July 2008 - Freeradius-Users - lists.freeradius.org

2.0.5 on Solaris
by Rafiqul Ahsan 08 Aug '08

08 Aug '08

Can anyone suggest the documents/wiki for installation steps for Freeradius 2.0.5 on Solaris ? -- Rafiqul Ahsan

2 5

Whether the FreeRADIUS supports switch 3Com 5500G-EI ?
by Gennadiy Redko 07 Aug '08

07 Aug '08

Hi,all. I wish to dispose authorization on the switch with the dynamic isolation VID on the port on the protocol of 802.1x on RADIUS Server. Stand: the switch of 3Com 5500-EI (Software Of version of 3Com OS Of v3.02.03s56), computer from OS Windows XP (SP2), RHEL 5 update 1, freeradius-1.1.3-1.2.el5,kernel 2.6.18-53.el5 #1 SMP. Technical support of the 3Com has advised to use here this document for adjustment: http://www.3com.com/products/en_US/result.jsp?selected=2&sort=effdt&order=d… DUA1725-0BAA02.pdf , page 415 The authorization to FreeRadius is passed at the given moment, but to port is not allotted necessary VID. FreeRADIUS does not support 3Com switches ?

5 25

Device authentication and User+Device authentication
by Cristian Novac 07 Aug '08

07 Aug '08

Hi all, Could someone tell me what has to be configured to be able to do Device authentication and User+Device authentication. Thank you! Cristian NOVAC

2 11

groupmembership and vlan assignment
by Matt Ashfield 05 Aug '08

05 Aug '08

Hello We have been using the groupmembership attribute in radius.conf to assign users to the appropriate vlans. Up until now we've done it based on the type of LDAP user they are (ie, staff, student, faculty, etc..): groupmembership_attribute = eduPersonPrimaryAffiliation, (where eduPersonPrimaryAffliation=staff, student, facult, etc..) Unfortunately, our student vlans have grown significantly large and we want to take measures to make them smaller. We have looked into using LDAP entitlement fields. There are however a few issues here: - The eduPersonEntitlement attribute is not unique. A user record can have multiple instances of this attribute for each different entitlement they have. - The eduPersonEntitlement attribute has a value that is not simply the name of a vlan. It is typically something like: eduPersonEntitlement: urn:mace:uni.ca:wireless?vlan=student1 So I'd need to parse the value as well to pull out the vlan name, in this case "student1". I'm unsure how to get around these two issues. Any suggestions are welcome. Thanks Matt mda(a)unb.ca

2 8

Vista Issue
by nf-vale 01 Aug '08

01 Aug '08

Alan, Do you have any news on the Vista EAP issue? For anyone having troubles with Vista there's this supplicant that works and its free: http://wire.cs.nthu.edu.tw/wire1x/ Nelson Vale

3 5

RE: Pattern Matching in users file
by Garber, Neal 01 Aug '08

01 Aug '08

> You can use the "hints" file to do what you want. It does *not* say > you can only use prefix & suffix matching. I was referring to the following in the sample hints file: # Matching can take place with the the Prefix and Suffix # attributes, just like in the "users" file. # These attributes operate ONLY on the username, though. And this in the doc/README file: Customize the /etc/raddb/hints file. This file is used to give users a different login type based on a prefix/suffix of their loginname. For example, logging in as "user" may result in a rlogin session to a Unix system, and logging in as "Puser" could start a PPP session. Is there another document that describes matching on other attributes and how to add new attributes to the request. I think these paragraphs need updating. Are you saying I can do this in hints: DEFAULT Cisco-AVPair == "", My-Group := "RadioIP-MAU" DEFAULT Cisco-AVPair == "ssid=(.*)", My-Group := "Wireless %{1}" DEFAULT My-Group := "Unknown source" That is, does hints work just like the users file, except it adds any new attributes to the request? If so, this is exactly what I need! If the syntax or usage is off, can you correct me. Thanks Alan.

4 4

Are there more logs than "radiusd -X" ??
by Cristian Novac 01 Aug '08

01 Aug '08

Hello all, May you tell me if there is a more detailed log than what I get while running freeradius with -X argument ? I would like to see more about what caused this error: rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert read:fatal:decrypt error TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:1409441B:SSL routines:SSL3_READ_BYTES:tlsv1 alert decrypt error rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [{3}0017c4274f2c(a)asb.com/<via Auth-Type = EAP>] (from client localhost port 0 cli 00-17-C4-27-4F-2C) Delaying reject of request 4 for 1 seconds Thank you! BR, Cristian Novac.

2 2

Proxy default-fallback
by Marcelo Henique Cabral Ariza 31 Jul '08

31 Jul '08

Hi everybody! I am using freeradius 2.0.5, and i had a problem whith the proxy option default_fallback, my server do proxy to 3 providers and i have a default realm configured to fallback, but when home servers die the proxy set them died, but don`t do the fallback. Anyone have a sugestion? Thanks! Marcelo

1 0

EAP-MSChapV2 Question
by Garber, Neal 31 Jul '08

31 Jul '08

Is it possible to use PEAP/EAP-MSChapV2 (e.g., from a WinXP supplicant) and authenticate with a local user (i.e., defined in the "users" file with a Cleartext-Password). I'm thinking this isn't supported, but I thought I'd ask to be sure.. Thanks..

3 6

re: groupmembership and vlan assignment
by Matt Ashfield 31 Jul '08

31 Jul '08

Is there a way to regexp checking on the group_membership field instead? Thanks Matt Ashfield mda(a)unb.ca -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Monday, July 28, 2008 3:23 PM To: mda(a)unb.ca; FreeRadius users mailing list Subject: Re: groupmembership and vlan assignment Matt Ashfield wrote: > DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Huntgroup-Name == UNBFWSS, > unbldap-Ldap-Group =~ .*staff1, Autz-Type := Ldap1, Auth-Type := Ldap1 The LDAP Group checking does *equality* checking, not regular expression checking. Sorry. Alan DeKok.

1 0