- Freeradius-Users - lists.freeradius.org

Re: Accounting Stopped
by sean＠swarmhotspots.com 29 Sep '06

29 Sep '06

Hi Alan, Thanks for taking the time to respond. I've already fixed the problem. It only took a bit of lateral thinking. The ADSL modem wasn't exchanging any information on port 1813. For the life of me I can't understand how it could re-boot and only loose a bit of it's setup. It would have been much better if it had lost everything. I wasted the best part of a week testing syslogd, reinstalling FreeRadius, MySQL and setting up a new test server. Anyway, once again thanks. I really appreciate the time and effort you take to give support to end users. Regards, Sean -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Login-Time and Session-Time Conflict
by Adam Tybor 29 Sep '06

29 Sep '06

We are using both Login-Time and Session-Time attributes with a rlm_sql configuration and the Login-Time attribute is always overriding the Session-Time. Meaning that if the Session-Time attribute value is less than the timeSpan difference of the Login-Time, the Login-Time timespan difference is still returned as the Session-Time value. I remember reading somewhere that in cases of both attributes being used, the most restrictive should be returned, however this is not happening. Can someone confirm what the real implementation is? We are running freeradius 1.1.1 on a Gentoo linux platform. BTW -- If this is the desired functionality does anyone know a way to get our desired functionality of the smallest Session-Time being used instead of Login-Time? Thank you, Adam

2 3

VSA and other attributes in Access-Accept
by Mohammed Petiwala 29 Sep '06

29 Sep '06

Hi: Could anyone please provide me some advice on my question below. Currently I am seeing VSAs in my reply messages from freeRADIUS being passed in Access-Accept, Access-Challenge. I would like to limit certain VSAs to only Accepts, or Challenge. Is this possible - because according to the RFCs for 3GPP/3GPP2 only some of them are possible in certain type of responses. Thx. Regards, Mohammed. Date: Thu, 30 Mar 2006 14:06:02 -0800 (PST) From: Mohammed Petiwala <mhpetiwala(a)yahoo.com> Subject: VSA and other attributes in Access-Accept To: freeradius-users(a)lists.freeradius.org Hi: First thanks to the freeRADIUS team - this is one of the most flexibile and powerful AAA available... I've 2 questions: 1. I've set up my clients to authenticate using EAP-TTLS with MSCHAPv2 as the inner authentication protocol. This works fine with the wpa_suppicant with intel 2200b/g as well as the Cisco Aironet 350. I've created my own dictionary file with VSAs that are useful for my NAS once Access-Accept is returned. The 'users' file has the VSAs Attrib = Value listed after each user entry and I do see the attributes being returned correctly on Access-Accept. My question is (please correct me if I am wrong) - I see the VSAs being returned during the intermediate Access-Challenge messages too even before authentication is complete. Is this the normal behavior, is there a way to setup the freeRADIUS server so that the VSAs are only returned on Access-Accept and not during the Access-Challenge. The NAS does ignore the VSAs in any case during the challenge - but would be good if there was a way to limit the message size for the Access-Challenge messages (only if this is valid from RADIUS RFC perspective - if someone could clarify). 2. How can I set users in the 'users' file (an example would be very helpful if someone can send) so that some users are only allowed to authenticate using EAP-TTLS while others are only allowed to use PEAP. Once I create an entry into the users file (and both authentications are EAP types) - the user can authenticate using any eap type - I would like to limit this per user. Is it possible?? Thx. Regards, Mohammed. --------------------------------- All-new Yahoo! Mail - Fire up a more powerful email and get things done faster.

1 0

Why is the default DH keysize only 512 bits?
by Jason Wittlin-Cohen 29 Sep '06

29 Sep '06

I noticed that the default DH keysize in FreeRadius 1.1.3 is 512 bits. As DH keys have approximately the same strength as RSA keys, and 512 bit RSA keys have already been broken, wouldn't it be adviseable to use at least 1024 bit DH keys as the minimum size. 1024 bits is currently the minimum recommended size for a DSA/RSA certificate. It might also be a good idea to include the option commented out in eap.conf so users know that it's something they can change. I originally thought that the DH keysize would be determined by the DH parameter file and only realized that it was still using 512 bit keys when I ran freeradius in debug mode. As fas as performance goes, I've tested with 2048 bit and 3072 bit DH keys with no performance degredation. Authentication occurs in 1-2 seconds using the Funk Odyssey client on Windows XP SP2 with 3072 bit RSA certificates and 3072 bit DH key exchange. Also, it might be a good idea to put a comment in the TLS cipher suite comment section that the Microsoft Windows supplicant in Windows XP SP2 uses RC4-MD5 by default (TLS_RSA_WITH_RC4_128_MD5). First, MD5 is deprecated and weak. SHA-1 should be used in its place. Secondly, DH is preferable to RSA for key exchange because it provides perfect forward secrecy. If RSA is used for encryption, a compromise of the client private key would allow an attacker to gain access to the master keys used to encrypt all prior wireless sessions whereas fresh DH keys are produced on each authentication and deleted after use. OpenSSL's 'HIGH' setting is probably the best for a Windows XP user as it uses EDH-RSA-DES-CBC3-SHA (TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA), so SHA1 is used for integrity, and DH is used for key exchange. Windows XP SP2 and earlier versions of Windows do not support AES for use in any of the EAP modes. Apparently, if you want to use AES you need to upgrade to Vista (See Security in Vista <http://www.microsoft.com/technet/itsolutions/network/evaluate/new_network.m…>) or use a 3rd party supplicant like the Funk Odyssey Client which I use (uses TLS_DH_RSA_WITH_AES_256_CBC_SHA with default Freeradius setup). Jason Wittlin-Cohen

3 5

Accounting stopped
by sean＠swarmhotspots.com 29 Sep '06

29 Sep '06

Hi All, Since a power cut last Sunday FreeRadius has stopped writing to its log files and updating radacct in MySQL. It is continuing to authenticate users. It gives no error messages running radiusd -X. I've tried upgrading from 1.0.3 to 1.1.3 with no effect. I've been working round the clock for five days now and seem no closer to a solution. Any hints, tips or advice would be very welcome. Regards, Sean -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

mysql radacct table no query
by Collen Blijenberg 29 Sep '06

29 Sep '06

Hmm, i was testing the mysql backend with freeradius 1.1.3. looks good at first glance, but i bumped into something essential (for us that is). We like to link MAC addresses with the user account's. what did i do: I added a user in table radcheck. worked! next step, added same user in table: radacct. username:gebruiker CalledStationId: 00166f980e79 did not work! I change the MAC address to a wrong one, and i still get in.?? also in debug (radiusd -X) no radacct query is done?, so no attribute checkings are done !!?? So my question is, how can i make the attributes work with the mysql backend.. are we missing some mysql queries in the sql.conf ?? (btw, this all did worked with the 'users' file from freeradius) Cheers Collen

3 2

dumb humble question about sqlippool
by Guilherme Franco 29 Sep '06

29 Sep '06

Hi, I know you guys must be angry with all the questions I'm posting here. In Devel-List, I found this: "Is it usefull to community? (SQLIPPOOL and NASCATS)" by Roman M. Bibikov on Thu, 16 Oct 2003 17:36:26 +1100. He says that created a sucessfull ip pool in Oracle (exactly what I'm trying to do) and also that developed stored functions and procedures handling in rlm_oracle (sql_runfunction() and sql_runprocedure()) I didn't found out those functions and I'm wondering if it's because of this that I can't make sqlippool work in oracle... Thanks in advance

2 5

peap client constantly re-authenticating
by Rob Shepherd 29 Sep '06

29 Sep '06

Dear list, This may not be the right place to discuss this issue, but radiusd -X is the only info i've got to go on. The windows PEAP client re-authenticates every 10-20 seconds or so. Has anybody else seen this? is it normal behavour? I have a cisco wlan controller, and freeradius 1.1.2. my OS X 802.1x client doesn't do this. Cheers for any pointers, Rob

1 0

rpl_perl and housekeeping
by Pshem Kowalczyk 29 Sep '06

29 Sep '06

Hi, We are building a proxy system using rlm_perl. Proxy is reposible for IP allocation, attributes rewriting and keeping the session database. The system works fine if all the NASes (and other proxies) behave properly (ie they send all the packets they supposed to send etc). Obviously real situation is a bit worse and sometimes we get stuck with a non-existent session in our session db (because the 'Stop' record never arrived). This situation can be easily detected as we timestamp all db opeartions, so in theory we could expire all outdated sessions or allocated IPs, but so far I can see only one option to do that - use an external program. We're not very keen to do it in the packet-handling functions as some of the opeartions can be very time consuming, and as a result that would live the packet without any answer. Ideally we would like to see an ability to run some functions on defined time intervals (not only when a packet comes) so the housekeeping is done then. I'm not sure if I'm not streetching the applications of rlm_perl a bit too far, if such functionality existed - that would be great. Or perhaps is there a different method of doing this? kind regards pshemko

2 2

RE: v1.1.3 - Logging Levels / Syslog / logging passwords
by Garber, Neal 29 Sep '06

29 Sep '06

> Is there any way to squish the user password in the -xx output? Are there any hidden/undocumented setting for radiusd.conf that do that? radiusd -Xx | sed -e "s/\([pP]\)assword.*/\1assword <masked>/" This is a tweak from something Alan suggested to me... It gets rid of most of the passwords (it leaves the password rlm_ldap uses to bind and it removed some other info. - but I think it's pretty close to what you want)..

1 0