July 2009 - Freeradius-Users - lists.freeradius.org

wpa2-psk and radiusd possible?
by Stefan Jensen 17 Jul '09

17 Jul '09

Hi,... i'm pretty new to radiusd, so this may be a dump question. :-) Is it possible to use something like MAC-based WPA2-PSK's to- gether with radiusd? I have used a single "hostapd" installation as AP, configured with unique WPA2-PSK's for each MAC-Addr that should have access. (which prevents trading the PSK) Now i want extend our network with a couple of Linksys Router, so I've installed radiusd and got EAP,PEAP,802.1X to work so far. But my users find it complicated to mess around with the Certs, so i decided to use the same PSK on all NAS-Clients (dd-wrt) and only doing MAC-Auth with radiusd. Is there a way to have different PSK's for every MAC? I bed, it is not a job for radius and maybe a complete wrong concept? best regards stefan PS: sorry for bad english ;-) -- Stefan Jensen <sjensen(a)versanet.de>

2 3

(SOLVED) XP3 EAP-TLS was Re: HELP! EAP-TLS: how can I install a cert on a workstation so that it works for all users
by john 16 Jul '09

16 Jul '09

On Thu, Jul 16, 2009 at 8:12 AM, Nicolas Boullis<nicolas.boullis(a)ecp.fr> wrote: > Hi, > > DISCLAIMER: I'm no Windows specialist. > > john wrote: >> >> I am having a hard time figuring out how to make this work. Where/how >> does the cert get imported. Do I need to make a registry change in >> KEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General\Global >> to make this work? I hope this is the part someone on the list will >> have done before and be able to guide me or point me at a howto. > > I had a hard time with this as well, and finally succeeded, using > Windows XP. > There are many points that matter: > * You have to edit your registry to add a "AuthMode" dword key in > KEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General\Global > with value 2. > * You have to load your certificate and private key in the computer's > personal store. I did that with mmc.exe. Note that loading the > certificate and private key in a user's personal store and then > moving them to the computer's store did not work for me. > * Your certificate must have "X509v3 Extended Key Usage: TLS Web Client > Authentication" or Windows won't use it. > * The username Windows will use is the name in the certificate with > "host/" prepended. > > Note that things are quite different with Windows Vista. > > Hope this helps, > > -- > Nicolas Boullis > Ecole Centrale Paris Thanks for your very thorough answer Nicolas! The solution you outline works perfectly for wired clients running Windows XP SP2. However,more digging showed me that my problem was specific to Windows XP/SP3. Windows XP/SP3 doesn't use KEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters\General\Global to store the value for the AuthMode parameter. Rather it uses an XML profile which you can export and edit and then re-import. For future reference for other folks this can be round here http://support.microsoft.com/kb/929847 I note that this was mentioned in an earlier post to the list http://lists.cistron.nl/pipermail/freeradius-users/2009-January/msg00723.ht… The author then had an identical problem, however he was trying to troubleshoot the wireless interface. Ivan or Alan, the information that Nicolas outlined, plus the caveat for XP3 clients would be REALLY HELPFUL to have on the wiki. It doesn't look like just anyone can edit it so would one of you be willing to add something? Thanks again to all for the help! John

1 0

HELP! EAP-TLS: how can I install a cert on a workstation so that it works for all users
by john 16 Jul '09

16 Jul '09

Hi all, I can't find this information anywhere. I have looked for days. Can I create a client cert for a computer so that any user that logs in may use it automatically under Windows XP? I have successfully created a client.p12 with the FQDN of the workstation I am using, installed it and been authenticated by Freeradius. However when I log in to the computer under a different windows profile authentication fails. How should I create this file and where do I place this cert so that it's available for any user logging on? Please help me figure this out! Thanks! John

5 8

radiusd start problem
by K bharathan 16 Jul '09

16 Jul '09

i'm newbie to freeradius installed freeradius server 2.1 on opensuse 11.1 when i run radiusd -X i get the following error: unable to write 'random state' dh: Permission denied make: *** [dh] Error 1 Exec-Program output: openssl dhparam -out dh 1024 Exec-Program-Wait: plaintext: openssl dhparam -out dh 1024 Exec-Program: returned: 2 rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } the rights for radiusd are as follows: drwxr-x--- 7 root radiusd 4096 Jul 16 18:10 . drwxr-xr-x 107 root root 12288 Jul 16 18:18 .. -rw-r----- 1 root radiusd 671 Dec 3 2008 acct_users -rw-r----- 1 root radiusd 4174 Dec 3 2008 attrs -rw-r----- 1 root radiusd 458 Dec 3 2008 attrs.access_reject -rw-r----- 1 root radiusd 437 Dec 3 2008 attrs.accounting_response -rw-r----- 1 root radiusd 2022 Dec 3 2008 attrs.pre-proxy drwxr-x--- 2 root radiusd 4096 Jul 16 18:10 certs -rw-r----- 1 root radiusd 6462 Dec 3 2008 clients.conf -rw-r----- 1 root radiusd 877 Dec 3 2008 dictionary -rw-r----- 1 root radiusd 14903 Dec 3 2008 eap.conf -r-xr-xr-x 1 root radiusd 14898 Jul 16 17:38 eap.conf.rpmsave -rw-r----- 1 root radiusd 4609 Dec 3 2008 example.pl -rw-r----- 1 root radiusd 14479 Dec 3 2008 experimental.conf -rw-r----- 1 root radiusd 2352 Dec 3 2008 hints -rw-r----- 1 root radiusd 1604 Dec 3 2008 huntgroups -rw-r----- 1 root radiusd 3017 Dec 3 2008 ldap.attrmap drwxr-x--- 2 root radiusd 4096 Jul 16 18:10 modules -rw-r----- 1 root radiusd 3357 Dec 3 2008 otp.conf -rw-r----- 1 root radiusd 1154 Dec 3 2008 policy.conf -rw-r----- 1 root radiusd 4873 Dec 3 2008 policy.txt -rw-r----- 1 root radiusd 984 Dec 3 2008 preproxy_users -rw-r----- 1 root radiusd 22839 Dec 3 2008 proxy.conf -rw-r----- 1 root radiusd 26077 Dec 3 2008 radiusd.conf drwxr-x--- 2 root radiusd 4096 Jul 16 18:10 sites-available drwxr-x--- 2 root radiusd 4096 Jul 16 18:10 sites-enabled drwxr-x--- 6 root radiusd 4096 Jul 16 18:10 sql -rw-r----- 1 root radiusd 2499 Dec 3 2008 sql.conf -rw-r----- 1 root radiusd 1933 Dec 3 2008 sqlippool.conf -rw-r----- 1 root radiusd 3450 Dec 3 2008 templates.conf -rw-r----- 1 root radiusd 6524 Dec 3 2008 users guidance appreciated

2 1

Re: How to reject when a user logs in without realm?
by Navin 16 Jul '09

16 Jul '09

At 08:00 PM 7/15/2009, you wrote: > > Hope you are referring to > > realm freescale.com { > > type = radius > > authhost = LOCAL > > accthost = LOCAL > > > > present in the radiusd.conf file. removed it. Restarted the freeradius > > server. > > > > The user file contains > > navin(a)freescale.com Cleartext-Password := "navin123" > > > > Even then when tested with radtest tool , the users "navin" & > > "navin(a)freescale.com" > > are both getting authenticated. I would prefer only > > navin(a)freescale.com get authenticated > > and user "navin" should get rejected. > >There is something else there then as well. Post the debug for navin. You >can probably safely disable suffix as well. But lets first see what is >stripping the username. There is nothing in the default configuration that >does that. Navin wrote: Thanks for suggesting the debug option. What probably happening was, the users file by default is configured to look into unix password database (/etc/passwd), And it so happens, that my machine has the same user and userpasswd as the radius access request info. Hence the login for "navin" as well as "navin(a)freescale.com" was getting authenticated. users file snippet of unix password database: # # First setup all accounts to be checked against the UNIX /etc/passwd. # (Unless a password was already given earlier in this file). # DEFAULT Auth-Type = System Fall-Through = 1 The debug option helped to see that i was hitting the above lines when i logged in as "navin". Thanks. have a nice day, navin >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

radtest for accounting
by Rakotomandimby Mihamina 16 Jul '09

16 Jul '09

Hi all, radtest alows me to bascally test account (login, pass,...). I would like to test the logout process now: what radtest friend is the one to use? Thank you. PS: I need it because at logout I have to process the remaining credit of the user. -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 1

question about freeradius vs AA(ldap) and A(mysql)
by Tony P. 16 Jul '09

16 Jul '09

hi, i have freeradius server over Debian Etch version FreeRADIUS Version 1.1.3 and making Accounting with MySQL radius DB. I want to make new form to authenticate my users to not have 2 password databases separated... so.. need auth ldap and account into mysql.. I test to make authorization + authentication with Ldap and keep going making Accounting into MySQL... and works but just basic mode. My question is how can i change the usergroup, radgroupcheck, radgroupreply, tables into Ldap to authorization-authentication step, with more options to check like Calling-Station-Id, Called-Station-Id, Hint, Groupnames, etc etc??? And in the schema of freeradius into Ldap, i load scheme but when i try to add new attribute to user like (option in the radiusd.conf) access_attr = "dialupAccess" what i type in the value?? .. just know "string" by the scheme explain but don't know that string exactly it is.... can help me any one..??? thanxs and regards and sorry by my english Tony

2 2

Info regarding Radius and Ipv6
by Vamsi Krishna Valiveti 16 Jul '09

16 Jul '09

Hi , Please let me know 1) Whether there Radius Server (Linux / Windows) is available with IPv6 support. 2) Whether Radius Server is available which listens on IPv6 address. Rgds, Vamsi ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error,please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 2

./configure
by shivashankar 16 Jul '09

16 Jul '09

hi all, this is shiva shankar. when i am isntalling freeradius-server-2.1.6 on solaris10. it is showing some warnings. plz help me out how to remove those warining miboss3:root$./configure >log.txt configure: WARNING: snmpget not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: snmpwalk not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: pcap library not found, silently disabling the RADIUS sniffer. config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting configure: WARNING: silently not building rlm_counter. configure: WARNING: FAILURE: rlm_counter requires: libgdbm. configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: silently not building rlm_eap_peap. configure: WARNING: FAILURE: rlm_eap_peap requires: OpenSSL. configure: WARNING: silently not building rlm_eap_tls. configure: WARNING: FAILURE: rlm_eap_tls requires: OpenSSL. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_eap_ttls. configure: WARNING: FAILURE: rlm_eap_ttls requires: OpenSSL. configure: WARNING: silently not building rlm_ippool. configure: WARNING: FAILURE: rlm_ippool requires: libgdbm. configure: WARNING: neither krb5 'k5crypto' nor 'crypto' libraries are found! configure: WARNING: the comm_err library isn't found! configure: WARNING: silently not building rlm_krb5. configure: WARNING: FAILURE: rlm_krb5 requires: krb5.h. configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-libs openssl-includes openssl-includes openssl-includes openssl-includes openssl-includes. configure: WARNING: silently not building rlm_perl. configure: WARNING: FAILURE: rlm_perl requires: EXTERN.h perl.h libperl.so. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: MySQL libraries not found. Use --with-mysql-lib-dir=<path>. configure: WARNING: silently not building rlm_sql_mysql. configure: WARNING: FAILURE: rlm_sql_mysql requires: libmysqlclient_r. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. i set path like this /usr/sbin :/usr/bin: /usr/local/bin :/usr/local/ssl/bin: /usr/ccs/bin :/usr/sfw/bin plz help me out.it is orgent for me. thax for advance -- View this message in context: http://www.nabble.com/.-configure-tp24497117p24497117.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 12

make install without messing with previous configuration?
by Stefan Winter 16 Jul '09

16 Jul '09

Hello, I wonder if there's a way to install FreeRADIUS, but *not* have it install config files in its raddb dir. The reason being that if you have a previous version and a well-shepherded config directory with only exactly the needed files, a "make install" will clutter your raddb dir with default files. You can delete the unnecessary files afterwards for sure, but it would be preferable if raddb could remain untouched on request. I even had one instance where I got bitten by it: a server didn't have a sites-enabled/default. "make install" during an upgrade helpfully created it with a set of module calls in it which weren't configured. As a result, the server refused to start afterwards until the "default" server was deleted. So, is there some kind of "make install-no-config", "./configure --no-touch-raddb" or similar? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

6 11