- Freeradius-Users - lists.freeradius.org

Authentication
by michel＠casa.co.cu 08 Jun '09

08 Jun '09

Hi I am newcomer to freeradius, I use the version is 1.1.3 release 1.4.el5 is coming in the repository of centos, my users are in the windows directory, I would like to authenticate users as follows michel(a)casa.co.cu. Excuse my English is very poor, appreciate any help Thanks Michel ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

8 9

Re: Re: Reply-message and supplicant
by David Mitton 08 Jun '09

08 Jun '09

4 3

Remove AV pair in post_proxy/pre_proxy section
by R.Filatov＠ttk.ru 08 Jun '09

08 Jun '09

Hello! Example, this code based on rlm_perl don't work sub post_proxy { # For debugging purposes only delete $RAD_REPLY{"ERX-Ingress-Policy-Name"}; #return RLM_MODULE_OK; return RLM_MODULE_UPDATED; } Attribute ERX-Ingress-Policy-Name avalible in recive packet Best Regards Filatov Ruslan

2 1

How to activate the certificate revocation list I created
by Josh Hiner 08 Jun '09

08 Jun '09

Hello, I have been searching for documentation on activating a certificate revocation list I just created with openssl. It is a crl.pem signed by my ca cert. I just need freeradius to reference it so that the one certificate I revoked gets denied on authentication. Here is what I have so far in my eap.conf (I am running freeradius 2.1.3 on REHL) crl_file = ${raddbdir}/certs/makecertificates/issued/crl.pem check_crl = yes CA_path = ${raddbdir}/certs/makecertificates/issued/ Are these lines correct? Are any lines I have up there unnecessary? Also, do I need to have my CA certificate in the same directory as the crl.pem file? It seems to hint towards that in the eap.conf file. Thanks for any help

2 2

eap-peap username/password problem
by kalesameer 08 Jun '09

08 Jun '09

i have implemented eap-peap using freeradius-2.1.1. i am using windows XP machines as clients. when users try to connect to server using the peap protocol,they are asked for their username and password. my problem is that once the users are connected to the server,they are not asked for a username/password when they try to connect after logging out of the network.the username/password that was used to connect to network initially, is used automatically for subsequent purposes to connect to the network. is it a problem of the XP clients?or is the radius server caching all the requests so that the next time no username/password is required?is there any way so that the users are asked for a username/password every time they want to connect after disconnecting(logging out)? -- View this message in context: http://www.nabble.com/eap-peap-username-password-problem-tp23915126p2391512… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 6

Re: Re: eap-peap username/password problem
by David Mitton 08 Jun '09

08 Jun '09

1 0

Duplicate SQL records versus unique constraints
by Christian Balzer 08 Jun '09

08 Jun '09

Hello, First of, been using freeradius for 5-6 years now and we are happy campers thanks to it. Freeradius 2.04 (Debian Lenny package), but I don't think this is very version specific. Configuration is set for direct (sql, not sql_log) logging of accounting records into mysql. We've got a number of what can only be described as "maniac" customers which fire off new sessions every minute or 2 and one of these has managed to create over 2000 "identical" sessions, as far as actsessionid and the default generation of acctuniqueid are concerned. It seems that the NAS in question is prone to recycle actsessionids under the onslaught of this user (within days at times). We are talking to the upstream access provider about this, but I don't think much of anything will come out of it. In this setting the default key generation for the acctuniqueid of: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" did little to stop the duplicates, since only the Acct-Session-Id is variable (when not re-used by the NAS), the rest are more or less static. We changed the Client-IP-Address to Framed-IP-Address in the key generation as this gives a much, much smaller chance of duplicates. But of course it does not guarantee uniqueness either. In the analysis of this event it became clear that the sql module will happily update any and all records that share the same acctuniqueid with a new stop and session time, even if these were not NULL or 0 respectively. Never mind that this whole scenario should not happen in the first place it seems that overwriting valid data in an already "complete" accounting record would be big no-no. Could anybody comment on this? Given this behavior and the still existing (albeit vastly smaller) chance of future duplicate records making it into the database I have a question: If we add a CONSTRAINT to enforce uniqueness for acctuniqueid in the DB, will the failure to insert an accounting record confuse the freerad sql module and will those failures percolate up towards the radius protocol level and thus result in the NAS keep on sending that accounting packet? Regards, Christian -- Christian Balzer Network/Systems Engineer NOC chibi(a)gol.com Global OnLine Japan/Fusion Network Services http://www.gol.com/ https://secure3.gol.com/mod-pl/ols/index.cgi/?intr_id=F-2ECXvzcr6656

3 7

Reply-message and supplicant
by Sergio Belkin 08 Jun '09

08 Jun '09

Hi, Is possible that Reply-message can be seen from laptops running the supplicant? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

5 27

Question on proxying requests
by Josh Hiner 07 Jun '09

07 Jun '09

Have a question on proxying requests in Freeradius. I know how to proxy requests to other radius servers via the proxy.conf based on domain etc.. I would like to have one radius server and authenticate off multiple domain controllers based on domain using ntlm_auth. Right now I see that you can only configure ntlm_auth in the mschapv2 module in /etc/raddb/modules. This works fine for one domain. But if a user from domain ISD wants to authenticate on our wireless, I want the radius server to authenticate on the ISD file server (its a samba server). If the user is in the HTN domain I would like the radius server to authenticate off the HTN domain controller. Or maybe ntlm_auth isnt the way to do this? Maybe I'm looking at this the wrong way? Any ideas to get this to work or any other better ideas? Thanks! -Josh

2 1

Prevent uid sharing or hot to allow use uid only once
by Sergio Belkin 06 Jun '09

06 Jun '09

Hi, Let's suppose that John Doe comes and login with jdoe uid, then Joe comes and wants to use wireless network, but he has not entry neither Ldap nor in radius users file, so he ask for jdoe that pass him its uid and password to login. Sorry if that sounds somewhat stupid but can we prevent that from radius? (please don't tell me to fire John Doe ;) ). Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 7