- Freeradius-Users - lists.freeradius.org

Freeradius 1.1.7 and EAP-TTLS with PAP as inner authentication
by d_maccari 14 Mar '08

14 Mar '08

I'm using EAP-TTLS with PAP as inner authentication. I'm wondering if it is possible to use a different module than standard PAP (maybe a script) to do the final step of authentication process and, if it is possible, how this script should be done. Bye Dario Maccari P.S. Sorry for previus post made as a reply

1 0

authentication question
by Emre Ersin 14 Mar '08

14 Mar '08

Hi, I am trying to authenticate our wired Windows users by using rlm_perl module over secured IMAP. When I give radtest command with a user-name and user-password it accepts; --------------------------------------------------------------------------- # radtest USERNAME PASSWORD localhost 0 testing123 Sending Access-Request of id 201 to 127.0.0.1 port 1812 User-Name = "USERNAME" User-Password = "PASSWORD" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=201, length=20 --------------------------------------------------------------------------- *Radeapclient also works if I supply User-Password. But xp supplicants (naturally) doesn't send user-passwords while using eap-md5. And I really don't want to create thousands of client certificates. Which protocol do I have to use or... Is it possible? Is there a way to authenticate winxp (and vista (and also Macos users)) users without installing any client program? Supplicant (winxp) ---- NAS (hp2626) -------- WAN | | RS -- rlm_perl ----- IMAP(s) or POP3(s) servers (more than one) Thanks

2 1

Re: RFC 2866 - Accounting ON / Accounting OFF packets
by David Mitton 14 Mar '08

14 Mar '08

3 2

perl and ldap at the same time??
by Oguzhan Kayhan 13 Mar '08

13 Mar '08

Hello, I wonder if i can make a dual authentication check via freeradius. I am using rlm_perl right now for our accounting needs. What i want is to add LDAP auth. Ofcourse i can add this function to perl script that i write but, it is better to use freeradius ldap function. So, is it possible to check ldap if the username not accepted in rlm_perl? Or only one option can be used for authentication?

2 1

Proven Hardware Platfoｒm
by Koichi Yagishita 13 Mar '08

13 Mar '08

Dear All, If you know proven hardware platform operating FreeRADIUS for managing about 1,000 users and 10,000 users, let me know. Best Regards, Yagishita BWA Project Japan Radio Co.,Ltd.

2 1

Re: virtual server configuration
by usawebbox＠fastmail.fm 13 Mar '08

13 Mar '08

> It also says: > # If CA_file (below) is not used, then the > # certificate_file below MUST include not > # only the server certificate, but ALSO all > # of the CA certificates used to sign the > # server certificate. > > Please read ALL of the comments in a module you are configuring. > Selectively reading them means that you miss vital information. > > Alan DeKok. Except that my server cert does contain a CA cert. I'm not 100% sure it's sufficient, because it was issued from an intermediate CA (it needs to be the signer(s) not the issuer, right?), so I went to another CA got a webserver cert in pem format directly from the root. Downloaded the root CA cert in pem format and appended them.... same error: Error reading Trusted root CA list (null) Do we know this mode is working (No CA_File, but certificate file with server cert + ca cert)? In any case, I'd be willing to experiment more. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - And now for something completely different

1 0

virtual server configuration
by usawebbox＠fastmail.fm 13 Mar '08

13 Mar '08

Pardon the non-threaded replies. I'll have to find a client that works with the list. >> I'm still having trouble with the eap_gtc section, because when I remove >> TLS or empty it or try to return reject, the server won't start. Is >> removing the section the right way to not support an eap type on one >> virtual server? > > Yes. Could you post the error? I should have done that. When TLS is empty (i.e. TLS {}): rlm_eap: SSL error error:0200100E:system library:fopen:Bad address rlm_eap_tls: Error reading certificate file (null) rlm_eap: Failed to initialize type tls When TLS is removed: rlm_eap: Unable to load EAP-Type/ttls, as EAP-Type/TLS is required first. Or, if TTLS is also removed: rlm_eap: Unable to load EAP-Type/peap, as EAP-Type/TLS is required first. This makes sense, as I'll need my server cert for PEAP. If those certs have to be defined in the TLS block, what is the right way to disable TLS in this case, but still have PEAP working? I tried deleting the CA_file, so I wouldn't be able to verify user certs, but it's required. Anyway, I don't want to offer TLS and fail it, I want to NAK it on server2. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - Does exactly what it says on the tin

2 4

Include Vendor Dictionary ?
by David Toms 12 Mar '08

12 Mar '08

Hello all, I'm using freeradius 2.0.1 with mysql to authorize users for a wireless hotspot. I have a wireless router running CoovaAP firmware. I'm using Arch Linux, and everything is now working great, with ONLY ONE niggling problem remaining I have not modified the freeradius configs much. I added "VENDOR ChilliSpot 14559" to the dictionary file, which I hoped would make freeradius read the "dictionary.chillispot" dictionary. The file says "see man dictionary for the format of the dictionary files", but this man page is not installed. There is no indication in the radius log that it has read a vendor specific dictionary. When freeradius attempts to authorise a user in the appropriate group, a message: rlm_sql: Failed to create the pair: Invalid octet string "1024" for attribute name "ChilliSpot-Max-Total-Octets" is logged and the user is rejected. I am assuming that the attribute name is invalid, because the vendor specific attributes are not known to radius. I added it to the default realm in the "attrs" configuration file, but no good. So, what is wrong? How do I allow vendor specific attributes to be sent in a radius reply? Many thanks in anticipation. David

2 4

Performance and hardware
by Mikhail Novikov 12 Mar '08

12 Mar '08

Hello. I have a question about FreeRadius: RADIUS proxy server (FreeRadius) should perform 150 - 250 requests per second. Some attributes in requests have to be modified (rules is specified in hints file). OS is Debian Linux. How much memory should have the server? What the processor (in GHz) do you recommend? Best regards, Michael

2 1

Rule for don't log specific user session.
by Rafael Medici 12 Mar '08

12 Mar '08

Hello, Is there a way to don't log nothing for a specific user, creating a rule in sql_log? You will probably ask me why! Because i have a plugin running on nagios, that checks for authentication with a specific user ex: "testuser" every 5 minutes, and at the end of the day my database grows with useless information. We are a global hotspot provider, so this check running on nagios is performed in 10.000 hotspots, to test for authentication, so you could imagine that this "testuser" generates infinite registers. I think put some kind of trigger to do that, will probably slow down my server performance, because we have a huge users database. I'm running freeradius(1.1.7) + postgre. Regards, Rafael Medici

4 6