November 2011 - Freeradius-Users - lists.freeradius.org

Radius testing.
by tonimanel 18 Nov '11

18 Nov '11

Hi everybody, Anybody knows a tool to test radius performance? I have seen radperf (without userguide or tutorial) and radtest application. Any advice or ideas? Thanks. Best regards, Toni. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-testing-tp5001965p5001965.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 4

wifi + freeradius + mysql + eap/tls
by Enrique Llanos Vargas 18 Nov '11

18 Nov '11

Hi guys, I've just installed a freeradius+mysql on a debian 6.0.3, first test from localhost with radtest and mysql user auth (radcheck table) worked well, 2nd test with radeaptest with mysql and md5 eap method worked well too, but I don't find a way to make it work with eap+tls: Here's my error output: *[peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation* For what I've read, either I must create my own certs for eap+tls or I can disable TLS, for the 1st, I've followed 'n' guides on the web but none seems to work for me and for the second, I just dont find where to disable the eap with TLS. I don't really want to use TLS, so if you help me to disable TLS, it'll be fine for me. Please, I'd very much apreciatte your assistance. Thanks in advance. Enrique

3 2

wifi + freeradius + mysql + eap/tls
by specr 17 Nov '11

17 Nov '11

Hi guys, I've just installed a freeradius+mysql on a debian 6.0.3, first test from localhost with radtest and mysql user auth (radcheck table) worked well, 2nd test with radeaptest with mysql and md5 eap method worked well too, but I don't find a way to make it work with eap+tls: Here's my error output: *[peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation* For what I've read, either I must create my own certs for eap+tls or I can disable TLS, for the 1st, I've followed 'n' guides on the web but none seems to work for me and for the second, I just dont find where to disable the eap with TLS. I don't really want to use TLS, so if you help me to disable TLS, it'll be fine for me. Please, I'd very much apreciatte your assistance. Thanks in advance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/wifi-freeradius-mysql-eap-tls-tp500… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

EAP-TLS Attributes
by Houston-III, Lester L 17 Nov '11

17 Nov '11

I'm trying to clear some confusion I'm experiencing. This is probably not the right place to ask this question, but I haven't been having much luck finding any answers on the web. I have a FreeRADIUS server running that is acting as a backend authenticator for my VPN server, which is StrongSwan. FreeRADIUS is using LDAP for authorization and I have JRADIUS connected for performing post authorization. Currently, I'm using EAP-TLS for connectivity from the StrongSwan VPN client down to JRADIUS and this is working well. What I want to do now is have the StrongSwan VPN client inject some custom data into the EAP message so that data can be propagated through to JRADIUS for use in the post authorization method. Maybe something like creating my own attribute or something. Is this possible? If so, how can I do this? If not, is there a way to modify an existing FreeRADIUS attribute that can be modified by the StrongSwan VPN client? Lester Houston III lester.l.houston-iii(a)boeing.com

4 6

VMPS
by Whitlow, Michael 17 Nov '11

17 Nov '11

All, I've got a Freeradius server I'm testing for VMPS. My mac2vlan file needs to be dynamically updated. Right now I have a cron job that does that and then stops/starts Freeradius so the new mac2vlan file is read. Is there a better way to do this? Thanks much, Mike

2 1

Check that user auths ok
by koos 17 Nov '11

17 Nov '11

I am sure that this is a very basic question, but I cannot seem to find a decent answer using google search: I have a large users.db file with a dummy user at the start and at the end. I basically want to write a perl script that will check that both these users are present in the users.db file, thus ensuring that my users.db file built fine with rlm_dbm_parse. I thought of just using radclient to do an auth for these 2 users, but I cannot find any docs on what return codes to check for when auth is ok or failed. I am sure I am missing something obvious here, but I am fairly new to radius and any suggestions would be greatly appreciated. Thanks! Koos -- View this message in context: http://freeradius.1045715.n5.nabble.com/Check-that-user-auths-ok-tp5001077p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

EAP Attributes
by Houston-III, Lester L 16 Nov '11

16 Nov '11

Does the EAP plugin support Vendor Specific Attributes (VSA)? Can any of the EAP attributes be modified to contain my own set of data? How can I inject custom data into my EAP message? lester.l.houston-iii(a)boeing.com

3 6

Re: users file - file module
by Alan Buxey 16 Nov '11

16 Nov '11

No. It doesn't. If you need to reread then you can HUP the daemon (later releases) or reload service. If you want dynamic values then SQL is one way (though not for clients directly as they are read on startup too, you need to use the dynamic clients virtual server). fastusers is worth a look too alan -- Message may be brief as it has been sent from my mobile

1 0

users file - file module
by mr. s 16 Nov '11

16 Nov '11

Hello, I am new to FreeRADIUS.. Does the files module periodically reload the users file into memory, if so how often? Thanks for your time. -S

1 0

Re: eap-ttls with ldap
by Alan Buxey 16 Nov '11

16 Nov '11

Your freeradius server was built with EAP support (openSSL support) ? this was not the whole output of radiusd -X alan

1 0