March 2013 - Freeradius-Users - lists.freeradius.org

freeradius2.2.1 rpm build
by Fred MAISON 06 Mar '13

06 Mar '13

Hi all, I have make a build unsing Suse spec, I saw it is binded to SOURCES/freeradius-server-2.2.0.tar.bz2. Is there any way to create SOURCES/freeradius-server-2.2.1.tar.bz2 after following sequence : git clone git://git.freeradius.org/freeradius-server.git git fetch origin v2.x.x:v2.x.x git checkout v2.x.x ? Does a tar cvfj could be OK ? Best regards , Fred MAISON

1 0

Is updating RAD_CHECK attribute take effect on replay attribute
by Mehdi Ravanbakhsh 06 Mar '13

06 Mar '13

If in section of sites-enabled file ( such as : authorize - authenticate - preacct - accounting - checksimul - post_auth and ..) i update some RAD_CHECK control attribute such as Pool-Name it is take effect on Framed -ip address replay attribute ? Is it matter that in which section i update RAD_CHECK control attribute ?

1 0

overlapping cisco avpairs (UCS+IOS)
by Jimmy Stewpot 06 Mar '13

06 Mar '13

Hello, For some time we have been using freeradius to provide authentication to our networking estate. Recently we introduced the Cisco UCS. The problem that we now have is it appears that we have a conflict in the VSA attributes required to provide the right levels of access to end users. We have always had the Cisco-AVPAIR of "shell:priv-lvl=15" which has been working for some time. With the Cisco UCS platform we need to introduce an additional shell: variable which looks like this "shell:roles=admin". I have tried to add the variables to our users file with a += but the values are never accepted by the end Cisco device. It seems that only the first-to-be-received is actually activated on the Cisco device. I have bene playing around with various formats in the users file without any success. I am interested to know if anyone else has had such issues and if so what the solution is? I am currently running with Freeradius v2.1.12 provided as a part of the Redhat EL6 distro. We have our users in an Active Directory tree using the ldap plugin. our users file looks like this currently. DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15" I've tried the following DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15, roles=admin" - Fails.. both networking and UCS result in read-only or no access. DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15,roles=admin" - Fails.. both networking and UCS result in read-only or no access. DEFAULT LDAP-Group == "Network Full Access" Cisco-AVPAIR="shell:priv-lvl=15", Cisco-AVPAIR+="shell:roles=admin" - Works with the switch/router estate but not with UCS. If i do a debug on the device it always matches the first entry in the returned attributes and discards the second. If I remove the priv-lvl=15 and only have shell:roles=admin and it works for UCS but the switch and router estate fails. Any assistance would be greatly appreciated. Regards, Jimmy.

3 2

Re: Freeradius 2.2.0 memory leak issue.
by Alan Buxey 06 Mar '13

06 Mar '13

Have you tried the latest 2.2 GIT release? Many code updates alan

3 2

Re: overlapping cisco avpairs (UCS+IOS)
by Alan Buxey 06 Mar '13

06 Mar '13

If request is from UCS then reply with the required UCS reply attribute, else send back your old reply attribute. This can be done by either using the client-identifier attribute and unlang, or by using a new virtual-server instance... well, it can actually be done by at least another 3 ways but they are the 2 methods I'd choose from Alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Re: schema.sql for postgresql >> problem in raduser group table
by Alan Buxey 06 Mar '13

06 Mar '13

Do YOU need a primary key? alan

1 0

Re: [Help] How to eliminate client certificate popup
by Alan Buxey 06 Mar '13

06 Mar '13

" 2. Check fig.9 and fig-10 .. looks like there is an option to cache user information and to 'not prompt user to ...' that I think (cmiiw) will give proper solution." It will stop pop-ups for future connections but not remove pop-ups for initial connection...which is what the requester wants. alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Unsubscribe
by Jed Gainer 06 Mar '13

06 Mar '13

Unsubscribe

1 0

schema.sql for postgresql >> problem in raduser group table
by Mehdi Ravanbakhsh 06 Mar '13

06 Mar '13

in schema.sql for PostgreSQL we do not have any primary key for raduser group table. Is that normal or we have some problem ?

1 0

[Help] How to eliminate client certificate popup
by Danny Kurniawan 05 Mar '13

05 Mar '13

Hello, We are using 802.1x wireless connection from Meraki and using PEAP-MSCHAPv2 for authentication with our LDAP. Everything works fine, it just we want to eliminate this pop-up at the 1st time people connect to it : The credentials provided by the server could not be validated. We recommend that you terminate the connection and contact your administrator with the information provided in the details. You may still connect but doing so exposes you to security risk by a possible rogue server. Details Radius Server: $radius Root CA: $ca How can i do that? We are using a cert from Global sign and we already have a root ca in our laptop, but we still need to choose that Terminate / Connect popup. It doesnt matter if we need to change our cert or etc, but we just want to eliminate that popup :) Thanks Danny -- Best Regards, Danny

4 9