- Freeradius-Users - lists.freeradius.org

Windows IIS authentication with FREERADIUS !
by aacable 04 Jul '11

04 Jul '11

Hello All, I am stuck in a situation and need help. I have a ISP type local network, I am using Mikrotik router as PPPOE server and FREERADIUS (ubuntu) as a radius server for about 2000+ users. I Have 5 Terabyte of Media sharing server, (hosted on IIS FTP) , Is there any way that IIS can get authentication from FREERADIUS ? so that only those users can access ftp media sharing server who have account on radius server. Can you please give me some hints on how I can configure IIS to use authentication from FREERADIUS server ? Help plz :) Regards, SYED JAHANZAIB -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-IIS-authentication-with-FRE… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Windows IIS authentication with FREERADIUS !
by aacable 04 Jul '11

04 Jul '11

Hello All, I am stuck in a situation and need help. I have a ISP type local network, I am using Mikrotik router as PPPOE server and FREERADIUS (ubuntu) as a radius server for about 2000+ users. I Have 5 Terabyte of Media sharing server, (hosted on IIS FTP) , Is there any way that IIS can get authentication from FREERADIUS ? so that only those users can access ftp media sharing server who have account on radius server. Can you please give me some hints on how I can configure IIS to use authentication from FREERADIUS server ? Help plz :) Regards, SYED JAHANZAIB -- View this message in context: http://freeradius.1045715.n5.nabble.com/Windows-IIS-authentication-with-FRE… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Invitation to connect on LinkedIn
by Sergio Belkin via LinkedIn 03 Jul '11

03 Jul '11

LinkedIn ------------ Sergio Belkin requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, I'd like to add you to my professional network on LinkedIn. - Sergio Accept invitation from Sergio Belkin http://www.linkedin.com/e/f5ihn8-gpobvdyd-2f/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… View invitation from Sergio Belkin http://www.linkedin.com/e/f5ihn8-gpobvdyd-2f/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… ------------------------------------------ Why might connecting with Sergio Belkin be a good idea? Sergio Belkin's connections could be useful to you: After accepting Sergio Belkin's invitation, check Sergio Belkin's connections to see who else you may know and who you might want an introduction to. Building these connections can create opportunities in the future. -- (c) 2011, LinkedIn Corporation

1 0

AUTO: Neal Howard is out of the office (returning 07/05/2011)
by Neal.Howard＠wichitafallstx.gov 30 Jun '11

30 Jun '11

1 0

./configure/make in subdir?
by Phil Mayers 30 Jun '11

30 Jun '11

Does anyone know if it's possible to persuade ./configure to work from within subdirs? I keep flipping back and forth between master and v2.1.x and it would be nice to be able to re-use builds without having to have two git repos & associated hassles. I've seen syntax like this work on some projects. git checkout v2.1.x cd build-v21x ../configure --prefix=/opt/fr21x make make install cd .. git checkout master cd master ../configure --prefix=/opt/frmaster make make install ...but this seems to fail on (the accursed!) libltdl subdir "configure" which is apparently jumping back up into the top-level source directory. I suspect it would similarly fail on the module configure scripts too.

2 2

Re: LDAP redundant with LDAP-Group within users file
by up＠3.am 30 Jun '11

30 Jun '11

> Just a gap of our users file, we have 18 default lines and additional 4 for a > local/PAP user: > > > DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == > "<LDAP-GROUP-Team-a>" > Login-Service = Telnet > FWIW, since it's the LDAP-Group attribute that you're having trouble with, we are doing LDAP auth with POSIX style LDAP auth data and I believe it gets around this by simply using the old "Group" attribute from before we migrated from PAP/unix (but still gets from LDAP): DEFAULT Group == acme, Pool-Name :="acme_pool", Auth-Type = Ldap This is a smaller network with 1 fallback LDAP server, and I know that the fallback is working and I'm pretty sure it passes on the proper group info to assign the correct IP pool in this case. It may not work with non-POSIX LDAP groups though...

1 0

patch files for pam_radius - adding an 'Always Prompt' option for one-time passcodes
by Nick Owen 30 Jun '11

30 Jun '11

We recently had a customer that wanted to check a password against AD via kerberos and then an one-time passcode against a WiKID Strong Authentication server via radius. We found that PAM passed the AD password to our OTP server, which failed. We have added a pam option "always prompt" in the attached code. This will force a "WiKID passcode:" prompt regardless of any previous password entry. The /etc/pam.d/sshd file looks like: Here's the /etc/pam.d/sshd: #%PAM-1.0 auth required /lib/security/pam_krb5.so auth requisite /lib/security/pam_radius_auth.so always_prompt account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so No changes to system-auth were made. The /etc/ssh/sshd_config looks like: Protocol 2 SyslogFacility AUTHPRIV PasswordAuthentication yes ChallengeResponseAuthentication yes GSSAPIAuthentication yes UsePAM yes AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL X11Forwarding yes UseDNS no Subsystem sftp /usr/libexec/openssh/sftp-server The key change is that ChallengeResponseAuthentication is yes. Hopefully, others will find this of use. Nick -- Nick Owen WiKID Systems, Inc. 404.962.8983 http://www.wikidsystems.com Commercial/Open Source Two-Factor Authentication

3 2

Re: LEAP Authentication?
by Alan Buxey 30 Jun '11

30 Jun '11

Client not responding to the access challenge, client issue alan

6 9

freeradius and IdenticalClients
by Franz Angeli 30 Jun '11

30 Jun '11

Hi i'm trying to migrate my radiator server to freeradius, i have to use something like "IdenticalClients" on radiator: # TEST <Client 10.1.131.1> # Specifies a list of other clients that have an identical setup. # You can use this parameter to avoid having to create separate # Client clauses for lots of otherwise identical clients IdenticalClients X.X.X.X Y.Y.Y.Y Z.Z.Z.Z # Secret is the shared secret between client and this server # Any number of characters, any character except newline # You must set a secret in every Client clause. Secret somesecret # Use this to set a default realm for requests that dont # already have one. This can trigger a specific Realm # statement for users who log in to this NAS without a # realm DefaultRealm FQDN </Client> can i replicate this configuration on freeradius? Thanks in advance Franz

3 2

Re: LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 30 Jun '11

30 Jun '11

> I will try to test this. Thank you very much! >What OS are you on, and what LDAP libraries & version of those libs are you using? RHEL Server 5.6 (64 bit), Kernel 2.6.18-238.5.1.el5 # rpm -qa | grep -i ldap php-ldap-5.1.6-27.el5_5.3 openldap-clients-2.3.43-12.el5_6.7 openldap-2.3.43-12.el5_6.7 python-ldap-2.2.0-2.1 mozldap-6.0.5-1.el5 freeradius2-ldap-2.1.7-7.el5 nss_ldap-253-37.el5 nss_ldap-253-37.el5 openldap-2.3.43-12.el5_6.7 #

1 0