- Freeradius-Users - lists.freeradius.org

Re: EAP-TNC supported?
by Ingo Bente 21 Aug '08

21 Aug '08

> Message: 4 > Date: Thu, 21 Aug 2008 14:39:48 +0200 > From: "Martin Schneider" <martincschneider(a)googlemail.com> > Subject: Re: EAP-TNC supported? > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <690347540808210539t1dabd41amdbb0d80f32271073(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi Ingo and others > >>> Does anybody know about a patch or something for FreeRadius that adds >>> more stable EAP-TNC processing? I heard about a patch from FH Hannover >>> (http://tnc.inform.fh-hannover.de/wiki/index.php/Main_Page) but I >>> don't know how good this one works. Did maybe anybody of you guys play >>> with that patch? >> Yes, it is very experimental. We have done some refactoring the last >> weeks but the new version of the EAP-TNC-Patch is currently not in the >> FreeRADIUS sources. You can download it from >> http://tnc.inform.fh-hannover.de. We will modify some further aspects >> soon (such as removing the dynamic loading of NAA-TNCS.so at runtime). > > Great! Thanks for that hint. I'll have a look at this soon. So you'll > want to integrate the TNC Server directly into the EAP Module, or to > be more precise, you'll add a "TNC Type Module" to the EAP module? There is already an EAP-TNC module. The TNC functions are split: most of the NAA part is realized in the EAP-TNC module (in C). Some NAA parts and the TNCS part is realised in a separate shared object (NAA-TNCS.so). Currently, the EAP-TNC module dynamically loads the NAA-TNCS.so at runtime (runtime dynamic linking I think ...). We want to change it to load time dynamic linking (as all the other methods do it). Alan suggested this already some time ago. I hope that the terms are right ... > >> You can do EAP-TNC inside EAP-TTLS without modifying the source. I >> tested it with the latest development version of wpa_supplicant. But you >> will have to modify the source if you want to to EAP-TNC inside EAP-TTLS >> _after_ another EAP-method (such as MD5). > > That's good news for me! > > So basically, the "only thing I need to do" when I want to perfom > EAP-TNC is to create a IMC/IMV pair and integrate the IMC to > wpa_supplicant and the IMV to Free Radius? You don't have to create one on your own. You can use the IMC/IMV HostScanner provided by TNC@FHH or the sample IMC/IMV pairs that are part of libtnc. The corresponding IMC.so and IMV.so files are loaded dynamically at runtime by wpa_suppicant and FreeRADIUS. Let me know if you need more information because our website is currently not up2date. Regards Ingo > > Regards > Martin > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 40, Issue 94 > ************************************************

1 0

Re: EAP-TNC supported?
by Ingo Bente 21 Aug '08

21 Aug '08

> Message: 3 > Date: Thu, 21 Aug 2008 08:36:07 +0200 > From: "Martin Schneider" <martincschneider(a)googlemail.com> > Subject: Re: EAP-TNC supported? > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <690347540808202336k5ce8ffd5jc0c3efea54b1835d(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi > > 2008/8/20 Alan DeKok <aland(a)deployingradius.com>: >> Martin Schneider wrote: >>> - I read in wikipedia, that the spring 2008 release of FreeRadius has >>> "experimental EAP-TNC" support. I couldn't find any information on the >>> FreeRadius homepage or wiki, that this information is correct. Has FreeRadius >>> EAP-TNC support? And "how experimental" is the EAP-TNC support? >> It's very experimental. Some people have gotten it to work, but I >> don't think it's ready for production use. > > What a pity! > > Does anybody know about a patch or something for FreeRadius that adds > more stable EAP-TNC processing? I heard about a patch from FH Hannover > (http://tnc.inform.fh-hannover.de/wiki/index.php/Main_Page) but I > don't know how good this one works. Did maybe anybody of you guys play > with that patch? Yes, it is very experimental. We have done some refactoring the last weeks but the new version of the EAP-TNC-Patch is currently not in the FreeRADIUS sources. You can download it from http://tnc.inform.fh-hannover.de. We will modify some further aspects soon (such as removing the dynamic loading of NAA-TNCS.so at runtime). > >>> - In case FreeRadius supports EAP-TNC, is it possible to run EAP-TNC >>> "inside" a EAP-TTLS tunnel? EAP-TTLS as outer method and EAP-TNC as >>> inner method? >> No. EAP-TNC is designed to be run as an authorization method *after* >> the user has been authenticated. It *cannot* be run all by itself >> inside of a TTLS tunnel. >> >> You can run it inside of the TTLS tunnel after another EAP method has >> been executed. You may have to edit the source code to get this to work. > You can do EAP-TNC inside EAP-TTLS without modifying the source. I tested it with the latest development version of wpa_supplicant. But you will have to modify the source if you want to to EAP-TNC inside EAP-TTLS _after_ another EAP-method (such as MD5). > Ok, thanks for clarifying this point! I really mixed this one up. > > I read in the EAP-TTLS draft, that you can perform mutual > authentication of server AND client using EAP-TTLS. (Client also needs > a Certificate...). So theoretically you should be able to run EAP-TNC > directly after EAP-TTLS in the TLS tunnel without any other user > authenticating EAP-method? > Yes. Regards Ingo > Regards > Martin > > >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> > > > ------------------------------ > > Message: 4 > Date: Thu, 21 Aug 2008 08:42:16 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: EAP-TNC supported? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <48AD0E48.1040803(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Martin Schneider wrote: >> Does anybody know about a patch or something for FreeRadius that adds >> more stable EAP-TNC processing? I heard about a patch from FH Hannover >> (http://tnc.inform.fh-hannover.de/wiki/index.php/Main_Page) but I >> don't know how good this one works. Did maybe anybody of you guys play >> with that patch? > > The EAP-TNC code in FreeRADIUS *is* the FH Hannover code. There's > just *more* work that has to be done to make it ready for a production > environment. > >> I read in the EAP-TTLS draft, that you can perform mutual >> authentication of server AND client using EAP-TTLS. (Client also needs >> a Certificate...). So theoretically you should be able to run EAP-TNC >> directly after EAP-TTLS in the TLS tunnel without any other user >> authenticating EAP-method? > > Perhaps. Check with the TNC specifications to see if this is permitted. > > Alan DeKok. > > > ------------------------------ > > Message: 5 > Date: Thu, 21 Aug 2008 09:31:59 +0100 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: FreeRadius 2.0.5 AD PEAP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20080821083159.GA27802(a)wildfire.net.ic.ac.uk> > Content-Type: text/plain; charset=us-ascii; format=flowed > >>> Perhaps try it with a Cleartext-Password in the "users" file. i.e. >>> *Without* using ntlm_auth. That works for me, including with >> eapol_test, and TTLS/EAP-MSCHAPv2. >> >> Can you clarify this setup/change to test? I was pretty sure I needed >> to use ntlm_auth to auth against AD to test mschapv2 > > Put a test user in the "users" file: > > test Cleartest-Password := "blah", MS-CHAP-Use-NTLM-Auth := 0 > >>> If that still fails, then there's something wrong with the system >> that breaks the server in 2.0.5. >> >> Running Samba 3.2.0 on Fedora 9 > > Your problem is very odd. I'm using 2.0.5 on RHEL5 with ntlm_auth and > it's working fine. > > The only time I've seen eapol_test fail with "mismatch" is when I've > failed to strip the DOMAIN\ or @DOMAIN.COM from usernames with realms > and this has confused the key hashing - but your usernames are > unadorned. > > Perhaps the Samba version in F9 has problems? What OS and samba version > is your (working) 1.1.7 server running? > >>> FYI: Unknown network block for the CA_CERT with regards to the eapol >>> test config file >>> What does that mean? >> Within the config you provided to for eapol_test at the bottom is a >> ca_cert declaration that errors out when uncommented >> >> Anyone using FC9 with freeradius 2.0.5 against AD working that I can use >> to compare? >> >> Thanks much appreciated >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 6 > Date: Thu, 21 Aug 2008 10:53:17 +0200 > From: Thomas Buchberger <buchberger(a)nefonline.de> > Subject: Re: Auth-Type := Accept - CHAP problems > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <48AD2CFD.3040206(a)nefonline.de> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi Alan and Ivan, > > Alan DeKok wrote: >>> Config looks like this: >>> >>> DEFAULT Auth-Type := Accept >>> >> This completely bypasses any password checks. >> >>> ERX-Virtual-Router-Name = "vpn:XXX", >>> ERX-Egress-Policy-Name = "XXX", >>> ERX-Local-Loopback-Interface = "loopback 255", >>> Service-Type = Framed-User, >>> Framed-Protocol = PPP, >>> Fall-Through = Yes >>> >>> Test100 Password = "Test100" >>> >> Use: >> >> Test100 Cleartext-Password := "Test100" >> > OK - now I understand... > with Cleartext-Password PAP and CHAP behave the same way... > For us the wrong way :-) > Is there a possibility so solve it with freeradius? > We want to Accept all Users but give "authenticated" (correct username > and password) users individual attributes and "non authenticated" users > (wrong username and / or password) different attributes but no "Login > incorrect". >

2 1

Re: convert steel-belt radius .dct to freeradius dictionary
by S Adrian 21 Aug '08

21 Aug '08

> Here it is attached to this message. Thanks .. but still .. those thingies .. c .. cr .. 7064 .. what are they ?

2 1

Re: performance report?
by Kevin J 21 Aug '08

21 Aug '08

Well, Radius protocol is not just machine-to-machine issue. I think you don't understand how request protocol can be simulated by hammering with our tool. We have tested various protocols by this tool. Per our test results, radius can reach the limit of requests by hammering easily but CPU was still low. We have various statistics on all these. My point is that radius was not able to use full cpu resource until reaching max number of handful requests. Your point with more clients does not make sense because we already reached max reqeusts hammering by our tool and that was same regardless of adding more clients under multi-threaded enviroment. ----- Original Message ---- From: Anders Holm <anders.holm(a)sysadmin.ie> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, August 20, 2008 12:52:20 PM Subject: Re: performance report? Re: performance report? I still do ... I’ve had 10 multi core boxes hammering one server, still not enough .. You need more clients .. ;) RADIUS as such requires very little from the server side in terms of CPU. All it really does is compare x with y and then respond yes or no, once you strip down all the various variants of auth protocols. That’s not a high requirement. I’m confident if you use a SSL enabled protocol, your CPU on the server is spending more time per request doing the necessary SSL stuff than RADIUS related work .. A pint of unspecified beverage says you’ll need more client CPU .. I’ll agree with the pint .. //anders On 20/08/2008 20:45, "Kevin J" <kevinsmailer(a)yahoo.com> wrote: Well, that's why I am saying we used the nas simulation tool. We can hammer a lot of traffic with this multi-threaded tool and also we tried at least three client boxes so don't assume our traffic was not enough. ----- Original Message ---- From: Anders Holm <anders.holm(a)sysadmin.ie> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, August 20, 2008 12:25:19 PM Subject: Re: performance report? Re: performance report? It is not likely your actually putting too much strain on the server side. You’ll need quite a lot of machines hammering the RADIUS server before it’ll break into a sweat. The client side would have higher CPU utilization then the server side, per request. Comparing one program to another is not exactly comparing apples with apples. It’s more like comparing a duck with a fork lift. One flies, the other just doesn’t (or rather, when it does, you don’t want to be there to see it) ... //anders On 20/08/2008 20:18, "Kevin J" <kevinsmailer(a)yahoo.com> wrote: Does anybody know the performance on Sun T-1000? Just noticed that radius cannot reach more than 20% CPU time when we ran a heavy traffic with nas simulations. We have tested some other programs and could reach even more than 90% so just curious anybody experienced the similar result. ________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

EAP-TNC supported?
by Martin Schneider 21 Aug '08

21 Aug '08

Hello everybody, I've got two questions: - I read in wikipedia, that the spring 2008 release of FreeRadius has "experimental EAP-TNC" support. I couldn't find any information on the FreeRadius homepage or wiki, that this information is correct. Has FreeRadius EAP-TNC support? And "how experimental" is the EAP-TNC support? - In case FreeRadius supports EAP-TNC, is it possible to run EAP-TNC "inside" a EAP-TTLS tunnel? EAP-TTLS as outer method and EAP-TNC as inner method? Hope anybody can help me! Thank you in advance Regards Martin

2 3

Re: Re: expiration or session-timeot
by Bozhan Boiadzhiev 20 Aug '08

20 Aug '08

ok thanks one more thing. is it possible to set timestamps instead date as Expiration attribute. I need this for example if i want to give a given customer access to internet for one day. As i understand Expiration attribute can get only date values. Can i set timestamp and radius to send Session-Timeout to NAS at that time, for example instead on 00:00 on given date on 13;45 on that date? >-------- Оригинално писмо -------- >От: "Ivan Kalik" >Относно: Re: expiration or session-timeot >До: "FreeRadius users mailing list" >Изпратено на: Сряда, 2008, Август 20 16:52:18 EEST >It calculates maximal session time and sends it to NAS as >Session-Timeout. If your NAS supports Session-Timeout attribute (and >most do) user will be signed off by the NAS if he is still logged on at >the expiration time. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 20/8/2008, "Bozhan Boiadzhiev" pi?e: > >>Hi, >>here is something i can't understand. >>If i set some user Expiration attribute for example 23.08.2008, >>and this user is connected to my NAS, how NAS will stop that user. >>Better explanation. >>I have setup mikrotik hotspot with radius authorization. >>Authorization works. User have access with given username and password, >>but i want to give user access to service for example for 7 days. >>Expiration attribute give me ability to set date when account expires. >>What happen on that give date. How radius will "tell" NAS to "unsubscribe"(cancel) >>access of that user. >> >>Thanks >> >>ps. >>sorry for bad english :( >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

2 1

Re: performance report?
by Kevin J 20 Aug '08

20 Aug '08

Well, that's why I am saying we used the nas simulation tool. We can hammer a lot of traffic with this multi-threaded tool and also we tried at least three client boxes so don't assume our traffic was not enough. ----- Original Message ---- From: Anders Holm <anders.holm(a)sysadmin.ie> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, August 20, 2008 12:25:19 PM Subject: Re: performance report? Re: performance report? It is not likely your actually putting too much strain on the server side. You’ll need quite a lot of machines hammering the RADIUS server before it’ll break into a sweat. The client side would have higher CPU utilization then the server side, per request. Comparing one program to another is not exactly comparing apples with apples. It’s more like comparing a duck with a fork lift. One flies, the other just doesn’t (or rather, when it does, you don’t want to be there to see it) ... //anders On 20/08/2008 20:18, "Kevin J" <kevinsmailer(a)yahoo.com> wrote: Does anybody know the performance on Sun T-1000? Just noticed that radius cannot reach more than 20% CPU time when we ran a heavy traffic with nas simulations. We have tested some other programs and could reach even more than 90% so just curious anybody experienced the similar result. ________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

performance report?
by Kevin J 20 Aug '08

20 Aug '08

Does anybody know the performance on Sun T-1000? Just noticed that radius cannot reach more than 20% CPU time when we ran a heavy traffic with nas simulations. We have tested some other programs and could reach even more than 90% so just curious anybody experienced the similar result.

2 1

Certificate problem on Windows XP clinet ...
by Venkata LK Mula 20 Aug '08

20 Aug '08

Hi, Regarding the above mentioned subject, we are facing the problem of "Windows was unable to find the certificate to log on to the network Roaming test2". Though the certificates are installed properly, and when we are using the same certificates for 'PEAP-MSCHAPv2' with 'validate server certificate' working fine. Can any one look into the same and respond me back please. regards, Venkat

1 0

Extend the ca certificates expire date
by Johan Nyman 20 Aug '08

20 Aug '08

Hello All, Can I extend the expire days for the CA certificate (ca.cnf) ? And if possible how long can I extend it as maximum? Right now the ca certificate´s maximum days are 30. Best regards, Johan Nyman

2 1