- Freeradius-Users - lists.freeradius.org

FreeRadius web GUI
by Keith Beeby 06 Dec '10

06 Dec '10

Hi, Could anyone recommend the best web based management for FreeRADIUS 2.x? Is there a Webmin module? Thank you Keith

2 1

Fall-Back Group
by Jay Dorado 06 Dec '10

06 Dec '10

Hi, I am trying to work on something which is to provide a user 100Mb per month and if the user exceeds the quota before the month end I want it to be configure in such a way that the user can still access the internet with 2hrs of internet access daily. Has anyone come across such configuration? -- Regards, Jay

1 0

FR proxy to ACS and NPS with MS CHAP v2
by SagiBarOr 05 Dec '10

05 Dec '10

We are developing a security scheme in which we use EAP TTLS MS CHAP v2 with Proxy. The TTLS phase is done with the first AAA server, and the second step, with MS CHAP v2, is proxied to another AAA (which is an LDAP server). When the first AAA server is FR and the second one is also FV, then authentication is OK. When the second AAA server is ACS (Cisco) or NPS (MS), the MS CHAP v2 authentication fails. We preformed troubleshooting and elimination testing which indicate the issue is with the pwd. Not with the user name. For example it also fails with the local DB of the 2nd AAA server. Also the verbose error log shows the user account is found. Looks like something is wrong with the pwd hash. will most appreciate your expert opinion. Thnks Sagi -- View this message in context: http://old.nabble.com/FR-proxy-to-ACS-and-NPS-with-MS-CHAP-v2-tp29132664p29… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 31

Meraki Access Points Login incorrect for SHA-Password
by danodemano 04 Dec '10

04 Dec '10

Alright, I'm going to try my best to explain what's going on here. I have a Meraki wireless access point I am trying to get configured to work with RADIUS. I have my freeradius server up and running with two other access points just fine. However, I cannot get it to work right with the Meraki one. It's set up to us MySQL for all the authentication and such and as I mentioned it works fine with the other two access points. However, when the Meraki access point tries to authenticate using SHA-Password credentials in the MySQL database I get a Login incorrect. Here is a bit from the radius log file: Sat Dec 4 09:21:54 2010 : Auth: Login OK: [testing] (from client Meraki port 0 via TLS tunnel) Sat Dec 4 09:21:54 2010 : Auth: Login OK: [testing] (from client Meraki port 0 cli 00-00-00-00-00-02) Sat Dec 4 09:22:24 2010 : Auth: Login incorrect: [test2] (from client Meraki port 0 via TLS tunnel) Sat Dec 4 09:22:24 2010 : Auth: Login incorrect: [test2] (from client Meraki port 0 cli 00-00-00-00-00-02) Both users are in the MySQL database, the only difference is the 'testing' has a 'Cleartext-Password' while the 'test2' user has an 'SHA-Password' If I try to use the 'test2' user from command line with a radtest it works fine: Sat Dec 4 09:23:28 2010 : Auth: Login OK: [test2] (from client localhost port 10) It also works correctly with my Untangle box: Sat Dec 4 09:29:23 2010 : Auth: Login OK: [test2] (from client Untangle port 0) I contacted Meraki about it and among other things they said: "It may be failing because your RADIUS server policy is configured to use the EAP-TLS authentication method and our test simulates a supplicant using PEAP-MSCHAPv2." Honestly I know very little about freeradius. I have set it up using some how-to guides on the Internet and it seems to be functioning correctly for the other two access points. The record in the 'nas' table for the Meraki access point is identical to the records for the other access points other than the IP/shortname. I have made copies of (I think) all the used config files if that's helpful. You can find them all here: http://dbunyard.homeip.net/stuff/raddb/ http://dbunyard.homeip.net/stuff/raddb/ Any help in configuring this would be greatly appreciated! If you need any additional information or logs let me know. Thanks! -- Dan -- View this message in context: http://freeradius.1045715.n5.nabble.com/Meraki-Access-Points-Login-incorrec… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

PEAP/TTLS and Client certificates
by rdeboer 04 Dec '10

04 Dec '10

Hello, I want to set up a radius server which authenticates users only once they provide their username, password AND client certificate. Now, I've managed to get this to work, my only problem is that as TTLS and PEAP use TLS, the TLS module must be enabled and configured. By doing so, users can also log in with just a client certificate. My real question here is: Is it possible to somehow force everyone to use PEAP or TTLS with a client certificate, while rejecting users trying to connect purely through TLS with only a client certificate? Kind regards, Remy -- View this message in context: http://freeradius.1045715.n5.nabble.com/PEAP-TTLS-and-Client-certificates-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

Again: clients.conf storage in ldap
by Michal Bruncko 04 Dec '10

04 Dec '10

Hello list, I have found one old discussion in freeradius maillist about storing RADIUS clients definitions in LDAP. That discussion is from date 23 Nov 2004 and is in following link: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg11425.… I want to ask what is the status of integrating clients.conf in LDAP storage now, four years later from that discussion? This integration is interesting and makes the configuration more centralized. thanks michal -- Ing. Michal Bruncko, CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic

5 4

radclient: no response
by Jorge L. Herrera 04 Dec '10

04 Dec '10

Hello! In the file users add the user jorge Auth-Type := Local , User-Password == "jorge" place the following command :~$ radtest jorge jorge localhost 1812 testing123 and the result is Sending Access-Request of id 19 to 127.0.0.1 port 1812 User-Name = "jorge" User-Password = "jorge" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=19, length=2 ------------------------------------------------------------------------------------------------------------- After add the user 00- 07 -E9- C7 -51- 89 Auth-Type := Local , User-Password == "mac" note this is a mac address 00- 07 -E9- C7 -51- 89 :~$ radtest 00- 07 -E9- C7 -51- 89 mac localhost 1812 testing123 and the result is Sending Acces-Request of id 208 to 127.0.0.1 port 1812 User-Name = " 00- 07 -E9- C7 -51- 89" User-Password = "mac" Nas-IP-Address = 127.0.1.1 Nas-Port = 1812 Framed-Protocol = PPP radclient: no response from server for ID 208 socket 3 help to solve the problem

1 0

RE: Freeradius-Users Digest, Vol 68, Issue 22
by Nancy Flores Arevalo 04 Dec '10

04 Dec '10

Hello Nesite help I am working with a FreeRADIUS server 2.10.1 Ubuntun in an operating system 10 and I need to know syntax or command as I use to incorporate customer a Linksys WAP54G Access Point Model Thanks !!!!!!!!!!!!! I await your reply !!!!!!!!!!!!!!!!!!

1 0

Ayuda
by Horacio Andrade Zepeda FELIZZZZZZ 04 Dec '10

04 Dec '10

Hello friend first of all I send you greetings know I am a good novice at this I need your help because I see you are very advanced in this case I desarrolladon a practice school in Freeradius-Server Server at Vercion 2.10.1 I have to make only the MAC authentication for users but my questions is the MAC addresses are enlisted in the Users file that is located in the directory / usr / local / etc / raddb / users if ay where you register the MAC address? with which to command or syntax or only modified the file with the via Appreciate your support Thank your server My mail in which I am at your command is Horacio-21(a)hotmail.com Thanks !!!!!!!!!!!!

1 0

LDAP_OPT_X_TLS_REQUIRE_CERT error on 1.1.7-3.1
by Joe Friedeggs 03 Dec '10

03 Dec '10

I am seeing the following error messages in the radius.log: Fri Dec 3 19:29:48 2010 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to demand Everything seems to be working. I am running freeradius.i386 1.1.7-3.1.fc6 that I downloading from rpm.pbone.net. I find some old Red Hat posts where this was an issue in 1.1.3 (Bug 287381 ). Any ideas? Is this a real issue, or just a bogus log? Thanks, John

2 1