- Freeradius-Users - lists.freeradius.org

definitively, I have a problem with eap-tls
by Sergio 25 Jul '08

25 Jul '08

HI, continuing with Reveal MAP problem with unknown ca's under eap-tls using default configuration.... private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem freeradius tell me this: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0bdb], Certificate --> verify error:num=24:invalid CA certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA well, it isn't a problem: cp server.pem root.pem cat ca.pem >> root.pem then I change CA_file = ${cadir}/root.pem ......and.....eureka!!!! authentication succesfully ....but now there is a problem to check the CRL because root.pem then, something is wrong before making root.pem. ....well, just tell freeradius how to find certificates.... c_rehash /usr/local/etc/raddb/certs also doesn't works I think Reveal had the same problem and I have read about this on mailing list but nothing. Also I've tried to install ca.pem on /etc/ssl/certs using "ln -s". Has somebody encountered problems with this apart from Reveal MAP and me? P.D. route certification into windows isn't a problem, only tell xp_supplicant who is root authority (It was logical)

3 14

New SNMP Code
by Alan DeKok 25 Jul '08

25 Jul '08

Sky Network Services has contributed a preliminary implementation of SNMP in the server. It's a Perl script that communicated with net-snmpd via the AgentX protocol. and with FreeRADIUS via the new Status-Server statistics functionality. The result is that you can now obtain FreeRADIUS statistics via SNMP. The code is alpha, but has been tested to work. Please test, and submit patches, suggestions, fixes, etc. back to the list, or to bugs.freeradius.org. See http://git.freeradius.org for the latest source. The new SNMP is in scripts/snmp-proxy/ Alan DeKok.

4 18

PEAP or TTLS and Microsoft Vista.
by Lech Karol Pawłaszek 24 Jul '08

24 Jul '08

Hello. I need your help. For the last few days I try to authenticate and authorize Microsoft Vista operating system against FreeRADIUS and 3com switch (as NAS) for wired authentication with no luck. I'm using FreeRADIUS 2.0.5 from sources built on Debian Etch GNU/Linux and certs made by bootstrap command (so those certs should have a bit of magic from xpextensions afaik). I try to make little steps and change as less as possible - to be honest I've only added user to the users file and client definition to the clients.conf file. I've tested my configuration with eapol_test command (as suggested at this site[1]) and it works fine. I've tested it against MacOsX 10.4 and MacOsX 10.5 and it works fine. I even tested it against Windows XP SP2 and it works fine. It doesn't work with Windows Vista and Windows XP SP3. Please help! What I have spotted is that the server sends "Access Challenge" and then on OSX dialog pops up where I can accept server's certificate and on Windows it's over. So I think it's the issue mentioned on this site[2] however i DO have Validate Server Certificate un-checked. One more thing. If I won't use Windows' PEAP authorization and install securew2 and use securew2's auth - I am able to connect. Work for a minute or so and then NAS reports lost carrier and the connection is lost. I've written about this issue about a year ago however this was put on-hold. You might want to look at logfiles from that tests. [1] - http://deployingradius.com/scripts/eapol_test/ [2] - http://deployingradius.com/documents/configuration/eap-problems.html [3] - http://lists.freeradius.org/pipermail/freeradius-users/2007-July/msg00096.h… Any hints and tips much appreciated. I'm attaching two logfiles. The first one - freeradius.log - is the one where I'm trying to authenticate using system-wide PEAP. The second one, namely freeradius-securew2.log, is the one where switch receives Access-Accept and a few moments later switch sends back information that the carrier is lost. I've compressed both logfiles. I hope it's ok here. If it's not - please let me know. Thanks in advance. -- Lech Karol Pawłaszek <ike> "You will never see me fall from grace." [KoRn]

7 17

Token Authorization
by krzychk2 23 Jul '08

23 Jul '08

Hi, I'm a new user in freeRADIUS. I'd like to do a solution like token authentication. Firts step. User is authorized by user/password. Secound step: For the authentication from LDAP is taken further informations (like UID, date of birth) and user is asked about it. I think it is something familiar with CHAP Challenge but I don't know how to combine this solutions. Could somebody help me?? Greetings Krzysztof Kardas

4 5

authorization: unlang/NAS-IP-Address
by leopold 23 Jul '08

23 Jul '08

Hi, I am using freeradius 2.0.5 with MySQL, I am very new to Radius and FreRadius so please pardon my ignorance I need to reject user if his NAS-IP-Address input attribute does not match check attributes defined for his group. For example radgroupcheck | 1 | GROUP1 | NAS-IP-Address | == | x.x.x.1 | 2 | GROUP1 | NAS-IP-Address | == | x.x.x.2 | 3 | GROUP1 | NAS-IP-Address | == | x.x.x.3 If user is coming from NAS-IP-Address x.x.x.1 or x.x.x.2 or x.x.x.3 the user should be accepted and reply attributes are sent back If however if user is coming from NAS-IP-Address y.y.y.1 he should be rejected (even in the case he provide a valid password and NAS y.y.y.1 is properly defined in NAS table with a valid shared key) Since I found that only one operator "==" for NAS-IP-Address check attrubute can be found, I changed authorize_group_check_query, but still I managed to get reply list as empty for invalid NAS-IP and expected attributes from valid NAS (which is part of check attributes) but user is accepted in both cases. Is there a way to check if "reply" list is empty in unlang (does not contain ANY attributes)? I tried this, but it does not work. if (!reply:[0]) { # reply list is empty reject } Do you have any suggestions? Thanks you very much for your reply. -- View this message in context: http://www.nabble.com/authorization%3A-unlang-NAS-IP-Address-tp18609937p186… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

POP3
by Vittore Zen 23 Jul '08

23 Jul '08

Hi, how to use (a remote) pop3 server with (a local) freeradius to authenticate users? thanks v.

4 3

Does anyone have a "fast reauth(session resumption)" patch for freeradius server???
by Cristian Novac 23 Jul '08

23 Jul '08

Thank you!!! Cristian Novac.

1 0

What's possible in hints file?
by Stefan A. 23 Jul '08

23 Jul '08

Gurus, normally, I would do a short check, but currently I've no connection to one of my running FR, but have to plan some extensions. Has someone of you done something like the following? Regarding 'hints' - file: Would it be possible to use - $INCLUDE /path/file? - Fall-Trough? - temp A/V pairs defined in the global dictionary file using an ID > 3000 and using them as %{My-Attribute} later on? Thank you. Regards Stefan

2 1

does anyone have a "fast reauth(session resumption)" patch???
by Cristian Novac 23 Jul '08

23 Jul '08

Thank you ! Cristian NOVAC

1 0

Keeping a set amount of detail logs
by lowbassman＠gmail.com 23 Jul '08

23 Jul '08

I've enabled "detail auth_log" and "detail reply_log" (it'd be great if there was a way to tie auths and replies together from the different log files somehow) and FreeRadius is creating new logs each day. I'm assuming that I'll need to take care of removing old logs on my own? Otherwise I'll be filling my disk up pretty quickly. Thanks, ~Matt

5 5