- Freeradius-Users - lists.freeradius.org

Some questions about freeRADIUS implementation, PLEASE HELP ME!!
by alfonso celestino 08 Sep '05

08 Sep '05

Hi, I need your help We decide to use freeRADIUS as Radius Server on a Big wireless Network (in a university ) with about five hundred APs, but there are some questions (maybe basic questions) I need from your help to understand them better. 1. About certificates In the first stage we will use EAP-PEAP authentication with Primary and backup Radius Servers. I think to do next: At the Primary Server, I will generate the root, Primary Server and Backup Server certificates, then I will copy the root and Backup Server certificates to Backup server, That's correct?. or I have to generate one more time the root and backup server certificates in the backup server. 2. At the second stage we will implement a PKI and we'll use EAP-TLS and my doubt is about LDAP data base and simultaneous-use, for example with EAP-PEAP I add the next lines to users file : ....... DEFAULT Ldap-Group == group1, Simultaneous-Use := 1 Aruba-User-Role = "ESTUDIANTE", DEFAULT Ldap-Group == group2, Simultaneous-Use := 1 Aruba-User-Role = "PROFESORES", DEFAULT .... ..... And work perfectly, But what happen if we use EAP-TLS --> client certificates, exists any way to obtain the same results? ,if it is affirmative, how can I do it (some references, howto's) !!because when I use EAP-TLS I don't need to add nothing at users file nor in LDAP data base!!. 3. Finaly exists some advantages If I use Solaris instead a Normal PC with Linux(Debian). Your help will be very important for me!! Thanks in advance NOTE: simultaneous-use work perfectly with some NAS, with ARUBA NAS don't do it, but I thing need some little changes in the checkrad.pl script. Alfonso Celestino DGSCA,UNAM __________________________________________________ Correo Yahoo! Espacio para todos tus mensajes, antivirus y antispam ¡gratis! Regístrate ya - http://correo.yahoo.com.mx/

1 0

RE: Mixed-mode authentication enviornment
by Jonathan De Graeve 08 Sep '05

08 Sep '05

Is this also possible with EAP or MS-CHAP authentication? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Alan DeKok Verzonden: woensdag 7 september 2005 23:59 Aan: FreeRadius users mailing list Onderwerp: Re: Mixed-mode authentication enviornment Daniel Corbe <daniel.junkmail(a)gmail.com> wrote: > Since the SIP server requires DIGEST authentication, the Auth-Type > attribute is present and it is set to DIGEST which forces FreeRADIUS > to attempt a digest authentication. Once this fails an Access-Reject > packet is sent back to the RADIUS client You don't say who's setting Auth-Type. In the example config, the "digest" module sets it. If you're setting it yourself, there's a high likelihood that something will go wrong. > Is there a way to configure FreeRADIUS so it first attempts a DIGEST > authentication, and when that fails, we go ahead and attempt normal > authentication? No. That doesn't make sense. There IS a way to configure the server to try digest authentication only when the RADIUS packet contains digest attributes. Uncomment the lines referring to "digest" in radiusd.conf. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Freeradius
by Jonathan De Graeve 08 Sep '05

08 Sep '05

Is it also possible to add multiple 'Huntgroup-Name's into the database? In my first test it doesn't seemed to be possible -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 -----Oorspronkelijk bericht----- Van: Tobias Frank [mailto:frank@synergysystems.de] Verzonden: donderdag 8 september 2005 12:36 Aan: Jonathan De Graeve Onderwerp: Re: Freeradius Hello again Jonathan De Graeve schrieb: > > What I want to do is distinct users from NASSes. Lets say, users in the > mysqlgroup IT can connect to the NASSES 1 & 2 & 3 while patients only > can connect to NAS 3. This can be done with huntgroups but don't know > how to do this with an SQL based implementation forget my last mail. it is quite simpler. create your huntgroups and insert into radcheck (username, attribute, op, value) values ('Tobi', 'Huntgroup-Name', '==', 'IT'); -- ******************************************** Synergy Systems GmbH Tobias Frank Leiter Entwicklung Konrad-Zuse-Platz 8 81829 München Fon +49 (0)89 89080-500 Fax +49 (0)89 89080-600 mailto:frank@synergysystems.de ******************************************** Best Connections - www.synergysystems.de ********************************************

1 0

Handling Radius Events with Client
by Ali Koyuncu 08 Sep '05

08 Sep '05

Hi to all, Let's say we have a switch and two (free) Radius servers backing up each other. I want to implement a client, that listens to the call-related events (such as accest-accept, call started, call finished, failed, and etc.) received from the target Radius server, and process these data based on some rules. Here comes my questions: 1. Is it possible to handle Radius call-relaed events over UDP or TCP? -- because i am newbie to the subject, please excuse me if i am asking something stupid. 2. If it's, how? Any sample source code can be provided? Thank you and regards, Ali Koyuncu R&D Director "I'm not Anti-Business, I'm Anti-Idiot! (Dilbert)"

2 1

huntgroups and bad_logins
by Jonathan De Graeve 08 Sep '05

08 Sep '05

Hello, I bought the radius book from O'Reilly and its a good book except when you want to use freeradius mainly with an SQL backend. (default users profiles in SQL) Also the principle of huntgroups isn't very well explained. What I want to do is the following: NAS1: 10.1.1.1 NAS2: 10.1.1.2 SQL usergroups: patients, it IT may connect to NAS1&2, patients only to NAS2. I've been looking on the internet how to do this but didn't found it. I also have problems with the bad_login perlscript. When I run this script, it doesn't do anything (just hangs with no given output) Kind Regards

2 1

different EAP type
by FeLiX 08 Sep '05

08 Sep '05

Hi all, I want to control my WLAN whit authorization based on LDAP and authenticathion based on EAP-TLS. But on the same WLAN there is a VLAN for the voip. The mobile phones don't support TLS but only LEAP. it is possible to insert this in users file? DEFAULT Auth-Type := EAP Fall-Through = 1 "phone" EAP-Type := LEAP, User-Password == "123456" Fall-Through = 1 whit this I have: Unexpected trailing comma in check item list for entry phone. it's wrong the attribute eap-type or it'impossible to do? Thanks, Felice

1 0

can not link to oracle DB
by Lee Bobby 07 Sep '05

07 Sep '05

system:RH9 DB:oracle9i freeradius0.9.3 I have complied the freeradius on RH9 and have setup the DB.But the failed to connect oracle9i the error codes are below: ...... rlm_sql (/tmp/bobby//var/log/radius/sqltrace.sql): Ignoring unconnected handle 0.. rlm_sql (/tmp/bobby//var/log/radius/sqltrace.sql): There are no DB handles to use! skipped 1, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 0 modcall: group authorize returns fail for request 0 ...... I am confirmed that the radius.conf and oraclesql.conf is right: the right DB user and password,the right DB server address. I am really confused,Can anyone help me?

2 1

LEAP Protocol
by Juan Daniel Moreno 07 Sep '05

07 Sep '05

Hi everyone, is me again!! I have a question about freeradius 1.0.4. With LEAP protocol, the last packet sent by the server has a "leap-session-key". Does anybody knows how this key is generated? Thank you very much!!! Juan Daniel MORENO

2 1

reject some users from radius - ldap ?
by Frank Bonnet 07 Sep '05

07 Sep '05

Hello I use freeradius with ldap to manage wi-fi users ( thru chillispot ) everything works well but I would like to know if it is possible to exclude some users with radius ? My purpose is to forbid wi-fi access BUT let use the wired LAN access to the considered users. Thanks a lot. -- Cordialement/Regards Frank Bonnet

2 2

Encrypted passwords in the users file
by Miguel Angel Quiles 07 Sep '05

07 Sep '05

Hi, I've got a SUSE 9.3 with FreeRadius 1.0.2, and at the moment I have my user registered in the users file such as: username Auth-Type := Local, User-Password == "password" Service-Type = "Callback Framed", ... I would like to know how to encrypt the passwords. I would like to know if I need to install any package. Also, I would like to know how I can create this encrypted passwords. I hope somebody can help me. Thanks.

1 0