- Freeradius-Users - lists.freeradius.org

Radius Over a NAT
by Esdras Caleb Oliveira Silva 18 Nov '11

18 Nov '11

My APs are all over a NAT and the radius server is outside this nat. How i configure the clients.conf to acept the conections from the APs? -- "Não se VAI à Igreja. Se É Igreja<http://www.youtube.com/watch?v=ifnJtkAnBq4> ."

4 5

Can I disable user certificate? Can I generate new one?
by asdf zxcv 18 Nov '11

18 Nov '11

Hi, Here's the case: Let's assume we have configured freeradius to use EAP/TLS. CA and server certificates are created, users recieved their .p12 keys and server certs. Now everyone (that has theese files of course) can access our wireless network. 1) What if - for some reason - I want to disallow certain user from having access? He already has the files he needs installed on his machine. I can set Expiration attribute, but is there any other way? 2) What if I need to generate a new certificate for the same user? Let's say someone gained access to his computer and stole the certificate and the key? Can I generate a new certificate for the same user and disable the old one he had? Regards, Peter

3 2

Re: Help: FreeRadius Users with multiple passwords
by Duong Manh Truong 18 Nov '11

18 Nov '11

Hi, Thanks for your reply :) I have a better news that: By using OpenLDAP for FR Authen & Authorization => I can configure multiple passwords for each user (Uid) and use 1 of those passwords for successfully Authentication! Although it is done manually now, but somehow it solves the matter ! If anyone have experienced this, please give some advices ! Example: How to do it automatically or How to create a pool of passwords then use the pool for multiple users :) Regards! Message: 3 Date: Tue, 15 Nov 2011 16:09:29 +0700 From: "Fajar A. Nugraha" <list(a)fajar.net> Subject: Re: Help: FreeRadius Users with multiple passwords To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <CAG1y0sffWuNVw08KH5XT8_Ny3NLCe=NFWB4U+=WEXFcmiQ0FoA(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 On Tue, Nov 15, 2011 at 4:00 PM, Duong Manh Truong <ngoahotanglongbk(a)gmail.com> wrote: > Hi all, > I have encounter with an issue and can not find the solution after several > days of thinking :( > I set up FreeRadius & Mysql successfully, testing with some account ok, > but my real case: Lot of my users?have more than 1 passwords, > Example: User: "truongdm" comes with the password "abc123" or the password > "123abc" is both ok Short version: you can't. Long version: it's doable, but ONLY if: - your user sends clear-text password (read: not using MSCHAP or PEAP-MS-CHAP v2, which is the one most often used by windows clients) - you create additional logic to handle authentication, either using unlang or external script (perl, php, whatever). Hint: see http://wiki.freeradius.org/Auth%20Type . Your additional logic would have to set Auth-Type := Accept when conditions (e.g. password) match. -- Fajar ------------------------------ Vào 18:00 Ngày 15 tháng 11 năm 2011, < freeradius-users-request(a)lists.freeradius.org> đã viết: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: EAP-TLS CRL checking when multiple CAs used (Martin ?mel?k) > 2. Help: FreeRadius Users with multiple passwords (Duong Manh Truong) > 3. Re: Help: FreeRadius Users with multiple passwords > (Fajar A. Nugraha) > 4. Re: mysql module help (Alan DeKok) > 5. Re: Issues with EAP-TLS and OpenSSL (Alan DeKok) > 6. Re: PEAP/mschapv2 - opendirectory (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 15 Nov 2011 09:23:23 +0100 > From: Martin ?mel?k <martin.cmelik(a)gmail.com> > Subject: Re: EAP-TLS CRL checking when multiple CAs used > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <CAGfF+_KCtw6Bet1JMxXJEijmF1dJTK2CekaiXoztVTifpuYOfA(a)mail.gmail.com > > > Content-Type: text/plain; charset=UTF-8 > > Hi all, > > problem has been on my side. I miss to add another one CRL into certs > directory. > > Thank you for all your help! > > Best regards, > > ? > Martin ?mel?k > > > > 2011/11/14 Martin ?mel?k <martin.cmelik(a)gmail.com>: > > Hi Alan, > > > > I did, there is nothing about it. > > > > Only this: > > > > # ?Check the Certificate Revocation List > > # > > # ?1) Copy CA certificates and CRLs to same directory. > > # ?2) Execute 'c_rehash <CA certs&CRLs Directory>'. > > # ? ?'c_rehash' is OpenSSL's command. > > # ?3) uncomment the line below. > > # ?5) Restart radiusd > > # ? ? ? check_crl = yes > > > > We have all CAs in ca.pem and CRL lists in separate file > > crl1.pem+.der, crl2.pem+.der, ect... > > > > Stefan, > > > > that's what I did. > > OK I will try to do same thing with previous configuration. Maybe that > > I miss something. > > > > Thank you > > > > > > ? > > Martin ?mel?k > > > > > > > > > > 2011/11/14 Alan DeKok <aland(a)deployingradius.com>: > >> Martin ?mel?k wrote: > >>> Question is: When Freeradius receive user certificate how daemon find > >>> correct CRL list in certs directory? > >> > >> ?Read raddb/eap.conf. ?This is documented. > >> > >> ?Alan DeKok. > >> - > >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >> > > > > > > ------------------------------ > > Message: 2 > Date: Tue, 15 Nov 2011 16:00:27 +0700 > From: Duong Manh Truong <ngoahotanglongbk(a)gmail.com> > Subject: Help: FreeRadius Users with multiple passwords > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <CAPY3iihX7xHE_kH5+yDB6Fv9=+FSwxVEoOM1R5FtmC8YnZo41A(a)mail.gmail.com > > > Content-Type: text/plain; charset="iso-8859-1" > > > Hi all, > > I have encounter with an issue and can not find the solution after several > days of thinking :( > > I set up FreeRadius & Mysql successfully, testing with some account ok, > > but my real case: Lot of my users *have more than 1 passwords*, > > > Example: User: "truongdm" comes with the password "abc123" or the password > "123abc" is both ok > > > Please help me: How can i set it up? > > - I try to insert serveral records with the same "username" and difference > "value" - password- in the "radcheck" table > but at one time, the server accept 1 pair of "username/value" only :( > > - I try to edit the file "users" manually but no help ..... > > Anyone has had this matter, please help me find the direction! > > Thanks & Best Regards! >

3 2

How to set up wireless-network-connections using WPA/WPA2 enterprise authentication?
by Ajay Garg 18 Nov '11

18 Nov '11

Hi all. I have posted my query at * http://www.linuxquestions.org/questions/showthread.php?p=4527255&posted=1#p… * but think that it might be more relevant at this list. Anyways, I will be grateful for help from either side :-| For brevity, here is the query detail :: Hi all. Let me confess at the beginning, that this is my first major networking assignment; so the terminology might not be absolutely adequate. However, I will try my level best to explain my requirements, and the steps that I have already taken. So, my motive is to allocate a network-connection on Fedora 14, using WPA/WPA2 enterprise authentication. I have a F14 base machine, and a F11 virtual-image hosted in a VirtualBox. Now, I have been able to carry out the stages of installing, configuring and testing a Freeradius server (which provides RADIUS authentication protocol) using the links :: *http://olex.openlogic.com/wazi/2011/...th-freeradius/<http://olex.openlogic.com/wazi/2011/authenticating-wi-fi-users-with-freerad…> * *http://deployingradius.com/scripts/eapol_test/* The Freeradius server is running on my F14 machine. Also, I have been able to carry out the testing both locally, and remotely (with the aid of F11 machine), with the Freeradius server. Now.. comes the actual thing.... I have a router, on which I have set WPA/WPA2 enterprise authentication, using TKIP/AES protocol. Upon rebooting the router firmware, I am no longer able to connect (on either of F14 or F11) via the wireless interface. I am however, able to connect (on both F14 or F11), if I connect a two-jack-wire, with one jack into the router, and another jack on my F14 laptop (remebering that F11 is a virtually hosted image). Now, I intend to do the testing for connecting to the network via wireless interface. I believe :: *a. That I continue to need the two-jack-wire, so as to provide a network-communication medium between the router, and the Freeradius server (which is running on my F14-laptop). b. To actually test connecting to the network via wireless interface, I need to somehow be able to have two connections simultaneously (one which I already have of the wired connection). Assuming part a. is true, how can b. be accomplished?* I am using NetworkManager as the backend, and nm-applet as the frontend, to manage connections. Just for brevity, *lspci* lists two interfaces (amongst others) - one for ethernet; other for wireless. 03:00.0 Network controller: Intel Corporation Centrino Wireless-N 1000 04:00.0 Ethernet controller: Atheros Communications AR8152 v1.1 Fast Ethernet (rev c1) So, I think, the following question summarises all my queries :: How to have simultaneous *wired connection* and *wireless connection* on Fedora 14? Looking forward to some enlightenment. Regards, Ajay

2 1

Radius testing.
by tonimanel 18 Nov '11

18 Nov '11

Hi everybody, Anybody knows a tool to test radius performance? I have seen radperf (without userguide or tutorial) and radtest application. Any advice or ideas? Thanks. Best regards, Toni. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-testing-tp5001965p5001965.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 4

wifi + freeradius + mysql + eap/tls
by Enrique Llanos Vargas 18 Nov '11

18 Nov '11

Hi guys, I've just installed a freeradius+mysql on a debian 6.0.3, first test from localhost with radtest and mysql user auth (radcheck table) worked well, 2nd test with radeaptest with mysql and md5 eap method worked well too, but I don't find a way to make it work with eap+tls: Here's my error output: *[peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation* For what I've read, either I must create my own certs for eap+tls or I can disable TLS, for the 1st, I've followed 'n' guides on the web but none seems to work for me and for the second, I just dont find where to disable the eap with TLS. I don't really want to use TLS, so if you help me to disable TLS, it'll be fine for me. Please, I'd very much apreciatte your assistance. Thanks in advance. Enrique

3 2

wifi + freeradius + mysql + eap/tls
by specr 17 Nov '11

17 Nov '11

Hi guys, I've just installed a freeradius+mysql on a debian 6.0.3, first test from localhost with radtest and mysql user auth (radcheck table) worked well, 2nd test with radeaptest with mysql and md5 eap method worked well too, but I don't find a way to make it work with eap+tls: Here's my error output: *[peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation* For what I've read, either I must create my own certs for eap+tls or I can disable TLS, for the 1st, I've followed 'n' guides on the web but none seems to work for me and for the second, I just dont find where to disable the eap with TLS. I don't really want to use TLS, so if you help me to disable TLS, it'll be fine for me. Please, I'd very much apreciatte your assistance. Thanks in advance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/wifi-freeradius-mysql-eap-tls-tp500… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

EAP-TLS Attributes
by Houston-III, Lester L 17 Nov '11

17 Nov '11

I'm trying to clear some confusion I'm experiencing. This is probably not the right place to ask this question, but I haven't been having much luck finding any answers on the web. I have a FreeRADIUS server running that is acting as a backend authenticator for my VPN server, which is StrongSwan. FreeRADIUS is using LDAP for authorization and I have JRADIUS connected for performing post authorization. Currently, I'm using EAP-TLS for connectivity from the StrongSwan VPN client down to JRADIUS and this is working well. What I want to do now is have the StrongSwan VPN client inject some custom data into the EAP message so that data can be propagated through to JRADIUS for use in the post authorization method. Maybe something like creating my own attribute or something. Is this possible? If so, how can I do this? If not, is there a way to modify an existing FreeRADIUS attribute that can be modified by the StrongSwan VPN client? Lester Houston III lester.l.houston-iii(a)boeing.com

4 6

VMPS
by Whitlow, Michael 17 Nov '11

17 Nov '11

All, I've got a Freeradius server I'm testing for VMPS. My mac2vlan file needs to be dynamically updated. Right now I have a cron job that does that and then stops/starts Freeradius so the new mac2vlan file is read. Is there a better way to do this? Thanks much, Mike

2 1

Check that user auths ok
by koos 17 Nov '11

17 Nov '11

I am sure that this is a very basic question, but I cannot seem to find a decent answer using google search: I have a large users.db file with a dummy user at the start and at the end. I basically want to write a perl script that will check that both these users are present in the users.db file, thus ensuring that my users.db file built fine with rlm_dbm_parse. I thought of just using radclient to do an auth for these 2 users, but I cannot find any docs on what return codes to check for when auth is ok or failed. I am sure I am missing something obvious here, but I am fairly new to radius and any suggestions would be greatly appreciated. Thanks! Koos -- View this message in context: http://freeradius.1045715.n5.nabble.com/Check-that-user-auths-ok-tp5001077p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1