- Freeradius-Users - lists.freeradius.org

Procautions on upgrading FR from 2.1.10 to 2.2.0
by Wang, Yu 23 Apr '13

23 Apr '13

Hello, I am planning to upgrade our FR from 2.1.10 to 2.2.0 to address increasing NTLM authentication failures using EAP-MSCHAPv2 in our wireless systems. I would welcome and appreciate advice on precautions I should take before, during, and after upgrade. Any issue did you run into in your upgrade, what impacts it had, and how did you resolve it? Thank you for your time. Yu Wang Network Architect Core Networking, FSU

4 7

Re: Procautions on upgrading FR from 2.1.10 to 2.2.0
by Alan Buxey 23 Apr '13

23 Apr '13

...have a little test/dev server. Copy your current config onto it and run the new version in full debug mode, see what it might complain about Alternatively, compare your config against vanilla config and then just start from vanilla making required changes...this can really help to clean up old legacy configs and also helps you learn the server and how it works..I note this method as its going to be crucial for 2.x to 3.x upgrades alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

get some invalid value in User-Name attribute
by Mehdi Ravanbakhsh 23 Apr '13

23 Apr '13

I get something like 'aolnet/aol.dsl.newuser.10A50001000300010001US92C1.0000.prod' in User-Name attribute . I think it should be connect-info attribute !!!!! and In this case all %{connect-info} is empty (not null) . i increase the connect-info to 150 character but nothing happens. I am confuse in this case .... what is the problem? it seams that some attribute is swap !!!!

3 2

Request has been waiting in the processing queue for 30 seconds
by Mehdi Ravanbakhsh 23 Apr '13

23 Apr '13

i get this error in log file when server load is increase . Request 55318 has been waiting in the processing queue for 30 seconds. Check that all databases are running properly! it means that database not respond to request or freeradius engine ? how can i solve this problem ?

2 4

[Help] How to control the authentication session timeout
by Danny Kurniawan 23 Apr '13

23 Apr '13

Hello All, We are using EAP-MSCHAPV2 for authentication with LDAP and using version 2.2.0. So actually who control the session validity for how long the client will be authenticate after connecting to the wireless AP? So for example i key in my username / password in Windows popup, then how long do i need to key in the credential again? Is this control by Radius or by the AP or by the Windows client? Thanks in advance and sorry for this newbie question :) -- Best Regards, Danny

1 0

OCSP parsing in client certificate
by Beltramini Francesco 22 Apr '13

22 Apr '13

Dear all, I have a small/big issue and I cannot find a good solution for that. Scenario: iPhones with certificates from internal PKI, joining a Wi-Fi network protected by WPA2-Enterprise authenticating against a Freeradius server v. 2.1.12 (Redhat 6.3). The radius server has as well an internal PKI certificate and the authentication used is EAP-TLS. No CRL/OCSP implementation on the first stage. Everything is working fine, the mobile device is configure to accept the radius certificate and the peers can therefore mutually authenticate each other. I then configured a Microsoft OCSP array to implement client certificate status checking on the radius server. When "override_cert_url = yes" in the OCSP section in eap.conf is configured to override the responder URL, everything is fine and radius get correct responses, [tls] --> verify return:1 [tls] --> Starting OCSP Request [ocsp] --> Responder URL = http://crl.ema.europa.eu:80/ocsp [ocsp] --> Response status: successful This Update: Apr 16 09:50:00 2013 GMT Next Update: Apr 17 22:10:00 2013 GMT [oscp] --> Cert status: good [ocsp] --> Certificate is valid! [tls] chain-depth=0, but when I try to remove this feature and use the OCSP property extracted from the client certificate, the radiusd -X output is: [tls] --> Starting OCSP Request [ocsp] --> Responder URL = http://(null):(null)(null) Error: Couldn't get OCSP response [ocsp] --> Certificate has been expired/revoked! [tls] chain-depth=0, [tls] error=0 I don't know if the problem is the client certificate or how Radius parse it. I this can help to understand, the output of: openssl x509 -in beltraminif.cer -noout -ocspid -ocsp_uri > http://crl.ema.europa.eu/ocsp (which is the correct url) Any input is really appreciated. Regards, Francesco Beltramini ________________________________________________________________________ This e-mail has been scanned for all known viruses by European Medicines Agency. ________________________________________________________________________

3 7

Couldn't init oracle OCI environment
by Lakshmi Narayana Baliah 22 Apr '13

22 Apr '13

Hi All, I want to configure the free radius to connect remote machine(where database installed). Getting below error. rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 rlm_sql_oracle: Couldn't init Oracle OCI environment (OCIEnvCreate()) rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. How do i do that ??? please help.... Thanks, Lakshmi narayana ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

3 2

Re: Connect-Info attribute
by Alan Buxey 21 Apr '13

21 Apr '13

Do your NAS send connect-info? Do tour other RADIUS servers even note or use it? Freeradius is more verbose so you will notice this and the provided sql schemas are very generic , one size won't fit all, you may find that you have to edit the config files your purpose. Are you using the filters? If so, you will need to ensure eg connect-info is added to the relevant filter file eg 'attrs' alan

1 0

Connect-Info attribute
by Mehdi Ravanbakhsh 21 Apr '13

21 Apr '13

Hi All my radius server is running well but %{Connect-Info} in start query of dial-up.conf is empty for all NAS NAS is work fine by other radius server , i do not know that it may be related to witch part of freeradius ... Please hellp

2 1

transfor of character in Cleartext-Password
by Mehdi Ravanbakhsh 20 Apr '13

20 Apr '13

Dear All If i use some character such as " !& " in Cleartext-Password when access that attribute in site-enable by %{User-Password} or %{control:Cleartext-Password} it change to "=21=26" for example : mgMG17!& > mgmg17=21=26 Best regards

1 0