- Freeradius-Users - lists.freeradius.org

PEAP certificates, signing requirements and examples
by Eshun Benjamin 09 Jul '07

09 Jul '07

Hi All, I came across this infomation and tought it would be nice to drop it here. Eventhough it is ssl issue it has to do with PEAP. Just to discuss; any comments. PEAP certificates, signing requirements and examples There are only minor differences between standard SSL certificates used by secure web sites and those used with PEAP on 802.1x wireless networks. With PEAP the SID of the network, rather than your organizations domain must match the common name (cn) of the certificate. Additionally an EKU (Enhanced Key Usage) for Server Authentication (OID 1.3.6.1.5.5.7.3.1) must be specified when creating your public certificate or signing request. [ PEAP ] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 extendedKeyUsage = 1.3.6.1.5.5.7.3.1 [ clientAuth ] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 [ serverAuth ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 In these examples we will use the OpenSSL utility to create a Certificate Signing Request (CSR) used with a third party certificate authority such as Verisign or Thawte. We will also generate a ‘self-signed’ certificate that does not require a certificate authority but does require users to first accept your certificate as valid on a one time basis depending on the supplicant and its configuration. Example creating a certificate signing request for a certificate authority openssl req -new -nodes -keyout private.pem -out public.csr -extensions PEAP -config openssl.cnf The output file public.csr is processed by your certificate authority (CA), which will return a signed certificate file to you. Combine private.pem with the certificate returned from the CA into a single file. This file becomes the ‘PEAP Certificate’ file. You will likely also need the CA’s certificate chain file if one is required. This file becomes the ‘PEAP CA Certificate’. Example creating a ‘self-signed’ certificate openssl req -new -x509 -key private.pem -out public.pem -extensions PEAP -config openssl.cnf -days 5000 ================================================== Benjamin K. Eshun _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

Help: Configuring attributes in Access-Request in 1.1.3
by Govardhana K N 09 Jul '07

09 Jul '07

Hi All, I am new to FreeRadius. I am using Free Radius 1.1.3. I want to configure the vendor attribtes in format as below, +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |RADIUS TYPE 26 | Length | Vendor-ID +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Vendor-ID (cont) | Vendor TYPE | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Continuation | Sub-Type | Sub-Type-Len | Sub-Type-Val | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ how can i configure this? Also i want to configure the same in Access-Accept. Can anyone guide me how to configure these. thanks in advance. -- With Regards, Govardhana K N

2 5

Using two tables (postgreSql) to validate users
by Daniel Bojczuk 09 Jul '07

09 Jul '07

Hi again... I have a doubt: Is it possible to use two tables to check the users? I need to do something like this... Freeradius checks if the user is valid on the table 1, if it returns true the user is validated, but if the return is false, freeradius checks the table 2, trying to validate the user once again. Is it possible? Thanks, Daniel

3 2

radius & mysql
by Michael Ziemann 09 Jul '07

09 Jul '07

Hi All! I have a problem with freeradius getting access to a mysql database. I installed freeradius 1.1.5 on OpenSuse. The radius server is working, because I get an Access-Accept Packet with radtest (I configured the clients.conf). But how do I configure FreeRadius to use an MySql-database? I already installed lampp, it contains an MySql-Server with the comfotable tool PHP-MyAdmin... Thanks Michael

4 3

R: Cisco VRF + Radius
by Francesco Cristofori 09 Jul '07

09 Jul '07

> Putting a User into a certain VRF is quite simple: > > vrfuser User-Password == "topsecret" > Cisco-AVPair += "lcp:interface-config#1=ip vrf forwarding \ > VRFNAME", Thank you Gerald, this is what I need to do. I tried using this method, but I end up with access-accept reply (from radiusd -X) like this: Sending Access-Accept of id 20 to x.y.159.252 port 1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Ascend-Client-Primary-DNS = x.y.z.1 Ascend-Client-Secondary-DNS = x.y.z.2 Session-Timeout = 20000 Cisco-AVPair = "lcp:interface-config#1=ip vrf forwarding Satcom" Framed-IP-Address = x.y.129.239 This seems correct to me, but the NAS ignores the Framed-IP-Address so the cpe never gets an Ip address. The IP address is taken from an ippool, the other attributes are stored in sql, everything works fine without that cisco-avpair attribute. Any hint? Thanks in advance, Francesco.

2 1

R: Cisco VRF + Radius
by Francesco Cristofori 09 Jul '07

09 Jul '07

Hi Kalik, thanks for your reply. I had a look at the cisco doc on vrf forwarding, but I think it's not what I need to do. I don't need to put all template items in fr, but only to select the vrf based on group which the user belongs to. Did I miss the point? Do I need to configure Templates inside radius? Thanks, Francesco.

1 0

FR + AD host/ machine/ workstation authentication
by Jacob Jarick 09 Jul '07

09 Jul '07

Im after some documentation on setting up host authentication on freeradius (or an example config). This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or user based authentication, modify the RADIUSD.CONF file by adding the following lines:" doesnt say where or what section to add said lines to and we all know how touchy the radiusd.conf file is. My files are configured according to this howto: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO and user authentication is working fine. I need host/ machine authentication for laptops that will connect wirelessly to a domain (<- need machine auth) before logon. Thanks in advance.

4 20

Re : using EAP instead of chilli
by Eshun Benjamin 09 Jul '07

09 Jul '07

i have a wrt54g linksys running dd-wrt can someone help or give a link on how to deploy using the same linksys box. Do this, The settings below will help: SETUP Internet connection: IP on WAN Under Optional Settings Host Name: MyWireless (Name of your client-AP) Domain Name: yourdomain.com (Your own domain) MTU: Auto Under Network Setup Router Local IP: 192.168.1.1 Subnet: 255.255.255.0 Gateway: 0.0.0.0 DHCP DHCP Server: enabled WIRELESS Under Basic settings; Wireless mode: AP wireless Network Mode: Mixed Wireless Network Name: MyWireless (Name of your client-AP) Wireless Channel: 11-2.462GHz Wireless SSID Broadcast: enable Sensitivity Range: 2000 Under Radius MAC Radius Client: enable MAC format : aabbcc-ddeeff Radius Server Address: your radius server IP Radius Server port: 1812 MUU: Password format: shared key Radius shared secret: the secret of your cliet (AP) Wireless Security Security Mode: WPA Radius WPA Algorithms: TKIP+AES Radius Server Address: Your radius server IP Radius Server port: 1812 WPA shared key: the secret of your client (AP) key renewal interval: 3600 ADMINISTRATION management Routing: enable 802.1x : enable Make sure you have your client(AP) information in radius: client.conf ( AP IP , MyWireless, Shared Key) configure eap.conf and radius.conf as well. All the best. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Carl aniams <aniamss(a)gmail.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Samedi, 7 Juillet 2007, 19h15mn 51s Objet : using EAP instead of chilli hi all i'm using freeradius with a mysql database to authenticate users through chillispot, and it's working fine. i would like to authenticate my user using EAP instead of using chilli that already grant them access through dhcp to the network i have a wrt54g linksys running dd-wrt can someone help or give a link on how to deploy using the same linksys box. thanks a lot -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Login /logout script hooks
by Steven J Lamb 09 Jul '07

09 Jul '07

I have been looking for a good example of a way to execute scripts when there is a login or logout. I haven't yet found a good example and unfortunately all of my attempts have failed to do anything. Any help or suggestions as to where I can find a good example of running a shell script when someone logs in or logs out. I would much appreciate it. Thanks in advance. Steven Lamb

2 1

Freeradius 2.0 - vmps feature, inaccuracies on FreeNAC
by Sean.Boran＠swisscom.com 09 Jul '07

09 Jul '07

Hi, I just came across your blog post commenting on the release of the 2.0 version of freeradius. I was kind of surprised by the upcoming support of VMPS. While trying to know more, I also found a post commenting on OpenVMPS (http://lists.cistron.nl/pipermail/freeradius-users/2007-May/063152.html ) and I have to say that I've been really dissapointed by what you wrote. I really didn't expect that animosity or that amount of FUD coming from you. Quote, from Alan Dekok, Mon May 28 14:21:56 CEST 2007 " 2.0.0-pre2 has "Magic feature number one" :)" > Arran Cudbard-Bell wrote: > > Neat , unfortunately only Cisco switches seem to support it, and we run > > entirely on HP Procurves. > > Guess it means people will no longer have to use OpenVMPS to proxy :) > > Plus, OpenVMPS is not under active development, so there's no > maintainers. It claims it's part of another project (that I won't > name), but that project includes the *binary* of OpenVMPS, and not the > source. GPL concerns may apply... > > On top of that, the project is funded by a commercial company, as a > loss-leader for their commercial support, and the "community" that works > on it is limited to the employees of that company. Good luck getting > patches added if they conflict with the corporate agenda... > > Alan DeKok. The project in question that you did not want to name is "FreeNAC" and I'm the lead developer. You'll understand that I cannot let those things stay uncorrected, so I'll quickly make some issues clear : - This project has been, from the start, a GPL project, sources have always been published. Just because an OpenVMPS binary is there doesn't mean there's no source : look into the contrib directory. - The main sponsor is effectively Swisscom Innovations, but there's no need to put quotes around community. Even if it's small (70 registered users), I let you check our forums to verify that it is not limited to Swisscom. We received some contributions (patches, documentation) that we accepted and we don't have any hidden agenda. [FreeNAC is GPL, and we respect the GPL of OpenVMPS too]. - "Good luck getting patches added if they conflict with the corporate agenda" The community are free to change FreeNAC themselves, and submit patches, if we don't do it fast enough. That is what OpenSource is about. The core team is not closed to Swisscom Innovation people either. I'll welcome anyone with the motivation, skills and time. This is, I repeat, a GPL - OpenSource project. But, at the end, I'd really like to close this misunderstanding and move further. There's no point in arguing or flaming each other as we're both working on closely related opensource project. In fact, FreeRADIUS was always in our mind, we announced FreeNAC on the "freeradius-user" mailing list in 2006 and we also integrated it. This is natural because the core value of FreeNAC is in at the "policy level", and not in the support of underlying protocols like VMPS or 802.1x. We've also closely followed the development in the NAC area and contacted other opensource projects (SecureW2, NAC@FHH) for that purpose. We would enjoy a collaboration that would lead to create _the_ opensource NAC framework. Regards, Sean Boran, www.FreeNAC.net

3 3