- Freeradius-Users - lists.freeradius.org

EAP-TLS: restricting CA certificate use to a subset of identities
by Edgar Fuß 28 Jun '10

28 Jun '10

Whein using EAP-TLS, is there any sane way of restricting the use of a CA Certificate to a subset of the possible identities? I.e., is it possible to configure a single FreeRADIUS 2 server to accept users @foo.my.domain only if their Certificates are signed with CA-Cert.foo and users @bar.my.domain only if theirs are signed with CA-Cert.bar? It looks a bit tough because (if I got it right) eap.conf doesn't use unlang and no information whatsoever from the CA Certificate used for verification is available as an attribute. Alternatively, is it possible to log the name of the CA certificate on successful login? So that even if the logged user identity is user(a)foo.my.domain the log shows that the user cert was actually issued by bar.my.domain. Thanks for any hints.

2 3

Invalid NT-key issue
by John 28 Jun '10

28 Jun '10

Hi all, We are using freeRADIUS (1.1.6) + samba (3.3.3) talk to multiple ADs. Sometimes ntlm_auth got invalid NT-key. It should be a samba issue. Which samba version is good? I googled this issue, Someone has the same problem https://bugzilla.samba.org/show_bug.cgi?id=6563 HJ

2 1

Acc-Session-Id Question
by JOE 28 Jun '10

28 Jun '10

Hi all! In radius schema, the RADACCT table specifies that field ACCTSESSIONID is NOT NULL. Actually a have a NAS that not sends this attribute on Accounting Request and the update RADACCT table fails. The question I have is if this attribute is required to comply with RFC or otherwise use is optional. Regards

2 1

can freeradius support l2tp/ipsec?
by Spacelee 28 Jun '10

28 Jun '10

maybe it's not freeradius's problem, but do you have any experience with l2tp/ipsec...I didn't find any solution valuable... -- Spacelee

1 0

howto start one connection and start another one?
by Spacelee 28 Jun '10

28 Jun '10

it seems in dialup.conf, I can't change the settings to automatically stop user's one connection and start another when he dialup on his another system, the simu was set equal to 1 -- Spacelee

2 3

PEAP - AD Disabled
by Nathan McDavit-Van Fleet 27 Jun '10

27 Jun '10

Okay, I've had a working config with the following for the past month. TTLS->LDAP PEAP->AD PEAP->Local Users File After a month running everything perfectly, 3 days ago the "PEAP-AD" portion of the AAA failed. This is for wireless auth. Strangely, I can still auth from the CLI using ntlm_auth and wbinfo. So it appears as if the Samba connection to the AD is fine. Nothing has changed config wise between then and now, and I haven't found any interesting log information. You just get a "Login incorrect" when you try to login via PEAP->AD. Everything else is verified as working. Aside from Freeradius itself, what are the differences between using ntlm_auth via CLI and via Freeradius? Nathan Van Fleet Telecommunications Analyst Network Assessment and Integration IITS Concordia University (514) 848-2424 Extension:5434

4 4

about simultaneous when using mysql and freeradius
by Spacelee 27 Jun '10

27 Jun '10

i want to limit user's behavior, such as a username can login only once at the same time... 1、modifiy default and inner-tunnel in # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { #radutmp # See "Simultaneous Use Checking Querie" in sql.conf sql } 2、modify dialup.conf in etc/raddb/sql/mysql # Uncomment simul_count_query to enable simultaneous use checking simul_count_query = "SELECT COUNT(*) \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" 3、add a entry to the table radgorucheck INSERT INTO `radgroupcheck` ( `id` , `GroupName` , `Attribute` , `op` , `Value` ) VALUES ( NULL , ’user’, ’Simultaneous-Use’, ’:=’, ’1’ ); 4. update the user "test" to the group "user" i finally tried successfully, but if , i say if the radius server was down suddenly or the user logout improperly(such as he poweroff the computer directly). then the record will still be record in the table as he was still online ...so we need to modify the record, but how to ? can freeradius judge it by itself, or how to judge the user if offline ? -- Spacelee -- Spacelee

4 7

chroot
by Mike Hammett 26 Jun '10

26 Jun '10

I read the appropriate section in radiusd.conf, but I don't know what needs to be in whatever folder I'm pointing the config to. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com

2 1

Help connecting to remote ldap server
by Raymond Norton 25 Jun '10

25 Jun '10

I successfully configured freeradius (version 1.x Ubuntu) to use ldap on a localhost via WPA. I am trying to setup version 2.1 (Ubuntu) to use a remote ldap server now. The module loads fine and I made what I believed were the correct changes to connect to the remote server, but I have missed something. Is there a good doc for ldap authentication on a remote host? Raymond

7 31

EAP issue
by David Peterson 25 Jun '10

25 Jun '10

I am having EAP issues with MSCHAPv2 packets. Does this output point to misconfiguration of FR or a NAS issue or both? Fri Jun 25 10:42:30 2010 : Info: ++[pap] returns noop Fri Jun 25 10:42:30 2010 : Info: Found Auth-Type = MSCHAP Fri Jun 25 10:42:30 2010 : Info: +- entering group MS-CHAP {...} Fri Jun 25 10:42:30 2010 : Info: [mschap] Told to do MS-CHAPv2 for 0010E741540D(a)WiMax.com with NT-Password Fri Jun 25 10:42:30 2010 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Fri Jun 25 10:42:30 2010 : Info: ++[mschap] returns reject Fri Jun 25 10:42:30 2010 : Info: Failed to authenticate the user. } # server inner-tunnel Fri Jun 25 10:42:30 2010 : Info: [ttls] Got tunneled reply code 3 Framed-Filter-Id = "SP=sp1:MSF=msf1;" Session-Timeout = 4200 MS-CHAP-Error = "LE=691 R=1" Fri Jun 25 10:42:30 2010 : Info: [ttls] Got tunneled Access-Reject Fri Jun 25 10:42:30 2010 : Info: [eap] Handler failed in EAP/ttls Fri Jun 25 10:42:30 2010 : Info: [eap] Failed in EAP select Fri Jun 25 10:42:30 2010 : Info: ++[eap] returns invalid David

2 1