- Freeradius-Users - lists.freeradius.org

unsubscribe
by srg 26 May '12

26 May '12

unsubscribe

1 0

Get current used certificate (id?) by IP or Mac
by Max Burkhardt 25 May '12

25 May '12

Hi all, I want to write a web interface. The web interface is available behind an WPA2 eap-tls network(using freeradius). And when the user logging in with their username & password, it should check if the user logged in to the WPA2 Network, with an specific Username. So for example is there a possibility to activate a mysql/psql/.. database and write into a table all current users which are logged in or is there a possibility to check with an SH-command the current users or an user by ip/mac/.. or etc. . ? Thanks for any response ;) MfG. Max

1 0

FR over TCP
by yagizozen 25 May '12

25 May '12

Hello Guys, I have a question about radius over tcp, is it possible? Can we use TCP instead of udp with freeradius (for more secure communication link and some other reasons) and how? can you forward me to necessary documentations if it is possible and I can read and understand how. Thank you !! -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-over-TCP-tp5713364.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Re: Proxying multiple times to virtual and external servers
by Alan Buxey 24 May '12

24 May '12

From my mobile. So terse... if("%{Called-Station-Id}" =~ /:eduroam$/){ update control { proxy-to-server = eduroam } } ...or such (there will be some lexical errors above) Search the mail Archives as there have been similar discussions PS its 'eduroam', NEVER a capital E alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart ----- Reply message ----- From: "Graeme Hamilton" <g.j.hamilton(a)stir.ac.uk> Date: Thu, May 24, 2012 15:36 Subject: Proxying multiple times to virtual and external servers To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Hello, I'm configuring FreeRADIUS (2.1.12) for use as part of our Eduroam deployment. We're using EAP-MSCHAPv2 authentication, so I've got both an outer and inner virtual server configured and working correctly. Currently, the outer server configuration (configured as default i.e. without a 'server' stanza) assumes that connections from our wireless controller clients are only ever Eduroam-related, and it processes them accordingly - does realm checks, proxy logic, mandatory logging, etc. This is acceptable for now, since Eduroam is currently the only wireless service we provide which uses 802.1X authentication. Ideally, I'd like a generic default virtual server which would process all authentications initially, but which would act upon the suffix (e.g. ':eduroam') appended to the Called-Station-Id by our wireless controllers to proxy the request off to another virtual server dedicated to that particular function, where further actions specific to that purpose can be carried out. Reading the comments in proxy.conf suggests that it's possible to proxy requests containing a particular realm off to another virtual server, but that such requests cannot subsequently be proxied again. This would break Eduroam, since visitors to our campus need to have their requests proxied off to the national proxy servers once we've processed them. Is there any way to achieve this functionality whilst retaining the ability to proxy requests multiple times, or should I just dedicate the whole FreeRADIUS instance to Eduroam and use the functionality of our wireless controllers to direct authentication attempts on specific SSIDs to specific RADIUS server groups, if and when the need arises? Regards, Graeme Graeme Hamilton Senior Network Specialist Information Services University of Stirling -- The Sunday Times Scottish University of the Year 2009/2010 The University of Stirling is a charity registered in Scotland, number SC 011159. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Proxying multiple times to virtual and external servers
by Graeme Hamilton 24 May '12

24 May '12

Hello, I'm configuring FreeRADIUS (2.1.12) for use as part of our Eduroam deployment. We're using EAP-MSCHAPv2 authentication, so I've got both an outer and inner virtual server configured and working correctly. Currently, the outer server configuration (configured as default i.e. without a 'server' stanza) assumes that connections from our wireless controller clients are only ever Eduroam-related, and it processes them accordingly - does realm checks, proxy logic, mandatory logging, etc. This is acceptable for now, since Eduroam is currently the only wireless service we provide which uses 802.1X authentication. Ideally, I'd like a generic default virtual server which would process all authentications initially, but which would act upon the suffix (e.g. ':eduroam') appended to the Called-Station-Id by our wireless controllers to proxy the request off to another virtual server dedicated to that particular function, where further actions specific to that purpose can be carried out. Reading the comments in proxy.conf suggests that it's possible to proxy requests containing a particular realm off to another virtual server, but that such requests cannot subsequently be proxied again. This would break Eduroam, since visitors to our campus need to have their requests proxied off to the national proxy servers once we've processed them. Is there any way to achieve this functionality whilst retaining the ability to proxy requests multiple times, or should I just dedicate the whole FreeRADIUS instance to Eduroam and use the functionality of our wireless controllers to direct authentication attempts on specific SSIDs to specific RADIUS server groups, if and when the need arises? Regards, Graeme Graeme Hamilton Senior Network Specialist Information Services University of Stirling -- The Sunday Times Scottish University of the Year 2009/2010 The University of Stirling is a charity registered in Scotland, number SC 011159.

2 1

ssh authentication failed problem use freeradius & pam_radius
by 小牧 24 May '12

24 May '12

Hi everyone, I am trying to use pam_radius to authenticate SSH login.My system is Centos 5.6 64bit. When I try to authenticate with ssh but failed,I am sure the shared secret is correct. Freeradius got the following logs: rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "? INCORRECT" [pap] Using clear text password "1111" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject And by the way,is it possible to create a ssh user on NAS after the first time successful authentication.

4 4

FR on RHEL
by Tobias Hachmer 24 May '12

24 May '12

Hello list, the red hat faq on http://wiki.freeradius.org/Red-Hat-FAQ supposes that the newest version of FR is in the official channel. Here on a RHEL6 server there is only version 2.1.10 in the repo (and only the base package, not the additional modules like mysql, ldap and so on): # yum info freeradius\* Loaded plugins: product-id, rhnplugin, security, subscription-manager Updating certificate-based repositories. Available Packages Name : freeradius Arch : i686 Version : 2.1.10 Release : 5.el6 Size : 1.3 M Repo : rhel-i386-server-6 Summary : High-performance and highly configurable free RADIUS server License : GPLv2+ and LGPLv2+ Description : The FreeRADIUS Server Project is a high performance and highly configurable : GPL'd free RADIUS server. The server is similar in some respects to : Livingston's 2.0 server. While FreeRADIUS started as a variant of the : Cistron RADIUS server, they don't share a lot in common any more. It now has : many more features than Cistron or Livingston, and is much more configurable. : : FreeRADIUS is an Internet authentication daemon, which implements the RADIUS : protocol, as defined in RFC 2865 (and others). It allows Network Access : Servers (NAS boxes) to perform authentication for dial-up users. There are : also RADIUS clients available for Web servers, firewalls, Unix logins, and : more. Using RADIUS allows authentication and authorization for a network to : be centralized, and minimizes the amount of re-configuration which has to be : done when adding or deleting new users. Where can I get the newest version of FR, which channel is meant? Regards, Tobias Hachmer

2 1

Re: FR on RHEL
by Alan Buxey 24 May '12

24 May '12

From previous discussions on this list I believe that the next point release of 6 will have 2.1.12. Its a little crazy that 5.x release is ahead of the 6.x but that's how it is... Alan

2 1

Error: SSL: SSL_read failed in a system call (-1), TLS session fails.
by Nikolaos Pavlidis 24 May '12

24 May '12

Hello all, The error: Thu May 24 08:51:17 2012 : Error: TLS Alert write:fatal:unexpected_message Thu May 24 08:51:17 2012 : Error: TLS_accept:error in SSLv3 read finished A Thu May 24 08:51:17 2012 : Error: rlm_eap: SSL error error:1408E0F4:SSL routines:SSL3_GET_MESSAGE:unexpected message Thu May 24 08:51:17 2012 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Thu May 24 08:51:17 2012 : Auth: Login incorrect: [some_username(a)beds.ac.uk] (from client mx-something port 1841 cli 00-00-00-00-00-01) Thu May 24 08:51:59 2012 : Auth: Invalid user: [host/Somepcname-PC] (from client mx-something-else port 16489 cli 00-00-00-00-00-02) The platform: SUSE Linux Enterprise Server 11 (x86_64) VERSION = 11 PATCHLEVEL = 1 Freeradius version: freeradius-server-2.1.8-2.1 (from Network AAA (SLE_11) repo) Question: Since I am very new to freeradius I am not going to assume anything and let you guys point me to the right direction :) The only thing I found similar is http://freeradius.1045715.n5.nabble.com/SSL-read-failed-in-a-system-call-1-… which refers to an earlier version of freeradius so... kind of lost here.. Any help would be much appreciated. Cheers, Nik

1 0

SSHA512
by Alex Needham 24 May '12

24 May '12

Hi Are there any plans to support SSHA512 with the 4000 ish folds etc. as this is pretty much the default for most linux distros these days? Thanks JH

2 1