August 2007 - Freeradius-Users - lists.freeradius.org

challenge-response
by Frost, Benjamin M. 03 Aug '07

03 Aug '07

Is there any way to implement challenge-response when using the rlm_perl module for authentication? I can't find much information on it. I've tried setting the reply-message and returning 11; but it doesn't seem to do much. Thanks, Ben Confidentiality Notice: This message, and any attachments, may contain information that is confidential, privileged, and/or protected from disclosure under state and federal laws that deal with the privacy and security of medical information. If you received this message in error or through inappropriate means, please reply to this message to notify the Sender that the message was received by you in error, and then permanently delete this message from all storage media, without forwarding or retaining a copy.

1 0

New to Linux
by Mudigonda Chaitanya 03 Aug '07

03 Aug '07

Hi I am using Red hat 9, I am pretty new to Linux field. Can someone suggest me how show I be proceeding so that I can use EAP authentication, for the user connected to my switch. I am very much familiar with the configuration on the switch. It would be helpful if some one can send me a link or doc that could help me to proceed further. Warm Regards Chaitanya Nortel Certified Support Specialist GNTS-Nortel E:mail::mchaitan@nortel.com Working Hours :: 8 - 5 EST Phone :: 800 4NORTEL (667 835) option 1 # ERC then Case number

2 3

Nas Type
by Roberto Greiner 03 Aug '07

03 Aug '07

Hi, I was starting to look at checkrad, and found (based on http://www.freeradius.org/radiusd/doc/Simultaneous-Use) that using "other" as the NAS-type will actually check only radutmp instead of looking at the actual NAS. Now, Could someone point me what would be the proper NAS type to use for each of the devices below(or the proper reference document to use)? I'm using the following NASes in my network: Monowall pfSense (3Com) Total Control PopTop (in Linux) What I want to do is to use checkrad as one of the steps to make sure that whoever appears as logged is really logged in, because I'm trying to use Simultaneous-use check, and some of the above (notably monowall) doesn't seem to be clearing properly sometimes. Thank you very much, Roberto Greiner -- ----------------------------------------------------- Marcos Roberto Greiner The optimists believe we are in the best of worlds The pessimists are afraid that this is true Murphy -----------------------------------------------------

4 7

Re : Linux RADIUS and Active Directory
by Eshun Benjamin 03 Aug '07

03 Aug '07

http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : inelec communication <inelec_communication(a)yahoo.fr> À : freeradius-users(a)lists.freeradius.org Envoyé le : Jeudi, 2 Août 2007, 13h34mn 03s Objet : Linux RADIUS and Active Directory I am trying to setup a Fedora Linux server to authenticate wireless users. I would like to use my AD server to get user information and use the RADIUS just for authentication on the wireless part of our network. Any suggestions or any documment that guide me to do that? best regards Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

Help: How to set VLAN by Tunnel-Private-Group-Id for user or group?
by Hangjun He 03 Aug '07

03 Aug '07

Hi, We use peap + AP + fr + AD to authenticate user. Now It can work. But I need to get VLAN from freeradius for different user or group. How should I do?? Please give me some advice, Thanks. I saw below debug info from maillist, from these info I guess freeradius can set VLAN for user or group. Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1:1645, id=38, length=149 User-Name = "DOMAIN\\testuser" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-19-AA-2C-8F-03" Calling-Station-Id = "00-08-74-46-2A-A5" EAP-Message = 0x0202001601434f5250524f4f545c7467646f72686531 Message-Authenticator = 0x9bc11b6f6182f53f6428ad12c48d8f10 NAS-Port = 50001 NAS-Port-Type = Ethernet NAS-IP-Address = 192.168.1.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_eap: EAP packet type response id 2 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 38 to 192.168.1.1 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "vlanX" EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67c75e29c6b4d8d32c662ce2d154d277 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --------------------------------- 雅虎免费邮箱3.5G容量，20M附件！

2 3

Linux RADIUS and Active Directory
by inelec communication 02 Aug '07

02 Aug '07

I am trying to setup a Fedora Linux server to authenticate wireless users. I would like to use my AD server to get user information and use the RADIUS just for authentication on the wireless part of our network. Any suggestions or any documment that guide me to do that? best regards --------------------------------- Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

RE: Freeradius - MySQL Update problem
by musoket＠mtn.co.ug 02 Aug '07

02 Aug '07

Hi Claudiu, Thanks for your response. Thu, 2 Aug 2007 03:10:24 +0300, you wrote: >How does your INSERT look like? >AFAIK, in logs you get something like > h323-remote-address = "h323-remote-address=re.mo.te.ip" >You should use the %{h323-remote-address} variable That is in fact the variable that I am using in my insert and update statements but it still doesn't work. See below: accounting_update_query_alt = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctSt artTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType,FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{Cisco-NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}','', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{h323-remote-address}', '%{Framed-Protocol}', '%{h323-remote-address}', '0')" It appears twice here because I tried putting it in two different columns. Regards Timothy.

3 2

billing & freeradius
by zahra bahar 02 Aug '07

02 Aug '07

Hi, I want to use freeraidus in billing. what module do this ? how could I do this? Is there any document for using freeradius for billing? thanks --------------------------------- Luggage? GPS? Comic books? Check out fitting gifts for grads at Yahoo! Search.

3 2

how to change reply message.(Password has expired)
by Marwan Sultan 02 Aug '07

02 Aug '07

Hello All, Im on freeradius Latest, and FreeBSD, ChilliSpot. When an account of my users expires, and he tries to log in again, the HotSpotlogin script will reply with a message says "Password Has Expired" How would I change this to "Account has Expired" I guess its somewhere in freeradius, Please correct me if im wrong. Thank you in advance. Marwan _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

2 1

PEAP, switch, FR and MS-AD as user profile and vlan storage
by Hangjun He 01 Aug '07

01 Aug '07

Hi, I would like to know if I can use FreeRADIUS for: PEAP, switch, FR and MS-Active Directory as user profile and vlan storage If so, can someone please shed some light/pointers ? Any info is highly appreciated. Thank you. --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！

2 2