- Freeradius-Users - lists.freeradius.org

TLS_accept:error in SSLv3 read client certificate A
by Martin Silvero 25 Aug '08

25 Aug '08

the method is eap+tls, ticket that need to know and what post. thanks!!! -- -- Silvero Martin

1 0

Re: Quota Control based on freeradius and SSG
by ahmed adel 25 Aug '08

25 Aug '08

I don't get a request for Quota, where does the Quota belong, I don't know where else to define it ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, August 25, 2008 1:11:41 PM Subject: Re: Quota Control based on freeradius and SSG Post the debug. If you have set things up properly you should get three requests: one for the user, one for the service and one for the quota. Quota doesn't belong in service profile. Ivan Kalik Kalik Informatika ISP Dana 25/8/2008, "ahmed adel" <ahmedadel4eg(a)yahoo.com> piše: >Hi > I have a setup where there is cisco 7200 router having SSG enabled on it, I want to enable quota control using SSG and radius. I made a service profile: > >quota Password := "cisco" > Service-Type = Outbound-User, > Cisco-Service-Info = "R0.0.0.0;0.0.0.0", > Cisco-Control-Info = "QV100" > >and the router logs the user in and gets the profile from the radius but doesn't assign a quota to the user. I followed Cisco documentation but without any success. If anyone has faced a situation like this or succeeded in such a configuration please help. > >Best Regards > > > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Quota Control based on freeradius and SSG
by ahmed adel 25 Aug '08

25 Aug '08

Hi I have a setup where there is cisco 7200 router having SSG enabled on it, I want to enable quota control using SSG and radius. I made a service profile: quota Password := "cisco" Service-Type = Outbound-User, Cisco-Service-Info = "R0.0.0.0;0.0.0.0", Cisco-Control-Info = "QV100" and the router logs the user in and gets the profile from the radius but doesn't assign a quota to the user. I followed Cisco documentation but without any success. If anyone has faced a situation like this or succeeded in such a configuration please help. Best Regards

2 1

Re: Re: Re: expiration or session-timeot
by Bozhan Boiadzhiev 24 Aug '08

24 Aug '08

Thank you Ivan, it works as you said. As i read in documentation Expiration attribute have accept date values and as in mysql i decide that it is only date. May be it is good if this is fixed in documentation. And i don't know how this can be done Thanks Bozhan Boiadzhiev >-------- Оригинално писмо -------- >От: "Ivan Kalik" >Относно: Re: Re: expiration or session-timeot >До: "FreeRadius users mailing list" >Изпратено на: Четвъртък, 2008, Август 21 00:02:21 EEST >>As i understand Expiration attribute can get only date values. > >No, date and time: > >August 20 2008 13:45:00 > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

RE: radsniff
by Lemaster, Rob 24 Aug '08

24 Aug '08

Thank you for your quick reply. I tried radsniff -h before posting. What I'm hoping to do is to troubleshoot a particular user, but I don't think I'm using the -r option correctly. # ./radsniff -i lo -rFOO -ssecret -X radsniff: Invalid RADIUS filter "(null)": expecting operator No matter what I use for -r, I get the same reply. When I use it without -r, I get basically the same as radtest output. Could you reply with some examples of the correct usage of this command? Is it possible to do a regex on a username or on Access-Rejects with radsniff? thanks ------------------------------ Message: 5 Date: Fri, 22 Aug 2008 20:54:53 -0700 From: "Lemaster, Rob" <rlemaste(a)covad.com> Subject: radsniff To: <freeradius-users(a)lists.freeradius.org> Message-ID: <3BC5D44AB71A754FAE3CA68A7597EABE0F82C86C(a)ZANEVS03.cc-ntd1.covad.com> Content-Type: text/plain; charset="iso-8859-1" I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples? ------------------------------ Message: 6 Date: Sat, 23 Aug 2008 06:51:31 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: radsniff To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48AF9753.8040602(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Lemaster, Rob wrote: > I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples? $ radsniff -h It's a simple wrapper around libpcap. It can also print out the contents of RADIUS packets using the FreeRADIUS dictionaries. Wireshark does more, but it's dictionaries aren't as up to date, and it's a *lot* bigger. Alan DeKok.

2 1

Re: Fwd: Certificate problem on Windows XP clinet ...
by Venkata LK Mula 23 Aug '08

23 Aug '08

Hi Ivan, "network Roaming test2" in which "Roaming test2" is the SSID. regards, Venkat ----- Original Message ----- From: "Ivan Kalik" <tnt(a)kalik.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: Fwd: Certificate problem on Windows XP clinet .. Date: Sat, 23 Aug 2008 01:51:24 +0100 > How? What do you think we know about "network Roaming > test2" setup? > > Ivan Kalik > Kalik Informatika ISP > > > Dana 22/8/2008, "Venkata LK Mula" > <vlkmula(a)saitechnology.com> piše: > > > Hi, > > Can any body respond to my earlier requst please. > > > > regards, > > Venkat > > > > > >----- Forwarded Message ----- > >From: "Venkata LK Mula" > >To: > >Subject: Certificate problem on Windows XP clinet ... > >Date: Thu, 21 Aug 2008 00:33:26 +0530 > > > > > > > > Hi, > > > > Regarding the above mentioned subject, we are facing the > > problem of "Windows was unable to find the certificate > > to log on to the network Roaming test2". > > > > Though the certificates are installed properly, and when > > we are using the same certificates for 'PEAP-MSCHAPv2' > > with 'validate server certificate' working fine. > > > > Can any one look into the same and respond me back > please. > > > regards, > > Venkat > > > > > > > > [Attachment: cacert.der] > > [Attachment: clinet.p12] > > > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: Fwd: Certificate problem on Windows XP clinet ...
by Venkata LK Mula 23 Aug '08

23 Aug '08

Hi Ivan, "network Roaming test2" in which "Roaming test2" is the SSID. regards, Venkat ----- Original Message ----- From: "Venkata LK Mula" To: FreeRadius users mailing list Subject: Re: Fwd: Certificate problem on Windows XP clinet .. Date: Sat, 23 Aug 2008 08:31:01 +0530 > Hi Ivan, > > "network Roaming test2" in which "Roaming test2" is the > SSID. > > regards, > Venkat > > ----- Original Message ----- > From: "Ivan Kalik" > To: "FreeRadius users mailing list" > > Subject: Re: Fwd: Certificate problem on Windows XP clinet > .. > Date: Sat, 23 Aug 2008 01:51:24 +0100 > > > How? What do you think we know about "network Roaming > > test2" setup? > > > > Ivan Kalik > > Kalik Informatika ISP > > > > > > Dana 22/8/2008, "Venkata LK Mula" > > piše: > > > > > Hi, > > > Can any body respond to my earlier requst please. > > > > > > regards, > > > Venkat > > > > > > > > >----- Forwarded Message ----- > > >From: "Venkata LK Mula" > > >To: > > >Subject: Certificate problem on Windows XP clinet ... > > >Date: Thu, 21 Aug 2008 00:33:26 +0530 > > > > > > > > > > > > Hi, > > > > > > Regarding the above mentioned subject, we are facing > > > the problem of "Windows was unable to find the > > > certificate to log on to the network Roaming test2". > > > > > > Though the certificates are installed properly, and > > > when we are using the same certificates for > > > 'PEAP-MSCHAPv2' with 'validate server certificate' > > working fine. > > > > Can any one look into the same and respond me back > > please. > > > > regards, > > > Venkat > > > > > > > > > > > > [Attachment: cacert.der] > > > [Attachment: clinet.p12] > > > > > > > > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html

2 1

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)
by William Hegardt 23 Aug '08

23 Aug '08

I hate to resurrect this long thread from July 22-28, but I have the same problem and never saw a resolution. I'm using FreeRadius 2.0.5 on CentOS 5.2 with wpa_supplicant 0.6.4 (latest to date). I'm using the bootstrap script to generate example certificates. I also created a client certificate using make client.pem. I configured wpa_supplicant with ca.pem, client.pem and client.key. EAP-TLS authentication fails with the "fatal unknown ca" message. If I hack the Makefile like Sergio mentioned last month to sign the client certificate with the CA key, then authentication succeeds. In last month's thread, Alan DeKok posted: > You need to follow the documentation in eap.conf. > > # If CA_file (below) is not used, then the > # certificate_file below MUST include not > # only the server certificate, but ALSO all > # of the CA certificates used to sign the > # server certificate. > certificate_file = ${certdir}/server.pem > > Have you done that? In my case, CA_file does indeed refer to ca.pem as created by the bootstrap script. So I'm assuming that I don't need to touch the server.pem file as created. I'd really like to understand what's wrong. Could wpa_supplicant be somehow incompatible with the bootstrap certificate chain? Thanks

5 9

3Com 4500 and 5500 local login
by Oxiel 23 Aug '08

23 Aug '08

Hello gurus. Is me again :), trying to authenticate local users to the switch through freeradius 2.0.5, but no success with 3Com 4500/5500. My users file has: admin Cleartext-Password := "XXXXX" Framed-IP-Address = "%{Framed-IP-Address}", 3Com-User-Access-Level = 3Com-Administrator, Reply-Message = "Hola usuario, %{User-Name}" radiusd -X shows this, as you can see i'm getting the access-accept message: rad_recv: Access-Request packet from host 192.168.100.246 port 5001, id=72, length=204 User-Name = "admin" User-Password = "XXXXX" NAS-IP-Address = 192.168.100.246 NAS-Identifier = "001cc53e1b02" NAS-Port = 16809985 NAS-Port-Id = "unit=1;subslot=0;port=8;vlanid=1" NAS-Port-Type = Ethernet Service-Type = Login-User Login-IP-Host = 192.168.100.246 Calling-Station-Id = "0000-0000-0000" Framed-IP-Address = 192.168.100.241 H3C-Connect_Id = 72 H3C-Product-ID = "4500" H3C-Ip-Host-Addr = "192.168.100.241 00:00:00:00:00:00" H3C-NAS-Startup-Timestamp = 954633321 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry admin at line 220 expand: %{Framed-IP-Address} -> 192.168.100.241 expand: Hola usuario, %{User-Name} -> Hola usuario, admin ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "XXXXX" rlm_pap: Using clear text password "XXXXX" rlm_pap: User authenticated successfully ++[pap] returns ok +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 72 to 192.168.100.246 port 5001 Framed-IP-Address = 192.168.100.241 3Com-User-Access-Level = 3Com-Administrator Reply-Message = "Hola usuario, admin" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 72 with timestamp +15 Ready to process requests. The switch shows me this: debugging radius packet terminal debugging *0.683215396 4500 RDS/8/DEBUG:- 1 -Recv MSG,[MsgType=Normal auth request Index = 72, ulParam3=2185152212] *0.683215397 4500 RDS/8/DEBUG:- 1 -Send attribute list: *0.683215398 4500 RDS/8/DEBUG:- 1 - [1 User-name ] [7 ] [admin] [2 Password ] [18] [B9CE88BA96205FBFF301351E5ED4A8C5] [4 NAS-IP-Address ] [6 ] [192.168.100.246] [32 NAS-Identifier ] [14] [001cc53e1b02] [5 NAS-Port ] [6 ] [16809985] [87 NAS_Port_Id ] [34] [unit=1;subslot=0;port=8;vlanid=1] *0.683215399 4500 RDS/8/DEBUG:- 1 - [61 NAS-Port-Type ] [6 ] [15] [3com-26 Connect_ID ] [6 ] [72] [6 Service-Type ] [6 ] [1] [14 Login-Host ] [6 ] [192.168.100.246] [31 Caller-ID ] [16] [303030302D303030302D30303030] [8 Framed-Address ] [6 ] [192.168.100.241] *0.683215400 4500 RDS/8/DEBUG:- 1 - [3com-255Product-ID ] [6 ] [4500] [3com-60 Ip-Host-Addr ] [35] [192.168.100.241 00:00:00:00:00:00] [3com-59 NAS-Startup-Timestamp ] [6 ] [954633321] *0.683215401 4500 RDS/8/DEBUG:- 1 -Send: IP=[192.168.100.91], UserIndex=[72], ID=[72], RetryTimes=[0], Code=[1], Length=[204] *0.683215401 4500 RDS/8/DEBUG:- 1 -Send Raw Packet is: *0.683215402 4500 RDS/8/DEBUG:- 1 - 01 48 00 cc e4 54 00 00 e7 22 00 00 b1 26 00 00 29 3b 00 00 01 07 61 64 6d 69 6e 02 12 b9 ce 88 ba 96 20 5f bf f3 01 35 1e 5e d4 a8 c5 04 06 c0 a8 64 f6 20 0e 30 30 31 63 63 35 33 65 31 62 30 32 05 06 01 00 80 01 57 22 75 6e 69 74 3d 31 3b 73 75 62 73 6c 6f 74 3d 30 3b 70 6f 72 74 3d 38 3b 76 6c 61 6e 69 64 3d 31 3d 06 00 00 00 0f 06 06 00 00 00 01 0e 06 c0 a8 64 f6 1f 10 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 08 06 c0 a8 64 f1 1a 3b 00 00 63 a2 1a 06 00 00 00 48 ff 06 34 35 30 30 3c 23 31 39 32 2e 31 36 38 2e 31 30 30 2e 32 34 31 20 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30 3a 30 30 3b 06 38 e6 8c 69 *0.683215413 4500 RDS/8/DEBUG:- 1 -Recv MSG,[MsgType=PKT response Index = 59, ulParam3=2182466612] *0.683215414 4500 RDS/8/DEBUG:- 1 -Receive Raw Packet is: *0.683215415 4500 RDS/8/DEBUG:- 1 - 02 48 00 3b 22 a0 e3 77 89 0b 9f f0 0f 82 02 71 a6 81 7b 68 08 06 c0 a8 64 f1 1a 0c 00 00 00 2b 01 06 00 00 00 03 12 15 48 6f 6c 61 20 75 73 75 61 72 69 6f 2c 20 61 64 6d 69 6e *0.683215416 4500 RDS/8/DEBUG:- 1 -Receive:IP=[192.168.100.91],Code=[2],Length=[59] *0.683215417 4500 RDS/8/DEBUG:- 1 - [8 Framed-Address ] [6 ] [192.168.100.241] [3com-1 User_Access_Level ] [6 ] [3] [18 Reply-Message ] [21] [Hola usuario, admin] Has anybody done this?, should i sent something else on the reply? Best regards. Oxiel __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.yahoo.es

2 1

radsniff
by Lemaster, Rob 23 Aug '08

23 Aug '08

I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples?

2 1