- Freeradius-Users - lists.freeradius.org

parsing certificate fields ?
by Riccardo Veraldi 13 Dec '05

13 Dec '05

Hello, I am using freeradius with 802.11i, everything works fine qith certificate authentication but I Can only parse the CN of the certificate I would like to parse for Locality L field. the new version 1.0.5 support this ? thanks Rick

3 4

EAP-TTLS with LDAP authentication?
by Konne 13 Dec '05

13 Dec '05

hi is it possible to do EAP-TTLS with LDAP authentication or what is the best and secure way? i have an AP cisco aironet 1242, Debian with Freeradius and a W2k3 Server with the Active Directory. what do you suggest? thx

2 1

Memory big problem
by Dmitry V. Pleganoff 13 Dec '05

13 Dec '05

By the way, rlm_checkval meets in most cases losses ==8528== 200448 bytes in 783 blocks are definitely lost in loss record 178 of 190 ... ==8528== by 0x1BB83E41: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ... ==8528== 60416 bytes in 59 blocks are possibly lost in loss record 162 of 190 ... ==8528== by 0x1BB88BF0: regexec (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FF4: do_checkval (rlm_checkval.c:281) ... ==8528== 55800 bytes in 15 blocks are possibly lost in loss record 159 of 190 ... ==8528== by 0x1BB83EBF: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ... ==8528== 22320 bytes in 6 blocks are possibly lost in loss record 151 of 190 ... ==8528== by 0x1BB83EBF: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ... etc.

2 1

Memory big problem
by Dmitry V. Pleganoff 13 Dec '05

13 Dec '05

Thanks, I have tried Valgrind. Valgrind have given out as a result of 20 losses and possible losses of memory. Basically from several bytes up to 200 kbytes for 30 seconds of work. The largest following. ... ... ... ==8528== 11032016 (72220 direct, 10959796 indirect) bytes in 785 blocks are definitely lost in loss record 166 of 190 ==8528== at 0x1B90659D: malloc (vg_replace_malloc.c:130) ==8528== by 0x1B906FFA: realloc (vg_replace_malloc.c:188) ==8528== by 0x1BB84194: (within /lib/tls/libc-2.3.2.so) ==8528== by 0x1BB83EBF: regcomp (in /lib/tls/libc-2.3.2.so) ==8528== by 0x1D310FC3: do_checkval (rlm_checkval.c:275) ==8528== by 0x80579CF: call_modsingle (modcall.c:254) ==8528== by 0x8057F3E: modcall (modcall.c:590) ==8528== by 0x8057AB2: call_one (modcall.c:287) ==8528== by 0x8057B6D: call_modgroup (modcall.c:342) ==8528== by 0x8057FC7: modcall (modcall.c:575) ==8528== by 0x8057526: module_authorize (modules.c:936) ==8528== by 0x804D1ED: rad_authenticate (auth.c:548) ... ... ... ==8528== LEAK SUMMARY: ==8528== definitely lost: 275914 bytes in 1581 blocks. ==8528== indirectly lost: 10960904 bytes in 140534 blocks. ==8528== possibly lost: 236468 bytes in 234 blocks. ==8528== still reachable: 2190028 bytes in 32961 blocks. ==8528== suppressed: 0 bytes in 0 blocks. Also what with it is possible to do? To try me to correct rlm_checkval?

2 1

SQL authenticate & Proxying
by stu-tss1＠auxs.umn.edu 13 Dec '05

13 Dec '05

3 2

LDAP: disable filter setting?
by Derrick Woo 13 Dec '05

13 Dec '05

I tried searching for it, but haven't come up with any solution. Is there a way to disable the filter rule in the LDAP section freeRADIUS 1.0.1? If I comment out the filter setting in the radiusd.conf, it seems to default to (uid=%{User-Name}) according to the logs. I ask because the server I am trying to bind to has not implemented filters.

1 0

configuration question
by Norbert Wegener 13 Dec '05

13 Dec '05

At a switch we do 802.1x authentication with freeradius via EAP-TLS. We take the User-Name from the certificate and check against AD, whether a valid account belongs to that machine. If so, different data are returned from AD. Among others the primaryGroupID. This group id shall be assigned as vlan-id to the switch, if - and only if - this vlan-id is known by the switch, if not, a default vlan should be setup. I want to store the vlans a switch knows about, in a database and start a query, using the primaryGroupID from AD to get the information, whether the switch knows this vlan. If not, a default vlan id shall be assigned. As I did not yet succeed in the last part, my question is: Is this at all possible? How can I refer to the primaryGroupID, when querying the database? Is there a much better solution for that problem? Thanks Norbert Wegener

1 0

Documentation on Group Locking using FreeRADIUS/AD/Cisco VPN Concentrator
by Alhagie Puye 13 Dec '05

13 Dec '05

Hello all, I have spent a few bit of time trying to get FreeRADIUS/Active Directory/Cisco VPN Concentrator 3005 to lock users into group using the class attribute. Dusty Doris gave me a hand too. It has been tested and it works as expected. http://www.cisco.com/warp/public/471/altigagroup.html This feature is very, very neat and flexible. I would now like to write up a step-by-step document on how to make these work together. I don't have a public web site to host this page. I'm looking for suggestions on how to make it readily available to other users since the VPN Concentrator is gaining popularity. Is the wiki page mentioned here a while back going to materialize? Or should I write up a text document so that it could be added to doc/ directory in the source code? I would hate for someone to have to reinvent the wheel on this issue. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 1

Load Test the radius server
by sajeewawin＠dcgroup.net.au 13 Dec '05

13 Dec '05

Hello all, Is there any scripts or tools I could use to stress test our radius server? I need to test so to see if the server we have configured would be able to handle 5000 connections trying to login in a few seconds. Regards, __________________________________________ Sajeewa Warnakulasuriya ispOne Pty Ltd.

3 2

NAS list and dynamic IP
by Gunther 13 Dec '05

13 Dec '05

I am running FR 1.0.5 using MySQL including the nas list in a table. So far I have to use the same secret for a number of different NAS units which are connected to the Internet via a dynamic IP. My FR server is on the Internet and has to accept connections from the various NAS units, which can be connected with a variety of different IPs. One ISP has several IP ranges and all of these addresses have to be recognised. So far I am using a masked IP address as nas identifier (e.g. 123.123.0.0/16). How can I use a unique secret for each NAS connected to the same ISP? This is the fixed position format of the nas list in sql (rlm_sql.c): /* * Format: * Row1 Row2 Row3 Row4 Row5 Row6 Row7 Row8 * * id nasname shortname type ports secret community description * */ >From what I understand and experienced, the nasname must be either a DNS resolveable name or an IP address or IP range with netmask. Since my nas clients are on dynamic IP addresses and the nas list will only be read during the radius startup, I am using IP addresses with netmasks. Startup: Sun Dec 12 13:03:44 2005 : Debug: rlm_sql_mysql: query: SELECT * FROM phs_nas Sun Dec 12 13:03:44 2005 : Debug: rlm_sql (sql): Read entry nasname=123.123.0.0/16,shortname=MyShortName,secret=mySecretHere Sun Dec 12 13:03:44 2005 : Debug: rlm_sql (sql): Adding client 123.123.0.0/16 (MyShortName) to clients list ... read nas next entry Is there another way of handling dynamic NAS IP addresses and unique nas secrets? Gunther

3 3