- Freeradius-Users - lists.freeradius.org

Linksys WAP54G
by M.K. tenNapel 25 Nov '08

25 Nov '08

Hi, I have setup a FreeRadius-server and try to get it operational with a Linksys WAP54G AccessPoint. This seems to work highly unreliable. I posted a question about this on the Linksys support forums, but no luck so far: http://forums.linksys.com/linksys/board/message?board.id=Access_Points&thre… Googeling this problem, I found more complaints about this issue. I was wondering if more FreeRadius users are familiar with this problem. Maybe someone came up with a solution? I hate to throw out 3 AP's... Thanks! Mariourk

5 11

certificates confusion
by Craig White 25 Nov '08

25 Nov '08

please excuse me if this isn't entirely related to freeradius but it's all about getting WindowsXP laptops to my wireless network with freeradius and 8021.x I see that there is certificate failures and am thinking that I need to clean this up up until now, server2 is my ca and I have used that to generate and sign certificates. my radius server though is running on server1 and I think that my failure is related to the fact that I'm generating the certificates and signing them with server2. So my questions... 1. Do I set up server1 to be its own CA or do I still use server2 as the CA? 2. If server2 is the CA, do I then generate the request on server1, copy it to server2 and then sign it on server2? 3. Does anyone see any problems with these methods of generating certificates ? (openssl on Linux) # Generate server certificate signing request openssl req -new -nodes -keyout $SSL/radius_server_key.pem \ -out $SSL/radius_server_req.pem \ -days 730 \ -config $SSL/openssl.cnf # Sign server certificate openssl ca -config $SSL/openssl.cnf \ -policy policy_anything \ -out radius_server_cert.pem \ -extensions xpserver_ext \ -extfile $SSL/xpextensions \ -infiles $SSL/radius_server_req.pem # Edit out text information in radius_server_cert.pem and then run # cat $SSL/radius_server_key.pem \ # $SSL/radius_server_cert.pem > \ # $SSL/radius_server_keycert.pem # Generate client certificates # openssl req -new -keyout $SSL/radius_client_key.pem \ -out $SSL/radius_client_req.pem \ -days 730 \ -config $SSL/openssl.cnf # Sign client certificates openssl ca -config $SSL/openssl.cnf \ -policy policy_anything \ -out $SSL/radius_client_cert.pem \ -extensions xpclient_ext \ -extfile $SSL/xpextensions \ -infiles $SSL/radius_client_req.pem # cat $SSL/radius_client_key.pem $SSL/radius_client_cert.pem > $SSL/radius_client_keycert.pem Thanks Craig

5 7

Unlang / Username modification
by Nemec Christopher 25 Nov '08

25 Nov '08

Hello list; our freeradius is used to authenticate MAC-addresses (locally) and "humans" (against the windows AD). Therefor I would to like use unlang to seperate MAC-addresses from humans as they need to be treated differentely; the MAC-address authentication works fine; so does the proxying to the realm called "office". However I am stuck with these two tasks: a) Append the "office" prefix to the username (since we are lazy and do not want to type in the domain name when we log on to one of our switches) b) proxy the request to the AD I have placed the following lines of code in the radiusd.conf file: if (User-Name="nemec") { %{User-Name}:=office\nemec Proxy-To-Realm := "office" } However they are not being executed. Do they need to be at the top of the file? Is the syntax correct? radiusd -X runs with no errors and correctly processes all other requests, but does not proxy to the "office" realm. Christopher Oesterreichische Lotterien Gesellschaft m.b.H., Rennweg 44, A-1038 Wien, FN 54472 g, Handelsgericht Wien, DVR-Nr: 0476706

2 1

How to interpret rlm_ippool_tool output ?
by thoralf.freitag＠biotronik.com 25 Nov '08

25 Nov '08

Hi, I am using the ipppol modul. To check, wether IPs will put back to the pool, after them freed, sometimes I take a look to the IP-Pool. sudo /opt/radius/bin/rlm_ippool_tool -av /opt/radius/etc/raddb/db.ippool.one /opt/radius/etc/raddb/db.ipindex.one shows something like this: KEY: '9680138403a6e74f3b73aac7df6999b0' - ipaddr:10.0.194.251 active:1 cli:0 num:1 KEY: '713fff05450587a3211ea1f508fa8aeb' - ipaddr:10.0.194.32 active:1 cli:0 num:0 In my understanding the first is th unique key build as configured. TSsecond is very clear. But then active:1 means this IP is used ? cli:0 I saw no other then 0 ? num: 0|1 I have no idea what this means Can anybody help me ? -- Thoralf Freitag Manager Health Services System Administration Phone: +49 (0) 30 68905-4611 Cellular:+49 (0) 151 1631-4611 Fax: +49 (0) 30 68905-2940 Mail: Thoralf.Freitag(a)biotronik.com www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementaerin: BIOTRONIK Mess- und Therapiegeraete GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschaeftsfuehrer: Dr. Max Schaldach, Christoph Boehmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately.

1 1

WPA Supplicant - EAPOL-TEST
by Surendranath.C. 25 Nov '08

25 Nov '08

I am not able to execute the file eapol_test after making the necessary changes as described in the link below: http://deployingradius.com/scripts/eapol_test/ The message that I am getting is as below: [root@testradiusdgp wpa_supplicant-0.5.10]# make eapol_test Make: `eapol_test' is up to date Need your inputs to proceed further. Thanks & Regards, Surendranath Chandranath

1 0

Capture the MAC address of VPN connecting devices in FreeRadius
by Lucio Godoy 24 Nov '08

24 Nov '08

Hi All; Is it possible to capture in Freeradius the MAC address of a device connecting via a VPN server (Cisco VPN 3000 or Microsoft PPTP Server), pls? The user has a Username/Password Combination which isn't the MAC Address. Thank you. Lucio _________________________________________________________________ See the most popular videos on the web http://clk.atdmt.com/GBL/go/115454061/direct/01/

6 8

question
by Jackson Jerry-NPC637 24 Nov '08

24 Nov '08

Hi - Summary - I want/need to configure free radius to allow a TLS user on to the system; without having To authenticate the certs? I am not sure if this is possible, but wanted to ask if there was a way to bypass TLS cert authentication. I did set the Default-auth-type = Accept; got a `Login Ok' response from free radius; but the user still wasn't able to get network entry? Any options? Thanks, Jerry Login OK: [001DE104702B(a)xohm.com/<no User-Password attribute>] (from client PAYLOAD_SET65537 port 1 cli 001de104702b) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 43 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.104.41/reply-detail-20081121' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m %d expands to /usr/local/var/log/radius/radacct/192.168.104.41/reply-detail-20081121 modcall[post-auth]: module "reply_log" returns ok for request 43 modcall: leaving group post-auth (returns ok) for request 43 Sending Access-Accept of id 110 to 192.168.104.41 port 33039 Reply-Message = "Default = Accept" Finished request 43 Going to the next request

3 3

Could not link driver rlm_sql_oracle: libclntsh.so.10.1
by Ilya 24 Nov '08

24 Nov '08

hello, i've got Linux 2.6.9-22 and freeRADIUS server v.2.1.1. after installing and configured FreeRADIUS i try to to start the daemon with -X parametr and get the error: Could not link driver rlm_sql_oracle: libclntsh.so.10.1: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[152]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section can anyone please help to solve this problem or push me to the right way? thanks in advance ilya

4 3

Re: Problems in TLS
by Martin Silvero 24 Nov '08

24 Nov '08

But that means that the authentication is successful? If I have the NAS and Supplicant improperly set, I do not understand because it rejects the response radius. What do these lines?: rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" Thanks Alan.

5 5

FreeRADIUS + Cisco Aironet WAP
by Tim Gustafson 24 Nov '08

24 Nov '08

Hey, I know this is a bit off-topic, but I was wondering if anyone on the list might be able to help with configuring a Cisco Aironet WAP to authenticate wireless users against a FreeRADIUS server? Thanks in advance! Tim Gustafson SOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

4 3