- Freeradius-Users - lists.freeradius.org

mysql and nt password..
by Collen Blijenberg 02 Oct '06

02 Oct '06

is there a good howto on using nt-passwords with freeradius and mysql as password backend ?? thx Collen

1 0

only work with 5 users or clients
by Tom Miller 01 Oct '06

01 Oct '06

I have a 7204 (12.0(22)S1) terminating DSL L2TP VPDN and freeradius ( 1.0.4) I am having problem when number of users (clients) increase from 6 and up. It worked fine when I have only 5 users (clients) using the system. I found the max_requests was set at 1024 in radiusd.conf and have inscrease the number up to 50 clients (50x256=12800) max_requests = 12800 However, It doesn't seem to have any effect. What am I doing wrong. One things I noticed. The two users that can not connect will sent incomplete information to the radius server from NAS (7204) such as: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.17.1:1645, id=200, length=95 NAS-IP-Address = 192.168.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen(a)abc.net" CHAP-Password = 7482c25ab08ffsddfddc0625fcb4007e Service-Type = Framed-User Framed-Protocol = PPP auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 200 to 192.168.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 209.101.222.12 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 16 Going to the next request *********** This is a log when it connected. It included the Tunnel server and client end point ********* rad_recv: Accounting-Request packet from host 192.168.17.1:1646, id=199, length=232 NAS-IP-Address = 192.168.17.1 NAS-Port = 6 NAS-Port-Type = ISDN User-Name = "knguyen(a)abc.net" Acct-Status-Type = Stop Acct-Authentic = RADIUS Service-Type = Framed-User Acct-Session-Id = "00000CD8" Framed-Protocol = PPP Tunnel-Server-Endpoint:0 = "10.10.6.5" Tunnel-Client-Endpoint:0 = "10.10.6.6" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "12345678" Tunnel-Server-Auth-Id:0 = "sfldse26rr.wi.AADS" Acct-Tunnel-Connection = "13441125" Framed-IP-Address = 209.101.222.12 Acct-Terminate-Cause = Admin-Reset Acct-Input-Octets = 281672 Acct-Output-Octets = 266074 Acct-Input-Packets = 4390 Acct-Output-Packets = 4154 Acct-Session-Time = 1967 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.17.17.1:1645, id=200, length=95 NAS-IP-Address = 172.17.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen(a)eintegration.net" CHAP-Password = 0xcc3aeb78c7482c25ab08dc0625fcb4007e Service-Type = Framed-User Framed-Protocol = PPP auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 200 to 172.17.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 38.101.172.12 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 16 Going to the next request What am I missing here? thanks much, Tom

2 1

Problem with Installation
by Abel Monzon 01 Oct '06

01 Oct '06

Hi list, I have trying install Freeradius on Debian Sytem, but when I try whit ./configure, that respond.. server:~/freeradius-1.1.3# ./configure configure: WARNING: you should use --build, --host, --target checking for CC-gcc... no checking for gcc... no checking for CC-cc... no checking for cc... no checking for cc... no checking for CC-cl... no checking for cl... no configure: error: no acceptable C compiler found in $PATH See `config.log' for more details. server:~/freeradius-1.1.3# ./configure CXX configure: WARNING: you should use --build, --host, --target checking for CXX-gcc... no checking for gcc... no checking for CXX-cc... no checking for cc... no checking for cc... no checking for CXX-cl... no checking for cl... no configure: error: no acceptable C compiler found in $PATH See `config.log' for more details. I can't see whit ./configure --help any solution, Please.. i need help.. Greatting.. Abel

2 1

repeat until success?
by Proft, Michael 30 Sep '06

30 Sep '06

Hi, is it possible to configure freeradius to do something like "repeat until success". Im trying to authenticate local users at the same system freeradius is running on and I proxy requests to another radius server. I want to do this _without_ using realms. So if asking for local user and no success I want to continue proxying requests to another radius server. Is this possible in some way? Thanks for any advice Michael

4 6

Re:Re: Questions about latest CVS
by 高嵩 30 Sep '06

30 Sep '06

Hi,all >> Does the radiusd server listen on IPv6 address by default? >No. You have to configure it. Could you tell me how to configure it listen on IPv6 address? >> How to use the radclient in Ipv6 ? >Send the request to an IPv6 address? Yes,send the request to the Radius server listening on IPv6 address. Thank you very much.

2 1

Small Linux- Minimal Instalation
by opaniagu＠yahoo.com.ar 30 Sep '06

30 Sep '06

Hi, some body know same samall linux distro, for instante, one that a keep and start on usb pendrive only with freeradius? I want to use it, like as router distros (they are very small). Thanks __________________________________________________ Preguntá. Respondé. Descubrí. Todo lo que querías saber, y lo que ni imaginabas, está en Yahoo! Respuestas (Beta). ¡Probalo ya! http://www.yahoo.com.ar/respuestas

1 0

Re: Accounting Stopped
by sean＠swarmhotspots.com 29 Sep '06

29 Sep '06

Hi Alan, Thanks for taking the time to respond. I've already fixed the problem. It only took a bit of lateral thinking. The ADSL modem wasn't exchanging any information on port 1813. For the life of me I can't understand how it could re-boot and only loose a bit of it's setup. It would have been much better if it had lost everything. I wasted the best part of a week testing syslogd, reinstalling FreeRadius, MySQL and setting up a new test server. Anyway, once again thanks. I really appreciate the time and effort you take to give support to end users. Regards, Sean -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Login-Time and Session-Time Conflict
by Adam Tybor 29 Sep '06

29 Sep '06

We are using both Login-Time and Session-Time attributes with a rlm_sql configuration and the Login-Time attribute is always overriding the Session-Time. Meaning that if the Session-Time attribute value is less than the timeSpan difference of the Login-Time, the Login-Time timespan difference is still returned as the Session-Time value. I remember reading somewhere that in cases of both attributes being used, the most restrictive should be returned, however this is not happening. Can someone confirm what the real implementation is? We are running freeradius 1.1.1 on a Gentoo linux platform. BTW -- If this is the desired functionality does anyone know a way to get our desired functionality of the smallest Session-Time being used instead of Login-Time? Thank you, Adam

2 3

VSA and other attributes in Access-Accept
by Mohammed Petiwala 29 Sep '06

29 Sep '06

Hi: Could anyone please provide me some advice on my question below. Currently I am seeing VSAs in my reply messages from freeRADIUS being passed in Access-Accept, Access-Challenge. I would like to limit certain VSAs to only Accepts, or Challenge. Is this possible - because according to the RFCs for 3GPP/3GPP2 only some of them are possible in certain type of responses. Thx. Regards, Mohammed. Date: Thu, 30 Mar 2006 14:06:02 -0800 (PST) From: Mohammed Petiwala <mhpetiwala(a)yahoo.com> Subject: VSA and other attributes in Access-Accept To: freeradius-users(a)lists.freeradius.org Hi: First thanks to the freeRADIUS team - this is one of the most flexibile and powerful AAA available... I've 2 questions: 1. I've set up my clients to authenticate using EAP-TTLS with MSCHAPv2 as the inner authentication protocol. This works fine with the wpa_suppicant with intel 2200b/g as well as the Cisco Aironet 350. I've created my own dictionary file with VSAs that are useful for my NAS once Access-Accept is returned. The 'users' file has the VSAs Attrib = Value listed after each user entry and I do see the attributes being returned correctly on Access-Accept. My question is (please correct me if I am wrong) - I see the VSAs being returned during the intermediate Access-Challenge messages too even before authentication is complete. Is this the normal behavior, is there a way to setup the freeRADIUS server so that the VSAs are only returned on Access-Accept and not during the Access-Challenge. The NAS does ignore the VSAs in any case during the challenge - but would be good if there was a way to limit the message size for the Access-Challenge messages (only if this is valid from RADIUS RFC perspective - if someone could clarify). 2. How can I set users in the 'users' file (an example would be very helpful if someone can send) so that some users are only allowed to authenticate using EAP-TTLS while others are only allowed to use PEAP. Once I create an entry into the users file (and both authentications are EAP types) - the user can authenticate using any eap type - I would like to limit this per user. Is it possible?? Thx. Regards, Mohammed. --------------------------------- All-new Yahoo! Mail - Fire up a more powerful email and get things done faster.

1 0

Why is the default DH keysize only 512 bits?
by Jason Wittlin-Cohen 29 Sep '06

29 Sep '06

I noticed that the default DH keysize in FreeRadius 1.1.3 is 512 bits. As DH keys have approximately the same strength as RSA keys, and 512 bit RSA keys have already been broken, wouldn't it be adviseable to use at least 1024 bit DH keys as the minimum size. 1024 bits is currently the minimum recommended size for a DSA/RSA certificate. It might also be a good idea to include the option commented out in eap.conf so users know that it's something they can change. I originally thought that the DH keysize would be determined by the DH parameter file and only realized that it was still using 512 bit keys when I ran freeradius in debug mode. As fas as performance goes, I've tested with 2048 bit and 3072 bit DH keys with no performance degredation. Authentication occurs in 1-2 seconds using the Funk Odyssey client on Windows XP SP2 with 3072 bit RSA certificates and 3072 bit DH key exchange. Also, it might be a good idea to put a comment in the TLS cipher suite comment section that the Microsoft Windows supplicant in Windows XP SP2 uses RC4-MD5 by default (TLS_RSA_WITH_RC4_128_MD5). First, MD5 is deprecated and weak. SHA-1 should be used in its place. Secondly, DH is preferable to RSA for key exchange because it provides perfect forward secrecy. If RSA is used for encryption, a compromise of the client private key would allow an attacker to gain access to the master keys used to encrypt all prior wireless sessions whereas fresh DH keys are produced on each authentication and deleted after use. OpenSSL's 'HIGH' setting is probably the best for a Windows XP user as it uses EDH-RSA-DES-CBC3-SHA (TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA), so SHA1 is used for integrity, and DH is used for key exchange. Windows XP SP2 and earlier versions of Windows do not support AES for use in any of the EAP modes. Apparently, if you want to use AES you need to upgrade to Vista (See Security in Vista <http://www.microsoft.com/technet/itsolutions/network/evaluate/new_network.m…>) or use a 3rd party supplicant like the Funk Odyssey Client which I use (uses TLS_DH_RSA_WITH_AES_256_CBC_SHA with default Freeradius setup). Jason Wittlin-Cohen

3 5