- Freeradius-Users - lists.freeradius.org

What does a good example look like
by Huckle Berry 07 May '10

07 May '10

Hello again, I have a few questions that may or may not be related to each other. First, I know radtest works fine for testing the basic functions of freeradius (i.e. it will authenticate with no encryption) but I would like to know if radtest can be used to test authentication using one of the various types of encryptions and protocols. Question two has to do with said protocols. Is there a clear and concise page that will define all of the protocols (PEAP, EAP, TLS, TTLS, MSCHAP, MSCHAPv2, LEAP, WPA(1/2)-PSK, etc) how they differ from each other and what exactly happens during the authentication process. Illustrations would be nice. Question three: I have come to conclude that some protocols are the same thing with different names, can anyone clarify which protocols are the same or are at least compatible, and which are different? Lastly, what does a successful authentication look like for each type of protocol. What should I be looking for in my freeradius output, and what can I compare it too. Possibly if I saw where stuff was going haywire I could determine for myself what the issue is. ~Huckle Berry

3 3

is there a package named phpmysql
by dorra aa 07 May '10

07 May '10

Hi.i'm working now in the install of mysql for the radius.I found a file that tell me to do: sudo apt-get install mysql-server phpmysql vim-full But i got: E: Impossible de trouver le paquet phpmysql (that means impossible to found phpmysql) is there a package called like that; or the file is wrong?? thank _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

3 4

Sila Sujjinanont is out of the office.
by Sila Sujjinanont 06 May '10

06 May '10

I will be out of the office starting 06/05/2010 and will not return until 09/05/2010. I will respond to your message when I return.

1 0

Freeradius + mysql + openssl certificates?
by shirkavand 06 May '10

06 May '10

Hi, Can i use freeradius + mysql + ssl certficates at the same time for autenticating users...or this does not make sense? I am a bit confused if i have to use one of them(mysql or ssl certificates) for autentication purposes. I have read tutorials for using freeradius + mysql OR freeradius + ssl certificates. In "freeradius + mysql" tutorial explains how to make the autentication using mysql... so the passwords and users are all stored inside a mysql db. In the other hand the freeradius + ssl certificates explains how to make the autentication using a file called "users" that stores all the users and paswords. So i am wondering if i can not make the radius server autenticate users using the credential fino from the mysql Db and using certificates too..or if each one are different methods to use. Any ideas? Cheers

2 1

radiusd does not logging while debug
by kes-kes＠yandex.ru 06 May '10

06 May '10

Hi, FreeRadius. How to force radiusd -X to do logging to log file too? -- mailto:kes-kes@yandex.ru

4 3

bug in 'man radiusd'
by Коньков Евгений 06 May '10

06 May '10

Hi, FreeRadius. >> -X Debugging mode. Equivalent to -sfxx -l stdout but man does not descrite -l option at all. -- mailto:kes-kes@yandex.ru

2 1

plz help me: access-reject
by dorra aa 05 May '10

05 May '10

Hi. im used freeradius 2.1.8. Please can somebody give me an example of configuration of files to do na simple test with radiusd -X. because i'm testing now a local client and the result is reject. I modify onlu users and clients.conf.is that anought? 1/I add on Users: "sonia" Auth-Type := Local, User-Password == "salut" Reply-Message = "Hello, %u", Reply-Message = "are you fine, %u" I'm also trying another exemple: "sonia" Cleartext-Password := "salut" Reply-Message = "Hello, %u", Reply-Message += "are you fine, %u" 2/And i add on Clients.conf: client 127.0.0.1 { secret = testing123 # notre clé partagée shortname = class nastype = other } when i do this command, i have: pfe@pfe-laptop:~$ sudo radtest sonia salut 127.0.0.1:1812 1812 testing123 Sending Access-Request of id 11 to 127.0.0.1 port 1812 User-Name = "sonia" User-Password = "salut" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=11, length=20 3/The result of output radiusd -X is: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38590, id=135, length=57 User-Name = "sonia" User-Password = "salut" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sonia", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sonia attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 135 to 127.0.0.1 port 38590 Waking up in 4.9 seconds. Cleaning up request 0 ID 135 with timestamp +153 Ready to process requests. What is the problem please Can you help me whith a clear example tahnk you _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

3 6

openssl
by ds14.kornel 05 May '10

05 May '10

hi I'm starting with linux and freeradius with peap configuration. I'm using debian lenny 2.6.26-2-686, when runnig freeradius -X (FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34) i'm getting those errors Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5* rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support.* Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } *rlm_eap: No such sub-type for default EAP type peap* /etc/freeradius/eap.conf[1]: Instantiation failed for module "eap" /etc/freeradius/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/freeradius/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } *Errors initializing modules* how should i install openssl ?? only compilation by hand will work here ?? Can anybody give needed advice please? Thanks a lot for help! :) Kornel

6 8

Re: R: rlm_ippool: No available ip addresses in pool
by Tabacchiera Stefano 05 May '10

05 May '10

>> Ok, you're right, but in my case I know the client session can't last more than 24hrs. >> So, for me it's ok to remove all *inactive* entries older than that. >> >> But, as far as I know, this seems to be impossible with gdm pool. >> So, what the "maximum_timeout" parameter is useful for ??? > It sets the timeout when entries are expired. Your tests (so you say) >don't go for 24 hours... so that timeout doesn't apply. Alan, that's wrong. I've done my tests with an ad-hoc pool, with maximum_timeout set at 10 secs. And the results I posted came from a new test session done the day after the first test. (24 hrs >> 10 secs) Why that timeout doesn't apply? >> So I need a method to avoid my pool being filled up by missing acct-stop. > You were told a method which should work. Try it. Surely I'll switch to sql pool, but what I observe is that dbm pool are useless, if I can't set a timeout *that works* on that. ST ______________________________________________________________________________________ La presente comunicazione ed i suoi allegati e' destinata esclusivamente ai destinatari. Qualsiasi suo utilizzo, comunicazione o diffusione non autorizzata e' proibita. Se ha ricevuto questa comunicazione per errore, la preghiamo di darne immediata comunicazione al mittente e di cancellare tutte le informazioni erroneamente acquisite. (Rif. D.Lgs. 196/2003). Grazie This message and its attachments are intended only for use by the addressees. Any use, re-transmission or dissemination not authorized of it is prohibited. If you received this e-mail in error, please inform the sender immediately and delete all the material. (Rif. D.Lgs. 196/2003). Thank you.

2 1

thx 4 openSSL & one more question
by ds14.kornel 05 May '10

05 May '10

Hi Thanks for last advices with freeradius installations + peap on debian lenny Now i have no problem with enabling peap :) this time I'm asking for help with some other problem: I'm trying to enable WPA2 enterprice authentication on my accesspoints. When trying to auth my wireless client I'm getting sth like this in log : Wed May 5 15:09:25 2010 : Auth: Login incorrect: [karol/<no User-Password attribute>] (from client AP1 port 0 cli 0022431380c4) where : 0022431380c4 is my wireless mac adress (laptop) client AP1 is my Access Point client from clients.conf karol - is my user from users.conf it looks like freeradius don't want to look inside the password field and can't recognize a laptop ip (getting mac) Please give me some advices - what's next ? Here is my debug. Kill-9:/home/kornel# freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 3 2010 at 15:51:52 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = yes dead_time = 120 wake_all_if_all_dead = no } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } * client 172.16.0.16 { ----------------------Client ip adress* require_message_authenticator = no secret = "tajne1234" shortname = "eee" } * client 192.168.10.50 { ----------------------AP ip adress* require_message_authenticator = no secret = "tajne1234" shortname = "AP1" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. *AND here is an authenticate attempt debug* rad_recv: Access-Request packet from host 192.168.10.50 port 2054, id=148, length=169 User-Name = "karol" * NAS-IP-Address = 192.168.10.50 ----------------------AP ip adress* NAS-Port = 0 * Called-Station-Id = "00265abab28d" ----------------------AP mac adress Calling-Station-Id = "0022431380c4" ----------------------Client mac adress* NAS-Identifier = "Realtek Access Point. 8186" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000b016d617263696e Message-Authenticator = 0x2ea50a302a451ed3b32b748a23fe00e3 WARNING: Empty section. Using default return values. No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [karol/<no User-Password attribute>] (from client AP1 port 0 cli 0022431380c4) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 148 to 192.168.10.50 port 2054 Waking up in 4.9 seconds. Client's system is eeebuntu and i'm sure that's on client and on AP everything is ok because when i'm connecting to another freeradius server - it's working fine (unfortunatelly i don't have an acces to those confs) in addition - temporarily I accepted all connections from those two ip's on my firewall to have 100% sure that's not a connection issue. Thank you for your time and knowledge share. -- LAN Administrator of DS14 Kornel Kornatka room 529

2 1