- Freeradius-Users - lists.freeradius.org

compiling freeradius with oracle support
by Alexandre Chapellon 30 Aug '08

30 Aug '08

Hi I manage to compil freeradius (2.0.5) with oracle support and so i installed the oracle instantclient (11_1) and its sdk... all this in /opt/oracle When launching compilation (using the dpkg-builpackage wrapper and rules files modified to enable oracle) i get a problem: The rlm_sql_oracle driver compilation is silently skip whereas i did specify the appropriate (well i guess they are appropriate): --with-rlm-sql-oracle=yes --with-oracle-home-dir=/opt/oracle --with-oracle-lib-dir=/opt/oracle/instantclient_11_1/ --with-oracle-include-dir=/opt/oracle/instantclient_11_1/sdk/include It says headers (oci.h) are not found, but this file realy is in the specified include path. So i decided to start the dirty stuff and set $oracle_include_dir as an environment variable doing manual configure (don't know if i can do it with dpkg-buildpackage) oracle_include_dir=/opt/oracle/instantclient_11_1/sdk/include ./configure ..... this made the header test successfull but i can't still make it find libs which are in /opt/oracle/instantclient: ~$ ls /opt/oracle/instantclient_11_1/ adrci genezi libclntsh.so.11.1 libocci.so libociei.so ojdbc5.jar sdk BASIC_README libclntsh.so libnnz11.so libocci.so.11.1 libocijdbc11.so ojdbc6.jar Does anyone have a clue what i could do?

3 20

FreeRadius not sending access-deny
by Ryan Kramer 29 Aug '08

29 Aug '08

Hello, I recently discovered that my Freeradius 1.1.7 install is no longer sending access-deny messages for bad passwords. This causes the device to mark the radius server as down and move on to the next one, or just marks it as down. I know its probably something I did in the config, but for the life of me can't figure out how I managed to cause that. Everything else on the install works great, just for the exception of no access-deny packets ever move. Any ideas? Ryan

3 4

Compile problems
by David Blood 29 Aug '08

29 Aug '08

I am trying to install freeradius from source and cannot seem to get it to install correctly. 1. I am installing on a centos 4.5 box and would like freeradius to install the config file in the correct place (i.e. /etc/raddb) setting the prefix='' ( or sysconfdir='/etc/raddb') in the configure script does not tell the radiusd executable to look in /etc/raddb for its configuration files. It still looks in /usr/local/etc/raddb 2. The configure script cannot find the libgdbm library and thus cannot configure some of the rlm_modules. I have tried setting the --with-rlm-counter-lib-dir='/usr/lib' which is where the gdbm library is looked to get rlm_couter to configure but it still fails. 3. I says it can't locate check-radiusd-config . I wish I knew where it was looking. Here is the configure command I last used with the error output received. ./configure --prefix='' --exec-prefix='/usr' --includedir='/usr/include' --datadir='/usr/share' --libdir='/usr/lib' --sysconfdir='/etc/raddb' --with-rlm-counter-lib-dir='/usr/lib' -q appending configuration tag "CXX" to libtool appending configuration tag "F77" to libtool config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting chmod: cannot access `check-radiusd-config': No such file or directory configure: WARNING: silently not building rlm_counter. configure: WARNING: FAILURE: rlm_counter requires: libgdbm. configure: WARNING: FAILURE: rlm_dbm requires: (ndbm.h or gdbm/ndbm.h or gdbm-ndbm.h) (libndbm or libgdbm or libgdbm_compat). configure: WARNING: silently not building rlm_dbm. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: creating ./config.status config.status: creating Makefile checking for OpenSSL support... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged configure: WARNING: silently not building rlm_ippool. configure: WARNING: FAILURE: rlm_ippool requires: libgdbm. configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r ldap.h. configure: WARNING: silently not building rlm_pam. configure: WARNING: FAILURE: rlm_pam requires: libpam. configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: sql.h. David

3 7

freeradius, proxy and packet loss
by Evgeniy Kozhuhovskiy 29 Aug '08

29 Aug '08

Hi all! I have a freeradius 2.0.5 installed and configured to authorize to realms (for example @a and @b) First realm - @a - authorizes locally (via rlm_sql) Second - @b - is proxying to remote server. The trouble looks so (we take this with with tcpdump): - my freeradius 2.0.5 server sends auth-req -- remote server gets it and process -- remote server sends answer -- it reach our server -- ~95% replyes goes to NAS'es, but sometimes my server says that "Rejecting request 4490 due to lack of any response from home server xx.xx.xx.xx port 1812" (but in fact this response arrives to the interface of the computer with freeradius installed - i see this with sniffer, but there is nothing in freeradius logs about this packet) -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.

4 6

FW: [RTX] POPS in Brasil
by José Soler 29 Aug '08

29 Aug '08

Stig, Jonathan, Have you moved on this one? Regards, jose From: José Soler Sent: 28 August 2008 11:14 To: 'Stig Skaugvoll' Cc: Claus Futtrup; Jonathan Schutte Subject: FW: [RTX] POPS in Brasil Stig, Can you take AP1 below and contact T-Systems /DTAG? RTX needs this information asap since it will determine what is the best location to install the core of the system. Thanks, jose From: José Soler Sent: 27 August 2008 17:18 To: 'jsr(a)rtx.com'; 'dvi(a)rtx.com'; 'mbd(a)rtx.com'; 'cto(a)rtx.com'; Claus Futtrup; 'Stig Skaugvoll'; Jonathan Schutte Cc: 'elias(a)emlacie.com.br' Subject: [RTX] Minutes technical meeting 270808- GoIPInt premises Participants: - RTX: Dalia Vitkauskaite, Morten Bundgaard, Carsten Toft, (Jørgen S Rosenkilde). (Elias + Palle in conference) - GoIPInt: Claus Futtrup, José Soler, (Peter Futtrup, Jonathan Schutte, Stig Skaugvoll) Action points and responsible company (RTX / GoIP) person listed (initials) below. è GoIPInt to request DT availability and location of POP (for international termination) in Brasil and forward to RTX (AP1: js/cf). è Number Portability issues: RTX to provide to GoIPInt information regarding regulative conditions in Brasil and inter operator procedures for number portability .(AP2:Elias) è Collect Call: RTX to provide GoIPInt information of how the Collect Call service is implemented in Maraba for the Nortelpa/Midas solution. (AP3: Elias). Additionally, GoIPInt to provide RTX with details of necessary conditions/requirements to implement service in GoIPInt platform (AP4: js/cf) è Billing: RTX to provide deeper details of interface with Servcom billing system.(AP5: Elias). Additionally GoIP to send details/example of feeds from GoIPInt rating system towards a likely Billing system. (AP6: cf). è Test setup (Anatel's): GoIP to provide feedback by 28th August regarding possibility of server purchase in Dk, preconfiguration and shipping to Brasil (Canaa) together with travelling person and proforma bill (for customs) (AP7: ss/jsc). è RTX to send to GoIPInt details of HTTP-based interface for customer creation in HLR (AP8: dvi). è Other services where mentioned in call with Elias (i.e. calling card like top-up functionality). A complete description of the features desired in the system needs to be settled-agreed as base for discussion and to realistically estimate implementation costs and schedules. GoIPInt to present a complete functionality / features description of the system (AP9: ss/ jsc). RTX to provide a complete description of desired functionality: call-related, administration operation related, customer access related, etc. (AP10: cto) è GoIP to confirm available voice codecs in DEC bases. GoIP platform can work with the following unlicensed ones: G711, G726, GSM, iLBC, Speex, and the following licensed ones: G723, G729.(AP11:dvi) è It was confirmed after discussion that local gateway redundancy will NOT be part of the solution if it is not a legal/regulative requirement. Alternative centralized redundant solutions might be considered. RTX to confirm this. (AP12: elias/cto) è RTX and GoIPInt to perform further tests on signaling for different cases during week 36. (AP13: cf/dvi/mbd) No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.9/1636 - Release Date: 26/08/2008 19:09 No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.9/1636 - Release Date: 26/08/2008 19:09 No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.10/1638 - Release Date: 27/08/2008 19:06 No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.12/1640 - Release Date: 28/08/2008 18:58

1 0

Hafiz Pussah recommends FastWeb to find scholarship money
by hafizpus＠yahoo.com 29 Aug '08

29 Aug '08

Hey! Hafiz Pussah knows you?re looking for money for college and wants you to find it on FastWeb. What can you get from becoming a member of FastWeb? ? Find scholarships just for you ? Search for colleges ? Get financial aid advice ? Locate internship and part-time job opportunities FastWeb has a ton of other great tools. And the best part? It?s all free. Visit FastWeb to find cash for college today! http://www.fastweb.com/ib/vmremuinew-1f/DWGTXBLGMJ4O -- FastWeb respects your online time and privacy. If you do not wish to receive future emailed opportunities to join FastWeb, simply click on the following link to let us know: http://www.fastweb.com/o3/vmremuinew/FREERADIUS%2dUSERS%40LISTS%2eFREERADIU… Copyright 2008 FastWeb, LLC All rights reserved. FastWeb, LLC, 444 N. Michigan Avenue, Suite 3000, Chicago, IL 60611

1 0

Fwd: MSCHAP module returns OK, authentication fails..
by James Yale 29 Aug '08

29 Aug '08

>> EAP-MSCHAPV2: Invalid authenticator response in success request > > Upgrade Samba. If you're not using at least 3.2.1, upgrade to that. > >> http://jim.geezas.com/stuff/radius-debugging/ *-failure.log), the >> message authenticator does seem to be invalid, > > No. eapol_test is saying that the MSCHAP response is invalid. > >> Has anyone seen this problem before, or am I looking in the wrong place? > > Others have seen exactly the same thing in the past weeks. Upgrading > Samba fixed it. > > Alan DeKok. > - I've upgraded to the testing version of samba for FC9, 3.2.1 which unfortunately didn't resolve the issue - still getting the 'Invalid authenticator response in success request' problem. jim@florence:~$ /usr/sbin/winbindd -V Version 3.2.1-18.fc9 Is there a known good version of Samba, or could the problem lie elsewhere? I've included the server output from the MSCHAP module trying the authentication for reference. +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for jim2 with NT-Password expand: --username=%{mschap:User-Name:-None} -> --username=jim2 rlm_mschap: No NT-Domain was found in the User-Name. expand: --domain=%{mschap:NT-Domain:-CURRICULUM} -> --domain=CURRICULUM mschap2: ee expand: --challenge=%{mschap:Challenge:-00} -> --challenge=c48639cf15fbe669 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0b4b18f4afaa63f4147e4250c8c907f3248ba67e7ee976a0 Exec-Program output: NT_KEY: 1847BA6C5854C261219362F18B4923E4 Exec-Program-Wait: plaintext: NT_KEY: 1847BA6C5854C261219362F18B4923E4 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d39313431454342383036383441464346413533303131384242454445363435373037323941383039 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x40622130416a3b8e9b04d3d502f1f161 PEAP: Processing from tunneled session code 0xa13a0d0 11 EAP-Message = 0x010800331a0307002e533d39313431454342383036383441464346413533303131384242454445363435373037323941383039 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x40622130416a3b8e9b04d3d502f1f161 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 7 to 127.0.0.1 port 35048 EAP-Message = 0x0108005b19001703010050a25e02bf01a7f7f6ca355df2cec89e3c2508b47b180497a05669336d0ac233f14b38ed612205594956295de1abbda4f5e4f8f03753d57524e01a42e5d29cabcf7996143335211d76065176783a7bb8ec Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5899ddd95f91c4e2ae146201bfc3a1be Finished request 7. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 0 with timestamp +5 Cleaning up request 1 ID 1 with timestamp +5 Cleaning up request 2 ID 2 with timestamp +5 Cleaning up request 3 ID 3 with timestamp +5 Cleaning up request 4 ID 4 with timestamp +5 Cleaning up request 5 ID 5 with timestamp +5 Cleaning up request 6 ID 6 with timestamp +5 Cleaning up request 7 ID 7 with timestamp +5 Ready to process requests. Thanks, James

3 3

User-Password required Authentication problem
by Syed Anwarul Hasan 28 Aug '08

28 Aug '08

Hi Alan and all, Thanks Alan for you earlier reply. I have a problem for Authenticating Radius server with Openldap backend. In the ldap.attrmap I added the line *checkitem User-Password userPassword *and also under modules in ldap module I have set_auth_type=yes for binding LDAP for authentication for User-Password. Also in the Sites-enabled dir under default file, I have added in the Authorize section I added, *update control { Auth-Type :=ldap } ldap* *And also enabled pap module with auto-header yes option. * So, after configuring in this manner,still I was not able to authenticate. Please help in this regard.* SYED #### Radius Debug Output:* r*ad_check_password: Found Auth-Type ldap auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use " (null)". ++[ldap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject* +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated *Sending Access-Reject of id 225 to 127.0.0.1 port 1033* *#using radtest:* *radtest hasan thales localhost 1 testing123*

3 9

multiple Certificate Authority
by kas mataz 28 Aug '08

28 Aug '08

Due to acquisition of companies, we now need to support multiple Certificate Authorities. Wireless is successful in v2.0.5 using EAP-TLS with one eap instance for Company1, but when I add a second eap instance for Company2, eap fails for Company1. Is there a means to evaluate the certificate Issuer in the early part of the communication using a unlang statement? Is there a specific key word to use for the certificate issuer? It seems like the configuration needs just a few changes to be successful. rad_recv: Access-Request packet from host 10.252.255.18 port 32770, id=37, length=1507 User-Name = "Test User (Company 1)" Calling-Station-Id = "00-13-CE-DD-D4-85" Called-Station-Id = "00-0A-85-65-3E-80:WIFI3D" NAS-Port = 29 NAS-IP-Address = 10.252.255.18 NAS-Identifier = "wc-05" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "798" EAP-Message = 0x021f05110d800000050716030104d70b0003c70003c40003c1308203bd308202a5a00302010202030124b5300d06092a864886f70d0101050500306f310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a4275726c696e67616d65310c300a060355040a130344484c3110300e060355040b130753797374656d73311630140603550403130d44484c20476c6f62616c204341301e170d3036313231353232353933345a170d3038313231343232353933345a30818a3110300e060355040a130764686c2e636f6d310b3009060355040b13027573310b300906035504071302616d311f30 EAP-Message = 0x1d060355040313164a756479204d2046656c646572202844484c205553293122302006092a864886f70d01090116134a7564792e46656c6465724064686c2e636f6d31173015060a0992268993f22c64010113076a66656c64657230819f300d06092a864886f70d010101050003818d0030818902818100a90faf75166496dd2657307e9bc3164667ef4af9a0ce20e74a8f644f1d6b6afb240524313173ab41aca3f8d7fc4ff39f592225e8f93f70e9cbe17e2adde9e2968cc7bca1284feb0b81edf6acdf0fc5f110b781ac305c7dd08e0e524582a8e6830640f88ad3a60f664ec40d7133c055a9802d4e51c65738bfbeec981b914c3f310203010001 EAP-Message = 0xa381c93081c6301106096086480186f84201010404030205a0300e0603551d0f0101ff0404030205e0301e0603551d110417301581134a7564792e46656c6465724064686c2e636f6d301f0603551d230418301680143d81b8eebd05dc3676e024514dcb1965bb18d470303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f616d636d732e64686c2e636f6d2f6f63737030290603551d250422302006082b0601050507030206082b06010505070304060a2b0601040182370a0304300d06092a864886f70d010105050003820101001e6887c1a6f58d4289d05e778a93b755135e81a0c2ac624818c4afb186 EAP-Message = 0x258b022f175db3da3f7d990fa4d1044b38c08ebfbcea646257025443ad25daefb981ed60ffcfbc568586fb8c2ae402185463afe81169e043abf9b5782f67a8319b713157330e9438e5e4741d876669b856e44139eb1c67279cb2ee16ee39d9b7fc12c0f8564c55108ba0cca991120818dcbce5304121ea67db9e33ac77cdd52aa17daaac07cee4465c70b236271d4ad59a5d9d6183c049c8941b45366952a50446b36f0101baef2f3928aaa5eaade4fc5fb571a0535f20e36738b1b5a417e29fdf4031904d48430a4bc63e26c80c7f88637247469fdcd89f5ff30811e93a472f174bd41000008200803467644319b1f3681185cf76bae98b20bf5a529d EAP-Message = 0xe395dd3d0f7f1d3e6c91c6cdaca8855c52c6f9bd84893ea1a2ae848e75070f9b1fb8ead9d2470b536737f5f6ccac4acbf6d4aec4703dfee89910c3046ec9fd06ce57c0498eb126328108c9e578d21dcd374012d34210adee04397867d450bcb787bd298ad08321a5ebcde3c70f0000820080150c570d4ee2d59103b622f1c7716f94e2313c0b4c731a9799c430963864866adce8964454c8e2c5d6ab9520262e962cf9b99ce14445c5b39100449055a505eba616a0f754290af94a70ad426edaa42fc8f91fddcf776974f6ac533efbb5372c2e244cd53ea61ac66f7cf8a5d775970cbfd3e17e971822426538143efacca6681403010001011603010020 EAP-Message = 0xfaa0905d8a278e3e6cbf563aa4ff516825708a612fd32bbd672373f61ac45934 State = 0x4edb29434bc424a7b8988b8f343c1e87 Message-Authenticator = 0x0a71963cc3baec5c6ac16ecbaaea6bb0 +- entering group authorize ++[preprocess] returns ok rlm_realm: No '@' in User-Name = "Test User (Company 1)", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_ldap: Entering ldap_groupcmp() expand: dc=external -> dc=external expand: (uid=%u) -> (uid=Test User \28Company 1\29) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=external, with filter (uid=Test User \28Company 1\29) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop expand: %{Huntgroup-Name} -> WIRELESS ++- entering switch %{Huntgroup-Name} +++- entering case WIRELESS rlm_eap: EAP packet type response id 31 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++++[eap_company1] returns updated rlm_eap: EAP packet type response id 31 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++++[eap_useram] returns updated rlm_eap: EAP packet type response id 31 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation +++- case WIRELESS returns updated ++- switch %{Huntgroup-Name} returns updated rlm_checkval: Item Name: Calling-Station-Id, Value: 00-13-CE-DD-D4-85 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop rad_check_password: Found Auth-Type eap_company1 rad_check_password: Found Auth-Type eap_company2 Warning: Found 2 auth-types on request for user 'Test User (Company 1)' auth: type "eap_company2" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 1287 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 03cb], Certificate chain-depth=1, error=0 --> User-Name = Test User (Company 1) --> BUF-Name = Company1 Global CA --> subject = /C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA --> issuer = /C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA --> verify return:1 rlm_eap_tls: Certificate issuer (/C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA) does not match specified value (/O=Parent-company/O=Child-company/OU=Division/CN=Company2 User CA PS)! chain-depth=0, error=0 --> User-Name = Test User (Company 1) --> BUF-Name = Test User (Company 1) --> subject = /O=company1.com/OU=us/L=am/CN=Test User (Company 1)/emailAddress=Test.User(a)company1.com/UID=tuser --> issuer = /C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA --> verify return:0 rlm_eap_tls:>>> TLS 1.0 Alert [length 0002], fatal certificate_unknown TLS Alert write:fatal:certificate unknown TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap_company2] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> Test User (Company 1) attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 37 to 10.252.255.18 port 32770 EAP-Message = 0x041f0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 1647. Going to the next request ../etc/raddb/sites-available/default authorize { preprocess suffix files switch "%{Huntgroup-Name}" { case HARDWARE1 { internal-uid } case HARDWARE2 { internal-mail } case HARDWARE3 { external-uid } case WIRELESS { eap_company1 eap_company2 } } checkval expiration } authenticate { internal-uid internal-mail external-uid eap_company1 eap_company2 } preacct { preprocess acct_unique suffix } accounting { detail radutmp attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { } ../modules/eap_company1 eap eap_company1 { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = private_key_file = ${certdir}/radius-co1.server.com.key certificate_file = ${certdir}/radius-co1.server.com.pem CA_file = ${cadir}/company1.pem dh_file = ${certdir}/dh random_file = ${certdir}/random fragment_size = 1024 check_crl = yes CA_path = /opt/freeradius/etc/raddb/certs check_cert_issuer = "/C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA" check_cert_cn = %{User-Name} cipher_list = "DEFAULT" } copy_request_to_tunnel = no } ../modules/eap_company2 eap eap_company2 { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = private_key_file = ${certdir}/radius-co2.server.key certificate_file = ${certdir}/radius-co2.server.pem CA_file = ${cadir}/chain-company2.pem dh_file = ${certdir}/dh random_file = ${certdir}/random fragment_size = 1024 check_crl = yes CA_path = /opt/freeradius/etc/raddb/certs check_cert_issuer = "/O=Parent-company/O=Child-company/OU=Division/CN=Company2 User CA PS" check_cert_cn = %{User-Name} cipher_list = "DEFAULT" } copy_request_to_tunnel = no } Regards, Kas _________________________________________________________________ Be the filmmaker you always wanted to be—learn how to burn a DVD with Windows®. http://clk.atdmt.com/MRT/go/108588797/direct/01/

2 1

Re: Release of 2.1.0?
by Alan DeKok 28 Aug '08

28 Aug '08

Arran Cudbard-Bell wrote: > New administrative components. The default schemas and configs will need > altering if you want it to work straight off, that's usually done in a > major release. It's been long enough since 2.0.5. I'd like to do something soon. > Ah no, this is EAP-TLS session resumption. The feature supported by the > native supplicant is PEAP Fast-Reconnect, which is something entirely > different. I have a strange feeling of deja vu, have we had this > discussion before ? I don't think fast-reauth is very different. It's pretty much the same thing. Both client && server cache various SSL magic, and then use that to bypass the full SSL setup. I've tested it with PEAP && wpa_supplicant. It seems to work. Alan DeKok.

1 0