RE: freeradius not responding on machine specific IPs

still going to get an access-reject response unless you setup the user account and password your authenticating with in the users file. Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-co...@yale.edu - List info/subscribe/unsubscribe? See http://www.freeradius.org/list

Logging authentication attempts while TLS session resumption (caching) is enabled

authentication attempts would be more useful if the real username was provided in addition to the anonymous identity. Caching disabled: Fri Dec 12 17:35:38 2008 : Auth: Login OK: [Jason Wittlin-Cohen] (from client Wireless port 0 via TLS tunnel) Fri Dec 12 17:35:38 2008 : Auth: Login OK

Re: Freeradius configuration to support EAP-TLS, EAP-TTLS and EAP-PEAP

On Thu, Dec 11, 2008 at 9:16 AM, Attou eric gouroue...@yahoo.fr wrote: Hi Everybody. We are having some issues in setting up freeradius to support EAP-TLS, EAP-TTLS and EAP-PEAP. Our goal is to have our authentication server providing those three Auth-Type simultaneously. To support

RE: (err=2)! (Shared secret is incorrect.)

are stored in the users file. -- Jason Wittlin-Cohen Yale Law School, Class of 2010 [EMAIL PROTECTED] - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Does FreeRADIUS support PEAPv0/EAP-TLS?

On Tue, Dec 9, 2008 at 5:35 AM, Alan DeKok [EMAIL PROTECTED]wrote: Jason Wittlin-Cohen wrote: I already do that with the Juniper Access Client. The problem is that the client certificate has the user's name as the Common Name and that is sent in the clear. PEAP/EAP-TLS sends the user's

RE: client certs

store is probably what you want. Double click the client certificate, select install certificate and choose Place the certificate in the following store. Select the Personal certificate store. That should solve your problem. Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 [EMAIL

RE: client certs

must convert to pkcs12 as the documentation states. openssl pkcs12 -export -in certname.pem \ -inkey keyname.key -out name.p12 -clcerts* * Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 [EMAIL PROTECTED] (908) 420-0861 - List info/subscribe/unsubscribe? See http://www.freeradius.org

Re: client certs

, Jason Wittlin-Cohen wrote: Craig, Apparently Windows automatically sends non-CA certificates in DER or PEM format to the Other People' certificate store. More importantly, the wireless supplicant in Windows XP \will not work with PEM or DER formatted client certificates. It'll complain

Re: FreeRadius and Ubuntu 8.10

to updating it: Opportunity knocked. My doorman threw him out. - Adrienne Gusoff At school you don't get parole, good behavior only brings a longer sentence. - The History Boys - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Jason Wittlin-Cohen Yale Law

Re: FreeRadius and Ubuntu 8.10

Sorry, that should be apt-get build-dep freeradius apt-get install dpatch dpatch is necessary to build the source package but isn't including as a build dependency. On Thu, Dec 11, 2008 at 2:09 AM, Jason Wittlin-Cohen [EMAIL PROTECTED] wrote: Note that the version of FreeRADIUS packaged

Re: Does FreeRADIUS support PEAPv0/EAP-TLS?

On Tue, Dec 9, 2008 at 5:35 AM, Alan DeKok [EMAIL PROTECTED]wrote: Jason Wittlin-Cohen wrote: I already do that with the Juniper Access Client. The problem is that the client certificate has the user's name as the Common Name and that is sent in the clear. PEAP/EAP-TLS sends the user's

Re: Does FreeRADIUS support PEAPv0/EAP-TLS?

, Jason Wittlin-Cohen [EMAIL PROTECTED] piše: I'm attempting to setup PEAPv0/EAP-TLS which uses EAP-TLS as the inner authentication method within PEAP. Unlike EAP-TLS, PEAPv0/EAP-TLS sends the client certificate within the secure SSL tunnel, thus protecting the user's identity. While RFC-5216

Does FreeRADIUS support PEAPv0/EAP-TLS?

] returns invalid Failed to authenticate the user. Login incorrect: [Jason Wittlin-Cohen] (from client Wireless port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE *PEAPv0

RE: Does FreeRADIUS support PEAPv0/EAP-TLS?

I forgot to mention that I'm running FreeRADIUS 2.1.0 on Ubuntu 8.10 (2.1.0+dfsg-0ubuntu2 to be exact). As the original binary didn't come with SSL support, I recompiled it using the Ubuntu source package. The client computer I have been testing run Windows XP SP3. Jason -- Jason Wittlin-Cohen

Question about the random file

suggest using /dev/urandom directly. Is this a good idea? Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 [EMAIL PROTECTED] - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

WPA authentication works only with MacOS clients

Date: Mon, 16 Oct 2006 13:25:22 +0200 From: Josh Shamir [EMAIL PROTECTED] Subject: WPA authentication works only with MacOS clients To: freeradius-users@lists.freeradius.org Message-ID: [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1 Hello all, I'm using WPA with

Re: WPA authentication works only with MacOS clients

Message: 5 Date: Mon, 16 Oct 2006 22:36:14 +0200 From: Josh Shamir [EMAIL PROTECTED] Subject: Re: WPA authentication works only with MacOS clients To: FreeRadius users mailing list freeradius-users@lists.freeradius.org Message-ID: [EMAIL PROTECTED] Content-Type: text/plain;

Re: WPA authentication works only with MacOS clients

\ -infiles ./server_req.pem You'll now have server_cert.pem (Public Certificate) and server_key.pem (Private Key which has no password). The public certificate will have the Server extended key usage extensions set and now your XP client should authenticate. Jason Wittlin-Cohen P.S: Sorry

Freeradius is not restarting properly (fails to quit and becomes a zombie process)

dius-users@lists.freeradius.org Message-ID: [EMAIL PROTECTED] Jason Wittlin-Cohen [EMAIL PROTECTED] wrote: I have discovered the root of the problem. When I enable the "check_cert_cn = %{User-Name}" option in eap.conf and successfully authenticate 1 user , a restart or stop of the r

WPA authentication works but take very log time

Message: 5 Date: Fri, 13 Oct 2006 23:38:54 +0200 From: Giuseppina Venezia [EMAIL PROTECTED] Subject: WPA authentication works but take very log time To: FreeRadius users mailing list freeradius-users@lists.freeradius.org Message-ID: [EMAIL PROTECTED] Content-Type: text/plain;

RE: EAP-TLS Certificate problems.

-outform DER -in cert-srv.pem -out cert-srv.der Jason Wittlin-Cohen - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: EAP-TLS Certificate problems.

-in cert-srv.pem -out cert-srv.der Jason Wittlin-Cohen - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: EAP-TLS Certificate problems.

:lib(0):func(0):reason(0) Sun Oct 8 03:13:56 2006 : Error: rlm_eap: SSL error error::lib(0):func(0):reason(0) Sun Oct 8 03:13:56 2006 : Auth: Login OK: [Jason Wittlin-Cohen] (from client WLAN port 8 cli 00095b93459e) Error 2 is seen if Validate is unchecked on the laptop --Error 2-- Sat

EAP-TLS Certificate problems.

Brian vb said: Ca is in trusted root stores under Current User, and client is in Personal under Current User. One thing I see when viewing the certs is the Root has Locker Systems (using a random name to keep the identity of my company out of the certs) as the issuer and the client has SSLeay

Can Session-Timeout be used to force users to re-authenticate?

to have no affect. The user does not re-authenticate at the given interval. Here's my setting from the users file: Jason Wittlin-Cohen Session-Timeout = 1800 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Freeradius is not restarting properly (fails to quit and becomes a zombie process)

Alan DeKok wrote: Jason Wittlin-Cohen [EMAIL PROTECTED] wrote: Over the last few days I've been having a recurring problem. Whenever I start Freeradius either with radiusd in a terminal or as a service in Debian, I can not restart/kill radiusd properly if it's authenticated any

Can Simultaneous-Use be used with EAP-TLS?

I am using EAP-TLS for authentication so I have no use for a backend db to check username/password credentials. However, I would still like to prevent simultaneous logins with the same certificate. Is this possible without having an sql database? I have Simultaneous-Users := 1 set in the users

Re: Why is the default DH keysize only 512 bits?

Alan DeKok wrote: Jason Wittlin-Cohen [EMAIL PROTECTED] wrote: I noticed that the default DH keysize in FreeRadius 1.1.3 is 512 bits. If you're talking about the key length in the EAP-TLS module, it looks like those aren't being used for anything. See the source

Freeradius is not restarting properly (fails to quit and becomes a zombie process)

Over the last few days I've been having a recurring problem. Whenever I start Freeradius either with radiusd in a terminal or as a service in Debian, I can not restart/kill radiusd properly if it's authenticated any clients. Restarting the service says it's successful but the radius log states

Re: Freeradius is not restarting properly (fails to quit and becomes a zombie process)

(1, rad_recv: Access-Request packet ..., 77rad_recv: Access-Request packet from host 192.168.0.1:2054, id=1, length=151 ) = 77 time(NULL) = 1159497421 write(1, \tUser-Name = \Jason Wittlin-Cohe..., 35User-Name = Jason Wittlin-Cohen ) = 35 write(1, \tNAS-IP-Address

Why is the default DH keysize only 512 bits?

in any of the EAP modes. Apparently, if you want to use AES you need to upgrade to Vista (See Security in Vista) or use a 3rd party supplicant like the Funk Odyssey Client which I use (uses TLS_DH_RSA_WITH_AES_256_CBC_SHA with default Freeradius setup). Jason Wittlin-Cohen - List info/subscribe