April 2008 - Freeradius-Users - lists.freeradius.org

Strategy Advice
by Sturgis, Grant 04 May '08

04 May '08

Greetings list, Brand new freeradius user here, I will try not to be too obnoxious with silly questions. My goal is to replace the Cisco ACS solution with Freeradius, including: 1. Shell (telnet/ssh) access to network switches/routers/firewalls 2. EAP-TLS to the wireless network 3. Potentially 802.1x auth to wired network ports I would like to use our network directory (W2K3 AD) user accounts for all of the above. And I would also like to be able to restrict based on group membership - so that only members of the "Cisco_Admin" group can log into switches and only members of the "wireless" group can authenticate to the WAPs. My questions is: Would it be wiser to pursue the mschap / ntml_auth / winbind module solution or the ldap module solution? I am guessing that this has been done in the past, right? Does anyone have any anecdotes that would be helpful? Thanks in advance, Grant ----------------- Pardon this rubbish: This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

6 7

Discard duplicate requests if received within a specified period
by rsg 02 May '08

02 May '08

Hi, I would like to discard duplicate Auth requests based on certain attributes other than the NAS-IP-Address (e.g. Calling-Station-Id, Pool-Name). For example if there are two requests originating from 2 NASes which corresponds to a particular client, I would like to discard the second request if it is received during a threshold time value (eg. 15 seconds) Specially I find that when using SQL for authorization this situation occurs as it takes a while to perform authorization using SQL. Thanks for your guidance, rg

4 13

HOWTO PEAP + FreeRadius + XP Client
by George KNIGHT 02 May '08

02 May '08

Hello everyone, Before I write my question here, I just want to let all of you know that I did lots of searching in both google and this email list. But couldn't find anything to get the answer. My question is I have been looking for a HOWTO paper for a beginner to set freeradius as an AAA server in a wireless environment to Windows XP SP2 clients. I will use Windows' own PEAP client. Is there such a paper someone can give me the link? I'm very frustrated to find out that there is no information available for a setup from the scratch. I wrote papers like that before for various topics such as subversion implementation for a multiple OS environment, VoIP implementation with a Linux based open sources S/W etc. I have intention to write such a paper for how to set up PEAP implementation with freeradius as well. But for that, I'm hoping someone can give me a good start. OK, here is my network settings and needed information; I have a SUSE SLES 10 server to be used as an AAA server. This server is called store-AAA and also acts as a DHCP server for the clients. I have a few of Cisco 1242 AP as an authenticator. Clients are going to be computers with WinCE as their OS and they will contact to the LAN wirelessly. What I want to achieve is authenticating this clients with server-AAA using PEAP before letting them use the other network resources. Thank you in advance for your time and effort. George Knight

5 16

FR 1.1.7 + AD 2003 + LDAP
by Charlie B 01 May '08

01 May '08

Hello everyone, We have setup FreeRadius w/ Active Direcotry using LDAP and ntlm as per the wiki and everything is working great save one item of concern. When our users are needing to reset their password or have reset their password ntlm fails I'm pretty certain that this is not a freeradius issue and I'm sorry to post here however this would be the largest base for user whom may have experienced this issue We can correct the issue if we remove the registry key located HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters however this removes the 802.1x configuration for the machine. rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user Raduser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_mschap: Told to do MS-CHAPv2 for Raduser with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=Raduser' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 88 radius_xlat: '--challenge=5fb05b4d0e49743a' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=abc64919a43a42c675c516ce59001bb4a3ef65d68f8de407' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 48 modcall: leaving group MS-CHAP (returns reject) for request 48 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 48 modcall: leaving group authenticate (returns reject) for request 48 auth: Failed to validate the user. Login incorrect (rlm_mschap: Logon failure (0xc000006d)): [Raduser/<no User-Password attribute>] (from client localhost port 0) freeradius-1.1.7-3.1 samba-3.0.28-0 samba-client-3.0.28-0 samba-common-3.0.28-0 Any help much appreciated, we currently running about 1500 users with this setup and everything is great save the password issue. Thanks

5 14

Deny Users AD on Freeradius + Wireless&VPN
by rmp dmd 01 May '08

01 May '08

Hi, We have a wireless network that uses freeRadius integrated with AD for authentication. There are some test user accounts on AD that I would like to deny access on our Wireless and VPN. I have tried "How do I deny access to a specific user, or group of users" on FAQ but it is not working. I'm guessing that this is not the correct method. Please help me on how to set-up correctly. Thanks! Roehl

3 8

How to implement two possible passwords? (one for PEAP and other for TTLS)
by Sergio Belkin 30 Apr '08

30 Apr '08

Hi, I've added an new attribute called "radiusPassword" this a clear-text password exclusively for radius usage. I want that: 1) All Linux, MAC OS X, and all Windows users that want to and can install (or already have installed and configured) securew2 use their usual encrypted userPassword. (EAP-TTLS) 2) All users that don't want to install securew2 (Windows users) and want to use PEAP instead TTLS use the radiusPassword as their password for access to wireless network. How can I do that? These are my current config files: ---------- radiusd.conf ---------------- prefix = /usr/local-2.0.2 exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = $(raddbdir) libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = 190.69.213.5 port = 0 } listen { ipaddr = 190.69.213.5 port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = yes auth = yes auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 190 reject_delay = 1 status_server = yes } proxy_requests = no $INCLUDE proxy.conf $INCLUDE clients.conf snmp = no $INCLUDE snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { radwtmp = ${logdir}/radwtmp } $INCLUDE eap.conf mschap { } ldap { server = "ldap.cadorna.edu identity = "cn=freeradius,ou=applications,dc=cadorna,dc=edu" port = 636 password = doyouwantocrakforgetitdude basedn = "ou=people,dc=cadorna,dc=edu" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile = /etc/raddb-2.0.2/cacert.pem randfile = /dev/urandom require_cert = "allow" } access_attr = "radiusAllowed" dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } realm IPASS { format = prefix delimiter = "/" } realm suffix { format = suffix delimiter = "@" } realm realmpercent { format = suffix delimiter = "%" } realm ntdomain { format = prefix delimiter = "\\" } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 header = "%t" suppress { User-Password } } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d suppress { User-Password } } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter attr_filter.post-proxy { attrsfile = ${confdir}/attrs } attr_filter attr_filter.pre-proxy { attrsfile = ${confdir}/attrs.pre-proxy } attr_filter attr_filter.access_reject { key = %{User-Name} attrsfile = ${confdir}/attrs.access_reject } attr_filter attr_filter.accounting_response { key = %{User-Name} attrsfile = ${confdir}/attrs.accounting_response } counter daily { filename = ${db_dir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout allowed-servicetype = Framed-User cache-size = 5000 } $INCLUDE sql/mysql/counter.conf always fail { rcode = fail } always reject { rcode = reject } always noop { rcode = noop } always handled { rcode = handled } always updated { rcode = updated } always notfound { rcode = notfound } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } expiration { reply-message = "Password Has Expired\r\n" } logintime { reply-message = "You are calling outside your allowed timespan\r\n" minimum-timeout = 60 } exec { wait = yes input_pairs = request shell_escape = yes output = none } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply shell_escape = yes } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 } policy { filename = ${confdir}/policy.txt } } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ EOF -------------- eap.conf ---------------- eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_file = /etc/pki/tls/certs/ips-spectrum-key.pem certificate_file = /etc/pki/tls/certs/ips-spectrum-crt.pem CA_file = /etc/pki/tls/certs/ips-ca-bundle.crt dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random cipher_list = "DEFAULT" } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } } EOF ------------------- ldap.attrmap checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Cleartext-Password clrtxtPassword checkItem User-Password userPassword replyItem Tunnel-Type radiusTunnelType replyItem Tunnel-Medium-Type radiusTunnelMediumType replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId checkItem LM-Password lmPassword checkItem NT-Password ntPassword checkItem LM-Password sambaLmPassword checkItem NT-Password sambaNtPassword checkItem SMB-Account-CTRL-TEXT acctFlags checkItem Expiration radiusExpiration checkItem NAS-IP-Address radiusNASIpAddress replyItem Service-Type radiusServiceType replyItem Framed-Protocol radiusFramedProtocol replyItem Framed-IP-Address radiusFramedIPAddress replyItem Framed-IP-Netmask radiusFramedIPNetmask replyItem Framed-Route radiusFramedRoute replyItem Framed-Routing radiusFramedRouting replyItem Filter-Id radiusFilterId replyItem Framed-MTU radiusFramedMTU replyItem Framed-Compression radiusFramedCompression replyItem Login-IP-Host radiusLoginIPHost replyItem Login-Service radiusLoginService replyItem Login-TCP-Port radiusLoginTCPPort replyItem Callback-Number radiusCallbackNumber replyItem Callback-Id radiusCallbackId replyItem Framed-IPX-Network radiusFramedIPXNetwork replyItem Class radiusClass replyItem Session-Timeout radiusSessionTimeout replyItem Idle-Timeout radiusIdleTimeout replyItem Termination-Action radiusTerminationAction replyItem Login-LAT-Service radiusLoginLATService replyItem Login-LAT-Node radiusLoginLATNode replyItem Login-LAT-Group radiusLoginLATGroup replyItem Framed-AppleTalk-Link radiusFramedAppleTalkLink replyItem Framed-AppleTalk-Network radiusFramedAppleTalkNetwork replyItem Framed-AppleTalk-Zone radiusFramedAppleTalkZone replyItem Port-Limit radiusPortLimit replyItem Login-LAT-Port radiusLoginLATPort replyItem Reply-Message radiusReplyMessage EOF Thanks in advance!! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 7

Version 2.0.4 has been released
by Alan DeKok 30 Apr '08

30 Apr '08

Version 2.0.4 has been released: http://freeradius.org/download.html There are a number of interesting new features, most notably DHCP support. :) Feature improvements * Allow "virtual_server" in "realm" and "home_server" sections. See raddb/proxy.conf and raddb/sites-available/virtual.example.com. * Allow "passwd" module to be listed in "accounting" and "post-auth". * Added "fallback" to "home_server_pool" configuration, to handle the case of all home servers being dead. See raddb/proxy.conf. * Added sample text to raddb/sites-available/inner-tunnel which can simplify debugging of inner tunnel configurations. * Added regular expression matching in realm names. See raddb/proxy.conf for examples. * Added simple DHCP server functionality. For comments, see raddb/sites-available/dhcp. * Added file globbing capabilities to detail file reader * Added sample raddb/sites-available/robust-proxy-accounting * Clients in SQL can now refer to a virtual server. Patch from Michael Bretterklieber. * Added some examples of creating RADIUS administrator in SQL, and assigning appropriate access rights. Bug fixes * Install all files in raddb/sites-available * Allow non-threaded builds. * Don't treat '0x' as special for known attributes that are not of type "octets". * Fix log error in rlm_pap. * Remove documentation about non-existent functionality. * Updated warning messages in debug output. * Fix handling of timeouts in rlm_ldap that affected 64-bit systems. This fix was supposed to go into 2.0.3, but did not make it. * Fix event handling in debug mode for failed proxy requests. * Fix memleak in fifos. Closes #537. * Fix memleak on blocked threads. Closes #538. * Perform additional checks on NULL realms. Closes #541. * Fix handling of "clients" in "listen" section. * When detail file cannot process a packet, sleep for longer to let the rest of the server do something. * Add missing table to raddb/sql/mssql/schema.sql. Closes #545. * Updated rlm_sql_postgresql to build with PostgreSQL 7.x. Closes #533. * Fix "postauth" of rlm_ldap to look for LDAP-UserDn in the correct place. * Update rlm_attr_filter for some corner cases. Closes #543. * Fixed memory leak in libfreeradius event handler. * In the SQL Accounting on/off queries, remove the restriction that the session time had to be zero.

1 0

dot1x specification EAPOL-Logoff clarification
by Arran Cudbard-Bell 30 Apr '08

30 Apr '08

Hi, Having some interesting issues with a HP ProCurve 2510 an Apple Mac Power Book running OSX 10.5.2, and MAC-Auth + EAP-Auth on the same wired port. I know this isn't strictly the list for this as this isn't really RADIUS, but i'm not sure where to post... Two questions: IEE802.1x-2004 8.1.3 EAPOL-Logoff When a Supplicant wishes the Authenticator PAE to perform a logoff (i.e., to set the controlled Port state to unauthorized), the Supplicant PAE originates an EAPOL-Logoff message (see 7.5.4) to the Authenticator PAE. As a result, the Authenticator PAE immediately places the controlled Port in the unauthorized state 1) It appears in the spec that there is no requirement or indeed method of the Supplicant PAE of confirming that the EAPOL-Logoff has been honoured. So the supplicant PAE could be in the unauthorised state while the Authenticator could be in the authorised state. Is this an over site of the dot1x spec, or is this meant to be handled at a higher level with EAP ? --- 2) On the termination of an EAP session, VLAN membership is usually altered, either to a MAC-Authorised VID a default unauthorised VID, or the port is blocked. Windows clients are pretty crap in terms of DHCP when this happens, and fail to renew their leases when moving between authorised and unauthorised states. Apple Mac clients however are very good in terms of DHCP dot1x integration. Unfortunately with EAP-Based and MAC-Based authentication transistions, DHCP renewal doesn't appear to work. This is what i've seen from the traces: FRAME 6436 - TS 212.482482 - Assumed VLAN 603 - Actual VLAN 603 - EAPOL Logoff FRAME 6440 - TS 212.484947 - Assumed VLAN Blocked (transistion) - Actual VLAN 603 - DHCP REQUEST FRAME 6443 - TS 212.487252 - Assumed VLAN Blocked (transistion) - Actual VLAN 603 - DHCP ACK (Answered by server on 603) FRAME 6454 - TS 212.529774 - Assumed VLAN 134 - Actual VLAN 134 - EAP Failure (Seems to denotate MAC Authentication succeeding) So it appears after the supplicant sends the EAPOL-Logoff, the DHCP client attempts to get a lease very quickly; so quickly in fact that the switch hasn't altered the state of the port. The result being that the DHCP request is acked by the DHCP server on the dot1x authorised VLAN, the VLAN transistion *then* occurs, but as the DHCP client has satisfied itself that it has a valid lease for the PAE unauthorised state it doesn't renew the lease until it expires... Should I be shouting at HP to get their switches to register the state change faster, or shouting at Apple to make their DHCP timings less agressive ? Many Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 16

User-Name attribute being evaluated as regular expression???
by bmccorkle 30 Apr '08

30 Apr '08

Hello, I have an issue and haven't been able to find any online help. I thought I had freeradius working correctly but discovered yesterday that if a user's name starts with 'r' then they can't login. I setup an unlang if statement (in the default sites available) to handle whether the login is a computer, user, or pda request (I'm assuming this is the best way to do it). The statement copies the User-Name attribute over to a Stripped-User-Name attribute and manipulates the Stripped-User-Name as necessary. Normally when a user logs in it's in the format: DOMAIN\first.lastname. I created some attr_rewrite modules to strip the domain and period out of the username. It was working fine, but I discovered if Randy Hall logs in (User-Name = DOMAIN\randy.hall); Stripped-User-Name becomes: DOMAIN andy halll (domain is not removed, the r in his name disappears and the last letter seems to be doubled (I tried this with another user and it removed the r from his name and doubled the 's' at the end of his name as well). So what is going on exactly? I'm not an expert but it seems like the attribute is being evaluated as a regular expression??? I commented out all the attr_rewrite modules except for the one that copies the user-name over to stripped-user-name and noticed the stripped-user-name was still incorrect in my ldap search. .....attr_rewrite section in RADIUSD.CONF..... attr_rewrite copy.user-name { attribute = Stripped-User-Name new_attribute = yes searchfor = "" searchin = packet replacewith = "%{User-Name}" } attr_rewrite add-dollar-sign { attribute = Stripped-User-Name searchfor = "^(host/.*)" searchin = packet new_attribute = no replacewith = "%{1}$" } attr_rewrite strip-realm-name { attribute = Stripped-User-Name new_attribute = no searchin = packet searchfor = "^(.*[\\/]+)" replacewith = "" max_matches = 1 } attr_rewrite remove-domain { attribute = Stripped-User-Name new_attribute = no searchfor = "\.DOMAIN\.EDU" searchin = packet replacewith = "" max_matches = 1 } attr_rewrite pda-fix { attribute = Stripped-User-Name new_attribute = no searchfor = "@DOMAIN" searchin = packet replacewith = "" max_matches = 1 } attr_rewrite strip-period { attribute = Stripped-User-Name new_attribute = no searchin = packet searchfor = "[.]" replacewith = " " max_matches = 1 } .....If statement in default under sites-available..... #Host Login if (User-Name =~ /^(host\/.*)/i) { copy.user-name strip-realm-name remove-domain } #User Login elsif (User-Name =~ /^(DOMAIN\\.*)/i) { copy.user-name strip-realm-name strip-period } #PDA Login elsif (User-Name =~ /((a)DOMAIN.EDU)/i) { copy.user-name remove-domain strip-period } else { copy.user-name strip-period } .....OUTPUT..... Waking up in 3.9 seconds. User-Name = "DOMAIN\\randy.hall" Framed-MTU = 1400 Called-Station-Id = "001a.e210.7420" Calling-Station-Id = "000e.3558.6ea4" Service-Type = Login-User Message-Authenticator = 0x3ee4bc7ed916ea6dc3bdb3d527346d95 EAP-Message = 0x0202001701474148414e4e415c72616e64792e68616c6c NAS-Port-Type = Wireless-802.11 NAS-Port = 3649 NAS-IP-Address = 192.168.0.229 NAS-Identifier = "Company" +- entering group authorize ++[preprocess] returns ok expand: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radacct/192.168.0.229/auth-detail-20080424 rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/192.168.0.229/auth-detail-20080424 expand: %t -> Thu Apr 24 10:18:40 2008 ++[auth_log] returns ok ++? if (User-Name =~ /^(host\/.*)/i) ? Evaluating (User-Name =~ /^(host\/.*)/i) -> FALSE ++? if (User-Name =~ /^(host\/.*)/i) -> FALSE ++? elsif (User-Name =~ /^(DOMAIN\\.*)/i) ? Evaluating (User-Name =~ /^(DOMAIN\\.*)/i) -> TRUE ++? elsif (User-Name =~ /^(DOMAIN\\.*)/i) -> TRUE ++- entering elsif (User-Name =~ /^(DOMAIN\\.*)/i) expand: %{User-Name} -> DOMAIN\randy.hall copy.user-name: Added attribute Stripped-User-Name with value 'DOMAIN\randy.hall' +++[copy.user-name] returns ok expand: ^(.*[\/]+) -> ^(.*[\/]+) strip-realm-name: Does not match: Stripped-User-Name = DOMAIN andy.halll +++[strip-realm-name] returns ok expand: [.] -> [.] expand: -> strip-period: Changed value for attribute Stripped-User-Name from 'DOMAIN andy.halll' to 'DOMAIN andy halll' +++[strip-period] returns ok ++- elsif (User-Name =~ /^(DOMAIN\\.*)/i) returns ok ++ ... skipping elsif for request 2: Preceding "if" was taken ++ ... skipping else for request 2: Preceding "if" was taken ++[chap] returns noop ++[mschap] returns noop -- View this message in context: http://www.nabble.com/User-Name-attribute-being-evaluated-as-regular-expres… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

[Fwd: mschapV2 problem]
by Cristian Novac 30 Apr '08

30 Apr '08

1 1