- Freeradius-Users - lists.freeradius.org

Re: Strip off the domain part from the User-Name
by Thomas Wunder 04 Apr '11

04 Apr '11

Hi On Friday 25 March 2011 15:42:30 you wrote: > In which case, you *must* enable "with_ntdomain_hack = yes" As you suggested I changed the 'with_ntdomain_hack' option to 'yes' in four different locations (modules/preprocess, modules/mschap, eap.conf, modules/inner-eap) but still it doesn't work. I get the following error message (for a full debug log see attachment) which is new: ++[ldap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [tom1] (from client swtswitch01 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled I'm obviously missing something but I can't seem to find out what it is... Any ideas? Regards Tom

2 8

Creating freeRADIUS extensions (beginner)
by Tiberiu Breana 03 Apr '11

03 Apr '11

Hello. I'm doing my thesis project on advanced authentication techniques. I want to use freeRADIUS to implement extensions regarding one or more of the following: 1)Location-based authentication 2)Prepay codes for timed access 3)QoS parameters (allocate network resources according to the user's services) Do you think these extensions are 'doable' for a beginner? What are the major steps in implementing a new module? From what I've understood so far, I have to create a .c file and add some attributes to the dictionary. Is implementing new message types difficult? (does the finite-state machine need to be modified?) Any advice/information/tips are greatly welcome. Thanks!

2 1

Re: Shared Secret / UAM Secret
by CP 02 Apr '11

02 Apr '11

nobody can help? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Shared-Secret-UAM-Secret-tp4275444p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

AD Integration -No Auth Type
by Raheel Itrat 02 Apr '11

02 Apr '11

Hi, Trying to integrate AD with FR I have successfully joined the domain and also ntlm_auth status as per attached file is OK But when I telnet to my cisco switch I get the subjected error. The relevant files are attached. Im using FR 2.1.0 for 2.1.0 version what elso do i need to do except enabling and editing ntlm_auth line in the mschap module as per Alan's deploying radius tutorial. KIndly go through attached files and help me in this regard Regards, Raheel

4 4

Ignoring reqest from unknown client
by Raheel Itrat 02 Apr '11

02 Apr '11

Hi, I am getting the subjected error when I try to authenticate. I am attaching the relevant files. btw is freeradius-X and radiusd-X same thing? ......My ubuntu doesnt seem to recognize radiusd command root@radius:~# radiusd -X The program 'radiusd' can be found in the following packages: * radiusd-livingston * xtradius * yardradius Try: apt-get install <selected package> radiusd: command not found Regards, Raheel

4 5

Dial up error and freeraius is down
by Robin 02 Apr '11

02 Apr '11

Hi Friends, I met a problem with FreeRADIUS2.1.9 (Mysql+centos, about 500 pppoe users)as below: In general, I found some users couldn't dial to radius and log information as below - Fri Apr 1 19:22:09 2011 : Error: Discarding duplicate request from client mpth12 port 40039 - ID: 129 due to unfinished request 10524 - Fri Apr 1 19:22:10 2011 : Error: Discarding conflicting packet from client mpth12 port 40039 - ID: 129 due to recent request 10524. - I have two guesses: - Brand width is insufficient from pppoe server to radius server; - Server running radius of capability is insufficient. Could you help me? Thank you very much. Robin

4 6

Oracle reconnection for free radius
by Jaikanth Krishnaswamy 01 Apr '11

01 Apr '11

Hi, I have setup free radius freeradius-server-2.1.10 with an oracle back end as suggested on in the documentation. Is there a setting for Oracle connectivity retries from the free- radius S/W ie. If Oracle Server is down does freeradius retry connection after a configurable amount of time?If so which config file is this in? Please advice. Thanks JK

1 0

multiple authentication methods
by Nick Kalen 01 Apr '11

01 Apr '11

Hello, looking at the docs, it looks like it's not possible to try to authenticate against a local LDAP server and in case it failes send it to another radius server? Can someone please prove me wrong?

2 1

sqlcounter & returning Gigawords?
by YvesDM 01 Apr '11

01 Apr '11

Hi, We 're about to upgrade our radius which is still running 1.1.7 We use monthly datalimits so we patched the sqlcounter in order to make it reply max 4GB of left quota (to avoid wrapping), even if the user still has 10GB quota left. Of course this results in a logged out user when he reaches a session of 4GB. As general datatraffic increases we would like to avoid this in our new radius setup. In the newest version, is there a way to reply gigawords from sqlcounter? If not, is there another solution to this? Many thx. Yves

2 2

same username different password on different NAS
by Richard Thornton 01 Apr '11

01 Apr '11

I am just learning about freeradius now, and would like to see if I can use it to manage access and logging for users at a few hundred locations. Each remote office has between 1 and 50 users, and at first glance freeradius will do the job, but I just noticed a problem with overlapping usernames. I am not sure if I need to use virtual servers, or if there is a better / easier way. The problem is that each location may have a user with the same login name as a different location. For a simple example, each site could have a login of "manager", but the manager username at each site would probably pair up with a different password. Without using virtual servers, is there a way to link the username "manager" to the NAS name or IP of the location? I'm picturing something like the radcheck table containing an additional field for NAS such that freeradius would key off the combined of NAS address and username fields, rather than just the username field. I am not opposed to using virtual servers if that is a better idea, but I'm worried about the overhead of several hundred of them... Any ideas or pointers to docs would be appreciated. -Richard

4 4