Re: the newbie on radiustesting strikes again
----- Original Message ----- From: "Ivan Kalik" <tnt@kalik.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Subject: Re: the newbie on radiustesting strikes again Date: Sat, 19 Apr 2008 17:34:36 +0100
You need to sort out some basic things:
- your user sits at the laptop and connects to - what? What service is router controlling? A: to internett via the router for example What service is router controlling? A:The traffic through the DSL-modem (You mean to say: "Which service is the router controlling" or "Which service is routercontrolling" i.e. controlling the router?)
OK. But how are they going to connect to the router? You are mentioning PEAP, so I assume that router does support EAP (WPA-Enterprise)? For wireless clients. Will there be wired clients? Can their access be controlled? The Router supports EAP/WPA-Enterprise(has a box for this choice;) Automatic (WPA or WPA2), TKIP and AES There will probably for all practical purposes be only wireless clients:3 laptops and one workstation,but I have configured 2 IP addresses for each laptop, one for their wireless card the other address for the wired/cabled card in case they will be needed. The access of the clients are controlled allowing only the specific MAC addresses of each machine to connect to the router.(Routers Netfilter) The machines have also fixed IPs reserved.
- your router is most likely the only (radius) client on your network. User machines should be removed from clients.conf. A:Remove all user machines Thus only one machine, the router, is to be defined as client client 192.168.0.1 { secret = testing123 shortname = asus-TL nastype = other # DLINK 635 Router }
That should be fine now.
- don't use Auth-Type and User-Password. Read instructions in users file. Documentation you got these entries from is years out of date.
A: FreeRADIUS Version 1.0.4. - And this is a tricky part. If no Auth-Type and User-Password, should I apply Fall-Through instead to have a DEFAULT running?
OK, disregard what I said. You are using version that is years out of date, so those entries are likely to be correct. Just check that you can disable DHCP on the router and hand IPs via radius. DHCP-server can be deactivated on the router but I had some problems making a deactivation work for the WinOSs. If the 4 machines have IPs 192.168.0.193-199 I could set DHCP reservations range on the router to the same and thus stop the server,is this safe, or does it disturb the radius DHCP ability?
If you upgrade to current version certificates will be created for you. Even if you don't want to upgrade you can download 2.0.3 and use it to generate certificates that you can use in 1.0.4. I have right now downloaded the 2.0.3 and had a look at it. I could later try to generate certificates, as you say. Could also later try to upgrade. Hope SuSE 10.0 has the necessary environment for it.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze
DHCP-server can be deactivated on the router but I had some problems making a deactivation work for the WinOSs. If the 4 machines have IPs 192.168.0.193-199 I could set DHCP reservations range on the router to the same and thus stop the server,is this safe, or does it disturb the radius DHCP ability?
Win XP has 3 levels of redundancy when IPs are handed over. On first level you can configure static IP or leave it on authomatic. If it's left on authomatic and there is no DHCP/radius IP configuration, secondary level is used. You can configure static IP there that will kick in when you are on a network without DHCP/radius. If that is also left unconfigured third level will assign an IP from APIPA range (169.254.x.x). So on Win XP client your connection will eventually get an IP even with no IP from the router. Use either DHCP or radius to hand out IPs. Pick what's easier for you. Ivan Kalik Kalik Informatika ISP
Hi, Ivan has already given you much good advice. I wanted to add a few comments. In message <20080419222236.5BED97B8F8@ws5-10.us4.outblaze.com>, Si St <sigbj-st@operamail.com> writes
The Router supports EAP/WPA-Enterprise(has a box for this choice;) Automatic (WPA or WPA2), TKIP and AES
I would be very surprised if the RADIUS functionality on the router supports anything other than the wireless access point. It sounds like you have a consumer level unit - not an enterprise level router/firewall here. If so, all you can do with RADIUS is to control access to your wireless network - the Authentication and Authorisation of AAA. Most consumer level units do not support Accounting - though some do. If your router doesn't support accounting, there's no point wasting any time setting up accounting in FreeRADIUS! You will not have the RADIUS functionality of more expensive enterprise level wireless access points, such as the ability to return the VLAN to connect the user to from the RADIUS server. There again, if this is a consumer unit, it probably has no VLAN support anyway.
There will probably for all practical purposes be only wireless clients:3 laptops and one workstation,but I have configured 2 IP addresses for each laptop, one for their wireless card the other address for the wired/cabled card in case they will be needed. The access of the clients are controlled allowing only the specific MAC addresses of each machine to connect to the router.(Routers Netfilter) The machines have also fixed IPs reserved.
I very much doubt that your router can make any use of RADIUS for handing out IP addresses, especially if the only mention of RADIUS is in connection with the wireless features. Handing out IP addresses via RADIUS is most commonly done with NASes (dial in servers), VPN servers and CMTS (cable modem termination systems). DHCP is more typical for bridged scenarios such as wireless networks. Your credentials get you connected to the wireless network, at which point the computer gets an IP address and related information (gateway address, DNS server(s), possibly WINS servers) via DHCP. If you want better management of DHCP, one possibility is a DHCP server that uses an LDAP backend. You could also use LDAP to store user credentials for FreeRADIUS. However, with the size of your network, the added complexity probably isn't worthwhile. Start with the simplest possible setup and only add functionality when you've got the basic stuff working. Keeping the configuration in a revision control system helps, too, not least when upgrading the server to a newer version. I use Subversion, but it is probably best to use what you're most familiar with. FreeRADIUS 2.0.3 will make your task much easier as it will build the necessary certificates for EAP automatically. PEAP is pretty easy to get going as there's no need to generate client certificates. Whatever your eventual aims, start by getting your wireless users on WPA2-Enterprise (or WPA2 / WPA mixed mode if you have any clients that can't do WPA2) authenticating against FreeRADIUS with PEAP. Use the users file for your users. Anything else should be built on top of that. radiusd -X is your friend. Best wishes, David -- David Wood david@wood2.org.uk
participants (3)
-
David Wood -
Ivan Kalik -
Si St