October 2009 - Freeradius-Users - lists.freeradius.org

Re: Stripping windows domain with dot1x and peap
by Gary Gatten 01 Oct '09

01 Oct '09

It would break EAP? If I enter my own creds and leave the Domain null it works great.... ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thu Oct 01 03:39:34 2009 Subject: Re: Stripping windows domain with dot1x and peap > I'm back on this issue again. 2.1.6 on FBSD and RHEL. When doing 8021x > auth using winblows xp supplicant (wired) and the setting "use my windows > username and password", I can't seem to get FR to strip the domain name. Good. Because that would break EAP. > I have the nt hack enabled in a couple places. Also read about using > "realms" modules instead of enabling nt hack. Tried both as well as a > couple different "--username" tweaks to no avail. > > Can someone point me in the right direction? I tried playing eap, mschap, > default, innertunnel, etc. Use ntdomain. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

(no subject)
by jon jon 01 Oct '09

01 Oct '09

Hi, I was wondering where to look in free radius, for something that is kicking the wireless clients off at a certain time. I have a backend mysql database that allows the clients certain times to login from. Where would the file be located that is telling the free radius server that there time is up and boot them off? thanks

2 2

EAPTLS Stress test: 2.1.7
by leopold 01 Oct '09

01 Oct '09

Hi, We tried to stress test (EAPTLS) FreeRADIUS 2.1.7 which sits behind Load Balancer We had 2 FreeRADIUS servers behind load balancer (R1,R2) Some requests got rejected (Access-Reject was sent) and the log showed Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Now we understand that if EAPTLS session started (we have 10 Access-Challenge messages because of our certificate chain) against Radius_1 and then continued to Radius_2 because load balancer reverted it there then EAPTLS handshake cannot succeed, but we expected that FreeRADIUS should drop packets and NOT RESPOND instead of sending Access-Reject when it cannot find STATE variable By looking at the code we think eap_tls module returns RLM_MODULE_INVALID or RLM_MODULE_FAIL when it cannot find EAP session in the tree. What is proper configuration that we can do? Is something like this recommended? authorize { .. eap { ok = return updated = return handled = return } if (invalid) { do_not_respond } # if we reach here then Auth-Type != EAP .. } Thanks you for your response -- View this message in context: http://www.nabble.com/EAPTLS-Stress-test%3A-2.1.7-tp25686662p25686662.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

FreeRADIUS with 2 certs/CAs etc
by Alan Buxey 01 Oct '09

01 Oct '09

hi, in the UK I deal with various questions regarding FreeRADIUS configuration and abilities - occasionally a question pops up that I'm very unfamilar with or havent got a direct clue to answer.. today one of those reemerged and as this might affect anyone at any point I was looking for best practice or a methodology. Say you have a nice FR setup...all is going well and everything is fine but then you have an issue with the certificate - eg its going to expire , or its been revoked...then you are going to have to have a new certificate for your FR server - but your clients will have the old certificate and CA - and your new clients will have the new cert and CA..and you might not be able to sort out all your clients for some time - hopefully before the final day of cert validity! anyway, in summary, your RADIUS server has to answer to the old clients and the new clients. What is the best practice way or configuration to ensure that your RADIUS server can be both people...old servercert+old_CA and new servertcert+new_CA so that it can deal with both types of clients. I'm thinking 2 virtual servers....one with old eap.conf and the other with neweap.conf with each virtual server ready to deal with each type of client - but then how to direct the incoming EAP to the right way. I cant see the normal fall-through group working --because the client has to create the EAP tunnel... or would a normal fallthrough system work... we send it to eap1 and if it fails send it to eap2 (which should be okay if client config okay!) ? I can envisage fronting it with a.n.other RADIUS solution which will proxy the request through a remote server list UNTIL it doesnt get a REJECT back.. but i dont want additional software in the mix thanks alan

4 6

Re: Stripping windows domain with dot1x and peap
by Ivan Kalik 01 Oct '09

01 Oct '09

> I'm back on this issue again. 2.1.6 on FBSD and RHEL. When doing 8021x > auth using winblows xp supplicant (wired) and the setting "use my windows > username and password", I can't seem to get FR to strip the domain name. Good. Because that would break EAP. > I have the nt hack enabled in a couple places. Also read about using > "realms" modules instead of enabling nt hack. Tried both as well as a > couple different "--username" tweaks to no avail. > > Can someone point me in the right direction? I tried playing eap, mschap, > default, innertunnel, etc. Use ntdomain. Ivan Kalik Kalik Informatika ISP

1 0

Stripping windows domain with dot1x and peap
by Gary Gatten 01 Oct '09

01 Oct '09

Hello, I'm back on this issue again. 2.1.6 on FBSD and RHEL. When doing 8021x auth using winblows xp supplicant (wired) and the setting "use my windows username and password", I can't seem to get FR to strip the domain name. I have the nt hack enabled in a couple places. Also read about using "realms" modules instead of enabling nt hack. Tried both as well as a couple different "--username" tweaks to no avail. Can someone point me in the right direction? I tried playing eap, mschap, default, innertunnel, etc. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 1

Problem with radzap
by Pierre-henri Baraffe 01 Oct '09

01 Oct '09

Hello, I have a mistake with my freeradius. On server with 1.1.7 the command : "radzap -u username -P port-nas 127.0.0.1 secret" work with no problem On a new server with FR 2.0.5, with the same command i have this error radclient:: failed to get value I have no more message with the "-x" option and nothing in the log. I have the same things if i replace "127.0.0.1" by "localhost" my client.conf client localhost { ipaddr = 127.0.0.1 secret = secret require_message_authenticator = no shortname = localhost nastype = other # localhost isn't usually a NAS... } I don't understand. Thanks for your help. ph

3 3