September 2014 - Freeradius-Users - lists.freeradius.org

Want to include LDAP group information in Access-Accept message
by Justin Michael Schwartzbeck 09 Sep '14

09 Sep '14

Hello, I am set up FreeRadius for LDAP authentication. I know that you can configure so that when Access-Accept message is sent, you can have custom attributes, using a dictionary file. I am wondering if I can set up FreeRadius to send back the LDAP groups that a user is a member of. Authentication with LDAP should use the username. Is it possible to get FreeRadius to query the LDAP server to find the groups associated with that username, then send this group list back to the connecting user in the Access-Accept message? Will this require a plugin? Can someone give me some guidance on how to do this? Thank you, -Justin

3 2

Virtual Server
by nicolas.clo＠ricoh-industrie.fr 09 Sep '14

09 Sep '14

Hi List, Sorry if it's a stupid question but since Freeradius 3.0.4 ( Version 3.0.4 (git #9b5c955) ), my custom virtual server is ignored by freeradius at startup Log: rlm_sql (sql): Executing query: 'SELECT id, nasname, shortname, type, secret, server FROM nas' rlm_sql (sql): Adding client 192.168.0.1 (AP01) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.2 (AP02) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.3 (AP03) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.4 (AP04) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.5 (AP05) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.6 (AP06) to rif clients list Thanks.

5 18

EAP-Fast Support
by Matthew Ceroni 08 Sep '14

08 Sep '14

Hi: Does Freeradius support EAP-FAST? I am looking to use FreeRadius as the radius server in a CiscoTrust Sec deployment. Thanks

3 8

Send custom accounting packet on login
by Julius Plenz 08 Sep '14

08 Sep '14

Hi, whenever a user successfully logs in, I want to send a custom accounting packet with derived information to a server. Is there a way to do that from the config directly? I have searched for some time now but couldn't find anything like that... Right now I'm using a script that uses the "Authen::Radius" Perl module, but I want to get rid of this solution. If there's no built-in mechanism, my plan would be to write a module that uses libfreeradius.so's library functions (and already initialized dictionaries etc.) to create a queue, send a packet etc. -- are there any problems with this approach? Functions like fr_packet_list_create(), rad_send(), fr_packet_list_recv() etc. are all reentrant, aren't they? Any hints are appreciated. Thanks! Julius

3 2

EAP Session problems
by Cardinal-Richards, Emma 08 Sep '14

08 Sep '14

Hi, I'm experiencing a problem with EAP sessions/new conversations not starting when I'm using the Janet testing as shown below. https://community.ja.net/library/janet-services-documentation/orps-role-des… We've run up 2 new pre-prod RADIUS servers with a newer release of freeradius and have indicated they are 'testdev' under our site's eduroam support. When we attempt to login with an account 'username(a)test.ucl.ac.uk' to our production ORPS we see the request reach our testdev ORPS but it fails to authenticate locally. (We've declared test.ucl.ac.uk as a realm in proxy.conf to be authorised locally to avoid looping back up to the NRPS and back to us etc). It fails with an EAP 'did not finish' (in the style as shown at the bottom section of here http://wiki.freeradius.org/guide/Certificate-Compatibility, the client is linux) failing to see it as a new session. Our certificates are the same on both production and testdev. The other odd behaviour is that despite getting a REJECT from this testdev server, I get authenticated by our production ORPS using 'username(a)test.ucl.ac.uk' which is not a declared local realm on the production ORPS. If I connect directly to the testdev ORPS it's fine. I've contacted the Janet Service desk but not got anywhere as yet, but they suggested I contact here to. I've attached the debug output (zipped to reduce size). Regards, Emma

4 4

Re: Fwd: Failed Authentication user on EAP-SIM,
by Iman Rahmat 08 Sep '14

08 Sep '14

(SOLVE) i put configuration like this 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 The Log show this rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 And you see this log too [eap] processing type sim can not initiate sim, no RAND1 attribute >From the RAND1 can't read from rlm_sim_files , because i write on users file mnc001 change with mnc000 so you must change that with : 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 WOW,,,, FAILED TOO, BUT THE MESSAGE DIFFERENT LOG APPEAR rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 <---> this is same.. but no problem because the different message of LOG its : [eap] processing type sim eap-sim can not find sim-challenge3 <----> different can not initiate sim, missing attributes from this message , we know the sim-challange3 cant be read. Because RAND3,SRES3, AND KC3 Dont write on Users files.. HAHHAHAHA TYPO... SO FINAL CHANGE ITS 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand3 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES3 = 0xF77daa16, EAP-Sim-KC3 = 0x71e9bd629Cee3000 AND CONNECTED, THANKS FOR EVERYONE WHO GIVE ME THE ADVICE AND HELP. indeed sometimes we need someone else to correct our mistakes. The man will never be perfect. thank you very much my friend, I can only pray I hope you are in good health and is always given in abundance. THIS IS LOG OF SUCCESSFULL rad_recv: Access-Request packet from host 111.111.111.195 port 55800, id=56, length=254 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.195 NAS-Identifier = "24a43c7c6ae2" NAS-Port = 0 Called-Station-Id = "26-A4-3C-7D-6A-E2:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02ec001c120b00000b0500008a3fb55d96159c743672996d4b57837a State = 0xaa2b3666abc72410f629694487c8517c Message-Authenticator = 0x470076d7d8eb5e312d290b18dff1d70f # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 236 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org at line 205 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 237 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/ default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 56 to 111.111.111.195 port 55800 MS-MPPE-Recv-Key = 0x69ee128ecad5e1edba8e336bc1c6a9f8843f83d7d8c052e34f7033a60bfbb91e MS-MPPE-Send-Key = 0xe7abe44f40dbce7cce6b2e093db05f23f39d01e5fb0458fd97f9312e86f33a3f EAP-Message = 0x03ed0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" Finished request 2. Going to the next request Waking up in 4.4 seconds. rad_recv: Accounting-Request packet from host 111.111.111.195 port 51808, id=57, length=213 Acct-Session-Id = "540D4EDB-00000005" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.195 NAS-Identifier = "24a43c7c6ae2" NAS-Port = 0 Called-Station-Id = "26-A4-3C-7D-6A-E2:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" # Executing section preacct from file /etc/freeradius/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "24a43c7c6ae2",NAS-IP-Address = 111.111.111.195,Acct-Session-Id = "540D4EDB-00000005",User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org"' [acct_unique] Acct-Unique-Session-ID = "d6d4b84652de2068". ++[acct_unique] = ok [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop ++[files] = noop +} # group preacct = ok # Executing section accounting from file /etc/freeradius/sites-enabled/ default +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 111.111.111.195 [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/111.111.111.195/detail-20140908 [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/111.111.111.195/detail-20140908 [detail] expand: %t -> Mon Sep 8 21:45:00 2014 ++[detail] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 57 to 111.111.111.195 port 51808 Finished request 3. Cleaning up request 3 ID 57 with timestamp +3 Going to the next request Waking up in 4.3 seconds. Cleaning up request 0 ID 54 with timestamp +2 Cleaning up request 1 ID 55 with timestamp +2 Waking up in 0.5 seconds. Cleaning up request 2 ID 56 with timestamp +3 Ready to process requests.

1 1

Re: Failed Authentication user on EAP-SIM,
by Iman Rahmat 08 Sep '14

08 Sep '14

(SOLVE) i put configuration like this 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 The Log show this rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 And you see this log too [eap] processing type sim can not initiate sim, no RAND1 attribute >From the RAND1 can't read from rlm_sim_files , because i write on users file mnc001 change with mnc000 so you must change that with : 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 WOW,,,, FAILED TOO, BUT THE MESSAGE DIFFERENT LOG APPEAR rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 <---> this is same.. but no problem because the different message of LOG its : [eap] processing type sim eap-sim can not find sim-challenge3 <----> different can not initiate sim, missing attributes from this message , we know the sim-challange3 cant be read. Because RAND3,SRES3, AND KC3 Dont write on Users files.. HAHHAHAHA TYPO... SO FINAL CHANGE ITS 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand3 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES3 = 0xF77daa16, EAP-Sim-KC3 = 0x71e9bd629Cee3000 AND CONNECTED, THANKS FOR EVERYONE WHO GIVE ME THE ADVICE AND HELP. indeed sometimes we need someone else to correct our mistakes. The man will never be perfect. thank you very much my friend, I can only pray I hope you are in good health and is always given in abundance. THIS IS LOG OF SUCCESSFULL rad_recv: Access-Request packet from host 111.111.111.195 port 55800, id=56, length=254 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.195 NAS-Identifier = "24a43c7c6ae2" NAS-Port = 0 Called-Station-Id = "26-A4-3C-7D-6A-E2:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02ec001c120b00000b0500008a3fb55d96159c743672996d4b57837a State = 0xaa2b3666abc72410f629694487c8517c Message-Authenticator = 0x470076d7d8eb5e312d290b18dff1d70f # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 236 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org at line 205 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 237 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 56 to 111.111.111.195 port 55800 MS-MPPE-Recv-Key = 0x69ee128ecad5e1edba8e336bc1c6a9f8843f83d7d8c052e34f7033a60bfbb91e MS-MPPE-Send-Key = 0xe7abe44f40dbce7cce6b2e093db05f23f39d01e5fb0458fd97f9312e86f33a3f EAP-Message = 0x03ed0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" Finished request 2. Going to the next request Waking up in 4.4 seconds. rad_recv: Accounting-Request packet from host 111.111.111.195 port 51808, id=57, length=213 Acct-Session-Id = "540D4EDB-00000005" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.195 NAS-Identifier = "24a43c7c6ae2" NAS-Port = 0 Called-Station-Id = "26-A4-3C-7D-6A-E2:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" # Executing section preacct from file /etc/freeradius/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "24a43c7c6ae2",NAS-IP-Address = 111.111.111.195,Acct-Session-Id = "540D4EDB-00000005",User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org"' [acct_unique] Acct-Unique-Session-ID = "d6d4b84652de2068". ++[acct_unique] = ok [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop ++[files] = noop +} # group preacct = ok # Executing section accounting from file /etc/freeradius/sites-enabled/default +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 111.111.111.195 [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/111.111.111.195/detail-20140908 [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/111.111.111.195/detail-20140908 [detail] expand: %t -> Mon Sep 8 21:45:00 2014 ++[detail] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 57 to 111.111.111.195 port 51808 Finished request 3. Cleaning up request 3 ID 57 with timestamp +3 Going to the next request Waking up in 4.3 seconds. Cleaning up request 0 ID 54 with timestamp +2 Cleaning up request 1 ID 55 with timestamp +2 Waking up in 0.5 seconds. Cleaning up request 2 ID 56 with timestamp +3 Ready to process requests.

1 0

About the file pointed at by setting "certificate_file"
by Axel Luttgens 08 Sep '14

08 Sep '14

Hello, Currently, I have in raddb/mods-available/eap the equivalent of: tls-config tls-common { private_key_password = whatever private_key_file = /path/to/my_server_key.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If ca_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. certificate_file = /path/to/my_server_cert.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. ca_file = /path/to/my_root_ca_cert.pem where the server's certificate (my_server_cert.pem) has been signed with the help of an ad hoc root CA (whose certificate is my_root_ca_cert.pem). It "works", in the sense that a client connecting thru TTLS receives both certificates, which is exactly what I want. :-) Now, it is true that I currently don't implement TLS. Putting above comments together, it seems that I could thus comment out the "ca_file = ..." line, and merge both certificates, my_server_cert.pem and my_root_ca_cert.pem, into a single file, say "my_combined_certs". And then define: certificate_file = /path/to/my_combined_certs What format(s) is (are) allowed by FR for that file "my_combined_certs"? Would a simple cat of the two certificates (currently in PEM format) be sufficient? TIA, Axel

3 10

Re: FreeRadius 3 deb packages upgrade
by Rui Ribeiro 08 Sep '14

08 Sep '14

Hi Fajar, Our local repo, from freeradius git, latest 3.1.0. Thanks for the pointers, will modify configuration accordingly. Regards > Date: Mon, 8 Sep 2014 16:27:43 +0700 > From: "Fajar A. Nugraha" <list(a)fajar.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius 3 deb packages upgrade > Message-ID: > <CAG1y0sehheH_a4XxFSbuQ7+k6R= > 5Ptfsh4WB5iTQH21yJudUqw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > On Mon, Sep 8, 2014 at 4:04 PM, Rui Ribeiro <ruyrybeyro(a)gmail.com> wrote: > > > > > Hi, > > > > Been using FreeRadius 3 deb compiled packages for a while here. At first > > I installed them locally and had no problem; however when doing the > upgrade > > from a repository, > > > > which repo? > > > > > the upgrades always overwrite my eap file in /etc/freeradius/mods-enabled > > with the original file. > > > > In the modules directory I am doing links to the files I have not > > modified, and I have the full files when modifying them. > > > > Is this intended behaviour or should I leave only links in mods-enabled > > and do full modifications in mods-available? (will also test this > situation > > in my next upgrade) > > > > > Basically yes, mods-enabled should only be symlinks. > > -- > Fajar > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

2 1

Re: Freeradius-Users Digest, Vol 113, Issue 28
by Rui Ribeiro 08 Sep '14

08 Sep '14

Hi Emma, For debbuging problems I usually use raddebug, and then only more difficult ones, or to send the output to the list are the ones that deserve running in full debug mode. Regards, Rui Ribeiro > > Message: 3 > Date: Mon, 8 Sep 2014 09:21:23 +0000 > From: "Cardinal-Richards, Emma" <e.cardinal-richards(a)ucl.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: EAP Session problems > Message-ID: > < > 7a18137e1a7c4d51b84031b037eb9166(a)AM3PR01MB209.eurprd01.prod.exchangelabs.com > > > > Content-Type: text/plain; charset="us-ascii" > > > On 8 Sep 2014, at 09:18, Cardinal-Richards, Emma <e.cardinal- > > richards(a)ucl.ac.uk> wrote: > > > I'm experiencing a problem with EAP sessions/new conversations not > > starting when I'm using the Janet testing as shown below. > > > > I'm not sure I fully understand your current configuration - are you > saying > > that you're routing test.ucl.ac.uk from your production radius servers, > via the > > national proxies, back to your pre-production servers? > > I believe that's the process of the test as per the guidance from JANET > here? This is for testing purposes, not our final configuration. > > "ORPS Testing > Setting an ORPS to testdev allows organisations to bring up a test box and > for it to only be sent specific test traffic during logic/rules checking > etc. eduroam administrators will need to generate such test traffic > themselves, eg. by using rad_eap_test with the username ' > testuser(a)test.youruniversity.ac.uk' to do a 'loopback test' to the new > systems. This can be done by using your live systems: > > 'testuser(a)test.youruniversity.ac.uk' -> Production ORPS -> NRPS -> > Testdev ORPS > > For this test realm handling facility to work eduroam administrators do > NOT have to specifically configure a 'test' sub-realm (eg.' > test.youruniversity.ac.uk') in the Realms section of eduroam Support." > > https://community.ja.net/library/janet-services-documentation/orps-role-des… > > I was just concerned that this behaviour would mean our roaming clients > would fail to authenticate back to us when they're visiting another > institution. > > > > > The issue seems to be that your client is responding too slowly: > > > > > Finished request 0. > > > Going to the next request > > > Waking up in 4.9 seconds. > > > Cleaning up request 0 ID 1 with timestamp +17 > > > > Increase the cleanup delay in radiusd.conf and requests should complete - > > but over 5 seconds is an obscenely long time, things should be much > faster. > > Dropping it to 3 seconds fixes it.. > > > Could you give an overview of where the requests being transmitted to the > > NRPS are originating from? > > Sorry do you mean the client? I tested from my Linux (Ubuntu) laptop and > my colleagues Windows 7 laptop with the same behaviour. > > > > > > The other odd behaviour is that despite getting a REJECT from this > testdev > > server, I get authenticated by our production ORPS using > > 'username(a)test.ucl.ac.uk' which is not a declared local realm on the > > production ORPS. > > > > We'd need to see a log from the production servers to investigate this. > > Just wondering is this technically correct behaviour (will have to > organise a specific time to run it in debug on our live servers..) my > 'test' user gets authenticated on my test ORPS so the NRPS tell my > production ORPS (as if they are another institution I'm visiting) to allow > me on the network? > > Regards, > Emma > > >

1 0