- Freeradius-Users - lists.freeradius.org

Help for buy a real Cert (not self-signed)
by Spider s 04 May '17

04 May '17

Hello, I have got a few questions about radius and buy an original Certificate. Firsts thank you for the help here, but I can’t find an option for search on all post, is this possible ?? only find this: For example only can find post from this mount http://lists.freeradius.org/pipermail/freeradius-users/2017-January/thread.… Is for don’t disturb with my questions is are answered, sorry. And now my questions, first I have got running my freeradius installation 3.10 on ubuntu) with AD Auth, but with limitations, because I need install my self-signed cert on all device for connect to wifi. I don’t want this (I don’t want install the certs), and I need buy a real cert for a real CA, I know ,but I never buy one for this. (I never buy a certfor radius, web or similar) I need buy a real cert, where I can buy ?? recommendations webs?? And witch type ?? I see a lot of certs, and I don’t know the certification specification.( a lot of prices and options) Please a direct links if possible to correct cert. I never buy an original cert and I don’t know process. When I receive the certificates is like certs on the folder?? Need change data??? How can use this certs on my radius install?? Are 3, 5, 20 files ???? where i can find info about this ?? (On docs i reffer) Need a domain for this ?? can i use the cert from a Web (typical ssl cert that is used for web?? I see a lot of info on internet for use self-signed cert, but I can’t find info on documentations or on my Ubuntu install when use real certs. (Is very possible I don’t find) Thank you for your time when you read me, and sorry if a newbie questions. Thank you in advanced, i dont want confuse with this and spend money with this.

6 15

How to log AAA Reject packets?
by Periko Support 03 May '17

03 May '17

I would like to know if exist a way to log AAA Reject packets on FR2.2.x.? I had read the log manual but didn't find this special flag. Thanks all for your time!!!

2 2

freeradius3: multiple rlm_perl and thread pool
by Eugene Grosbein 03 May '17

03 May '17

Hi! Is it supported for freeradius3 to use two distinct rlm_perl modules inside single radiusd process but for different virtual servers? My perl installation is built with both of useithreads=define, usemultiplicity=define. In fact, I already run freeradius3/dhcp module with single server and rlm_perl and it works just fine: thread pool { start_servers = 1000 max_servers = 1000 min_spare_servers = 1000 max_spare_servers = 1000 } Each thread keeps its own persistent connection to powerful external MS SQL server and this 64bit FreeRADIUS has enough memory to run memory-hog embedded threaded Perl to be able to process hundreds of parallel DHCP requests without queueing delay. I need to add new virtual server to process plain RADIUS accounting requests (not DHCP requests) using another perl script and another rlm_perl instance. The question is: is it possible to define another thread pool for new virtual server with distinct *_servers parameters? If no, will new virtual server get a copy of its own thread pool with same parameters or FreeRADIUS uses same pool for all its virtual servers? Eugene Grosbein

3 3

documentation as epub and/or mobi
by Tobias Koeck 03 May '17

03 May '17

Hi, is there any way to get the documentation as epub and/or mobi format. It would be interesting to be able to use the own e-book reader to read the docs. Greetings Tobias

2 1

EAP TLS against multiple certificates?
by David Hartburn 03 May '17

03 May '17

Hi, Is it possible to check EAP-TLS against multiple certificate chains, or bundle two chains together into the same pem file? We have a potential problem where all our certificate auth laptops have been using SHA1 for quite some time. Recently we upgraded our certificate authority to SHA256, so any laptops that request a new cert will get a SHA256. If I put a SHA256 root chain certificate in the EAP-TLS config then a SHA256 client can authenticate, but naturally SHA1 can not. If I leave the SHA1 root chain on the server, then the newer SHA256 clients can not authenticate. I am worried that one day I will come in to find half the clients have renewed to a SHA256 and can no longer auth. Is there anything I can do to allow both certificate types to authenticate during this transition period? In terms of config, in mods-enabled/eap, I have tls-config loanlaptops { private_key_file = ${confdir}/certs/loan_laptop_server.pem certificate_file = ${confdir}/certs/loan_laptop_server.pem ca_file = ${confdir}/certs/unikentrootCAchain.pem ...... } tls { # Point to the Loan Laptops TLS configuration tls = loanlaptops virtual_server = check-eap-tls } Yours Dave Hartburn

2 5

Re: Radsec Clients
by Alan Buxey 03 May '17

03 May '17

Just populate the naslist table as you would for normal clients and ensure they are pointed to the correct virtual server and you've enabled reading of clients from the database in the SQL module alan On 2 May 2017 12:28 pm, "Xavier Maysonnave" <x.maysonnave(a)gmail.com> wrote: Hi, Thanks for the answer. You are right I don't want to put the tls sub-section in a sql table. I was referring to the clients radsec {...} sub-section defined in the file sites-available/tls. I'm looking at how to store those clients in a SQL table and didn't find out the correct solution yet. Thanks -- PGP: CAE5 CE4A EFE9 134F D991 5465 081C B6FB 2EAC 6CC9 <https://goo.gl/lPjb40> -- Light Xavier / Pudhuveedu 2017-05-01 17:35 GMT+05:30 Alan DeKok <aland(a)deployingradius.com>: > On Apr 30, 2017, at 11:33 PM, Xavier Maysonnave <x.maysonnave(a)gmail.com> > wrote: > > > > is there a way to store the radsec clients in an sql table rather than > > using the tls configuration file ? > > No. > > Clients can be listed in SQL. But the "tls" sub-section can't be put > into SQL. > > Alan DeKok. > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

2 2

Re: How to log AAA Reject packets?
by Peter Lambrechtsen 03 May '17

03 May '17

Add linelog or detail depending on how much detail you want into the post-auth Reject section and the rejects get logged. On 3/05/2017 12:58, "Periko Support" <pheriko.support(a)gmail.com> wrote: I would like to know if exist a way to log AAA Reject packets on FR2.2.x.? I had read the log manual but didn't find this special flag. Thanks all for your time!!! - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html

1 0

Radsec Clients
by Xavier Maysonnave 02 May '17

02 May '17

Hi All, is there a way to store the radsec clients in an sql table rather than using the tls configuration file ? Thanks -- PGP: CAE5 CE4A EFE9 134F D991 5465 081C B6FB 2EAC 6CC9 <https://goo.gl/lPjb40> -- Light Xavier / Pudhuveedu

2 3

Error when changing inner auth
by LUCA 01 May '17

01 May '17

Hi, I'm using the Version 2. I've successfully changed the default eap type. Now I'm trying to change the inner auth because I need pap as default. I've tried to change the inner auth for ttls but then this happens: ttls { default_eap_type = "pap" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } rlm_eap_ttls: Unknown EAP type pap rlm_eap: Failed to initialize type ttls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. I've tried to change the inner auth for peap as well, but same problem as before: peap { default_eap_type = "pap" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } rlm_eap_peap: Unknown EAP type pap rlm_eap: Failed to initialize type peap /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Why it doesn't recognize pap? Thank you. Luca

3 2

duplicated query insert doing accounting
by Leandro 30 Apr '17

30 Apr '17

Hi guys , Im trying to tune my accounting server. Everything is working good so far. On strange thing is the following line when debuging. rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql (sql): Duplicate entry '915bec9642b89feb789b9566b7ec6e9b' for key 'acctuniqueid' rlm_sql_mysql: MYSQL check_error: 1062 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Duplicate entry '915bec9642b89feb789b9566b7ec6e9b' for key 'acctuniqueid'' Why is there a second attempt to insert a register ? On the client side I did: radclient -f accounting_packet 172.20.4.208 acct xxxxxxx and checked that there is only one accounting request going to the server. Regards, Leandro

2 1