<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
<div>Hi</div><div><br></div><div> I am using freeradius version 2.1.4 and I want to set up config to eap TTLS using users and clients file but didnt work.Please help me.Thanks.</div><div><br></div><div><br></div><div><br></div><div>***************OUTPUT************************************</div><div>Finished request 18.</div><div>Going to the next request</div><div>Waking up in 2.0 seconds.</div><div>Cleaning up request 17 ID 18 with timestamp +75</div><div>Waking up in 2.9 seconds.</div><div>rad_recv: Access-Request packet from host 10.1.1.252 port 1206, id=20, length=183</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "deneme"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 10.1.1.252</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Called-Station-Id = "00-30-4F-44-3D-C1"</div><div><sp!
an class="Apple-tab-span" style="white-space:pre"> </span>Calling-Station-Id = "00-18-DE-88-62-77"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Identifier = "WirelessAccessPoint"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Framed-MTU = 1380</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port-Type = Wireless-802.11</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>EAP-Message = 0x0211002219001703010017a5491ed47f0de82246939132f8766cf3c1a85f8c211be5</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>State = 0x56c2eb4850d3f233efbb27b16d1adb57</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x1ea576935b901d2c1f156615504ed0da</div><div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>++[chap] returns noop</div><div>++[mschap] returns noop</div><div>[suffix] No '@' in User-Name = !
"deneme", looking up realm NULL</div><div>[suffix] No such realm "NULL
"</div><div>++[suffix] returns noop</div><div>[eap] EAP packet type response id 17 length 34</div><div>[eap] Continuing tunnel setup.</div><div>++[eap] returns ok</div><div>Found Auth-Type = EAP</div><div>+- entering group authenticate {...}</div><div>[eap] Request found, released from the list</div><div>[eap] EAP/peap</div><div>[eap] processing type peap</div><div>[peap] processing EAP-TLS</div><div>[peap] eaptls_verify returned 7 </div><div>[peap] Done initial handshake</div><div>[peap] eaptls_process returned 7 </div><div>[peap] EAPTLS_OK</div><div>[peap] Session established. Decoding tunneled attributes.</div><div>[peap] Identity - deneme</div><div>[peap] Got tunneled request</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>EAP-Message = 0x0211000b0164656e656d65</div><div>server {</div><div> PEAP: Got tunneled identity of deneme</div><div> PEAP: Setting default EAP type for tunneled EAP session.</div><div>!
PEAP: Setting User-Name to deneme</div><div>Sending tunneled request</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>EAP-Message = 0x0211000b0164656e656d65</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>FreeRADIUS-Proxied-To = 127.0.0.1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "deneme"</div><div>server inner-tunnel {</div><div>No authenticate method (Auth-Type) configuration found for the request: Rejecting the user</div><div>Failed to authenticate the user.</div><div>} # server inner-tunnel</div><div>[peap] Got tunneled reply code 3</div><div>[peap] Got tunneled reply RADIUS code 3</div><div>[peap] Tunneled authentication was rejected.</div><div>[peap] FAILURE</div><div>++[eap] returns handled</div><div>Sending Access-Challenge of id 20 to 10.1.1.252 port 1206</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>EAP-Message = 0x011200261900170301001b3f825a!
ee84e1fd23b0089c976f25f2f4054e5c93627e072882688f</div><div><span class
="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x00000000000000000000000000000000</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>State = 0x56c2eb4851d0f233efbb27b16d1adb57</div><div>Finished request 19.</div><div>Going to the next request</div><div>Waking up in 1.9 seconds.</div><div>Cleaning up request 18 ID 19 with timestamp +78</div><div>Waking up in 2.9 seconds.</div><div>rad_recv: Access-Request packet from host 10.1.1.252 port 1206, id=21, length=187</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "deneme"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 10.1.1.252</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Called-Station-Id = "00-30-4F-44-3D-C1"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Calling-Station-Id =!
"00-18-DE-88-62-77"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Identifier = "WirelessAccessPoint"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Framed-MTU = 1380</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port-Type = Wireless-802.11</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>EAP-Message = 0x021200261900170301001bd0f786fe5ec27d325f117cb1c6314a2fc09664e18d31038aaa2a5f</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>State = 0x56c2eb4851d0f233efbb27b16d1adb57</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0xe4dd7f51a3fd9548338084267728d316</div><div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>++[chap] returns noop</div><div>++[mschap] returns noop</div><div>[suffix] No '@' in User-Name = "deneme", looking up realm NULL</div><div>[suffix] No such realm "NULL!
"</div><div>++[suffix] returns noop</div><div>[eap] EAP packet type re
sponse id 18 length 38</div><div>[eap] Continuing tunnel setup.</div><div>++[eap] returns ok</div><div>Found Auth-Type = EAP</div><div>+- entering group authenticate {...}</div><div>[eap] Request found, released from the list</div><div>[eap] EAP/peap</div><div>[eap] processing type peap</div><div>[peap] processing EAP-TLS</div><div>[peap] eaptls_verify returned 7 </div><div>[peap] Done initial handshake</div><div>[peap] eaptls_process returned 7 </div><div>[peap] EAPTLS_OK</div><div>[peap] Session established. Decoding tunneled attributes.</div><div>[peap] Received EAP-TLV response.</div><div>[peap] Had sent TLV failure. User was rejected earlier in this session.</div><div>[eap] Handler failed in EAP/peap</div><div>[eap] Failed in EAP select</div><div>++[eap] returns invalid</div><div>Failed to authenticate the user.</div><div>Using Post-Auth-Type Reject</div><div>+- entering group REJECT {...}</div><div>[attr_filter.access_reject] <span class="Ap!
ple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> deneme</div><div> attr_filter: Matched entry DEFAULT at line 11</div><div>++[attr_filter.access_reject] returns updated</div><div>Delaying reject of request 20 for 1 seconds</div><div>Going to the next request</div><div>Waking up in 0.9 seconds.</div><div>Sending delayed reject for request 20</div><div>Sending Access-Reject of id 21 to 10.1.1.252 port 1206</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>EAP-Message = 0x04120004</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Message-Authenticator = 0x00000000000000000000000000000000</div><div>Waking up in 0.9 seconds.</div><div>Cleaning up request 19 ID 20 with timestamp +81</div><div>Waking up in 3.9 seconds.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>************EAP.conf********************</div><div># -*- text -*-</div><div>##</div><div>## eap.conf -- !
Configuration for EAP types (PEAP, TTLS, etc.)</div><div>##</div><div>
##<span class="Apple-tab-span" style="white-space:pre"> </span>$Id$</div><div><br></div><div>#######################################################################</div><div>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>eap {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>default_eap_type = ttls</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># A list is maintained to correlate EAP-Response</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># packets with EAP-Request packets. After a</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># configurable length of time, entries in the list</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># expire, and are deleted.</div><div><span class="Apple-tab-span" style="white-space:pre!
"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>timer_expire = 60</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ignore_unknown_eap_types = no</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># a User-Name attribute in an Access-Accept, it copies one</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># more byte than it should.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># We can work around it by configurably adding an extra</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># zero byte.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>cisco_accoun!
ting_username_bug = no</div><div><br></div><div><span class="Apple-tab
-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Help prevent DoS attacks by limiting the number of</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># sessions that the server is tracking. Most systems</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># can handle ~30 EAP sessions/s, so the default limit</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># of 2048 is more than enough.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>max_sessions = 2048</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Supported EAP-types</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># We do NOT recommend using EAP-MD5 authentication</div><div><span cla!
ss="Apple-tab-span" style="white-space:pre"> </span># for wireless connections. It is insecure, and does</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># not provide for dynamic WEP keys.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>md5 {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Cisco LEAP</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leap {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Generic Token Card.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>gtc {</div><div>!
<span class="Apple-tab-span" style="white-space:pre"> </span>#  
;The default challenge, which many clients</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># ignore..</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#challenge = "Password: "</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auth_type = PAP</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>## EAP-TLS</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># See raddb/certs/README for additional comments</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># on certificates.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># http://www.dslreports.com/forum/remark,9286052~mode=flat</div><div><span class="Apple-tab-span" style="!
white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>tls {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># These is used to simplify later configurations.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>certdir = ${confdir}/certs</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>cadir = ${confdir}/certs</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>private_key_password = 123456</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>private_key_file = ${certdir}/server.pem</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>certificate_file = ${certdir}/server.pem</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>C!
A_file = ${cadir}/ca.pem</div><div><span class="Apple-tab-span" style=
"white-space:pre"> </span>dh_file = ${certdir}/dh</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>random_file = ${certdir}/random</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#<span class="Apple-tab-span" style="white-space:pre"> </span>fragment_size = 1024</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#<span class="Apple-tab-span" style="white-space:pre"> </span>include_length = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#<span class="Apple-tab-span" style="white-space:pre"> </span>check_crl = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#<span class="Apple-tab-span" style="whit!
e-space:pre"> </span>check_cert_cn = %{User-Name}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>cipher_list = "DEFAULT"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#<span class="Apple-tab-span" style="white-space:pre"> </span>make_cert_command = "${certdir}/bootstrap"</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>cache {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # Enable it. The default is "no".</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # Deleting the entire "cache" subsection</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # Also disables c!
aching.</div><div><span class="Apple-tab-span" style="white-space:pre"
> </span> #</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # You can disallow resumption for a</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # particular user by adding the following</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # attribute to the control item list:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #<span class="Apple-tab-span" style="white-space:pre"> </span>Allow-Session-Resumption = No</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # If "enable = no" below, you CANNOT</div><div><span class="!
Apple-tab-span" style="white-space:pre"> </span> # enable resumption for just one user</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # by setting the above attribute to "yes".</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> enable = no</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # Lifetime of the cached entries, in hours.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # The sessions will be deleted after this</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # time.</div><div><span class="!
Apple-tab-span" style="white-space:pre"> </span>  
;#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> lifetime = 24 # hours</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # The maximum number of entries in the</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # cache. Set to "0" for "infinite".</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # This could be set to the number of users</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> # who are logged in... which can be a LOT.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> #<!
/div><div><span class="Apple-tab-span" style="white-space:pre"> </span> max_entries = 255</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ttls {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># The tunneled EAP session needs a default</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># EAP type which is separate from the one for</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># the non-tunneled EAP module. Inside of the</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># TTLS tunnel, we recommend using EAP-MD5.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># If the request does not contain an EAP</div><div><spa!
n class="Apple-tab-span" style="white-space:pre"> </span># con
versation, then this configuration entry</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># is ignored.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>default_eap_type = md5</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># allowed values: {no, yes}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>copy_request_to_tunnel = no</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># allowed values: {no, yes}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>use_tunneled_reply = no</div><div><br></div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>virtual_server = "inner-tunnel"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>peap {</div><div><span class="App!
le-tab-span" style="white-space:pre"> </span># The tunneled EAP session needs a default</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># EAP type which is separate from the one for</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># the non-tunneled EAP module. Inside of the</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># PEAP tunnel, we recommend using MS-CHAPv2,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># as that is the default type supported by</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Windows clients.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>default_eap_type = mschapv2</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># the PEAP module also has these configuration</div><div><span class="Apple-tab-span" style="white!
-space:pre"> </span># items, which are the same as for TTLS.</
div><div><span class="Apple-tab-span" style="white-space:pre"> </span>copy_request_to_tunnel = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>use_tunneled_reply = no</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># When the tunneled session is proxied, the</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># home server may not understand EAP-MSCHAP-V2.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Set this entry to "no" to proxy the tunneled</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># EAP-MSCHAP-V2 as normal MSCHAPv2.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#<span class="Apple-tab-span" style="white-space:pre"> </span>proxy_tunneled_request_as_eap = yes</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>virtual_server = "inner-tunn!
el"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mschapv2 {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><br></div><div><br></div><div>***************** inner-tunnel ***********</div><div># -*- text -*-</div><div>######################################################################</div><div>#</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>This is a virtual server that handles *only* inner tunnel</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>requests for EAP-TTLS and PEAP types.</div><div>#</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>$Id$</div><div>#</div><div>######################################################################</div><div><br></div><div>se!
rver inner-tunnel {</div><div>authorize {</div><div><span class="Apple
-tab-span" style="white-space:pre"> </span>suffix</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>unix</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>update control {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> Proxy-To-Realm := LOCAL</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>eap {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ok = return</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>files</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>pap</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>chap</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mschap</div><div>#<span class="Apple-tab-span" style!
="white-space:pre"> </span>IPASS</div><div><br></div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>ntdomain</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># See "Authorization Queries" in sql.conf</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>sql</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># If you are using /etc/smbpasswd, and are also doing</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># mschap authentication, the un-comment this line, and</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># configure the 'etc_smbpasswd' module, above.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>etc_smbpasswd</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#<!
/div><div><span class="Apple-tab-span" style="white-space:pre"> </span
># The ldap module will set Auth-Type to LDAP if it has not</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># already been set</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>ldap</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Enforce daily limits on time spent logged in.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>daily</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Use the checkval module</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>checkval</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>expiration</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>logintime</div><div>}</di!
v><div><br></div><div><br></div><div># Authentication.</div><div>authenticate {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># PAP authentication, when a back-end database listed</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># in the 'authorize' section supplies a password. The</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># password can be clear-text, or encrypted.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type PAP {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>pap</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Most people want CHAP authentication<!
/div><div><span class="Apple-tab-span" style="white-space:pre"> </span
># A back-end database listed in the 'authorize' section</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># MUST supply a CLEAR TEXT password. Encrypted passwords</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># won't work.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type CHAP {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>chap</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># MSCHAP authentication.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type MS-CHAP {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mschap</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div!
><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Pluggable Authentication Modules.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>pam</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># See 'man getpwent' for information on how the 'unix'</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># module checks the users password. Note that packets</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># containing CHAP-Password attributes CANNOT be authenticated</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># against /etc/passwd! See the FAQ for details.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># </div><div><span class="Apple!
-tab-span" style="white-space:pre"> </span>#unix</div><div><br></div><
div><span class="Apple-tab-span" style="white-space:pre"> </span># Uncomment it if you want to use ldap for authentication</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Note that this means "check plain-text password against</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># the ldap database", which means that EAP won't work,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># as it does not supply a plain-text password.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type LDAP {</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>ldap</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Allow EAP au!
thentication.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>eap</div><div>}</div><div><br></div><div>######################################################################</div><div>#</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>There are no accounting requests inside of EAP-TTLS or PEAP</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>tunnels.</div><div>#</div><div>######################################################################</div><div><br></div><div><br></div><div># Session database, used for checking Simultaneous-Use. Either the radutmp </div><div># or rlm_sql module can handle this.</div><div># The rlm_sql module is *much* faster</div><div>session {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>radutmp</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-!
space:pre"> </span># See "Simultaneous Use Checking Queries" in
sql.conf</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>sql</div><div>}</div><div><br></div><div><br></div><div># Post-Authentication</div><div># Once we KNOW that the user has been authenticated, there are</div><div># additional steps we can take.</div><div>post-auth {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Note that we do NOT assign IP addresses here.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># If you try to assign IP addresses for EAP authentication types,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># it WILL NOT WORK. You MUST use DHCP.</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># If you want to have a log of authentication replies,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># un-c!
omment the following line, and the 'detail reply_log'</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># section, above.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>reply_log</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># After authenticating the user, do another SQL query.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># See "Authentication Logging Queries" in sql.conf</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>sql</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Instead of sending the query to the SQL server,</div><div><span class="Apple-tab-span" style="!
white-space:pre"> </span># write it into a log file.</div><div><
span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>sql_log</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Un-comment the following if you have set</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># 'edir_account_policy_check = yes' in the ldap module sub-section of</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># the 'modules' section.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>ldap</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Access-Reject packets are sent through the REJECT sub-section of the</div!
><div><span class="Apple-tab-span" style="white-space:pre"> </span># post-auth section.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Add the ldap module name (or instance) if you have set </div><div><span class="Apple-tab-span" style="white-space:pre"> </span># 'edir_account_policy_check = yes' in the ldap module configuration</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Post-Auth-Type REJECT {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>attr_filter.access_reject</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div>}</div><div><br></div><div>#</div><div># When the server decides to proxy a request to a home server,</div><div># the proxied request is first passed through t!
he pre-proxy</div><div># stage. This stage can re-write th
e request, or decide to</div><div># cancel the proxy.</div><div>#</div><div># Only a few modules currently have this method.</div><div>#</div><div>pre-proxy {</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>attr_rewrite</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Uncomment the following line if you want to change attributes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># as defined in the preproxy_users file.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>files</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Uncomment the following line if you want to filter requests</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># sent to remote servers based on the rules defined in the</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># 'attrs.pre-p!
roxy' file.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>attr_filter.pre-proxy</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># If you want to have a log of packets proxied to a home</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># server, un-comment the following line, and the</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># 'detail pre_proxy_log' section, above.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>pre_proxy_log</div><div>}</div><div><br></div><div>#</div><div># When the server receives a reply to a request it proxied</div><div># to a home server, the request may be massaged here, in the</div><div># post-proxy stage.</div><div>#</div><div>post-proxy {</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># If you want to have a log of replies from a home!
server,</div><div><span class="Apple-tab-span" style="white-space:pre
"> </span># un-comment the following line, and the 'detail post_proxy_log'</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># section, above.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>post_proxy_log</div><div><br></div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>attr_rewrite</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span># Uncomment the following line if you want to filter replies from</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># remote proxies based on the rules defined in the 'attrs' file.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>attr_filter.post-proxy</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># If you are proxying LEAP, you MUST configure the EAP</div><div><s!
pan class="Apple-tab-span" style="white-space:pre"> </span># module, and you MUST list it here, in the post-proxy</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># stage.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># You MUST also use the 'nostrip' option in the 'realm'</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># configuration. Otherwise, the User-Name attribute</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># in the proxied request will not match the user name</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># hidden inside of the EAP packet, and the end server will</div><div><span class="Apple-tab-span" style="white-space:pre"> </span># reject the EAP request.</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>!
#</div><div><span class="Apple-tab-span" style="white-space:pre"> </sp
an>eap</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>#</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>Post-Proxy-Type Fail {</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>detail</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div><br></div><div>}</div><div><br></div><div>} # inner-tunnel server block</div> <br /><hr />Windows Live Hotmail: <a href='http://www.microsoft.com/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:tr-tr:SI_SB_4:092009' target='_new'>Arkadaşlarınız Facebook'taki güncellemelerinizi doğrudan Hotmail®'den görür.</a></body>
</html>