- Freeradius-Users - lists.freeradius.org

Freeradius+Java application api call and authenticate
by sollunga 16 Apr '09

16 Apr '09

i am using Cisco ACS for authenticating my vpn users, now i thought of using two factor auth in place against the direct authentication by ACS, on this process one of the googling guided me to try proxying the ACS to Freeradius and call some scripts to talk to the java application. now by making the ACS to do proxying at network configuration, i can see the request is flowing to freeradius from ACS, and the freeradius does "" [chap] rlm_chap: Attribute "User-Name" is required for authentication. ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ++[attr_filter.access_reject] returns noop Delaying reject of request 27 for 1 seconds "" after a while it says "" [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "Doe" with CHAP password [chap] Using clear text password "hello" for user Doe authentication. [chap] chap user Doe authenticated succesfully ++[chap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 63 to "" i am trying to figure out where could be the issue once after this process, i need to send the same to a java application and get a success status from there and authenticate this user. could it be possible? team i am a newbie here, i am just a sys admin, and now trying extend my knowledge, please help me. -- View this message in context: http://www.nabble.com/Freeradius%2BJava-application-api-call-and-authentica… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 12

other device to store configuration!
by new conf 16 Apr '09

16 Apr '09

hello to all; I have a question.. and i hope I'll have a reply or an idea!! If I have to store my files of configuration (eap, keys, randoms, dh..) in a usb device, have you an idea: how can I configure my freeradius? thanks you for your help!

4 10

Help with initial setup Sita<-->Ext. Radius<-->Int.Radius<-->AD
by Podlazov, Lev 16 Apr '09

16 Apr '09

Good morning , Our organization is trying to set Wireless Users authentication via AD with Radius in between. The reason for Ext. and Int. Radius based on our security group recommendations. I've installed freeradius-1.1.3 from RedHat . It's up on both Ext and Int boxes. I was able to run radtest and radclient locally on both machines but when I am trying to run them from Ext to Int I am getting these errors radclient: no response from server for ID 174 . I've set access for all users in /etc/raddb/users and defined clients in /etc/raddb/clients.conf according to documentation. I am totally new to Radius and this point I am lost what to try next. Any help greatly appreciated Thanks Lev Podlazov IMF 202-623-4054

3 3

Re: Freeradius-Users Digest, Vol 48, Issue 56
by Guk Victor 16 Apr '09

16 Apr '09

1 0

Re: NAS table
by Nizar Zulmi 15 Apr '09

15 Apr '09

i comment out this on clients.conf #client 127.0.0.1 { # secret = passwordradius # shortname = localhost # nastype = other # localhost isn't usually a NAS... #} and i add this to NAS table on radius database. insert into nas (nasname, shortname, secret) values ("client 127.0.0.1","localhost","passwordradius"); i restart the mysql server and then i perform test using radtest and got this message: radtest Nizar 123456 localhost 1812 passwordradius Sending Access-Request of id 104 to 127.0.0.1 port 1812 User-Name = "Nizar" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 .... Re-sending Access-Request of id 104 to 127.0.0.1 port 1812 User-Name = "Nizar" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 radclient: no response from server for ID 104 why its still dosn't work..?? clue plase... --- On Tue, 4/14/09, JDL <JDL(a)imaginenet.net> wrote: From: JDL <JDL(a)imaginenet.net> Subject: Re: NAS table To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tuesday, April 14, 2009, 11:42 AM Nizar Zulmi wrote: > i enable this on sql.conf > readclients = yes > > do i have to remove this : > client 127.0.0.1 { Do you have a "127.0.0.1" client in your the nas table? If so, then yes, you will need to remove it or else you will end up with a duplicate. If this client is not in your nas table, then you can just leave the 127.0.0.1 client in the clients.conf file. BTW, I think the 127.0.0.1 client is just there for testing purposes. I do not believe it will break anything if it is completely removed (unless, of course, you are running also running some sort of radius client on the same server as FreeRADIUS). Jim L. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

Detail file polling issues
by Alan DeKok 15 Apr '09

15 Apr '09

Some people have seen the detail file listener go "crazy", and use lots of CPU. I've managed to reproduce the problem, and have committed a fix to the "stable" tree. Please see http://git.freeradius.org/pre/ for tar files && debian files containing the fix. Or, see http://git.freeradius.org/ for instructions on grabbing the latest "stable" code from git. Alan DeKok.

3 6

Dynamically set password_attribute
by James Devine 15 Apr '09

15 Apr '09

Is it possible to dynamically set the password_attribute ldap module option? I tried setting it to %{Ldap-Pass-Attr}, but it doesn't seem to expand this.

3 6

RE: (EAP) AES Key-wrap of MK issued to the authenticator
by William Rettig 15 Apr '09

15 Apr '09

I'm trying to set up AES Key-wrap of MK issued to the authenticator. Is this possible? If it is, will someone please explain how to do it? Thank you, Bill

1 0

(EAP) AES Key-wrap of MK issued to the authenticator
by William Rettig 15 Apr '09

15 Apr '09

Please point me to documentation that shows how to set up "AES Key-wrap of the MK issued to the authenticator". I am trying to support FIPS140-2. Is this possible? Thank you, Bill

1 0

problem with samba and kerberos 5 to integrate freeradius with AD
by bastardinho69 15 Apr '09

15 Apr '09

Hi, i have been following this great guide http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO on how to integrate freeradius with AD. I am getting confused about kerberos5. Do i have to additionally install krb5 from ports? Or maybe it should be on my system already after samba server installation? In any way (install krb5 or no, i tried both ways) i dont have the krb5.conf file on my system at all. Judging from the guide, it should be there without any krb5 installation procedure. I am running FreeBSD 7.1. I hope u guys can help me, becoz it feels like "no way out" at the moment. Thanks for ur time ;)

1 0