- Freeradius-Users - lists.freeradius.org

EAP-TTLS,SecureW2 issue
by Philippe Schwarz 24 Jun '10

24 Jun '10

Hi, I've built a FR-2.1.3 (with rlm ldap) on OpenBSD, with credentials on a OpenLDAP (2.3.30-5+etch3), using EAP-TTLS. Everything, 's working fine with Iphone,Linux &MacOS. But with Windows (XP, Vista & 7), i'm unable to get the SecureW2 (v3.3.3.) client connecting. 1. Downloaded locally both the CA & Radius .der certificates 2. Installed both of them of local computer. 3. Add both (and also tried only radius cert, or no cert at all) certs to SecureW2. But Always got : "Received an invalid server certificate, please verify your certificate configuration" response from the software. All the steps (in french) : http://www.openbsd-edu.net/index.php/FreeRadius Found almost nothing usable either on the Securew2 website or on the goggled links... If anyone had an idea.. Thanks. -- Lycée Alfred Nobel, Clichy sous Bois http://www.lyceenobel.org

2 1

Am I going to cause a problem with this config setup?
by Tom Leach 24 Jun '10

24 Jun '10

I'm trying to configure Freeradius to use LDAP (which is working), but I need to mix PAP and CHAP. I have a wireless web-auth that uses PAP and is sending the cleartext password (tunneled via TLS) to the LDAP database that contains the encrypted (SSHA) user passwords. I also have switches that only do CHAP but for those, I'm only going to do MAC-auth so I've set up a separate database (same LDAP server, different basedn) that contains cleartext passwords (the MAC address) for each MAC that is authorized for the switch. I know it's not the best access control, but better then none. I've set up 4 ldap modules, two different basedn's on two redundant servers. This appears to work so far, but am I missing something here that's going to cause problems down the line??? Here are the authorize and authenticate sections of default, I haven't removed mschap, suffix, eap, unix or files, but none of them _should_ be used.: authorize { preprocess auth_log chap mschap suffix eap { ok = return } unix files redundant-load-balance { ldap-server1-radius ldap-server2-radius } redundant-load-balance { ldap-server1 ldap-server2 } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { redundant-load-balance { ldap-server1 ldap-server2 } } eap }

2 1

Re: speed of detail reader server
by Alexandru Oprisan 24 Jun '10

24 Jun '10

On 23.06.2010 10:07, freeradius-users-request(a)lists.freeradius.org wrote: > On Mon, Jun 21, 2010 at 07:48:19PM +0300, Alexandru Oprisan wrote: >> > I'm using freeradius 2.1.6 on gentoo to do decoupled accounting. >> > I have everything set up, the only problem seems to be the speed of >> > the 'detail reader server'. I do quite a lot off accounting packets on >> > the box ( no auth ), the detail writer has already written 1.9G of >> > details ( in about 5 hours ) to hourly files, but the detail reader is >> > lagging far behind (still working on the first file). I only see about 1 >> > row inserted per second, but I know the server can do far more. >> > I have set load-factor to 100, doesn't seem to help. > The detail reader is serial in nature, meaning it will read a packet, > transmit it, and wait for a response. Upon receipt of an ack it will > repeat for the next packet. If you have any sort of latency on your > link you can easily get heavily backlogged. > > We ended up implementing a proxy in between the detail file reader and > the remote end; the proxy (a custom Perl script) transmits across > several sockets, which the remote end seems to be able to deal with > properly. This has alleviated any backlog. > > I have grand plans to modify the reader to transmit non-serially, but so > far have not had the tuits to apply to the problem. I'm not sure I would > recommend the proxy solution, but if you can manage it, it may be a > reasonable stop-gap. > I have worked around the problem by compiling freeradius 2.1.7. I noticed in the release notes for 2.1.7 the following bug fix: Allow detail file reader to be faster when "load_factor = 100" It seems to work perfectly, the detail reader caught up with the detail writer in just a few hours. The reason I had not compiled 2.1.7 previously is that it does not compile in gentoo ( using emerge ) unless you add the "threads" USE flag ( which I didn't know ) Thanks for your answer. Alex

1 0

Re: Freeradius-Users Digest, Vol 62, Issue 96
by Alexandru Oprisan 24 Jun '10

24 Jun '10

On 23.06.2010 10:07, freeradius-users-request(a)lists.freeradius.org wrote: > On Mon, Jun 21, 2010 at 07:48:19PM +0300, Alexandru Oprisan wrote: >> > I'm using freeradius 2.1.6 on gentoo to do decoupled accounting. >> > I have everything set up, the only problem seems to be the speed of >> > the 'detail reader server'. I do quite a lot off accounting packets on >> > the box ( no auth ), the detail writer has already written 1.9G of >> > details ( in about 5 hours ) to hourly files, but the detail reader is >> > lagging far behind (still working on the first file). I only see about 1 >> > row inserted per second, but I know the server can do far more. >> > I have set load-factor to 100, doesn't seem to help. > The detail reader is serial in nature, meaning it will read a packet, > transmit it, and wait for a response. Upon receipt of an ack it will > repeat for the next packet. If you have any sort of latency on your > link you can easily get heavily backlogged. > > We ended up implementing a proxy in between the detail file reader and > the remote end; the proxy (a custom Perl script) transmits across > several sockets, which the remote end seems to be able to deal with > properly. This has alleviated any backlog. > > I have grand plans to modify the reader to transmit non-serially, but so > far have not had the tuits to apply to the problem. I'm not sure I would > recommend the proxy solution, but if you can manage it, it may be a > reasonable stop-gap. > I have worked around the problem by compiling freeradius 2.1.7. I noticed in the release notes for 2.1.7 the following bug fix: Allow detail file reader to be faster when "load_factor = 100" It seems to work perfectly, the detail reader caught up with the detail writer in just a few hours. The reason I had not compiled 2.1.7 previously is that it does not compile in gentoo ( using emerge ) unless you add the "threads" USE flag ( which I didn't know ) Thanks for your answer. Alex

1 0

howto stop one connection and start another
by Spacelee 24 Jun '10

24 Jun '10

i use pptp and freeradius2+mysql the situation is : there is a user it set to be Simultaneous-Use := 1 when he login in his ipad, he watch some movie, then he want to login in his iphone, how can i stop his original connection and start another connection in freeradius? -- Spacelee

1 0

freeradius 2.1.8, eap-tls with 3Com AccessPoint
by Phanuphong Thipsuk 24 Jun '10

24 Jun '10

Hi, I've installed freeradius 2.1.8, eap-tls with 3Com Access point (3CRWE454G72). It's work fine. Unfortunately, window xp client have been disconnected/reconnected many time per day. and sometime, during it's trying to connect, I will see windows popup request the certificate as well. anyway, i just choose the right certificate, it gonna work normally. Do you have any idea ? Thank you, maxx

1 0

freeradius Kerberos config in users file ?
by Riccardo Veraldi 23 Jun '10

23 Jun '10

Hello, I have just a question. if I configure freeradius2 with krb5 authentication and I use the following users file, the authentication works using radtest DEFAULT Auth-Type := Kerberos but it fails using EAP (EAP-TTLS) telling USer-PAssword attribute is missing... rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: Attribute "User-Password" is required for authentication. ++[krb5] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> veraldi(a)cnaf.infn.it attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 95 to 192.168.252.17 port 1645 Waking up in 2.9 seconds. if I instead use the following users file: DEFAULT Auth-Type = Kerberos both radtest and EAP authentication works, and thtat's good, but why ? thanks Rick

2 2

freeradius Kerberos config in users file ?
by Riccardo Veraldi 23 Jun '10

23 Jun '10

Hello, I ahve jsut a question. if I configure freeradius2 with krb5 authentication and I use the following users file, the authentication works using radtest DEFAULT Auth-Type := Kerberos but it fails using EAP (EAP-TTLS) telling USer-PAssword attribute is missing... rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: Attribute "User-Password" is required for authentication. ++[krb5] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> veraldi(a)cnaf.infn.it attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 95 to 192.168.252.17 port 1645 Waking up in 2.9 seconds. if I instead use the following users file: DEFAULT Auth-Type = Kerberos both radtest and EAP authentication works, and thtat's good, but why ? thanks Rick

1 0

speed of detail reader server
by Alexandru Oprisan 23 Jun '10

23 Jun '10

Hello, I'm using freeradius 2.1.6 on gentoo to do decoupled accounting. I have everything set up, the only problem seems to be the speed of the 'detail reader server'. I do quite a lot off accounting packets on the box ( no auth ), the detail writer has already written 1.9G of details ( in about 5 hours ) to hourly files, but the detail reader is lagging far behind (still working on the first file). I only see about 1 row inserted per second, but I know the server can do far more. I have set load-factor to 100, doesn't seem to help. What can I do? Alex Oprisan

4 4

setting freeradius2 to AD authentication
by Riccardo Veraldi 22 Jun '10

22 Jun '10

Hello, configuring freeradius2 to authenticate using AD as described by Enrik http://archives.free.net.ph/message/20060104.153134.68c5be76.en.html should it work with PEAP also ? or it works only eith EAP-TTLS ? The method is different from the one reported in the freeradius wiki http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO which uses ntlmauth instead and works with PEAP too. thanks Rick

2 2