- Freeradius-Users - lists.freeradius.org

Re : use_tunneled_reply
by Eshun Benjamin 10 Jul '07

10 Jul '07

It is explained in the config file. # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} # the PEAP module also has these configuration # items, which are the same as for TTLS. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Manuel Sanchez Cuenca <msc(a)dif.um.es> À : freeradius-users(a)lists.freeradius.org Envoyé le : Mardi, 10 Juillet 2007, 17h07mn 43s Objet : use_tunneled_reply Hello all, can anybody exaplain me the meaning of the attribute use_tunneled_reply in the peap configuration? what is the difference in the behaviour of PEAP if I set this option to yes or no? Thanks in advance. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

R: R: Cisco VRF + Radius
by Francesco Cristofori 10 Jul '07

10 Jul '07

> You don't need to set up vrf templates if everyone is going to use the > default radius server and default authentication and au6thorization > groups. It's optional. Thanks Ivan, now it's clear I don't need templates... > What does debug radius and debug ppp negotiation on Cisco say > about why > was the Framed-IP-Address rejected. If it fails on IPCP then > your route > is the problem. Since it all goes well without it ... Yes, the problem was on the nas side. Now it seems to understand and correctly assign the IP address to the cpe. > Ivan Kalik > Kalik Informatika ISP Thanks, Francesco Cristofori.

1 0

Re : Re : PEAP certificates, signing requirements and examples
by Eshun Benjamin 10 Jul '07

10 Jul '07

> I have read and used the make_cert_command = "${certdir}/bootstrap"; its > excellent tool but it only creates clientAuth and serverAuth and does > not add PEAP Huh? What do you mean by that? You have clarified, There's no need to post the OID's in every message. We've seen them before. > ... it usually pops up message > "the server certificate is not trusted because there no explicit trust > settings" - this seem to require the setting of eap oid. No. If you get that message, then the OID is in the certificate, and PEAP is working. The message simply says that the certificate isn't signed by a root CA your system knows about. I get this message even with certificate signed by root CA. And also by intermediate CA. Thanks Alan, I have to ask Apple. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mardi, 10 Juillet 2007, 14h55mn 34s Objet : Re: Re : PEAP certificates, signing requirements and examples Eshun Benjamin wrote: > I have read and used the make_cert_command = "${certdir}/bootstrap"; its > excellent tool but it only creates clientAuth and serverAuth and does > not add PEAP Huh? What do you mean by that? > ... it usually pops up message > "the server certificate is not trusted because there no explicit trust > settings" - this seem to require the setting of eap oid. No. If you get that message, then the OID is in the certificate, and PEAP is working. The message simply says that the certificate isn't signed by a root CA your system knows about. > The question is > what is the difference between web server and radius server certificates > with respect to ssl and wireless in the context of EAP, PEAP. Ask Microsoft. > [ PEAP ] ... There's no need to post the OID's in every message. We've seen them before. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

use_tunneled_reply
by Manuel Sanchez Cuenca 10 Jul '07

10 Jul '07

Hello all, can anybody exaplain me the meaning of the attribute use_tunneled_reply in the peap configuration? what is the difference in the behaviour of PEAP if I set this option to yes or no? Thanks in advance.

2 1

Re: Any successes with Belkin Wireless Access Point?
by Garvin Haslett 10 Jul '07

10 Jul '07

I've now configured the the clients as such: client 172.16.0.0/16 { secret = testing123 shortname = belkin-at-garvin } The IP address of the network card on my Windows machine is 172.16.1.1. While the corresponding value for the Access point is 172.16.1.2. Subnet masks in both cases is 255.255.0.0 However, still no sign of traffic destined for the Radius server. Garvin. ------------------------------ Message: 2 Date: Tue, 10 Jul 2007 11:24:01 +0100 From: <tnt(a)kalik.co.yu> Subject: RE: Freeradius-Users Digest, Vol 27, Issue 44 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <Yj5Lgl5G.1184063041.8496430.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 XP won't route to APIPA address. Make a /30 network in a different private IP range. Or you can switch on Internet Connection sharing on XP, NIC wil be fixed to 192.168.0.1 and it will behave like a mini-router (DHCP etc.). Just fix the IP address on AP (so you have a single address in clients.conf) and leave the rest on automatic. Ivan Kalik Kalik Informatika ISP Dana 10/7/2007, "Garvin Haslett" <Garvin.Haslett(a)Emccsoft.com> pi?e: >I've changed the client declaration thus so that the CIDR matches the >subnet mask for a Class B IP address: > >client 169.254.188.217/16 { > secret = testing123 > shortname = belkin-at-garvin >} > >But it still doesn't work. > >Is this what was meant or is it the 169.254.0.0 network number that is >at fault? > >Garvin. > >------------------------------ > >Message: 5 >Date: Mon, 09 Jul 2007 19:25:01 +0100 >From: <tnt(a)kalik.co.yu> >Subject: Re: Any successes with Belkin Wireless Access Point. >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: <TlD6aGsD.1184005501.8040110.tnt(a)kalik.co.yu> >Content-Type: text/plain; charset=ISO-8859-2 > >Your AP IP address is from Automatic Private IP Addressing range. >Routing is not going to work there. Make a "proper" /30 network between >AP and the PC. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 9/7/2007, "Garvin Haslett" <Garvin.Haslett(a)Emccsoft.com> pi?e: > >>I have a tiny test network consisting of a Belkin Wireless Access Point >>(FCC: K7SF5D7132A) connected by an ethernet cable to a Windows machine >>with an Intel network card. >> >>I'm running FreeRADIUS.net-1.1.5-r0.0.3 and configure the client thus: >> >>client 169.254.188.217 { >> secret = testing123 >> shortname = belkin-at-garvin >>} >> >>When I connect to the AP I can see packets getting through to the >>network card using ethereal but nothing appears in the radius.log. >> >>When I disconnect from the AP the device's MAC still appears in the >>AP's list and it is reported as being Authenticated! >> >>Can anyone tell me what I have missed in the configuration? >> >>Garvin. >> >>- >>List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html >> >>

1 0

Re : PEAP certificates, signing requirements and examples
by Eshun Benjamin 10 Jul '07

10 Jul '07

I have read and used the make_cert_command = "${certdir}/bootstrap"; its excellent tool but it only creates clientAuth and serverAuth and does not add PEAP which ofcourse one can add by himself. Eventhough freeradius will authenticate some supplicants will require users to first time save the cert. Windows supplicants the oids : xpclient_ext and xpserver_ext and on MAC supplicants ? ; it usually pops up message "the server certificate is not trusted because there no explicit trust settings" - this seem to require the setting of eap oid. The question is what is the difference between web server and radius server certificates with respect to ssl and wireless in the context of EAP, PEAP. Does it matter if the cn is the SSID of the wireless network for radius server auth and server domain name for webserver auth? [ PEAP ] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 extendedKeyUsage = 1.3.6.1.5.5.7.3.1 [ clientAuth ] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 [ serverAuth ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 9 Juillet 2007, 18h12mn 28s Objet : Re: PEAP certificates, signing requirements and examples Eshun Benjamin wrote: > Hi All, > I came across this infomation and tought it would be nice to drop it > here. Eventhough it is ssl issue it has to do with PEAP. Just to > discuss; any comments. This is documented in eap.conf, among other places. It's on the Wiki, in the script files that create the test certificates for the server, etc. In 2.0, a brand-new install of the server will automatically create test certificates with the right OID's for Windows. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

RE: Freeradius-Users Digest, Vol 27, Issue 44
by Garvin Haslett 10 Jul '07

10 Jul '07

I've changed the client declaration thus so that the CIDR matches the subnet mask for a Class B IP address: client 169.254.188.217/16 { secret = testing123 shortname = belkin-at-garvin } But it still doesn't work. Is this what was meant or is it the 169.254.0.0 network number that is at fault? Garvin. ------------------------------ Message: 5 Date: Mon, 09 Jul 2007 19:25:01 +0100 From: <tnt(a)kalik.co.yu> Subject: Re: Any successes with Belkin Wireless Access Point. To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <TlD6aGsD.1184005501.8040110.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 Your AP IP address is from Automatic Private IP Addressing range. Routing is not going to work there. Make a "proper" /30 network between AP and the PC. Ivan Kalik Kalik Informatika ISP Dana 9/7/2007, "Garvin Haslett" <Garvin.Haslett(a)Emccsoft.com> pi?e: >I have a tiny test network consisting of a Belkin Wireless Access Point >(FCC: K7SF5D7132A) connected by an ethernet cable to a Windows machine >with an Intel network card. > >I'm running FreeRADIUS.net-1.1.5-r0.0.3 and configure the client thus: > >client 169.254.188.217 { > secret = testing123 > shortname = belkin-at-garvin >} > >When I connect to the AP I can see packets getting through to the >network card using ethereal but nothing appears in the radius.log. > >When I disconnect from the AP the device's MAC still appears in the >AP's list and it is reported as being Authenticated! > >Can anyone tell me what I have missed in the configuration? > >Garvin. > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > >

2 1

eap/peap oid on certs
by Eshun Benjamin 10 Jul '07

10 Jul '07

Hi Alan, You are doing good job and kudos to your team. Just want some clarafication on this issue. make_cert_command = "${certdir}/bootstrap"; its excellent tool but it only creates clientAuth and serverAuth and does not add PEAP which ofcourse one can add by himself. Eventhough freeradius will authenticate some supplicants will require users to first time save the cert. Windows supplicants the oids : xpclient_ext and xpserver_ext and on MAC supplicants ? ; it usually pops up message "the server certificate is not trusted because there no explicit trust settings" what explicit trust settings is it looking for - does it require the setting of eap oid ?. The question is what is the difference between web server and radius server certificates with respect to ssl and wireless in the context of EAP, PEAP. Does it matter if the cn is the SSID of the wireless network for radius server auth and server domain name for webserver auth? [ PEAP ] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 extendedKeyUsage = 1.3.6.1.5.5.7.3.1 [ clientAuth ] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 [ serverAuth ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 ================================================== Benjamin K. Eshun _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Problem with NULL realm..
by Mark J Elkins 10 Jul '07

10 Jul '07

I have an old instance of icradius - which - when users had a static IP allocated - login would fail if there was a realm present but work just fine if the realm was missing. This was in the old, dark days - when everyone was in the same realm. Now - freeradius works just fine with a full realm based login and statc IP but I have a number of users both with and without static IP's who don't have their realm as part of their login ID.. ie rather than 'joe(a)pop.co.za' - they just use 'joe'. The easiest solution would be - if (REALM == NULL) - add on the default realm. There are about 10 different realms being used - as well as the 'default'. Anyway.. In proxy.conf - I have uncommented .. realm NULL { type = radius authhost = LOCAL accthost = LOCAL } (This is now the last 'realm' definition in this file - in case order matters. 'DEFAULT' is still commented) In my sql.conf - I have code that looks like... ... Username='%{Stripped-User-Name}' AND realm='%{Realm:-pop.co.za}' AND .... ie - if the REALM is missing - it should default to 'pop.co.za'... Anyway - still getting incorrect logins.... A radiusd -X shows me that .."WHERE Username='mje' AND realm='NULL' AND"... ie - If there is no realm - its set to the string of four characters 'NULL' rather than the string '\0' .. not what I was hoping for... If the realm is missing - it can only refer to a user in the 'pop.co.za' realm - and no other. Suggestions? ie - the equivalent of ... if( ${Realm} == "NULL") Realm="pop.co.za" ..put somewhere. ps. It would be very useful if one could run radiusd in '-X' mode based on some criteria - such as the Realm or the Nas, especially on a busy server - just for matching packets. (in proxy.conf .. syntax of realm myrealm.com { type = radius authhost = LOCAL accthost = LOCAL debug = yes } or in clients.conf client access.pop.co.za { secret = very shortname = access nastype = cisco debug = yes } ) -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

3 4

RE: FreeRADIUS vs Windows VISTA clients
by tnt＠kalik.co.yu 09 Jul '07

09 Jul '07

>Thanks Arran, > >Is there a doc that will shed some light as to the procedure for enabling >support for a VISA client. >(I am refering to PPTP connections.) > >Again, thanx for the reply. > >/Crowley PPTP will work (with Vista as well) "out of the box". It should use MS-CHAPv2 which is enabled by default in Freeradius. Store cleartext password and you will be fine. Ivan Kalik Kalik Informatika ISP

1 0