Hi Nicolas,
Be careful that using MD5 is not possible with all authenfication methods: http://deployingradius.com/documents/protocols/compatibility.html (as you cannot uncrypt a hash)
I'm working on Radius Proxy. The method used for Authentication is EAP-TLS. The server is configured with a certificate for EAP-TLS. As Radius Proxy, I need to send the packet, received from Radius Client, towards Radius Server, with a Message-Authenticator (HMAC-MD5). Home_server function: home_server SERVER1 { ... require_message_authenticator = yes secret = <Shared Secret assigned to RAdiusServer> ... } As Radius Proxy, should I define an authentication protocols? Thanks Regards Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request@lists.freeradius.org Sent: giovedì 4 giugno 2009 13.55 To: freeradius-users@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 50, Issue 18 Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: dealing with 'corrupt' detail file (Arran Cudbard-Bell) 2. How use tagged atrributes? (R.Filatov@ttk.ru) 3. help HMAC-MD5 (Marco De Magistris) 4. Re: help HMAC-MD5 (Nicolas Goutte) ---------------------------------------------------------------------- Message: 1 Date: Thu, 04 Jun 2009 11:34:59 +0100 From: Arran Cudbard-Bell <a.cudbard-bell@sussex.ac.uk> Subject: Re: dealing with 'corrupt' detail file To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <4A27A353.3050306@sussex.ac.uk> Content-Type: text/plain; charset=UTF-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi,
(I've already got, on my list, use Calling-Station-Id instead of NAS-Port for the unique function as many NAS use the same port for every accounting packet :-|) Create a patch, and send it to the list via git format-patch. "Best practices" really need to go into the server configuration. Anything else is too frustrating for the end users.
I was hoping to get a small discussion initiated that would hopefully bring up a few things that people find they have to do to their configs ...at the end of which we get a nice comprehensive list of updates needed for the core server configuration (and hopefully a large number of 'you need to change this or add that' blog/wiki/random document entries removed across the world) We write out a different detail file per hour. If for whatever reason the account buffer gets to be big, and you have to restart the server, at least you only have to deal with an hours worth of duplicate accounting logs.
And just as Alan DeKok suggested: accounting { # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql { invalid = 2 } if (invalid) { ok } } You can log it to a rejects detail file as well, if you want to dissect the packets later. The other (far more difficult) to handle one, is where you're using this to Proxy eduroam Accounting records back to an ORPS. If the administrator of the ORPS has been particularly... obnoxious. Then the ORPS will not send Accounting-Responses, and the packet will be stuck in the detail file indefinitely. Our workaround is: accounting { # # Icky workaround for lack of universal eduroam accounting support # Really need NRPS to manufacture accounting response. # if((Acct-Delay-Time < 600) || (Realm != 'remote.jrs')){ proxy_to_realm } # # Since we're proxying, we don't log anything # locally. Ensure that the accounting section # "succeeds" by forcing an "ok" return. ok } This sucks, because perfectly valid Accounting Requests might be lost if they were received at around the same time as invalid ones. I'd be interested to hear if anyone has a better solution than the above. Thanks, Arran -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkono1MACgkQcaklux5oVKKh8ACdHgDLbeRIF6wpJY9boGATfybU AiUAoIsSVWWYt6LUETZ6Ky15Out8Fm+w =cShM -----END PGP SIGNATURE----- ------------------------------ Message: 2 Date: Thu, 4 Jun 2009 15:39:12 +0400 From: R.Filatov@ttk.ru Subject: How use tagged atrributes? To: <freeradius-users@lists.freeradius.org> Message-ID: <OF1C050F6B.AF15FFDD-ONC32575CB.003FFB82-C32575CB.004003A7@ttk.ru> Content-Type: text/plain; charset="us-ascii" Hello! This construction don't work # radiusd -X FreeRADIUS Version 2.1.6, for host x86_64-unknown-linux-gnu, built on Jun 2 2009 at 23:23:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf ..... attr_rewrite add.service-volume { attribute = "ERX-Service-Volume:1" searchfor = "" searchin = "packet" replacewith = "1000" append = no ignore_case = yes new_attribute = no max_matches = 1 } rlm_attr_rewrite: No such attribute ERX-Service-Volume:1 /usr/local/etc/raddb/modules/attr_rewrite[48]: Instantiation failed for module "add.service-volume" /usr/local/etc/raddb/sites-enabled/default[482]: Failed to find module "add.service-volume". /usr/local/etc/raddb/sites-enabled/default[480]: Errors parsing pre-proxy section. Errors initializing modules May be trouble in my /dev/hands? Best Regards Filatov Ruslan