- Freeradius-Users - lists.freeradius.org

Freeradius + EAP TLS + MySQL + PPTP
by Gregoire leroy 20 Apr '11

20 Apr '11

Hi, I want to setup a PPTP server with EAP TLS and authentication by FreeRadius. I've seen in a documentation that we must set Auth-type, but the documentation is out-dated and on freeradius.org, it's specified that Auth-type shouldn't be set manually. So, I don't know which data I must set in which table, MySQL-side. Can anyone help me ? Thanks, Regards, Grégoire Leroy

2 1

setup service needed
by danieln 20 Apr '11

20 Apr '11

Hi, Anyone here managed to setup a hotspot service using freeradius and a captive portal? I'd like to hire someone to do a setup for me. -- View this message in context: http://freeradius.1045715.n5.nabble.com/setup-service-needed-tp4315197p4315… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

MS-CHAPv2 password change implementation
by Phil Mayers 20 Apr '11

20 Apr '11

All, I have spent the last few days writing the code to allow rlm_mschap and rlm_eap_mschapv2 to support password changes. Rather than slinging tarballs around, the patches are in a branch here: https://github.com/philmayers/freeradius-server/tree/v2.1.x-mschap-changepa… It basically works for me; I've tried it with a Windows XP client on a wired 802.1x port, but it needs extensive testing given the scope of the changes. It supports both password changes via samba/ntlm_auth and also locally if you have NT-Password/Cleartext-Password. I've tried to split the patches up into logical units, which should make the review easier. Particularly, the first patch in the set interferes with src/main/exec.c so that we can re-use the code to open a process with a pipe on both stdin and stdout. This change will need very careful review. Testing and comments are very welcome, but I'll be offline for most of the next two weeks enjoying the weather! Cheers, Phil

2 1

Freeradius, rlm_perl and tagged attributes from rlm_sql
by Igor V. Malinovskiy 19 Apr '11

19 Apr '11

I'm using Freeradius 2.1.10. I need to reply to NAS same attributes with tags using rlm_sql and rlm_perl. But in result number of tags is missing and in reply only attributes with ":0". mysql> select * from radreply; +----+--------------+-------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+-------------------+----+----------+ | 1 | testuser@new | Context-Name | = | Internet | | 2 | testuser@new | Service-Name:1 | += | GUEST | | 3 | testuser@new | Service-Options:1 | += | 0 | | 4 | testuser@new | Service-Name:2 | += | INET | | 5 | testuser@new | Service-Options:2 | += | 1 | +----+--------------+-------------------+----+----------+ 5 rows in set (0.00 sec) Debug: rlm_perl: Added pair NAS-Port-Type = Virtual Debug: rlm_perl: Added pair CHAP-Password = 0x01d5b5364721d124b36c2fcaf86dc1289b Debug: rlm_perl: Added pair Acct-Session-Id = 0000FFFF6802B4D0-4DAC4ACD Debug: rlm_perl: Added pair Proxy-State = 0x313538 Debug: rlm_perl: Added pair Service-Type = Framed-User Debug: rlm_perl: Added pair CHAP-Challenge = 0xa87b4c6f31d9b71f63a5b54b9482bf1f Debug: rlm_perl: Added pair NAS-IP-Address = 172.26.201.21 Debug: rlm_perl: Added pair NAS-Real-Port = 285216672 Debug: rlm_perl: Added pair Medium-Type = 11 Debug: rlm_perl: Added pair Framed-Protocol = PPP Debug: rlm_perl: Added pair User-Name = testuser@new Debug: rlm_perl: Added pair NAS-Port = 16842752 Debug: rlm_perl: Added pair Acct-Interim-Interval = 1800 Debug: rlm_perl: Added pair Service-Name = GUEST Debug: rlm_perl: Added pair Service-Name = INET Debug: rlm_perl: Added pair Context-Name = Internet Debug: rlm_perl: Added pair Service-Type = Framed-User Debug: rlm_perl: Added pair Framed-IP-Address = 255.255.255.254 Debug: rlm_perl: Added pair Service-Options = 0 Debug: rlm_perl: Added pair Service-Options = 1 Debug: rlm_perl: Added pair Cleartext-Password = testpass Debug: rlm_perl: Added pair Auth-Type = CHAP Info: ++[perl] returns ok Sending Access-Accept of id 180 to 127.0.0.1 port 11113 Acct-Interim-Interval = 1800 Service-Name:0 += "GUEST" Service-Name:0 += "INET" Context-Name = "Internet" Service-Type = Framed-User Framed-IP-Address = 255.255.255.254 Service-Options:0 += 0 Service-Options:0 += 1 Proxy-State = 0x313538 Mon Apr 18 17:29:33 2011 : Info: Finished request 3. Mon Apr 18 17:29:33 2011 : Debug: Going to the next request

1 0

what does the attribute PW_DIGEST_NONCE represent in the rlm_digest module?
by maximus 19 Apr '11

19 Apr '11

Hi, I would like to know what does the attribute PW_DIGEST_NONCE (1064) represent in rlm_digest module in radius server? My radius log information is given here. <------the radius log information for the authentication packet starts here----------> Received radius packet: NAS-Identifier = "localhost.localdomain" Digest-Attributes = "\003\010INVITE" Digest-Attributes = "\006\005MD5" Digest-Attributes = "\002*60d9d2b7b8ab7b4da4014bcdac1724b7320068d6" Digest-Attributes = "\n\0146599999970" User-Name = "6599999970(a)192.168.104.239" Digest-Attributes = "\004 sip:6599999508@192.168.104.240" Digest-Response = "1ee3c49572b6fcd4a9e0438bba8810dc" Digest-Attributes = "\001\021192.168.104.239" rlm_sql in rlm_sql_authenticate <------the radius log information ends here----------> The Digest-Attributes = "\002*60d9d2b7b8ab7b4da4014bcdac1724b7320068d6" is the PW_DIGEST_NONCE with 60d9d2b7b8ab7b4da4014bcdac1724b7320068d6 as the value. In my setup, the radius client uses SIP. I want to know whether the PW_DIGEST_NONCE in the digest attributes can be used as a Session ID of the SIP call or the Call-Reference of the authentication packet? Or, only after receiving the RLM_MODULE_OK for the digest request, the radius client will send the further SIP call information in the next packet? A little background about the problem I face: I have a customized radius source(taken from freeradius few years back) to work with radius clients to perform authentication and accounting with only rlm_detail, rlm_preprocess, rlm_sql (with unixodbc) modules. Now, I have a requirement for the radius server to work with a radius client which has SIP. And I have found that radius client with SIP uses 'rlm_digest' module as part of authentication. This is when I have the following issues: a) I can not just integrate 'rlm_digest' module source to the existing radius server source to work since the changes are quite a lot. b)I have very limited or no details about how the radius client with the SIP works. This is why I wanted to get more information about the role of rlm_digest module and how to handle it in my situation. Thanks. ./maximus -- View this message in context: http://freeradius.1045715.n5.nabble.com/what-does-the-attribute-PW-DIGEST-N… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

WildCard/Subject Alternative Names Cert Question
by Casartello, Thomas 18 Apr '11

18 Apr '11

Hello. I have a FreeRADIUS setup using PEAP/MSCHAPv2 to authenticate wireless clients against an Active Directory environment. We've recently purchased a new wildcard certificate from DigiCert for our organization. The RADIUS server is not covered by the wildcard common name on the certificate, however I have a subject alternative name specifying the RADIUS server hostname on it as well. On my new cert, connection to the system fails when I try validating the new cert (I have all the possible cert authorities checked off.) If I uncheck validate the cert, I am then able to connect. As soon as I place the old cert back in place validation works fine. The old cert was a free signal name cert from IPS CA. The new cert is a wildcard duplicate issued from DigiCert that has the server name as a subject alternative name as it is not covered by the wild card common name we are using - I generated the CSR for this certificate copy using the tools in freeradius (XPExtensions and whatnot.) Should this kind of a cert work, or does 802.1x/PEAP/mschapv2 not support validating by subject alternative names. I tried including the CA Cert in a chain file and not including it and had the same results either way. I know the CA is trusted by Microsoft as this same wildcard cert works in our web applications. Tom Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State University (413) 572-8245 Red Hat Certified Technician (RHCT) Cisco Certified Network Associate (CCNA)

2 5

groups with port permissions
by subcode 18 Apr '11

18 Apr '11

Hi All, I'm new in FreeRadius. I have install freeRadius and ChillSpot on Debian with squid and iptables. Everything is ok, but I want to make a Group with port permissions. For exampel first group "Low" with only HTTP(S) permission, the second group "Mittel" with HTTP(S), POP(S), IMAP, SMTP(S) and the third group "Hi" with all permission (all ports). How can I do this? I have my hotspot in my caffe-bar and only customers can have a internet. Thanks for your help! PS: Sorry for my englisch :-) -- View this message in context: http://freeradius.1045715.n5.nabble.com/groups-with-port-permissions-tp4300… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Radrelay and off-server accounting
by Etienne Pretorius 18 Apr '11

18 Apr '11

Hello List, I have a problem with radrelay and specifically the IPASS Realm. Attached is the dump of the freeradius -X run. This is the scenario: I have a server that is radrelaying packets to another server. But for some reason - specifically only the RADIUS realm - it tries to proxy the accounting request. I do not want it to attempt to proxy the accounting request to the IPASS server when it is radrelaying, as it should only store the packet details into sql. Can anyone perhaps give me an idea how to work around this issue. Kind Regards, Etienne Pretorius

2 4

re ip
by Clint Johnson 17 Apr '11

17 Apr '11

I have FreeRadius version 1.1.7. I am trying to change its IP and when I check the the sqltrace.sql log I see the old IP in there. So I need to change this through MYSQL as well. I have changed it in all the conf files that held the old IP in freeradius and freeradius-dialupadmin. Thanks

1 0

Running FreeRadius daemon in debug mode
by Mike Hale 17 Apr '11

17 Apr '11

Hi All, I'm running the latest yum version of freeradius2 on a 32bit CentOS 5.5 install. I'm using "service radius start" to launch the daemon. I'm trying to figure out how to use the service method to launch the process in debug mode. I can start it in debug mode when calling it from the command line just fine. I thought it might be as simple as modifying the radiusd script file in /init.d with the -x switch, but that causes errors. Does anyone have a working copy of the init.d script I could look at? Thank you in advance! - Mike

4 3