September 2005 - Freeradius-Users - lists.freeradius.org

Cisco Privilege Level
by Ryan Sharpe 20 Sep '05

20 Sep '05

I finally figured it out. I apologize for my own stupidity. It was a syntax error > CiscoAVPair = "shell:priv-lvl=2" Should be cisco-avpair = "shell:priv-lvl2" -- Ryan Sharpe Junior Technical Analyst LARG*net (519) 661-2111 x86356 http://www.largnet.on.ca

1 0

default ip pools
by Ezequiel O. Block 20 Sep '05

20 Sep '05

Hi Folks, I'm trying to set up default ip pools and it is not working, if i set "Pool-Name :=" to any of the pools defined on radiusd.conf then it does work, but if i set Pool-Name := DEFAULT then the server doesn't send Framed-Ip-Address as expected. I did some searches on this list and found some posts where the "default" feature were not available on earlier versions of FreeRadius. I'm working in freeradius-1.0.5 compiled from sources, does this version have this feature? Any clue? These lines are from radiusd.conf ... ippool tasa1 { range-start = a.b.c.30 range-stop = a.b.c.40 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/dbtasa1.ippool ip-index = ${raddbdir}/dbtasa1.ipindex override = no maximum-timeout = 0 } ippool teco1 { range-start = a.b.d.150 range-stop = a.b.d.160 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/dbteco1.ippool ip-index = ${raddbdir}/dbteco1.ipindex override = no maximum-timeout = 0 } Thanks in advance. Ezequiel. Cooperativa La Lonja.

1 0

ntlm_auth multiple domains
by Jamie Crawford 20 Sep '05

20 Sep '05

Hi, I'm using ntlm_auth to authenticate users in freeradius. My samba server is joined to DOMAINA. When I run ntlm_auth --username=domainauser everything works great. When I run ntlm_auth --username=domainbuser it fails because the user does not exist in domaina which the server is joined to. If I run ntlm_auth --username=domainbuser --domain=domainb it works great. I was wanting to do ntlm_auth --domain=domaina --domain=domainb --username=domainbuser, it works only because the second domain variable is domainb. If I were to use a domainauser, it would fail. Would setting up realms help? How can I tell freeradius to use ntlm_auth --domain=domaina on domaina users and ntlm_auth --domain=domainb on domainb users? Any ideas??? tia, jamie Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU

2 1

Transmitted packet
by Iandc Davies 20 Sep '05

20 Sep '05

All, The contents of the transmitted packet include an uint8_t *data. What exactly is this pointing to ? The radius.c code sems to check it the first time round against NULL ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

Radius PEAP protocol
by Juan Daniel Moreno 20 Sep '05

20 Sep '05

Hi everyone, I am trying to create a client's interface for Radius PEAP protocol. The server has donne all I wonder it to do, but now I have a question about the finish handshake message I have to send. When I get the server's cetificate, I get a public key too. I have to "public-key-encrypt" a PreMasterSecret that is a vector of 46 random bytes and the tls version (1.0). My question is how can I do that. Am I obliged to get the ssl libraries to "public-key-encrypt" this packet? Thank you for any complemetary information. Juan Daniel MORENO

2 1

Multiple LDAPS
by S�bastien Cantos 20 Sep '05

20 Sep '05

Hi, I was wondering if there's a way to look for users in differents LDAP trees and/or servers depending of the suffix (@something) in the login. If it's possible could someone show me the config ? Thanks in advance. Regards, -- Sebastien Cantos <scantos(a)technodiva.com> Network / System Manager Neopost DIVA

2 2

RE: Transmitted packet
by Jonathan De Graeve 20 Sep '05

20 Sep '05

Actie voltooid. Wordt naar zowel Wendy als kathleen gestuurd. J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Iandc Davies Verzonden: dinsdag 20 september 2005 15:05 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Transmitted packet All, The contents of the transmitted packet include an uint8_t *data. What exactly is this pointing to ? The radius.c code sems to check it the first time round against NULL ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: 12077 error???
by King, Michael 20 Sep '05

20 Sep '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > Behalf Of Armin Krämer > > Hi, I set up freeradius with eap-tls and after I generated my > certificates with TinnyCA and configured it in eap.conf File > I get this error message...Does anyone knows what causes this error? > Thanks Armin > > debian:~# freeradius -X -A Did you install FreeRadius via Apt (aptitude) or compile from source?

3 2

Hashed passwords in the users file???
by Miguel Angel Quiles 20 Sep '05

20 Sep '05

Hi, does someone know how to use hashed passwords for the users entries in the users file????? I hope someone can help me.

1 0

RE: Nortel Networks Passport 8600 + Radius AAA
by Jonathan De Graeve 20 Sep '05

20 Sep '05

There were bugs in that release. Upgrade to 3.5.10.0 J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- ________________________________ Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Inci Gedik Verzonden: dinsdag 20 september 2005 10:53 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Nortel Networks Passport 8600 + Radius AAA Hi Everyone, I have the same problem. Could someone send me the correct configuration Radiusd.conf , users, clients.conf or if it is necessary dictionary files? Thanks Inci Gedik ------------------------------------------------------------------------ -- I am in the testing phase using Nortel 8600's (8010 is the chassis), No dictionary needed. I have had no problems. but I am also using 3.5 code. maybe trying the current version of code might help. Just a thought >>> ettan(a)online.no 1/15/2004 9:01:32 AM >>> Hi We have just bought a few Nortel Passport 8010, and I like to use freeradius to authenticate the user that want to log on to configure this switches. I can se the Radius server is sending Access-Accept back to the switch, but I don't get any login prompt, but ask me again about login name. Have someone got this to work or have any hints for me ? I can't find any dictionary for Nortel, do I need that ? users file: jon Auth-Type := local, User-Password == "jon",Huntgroup-Name == "pp8600" Service-Type = Login-User, Fall-Through = NO debuging from radiusd -X: modcall: group authorize returns ok rad_check_password: Found Auth-Type local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 23 to 10.10.9.51:1051 Service-Type = Login-User Finished request 0 Going to the next request The PP8610 config,Software Release 3.2.3.0 configuration: LAB_550:5/config/radius/server# enable true LAB_550:5/config/radius/server# create 10.10.1.2 secret test LAB_550:5/config/radius/server# set 10.10.1.2 secret test - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----------------------------------------------------- This message is intended only for certain recipients and may be privileged or confidential. If you have received it in error, please notify sender and delete it without making or retaining a copy. ----------------------------------------------------- <<<<*P*H*L*>>>>

2 1