June 2008 - Freeradius-Users - lists.freeradius.org

help EAP-TNC
by fbernal＠um.es 20 Jun '08

20 Jun '08

Hi all, I'm working in setting up a basic scenario which involves 3 components: a client using Xsupplicant a AP making use of hostapd and a Radius server using FreeRadius ;). I'm trying to probe the EAP-TNC method but i have received this message from the FreeRadius server: rlm_eap: ERROR: EAP-TNC must be run inside of a TLS method. I've configured EAP-TLS and this method alone it is working properly. So when I put in configuration file --> default_eap_method = tnc FreeRadius shows the message before. I think that in some way TLS must be configured or something to transport EAP-TNC, ok? (is possible to do this?) is posible test EAP-TNC with the current version of FreeRadius? Regards, Fernando.

3 3

FreeRADIUS + DHCP
by Raja 20 Jun '08

20 Jun '08

Can someone point me in the right direction to configure FreeRADIUS with DHCP ? Tried editing sites-available/dhcp but still dhcp module does not get to load. Is there something need to be added to radiusd.conf ? Thanks Raja

3 5

Question regarding eapclient
by pallavi dharmadhikari 20 Jun '08

20 Jun '08

Hi I am trying to test the eapclient on Fedora. When I type this command radeapclient -x localhost 1812 testing, and started the freeradius server to accept the packets from eapclient, the eapclient window gets hanged and nothing happens. Other question that I have is that, if we have to write a EAP-MD5 client , do we need to modify the original server settings ? If yes, then what are they? Thanks in advance -- Regards Pal

2 3

FreeRADIUS 2.0.5 Debian dpkg-buildpackage error
by Giovanni Lovato 19 Jun '08

19 Jun '08

# dpkg-buildpackage -b -uc dpkg-buildpackage: source package is freeradius dpkg-buildpackage: source version is 2.0.5-0 dpkg-buildpackage: source changed by Alan DeKok <aland(a)freeradius.org> dpkg-buildpackage: host architecture i386 dpkg-buildpackage: source version without epoch 2.0.5-0 debian/rules clean dpatch deapply-all 02-dialupadmin-help not applied to ./ . 01-radiusd-to-freeradius not applied to ./ . rm -rf patch-stamp patch-stampT debian/patched dh_testdir dh_clean rm -f build-arch-stamp build-indep-stamp libltdl/stamp-h1 rm -f install-arch-stamp install-indep-stamp configure-stamp [ -f Make.inc ] && make distclean || true # The make clean forgets to remove this build directory [ -d src/modules/lib ] && rm -fr src/modules/lib || true # Put the original autotools files back in place [ -f config.sub.dist ] && rm config.sub && mv config.sub.dist config.sub || true [ -f config.guess.dist ] && rm config.guess && mv config.guess.dist config.guess || true debian/rules build test -d debian/patched || install -d debian/patched dpatch apply-all applying patch 01-radiusd-to-freeradius to ./ ... failed. make: *** [patch-stamp] Error 1

4 5

No authentication method (AUth Type) problem.
by Andy An 19 Jun '08

19 Jun '08

Hi: I am a new guy to deal with freeradius/wireless stuff. I use freeradius 2.0.5 with LDAP back end. If I test with radtest (localhost) or with NTRadPing (from another WINXP machine)it works fine(return Access-Accept). But if I test with MAC Airport as a client and Netgear WG 302 as a AP it fails again and agian no matter how I adjust the configuration file around (e.g. eap.conf, sites-eabled/ldap, radiusd.conf etc.) Thanks in advance for any help/clue/guide. P.S. -----------Mac client settings: 802.1x enabled with PEAP(outer identity: none) and TTLS(inner auth: mschapv2 outer identity: none) Security: WPA enterprise -----------Netgear WG302 settings: Security: WPA with radius Data encrypt: TKIP+AES Auth server port: 1812 Acc server port: 1813 ----------- the info cut from the radiusd.-X output: rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user andyan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user *(It might be problematic from here)* auth: Failed to validate the user. TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> andyan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 23 to 10.10.10.228 port 1059 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5. Going to the next request ----------------- --

4 3

LDAP PASSWORD HASH
by Eduardo Cavalcanti 19 Jun '08

19 Jun '08

I use freeradius 2.0.2 with PEAP and MSCHAPv2 for authentication. I want to authenticate on LDAP database, but these protocols only read clear-text or hashes of the passwords on LDAP database. My question is: how do I make hashes of the passwords stored on LDAP?? Can I use SHA-256 for hashing??? Grateful, Eduardo.

2 4

SQL failover
by Roy Kartadinata 19 Jun '08

19 Jun '08

Hello, We currently in a process of upgrading our current radius server to the most current one (thanks Alan) and I found a section on the wiki that talks about SQL failover. Interesting enough, our SQL servers are in master master mode so that it will replicate each other. Can I use the same setup for accounting as well or it will work just for authentication? Is there a page within the wiki or a document that explain what each line within the group being used for? Cheers, Roy Kartadinata Pocket Communications Email: rkartadinata(a)pocket.com Phone: 210-858-2559

2 1

how can i update radacct_old?
by Jose Maira Iranzo Marin 19 Jun '08

19 Jun '08

I need a radacct_old table mounthly update and clean radacct. Radacct_old, and radacct_summary are original table? No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.4.0/1509 - Release Date: 19/06/2008 8:00

2 1

Server failover like dhcp?
by Piero Giobbi 19 Jun '08

19 Jun '08

Hi. I just installed two dhcp 4 server with failover and it works great. So great that i want the same for my freeradius server, so i look at the wikis. As for what i can figure out there's only a module config (sql) for failover? Didn't find anything in the FAQs either. Im not using SQL, only files (yes will make it happend when i have the time : )), is the failover only possible in SQL? What i would like to accomplish is this, if server primary explodes the secondary takes over, just like dhcp. Regards p

2 1

Re: Freeradius-Users Digest, Vol 38, Issue 32
by Piero Giobbi 19 Jun '08

19 Jun '08

Hi all. Just for the record if anyone else has Fedora 8 problem; upgrade to 9 (yum install preupgrade) and freeradius 2 will compile beautifully.. : ) p > Hi Alan. > > Hers's my version: > > OpenSSL> version > OpenSSL 0.9.8g 19 Oct 2007 > OpenSSL> > > > p > > > 7 jun 2008 kl. 12.00 skrev freeradius-users-request(a)lists.freeradius.org > : > >> Send Freeradius-Users mailing list submissions to >> freeradius-users(a)lists.freeradius.org >> >> To subscribe or unsubscribe via the World Wide Web, visit >> http://lists.freeradius.org/mailman/listinfo/freeradius-users >> or, via email, send a message with subject or body 'help' to >> freeradius-users-request(a)lists.freeradius.org >> >> You can reach the person managing the list at >> freeradius-users-owner(a)lists.freeradius.org >> >> When replying, please edit your Subject line so it is more specific >> than "Re: Contents of Freeradius-Users digest..." >> Today's Topics: >> >> 1. Re: Problems compiling Freeradius 2.0.4 on Fedora 8. >> (A.L.M.Buxey(a)lboro.ac.uk) >> 2. Re: logging of tls logons (Vladimir Vassiliev) >> >> Från: A.L.M.Buxey(a)lboro.ac.uk >> Datum: lö 7 jun 2008 09.40.22 GMT+02:00 >> Till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org >> > >> Ämne: Re: Problems compiling Freeradius 2.0.4 on Fedora 8. >> Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org >> > >> >> >> hi, >> >> what version of OpenSSL do you have? >> >> alan >> >> >> >> >> Från: Vladimir Vassiliev <vova(a)edu.yar.ru> >> Datum: lö 7 jun 2008 09.54.16 GMT+02:00 >> Till: freeradius-users(a)lists.freeradius.org >> Ämne: Re: logging of tls logons >> Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org >> > >> >> >>> So, how can I get in logs exactly common names? >> >> As I understand, only way to do it is >> >> check_cert_cn = %{User-Name} >> >> in eap.conf? >> >> -- >> Vladimir Vassiliev <vova(a)edu.yar.ru> >> >> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0