- Freeradius-Users - lists.freeradius.org

EAP/TLS certificate Security question
by satish patel 08 Oct '07

08 Oct '07

Dear all I have installed EAP/TLS base authentication in my wirless network i have some question about security issue i have installed certificate on every laptop of wirless client machine now thing is that is some one will installed that certificate on unknow client then how can i privent them if one if my company user give his/her certificate so some one or hacker then ??? is it possible i create certificate per user i genrate ceruficate per username thats why no bodya can give his/her certificate to untrusted party or anyother guys .....give me suggestion for this question how to more secure my wirless NETWORK.. $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Unlimited freedom, unlimited storage. Get it now

2 1

Re : Freeradius Billing Account Management
by Eshun Benjamin 08 Oct '07

08 Oct '07

You may want to use phpMyPrepaidhttp://sourceforge.net/project/showfiles.php?group_id=127438 ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Pratchaya Chatuphian <pratchaya.note(a)gmail.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Samedi, 6 Octobre 2007, 12h47mn 59s Objet : Freeradius Billing Account Management Billing Account Management ======================= I 've successful about installation freeradius + mysql + dd-wrt ( using chillispot ). Now, i need you help. Would you like to suggestion me about "Hotspot Billing Account Management" ? that can provide postpaid/prepaid and register/sign up new user and can be refill internet time . Anybody have experience about this ? Thank you very much Best Regards., PT Ps. have it a opensource ? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

IPv6 deployment "howto"
by Mark J Elkins 08 Oct '07

08 Oct '07

Hi, I'm looking for some assistance on deploying IPv6. I'm currently using FreeRADIUS Version 1.1.6. I have for testing a Cisco 3640 running C3640-IK9S-M. The cisco has properly routable IPv6 addresses on its Ethernet and Loopback. I currently allow clients to dial to this device using the E1 (ISDN-PRI) and with 30 mica modems. Currently - I issue IPv4 addresses to clients and all is working well. I run MySQL as the admin backend to FreeRadius - ie thats where my clients info is stored. Usually - a client will be given a dynamic IPv4 address from a local pool of addresses configured on the Cisco... some (very few - but importaint) clients have static addresses (ie - for pre-defined holes in their company firewalls - etc). I'd like to also be able to provide dialup clients with IPv6 addresses - in addition to any IPv4 address. I think that I'd like to have a pool of IPv6 addresses on the cisco and to be able to provide clients with a /64 block (might look at a /60 or /56 one day). To do this in IPv4 - I send 255.255.255.254 to the NAS/Cisco. So whats the IPv6 equivalent? I expect to stay with FreeRADIUS Version 1.1.6 for now and understand that packets between the NAS and Radius will be via IPv4. Thats fine - though one day I think I expect to see FreeRadius listening on both IPv4 and IPv6 at the same time. The WIKI has little to say on IPv6 - except that IPv6 support is better on FreeRadius2.0 - but IPv6 attributes can be supplied from pre-2.0 versions of freeRadius. So - can anyone help me please? What magic lines would I need to add to my Cisco and what magic to add to FreeRadius? Anyone have Dialup clients being issued IPv6 addresses yet? 1 - I expect to add some sort of IPv6 field to MySQL (ie - for a static IPv6 address or to signify the NAS to use a Dynamic address) 2 - I expect the "authorize_check_query" and other SQL queries to change a bit... ie return IPv6 data - without breaking IPv4 only NAS's 3 - I expect to add an IPv6 pool and other lines of magic to my Cisco. just need a little help...? Someone must have done this already! -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

3 4

Freeradius Billing Account Management
by Pratchaya Chatuphian 06 Oct '07

06 Oct '07

Billing Account Management ======================= I 've successful about installation freeradius + mysql + dd-wrt ( using chillispot ). Now, i need you help. Would you like to suggestion me about "Hotspot Billing Account Management" ? that can provide postpaid/prepaid and register/sign up new user and can be refill internet time . Anybody have experience about this ? Thank you very much Best Regards., PT Ps. have it a opensource ?

1 0

freeradius error genrate CA.all certificate
by satish patel 06 Oct '07

06 Oct '07

Dear all I have installed openssl in /usr/local/openssl and installed radius with openssl support now what i going to genrate CA.all i got this error Certificate is to be certified until Oct 5 05:47:00 2008 GMT (365 days) Sign the certificate? [y/n]:y failed to update database TXT_DB error number 2 + openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out cert-srv.p12 -clcerts -passin pass:whatever -passout pass:whatever No certificate matches private key + openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin pass:whatever -passout pass:whatever 5829:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:140: + openssl x509 -inform PEM -outform DER -in cert-srv.pem -out cert-srv.der unable to load certificate 5830:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:642:Expecting: TRUSTED CERTIFICATE + echo -e '\n\t\t##################\n' $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Get the freedom to save as many mails as you wish. Click here to know how.

1 0

Re: Supplicant seems not to send password user (IT WORKED!!!)
by Sergio Belkin 05 Oct '07

05 Oct '07

2007/10/3, Alan DeKok <aland(a)deployingradius.com>: > Sergio Belkin wrote: > > Is 2.0.0-pre2 reliable for production usage? > > You *can* use the certificates it creates in 1.1.7. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > Well, finally I fixed the problem, issuing "real" certificates and importing cacert.pem in Windows. I used ttls. By other hand, I used DEFAULT Ldap-UserDN := `uid=%{User-Name},ou=people,dc=company,dc=com` in users file because I need to use LDAP and RADIUS *only* for authentication and authorization for a wireless network. Thanks everybody for your support! -- -- Sergio Belkin -

3 2

psql problem
by Budi Wibowo 05 Oct '07

05 Oct '07

dear all i have this problem on my freeradius ..and this make some field cant be inserted to db need advice for the proper configuration rlm_sql (sql): Reserving sql socket id: 21 rlm_sql_postgresql: query: UPDATE radacct ??SET AcctStopTime = ('2007-10-05 17:19:13'::timestamp - '0'::interval), ??AcctSessionTime = NULLIF('0', '')::bigint, ??AcctInputOctets = (('0'::bigint << 32) + '0'::bigint), ??AcctOutputOctets = (('0'::bigint << 32) + '0'::bigint), ??AcctTerminateCause = '3', AcctStopDelay = '0', ??FramedIPAddress = NULLIF('', '')::inet, ConnectInfo_stop = '', ??acctstatus = 'Stop', ??clientip = '2xxxxx.1', ??h323remoteaddress = '' ??WHERE AcctSessionId = 'a3e2e56a-e0f4b-b45ed37fT1' AND UserName = '203.130.218.1' ??AND NASIPAddress = '202.147.19.66' AND AcctStopTime IS NULL rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_postgresql #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql_postgresql: query: UPDATE radacct ??SET AcctStopTime = ('2007-10-05 17:19:13'::timestamp - '0'::interval), ??AcctSessionTime = NULLIF('0', '')::bigint, ??AcctInputOctets = (('0'::bigint << 32) + '0'::bigint), ??AcctOutputOctets = (('0'::bigint << 32) + '0'::bigint), ??AcctTerminateCause = '3', AcctStopDelay = '0', ??FramedIPAddress = NULLIF('', '')::inet, ConnectInfo_stop = '', ??acctstatus = 'Stop', ??clientip = '2tttt.1', ??h323remoteaddress = '' ??WHERE AcctSessionId = 'a3e2e56a-e0f4b-b45ed37fT1' AND UserName = 'tttttt' ??AND NASIPAddress = ' 2tttt.66' AND AcctStopTime IS NULL rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: affected rows = rlm_sql_postgresql: Postgresql check_error: PGRES_FATAL_ERROR, returning SQL_DOWN rlm_sql (sql): failed after re-connect rlm_sql (sql): Couldn't update SQL accounting STOP record - ERROR: invalid input syntax for type inet: "" rlm_sql (sql): Released sql socket id: 21 regards budi

2 1

Re: Freeradius-Users Digest, Vol 30, Issue 24
by wlan＠mac.com 05 Oct '07

05 Oct '07

> [...] > <sigh> You started asking questions on the FreeRADIUS list. Rather > than updating the FreeRADIUS Wiki, you've gone somewhere else. Nice. > Sorry about that. I intended to put it in the freeradius wiki (and still will, if desired), but thought it was too off-topic after all - the site otherwise being rather vendor agnostic. No disrespect intended... >> I took a perhaps less hostile classification than 'broken' - and >> labeled >> them as having a "AC" or "Client" perspective. > > Perhaps "non RFC compliant" would be a politer choice of words. > Indeed... >> Of course, the Access >> Controller/NAS is the right meaning as defined in this forum. > > Perhaps you haven't been reading my messages. This forum is NOT > defining anything. The definitions existed for years before > FreeRADIUS > existed. Stop trying to claim it's a disagreement between vendors. > It's not. > Of course, sorry 'bout that. What I meant was more like "as acknowledged as fact in this thread"... > The default should be the correct meaning. The documentation should > have big bold warnings that vendors doing it the other way are > non-compliant. > Yes. This is another reason why I ended up documenting this elsewhere -- where I can link it into the more relevant documentation - just as you suggest - acknowledging and high-lighting the non-compliance. >> Huh, I wonder if there was something originally 'lost in translation' > > The original RFC's were written the the designers and > implementors of > RADIUS, in Ann Arbour, Michigan, USA. They might be poorly > phrased, but > there is no confusion. > >> with how this got implemented. With some Googling, I came across: >> >> http://www.gsmworld.com/documents/wlan/ir61.pdf >> >> Which states for Acct-Input-Octets: "Volume of the downstream >> traffic of >> the User" and Output-Octets with "upstream traffic of the user". That >> sounds rather Client centric -- it's not to / from the User, for >> instance. Are we expecting too much from the (off-shore) out-sourcing >> companies? :) > > Apparently people implementing NAS equipment can't be bothered to > read > the spec, or to ask questions if they don't understand it, or to see > what the large vendors do. It would be interesting to know the history of this all. One vendor probably got it wrong and others followed the (wrong) vendor. Perhaps the lesson here is that if you follow a vendor, make it Cisco :) David

1 0

FreeRadius + ntlm_auth + blank character in the NT group name
by charles＠copel.com 05 Oct '07

05 Oct '07

Hi: I need to Configure my FreeRadius to authenticate NT users in a determinate NT Group that has a "blank character" in the name. My NT Group name is "COPEL\Acesso Remoto". When I execute the "ntlm_auth" program in the command line: it works. The command line is below: [root@FreeRADIUS /usr/local/etc/raddb]# ntlm_auth --require-membership-of='COPEL\Acesso Remoto' --request-nt-key --domain=COPEL --username=radius --password=radius NT_STATUS_OK: Success (0x0) [root@FreeRADIUS /usr/local/etc/raddb]# When I configure the "ntlm_auth" program in the radiusd.conf, my FreeRadius show the followings messages: ... auth: type "win_domain" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 radius_xlat: '--username=radius' radius_xlat: '--password=radius' [2007/10/05 09:10:42, 0] utils/ntlm_auth.c:get_require_membership_sid(237) Winbindd lookupname failed to resolve 'COPEL\Acesso Remoto' into a SID! Exec-Program output: Exec-Program: returned: 1 rlm_exec (win_domain): External script failed modcall[authenticate]: module "win_domain" returns fail for request 0 modcall: leaving group authenticate (returns fail) for request 0 auth: Failed to validate the user. Login incorrect: [radius/radius] (from client cerberus2 port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 239 to 10.4.3.248 port 32795 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 239 with timestamp 470629c2 Nothing to do. Sleeping until we see a request. My FreeRadius don´t get to find the NT group. It sounds like problem when FreeRadius find the "blank character" in the name of group. My environment is: FreeBSD 6.2 + Samba 3.0.24 + freeradius 1.1.6 Any Idea ? Best Regards, Charles.

1 0

Special Charactors in Username
by Kartik 05 Oct '07

05 Oct '07

I have my own radius client, communicting with a SBR radius server. The user name i send for authentication has special charactors - kärtïk The Hex dump in the access-request packet for the name is 6B C3 A4 72 74 C3 AF 6B [Attaching the snapshot of the dump]. Is it the correct format in which the name has to go? Bcos, even though it is in correct UTF-8 format, the server rejects it saying invalid username. http://www.nabble.com/file/p13054115/Dump.jpeg Dump.jpeg Now my question is, is my Dump correct ? Is there any restriction in sending non-ascii charactors ? If at all there is no restriction, then is there a special way of communicating the non-ascii charactors to the radius server. -- View this message in context: http://www.nabble.com/Special-Charactors-in-Username-tf4573354.html#a130541… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3