November 2011 - Freeradius-Users - lists.freeradius.org

20 Nov '11

I was wondering if there was a open source billing system available to manage our DSL customers and automatically populate radius users file that anyone could suggest to me. Thanks, Domenic

4 3

getting sometimes TLS error
by Andreas Rudat 19 Nov '11

19 Nov '11

Hi, I get the error from time to time, I use one self signed cert for alle clients and some times I get this error from one ubuntu client, do you have any idea? so self+signed cert + mschapv2 TLS Alert read:fatal:bad certificate Sat Nov 19 18:52:30 2011 : Error: TLS_accept:failed in SSLv3 read client certificate A Sat Nov 19 18:52:30 2011 : Error: rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate Sat Nov 19 18:52:30 2011 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Sat Nov 19 18:52:30 2011 : Debug: TLS receive handshake failed during operation its not the password problem, how I said, the same cert works fine on two different machines, windows + linux the other got archlinux and xp running Thanks

1 2

temporary url-redirect
by Student University 19 Nov '11

19 Nov '11

Hi , anyone have configure freeradius attribute for temporary url-redirect every 1 hour , regards Lily ,,,

2 1

Radius + SambaPDC + "offline" login
by Andreas Rudat 19 Nov '11

19 Nov '11

Hi, perhaps it is the wrong mailing list but I try it :) my samba pdc is running in a different subnet than my radius clients. So, samba ist running x.x.15.x and my Wlan+Radius users using x.x.16.x I use wins instead of dns. I joined with my client the domain successfully, but if I try to login I get the msg "domain not reachable", sure, because I'm not online at that moment, but is there anyway to be that? Thanks.

2 1

Hiding "secret" used in for PAM authentication
by Gregory Machin 19 Nov '11

19 Nov '11

Hi. We are using using PAM to authenticate users against Freeradius, an that is working well. The problem is that the users are 3rd party developers and some need root access. The issue we have is that the radius secret is stored in clear text file. How can this be hidden so that is can be misused ? Is there a document on hardening Freeradius ? Thanks G

2 1

Deleting user accounts in windows xp
by Andreas Rudat 19 Nov '11

19 Nov '11

Hi, hope anyone knows that, if I connect successfully with an xp client, I have never again to put in my login data, so windows has to save my login stuff anywhere but where? I would like to delete my login data. Thanks Andreas

2 2

Radius Over a NAT
by Esdras Caleb Oliveira Silva 18 Nov '11

18 Nov '11

My APs are all over a NAT and the radius server is outside this nat. How i configure the clients.conf to acept the conections from the APs? -- "Não se VAI à Igreja. Se É Igreja<http://www.youtube.com/watch?v=ifnJtkAnBq4> ."

4 5

Can I disable user certificate? Can I generate new one?
by asdf zxcv 18 Nov '11

18 Nov '11

Hi, Here's the case: Let's assume we have configured freeradius to use EAP/TLS. CA and server certificates are created, users recieved their .p12 keys and server certs. Now everyone (that has theese files of course) can access our wireless network. 1) What if - for some reason - I want to disallow certain user from having access? He already has the files he needs installed on his machine. I can set Expiration attribute, but is there any other way? 2) What if I need to generate a new certificate for the same user? Let's say someone gained access to his computer and stole the certificate and the key? Can I generate a new certificate for the same user and disable the old one he had? Regards, Peter

3 2

Re: Help: FreeRadius Users with multiple passwords
by Duong Manh Truong 18 Nov '11

18 Nov '11

Hi, Thanks for your reply :) I have a better news that: By using OpenLDAP for FR Authen & Authorization => I can configure multiple passwords for each user (Uid) and use 1 of those passwords for successfully Authentication! Although it is done manually now, but somehow it solves the matter ! If anyone have experienced this, please give some advices ! Example: How to do it automatically or How to create a pool of passwords then use the pool for multiple users :) Regards! Message: 3 Date: Tue, 15 Nov 2011 16:09:29 +0700 From: "Fajar A. Nugraha" <list(a)fajar.net> Subject: Re: Help: FreeRadius Users with multiple passwords To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <CAG1y0sffWuNVw08KH5XT8_Ny3NLCe=NFWB4U+=WEXFcmiQ0FoA(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 On Tue, Nov 15, 2011 at 4:00 PM, Duong Manh Truong <ngoahotanglongbk(a)gmail.com> wrote: > Hi all, > I have encounter with an issue and can not find the solution after several > days of thinking :( > I set up FreeRadius & Mysql successfully, testing with some account ok, > but my real case: Lot of my users?have more than 1 passwords, > Example: User: "truongdm" comes with the password "abc123" or the password > "123abc" is both ok Short version: you can't. Long version: it's doable, but ONLY if: - your user sends clear-text password (read: not using MSCHAP or PEAP-MS-CHAP v2, which is the one most often used by windows clients) - you create additional logic to handle authentication, either using unlang or external script (perl, php, whatever). Hint: see http://wiki.freeradius.org/Auth%20Type . Your additional logic would have to set Auth-Type := Accept when conditions (e.g. password) match. -- Fajar ------------------------------ Vào 18:00 Ngày 15 tháng 11 năm 2011, < freeradius-users-request(a)lists.freeradius.org> đã viết: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: EAP-TLS CRL checking when multiple CAs used (Martin ?mel?k) > 2. Help: FreeRadius Users with multiple passwords (Duong Manh Truong) > 3. Re: Help: FreeRadius Users with multiple passwords > (Fajar A. Nugraha) > 4. Re: mysql module help (Alan DeKok) > 5. Re: Issues with EAP-TLS and OpenSSL (Alan DeKok) > 6. Re: PEAP/mschapv2 - opendirectory (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 15 Nov 2011 09:23:23 +0100 > From: Martin ?mel?k <martin.cmelik(a)gmail.com> > Subject: Re: EAP-TLS CRL checking when multiple CAs used > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <CAGfF+_KCtw6Bet1JMxXJEijmF1dJTK2CekaiXoztVTifpuYOfA(a)mail.gmail.com > > > Content-Type: text/plain; charset=UTF-8 > > Hi all, > > problem has been on my side. I miss to add another one CRL into certs > directory. > > Thank you for all your help! > > Best regards, > > ? > Martin ?mel?k > > > > 2011/11/14 Martin ?mel?k <martin.cmelik(a)gmail.com>: > > Hi Alan, > > > > I did, there is nothing about it. > > > > Only this: > > > > # ?Check the Certificate Revocation List > > # > > # ?1) Copy CA certificates and CRLs to same directory. > > # ?2) Execute 'c_rehash <CA certs&CRLs Directory>'. > > # ? ?'c_rehash' is OpenSSL's command. > > # ?3) uncomment the line below. > > # ?5) Restart radiusd > > # ? ? ? check_crl = yes > > > > We have all CAs in ca.pem and CRL lists in separate file > > crl1.pem+.der, crl2.pem+.der, ect... > > > > Stefan, > > > > that's what I did. > > OK I will try to do same thing with previous configuration. Maybe that > > I miss something. > > > > Thank you > > > > > > ? > > Martin ?mel?k > > > > > > > > > > 2011/11/14 Alan DeKok <aland(a)deployingradius.com>: > >> Martin ?mel?k wrote: > >>> Question is: When Freeradius receive user certificate how daemon find > >>> correct CRL list in certs directory? > >> > >> ?Read raddb/eap.conf. ?This is documented. > >> > >> ?Alan DeKok. > >> - > >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >> > > > > > > ------------------------------ > > Message: 2 > Date: Tue, 15 Nov 2011 16:00:27 +0700 > From: Duong Manh Truong <ngoahotanglongbk(a)gmail.com> > Subject: Help: FreeRadius Users with multiple passwords > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <CAPY3iihX7xHE_kH5+yDB6Fv9=+FSwxVEoOM1R5FtmC8YnZo41A(a)mail.gmail.com > > > Content-Type: text/plain; charset="iso-8859-1" > > > Hi all, > > I have encounter with an issue and can not find the solution after several > days of thinking :( > > I set up FreeRadius & Mysql successfully, testing with some account ok, > > but my real case: Lot of my users *have more than 1 passwords*, > > > Example: User: "truongdm" comes with the password "abc123" or the password > "123abc" is both ok > > > Please help me: How can i set it up? > > - I try to insert serveral records with the same "username" and difference > "value" - password- in the "radcheck" table > but at one time, the server accept 1 pair of "username/value" only :( > > - I try to edit the file "users" manually but no help ..... > > Anyone has had this matter, please help me find the direction! > > Thanks & Best Regards! >

3 2

How to set up wireless-network-connections using WPA/WPA2 enterprise authentication?
by Ajay Garg 18 Nov '11

18 Nov '11

Hi all. I have posted my query at * http://www.linuxquestions.org/questions/showthread.php?p=4527255&posted=1#p… * but think that it might be more relevant at this list. Anyways, I will be grateful for help from either side :-| For brevity, here is the query detail :: Hi all. Let me confess at the beginning, that this is my first major networking assignment; so the terminology might not be absolutely adequate. However, I will try my level best to explain my requirements, and the steps that I have already taken. So, my motive is to allocate a network-connection on Fedora 14, using WPA/WPA2 enterprise authentication. I have a F14 base machine, and a F11 virtual-image hosted in a VirtualBox. Now, I have been able to carry out the stages of installing, configuring and testing a Freeradius server (which provides RADIUS authentication protocol) using the links :: *http://olex.openlogic.com/wazi/2011/...th-freeradius/<http://olex.openlogic.com/wazi/2011/authenticating-wi-fi-users-with-freerad…> * *http://deployingradius.com/scripts/eapol_test/* The Freeradius server is running on my F14 machine. Also, I have been able to carry out the testing both locally, and remotely (with the aid of F11 machine), with the Freeradius server. Now.. comes the actual thing.... I have a router, on which I have set WPA/WPA2 enterprise authentication, using TKIP/AES protocol. Upon rebooting the router firmware, I am no longer able to connect (on either of F14 or F11) via the wireless interface. I am however, able to connect (on both F14 or F11), if I connect a two-jack-wire, with one jack into the router, and another jack on my F14 laptop (remebering that F11 is a virtually hosted image). Now, I intend to do the testing for connecting to the network via wireless interface. I believe :: *a. That I continue to need the two-jack-wire, so as to provide a network-communication medium between the router, and the Freeradius server (which is running on my F14-laptop). b. To actually test connecting to the network via wireless interface, I need to somehow be able to have two connections simultaneously (one which I already have of the wired connection). Assuming part a. is true, how can b. be accomplished?* I am using NetworkManager as the backend, and nm-applet as the frontend, to manage connections. Just for brevity, *lspci* lists two interfaces (amongst others) - one for ethernet; other for wireless. 03:00.0 Network controller: Intel Corporation Centrino Wireless-N 1000 04:00.0 Ethernet controller: Atheros Communications AR8152 v1.1 Fast Ethernet (rev c1) So, I think, the following question summarises all my queries :: How to have simultaneous *wired connection* and *wireless connection* on Fedora 14? Looking forward to some enlightenment. Regards, Ajay

2 1