- Freeradius-Users - lists.freeradius.org

Raddius + Windows Vista
by Gustavo Chavelas 14 Mar '08

14 Mar '08

Hi to all friends. I'm new in this list. My problem is this: I have a freeradius-1.1.3-1.2.el5 into a CenOS 5, this is working without problem. The radius is for authenticate a wireless network clients. I have a Windows XP, Windows CE and Pocket PC and work very fine, all clients authenticate very good. My problem is with Window$$ Vista. This Operating System can't connect to my radius. Radius send me a message: Fri Mar 14 23:28:04 2008 : Auth: Login incorrect: [CLIENT/<no User-Password attribute>] (from client AP_RESPALDO port 384 cli MAC_ADRESS) Solve this problem it's very important for me. Somebody can help me? Regards PD: Alguien habla español en esta lista?

3 2

Modifying attributes
by Mikhail Novikov 14 Mar '08

14 Mar '08

Hello. I have another question: FreeRadius is installed and works like proxy RADIUS server. But one attribute in requests should be modified. Proxy have to change this field Nas-Port-ID = GigabitEthernet 0/0/2.12111010:1211-820 to this PortLLID = 1211-820 What should I do? Best regards, Michael Novikov

1 0

RFC 2866 - Accounting ON / Accounting OFF packets
by Arran Cudbard-Bell 14 Mar '08

14 Mar '08

Hi, RFC 2866 (5.5) States 'An Accounting-Request packet MUST have an Acct-Session-Id' but for Accounting Request packets with 'Acct-Status-Type' set to Accounting-On or Accounting-Off, there can be no Acct-Session-Id, as these are global events on the NAS... Unless the NAS is meant to send an Accounting-On or Accounting-Off packet for every session on the access point, when an Accounting-On or Accounting-Off event occurs... Does anyone know of a later RFC that clarifies this ? Also the index 'acctsessiontime' is missing for the radacct table in the default schema; makes the Accounting-On / Accounting-Off queries very slow doing a table scan on 1.4 million rows... Is this intentional or an oversight ? Might be an Idea to specify the default engine as InnoDB for the MySQL schemas. MyISAM (with it's table locks on every update/insert) just doesn't cut it with a reasonably busy RADIUS server; all connections in the db pool get used and users start being rejected. Not good ... Thanks, Arran ** -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

5 13

Freeradius 1.1.7 and EAP-TTLS with PAP as inner authentication
by d_maccari 14 Mar '08

14 Mar '08

I'm using EAP-TTLS with PAP as inner authentication. I'm wondering if it is possible to use a different module than standard PAP (maybe a script) to do the final step of authentication process and, if it is possible, how this script should be done. Bye Dario Maccari P.S. Sorry for previus post made as a reply

1 0

authentication question
by Emre Ersin 14 Mar '08

14 Mar '08

Hi, I am trying to authenticate our wired Windows users by using rlm_perl module over secured IMAP. When I give radtest command with a user-name and user-password it accepts; --------------------------------------------------------------------------- # radtest USERNAME PASSWORD localhost 0 testing123 Sending Access-Request of id 201 to 127.0.0.1 port 1812 User-Name = "USERNAME" User-Password = "PASSWORD" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=201, length=20 --------------------------------------------------------------------------- *Radeapclient also works if I supply User-Password. But xp supplicants (naturally) doesn't send user-passwords while using eap-md5. And I really don't want to create thousands of client certificates. Which protocol do I have to use or... Is it possible? Is there a way to authenticate winxp (and vista (and also Macos users)) users without installing any client program? Supplicant (winxp) ---- NAS (hp2626) -------- WAN | | RS -- rlm_perl ----- IMAP(s) or POP3(s) servers (more than one) Thanks

2 1

Re: RFC 2866 - Accounting ON / Accounting OFF packets
by David Mitton 14 Mar '08

14 Mar '08

3 2

perl and ldap at the same time??
by Oguzhan Kayhan 13 Mar '08

13 Mar '08

Hello, I wonder if i can make a dual authentication check via freeradius. I am using rlm_perl right now for our accounting needs. What i want is to add LDAP auth. Ofcourse i can add this function to perl script that i write but, it is better to use freeradius ldap function. So, is it possible to check ldap if the username not accepted in rlm_perl? Or only one option can be used for authentication?

2 1

Proven Hardware Platfoｒm
by Koichi Yagishita 13 Mar '08

13 Mar '08

Dear All, If you know proven hardware platform operating FreeRADIUS for managing about 1,000 users and 10,000 users, let me know. Best Regards, Yagishita BWA Project Japan Radio Co.,Ltd.

2 1

Re: virtual server configuration
by usawebbox＠fastmail.fm 13 Mar '08

13 Mar '08

> It also says: > # If CA_file (below) is not used, then the > # certificate_file below MUST include not > # only the server certificate, but ALSO all > # of the CA certificates used to sign the > # server certificate. > > Please read ALL of the comments in a module you are configuring. > Selectively reading them means that you miss vital information. > > Alan DeKok. Except that my server cert does contain a CA cert. I'm not 100% sure it's sufficient, because it was issued from an intermediate CA (it needs to be the signer(s) not the issuer, right?), so I went to another CA got a webserver cert in pem format directly from the root. Downloaded the root CA cert in pem format and appended them.... same error: Error reading Trusted root CA list (null) Do we know this mode is working (No CA_File, but certificate file with server cert + ca cert)? In any case, I'd be willing to experiment more. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - And now for something completely different

1 0

virtual server configuration
by usawebbox＠fastmail.fm 13 Mar '08

13 Mar '08

Pardon the non-threaded replies. I'll have to find a client that works with the list. >> I'm still having trouble with the eap_gtc section, because when I remove >> TLS or empty it or try to return reject, the server won't start. Is >> removing the section the right way to not support an eap type on one >> virtual server? > > Yes. Could you post the error? I should have done that. When TLS is empty (i.e. TLS {}): rlm_eap: SSL error error:0200100E:system library:fopen:Bad address rlm_eap_tls: Error reading certificate file (null) rlm_eap: Failed to initialize type tls When TLS is removed: rlm_eap: Unable to load EAP-Type/ttls, as EAP-Type/TLS is required first. Or, if TTLS is also removed: rlm_eap: Unable to load EAP-Type/peap, as EAP-Type/TLS is required first. This makes sense, as I'll need my server cert for PEAP. If those certs have to be defined in the TLS block, what is the right way to disable TLS in this case, but still have PEAP working? I tried deleting the CA_file, so I wouldn't be able to verify user certs, but it's required. Anyway, I don't want to offer TLS and fail it, I want to NAK it on server2. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - Does exactly what it says on the tin

2 4