September 2009 - Freeradius-Users - lists.freeradius.org

Re: Re: Configuration for md5 not working
by David Mitton 17 Sep '09

17 Sep '09

From: From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Sep 17, 2009 04:28:13 AM, freeradius-users(a)lists.freeradius.org wrote: >Hi, > >> I have everything configured for md5 authentication so that I do not need to >> use either server or client-side certificates. I have my access points >> configured in /etc/raddb/clients.conf and my users configured in >> /etc/raddb/users >> >>>> > My access point is set to WPA Enterprise security using a RADIUS server. > >cool. last time i checked you couldnt use MD5 as a method for wireless 802.1X >- there are only certain EAP types that can be used - PEAP, EAP-TLS, EAP-TTLS >etc being some of them. Microsoft has disabled MD5 in recent releases. If you really want to use it, you have to figure out how to reenable it. You can, but that's an exercise for the reader. For WPA wireless encryption, you must use an EAP method that generates encryption keys. MD5 does not. Neither does GTC. If you need to use clear text passwords, the "fix" is to run the method inside of PEAP or TTLS, which will generate keys and protect your passwords in the air. > MD5 is fine for wired because - ha ha - wired 802.1X >is a bit of a joke really - all it does is authenticate you, there is no Um, I don't get the "joke"? How is that different than normal NAS PPP dial-up access that RADIUS was originally designed for? Most people using wired 802.1X only need network access control. Wireless is the special case here. And the encryption only covers the connection between the station and the access point. If you want to protect your data on a physical wire, use a VPN or IPSEC. Dave Mitton. >link layer encryption going on - unlike WPA Enterprise wireless - which all gets >encapsulated in an EAP tunnel - hence you need specific types of EAP for wifi >... >alan

3 2

Support
by Gary Gatten 17 Sep '09

17 Sep '09

Hi Alan, I want to support your efforts and it seems I don't have the time to get FR fully integrated into my environment. Ill be putting in a request today to authorize a support contract with you. Should I just follow the docs on the web for the support info? ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thu Sep 17 07:13:41 2009 Subject: First steps towards RadSec support Now that version 2.1.7 has been released, the git repository has been updated with the first step to RadSec support. For now, it only provides RADIUS transport over TCP, as per the following document: http://tools.ietf.org/html/draft-dekok-radext-tcp-transport-01 Using "bare" TCP without TLS is't a good idea in most cases. But it's useful for testing, and can help with the transition to RadSec. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

simulation of the radius
by Magui 17 Sep '09

17 Sep '09

Hello ,some body know if exist a software platform for simulation of the radius out of an production envairoment. I configure radius in my first upon with pgsql an "freeradius -X" give me freeradius listen 1813 1815 1817 ports for auth pass an proxy and waiting request seemingly ok. But i need to prove it without a NAS ,for work reason i can not affect the services with a prove Some body know if i can use for a prove with radius a modem, a software or some thing thus -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

7 8

Configuration for md5 not working
by Jon Standley 17 Sep '09

17 Sep '09

Running freeradius 2.1.6 on CentOS 5.3 I have everything configured for md5 authentication so that I do not need to use either server or client-side certificates. I have my access points configured in /etc/raddb/clients.conf and my users configured in /etc/raddb/users My access point is set to WPA Enterprise security using a RADIUS server. When I try to connect to the network, all I get is "Windows is unable to connect to the wireless network" No prompt for username/password or anything. Can someone tell me if its my radius configuration that is bad or my access point or what? Thanks

3 2

freeradius2 exited when running in multi-server mode
by CHui 17 Sep '09

17 Sep '09

I am testing freeRadius 2.1.6 running on FreeBSD kernel 7.2 i386. The freeradius2 is configured to do ldap authentication and authentication worked without any issue. However, radiusd exited unexpectedly during a simple stress test. I used a sh script to issue the "radtest user pwd . &" command in a loop to simulate radius client authentication request. When freeradius2 was invoked with the following command "radiusd -d /usr/operator/raddb/", thus running in multi-server mode, it exited within a few minutes. There was no trace of runtime error nor coredump (did try allow_core_dump=yes). If I run freeradius2 in single-server mode with the command "radiusd -s -d /usr/operator/raddb/", it held up quite well. I don't mind running freeradius2 in single-server mode as it appears to handle the load quite well during the test. Is it recommended though? Any suggestion on work around? Thanks CHui

2 1

Upgrading from 2.1.6 to 2.1.7
by Phil Pierotti 17 Sep '09

17 Sep '09

Hi All, So I'm on Ubuntu Hardy Heron, currently running FreeRADIUS 2.1.6, and have just downloaded 2.1.7 ./configure ; make ; make install No complaints other than the expected "config files are more recent, you'll need to fix that yourself, we won't touch it". Running the new radiusd produces an error: # radiusd -X radiusd: error while loading shared libraries: libfreeradius-radius-2.1.7.so: cannot open shared object file: No such file or directory # locate libfreeradius-radius-2.1.7.so /usr/local/lib/libfreeradius-radius-2.1.7.so mm ok, so it's there (NB right beside the -2.1.6 libraries). And they both have the same permissions. Also, if I then go to my 2.1.6 source dir, and re-run make install, I am back to a working 2.1.6 installation. What am I missing? Thanks, Phil P

2 2

Cannot upgrade 2.1.4 to 2.1.6
by kachin Agarwal 17 Sep '09

17 Sep '09

m trying to upgrade freeradius-server from 2.1.4 to 2.1.6. i ve created some patches and applied it. but while compiling, it patches all the files and then gives me an error as below : /opt/wios/gcc-4.2.2-glibc-2.7- p2/mips-xlr-linux-gnu/lib/gcc/ mips-xlr-linux-gnu/4.2.2/../.. /../../mips-xlr-linux-gnu/bin/ ld: warning: libfreeradius-radius-2.1.6.so, needed by libeap/.libs/libfreeradius- eap.so, not found (try using -rpath or -rpath-link) collect2: ld returned 1 exit status make[7]: *** [radeapclient] Error 1 make[6]: *** [common] Error 2 make[5]: *** [all] Error 2 make[4]: *** [common] Error 2 make[3]: *** [all] Error 2 make[2]: *** [common] Error 2 make[1]: *** [all] Error 2 make: *** [*/*/*/*/*/freeradius-server- 2.1.6/src/main/radiusd] Error 2 i think it fails to link plz give me a solution to this problem. From cricket scores to your friends. Try the Yahoo! India Homepage! http://in.yahoo.com/trynew

1 0

need help for adding VSA dictionary in Freeradius 2.1.6
by Salim Engin 17 Sep '09

17 Sep '09

Hello, I have problem in adding new VSA dictionary file into Freeradius 2.1.6. Below you can find the steps I performed; - create the file named *dictionary.alcatel.esam* with the following content in */usr/local/share/freeradius/* folder; # # VENDOR Alcatel-ESAM 637 BEGIN-VENDOR Alcatel-ESAM ATTRIBUTE A-ESAM-VRF-Name 0x0700 string ATTRIBUTE A-ESAM-Vlan-Id 0x0701 integer ATTRIBUTE A-ESAM-QOS-Profile-Name 0x0702 string ATTRIBUTE A-ESAM-QOS-Params 0x0703 string ATTRIBUTE A-ESAM-Termination-Cause 0x0704 integer # . . END-VENDOR Alcatel-ESAM - add the line below into */usr/local/share/freeradius/dictionary* file; $INCLUDE dictionary.netscreen $INCLUDE dictionary.networkphysics $INCLUDE dictionary.nexans $INCLUDE dictionary.ntua $INCLUDE dictionary.nokia *$INCLUDE dictionary.alcatel.esam* - start radiusd with debugging option. I get the following error message (radiusd -X ) ; *including dictionary file /usr/local/etc/raddb/dictionary Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.alcatel.esam[9]: dict_init: /usr/local/share/freeradius/dictionary.alcatel.esam[9]: * According to my analysis, freeradius does not like the hex values in the VSA dictionary file i.e : 0x0700 . So I tried to make it decimal which is 1792 but still getting the same error message. It seems those attribute numbers should be in a lower range, because if I start from 1 , and I don't get the message in question. But in this case, the attribute becomes unknown resulting in having not applied while user authentication. Is there a way to overcome this problem ? Thanks Salim Engin

5 8

freeradius running in single server mode?
by Alexandre Chapellon 16 Sep '09

16 Sep '09

I'm running freeradius on debien 5.0 system. I have noticed that freeradius only fork one process whereas it's not running in single server mode: ps aux | grep '^freerad.*\/usr\/sbin\/freeradius' freerad 1930 1.6 3.9 833900 82072 ? Ssl Sep15 25:42 /usr/sbin/freeradius my options for threads pool are set as below: thread pool { start_servers = 5 max_servers = 64 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } I thought I should have 5 freeradius processes forked at startup... Is there something wrong here? regards

2 2

help with freeradius authentication that does not require client-side certificates
by Jon Standley 16 Sep '09

16 Sep '09

Hello, I'm using freeradius 2.1.6 on CentOS 5.3. I'm trying to configure the RADIUS server to authenticate for several clients. I've read that certificate based authentication is more secure as I understand. However, the nature of my wireless network (with users changing on a rather constant basis) does not allow to use client-side certificates that they have to install in order to gain access to the network. I've attempted to read the manuals behind the different types of authentication and how to configure freeradius for them but I've just gotten lost. All I want is a simple challenge-answer system to authenticate the user to the network. It does not have to be via a web portal. Can someone please help me or guide me somewhere with a manual that goes through every step that isn't outdated as the one's I've tried either rely on an older version of freeradius or talk about areas in files that have either changed with freeradius2 or do not exist anymore. I would really appreciate any help and time anyone can spare. I apologize if this is the 10000000000th time you have seen this post. Thank you again. _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. http://clk.atdmt.com/GBL/go/171222985/direct/01/

2 2