- Freeradius-Users - lists.freeradius.org

One radius and 4 pppoe/pptp servers
by Mordor Networks 07 Jun '06

07 Jun '06

Hi all I have a small problem , i have a freeradius server with mysql backend and 3 pppoe server and one pptp server all the NAS'es "pppoe/pptp server" connect to the same radiusd and same mysql database , so when i add a user for exampe i added a user to server-one and his ip is 192.168.2.100 so the user must set the the server-name "server-one" in the service name when creating his connection setup , my problem is if a user on server-one did not set the service name or change it from server-one to server-two , he get connected to another server instead of server one , if he set the service name to server-two he get connected to server-two instead of server-one and if he did not set the service name at all he get connected to a ramdom server , how i can fix this issue , but forcing the user to get connect to the server we set up his account in . thanks

2 1

Re: Freeradius-Users Digest, Vol 14, Issue 29
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 28
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

PEAP authentication with freerad ?
by thomas hahusseau 07 Jun '06

07 Jun '06

Hello, I would like to use PEAP to perfome authentication of wlan users , I choose PEAP because Users and Passwords are in an LDAP Server (OPEN-LDAP). According to me PEAP works like this : Phase 1 :: TLS handshake the server authenticate to the client as a trusted radius serveur and a cipher tunel is created. Phase 2 :: Login + Password + Domain hashed with MD5 are send to the Radius Server which ask LDAP server for password and login. acording to the doc file : realm_eap , freeradius supports only eap-tls (authentication based only on certificates (client + server ) lead and eap-MD5 ( according to me even if PEAP use MD5 hash , the EAP-MD5 is different with no mutual autenthication and no TLS handshake ) I dont want to use a full certifcate based solution like EAP-TLS or a authentification with no ciphered tunel like with EAP-MD5 Anyone could help me for using PEAP (or at least authentication with the two phases described upper) with freeradius ? thank you. Ps : sorry for english mistakes :)

5 7

Re: Freeradius-Users Digest, Vol 14, Issue 27
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

freeradius 1.1.2 & rlm_unix on AMD 64
by MaKKrO 07 Jun '06

07 Jun '06

Hi all. I have a big problem woth freeradius and i need to fix it ASAP ! If someone can help me ... I'm using freeradius for a long time without any problem, but with the v1.1.2, i can't do anything ! When i want to start it, i'm always getting the message : Module: Instantiated pam (pam) radiusd.conf[604] Failed to link to module 'rlm_unix': /usr/lib64/rlm_unix.a: invalid ELF header radiusd.conf[1880] Unknown module "unix". radiusd.conf[1840] Failed to parse authenticate section. I tried to downgrade, but no older version are available on Gentoo (ebuild). Please... I really need your help guys ! Thank you -- View this message in context: http://www.nabble.com/freeradius-1.1.2---rlm_unix-on-AMD-64-t1740156.html#a… Sent from the FreeRadius - User forum at Nabble.com.

2 2

RE: SecurID authentication
by David Mitton 07 Jun '06

07 Jun '06

Darshak, I'm not a legal representative, but Michael's response is for someone that wishes to sell or distribute(?) a product that uses the SecurID service While doing a RADIUS proxy to for the new RADIUS server may be the correct approach, if you are an owner of a SecurID server solution, you can certainly develop code to use your licensed server for whatever application you wish. The product offering includes an ACE Client SDK which gives you a C-language API for doing SecurID authentication. It would be fairly straight forward to develop your own Free RADIUS module, but there are details with New Pin assignment and Next Token mode that get messy. The server uses Access-Challenge for them. Also the new server includes EAP support for several methods. So proxy may still be the best path. David Mitton Software Development, RSA Security, Inc. PS: I urge all senders to use meaningful Subject lines, the original message was discarded by me on first pass as spam. ----- Original Message ----- From: "Michael Lecuyer" <mjl(a)theorem.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: Hello, Date: Tue, 06 Jun 2006 09:08:16 -0400 It would be difficult to say how RADIUS would interact with the actual ACE server since it's a proprietary system. In 2002 I thought about going down this route and I'm summarizing from the 5 page SecurId integration document. You must write code that uses RSA's 'RSA Agent' software to communicate with the RSA ACE server. You must become a partner a a cost of ten thousand dollars for each product each year you provide the product(s). You must pay RSA twenty percent of your product's licensing fee. And you must have RSA certify it and may be required to provide a training program for RSA certification technicians. The sublicense agreement with RSA is incompatible with any open source software. The best thing to do is use FreeRadius as a proxy to the RSA RADIUS server. From a client's point of view the ACE RADIUS server may require a simple CHAP/PAP transaction or there may be challenges asking for more information. It depends on the RSA server configuration. darshak wrote: > Hi All > I m new to AAA things.I want how can I support RSA ACE/Server in > freeradius. > Can anyone has details How interaction is made between RADIUS and > RSA/ACE-server?. in general scenario > > > Rgds > DArshak >

2 1

peap authentication with active directory
by Kartthik Raghunathan 07 Jun '06

07 Jun '06

A supplicant ie. win XP machine validates the identity and logon credentials against active directory using peap-mschapv2 randomly ie. every 30 mins or 60 mins. This disturbs the wireless connectivity often and am unable to complete this project due to this situation. In krb5.conf and smb.conf i have left with default settings. here is my radiusd.conf file, let me know someone faced this issue. is there something am missing in my configuration. radiusd -A -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/openssl/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/openssl/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/secert/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/secert/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/secert/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/secert/dh" tls: random_file = "/usr/local/etc/raddb/secert/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 26
by Gilbert Lo 07 Jun '06

07 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

revoking ca certificates
by sumi thra 07 Jun '06

07 Jun '06

Hey All, Any body knows how to revoke the certificates? what changes needs to be done in the freeradius eap.conf file. Im trying to do in the way its given in the default config file: Oopenssl command to revoke the ca-certificate: openssl ca -gencrl -keyfile ./privatekey.pem -cert cacert.pem revoke cacert.pem -out crl.pem 1. copied ca & crl to ./ directory( my ca & crl files are in current directory ) 2. c_rehash ./ tls { ... CA_file = ./cacert.pem CA_path = ./ check_crl = yes } Still the server returns success for the user. Any idea ? where am i missing the configuration? Please reply me with your info. Thanks Sumi -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!" -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

4 3