- Freeradius-Users - lists.freeradius.org

When to ldap?
by Dean, Barry 13 May '10

13 May '10

I am working on a new radius config and have been trying to avoid the lookup in LDAP I have been seeing for the outer identity. I have moved to 2.1.8 with the inner-tunnel virtual host enabled. I have an authorise section for the relevant virtual server that has: authorize { preprocess auth_log chap mschap suffix eap { ok = return } files if (!EAP-Message) { ldap } expiration logintime pap } The "if(!EAP-Message)" works a treat at preventing an LDAP lookup for the outer identity, but if I want to send a basic User-Name/User-Password type auth request after checking with LDAP and returning "Remote access is permitted", I then see: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user What am I missing to tell the "authenticate" section below what I want to do next? authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } Auth-Type EAP { eap } eap } I presume: if (!EAP-Message) { ldap } Fails to set Auth-Type LDAP? ---------------------- Barry Dean Principal Programmer/Analyst Networks Group Computing Services Department Tel: 0151 795 9540

2 6

SAMBA Version
by Colin Byelong 13 May '10

13 May '10

Hi, I was reading the archives and saw that some of the later versions of SAMBA had a bug so it couldn't be used for ntlm_auth/Eap-PEAP. Does anyone know if this is now fixed ? We are running Fedora core 12 and it ships with SAMBA 3.4.7 Thanks Colin -- ----------------------------------------------------------------------- Colin Byelong Email: C.Byelong(a)ucl.ac.uk Senior Network Development Officer Network Group Information Systems Division University College London Gower Street Phone: 020 7679-2572 London WC1E 6BT ------------------------------------------------------------------------

1 0

Clark Wang has invited you to Dropbox
by Dropbox 13 May '10

13 May '10

We're excited to let you know that Clark Wang has invited you to Dropbox! Clark Wang has been using Dropbox to sync and share files online and across computers, and thought you might want it too. Visit http://www.dropbox.com/link/20.Nk89gKs-aB/NjE2MzQ0ODgxNw to get started. - The Dropbox Team ____________________________________________________ To stop receiving invites from Dropbox, please go to http://www.dropbox.com/bl/28952efc12b9/freeradius-users%40lists.freeradius.…

2 1

sending Access-request, Access-Reject
by dorra aa 13 May '10

13 May '10

hi can someone help me in that i add a users : abc cleartext-password:="123" and i run freeradius -X after that i do: root@pfe-laptop:/home/pfe# radtest abc 123 localhost 1812 testing123 Sending Access-Request of id 48 to 127.0.0.1 port 1812 User-Name = "abc" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=48, length=20 and this is the output of deamon: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:41804, id=48, length=55 User-Name = "abc" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "abc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry abc at line 216 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 48 to 127.0.0.1 port 41804 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 48 with timestamp 4beb3ff9 Nothing to do. Sleeping until we see a request. _________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969

2 1

RE: framedipaddress
by Paweł Pogorzelski 12 May '10

12 May '10

Listen we've already bought complete meru sytem to eduroam project and there is no turning back. There are many great feature which only meru have. Right now i must find solution for this sytem. -- Pozdrawiam/Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

5 4

RE: framedipaddress
by Paweł Pogorzelski 12 May '10

12 May '10

Unfortunately Meru claims that the client IP address is not sent to the radius in any other attribute either. -- Pozdrawiam/Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

4 3

How to demonize 'radiusd -s'
by Коньков Евгений 11 May '10

11 May '10

Hi, FreeRadius. Is this posible to demonize 'radiusd -s' ? -- Eugen Konkov mailto:kes-kes@yandex.ru

1 0

Adding a signed certificate from a signing authority
by Iain Grant 11 May '10

11 May '10

Apologies I seem to be hogging this today. My radius server is working fine, so now I want to add a signed certificate from a certificate authority. Are there any pointers on how to do this. I have found and carried out the steps on the wiki site around using "snake oil" certificates and then creating your own producution certificates. But I now would like to add the externally signed certificate for added security. Thanks again Iain ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

2 1

Simultneous-Use + SQL + Checkrad
by Galatóczki István 11 May '10

11 May '10

Hi All! I use Freeradius 2.0.4(deb pack) with Mysql 5.0.51. The online users check not work in the NAS with checkrad script my network. I read the list and forums but not founded solution. Question: working the checkrad script without radutmp? my config: radcheck- Simultaneous-Use: =1 accounting ( sql sqlippool ) session ( sql ) uncomment: simul_count_query... in dialup.conf include: sql.conf etc.. in the radiusd.conf Best Regards Steve ps: sorry my english

1 0

RE: framedipaddress
by Paweł Pogorzelski 11 May '10

11 May '10

Than You sunhualing for advice. I'm waiting for answer from Meru. -- Pozdrawiam/Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

1 0