<html><HEAD><LINK media=all href="static/deg/css/wysiwyg.css" type=text/css rel=stylesheet>
<META content="MSHTML 6.00.2900.3243" name=GENERATOR></HEAD>
<BODY>
<P>The RSA Authentication Server does not take requests from undefined agents. <BR>All Agent Hosts must be defined in the Server's Agent Host list.<BR><BR>However, we are talking about RADIUS requests here, from the RSA Server's point of view, the RADIUS server is the agent host making the request to it via the RSA SecurID APIs. If you look at the RSA Server documentation you will find information on how to define Agent Hosts that happen to be RADIUS servers.</P>
<P>Furthermore, there is a feature in our system that will also extend such "protection" to the NAS'es that originated the RADIUS request. This is a defense in depth to prevent rogue access points and the like. If this feature is enabled, all NASes that generate RSA auth requests must also be defined as Agent Hosts in the RSA Servers db. The originated IP address of the RADIUS request is passed up to RSA server and looked up.</P>
<P>You can turn that feature off at the Agent Host interface between RADIUS and SecurID:<BR>- If using the Windows EAP plugins, its in the RSA Security Center application, Remote EAP Configuration page, Authentication Settings dialog, "Enable RADIUS Client Check" check box.<BR>- If using the RSA RADIUS server, open the securid.ini file and change the setting of CheckUserAllowedByClient=1 to =0 in the [Configuration] section and restart the server. This is documented in the manual.</P>
<P>Dave.<BR><BR>Feb 5, 2008 10:37:46 AM, freeradius-users@lists.freeradius.org wrote:<BR></P>
<BLOCKQUOTE style="BORDER-LEFT: rgb(102,153,204) 3px solid">
<P>Jakub Morávek wrote:<BR>> In RSA terminology "Agent hosts" is host which sends authetication request.<BR>....<BR>> In my case RSA rejects "user1" access, because RSA thikns, that "user1"<BR>> wants to log into "freeradius" and there is no "freeradius" Agent host<BR>> defined in RSA database.<BR><BR> So... you might need to define one.<BR><BR>> My idea is that freeradius does not send Client-IP-Address attribute and<BR>> therefore RSA RADIUS determines that original host is freeradius proxy<BR>> server.<BR><BR> The Client-IP-Address attribute is not sent in a packet. The RADIUS<BR>protocol uses the originating IP address to determine the client.<BR><BR> I would suggest reading the RSA documentation to see how to make it<BR>think that FreeRADIUS is not the originating host. If the documentation<BR>does not define how to do that, it is likely impossible.<BR><BR> Alan DeKok.<BR>-<BR>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<BR></P></BLOCKQUOTE></BODY></html>