- Freeradius-Users - lists.freeradius.org

Question about the random file
by Jason Wittlin-Cohen 09 Dec '08

09 Dec '08

I'm currently using EAP-TLS with 3072 bit RSA certificates and a 3072 bit DH paramters. Currently I'm using the random file produced by the bootstrap script which appears to take 10 bytes of data from /dev/urandom. Is this sufficient with the larger keysize I am using? In addition, many howtos suggest using /dev/urandom directly. Is this a good idea? Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

2 1

Disabling accounting logging (FreeRADIUS 1.1.4)
by Ciaran O'Rourke 09 Dec '08

09 Dec '08

Hello We're running FreeRADIUS 1.1.4 on OpenBSD 4.0. We've implemented a proprietary RLM that we use to manipulate auth and accounting packets before proxying them to a central RADIUS server. Diskspace on the host running FreeRADIUS is limited in size (deliberately). My question is: is there a way to completely disable accounting logging? I've tried commenting out the entire contents of the accounting section in radiusd.conf (including the 'detail' and 'daily' entries), but this results in accounting responses not being sent by the server (as if an empty accounting section disables handling of accounting responses). Thanks.

2 1

EAP-AKA
by Fernando 09 Dec '08

09 Dec '08

Hi all, I'm trying to configure EAP-AKA using EAP2, where do I insert the quintets?.. in the same way as EAP-SIM? Thanks, Fernando.

1 0

need help on Access Reject
by Do Nguyen Ha 09 Dec '08

09 Dec '08

Hi all is there a way to insert the attribute h323-return-code = 2 in the Access Reject message i use the FreeRadius 1.1.7, Could you give me some advices Thank you Ha`

2 1

RE: Does FreeRADIUS support PEAPv0/EAP-TLS?
by Jason Wittlin-Cohen 09 Dec '08

09 Dec '08

I forgot to mention that I'm running FreeRADIUS 2.1.0 on Ubuntu 8.10 (2.1.0+dfsg-0ubuntu2 to be exact). As the original binary didn't come with SSL support, I recompiled it using the Ubuntu source package. The client computer I have been testing run Windows XP SP3. Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu (908) 420-0861

1 0

Re: Is FreeRADIUS 2.1.1 capable of handling NAI decorations
by tnt＠kalik.net 08 Dec '08

08 Dec '08

>The problem is that all my subsequent queries suppose the Attribute >User-Name to be utenteA(a)nap.com instead of {am=1}utenteA(a)nap.com so I >keep getting null result set from the Oracle DB since there aren't >entries for {am=1}utenteA(a)nap.com in the DB. A possible solution could >be making the sql module to use Stripped-User-Name instead of the User- >Name for the queries but I was looking for a solution that doesn't >involve the code. > Just change sql_user_name definition you are using in raddb/sql/oracle/dialup.conf. The one using Stripped-User-Name is commented out by default. Ivan Kalik Kalik Informatika ISP

1 0

Re: Is FreeRADIUS 2.1.1 capable of handling NAI decorations
by Luca Adamo 08 Dec '08

08 Dec '08

Thank you for the quick reply. I've tried this solution but the results are not what I expected. In fact i defined the following realm module: realm wimax_decorator { format = prefix delimiter = "}" ignore_default = no ignore_null = no } and i make FR to call it during authorize phase. The client show up with this NAI {am=1}utenteA(a)nap.com and the module output (from radiusd -X) is the following. . . [wimax_decorator] Looking up realm "{am=1" for User-Name = "{am=1}utenteA(a)nap.com "; [wimax_decorator] Found realm "DEFAULT" [wimax_decorator] Adding Stripped-User-Name = "utenteA(a)nap.com"; [wimax_decorator] Adding Realm = "DEFAULT" [wimax_decorator] Authentication realm is LOCAL. . . The problem is that all my subsequent queries suppose the Attribute User-Name to be utenteA(a)nap.com instead of {am=1}utenteA(a)nap.com so I keep getting null result set from the Oracle DB since there aren't entries for {am=1}utenteA(a)nap.com in the DB. A possible solution could be making the sql module to use Stripped-User-Name instead of the User- Name for the queries but I was looking for a solution that doesn't involve the code. Am i making any mistake above? Any other ideas? Thank you, Lu Il giorno 02/dic/08, alle ore 16:28, A.L.M.Buxey(a)lboro.ac.uk ha scritto: > 1) set 'prefix' to be } > > with this, anything before and including } > (which may never appear as a realm or username) > would be treated like a NT domain and be stripped > off logically

2 1

per_socket_clients usage
by John Center 07 Dec '08

07 Dec '08

Hi, I'm in the process of upgrading from v1.1.6 to v2.1.3, & I've been reviewing the 2.1.3 config files. I don't understand the purpose of the per_socket_clients config item in radiusd.conf. I think I understand how this is configured, but what is this used for? What benefits does this provide? Is it for security, server resources, etc? Thanks. -John -- John Center Villanova University

2 1

please help !!!! =/ -> freeradius + mysql with encrypted MD5
by Diogo Teixeira 07 Dec '08

07 Dec '08

Hi people, I'm Portuguese student ! I have a big problem to solve. I have my freeradius, thats authenticates users by mysql database. I have passwords encrypted with MD5, but when i test, the Login is always Incorrect ! If password is clear, the freeradius works OK ! In the attachment i put my config files. My only query to create "new user" is: *INSERT INTO radcheck (username, attribute, op, value) VALUES ('5','MD5-Password', '==', MD5('teste'));* I have create many users, in different ways ! please look: mysql> SELECT id,UserName,Attribute,Value,op FROM radcheck; +----+----------+----------------+----------------------------------+----+ | id | UserName | Attribute | Value | op | +----+----------+----------------+----------------------------------+----+ | 1 | teste | Password | teste | == | | 2 | 1 | Password | 698dc19d489c4e4db73e28a713eab07b | == | | 3 | 2 | Password | 698dc19d489c4e4db73e28a713eab07b | == | | 4 | 3 | User-Password | 698dc19d489c4e4db73e28a713eab07b | == | | 5 | 4 | Crypt-Password | 698dc19d489c4e4db73e28a713eab07b | == | | 6 | 5 | MD5-Password | 698dc19d489c4e4db73e28a713eab07b | == | +----+----------+----------------+----------------------------------+----+ I have read, many many times the "man rlm_pap" but i don't know where i put the headers (i.e {md5} {clear} etc...) !!! please help me to solve this big truble !!! =/ I need this to put my freeradius authenticate users, and the passwords in Mysql DB have to be encrypted !! Sorry for my poor english ! =/ Big thks Regards, Diogo Teixeira

3 11

realms and Windows domain
by Craig White 06 Dec '08

06 Dec '08

freeradius-1.1.3-1.2.el5 LDAP authentication (OpenLDAP) I am mostly working now but I do get failures if a user has the Windows Domain set to any value at all which of course means that the authentication is passed as DOMAIN\user and I want it to strip out the DOMAIN\ part and just keep the user so Windows laptops would just automatically authenticate current logged in user. Not sure this is necessary but this is the debug of what is happening... rlm_ldap: - authorize rlm_ldap: performing user authorization for MyOrg\craigwhite radius_xlat: '(uid=MyOrg\5c\5ccraigwhite)' radius_xlat: 'ou=People,ou=Accounts,o=MyOrg,c=US' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as cn=admin,o=MyOrg,c=US/pass to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=People,ou=Accounts,o=MyOrg, with filter (uid=MyOrg\5c\5ccraigwhite) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? rlm_mschap: Told to do MS-CHAPv2 for MyOrg\craigwhite with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [MyOrg\\craigwhite/<no User-Password attribute>] (from client RRAS port 11 cli 68.231.14.75) Delaying request 0 for 1 seconds Finished request 0 I have tried it with ntdomain_hack enabled but the outcome is the same. If I don't include the Domain, I get authenticated no problem...so I figure all I need/want is to strip the user name out. Craig

1 1