<div dir="ltr">Hi,<div><br></div><div>I am using freeradius v3.0.4 on ubuntu 14.04. </div><div>I tried to send radius request using command "radtest test password localhost 0 testing123"</div><div>I got no reply from server.</div><div>When I checked for open ports I didnot see any ports opened for freeradius.</div><div>What is the command to start freeradius services?</div><div>I tried /etc/init/d/freeradius restart which did not work</div><div><br></div><div><br>Thanks,</div><div>Kavya<br><div><br></div><div><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Oct 1, 2014 at 11:09 AM, <span dir="ltr"><<a href="mailto:freeradius-users-request@lists.freeradius.org" target="_blank">freeradius-users-request@lists.freeradius.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send Freeradius-Users mailing list submissions to<br>
<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://lists.freeradius.org/mailman/listinfo/freeradius-users" target="_blank">http://lists.freeradius.org/mailman/listinfo/freeradius-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:freeradius-users-request@lists.freeradius.org">freeradius-users-request@lists.freeradius.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:freeradius-users-owner@lists.freeradius.org">freeradius-users-owner@lists.freeradius.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Freeradius-Users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. RE: Maximum username length<br>
(Franks Andy (RLZ) IT Systems Engineer)<br>
2. Re: Maximum username length (Alan DeKok)<br>
3. Authentication and Authorization (Alex Gregory)<br>
4. Re: Authentication and Authorization (Nick Owen)<br>
5. Re: Authentication and Authorization (Alex Gregory)<br>
6. Re: Authentication and Authorization (Alan DeKok)<br>
7. EAP-GTC & Yubikey (<a href="mailto:cellkites@hushmail.com">cellkites@hushmail.com</a>)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 30 Sep 2014 15:55:56 +0100<br>
From: "Franks Andy \(RLZ\) IT Systems Engineer"<br>
<<a href="mailto:Andy.Franks@sath.nhs.uk">Andy.Franks@sath.nhs.uk</a>><br>
To: "FreeRadius users mailing list"<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Subject: RE: Maximum username length<br>
Message-ID: <<a href="mailto:20140930145557.4FCC5448906@nhs-pd1e-esg106.ad1.nhs.net">20140930145557.4FCC5448906@nhs-pd1e-esg106.ad1.nhs.net</a>><br>
Content-Type: text/plain; charset="UTF-8"<br>
<br>
They should make a movie..<br>
<br>
So you're suggesting I reprogram pfsense then? I'll have to inform the boss it's going to take a bit longer!<br>
<br>
Anyway, point taken, I'll have to see what this entails. The string was looking to be pretty long anyway.<br>
:-)<br>
<br>
<br>
<br>
-----Original Message-----<br>
From: freeradius-users-bounces+andy.franks=<a href="mailto:sath.nhs.uk@lists.freeradius.org">sath.nhs.uk@lists.freeradius.org</a> [mailto:<a href="mailto:freeradius-users-bounces%2Bandy.franks">freeradius-users-bounces+andy.franks</a>=<a href="mailto:sath.nhs.uk@lists.freeradius.org">sath.nhs.uk@lists.freeradius.org</a>] On Behalf Of Alan DeKok<br>
Sent: 30 September 2014 14:03<br>
To: FreeRadius users mailing list<br>
Subject: Re: Maximum username length<br>
<br>
Franks Andy (RLZ) IT Systems Engineer wrote:<br>
> We?re going to attempt to pass a number of delimited variables<br>
> through via the username field<br>
<br>
Dear god no. This is a *terrible* idea. It will cause global warming, rickets, plagues, alien invasions, and help bring on the coming apocalypse.<br>
<br>
> and split them at the freeradius end, mostly to avoid rewriting the<br>
> php in the captive portal to use more orthodox existing attributes.<br>
<br>
There's no good reason to push crap onto someone else. Your laziness just makes life harder for everyone else.<br>
<br>
If you care about your users, *don't* do this.<br>
<br>
> Can someone confirm the maximum username field length? I can see in<br>
> the RFCs that 63 is the recommended minimum nas length but there?s not<br>
> much else I can see in there.<br>
<br>
A lot of equipment and systems won't handle more than 63 characters.<br>
<br>
This is a terrible, evil, disgusting idea. RADIUS is full of enough crap already without people deliberately adding more.<br>
<br>
Alan DeKok.<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Tue, 30 Sep 2014 11:36:39 -0400<br>
From: Alan DeKok <<a href="mailto:aland@deployingradius.com">aland@deployingradius.com</a>><br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Subject: Re: Maximum username length<br>
Message-ID: <<a href="mailto:542ACE07.9050601@deployingradius.com">542ACE07.9050601@deployingradius.com</a>><br>
Content-Type: text/plain; charset=UTF-8<br>
<br>
Franks Andy (RLZ) IT Systems Engineer wrote:<br>
> So you're suggesting I reprogram pfsense then? I'll have to inform the boss it's going to take a bit longer!<br>
<br>
You can fix pfsense once, or thousands of administrators can curse<br>
your name while they try to "fix" their RADIUS server so that it works<br>
with a non-standard username.<br>
<br>
That's a lot of negative karma.<br>
<br>
Alan DeKok.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Tue, 30 Sep 2014 19:18:20 +0000<br>
From: Alex Gregory <<a href="mailto:alex@c2company.com">alex@c2company.com</a>><br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Subject: Authentication and Authorization<br>
Message-ID: <<a href="mailto:7A1FE1A4-0B02-4D9E-AB1A-B80D64AF82D3@c2company.com">7A1FE1A4-0B02-4D9E-AB1A-B80D64AF82D3@c2company.com</a>><br>
Content-Type: text/plain; charset="us-ascii"<br>
<br>
Hello-<br>
<br>
If I have both LDAP and Proxy configured will FreeRadius use both? What I am looking for is the FreeRadius server authorize a user in LDAP and if that passes forward the user to the upstream OTP radius server (via proxy.conf) for authentication. I believe its doing this now with the LDAP module, just authenticating locally, rather than proxied.<br>
<br>
Is this possible?<br>
<br>
Thanks,<br>
<br>
Alex<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Tue, 30 Sep 2014 17:02:20 -0400<br>
From: Nick Owen <<a href="mailto:owen.nick@gmail.com">owen.nick@gmail.com</a>><br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Subject: Re: Authentication and Authorization<br>
Message-ID:<br>
<<a href="mailto:CAJC4Zap-F3xJHhJPXjx9vRZoC6-4EHOaafv4wummZpRTdGi9gQ@mail.gmail.com">CAJC4Zap-F3xJHhJPXjx9vRZoC6-4EHOaafv4wummZpRTdGi9gQ@mail.gmail.com</a>><br>
Content-Type: text/plain; charset=UTF-8<br>
<br>
Yes, see this tutorial:<br>
<a href="https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-openldap-and-freeradius" target="_blank">https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-openldap-and-freeradius</a>.<br>
Note that you login with the username and OTP. No ldap password is<br>
needed.<br>
<br>
HTH,<br>
<br>
Nick<br>
<br>
On Tue, Sep 30, 2014 at 3:18 PM, Alex Gregory <<a href="mailto:alex@c2company.com">alex@c2company.com</a>> wrote:<br>
> Hello-<br>
><br>
> If I have both LDAP and Proxy configured will FreeRadius use both? What I am looking for is the FreeRadius server authorize a user in LDAP and if that passes forward the user to the upstream OTP radius server (via proxy.conf) for authentication. I believe its doing this now with the LDAP module, just authenticating locally, rather than proxied.<br>
><br>
> Is this possible?<br>
><br>
> Thanks,<br>
><br>
> Alex<br>
><br>
> -<br>
> List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
<br>
<br>
<br>
--<br>
--<br>
Nick Owen<br>
WiKID Systems, Inc.<br>
<a href="http://www.wikidsystems.com" target="_blank">http://www.wikidsystems.com</a><br>
Commercial/Open Source Two-Factor Authentication<br>
<br>
<br>
------------------------------<br>
<br>
Message: 5<br>
Date: Tue, 30 Sep 2014 22:49:00 +0000<br>
From: Alex Gregory <<a href="mailto:alex@c2company.com">alex@c2company.com</a>><br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Subject: Re: Authentication and Authorization<br>
Message-ID: <<a href="mailto:BCBCCE17-2331-4F9E-B664-D66FF01473DA@c2company.com">BCBCCE17-2331-4F9E-B664-D66FF01473DA@c2company.com</a>><br>
Content-Type: text/plain; charset="us-ascii"<br>
<br>
Thank you for the link. I have the OTP working on a test server now with proxying. The problem is the hosted OTP server does not supply any group or attribute information back yet like this Wikid server does. But I have two different user groups for two different networks (Corp and Dev users) that need to be differentiated.<br>
<br>
In production have two virtual radius servers each doing an LDAP lookup into a different group. If a user tries to access the incorrect network they are denied because they are not in that group. Works great. If I alter the server to proxy the request with the LDAP module configured will it handle things properly?<br>
<br>
Thanks,<br>
<br>
Alex<br>
<br>
<br>
<br>
On Sep 30, 2014, at 2:02 PM, Nick Owen <<a href="mailto:owen.nick@gmail.com">owen.nick@gmail.com</a>> wrote:<br>
<br>
> Yes, see this tutorial:<br>
> <a href="https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-openldap-and-freeradius" target="_blank">https://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-openldap-and-freeradius</a>.<br>
> Note that you login with the username and OTP. No ldap password is<br>
> needed.<br>
><br>
> HTH,<br>
><br>
> Nick<br>
><br>
> On Tue, Sep 30, 2014 at 3:18 PM, Alex Gregory <<a href="mailto:alex@c2company.com">alex@c2company.com</a>> wrote:<br>
>> Hello-<br>
>><br>
>> If I have both LDAP and Proxy configured will FreeRadius use both? What I am looking for is the FreeRadius server authorize a user in LDAP and if that passes forward the user to the upstream OTP radius server (via proxy.conf) for authentication. I believe its doing this now with the LDAP module, just authenticating locally, rather than proxied.<br>
>><br>
>> Is this possible?<br>
>><br>
>> Thanks,<br>
>><br>
>> Alex<br>
>><br>
>> -<br>
>> List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
><br>
><br>
><br>
> --<br>
> --<br>
> Nick Owen<br>
> WiKID Systems, Inc.<br>
> <a href="http://www.wikidsystems.com" target="_blank">http://www.wikidsystems.com</a><br>
> Commercial/Open Source Two-Factor Authentication<br>
> -<br>
> List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 6<br>
Date: Tue, 30 Sep 2014 21:26:56 -0400<br>
From: Alan DeKok <<a href="mailto:aland@deployingradius.com">aland@deployingradius.com</a>><br>
To: FreeRadius users mailing list<br>
<<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Subject: Re: Authentication and Authorization<br>
Message-ID: <<a href="mailto:542B5860.5010803@deployingradius.com">542B5860.5010803@deployingradius.com</a>><br>
Content-Type: text/plain; charset=ISO-8859-1<br>
<br>
Alex Gregory wrote:<br>
> Thank you for the link. I have the OTP working on a test server now with proxying. The problem is the hosted OTP server does not supply any group or attribute information back yet like this Wikid server does.<br>
<br>
There are no standard RADIUS attributes which carry that information.<br>
If you need it, the OTP server may not even be able to send that<br>
information in RADIUS.<br>
<br>
> But I have two different user groups for two different networks (Corp and Dev users) that need to be differentiated.<br>
><br>
> In production have two virtual radius servers each doing an LDAP lookup into a different group. If a user tries to access the incorrect network they are denied because they are not in that group. Works great. If I alter the server to proxy the request with the LDAP module configured will it handle things properly?<br>
<br>
LDAP lookups are completely independent of proxying.<br>
<br>
If configured correctly, it should work.<br>
<br>
Alan DeKok.<br>
<br>
<br>
------------------------------<br>
<br>
Message: 7<br>
Date: Wed, 01 Oct 2014 13:39:23 +0800<br>
From: <a href="mailto:cellkites@hushmail.com">cellkites@hushmail.com</a><br>
To: <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br>
Subject: EAP-GTC & Yubikey<br>
Message-ID: <<a href="mailto:20141001053923.E3D29C0105@smtp.hushmail.com">20141001053923.E3D29C0105@smtp.hushmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
I've been attempting to integrate yubikeys with freeradius and have<br>
had great success with the included yubikey module authenticating<br>
against both stored aes keys and a private otp validation server.<br>
However I am now attempting to use them in conjunction with EAP-GTC<br>
and am slightly lost.<br>
<br>
Under the gtc section of the eap module config i see that a user<br>
password is returned from the connecting client and passed onto<br>
another module for authentication. Is it possible to then pass this to<br>
the yubikey module to extract the otp portion, authenticate the otp<br>
and then continue with PAP authentication using the users password?<br>
<br>
Is there another way i should be going about this?<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.freeradius.org/pipermail/freeradius-users/attachments/20141001/cc61eb8c/attachment.html" target="_blank">http://lists.freeradius.org/pipermail/freeradius-users/attachments/20141001/cc61eb8c/attachment.html</a>><br>
<br>
------------------------------<br>
<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
<br>
End of Freeradius-Users Digest, Vol 114, Issue 1<br>
************************************************<br>
</blockquote></div><br></div>