- Freeradius-Users - lists.freeradius.org

FreeRadius 2.1.12, why is EAP AKA support in eap2 module
by Altaf Husain 16 Mar '12

16 Mar '12

> > Hi, > We are using FreeRadius ver 2.1.12, I had query regarding EAP-AKA > support in eap2 module, its mentioned in FreeRadius website that "This > module is experimental, and may not be ready for use in a production > environment", Is it still in experimental state, can't it be used as > EAP-SIM, is performance tested for EAP-AKA. I am waiting for response so > that we supporting EAP-AKA in our product using FreeRadius, any specific > reason for keeping it in eap2 module rather then mainline eap module. > Waiting for positive and quick response, Thanks in advance. > > Thanks > Altaf >

3 5

Windows 7 clients
by Scott McLane Gardner 16 Mar '12

16 Mar '12

Okay, I've finally got the server certificate sorted out, signed by GeoTrust and installed, but now I have another certificate problem. I believe this one is that the client doesn't recognize my ca.pem as being signed by a trusted authority. Do I need to get another root cert signed by GeoTrust? If so, how do I go about doing that? FR v2.1.10 [peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user.

6 10

Cannot authenticate TinyRadius with freeRadius
by ulislam.raihan 16 Mar '12

16 Mar '12

Hi All, I am using Tiny Radius client to authenticate with freeRadius Server. But from freeRadius server(version 2.1.10) it can not read the password.I am getting following msg from freeRadius server. The user name is testing. Password is password. Secret is testing123. I have test the username and password with radtest that comes with freeRadius and it works. The entry in users file is following. *testing Cleartext-Password == "password"* I will be very great full to you . if any one ca tell me how to fix it. Thanks Raihan *Msg from FreeRadius Server* rad_recv: Access-Request packet from host 127.0.0.1 port 49851, id=1, length=59 User-Name = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 123 User-Password = "\317\356`\275\277\377d%q\321\341o2خ\303" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry testing at line 49 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "��`��d%q��o2خ�" [pap] Using clear text password "password" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 1 to 127.0.0.1 port 49851 Waking up in 4.9 seconds. Cleaning up request 5 ID 1 with timestamp +364 *JAVA source code* import java.io.IOException; import org.tinyradius.*; import org.tinyradius.packet.AccessRequest; import org.tinyradius.packet.RadiusPacket; import org.tinyradius.util.RadiusClient; import org.tinyradius.util.RadiusException; public class JavaRadiusClient { /** * @param args */ public static void main(String[] args) { // TODO Auto-generated method stub //JavaRadiusClient jrc = new JavaRadiusClient(); //jrc.secndAuthentication(); RadiusClient rc = new RadiusClient("localhost"," testing123"); try { if (rc.authenticate("testing", "password")) { System.out.println("Authnticated"); } else System.out.println("Not Authnticated"); } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (RadiusException e) { // TODO Auto-generated catch block e.printStackTrace(); } } public void secndAuthentication(){ RadiusClient rc = new RadiusClient("localhost"," testing123"); AccessRequest ar = new AccessRequest("testing", "password"); //ar.setAuthProtocol(AccessRequest.AUTH_CHAP); // or AUTH_PAP ar.setAuthProtocol(AccessRequest.AUTH_PAP); // or AUTH_PAP ar.addAttribute("NAS-IP-Address", "127.0.0.1"); ar.addAttribute("NAS-Port" ,"123"); RadiusPacket response; try { response = rc.authenticate(ar); if (response.getPacketType() == RadiusPacket.ACCESS_ACCEPT) { System.out.println("Authnticated"); } } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (RadiusException e) { // TODO Auto-generated catch block e.printStackTrace(); } } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/Cannot-authenticate-TinyRadius-with… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

SQL_LOG Interim Update missing "partial" config error? huh?
by Christiaan Rademan 15 Mar '12

15 Mar '12

Greetings Everyone, I am using FreeRadius + mySQL + SQLIPPOOL. FreeRADIUS Version 2.1.11. The start and stop accounting records work fine. My issue is I keep getting the following in the logs: Tue Mar 13 22:18:33 2012 : Info: [sql_log] Couldn't find an entry Interim-Update in the config section. Any idea why the interim-updates not working? I have looked through the configuration, I cant find what config section it refers too? I mean the stuff should all be configured as per default for interim update sql query etc is still in raddb/sql/mysql/dialup.conf what special configuration do I have todo? Or where can I go read about it? Please advice! Many thanks! -- Christiaan Rademan - JNCIE #661 Mobile: +27 83 419 2078 E-mail: christiaan.rademan(a)gmail.com

3 3

FreeRADIUS 1.1.2 -> 2.1.12 migration steps
by Martin Mielke 15 Mar '12

15 Mar '12

All, At my new working place I have inherited a FR 1.1.3 running on CentOS 5.6. Beyond being outdated and unsupported, this FR setup is causing a lot of problems so I plan a migration to RHEL5 and FR 2.1.12. I've been searching but I cannot find a procedure describing which steps to follow in order to migrate from one server/version to another. Can someone please shed some light or point me in the right direction? TIA, Martin

9 13

Very large environment depending on FreeRadius
by Christiaan Rademan 15 Mar '12

15 Mar '12

Greetings guys, Need advice before going live: I have deployed a FreeRadius server in an environment with 2,491,000 subscribers. GGSN 2,491,000 MSISDN subscribers. 3 APN(s). 1 APN will be authenticated locally: 830 000 subscribers 1 APN will be proxied for: 1,660,000 subscribers 1 APN another will be proxied for: 1,660,000 subsicbers. BRAS for PPPOE is 1000 subscribers. We tested the configuration and it was working, with attribute filters on proxy etc.. for all our requirements. Using MYSQL Backend and SQL IP Pool to hand out IP addresses for localally authenticated. Also have a secondary standby FreeRadius, with mysql replication using a bunch of additional scripts I wrote to handle redundancy and consistency checks. The system is running live for the 1000 subscribers. We about to swing over the 2,491,000 mobile subscribers... Can you please advice me on anything I should watch out for or plan for? Should I be worried about tuning the ports? listening on multiple ports for auth+acct? anything strange? Any tips??? :-) go mad, i need to ensure this runs smoothly... System is running on Ubuntu Linux Server. -- Christiaan Rademan - JNCIE #661 Mobile: +27 83 419 2078 E-mail: christiaan.rademan(a)gmail.com

3 3

Cannot authenticate TinyRadius with freeRadius
by ulislam.raihan 15 Mar '12

15 Mar '12

Hi All, I am using Tiny Radius client to authenticate with freeRadius Server. But from freeRadius server(version 2.1.10) it can not read the password.I am getting following msg from freeRadius server. The user name is testing. Password is password. Secret is testing123. I have test the username and password with radtest that comes with freeRadius and it works. The entry in users file is following. *testing Cleartext-Password == "password"* I will be very great full to you . if any one ca tell me how to fix it. Thanks Raihan *Msg from FreeRadius Server* rad_recv: Access-Request packet from host 127.0.0.1 port 49851, id=1, length=59 User-Name = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 123 User-Password = "\317\356`\275\277\377d%q\321\341o2خ\303" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry testing at line 49 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "��`��d%q��o2خ�" [pap] Using clear text password "password" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 1 to 127.0.0.1 port 49851 Waking up in 4.9 seconds. Cleaning up request 5 ID 1 with timestamp +364 *JAVA source code* import java.io.IOException; import org.tinyradius.*; import org.tinyradius.packet.AccessRequest; import org.tinyradius.packet.RadiusPacket; import org.tinyradius.util.RadiusClient; import org.tinyradius.util.RadiusException; public class JavaRadiusClient { /** * @param args */ public static void main(String[] args) { // TODO Auto-generated method stub //JavaRadiusClient jrc = new JavaRadiusClient(); //jrc.secndAuthentication(); RadiusClient rc = new RadiusClient("localhost"," testing123"); try { if (rc.authenticate("testing", "password")) { System.out.println("Authnticated"); } else System.out.println("Not Authnticated"); } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (RadiusException e) { // TODO Auto-generated catch block e.printStackTrace(); } } public void secndAuthentication(){ RadiusClient rc = new RadiusClient("localhost"," testing123"); AccessRequest ar = new AccessRequest("testing", "password"); //ar.setAuthProtocol(AccessRequest.AUTH_CHAP); // or AUTH_PAP ar.setAuthProtocol(AccessRequest.AUTH_PAP); // or AUTH_PAP ar.addAttribute("NAS-IP-Address", "127.0.0.1"); ar.addAttribute("NAS-Port" ,"123"); RadiusPacket response; try { response = rc.authenticate(ar); if (response.getPacketType() == RadiusPacket.ACCESS_ACCEPT) { System.out.println("Authnticated"); } } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (RadiusException e) { // TODO Auto-generated catch block e.printStackTrace(); } } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/Cannot-authenticate-TinyRadius-with… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Using freeRadius with OTP and gateway
by Mercier Valentin 15 Mar '12

15 Mar '12

Hi everyone, I'm using Freeradius 2.1.12 on a server Debian. I have an another server Debian with Coovachilli (captive portal) and an Access Point based on Ruckus OS. When my users connected on the AP, a web page is coming with a formular to connect. Then the user enter is information (username and password) and Coovachilli made the authentication on the radius and this is working fine. Now I want to make something different, when the user connected on the AP, I want that he received a little formular, then he need to enter a username (not know on the radius) and i want the radius to create a One Time Password and send it to the user (on an another webpage). And the user send this OTP via SMS to a smsm gateway to finish the authentication, is that possible, and if yes, could someone explain to me how I can make it ? For the gateway sms I am using SMSLib (java library) on the same server as freeradius. Best regards and sorry for my bad english (from switzerland). -- Mercier Valentin

4 5

radius.log rotation
by Shreya Shah 15 Mar '12

15 Mar '12

Hi, How can we rotate radius.log file ? -Shreya.

2 1

Creating Certificates for EAP
by suggestme 15 Mar '12

15 Mar '12

Hi, I am trying to create certificates in Freeradius going inside /usr/local/etc/raddb/certs. I need these certificates for EAP-TTLS authentication for wireless access points. As suggested in deployingradius.com and README inside /usr/local/etc/raddb/certs; I tried to create "Test Certificates" for testing purpose at first. I tried the command "make" inside /usr/local/etc/raddb/certs, but it doesn't do anything, i.e. doesn't show any certificates building. Also I tried "./bootstrap" going inside the same certs directory; it also doesn't do anything. I don't see any certificates like "root CA" that has been built after I run "make" or "./bootstrap" command inside certs directory. I have already installed "openssl" in my machine with freebsd in which freeradius server is installed. Is there anything I am missing? Your suggestions would be greately appreciated. Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Creating-Certificates-for-EAP-tp556… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4