May 2017 - Freeradius-Users - lists.freeradius.org

802.1x with multi AD domains
by Vittore Zen 04 May '17

04 May '17

Hi, there are a lot of freeradius configurations that's done a 802.1x PEAP AAA but I'm looking for a configuration that do this with: - multi Microsoft active directory domains - AD domains are not part of same forest - users authenticate using username and password I'm using FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu (a debian 8 on 64bit). Someone can share his configuration? Thanks in advance. v. -- ------------------------------ INFORMAZIONE PER IL RICEVENTE Le informazioni che sono contenute o che accompagnano questa comunicazione potrebbero essere riservate, coperte da segreto professionale, o altrimenti protette da altre restrizioni alla loro divulgazione, e sono destinate esclusivamente alle persone alle quali questa comunicazione é indirizzata. Se questa comunicazione non é indirizzata a Voi, siete pregati di distruggerne tutte le copie in Vostro possesso, di notificarci che avete ricevuto questa comunicazione per errore, e di considerare che sono espressamente vietate la lettura, la diffusione o la distribuzione totale o parziale di questa comunicazione, nonché l'agire sulla base di (informazioni contenute in) questa comunicazione. I messaggi di posta elettronica possono contenere virus o altri difetti, possono non essere accuratamente riprodotti su altri sistemi, o possono essere intercettati, cancellati o alterati senza che il mittente o il destinatario ne vengano a conoscenza. ConsorziSDB declina ogni responsabilitá in relazione a tali evenienze. Vogliate notare che ConsorziSDB riserva il diritto di intercettare, monitorare e conservare, nei limiti consentiti dalle disposizioni legislative o regolamentari applicabili, messaggi di posta elettronica provenienti dai suoi sistemi o ad essi destinati. Se non accettate i rischi associati con le comunicazioni di posta elettronica, potreste scegliere di non utilizzare la posta elettronica per comunicare con ConsorziSDB.

2 3

Reply-Radius
by Ejaz 04 May '17

04 May '17

Hello, when the user gets authenticated, the Radius will send some confirmation to router about that particular user? How can I check this As per my programmer(CRM application data packet service) any user gets authenticated its values should populate Home Agent router which is not happening. We use Cisco 7206 Mobile Wireless Home Agent. Any clue to see Reply response from the radius server Thanks, Mohammed Ejaz Asst. Operation Director of Systems. Cyberia SAUDI ARABIA P.O.Box: 301079, Riyadh 11372 Phone: (+966) 11 464 7114 Ext. 140 Mobile: (+966) 562311787 Fax: (+966) 11 465 4735 Website: http://www.cyberia.net.sa

3 3

Help for buy a real Cert (not self-signed)
by Spider s 04 May '17

04 May '17

Hello, I have got a few questions about radius and buy an original Certificate. Firsts thank you for the help here, but I can’t find an option for search on all post, is this possible ?? only find this: For example only can find post from this mount http://lists.freeradius.org/pipermail/freeradius-users/2017-January/thread.… Is for don’t disturb with my questions is are answered, sorry. And now my questions, first I have got running my freeradius installation 3.10 on ubuntu) with AD Auth, but with limitations, because I need install my self-signed cert on all device for connect to wifi. I don’t want this (I don’t want install the certs), and I need buy a real cert for a real CA, I know ,but I never buy one for this. (I never buy a certfor radius, web or similar) I need buy a real cert, where I can buy ?? recommendations webs?? And witch type ?? I see a lot of certs, and I don’t know the certification specification.( a lot of prices and options) Please a direct links if possible to correct cert. I never buy an original cert and I don’t know process. When I receive the certificates is like certs on the folder?? Need change data??? How can use this certs on my radius install?? Are 3, 5, 20 files ???? where i can find info about this ?? (On docs i reffer) Need a domain for this ?? can i use the cert from a Web (typical ssl cert that is used for web?? I see a lot of info on internet for use self-signed cert, but I can’t find info on documentations or on my Ubuntu install when use real certs. (Is very possible I don’t find) Thank you for your time when you read me, and sorry if a newbie questions. Thank you in advanced, i dont want confuse with this and spend money with this.

6 15

How to log AAA Reject packets?
by Periko Support 03 May '17

03 May '17

I would like to know if exist a way to log AAA Reject packets on FR2.2.x.? I had read the log manual but didn't find this special flag. Thanks all for your time!!!

2 2

freeradius3: multiple rlm_perl and thread pool
by Eugene Grosbein 03 May '17

03 May '17

Hi! Is it supported for freeradius3 to use two distinct rlm_perl modules inside single radiusd process but for different virtual servers? My perl installation is built with both of useithreads=define, usemultiplicity=define. In fact, I already run freeradius3/dhcp module with single server and rlm_perl and it works just fine: thread pool { start_servers = 1000 max_servers = 1000 min_spare_servers = 1000 max_spare_servers = 1000 } Each thread keeps its own persistent connection to powerful external MS SQL server and this 64bit FreeRADIUS has enough memory to run memory-hog embedded threaded Perl to be able to process hundreds of parallel DHCP requests without queueing delay. I need to add new virtual server to process plain RADIUS accounting requests (not DHCP requests) using another perl script and another rlm_perl instance. The question is: is it possible to define another thread pool for new virtual server with distinct *_servers parameters? If no, will new virtual server get a copy of its own thread pool with same parameters or FreeRADIUS uses same pool for all its virtual servers? Eugene Grosbein

3 3

documentation as epub and/or mobi
by Tobias Koeck 03 May '17

03 May '17

Hi, is there any way to get the documentation as epub and/or mobi format. It would be interesting to be able to use the own e-book reader to read the docs. Greetings Tobias

2 1

EAP TLS against multiple certificates?
by David Hartburn 03 May '17

03 May '17

Hi, Is it possible to check EAP-TLS against multiple certificate chains, or bundle two chains together into the same pem file? We have a potential problem where all our certificate auth laptops have been using SHA1 for quite some time. Recently we upgraded our certificate authority to SHA256, so any laptops that request a new cert will get a SHA256. If I put a SHA256 root chain certificate in the EAP-TLS config then a SHA256 client can authenticate, but naturally SHA1 can not. If I leave the SHA1 root chain on the server, then the newer SHA256 clients can not authenticate. I am worried that one day I will come in to find half the clients have renewed to a SHA256 and can no longer auth. Is there anything I can do to allow both certificate types to authenticate during this transition period? In terms of config, in mods-enabled/eap, I have tls-config loanlaptops { private_key_file = ${confdir}/certs/loan_laptop_server.pem certificate_file = ${confdir}/certs/loan_laptop_server.pem ca_file = ${confdir}/certs/unikentrootCAchain.pem ...... } tls { # Point to the Loan Laptops TLS configuration tls = loanlaptops virtual_server = check-eap-tls } Yours Dave Hartburn

2 5

Re: Radsec Clients
by Alan Buxey 03 May '17

03 May '17

Just populate the naslist table as you would for normal clients and ensure they are pointed to the correct virtual server and you've enabled reading of clients from the database in the SQL module alan On 2 May 2017 12:28 pm, "Xavier Maysonnave" <x.maysonnave(a)gmail.com> wrote: Hi, Thanks for the answer. You are right I don't want to put the tls sub-section in a sql table. I was referring to the clients radsec {...} sub-section defined in the file sites-available/tls. I'm looking at how to store those clients in a SQL table and didn't find out the correct solution yet. Thanks -- PGP: CAE5 CE4A EFE9 134F D991 5465 081C B6FB 2EAC 6CC9 <https://goo.gl/lPjb40> -- Light Xavier / Pudhuveedu 2017-05-01 17:35 GMT+05:30 Alan DeKok <aland(a)deployingradius.com>: > On Apr 30, 2017, at 11:33 PM, Xavier Maysonnave <x.maysonnave(a)gmail.com> > wrote: > > > > is there a way to store the radsec clients in an sql table rather than > > using the tls configuration file ? > > No. > > Clients can be listed in SQL. But the "tls" sub-section can't be put > into SQL. > > Alan DeKok. > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

2 2

Re: How to log AAA Reject packets?
by Peter Lambrechtsen 03 May '17

03 May '17

Add linelog or detail depending on how much detail you want into the post-auth Reject section and the rejects get logged. On 3/05/2017 12:58, "Periko Support" <pheriko.support(a)gmail.com> wrote: I would like to know if exist a way to log AAA Reject packets on FR2.2.x.? I had read the log manual but didn't find this special flag. Thanks all for your time!!! - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

1 0

Radsec Clients
by Xavier Maysonnave 02 May '17

02 May '17

Hi All, is there a way to store the radsec clients in an sql table rather than using the tls configuration file ? Thanks -- PGP: CAE5 CE4A EFE9 134F D991 5465 081C B6FB 2EAC 6CC9 <https://goo.gl/lPjb40> -- Light Xavier / Pudhuveedu

2 3