May 2009 - Freeradius-Users - lists.freeradius.org

radius client on fedora 10 ?
by François Mehault 13 May '09

13 May '09

Hi, I would like to know is there any radius client on fedora 10 ? pam_radius ? other ? Regards, François

2 1

IPSEC-tunnell from FreeRadius to WLC Cisco
by Saleh Abuzid 13 May '09

13 May '09

Our university college (HiST) is trying to establish an IPSec tunnel between a FreeRadius server using Openswan OpenSwan 2.4.12 and a Cisco WLC running 4.2.173.00. To start the IPSec negotiation we need RSA-keys at both ends of the tunnel ( freeradius, WLC Cisco), or Pre-shared keys (PSK). Case 1: On the Freeradius Server we two pairs of keys on the command line as follows: - Keypair for the FreeRadius-server: Freradiushost# ipsec newhostkey --hostname "FreeRadius" -output /etc/ipsec.secrets -bits 1024. - Keypair for the wlc: Freradiushost# ipsec newhostkey -hostname "wlcname" -output "RSAKeyFileName" -bits 1024 However, the WLC doesn't accept the RSA keys generated. The file produced looks like this: : RSA { # RSA 1024 bits "wlcname" etc. # for signatures only etc. #pubkey=xxxxxxx Modulus: xxxx PublicExponent: xxx #everything after this point is secret PrivateExponent: xxx Prime1: xxxx Prime2: xxxx Exponent1: xxxx Exponent2: xxxx Coefficient: xxxx } We try to paste the wlc's keys into the web interface under the menu Security, Advanced, CA Certificate, IPSec Certs. But, to no avail, the page at "ip-number of wlc" says: Error in setting Certificate". How should we generate the RSA keys in OpenSwan in order to get them into the Cisco WLC? Case 2: We have also tried to use Pre-shared keys. But alas, the Cisco WLC doesn't respond to the request from Freeradius Server. How should these PSK's be formed and what settings should be used? Any configuration examples of IPSEC on the OpenSwan, or generic explanations would be welcome as well. Shared Secret Format: ASCII Shared Secret: <same as on OpenSwan> Key Wrap: <not used> Port Number: 1812 Server Status: Enabled Support for RFC 3576 : Enabled Server Timeout: 2 seconds Network User: Enable Management: Enable IPSec Enable IPsec Parameters IPSec: HMAC SHA1 IPSEC Encryption: AES CBS (Shared Secret will be used as the Preshared Key) IKE Phase 1 Aggressive (tried main as well, with corresponding settings in OpenSwan) Lifetime (seconds) 28800 IKE Diffie Hellman Group Group 2 (1024 bits) Remarks: I would like to mention two tings: The path is open between FreeRadius server and WLC Cisco. The FreeRadius server was tested with other Linux IPSec tunnels, and this worked flawlessly. The setup of the FreeRadius is changed in each case to correspond with settings on the WLC. Looking forward to getting help from you! P.S.: It seems that IPSEC tunnels vs. WLCs is not what's easy to get help with; we've contacted several major Norwegian consulting firms with little or no response. Regards Saleh Abuzid Dept. engineer, Dept. of servers- and networks, HiST - Sor-Trondelag University College (www.hist.no <http://www.hist.no/> ) Phone: ++47 73559672 E-mail: Saleh.Abuzid(a)hist.no Saleh Abuzid Gunnerus gate 1 Høgskolen i Sør-Trøndlag (HiST) SPO-IKT Avdelingsingeniør tlf: 73559672 E-mail: Saleh.Abuzid(a)hist.no

2 1

Re: Upgrading freeradius from source
by Ming-Ching Tiew 13 May '09

13 May '09

--- On Tue, 5/12/09, John Dennis <jdennis(a)redhat.com> wrote: > > I think you'll save yourself a lot of headaches if you > stick with RPM > based packages. If the version of FreeRADIUS is not > available as an RPM > for the version of the distro you're using then you can > find > instructions for how to download, build and install the > *RPM* for a > current version here: > > http://wiki.freeradius.org/Red_Hat_FAQ > > I can't find a SOURCE RPM for 2.1.4 yet for fedora. I tried one of those 2.1.3 rpm, it works perfectly on my older fedora distro, even though it seem to indicate that they are for newer fedora. So I guess I have to wait a little longer. Regards.

4 3

FreeRadius and logwatch
by Matthieu Lazaro 13 May '09

13 May '09

Hello forum, Just wondering if someone found or had written perl scripts for logwatch so that we can send the logs all tidy?? Asking this in case I missed something or if someone had this in it's drawer! I'm going to post this as well to the logwatch mailing. Best regards, Matt

1 1

Re: Upgrading freeradius from source
by Ming-Ching Tiew 13 May '09

13 May '09

--- On Wed, 5/13/09, Ivan Kalik <tnt(a)kalik.net> wrote: > From: Ivan Kalik <tnt(a)kalik.net> > Subject: Re: Upgrading freeradius from source > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Date: Wednesday, May 13, 2009, 9:06 AM > 2.1.4/2.1.5 release had identity > crises. 2.1.8. will be available in > matter of days. It's on pre-release testing. > > Catching up with releases is always a never ending game, and each version can take up a lot of resources to prove to be stable for production use. Are there major defects with 2.1.4 which resulting in quick subsequent new releases ? Regards.

1 0

Date/Time inside the log file in each request
by Selcuk COSAN 13 May '09

13 May '09

> Hi > > We are running FreeRADIUS Version 2.1.5 using "radiusd -xx" command. > Is it possible to make date/time written into radius.log file without using -X parameter in each request line? > Because " -X " points " -sfxx " and we do not want to use -s parameter. > > Thanks > > > Selcuk COSAN >

2 1

Re: Add users without restarting radiusd
by ournixnation＠gmail.com 12 May '09

12 May '09

I am fairly new to radius and would like to know if you could explain how I would go about this: "In 2.1.x, you can HUP the server, and it will reload the users file."

2 2

Add users without restarting radiusd
by ournixnation＠gmail.com 12 May '09

12 May '09

Is there a way to add entries to or modify the users file in /etc/raddb without having to restart radiusd to apply the changes?

2 1

Upgrading freeradius from source
by mctiew＠yahoo.com 12 May '09

12 May '09

I have done some testing on 2.1.4 and I like the flexibility comparing to 1.x. Unfortunately, I am using for production a pretty old distribution 1.1.7. For such an old distro, it's almost impossible to do an upgrade and still maintaining the rpm package info and what not, so I am considering upgrading by compiling from source, ie configure and make install. Any thing I should consider before I have go down to this path ? Cheers.

3 2

how to define ACL like things in RADIUS
by Parashar Singh 12 May '09

12 May '09

Hi I have configure Radius server with LDAP authentication, for performing AAA for Cisco Routers and Firwalls. Currently all users created in LDAP are getting equal priviledge of accessing all devices (NAS) configured with AAA. I want to allow a set of users to let access some devices (say only few routers) while to allow other set of users with access permission of all devices (including Routers and Firwalls). I am aware of following: root Auth-Type := Accept Reply-Message = "Your account has been disabled." which deny all access to user root. But I want some modification, i.e. root user will able to authenticate to only two NAS, 192.168.1.178 & 192.168.1.179. Pls suggest some solution. Please guide me and help me to implement above scenario. Thanks

2 1