- Freeradius-Users - lists.freeradius.org

Is 2.1.3 sqlippool fast enough?
by Dave 11 Dec '08

11 Dec '08

(repost, was posted as part of wrong thread) I have had a number of problems with 1.1.7 and sqlippool that its simply not able to process more than 10-20 connections at any one time. I will upgrade to 2.1.3 if its capable of handing 50-80 connections at one time? Does any one know? My server is a p4 dual core 3.0ghz and its also handing some load of emails for about 200 accounts. I tried to optimize my mysql installation, etc num_server but I could never get it fast enough. Anyone know of tricks, or if 2.1.3 freeradius is any better? or should I be looking at some other way to hand out IPs? I really like the sqlippool way of doing things. Thanks!

2 1

wimax support
by Ying DONG 11 Dec '08

11 Dec '08

Hi, I am using the freeradius server 2.1.1 as the Radius server in the network to authenticate a wimax user. It seems that it could support the wimax VSA, since I found the dictionary.wimax in the dictionary directory. However, in my application, in the Access Accept message, the freeradius server Include the attributes of vendor-id 311 (microsoft), not having the expected attributes of wimax (such as MSK attribute). I want to how the radius server determine which dictionary it should use to response the incoming request? What I should do to make the freeradius server set the wimax specified attribute in the access-accept msg? Thanks ASTRI - Hong Kong Applied Science and Technology Research Institute tel:+852 <tel:+852> 3406 2918 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message (including any attachments) is for the named addressee(s)'s use only. It may contain sensitive, confidential, private proprietary or legally privileged information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. Any use, disclosure, copying, or distribution of this message and/or any attachments is strictly prohibited. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 6

How to configure RADIUS on 2 IP address Server
by Pongsak Tawankanjanachot 11 Dec '08

11 Dec '08

Hi, I'm setting up RADIUS server to use with Wireless network 1) RADIUS server is Debian (eth0=192.168.25.254 (support all local computer, Access point) and eth1=192.168.2.45 (to Internet) 2) Access Point is LinkSys WAP54G (192.168.25.75) 3) Client is Dell Inspiron with Intel Broadcom wireless network card. My setting RADIUS server has 2 network cards. They are I started installing, ,setting, running ./radiusd -X with default configuration. Everything seems find. Server is running. ================================================================== On Server terminal, I test with radtest test test localhost 0 testing123 Debug message shows up: Sending Access-Request of id 102 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Request packet from host *192.168.2.45 *port 36272, id=102, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 then it ends with Sending Access-Accept of id 102 to* 192.168.2.45* port 36272 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Accept packet from host 192.168.2.45 port 1812, id=102, length=38 radclient: received response to request we did not send. (id=102 socket 3) Sending Access-Request of id 102 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 My question is why the Access-Accept is to 192.168.2.45 (It should be 192.168.25.254??) I also try to use RTRadPing Test Utility from local computer-WinXP SP3 ( 192.168.25.142) asking Authentication Request to 192.168.25.254 RTRadPing says no response from server, timeout. Seems like my ./radiusd runs on *192.168.2.45* ?? (eth1) ================================================================== On Server terminal, I try again with radtest test test 192.168.25.254 0 testing123 Sending Access-Request of id 162 to 192.168.25.254 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Request packet from host 192.168.25.254 port 36275, id=162, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 then it ends with Sending Access-Accept of id 162 to 192.168.25.254 port 36275 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Accept packet from host 192.168.25.254 port 1812, id=162, length=38 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 ================================================================== Then, I kill ./radiusd start with ./radiusd -i 192.168.25.254 -p 1812 -X & (I start it in background mode, fix IP+Port) It ends with... radiusd: #### Opening IP addresses and Ports #### Listening on authentication address 192.168.25.254 port 1812 Listening on accounting address 192.168.25.254 port 1813 Listening on proxy address 192.168.25.254 port 1814 Ready to process requests. Seems like RADIUS is listening on 192.168.25.254..... :D ================================================================== On Server terminal, I test with radtest test test localhost 0 testing123 Sending Access-Request of id 103 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 *There is no response at all....* if I try with radtest test test 192.168.25.254 0 testing123 It ends with Sending Access-Accept of id 88 to 192.168.25.254 port 36277 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Accept packet from host 192.168.25.254 port 1812, id=88, length=38 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 It replies!! Seems like it is listening at eth0 192.168.25.254 port 1812 BUT when I use RTRadPing Test Utility from local computer-WinXP SP3 ( 192.168.25.142) asking Authentication Request to 192.168.25.254 RTRadPing says no response from server, timeout. What should I do next?? Somebody can suggest me? I think this is just the first step, then I need to install OpenSSL and test....a long way to go.. Best regards, Pongsak

2 1

Regarding Dynamic Vlan
by duraivelanc Chockalingam 11 Dec '08

11 Dec '08

Hi This is Durai Velan C, from India. I would like to know about the Free Radius Version that supports, "Dynamic VLAN Association" for an User that is getting authenticated from Radius Server. Here by, I would require the Free Radius Server Configurations document to aid the Same. Requirements. 1.) My Radius Server IP auth = 172.21.185.142, acct = 172.21.185.142 2.) User = alcatel , Domain = adilab.com 3.) User password = alcatel 4.) Authentication: 8021.X , through MD5-Challenge. If possible, kindly provide me the Radius Server COnfiguration for the above mentioned, details Your help on the same would be great Regards Durai velan C

2 1

FreeRadius and Ubuntu 8.10
by Matthew Carriere 11 Dec '08

11 Dec '08

I am also about to install FreeRadius, anyone have experience with installing on Ubuntu 8.10 Server 32 Bit? -- Matthew Carriere matthew(a)blackninjasoftware.com

3 3

RE: client certs
by Jason Wittlin-Cohen 11 Dec '08

11 Dec '08

Craig, Apparently Windows automatically sends non-CA certificates in DER or PEM format to the "Other People' certificate store. More importantly, the wireless supplicant in Windows XP \will not work with PEM or DER formatted client certificates. It'll complain that you have no certificate. You must convert to pkcs12 as the documentation states. openssl pkcs12 -export -in certname.pem \ -inkey keyname.key -out name.p12 -clcerts* * Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu (908) 420-0861

3 4

RE: client certs
by Jason Wittlin-Cohen 11 Dec '08

11 Dec '08

>server certs seem fine but generated client cert in Windows shows >"Windows does not have enough information to verify" and yes, I have >loaded the 'ca.der' file generated by the instructions on the Windows >client and that installs in 'Trusted Root Authorities'. The 'client' >cert seems to install in 'Other People', and does include the >XPextensions stuff. > >Craig Craig, You have to install the root certificate and client certificate to the correct certificate store. You have two options - the machine store or the personal certificate store of your current Windows user. The personal certificate store is probably what you want. Double click the client certificate, select "install certificate" and choose "Place the certificate in the following store". Select the "Personal" certificate store. That should solve your problem. Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

3 2

Which version?
by Just E. Mail 11 Dec '08

11 Dec '08

OK.. I am ready to install freeRADIUS!. I have setup a LINUX server with: CentOS 5.2 mySQL-server-5.0.25-7 I noticed that 2.1.3 is the latest freeRADIUS version. Does it work with the above OS & mySQL versions or I need to fall back to a previous version of freeRADIUS? I am pretty new and this is my first freeRADIUS installation! Sam

2 1

Does FreeRADIUS support PEAPv0/EAP-TLS?
by Jason Wittlin-Cohen 10 Dec '08

10 Dec '08

I'm attempting to setup PEAPv0/EAP-TLS which uses EAP-TLS as the inner authentication method within PEAP. Unlike EAP-TLS, PEAPv0/EAP-TLS sends the client certificate within the secure SSL tunnel, thus protecting the user's identity. While RFC-5216 suggests that EAP-TLS can optionally support a privacy mode in which the client certificate is pushed through the SSL tunnel, I've not found any way to enable this option. I have no particual interest in using PEAPv0/EAP-TLS other than the fact that I know it does what I want to accomplish. I would be perfectly happy to use EAP-TLS in Privacy mode, or PEAPv0/MSCHAPv2 with a required client certificate. However, both these modes pass the client certificate in the clear. Here's what my testing has shown: EAP-TLS: Works with both Windows XP Supplicant and Juniper Odyssey Access Client 4.8 PEAPv0/EAP-MSCHAPv2- Works with both Windows XP Supplicant and Juniper Odyssey Access Client 4.8 PEAPv0/EAP-MSCHAPv2 + Requierd Client Certificate- Works with Juniper Odyssey Access Client 4.8 (XP Supplicant doesn't support MSCHAPv2 + Certificate) PEAPv0/EAP-TLS- Fails on both supplicants I don't think my TLS settings are improper, as both EAP-TLS and PEAPv0/MS-CHAPv2 + Client Certifciate work fine. The debug logs shows the client certificate verified properly. I've tried pretty much every combination of PEAP options, and after each permutation I forced a reauthentication so that I could analyze the packets in Wireshark. No combination of settings forced the client certificate through the SSL tunnel. I thought " use_tunneled_reply = yes" might help, but it did not. I have pasted the relevant configuration settings below as well as a full log of the failure when I attempt to use PEAPv0/EAP-TLS. The relevant settings: Other than "default_eap_type = "tls" my settings are identical for PEAPv0/EAP-MSCHAPv2 which works fine. The failure log seems to suggest that "tls" is not a supported authentication mode within PEAP. [files] users: Matched entry DEFAULT at line 200 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} *rlm_eap: No EAP session matching the State variable.* *[eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request* [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [Jason Wittlin-Cohen] (from client Wireless port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE *PEAPv0/EAP-TLS Failure Log: *http://pastebin.com/m900e269 *PEAPv0/MSCHAPv2 Success Log:* http://pastebin.com/m16114697 *PEAPv.0/MSCHAPv2+Cert Success Log: *http://pastebin.com/m429d9c12 *EAP-TLS Success Log:* http://pastebin.com/m2b1c62f4 Relevant Settings: eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 3072 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server_key.pem" certificate_file = "/etc/freeradius/certs/server_cert.pem" CA_file = "/etc/freeradius/certs/cacert.pem" dh_file = "/etc/freeradius/certs/dh3072.pem" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "HIGH" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no peap { default_eap_type = "tls" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no modules mschap: Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Users: "DEFAULT" Cleartext-Password := "**************************************", EAP-TLS-Require-Client-Cert := Yes Note: (*'s represent a 32 character randomly generated password) Thanks in advance, Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

3 5

Programatically provision users to server.
by Matthew Carriere 10 Dec '08

10 Dec '08

Hi everyone, I am thinking of adding a FreeRadius server to an existing infrastructure in order to provision users through an application. I am currently running a WLAN controller connecting several access points. Currently users are added manually through the WLAN controller interface. Could I add a FreeRadius server and be able to programatically add users to it? I need to be able to do this through a Ruby on Rails application. I am thinking I would have to either: 1. Use some sort of API 2. Run a script that uses a command line interface Your thoughts and suggestions on this architecture would be appreciated. Thanks Matthew.

5 16