January 2009 - Freeradius-Users - lists.freeradius.org

Certificate Provisioning for EAP-TLS Networks
by Matt Causey 03 Feb '09

03 Feb '09

I am running FreeRadius at my company on a WLAN - using SSL key material issued by our internal certificate authority. All is well. However a pretty big limitation of this security architecture is of course getting the SSL key material onto the devices. In our case - the devices are SIP phones with no wired ethernet connection. I know there are other sites with similar issues. I would like to hear some ideas on what folks are doing to manage SSL key material on devices. This would include initial key provisioning and re-keying when certs expire. Presently ours expire every 90 days. Thoughts? -- Matt

4 6

chap authentication and freeradius
by gf fg 02 Feb '09

02 Feb '09

Hi Freeradius users! I have installed Freeradius and diualup admin and mysql I configurated the both ! I have an an aplication called vyatta. I am trying that this vyatta validate the users with the freeradius I configurated in the admin.conf with chap and clear-password and i set that the password are store in clear in the database too. But when i try to login with a user that uses chap authentiation! the freeradius told me that need claer password! what is worng ??? Someone can help me to configurate Freeradius , dialup admin and mysql with chap authentication ?? _________________________________________________________________ Permanece actualizado con MSN Noticias. Clic aquí http://noticias.cl.msn.com/

4 17

IP-Assignment with sqlippool based on nas-ip-address
by Sebastian Heil 02 Feb '09

02 Feb '09

Hello, we are using freeradius 2.1.1 on suse linux enterprise server 10. We have different Network Access Servers, which are located in different locations. The users, which login to this NAS, will be assigned an ip-address by the sqlippool-module. I read a lot of the documentation and tried a lot of different things, but i don't know, how to configure the sqlippool-module to assign an ipaddress based on the nas, on the which the users logs in. So for example, if the users logs in on nas1, he will get an ip out of the pool 10.1.1.1 - 10.1.10.255, if he logs in on nas2, he will get an ip out of the pool 10.200.1.1 - 10.200.10.255. The authentication information and the ippoolinformation will be stored in mysql. Can you give me an example where i have to configure this? Thanks. Sebastian -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger

3 19

feature request
by Hans-Peter Fuchs 02 Feb '09

02 Feb '09

Hello Alan, today I upgraded from freeradius-2.1.1 to 2.1.3 and stumbled because freeradius does not erase the socket file in /var/run/radiusd. -- Mit freundlichen Grüßen Hans-Peter Fuchs Hans-Peter Fuchs - RRZK Zimmer 20 Zentrum für angewandte Informatik - Universitätsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

2 3

reply message to rejected users
by Alex M 30 Jan '09

30 Jan '09

i'm trying to display reply message to users whos passwords get rejected. so I setup the group and added my test user there. then i went to groupreply table and added reply message there. Now when I do my testing is password is ok the message is displayed BUT if password is incorrect the message is not displayed. I'm sure i did something wrong. So the question is: how do i display message to the user if their username gets rejected by any reason? thanks for help!

2 2

Access based on eDirectory and Accounting
by Martin Potgieter 30 Jan '09

30 Jan '09

Hello list, I am looking for a solution that will allow a captive portal to authenticate against eDirectory but also check the accounting database to ensure a user has not exceeded their bandwidth allocation. I would prefer not to import the eDirectory users into a SQL database but rather keep the actual users in eDirectory but I am not sure if Freeradius can authenticate off of eDirectory and also check accounting information in a SQL db before allowing access. I have used a pure SQL backend and it worked great but need advise on the above. Can anyone tell me if this would require source hacking or if this is a straight forward configuration. And if anyone knows of a web management front end for Freeradius besides the following that I have already looked at, that would be great: Dialup Admin, ARA and Radius Manager. Commercial solutions aswell. Thanks, Martin

2 3

rlm_sql errors
by qrt 30 Jan '09

30 Jan '09

Hi everyone, I use freeradius (FreeRADIUS Version 1.1.4, with security changes through 1.1.7, for host apple.com, built on Sep 23 2007 at 22:52:08) on Mac OS X Server 10.5.6. My problem is that I get messages that I do not understand in the log file It looks like this: > Thu Jan 29 16:10:41 2009 : Auth: rlm_opendirectory: User > <vorname_nachname> is authorized. > Thu Jan 29 16:10:41 2009 : Auth: Login OK: [vorname_nachname/<no > User-Password attribute>] (from client Cisco 4402 port 29 cli 00-17- > F2-E8-74-76) > Thu Jan 29 16:10:42 2009 : Info: rlm_sql_sqlite: Opening sqlite > database for #1 > Thu Jan 29 16:10:42 2009 : Info: rlm_sql_sqlite: sqlite3_open() = 0 > Thu Jan 29 16:10:42 2009 : Error: rlm_sql (sql): failed after re- > connect > Thu Jan 29 16:10:42 2009 : Error: rlm_sql (sql): Couldn't update SQL > accounting ALIVE record - (null) > Thu Jan 29 16:10:48 2009 : Info: rlm_sql_sqlite: Opening sqlite > database for #0 > Thu Jan 29 16:10:48 2009 : Info: rlm_sql_sqlite: sqlite3_open() = 0 > Thu Jan 29 16:10:48 2009 : Error: rlm_sql (sql): failed after re- > connect > Thu Jan 29 16:10:48 2009 : Error: rlm_sql (sql): Couldn't update SQL > accounting ALIVE record - (null) > Thu Jan 29 16:13:44 2009 : Error: rlm_radutmp: Logout entry for NAS > Cisco 4402 port 29 has wrong ID > Thu Jan 29 16:13:44 2009 : Info: rlm_sql_sqlite: Opening sqlite > database for #4 > Thu Jan 29 16:13:44 2009 : Info: rlm_sql_sqlite: sqlite3_open() = 0 > Thu Jan 29 16:13:44 2009 : Error: rlm_sql (sql): failed after re- > connect > Thu Jan 29 16:13:44 2009 : Error: rlm_sql (sql): Couldn't update SQL > accounting STOP record - (null) > Thu Jan 29 16:13:50 2009 : Error: rlm_radutmp: Logout entry for NAS > Cisco 4402 port 29 has wrong ID > Thu Jan 29 16:13:50 2009 : Info: rlm_sql_sqlite: Opening sqlite > database for #3 > Thu Jan 29 16:13:50 2009 : Info: rlm_sql_sqlite: sqlite3_open() = 0 > Thu Jan 29 16:13:50 2009 : Error: rlm_sql (sql): failed after re- > connect > Thu Jan 29 16:13:50 2009 : Error: rlm_sql (sql): Couldn't update SQL > accounting STOP record - (null) > Could someone please tell me what this means? What consequences does this have? What can I do to make this baby running right? Thanks Qrt

3 2

what is this ?
by Freeradius Mail List 30 Jan '09

30 Jan '09

Have some error in freeradius log: Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:55 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:57 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:57 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:57 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Fri Jan 30 03:32:57 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Can anybody talk what is this ? What is the reason and how to solve ? Thx.

1 1

attribute filter prior to prxy
by Alexandre Chapellon 29 Jan '09

29 Jan '09

Hello, I want to remove all attributes from packets to proxy except some of them i do say are allowed... I thought the following would do the job in the pre-proxy section, but when i check what the freeradius proxies (using tcpdump) i see the filter.... just filters nothing DEFAULT Acct-Status-Type =* ANY, User-Name =* ANY, Framed-IP-Address =* ANY, Qos-Policy-Metering =* ANY, Ip_Address_Pool_Name =* ANY, Class =* ANY

1 1

802.1x machine authentication ads peap domainname
by orzeh 29 Jan '09

29 Jan '09

hello for all! I've configured freeradius to work with 802.x connection, everything working well but rlm_mschap expanding user name and domain "host/host123.domain.com" to: username -> host123$ domain -> domain (without .com) in ntlm_auth i have no correct domain name (without .com) so i've added domainname directly to command line. is there better solution to expand full domain name by mschap? thanks! Lukasz

2 8