- Freeradius-Users - lists.freeradius.org

ldap_connections_number
by Benedikt Panzer 23 Aug '05

23 Aug '05

Hello, it seems to me the FR doesn't open as many connections as in ldap_connections_number specified. Even tough there are many RADIUS requests in the queue (they have to be) and I allowed 50 connections to the ldap server FR opens justs 1 or 2. Why? That wouldn't bother me usually. But my ldap server delays responses when the password was wrong. And because FR uses only so few parallel connections also those requests with correct passwords are affected and delayed. That's why I'd really apreciate if FR used more connections. Is there a chance? Thanks a lot, Benedikt -- Benedikt Panzer Rechenzentrum Universität Stuttgart

2 1

RE: best place for logic - users file or custom module?
by Tariq Rashid 23 Aug '05

23 Aug '05

is python more stable than the support for perl? i have much more experience in python than perl. also is the "perl/python" stuff persistent - or is the interpreter invoked for every request? i am asking as i think this is the main reason for Radiator's performance issues - in theory even a big interpreter loaded into RAM should run fine ... but I suspect something inefficent is happening with Radiator. tariq rashid -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 23 August 2005 16:54 To: FreeRadius users mailing list Subject: Re: best place for logic - users file or custom module? Tariq Rashid <tariq.rashid(a)uk.easynet.net> wrote: > hi, i'm planning a significant migration from a different radius server > (Radiator, perl based). That's good to hear! > our tests with freeradius show a much lighter server - its faster, and > easier on memory and cpu. however the downside is that applying custom logic > to the radius process is a bit more difficult. Yes, there are trade-offs. > i'd like some advide on the best place to implement this logic. for example > - a common scenario is for a request to come from A, and the reply to A > contains instructions to extend a tunnel to a second device B. A second > query from B is then received. > > this case is handled easily in perl using "if()" constructs. My suggestion is to use Perl. :) rlm_perl is in 1.0.4, but it's not stable. The CVS head is in transition, too. I would suggest grabbing revision 1.19 of rlm_perl from CVS, and building it into 1.0.4. It should work, and it will get you the custom logic you need. And, it will be multi-threaded, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

MySQL radacct not updated
by sean 23 Aug '05

23 Aug '05

Hi, I have a strange problem with MySQL and FreeRadius. The system had been performing perfectly but it is no longer updating radacct. The result is that when users login the counter on their login page counts down their remaining time. But when they logout and then login again the counter is reset back to its origional value. This means that user names and passwords last forever. The sql log file used to show Quote: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='bebbik6'; INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('42e4494400000000', '3f1c519e5a66e2fe', 'bebbik6', '', '0.0.0.0', '0', 'Wireless-802.11', '2005-07-26 06:04:07', '0', '0', '', '', '', '0', '0', '00-12-17-B7- A1-70', '00-C0-49-5C-40-48', '', '', '', '192.168.182.2', '', '0'); UPDATE radacct SET AcctStopTime = '2005-07-26 06:04:13', AcctSessionTime = '6', AcctInputOctets = '1403', AcctOutputOctets = '5179', AcctTerminateCause = 'User-Request', AcctStopDelay = '', ConnectInfo_stop = '' WHERE AcctSessionId = '42e4494400000000' AND UserName = 'bebbik6' AND NASIPAddress = '0.0.0.0'; But now it only shows Quote: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='bebbik6'; I'd really appreciate any help to solve this problem. Regards from Ireland. Sean Bracken

2 1

problems with the detail file
by jgruwell＠cox.net 23 Aug '05

23 Aug '05

Hello, I am running freeradius version 1.0.4 on Fedora Core 4. I have a problem with the detail file that writes to the radacct directory. I noticed that this log file is setup to write by default. I have uncomment the appropriate lines to have the auth-detail and replay-detail log files written to that same directory. There is no problem with these files being written to that directory either. I receive no errors for these three log files during the daemon startup or during debug output. It looks like this should be working but only the auth-detail and reply-detail log files are being written to that directory. I have no detail file in that directory. Here is the debug output of the server. Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication 192.168.1.222:1645 Listening on accounting 192.168.1.222:1646 Ready to process requests. I cant see any differences for the output between the three files. I receive no erros during startup as well. I think this should be working, but I only get two log files auth-detail and reply-detail, not the detail file. Any help you may be able to give me would be greatly appriciated, thanks in advance. I attached the whole debug output in case you may need it. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 60 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.1.222 IP address [192.168.1.222] main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/etaxradius_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/etaxradius_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/cacert.pem" tls: private_key_password = "my key" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication 192.168.1.222:1645 Listening on accounting 192.168.1.222:1646 Ready to process requests.

1 0

best place for logic - users file or custom module?
by Tariq Rashid 23 Aug '05

23 Aug '05

hi, i'm planning a significant migration from a different radius server (Radiator, perl based). one advantage of that server is that it is very easy to code custom hooks to apply business logic to post-(ldap)-search and post-auth points of the radius sequence. the disadvantage is the performance of the system (single-threaded, low peak performance intorducing latency into system). our tests with freeradius show a much lighter server - its faster, and easier on memory and cpu. however the downside is that applying custom logic to the radius process is a bit more difficult. i'd like some advide on the best place to implement this logic. for example - a common scenario is for a request to come from A, and the reply to A contains instructions to extend a tunnel to a second device B. A second query from B is then received. this case is handled easily in perl using "if()" constructs. in theory - and for simple cases - i can do this in the "users" file with the matching conditions to provide the logic - but that's not a scalable or sensible way i think - correct me if i'm wrong. i'll be handling many conditions (if nas-identifier = x, .., if domain/realm = y ... ). so i guess i have to write a custom module for this? comments appreciated. pointers to examples / tutorials also appreciated - i couldn't find any in the documentation or on the website. tariq

4 3

EAP-MD5 usage
by Bilal Shahid 23 Aug '05

23 Aug '05

Hello, I have a question about EAP-MD5 usage. Would appreciate any help. I am using FreeRADIUS as the Authentication Server with Open1X Supplicant. When I set Supplicant Identity different from EAP-MD5 username, the RADIUS Server sends my Supplicant an Access-Reject. My questions are the following: 1- Where do we set the "Supplicant Identity" in the FreeRADIUS Server? Do we set it in the "users file? If yes, then where do we set the EAP-MD5 user information? 2- Is it necesasry that the EAP-MD5 "username" must match the Supplicant identity that open1x Supplicant returns to the Ethernet switch in response to an EAP-Request/Identity packet? Thanks, Bilal _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

build problem - mysql header files not found
by Ben Dowling 23 Aug '05

23 Aug '05

Hi, I am having a problem building freeradius-1.04 on linux. I have installed mysql 4.1.10 but when running make it bails out complaining that mysql.h and errmsg.h cannot be found. The files can be located in /usr/local/mysql/include. As a hack I copied these files into the corresponding build directory and I also added /usr/local/mysql/lib to /etc/ld.so.conf but the build bails out saying a mysql library cannot be found. Searching on the net it seems that these problems are a result of mysql-devel not being installed, but I don't believe this package exists for mysql 4.1.10, as the header files and libraries are included in the standard package. Do I need to set some enviroment variables to get this to work, or am I using an incompatable version of mysql? Thanks in advance, Ben

1 0

Re: Windows Client Authentification bevore Domain logon
by Armin Krämer 23 Aug '05

23 Aug '05

Hi, thanks for your email! Ok, i tried it out but i have some problems. If i use the DWORT String you sent me it has no efekkt. I found an other DWORT Key which Sounds "AuthMode" and with this DWORT he only tries to authentificate with the machine account. Maybe you have made a typing mistake in your email?? Ok, but my problem ist, that when he tries to authentificate with the Computer Account i see in the radius debugging modse that he only tried to use the default entry in the user File and not the "Client3" Entry. It seems that he does not find the right Computer Certificate or the Freeradius does not find the Right Entry in his user File??? This is the output from Freeradius -X -A when the DWORT "AuthMode" is set to 2 Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/ssl/certs/8021x-server.pem" tls: certificate_file = "/etc/ssl/certs/8021x-server.pem" tls: CA_file = "/etc/ssl/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/ssl/certs/dh" tls: random_file = "/etc/ssl/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 10.40.0.254:1024, id=103, length=120 NAS-IP-Address = 10.40.0.254 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x8e013b02cf39c8b291f8a9d790f3bd6a NAS-Port = 8 Framed-MTU = 1490 User-Name = "host/Client3" Calling-Station-Id = "00-10-5A-F7-F0-BA" EAP-Message = 0x02ff001101686f73742f436c69656e7433 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/Client3", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 255 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 181 users: Matched entry DEFAULT at line 200 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 103 to 10.40.0.254:1024 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010000060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1814a65439afaa74487aa379af48ead9 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 103 with timestamp 430b0c7e Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.40.0.254:1024, id=104, length=120 NAS-IP-Address = 10.40.0.254 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0xe3868d2de84c592e7e54eb355b23752f NAS-Port = 8 Framed-MTU = 1490 User-Name = "host/Client3" Calling-Station-Id = "00-10-5A-F7-F0-BA" EAP-Message = 0x0201001101686f73742f436c69656e7433 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "host/Client3", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 181 users: Matched entry DEFAULT at line 200 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 23.08.05 09:15:13: At 16:26 22/08/05, you wrote: >Hi, i sucessfully installed a Radius authentificated Network with EAP-TLS >Authentifikation. But I cant get logon to my Domain Controller when >themachines boot up.. Ok, I know this Problem is not new, but is there any >chance to solve this problem without additional software like AEGIS?? Or is >there an other Software for Windows XP and or 2000 which is free from >license? And is itpossible to set a default vlan group where the Domain >Controller exists and all Clients firstly get in and later change the >VLANID??? Would this be possible and how would it work? > >Greetings Armin I have managed to do this by three different routes. 1. Use the Microsoft built in wireless client. To do this you need to use mmc and the certificate plug in to install a CA certificate & personal certificate for the local machine. Create a wireless profile in XP which connects to your network using the CA certificate you installed. Then add a DWORD registry entry AuthType with a value of 2 to HKLMSOFTWAREMicrosoftEAPOLParametersGeneralGlobal. This causes XP to use the machine account to authenticate to the network. This only uses the machine account to authenticate against the network, at no time does it use the users account. Other values to use are 0 - Use the default XP authentication, 1 - Always perform user authentication when a user logs on, 2 - Perform computer authentication only. 2. As above, but don't add the registry entry. This time the machine will authenticate itself to the network before logon which allows the computer to see the network and the domain. Once the user logs on to the domain the connection is lost and the user account is then used to authenticate against the network. The problem here is that unless the user also has a valid personal certificate the authentication fails. This means going round to each user and installing a certificate, unless you can do it via Active Directory, we are using a Samba PDC here so that is not possible. I decided against this option with having 1500 potential users. 3. If you are using Intel wireless cards download the full version of the ProSet drivers, mine were 2200BG. This allows for different profiles which work as the machine before logon, or during logon to validate the user against the network. It also adds TTLS as well as TLS. There is a problem with this software if you are using roaming profiles. During logoff the network connection is dropped and it is impossible to upload the profile to the servers. According to Intel this is a know problem and at this time they have not replied to say if there is going to be a fix for it. This method worked very well upto the point of saving the profile, it is also much easier to distribute the settings to other machine using the profile import feature the ProSet drivers provide. Steve Atkinson Deputy Network Manager Fallibroome High School Priory Lane Macclesfield Cheshire SK10 4AF - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Netscreen and Freeradius.
by Maqbool Hashim 23 Aug '05

23 Aug '05

Hi, Has anyone used Radius for authentication with the Netscreens? It works fine, however there is one problem. Root-Admin for Radius authentication is no longer supported. This is the value of the NS-Admin-Privilege attribute in the Netscreen dictionary file which gives full access to the user. Consequently you have to use All-VSYS-Root-Admin which gives read-write access to the user, but disables some vital functions. One of which is tftping software and config on and off the device. Is anyone aware of any other limitations for All-VSYS-Root-Admin users? I'm posting this in the hope that other people have come across this issue and found a workaround. Hoping for the best, Maqbool Hashim

1 0

Server Certificate for use with Windows PEAP Clients
by Ben Thompson 23 Aug '05

23 Aug '05

Hi I'd like to get certificates installed on two of our FreeRADIUS boxes to satisfy the requirements of the Windows built in PEAP client when it does it's "Validate server certificate" bit. I have read about the requirement for the certificate to include the Server Authentication (1.3.6.1.5.5.7.3.1) OID in the Enhanced Key Usage section and I would like to know if anyone else has had experience of this. I have also heard about the special WLAN certificate available from Verisign which sounds like it will do the job, but I would like to hear from anyone who knows about an alternative as this one is a bit pricey. Thanks Ben Thompson

5 8