- Freeradius-Users - lists.freeradius.org

CA Dir
by Jeffrey Sewell 19 Jan '07

19 Jan '07

In the eap.conf, tls section, the comments say to use the 'CA_path' variable in the radiusd.conf file to indicate where the trusted CA chain will reside. However, this variable isn't in the tls section of the radiusd.conf (it is in the LDAP section, but I'm pretty sure that won't help me) file or the eap.conf file (where I thought it might have moved). As an experiment, I added it to eap.conf and it loaded ok with the following output: tls: CA_path = "/usr/local/etc/raddb/certs/rootCA" ... tls: CA_file = "(null)" Unfortunately the CA_file is the imporant one as I discovered when I tested the link: Fri Jan 19 09:51:05 2007 : Error: TLS Alert write:fatal:unknown CA So where is the appropriate place for the root chain? --Jeffrey

1 0

Restrict Password from detail file , accounting
by Ellis, Scott 1 (N-Comptel Inc.) 19 Jan '07

19 Jan '07

Is there a way to eliminate the password from being written to the accounting log files? Either not in clear text or altogether? I know that read access is restricted to Root access only.

3 4

Freeradius - Chillispot - ??? for WLAN + terminal-access
by Jens Meyer 19 Jan '07

19 Jan '07

Hi! I am looking for a small hotspot-solution (and found Freeradius + Chillispot - great!). But I want to connect (authenticate) 2-3 LAN-Kiosk-terminals (wired) additional (small Internet-Cafe). I found your description of "NAS"/"RAS" in the WIKI but I can't find any solution for this on the net. Is it possible to do this with Chillispot, too? Have you any tipps for me for this kind of setup? Any hint would be great - thank you! Kind regards, Jens

1 0

One question about Access-Request packet
by Rafał Kamiński 19 Jan '07

19 Jan '07

Hi, i have one question: Why when i try auth. by laptop-wifi over linksys then it's send that request: rad_recv: Access-Request packet from host 192.168.1.245:3072, id=0, length=119 User-Name = "rka" NAS-IP-Address = 192.168.1.245 Called-Station-Id = "001217694588" Calling-Station-Id = "0014a41e7112" NAS-Identifier = "001217694588" NAS-Port = 61 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000801726b61 Message-Authenticator = 0x794e9d729e673a6c41b875855ae5a464 Request without User-Password -> and that is problem with auth. When i try auth. over lan my PC send request: rad_recv: Access-Request packet from host 10.44.3.15:62963, id=66, length=55 User-Name = "rka" User-Password = "qazwsxedc" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 And the auth. is correct. Where is the problem? Maybe with Linksys? This is WPA54G. Thanks a lot for help BR, -- Rafal Kaminski http://blstream.com email: rafal.kaminski(a)blstream.com jid: rka(a)im.blstream.com

4 5

EAP-TLS certificate question
by kemas 19 Jan '07

19 Jan '07

Hi all, I've install freeradius-1.1.3,use it with AP Aironet 1100 doing EAP-TLS and works very well. I still confuse about certificate, is all client certificate created under 1 root ca, can be authenticated against freeradius that started with different server certificate? is it possible to set things like this root ca ------------ / | \ / | \ / | \ server1 server2 server3 ------- ------- ------- | | | | | | client1 client2 client3 I don't want client1 to be authenticated against server2 or server3. thanks

3 3

rlm_eap: Failed to link EAP-Type/peap: rlm_eap_peap.so:
by María Félix Rodríguez 19 Jan '07

19 Jan '07

Hi, At first, sorry for my english, (I'm spanish :). I've just installed freeradius, and I would like to use PEAP-MS-CHAP authentication, I've configured needed files, and when I try to start freeradius, with the debug option, y receive this messages: tls: private_key_file = "/ca/key_radius.pem" tls: certificate_file = "/ca/cert_radius.pem" tls: CA_file = "/ca/cacert.pem" tls: private_key_password = "radius" tls: dh_file = "/ca/dh" tls: random_file = "/ca/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls rlm_eap: Failed to link EAP-Type/peap: rlm_eap_peap.so: cannot open shared object file: No such file or directory radiusd.conf[9]: eap: Module instantiation failed. linux:/lib # I don't have too much experience in linux enviroments (this is a Suse Interprise Server 9), and I don't have idea about what is happening. I would need some kind of help, please. Thanks a lot !!! María.

3 2

Re: Freeradius-Users Digest, Vol 21, Issue 58
by Mike 19 Jan '07

19 Jan '07

> Mike wrote: > > All, > > When trying to use the "radauth" tool from nagios to monitor > > freeradius, I get the following in the freeradius log: > > > > Error: WARNING: Malformed RADIUS packet from host ... too long (length > > 18432 > maximum 4096) > > > > radtest seems to be ok. has anyone else experienced this or knows > > what is wrong? > > I haven't seen it. I note that 18432 is hex 0x7200. I suspect that > the NAGIOS people missed a 'htons()' somewhere, and the field should be > 0x0072. Alan, You are exactly correct. Good catch. For mailing list archives, the simplest patch I came up with: /* copy the first 20 bytes of the radius header. this size is static * per RFC. */ radhead->rad_length = htons(radhead->rad_length); memcpy(packet,(char *)radhead,20); radhead->rad_length = ntohs(radhead->rad_length); rad_length is used elsewhere, so this is done to avoid breaking anything else. Thanks for your help! (I wonder how this always worked for xtradius from the same machine?)

2 1

rlm_eap: SSL error
by James Lever 19 Jan '07

19 Jan '07

Hi List, FreeRADIUS 1.1.4 on FreeBSD (5-STABLE), Apple Airport Extreme NAS, MacBook Pro client, WPA2 Enterprise with 2k keys. I'm having the much mentioned but very hard to get real information about error below: Wed Jan 17 08:00:11 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Jan 17 08:00:11 2007 : Error: rlm_eap: SSL error error: 00000000:lib(0):func(0):reason(0) Wed Jan 17 08:00:11 2007 : Error: rlm_eap: SSL error error: 00000000:lib(0):func(0):reason(0) Wed Jan 17 08:00:11 2007 : Auth: Login OK: [wireless- client.jamver.id.au] (from client apple-basestation port 255 cli xx- xx-xx-xx-xx-xx) Now, the best explanation I can find on list is that it's safe to ignore the 3 lines of errors, which, although appears to be very accurate in that they have no effect on the running service, should not be there if they are really not errors. Can anybody explain what is actually causing these errors (and why) and what would be required to silence them? cheers, James

3 3

How to send tome clients to the same detail file
by Angel L. Mateo 18 Jan '07

18 Jan '07

Hello, I have a running server with this configuration: detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } I have activated the detail file in the accounting section and the auth_log in the authorize and are working fine. But now I want to send all the logs for requests from a group of clients (defined as a huntgroup) to the same files, and the request for all other clients as now (classified with the IP address of the client). Is there any way to redefine this files for a set of clients? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

2 3

EAP-TLS/seg fault with 4096 bit keys
by James Lever 18 Jan '07

18 Jan '07

Hi again list, Another issue I have had in setting up a WPA2 Enterprise environment is that I can get it to work as expected with 2k keys, however, if I go to 4k keys, freeradius 1.1.4 loads properly but seg faults when handling a 4k key request. The environment is Apple Airport Extreme base station, and MacBook Pro client wth FreeRADIUS 1.1.4 under FreeBSD 5-STABLE. As soon as I migrate back to 2k keys it again works as expected. Can anybody make any suggestions on how to debug this? cheers, James

2 1