- Freeradius-Users - lists.freeradius.org

Supported Acesspoints
by M.K. ten Napel 26 Nov '08

26 Nov '08

Hi, Previously I asked if anyone had trouble with the Linksys WAP54G, Like I did. I'm think about trying another type of Accesspoint. Before buying one, I would like to know what AP's are being used with FreeRadius. Any tips/suggestions on buying an AP that works wel in WPA-enterprise (EAP-TLS) with FreeRadius? Thanks! :) Mariourk

4 4

Read radius client from database
by Saeed Akhtar 26 Nov '08

26 Nov '08

Hi all, I am having problem to configure Radius to read client information from mysql database table "nas". I found an option at last line of sql.conf readclients = yes i uncommented it ... then added record in nas table... then tried to send request from newly added client but it says unknown client.... Can anyone help me in this regard??? Thank you Regards, Saeed Akhtar

3 9

authentication delay in virtual servers
by Oguzhan Kayhan 26 Nov '08

26 Nov '08

Hello, I have two virtual servers on my freeradius installation with one is made via mysql and other is via a perl script which is checking an xml page for user/pass control. What i noticed is, when the xml server is down if somebody tries to login from this virtual server, the other virtual server hangs up too before it gets a reply from the previous virtual server. Is it smthing suppose to happen?

2 1

Re: Re: RSASecurid and PEAP
by David Mitton 26 Nov '08

26 Nov '08

I should know better to ask "what are you thinking?" but let me attempt to explain. The RSA SecurID RADIUS server can authenticate plain text OTPs inside of PEAP (or if you load our EAP client, use SecurID-EAP or Protected-OTP) FreeRADIUS should have no problem proxying that. But as Alan points out, EAP & RADIUS don't work the way you want. The EAP authentication end-to-end. The RADIUS server itself doesn't know how the EAP method did it's thing. It relays EAP messages as opaque blobs, and gets a success/failure indication (and the encryption keys) when it's done. To a certain extent so does the access point. APs should be able to support any EAP method that follows RFC 3748 message formats. So you cannot alter this conversation without changing the EAP method protocol. What piece of software on the client is going to respond to this challenge out of thin air? PEAP on the client doesn't work that way. Dave. On Nov 26, 2008, aland(a)deployingradius.com wrote: Paul TAVERNIER wrote: > 1) i want to authorize/authenticate a user with a couple > username/OTPpassword (RSASecurid) through a Freeradius server (i proxy > the acces-request to a RSARadius-Securid server). It's ok. What do you mean "It's OK"? Have you tested this with cleartext-passwords, MS-CHAP, PEAP, or ...? > 2) (then, if i get an Access-Accept) (in a post-proxy section?) i want > to initiate an EAP Challenge between my XP-Wireless-supplicant client > and FREERADIUS (not the RSA radius)... That's not how EAP works. The supplicant and NAS control how the protocol works, and you can't change things on the RADIUS server. > Can i configure something like that No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Can FreeRadius server as AAA for MMSC and EVDO as well?
by Aldo 26 Nov '08

26 Nov '08

Well, you are right I shouldn't post about the MMSC if I know that dont support RADIUS, but as I wrote in the input, the NAS (Huawei PDSN 9660) support RADIUS, and I need to set it up the headsets to being authorized with FreeRADIUS to use EVDO, I think I have a very basic idea, please correct me and give some guidance if you can, -In FreeRADIUS I have to connect it with sql database server (such as mysql), then create a database, then I dont know how to interconnect it with the NAS (my PDSN) -For the PDSN, I think I must enable a interface which connects to the RADIUS server and then authenticate them with a shared secret and then setup a ip pool in the PDSN, please tell me what steps i miss. Thanks again, Aldo > ---------------------------------------------------------------------- > > Date: Wed, 26 Nov 2008 01:02:00 -0800 > From: Aldo <aldo(a)cleartalk.net> > Subject: Re: Re: Can FreeRadius server as AAA for MMSC and EVDO as > well? > > Well, the my NAS (Huawei PDSN 9660) does support RADIUS actually, the > MMSC is a older Huawei MMSC (based on Sun) and documentation doesn't say > nothing about RAIUS. > I know HLR can handle the Phone authorization for data usage, but that > will enable/disable MMSC and EVDO in bundle, lets say I configure the > PDSN with the FreeRADIUS for the EVDO, what do you recommend me to > authenticate MMSC? > > Thanks again. > > >> ---------------------------------------------------------------------- >> >> Date: Wed, 26 Nov 2008 08:30:38 +0100 >> From: Alan DeKok <aland(a)deployingradius.com> >> Subject: Re: Can FreeRadius server as AAA for MMSC and EVDO as well? >> >> Aldo Zavala wrote: >> >> >>> Hello, I in our network we have two data services: >>> 1.- MMSC (Multimedia Message Service Center) >>> 2.- EVDO (Evolution-Data Optimized) >>> >>> I just downloaded and installed the FreeRADIUS in a FreeBSD server, this is my first time trying to configure it, but first of all I would like to know if mine is a common usage of FreeRADIUS, the MMSC is served trough a Solaris based server and EVDO is served trough a propietary PDSN appliance. >>> >>> Are there more people who figured out how to make possible this configuration-like? >>> >>> >> If those services use RADIUS for authentication, then it's possible. >> See their documentation for the list of features that they support. >> >> Alan DeKok. >> >> >> > > ------------------------------ > > > Date: Wed, 26 Nov 2008 11:14:19 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Can FreeRadius server as AAA for MMSC and EVDO as well? > > Aldo wrote: > >> Well, the my NAS (Huawei PDSN 9660) does support RADIUS actually, the >> MMSC is a older Huawei MMSC (based on Sun) and documentation doesn't say >> nothing about RAIUS. >> I know HLR can handle the Phone authorization for data usage, but that >> will enable/disable MMSC and EVDO in bundle, lets say I configure the >> PDSN with the FreeRADIUS for the EVDO, what do you recommend me to >> authenticate MMSC? >> > > If your MMSC doesn't support RADIUS, then you can't do RADIUS. > > If you're not using RADIUS, there's no point asking questions on this > list. > > Alan DeKok. > >

2 1

re:Re: Read radius client from database
by mj mailing lists user 26 Nov '08

26 Nov '08

Hi seems to me you are missing rlm_sql, when I start radiusd -X I get the following lines: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked .. rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret FROM nas this last line is then followed by rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=secretpw .. Maybe you didn't configure sql right. In freeradius2 Uncomment sql in raddb/sites-enabled/default Check you raddb/sql.conf file in freeradius1 uncomment sql (authorize section) in radiusd.conf and adapt sql.conf Michel >Debug Trace: > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file: /usr/local/etc/raddb/proxy.conf >Config: including file: /usr/local/etc/raddb/clients.conf >Config: including file: /usr/local/etc/raddb/snmp.conf >Config: including file: /usr/local/etc/raddb/jradius.conf >Config: including file: /usr/local/etc/raddb/eap.conf >Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/usr/local/var" > main: logdir = "/usr/local/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/usr/local/var/log/radius/radacct" > main: hostname_lookups = no > main: snmp = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/usr/local/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library search path is /usr/local/lib >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no >Module: Instantiated realm (suffix) >Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded jradius > jradius: name = "example" > jradius: primary = "127.0.0.1" > jradius: secondary = "192.168.1.2:1815" > jradius: tertiary = "192.168.1.2:1816" > jradius: timeout = 1 > jradius: onfail = "NOOP" > jradius: keepalive = yes > jradius: connections = 8 >rlm_jradius: configuring jradius server 127.0.0.1:1814 >rlm_jradius: configuring jradius server 192.168.1.2:1815 >rlm_jradius: configuring jradius server 192.168.1.2:1816 >rlm_jradius: starting JRadius connection 0 >rlm_jradius: starting JRadius connection 1 >rlm_jradius: starting JRadius connection 2 >rlm_jradius: starting JRadius connection 3 >rlm_jradius: starting JRadius connection 4 >rlm_jradius: starting JRadius connection 5 >rlm_jradius: starting JRadius connection 6 >rlm_jradius: starting JRadius connection 7 >Module: Instantiated jradius (jradius) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, >Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = >"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/usr/local/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Ready to process requests. > > >Regards, > >Saeed Akhtar > > > >2008/11/26 <tnt(a)kalik.net> > >> Post the debug of the server startup. >> >> Ivan Kalik >> Kalik Informatika ISP >> >> >> Dana 26/11/2008, "Saeed Akhtar" <saeedakhtar.484(a)gmail.com> pi¹e: >> >> >Hi all, >> > >> > I am having problem to configure Radius to read client information from >> >mysql database table "nas". I found an option at last line of sql.conf >> > >> >readclients = yes >> > >> >i uncommented it ... then added record in nas table... then tried to send >> >request from newly added client but it says unknown client.... Can anyone >> >help me in this regard??? Thank you >> >Regards, >> > >> >Saeed Akhtar >> > >> > >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > >

1 0

EAP2 configuration
by Fernando 26 Nov '08

26 Nov '08

Hi all, What do I need to do for use eap2 module? I want to use GPSK or PSK. Can anybody help me with the configuration? Thanks.

2 13

RSASecurid and PEAP
by Paul TAVERNIER 26 Nov '08

26 Nov '08

Hi i would like to know if this thing (scenario) is possible... 1) i want to authorize/authenticate a user with a couple username/OTPpassword (RSASecurid) through a Freeradius server (i proxy the acces-request to a RSARadius-Securid server). It's ok. 2) (then, if i get an Access-Accept) (in a post-proxy section?) i want to initiate an EAP Challenge between my XP-Wireless-supplicant client and FREERADIUS (not the RSA radius)... Can i configure something like that authorize { ... suffix ... } post-proxy { (if access-accept...) eap } Hope this mail is not too obfuscated...and then is able to be decoded... Regards Paul

2 1

ip pool
by sugiarto tjahyono 26 Nov '08

26 Nov '08

Dear all, I have a few problem. i use ip pool and it's works fine if i define ip pool in mysql. 779084,"test","password","=","test123" 779085,"test","Pool-Name",":=","main_pool1" 779086,"test","Called-Station-Id","=","hostpot1" The problem happened if i have 2 access point in the same area and IP the different is only at called-station-id. what should i set in radius if any user can go to AP 1 with Called-Station-Id 1 or AP 2 with Called-Station-Id 2. if user logged in AP1 they will get main_pool1 and if user logged in AP2 they will get main_pool2 sorry for my bad language:)

2 1

radmin SIGABRTs freeradius 2.1.1
by Norbert Wegener 26 Nov '08

26 Nov '08

I have an input file for radmin with the following content: debug file /var/log/radius/nw2.log debug condition '(NAS-IP-Address == "172.31.110.147") || (NAS-IP-Address == "172.31.110.149") || (NAS-IP-Address == "149.246.185.169")' When those commands have been executed and some debugging shows up int the logfile, I want to switch to another log. changing the radmin input file to debug file /var/log/radius/nw3.log debug condition '(NAS-IP-Address == "172.31.110.147") || (NAS-IP-Address == "172.31.110.149") || (NAS-IP-Address == "149.246.185.169")' and executing the commands, freeradius in the actual 2.1.1 version dies. This is, what gdb show up: Loaded symbols for /usr/lib64/freeradius/rlm_sql_log.so 0x00002b091e323562 in ?? () from /lib64/libc.so.6 (gdb) cont Continuing. Program received signal SIGABRT, Aborted. [Switching to Thread 47318162851936 (LWP 2820)] 0x00002b091e299b95 in raise () from /lib64/libc.so.6 (gdb) bt #0 0x00002b091e299b95 in raise () from /lib64/libc.so.6 #1 0x00002b091e29af90 in abort () from /lib64/libc.so.6 #2 0x00002b091e2d035b in __libc_message () from /lib64/libc.so.6 #3 0x00002b091e2d534e in malloc_printerr () from /lib64/libc.so.6 #4 0x00002b091e2d695c in free () from /lib64/libc.so.6 #5 0x000000000040e748 in command_debug_condition (listener=<value optimized out>, argc=2820, argv=0x6) at command.c:718 #6 0x000000000040ee01 in command_domain_recv (listener=0x726dc0, pfun=<value optimized out>, prequest=<value optimized out>) at command.c:1680 #7 0x000000000041ef10 in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=<value optimized out>) at event.c:2666 #8 0x00002b091d7169c0 in fr_event_loop (el=0x70e980) at event.c:400 #9 0x0000000000418bb1 in main (argc=<value optimized out>, argv=0xe) at radiusd.c:394 Norbert Wegener

4 6