in a module you are configuring. > Selectively reading them means that you miss vital information. > > Alan DeKok. Except that my server cert does contain a CA cert. I'm not 100% sure it's sufficient, because it was issued from an intermediate CA (it needs to be the signer(s) not the issuer, right?), so I went to another CA got a webserver cert in pem format directly from the root. Downloaded the root CA cert in pem format and appended them.... same error: Error reading Trusted root CA list (null) Do we know this mode is working (No CA_File, but certificate file with server cert + ca cert)? In any case, I'd be willing to experiment more. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - And now for something completely different

1 0

virtual server configuration
by usawebbox＠fastmail.fm 13 Mar '08

13 Mar '08

Pardon the non-threaded replies. I'll have to find a client that works with the list. >> I'm still having trouble with the eap_gtc section, because when I remove >> TLS or empty it or try to return reject, the server won't start. Is >> removing the section the right way to not support an eap type on one >> virtual server? > > Yes. Could you post the error? I should have done that. When TLS is empty (i.e. TLS {}): rlm_eap: SSL error error:0200100E:system library:fopen:Bad address rlm_eap_tls: Error reading certificate file (null) rlm_eap: Failed to initialize type tls When TLS is removed: rlm_eap: Unable to load EAP-Type/ttls, as EAP-Type/TLS is required first. Or, if TTLS is also removed: rlm_eap: Unable to load EAP-Type/peap, as EAP-Type/TLS is required first. This makes sense, as I'll need my server cert for PEAP. If those certs have to be defined in the TLS block, what is the right way to disable TLS in this case, but still have PEAP working? I tried deleting the CA_file, so I wouldn't be able to verify user certs, but it's required. Anyway, I don't want to offer TLS and fail it, I want to NAK it on server2. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - Does exactly what it says on the tin

2 4

Include Vendor Dictionary ?
by David Toms 12 Mar '08

12 Mar '08

Hello all, I'm using freeradius 2.0.1 with mysql to authorize users for a wireless hotspot. I have a wireless router running CoovaAP firmware. I'm using Arch Linux, and everything is now working great, with ONLY ONE niggling problem remaining I have not modified the freeradius configs much. I added "VENDOR ChilliSpot 14559" to the dictionary file, which I hoped would make freeradius read the "dictionary.chillispot" dictionary. The file says "see man dictionary for the format of the dictionary files", but this man page is not installed. There is no indication in the radius log that it has read a vendor specific dictionary. When freeradius attempts to authorise a user in the appropriate group, a message: rlm_sql: Failed to create the pair: Invalid octet string "1024" for attribute name "ChilliSpot-Max-Total-Octets" is logged and the user is rejected. I am assuming that the attribute name is invalid, because the vendor specific attributes are not known to radius. I added it to the default realm in the "attrs" configuration file, but no good. So, what is wrong? How do I allow vendor specific attributes to be sent in a radius reply? Many thanks in anticipation. David

2 4

Performance and hardware
by Mikhail Novikov 12 Mar '08

12 Mar '08

Hello. I have a question about FreeRadius: RADIUS proxy server (FreeRadius) should perform 150 - 250 requests per second. Some attributes in requests have to be modified (rules is specified in hints file). OS is Debian Linux. How much memory should have the server? What the processor (in GHz) do you recommend? Best regards, Michael

2 1

Rule for don't log specific user session.
by Rafael Medici 12 Mar '08

12 Mar '08

Hello, Is there a way to don't log nothing for a specific user, creating a rule in sql_log? You will probably ask me why! Because i have a plugin running on nagios, that checks for authentication with a specific user ex: "testuser" every 5 minutes, and at the end of the day my database grows with useless information. We are a global hotspot provider, so this check running on nagios is performed in 10.000 hotspots, to test for authentication, so you could imagine that this "testuser" generates infinite registers. I think put some kind of trigger to do that, will probably slow down my server performance, because we have a huge users database. I'm running freeradius(1.1.7) + postgre. Regards, Rafael Medici

4 6

Group Membership Checking.
by David Bell 12 Mar '08

12 Mar '08

My radius.conf file has the following for Group Membership Checking # # Group membership checking. Disabled by default. # groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member= uid=%{User-Name},ou=people,dc=dxi,dc=net))" groupmembership_attribute = radiusGroupName The problem with this configuration is that if a user is a member of the group it will allow them access, even if they input the wrong password. Can someone help me with this please. Thanks David

1 0

Unsubscribe
by David W Bell 12 Mar '08

12 Mar '08

1 0

I will be giving a talk at Networkshop36 in April
by Alan DeKok 11 Mar '08

11 Mar '08

I will be giving a talk in Glasgow in April. http://www.ja.net/services/events/2008/networkshop-36.html On Wednesday: 15.00 The evolution of Free RADIUS and future developments Alan DeKok, FreeRADIUS If anyone on this list is planning on attending, look for me, or send me email. I'll also be showing up early (likely Monday), so I may have some time in advance to meet people. Alan DeKok.

2 1

Can freeRadius do that?
by Guillaume Chartrand 11 Mar '08

11 Mar '08

Hi, I just want to know if freeradius server can do what I want to deploy in my environnement. I want to deploy freeradius to taking care of security and authorization for my wireless network. What I want to do is like many hotel in my country. The user open is laptop with wireless capability, is automaticly connected to the wireless network but if he want to use the internet connection, when he first run is browser, he's automaticly redirect to an authentification page that ask him a username and a password. So is it freeradius who's handle this or another software or combination of software. Like a freeradius server and a proxy or freeradius with third party software. Can someone help me with my interrogation. Thanks a lot ---------------------------- Guillaume Chartrand Technicien informatique Cégep régional de Lanaudière Centre administratif, Repentigny (450) 470-0911 poste 7218

4 4

Help with complex redundant LDAP setup
by Capelle, Mark (PCMC-GB) 11 Mar '08

11 Mar '08

I have an LDAP setup with multiple module statements pointing to the same LDAP server, but at different OU's (referred to as sites) to get around issues due to the large tree size present. This is currently working with the following setup radiusd.conf: modules { ldap srv1-sitea { .. set_auth_type = yes } ldap srv1-siteb { .. set_auth_type = yes } } sites-available/default: authorize { srv1-sitea srv1-siteb } authenticate { Auth-Type srv1-sitea { srv1-sitea } Auth-Type srv1-siteb { srv1-siteb } } Now my goal is to make this a redundant configuration. I have duplicated my modules config, changing "srv1" to "srv2" and changing the IP address of the LDAP server. The rest of the configuration is what is fuzzy for me. I assume that my authorize section would be: authorize { redundant { srv1-sitea srv2-sitea } redundant { srv1-siteb srv2-siteb } Now the authentication part is where is becomes complicated. I don't even know where to begin with this. I tried this based on some old configs I had used in the past, but this failed miserably: authenticate { Auth-Type ldap { group { srv1-sitea { reject = 1 ok = return } srv2-siteb { reject = return ok = return } } } I read the "configurable failover" docs, but it is still not clear to me what I would need to do in this situation. I am sure there is probably an easy way to accomplish this so that for each OU ("site") it uses both LDAP servers ("srv1","srv2") in a redundant fashion, but how to do it is something I am having a heck of a time figuring out.

2 1