- Freeradius-Users - lists.freeradius.org

Performance
by Jory Privett 22 Sep '06

22 Sep '06

I am getting ready to switch my Radius servers over to FreeRadius and I would like to get some performance help. I know that FreeRadius can authenticate users from a MySQL database, from Linux users, and other options. For a performance and ease of maintenance which is recommended and why? Jory Privett WCCS

2 1

Problem configuration eap-tls
by listas 22 Sep '06

22 Sep '06

Hello!I'm OrgacK and this is my first post. I'm try to configure my own radius server for my house but before a lot of attempts I haven't got it. I always obtain same error: Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading Trusted root CA list rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1897] Unknown module "eap". radiusd.conf[1844] Failed to parse authenticate section. I think about the CA, server certificates and client certificates are created correctly. I don't know what i can do, have somebody any idea? PD: Sorry I'm Spanish and my English isn't very good. Greeting

4 6

Default radiusd.conf and Auth-Type LDAP comment
by Thibault Le Meur 22 Sep '06

22 Sep '06

Hi, This is just a comment on the default radiusd.conf provided information. In the authenticate section of the default radiusd.conf I can read about "Auth-Type LDAP": <quote> # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. </quote> While usually true, this assumption is a little confusing sometimes. Indeed, when EAP-TTLS uses PAP (not an EAP protocol I know) as its inside authentication protocol, a cleartext password is provided to Freeradius which is then able to use a simple ldap bind exchange to authenticate the user. Could we replace with something like that <quote> # Note that this means "check plain-text password against # the ldap database", which means that most EAP types won't work # as they do not supply a plain-text password (unless you use a # composite EAP scheme with and inner cleartext-enabled protocol # such as EAP-TTLS/PAP) </quote> But this is a little tricky... Or more simply: <quote> # Note that this means "check plain-text password against # the ldap database", which means that most EAP types won't work # as they do not supply a plain-text password # (an exception beeing EAP-TTLS with inner PAP authentication) </quote> The second one could be less confusing for people trying to setup EAP-TTLS/PAP on ldap directories but of course this is not a big deal... Thibault

3 7

Re: MSCHAP and encripted passwd
by ivandal＠tiscali.it 22 Sep '06

22 Sep '06

Hi, > PAP!!!!! I have read that it is possibile make it with NT-passwd hash. > It is true? And how it is possible? you put the NT-Passwd hash into the LDAP as password field entry alan Ok, but how can I convert passwd from clear text to NT-Passwd format? Thanks Naviga e telefona senza limiti con Tiscali Scopri le promozioni Tiscali adsl: navighi e telefoni senza canone Telecom http://abbonati.tiscali.it/adsl/

2 1

SMUX with FreeRadius
by Kshitij Korde 22 Sep '06

22 Sep '06

Hi I have integrated free radius server with NET-SNMP for monitoring radius server. Now the NET-SNMP daemon is detecting radius server. If I run radius server in debug mode I get following debug messages. Module: Instantiated radutmp (radutmp) main: smux_password = "verysecret" main: snmp_write_access = no inside oid_compare inside smux_connect SMUX connect try 1 inside smux_oid_dump SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: verysecret inside smux_oid_dump SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 inside smux_oid_dump SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. SMUX read start SMUX read len: 12 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. I may be asking some silly question since I don't have any idea how SMUX works. What are the functionalities provided by SMUX peer with respect to SNMP MODULE? Is there any mechanism where in we can send trap signal if radius server goes down? ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

MS Vista RC1 and Freeradius 802.1x
by Dourty, Brian R. (IATS) 22 Sep '06

22 Sep '06

We are having some difficulties getting MS Vista RC1 build (5600) to work with our Freeradius server using 802.1x. Has anyone been able to get this to work? Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

4 5

MSCHAP and encripted passwd
by ivandal＠tiscali.it 22 Sep '06

22 Sep '06

Hi, I have a big problem with Radius and Ldap. There is a way to use MSCHAP v2 with the password stored in LDAP in some encripted manners? (md5, crypto...) In the client authentication software I cannot use pap/ttls, so Radius receive finally from the client unencripted passwd and have to compare with the passwd encrypted on Ldap. I cannote use PAP!!!!! I have read that it is possibile make it with NT-passwd hash. It is true? And how it is possible? Thanks Ivan Naviga e telefona senza limiti con Tiscali Scopri le promozioni Tiscali adsl: navighi e telefoni senza canone Telecom http://abbonati.tiscali.it/adsl/

2 1

Re: Radius installation
by anyuru francis 22 Sep '06

22 Sep '06

Hello, Am installing freeRadius with Mysql5 and dialup admin with a freebsd 5.4 box well done most of the configs but dialup wont show the frame on the right in browser when I load it on the webserver Any help will be highly appreciated Kind Regards Francis

2 1

Users submitted password
by Michael Gale 21 Sep '06

21 Sep '06

Hello, Should I be able to read the User-Password attribute in the authorize section ? I tried printing out RAD_REQUEST{'User-Password'} but it is blank ... -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

2 2

rlm_ldap and 'unencrypted' connections
by Thibault Le Meur 21 Sep '06

21 Sep '06

ine doc/rlm_ldap I've read: <quote> # identity: DN under which LDAP searches are done password: pasword # which authenticate this DN default: anonymous bind, no password # required NOTE: searches are done now over unencrypted connection! </quote> I'm especially concerned about the 'searches are done now over unencrypted connection!' sentence. Does this mean that even if I use "start_tls = yes", searches will be performed unencrypted ? If yes, isn't the following procedure a way to enforce encryption on searches ? * do not use "start_tls = yes" * use "port = 636" and/or "tls_mode = yes" * have your ldap server reply only to port 636 in ldaps. Thanks in advance, Thibault

1 0