- Freeradius-Users - lists.freeradius.org

EAP - TLS Client Certification Stored Removable Media
by Aydın KOÇAK 05 Nov '08

05 Nov '08

Hello All; I have a question about EAP - TLS . How can I configure client certification stored from removable media (ex: usb memor, smartcard, etc..). I have already used EAP - TLS with client certification stored on Windows (cliet) but i need a solution that user can authenticate when insert his usb memory and logout when remove his usb memory ? My system running with EAP - TLS authentication and LDAP authorization and clients are use 802.1x ... Thank You For Your Relation, Aydin Kocak, TURKOM.

6 5

Re: Freeradius-Users Digest, Vol 43, Issue 17
by Kerry Tobin 05 Nov '08

05 Nov '08

OK, I think I'm another step closer now. I made the suggested change and there was no change in the logs. EAP still was not being done on the local machine and was failing on the proxy. However, I tried creating a second domain, set the original domain to go to LOCAL and the second domain to go to the proxy server. When I do that the proxy properly authenticates to Open Directory, step one. However, eventually I get a failure in rlm_eap again. modcall: entering group authenticate for request 8 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler Am I on to the beginning of a solution by using two domains or do I need to go back and then change something else? Kerry Tobin > > ------------------------------ > > Message: 7 > Date: Wed, 05 Nov 2008 00:07:50 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Unable to authenticate to Open Directory > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <OVuOqjFE.1225840070.2492580.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > >> I think we're back to what I had been trying to do on my test >> machines >> now and still can't seem to get working. >> >> When I add "DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To- >> Realm := DOMAIN" to users of the first server (I believe that's the >> correct place to put it). I get "rlm_eap: Request is supposed to be >> proxied to Realm DOMAIN. Not doing EAP." on the first server and the >> proxy server still says " rlm_eap: Identity does not match User-Name, >> setting from EAP Identity." >> > > There is a setting proxy_tunneled_request_as_eap in peap section of > eap.conf. Change that to no. > > Ivan Kalik > Kalik Informatika ISP >

2 1

freeradius-1.0.5_EAP-TTLS_EAP-Tokencard auth failure for WPA.
by Prasad Parab 05 Nov '08

05 Nov '08

Dear All, My setup involves freeradius 1.0.5 as backend server with AP and wifi client authenticating using EAP-TTLS, EAP-Tokencard type. SEPUP: WIN XP (wifi client) <-------> AP <----------> freeradius-1.0.5 EAP-TTLS,EAP-Tokencard authenticator eap type = ttls. The result is auth failure. Using hostapd-0.5.9 as authenticator. Attached are the log and conf files. Anticipating your help. Regards Prasad

2 1

Re: user group problems, my logic or freeradius limitation
by Reynolds, Walter 05 Nov '08

05 Nov '08

sql is not something we have a lot of expertise in so was hoping there is some other way to be able to get this to work. Can I use unlang in some way to support the users with multiple group names? -- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438 > > ------------------------------ > > Message: 5 > Date: Tue, 04 Nov 2008 17:35:58 +0100 > From: <tnt(a)kalik.net> > Subject: Re: user group problems, my logic or freeradius limitation > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <Ne2NeLhB.1225816558.0900920.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > >> The first comment you gave mentioned to put the Etc-Group-Name in the > huntgroups file. This unfortunately does not work as it will only > accept system groups (and users do not have accounts for this system). >> >> This option does not scale if I am understanding you right. >> >> I would have to add a section for each user for every huntgroup. If >> I have 20 > administrators and 20 huntgroups I would have to create 400 entries > just for them. With the number of users I would have to deal with this would not scale. >> It seems like there should be a easy way to deal with users in more >> than one group. >> > > Use sql. > > Ivan Kalik > Kalik Informatika ISP >

2 1

Modifying AVPs when acting as a proxy
by Olli Salonen 05 Nov '08

05 Nov '08

Hello, I have a problem with my NAS and my current RADIUS server. The RADIUS server is responding with 2 vendor-specific AVPs, which my NAS is not able to understand. However, there are corresponding vendor-specific AVPs in my NAS as well. Could I install FreeRADIUS as a proxy between my current NAS and RADIUS server and have it somehow modify the answer I get from my current RADIUS, effectively acting as a translator between my two current nodes? Cheers, -olli

2 1

Re: Freeradius-Users Digest, Vol 43, Issue 17
by Rolando Tejada 05 Nov '08

05 Nov '08

hi, i would like to know if somebady can help me to configurate a cautive portal in monowall to autenticate user in freeradius.

2 1

freeradius-1.0.5_EAP-TTLS_MSCHAPv2 auth issue
by Prasad Parab 05 Nov '08

05 Nov '08

Hi all, Kindly help me with the issue involving freeradius-1.0.5 for EAP-TTLS_mschapv2 auth type. ** *SEPUP:* ** *WIN XP (wifi client) <-------> AP <----------> freeradius-1.0.5* *EAP-TTLS_mschapv2 authenticator eap type = ttls* Attached is the debug log and eap.conf file. *But with same setup EAP-TTLS with mschap works*. Pls advice if my eap.conf is wrong ?? Regards Prasad

2 4

Trouble using % percent sign in usernames with MySQL auth
by Jonas Frey 05 Nov '08

05 Nov '08

Hello, i am running into problems while using usernames which include a percent % sign. The rlm_sql_mysql module apparently translates these into the ascii of "=25". So a username which was isp/somebody%somewhere gets translated into isp/somebody=25somewhere. Additionally these users are listed incorrect via dialup admin. If you click on their names (even if they include the =25) you cant administer them since dialupadmin apparently strips out the equalsign (as well as the percent sign). Is anyone observing similar behaviour and/or knows of a fix? Regards, Jonas

2 1

Re: Unable to authenticate to Open Directory
by Kerry Tobin 04 Nov '08

04 Nov '08

I think we're back to what I had been trying to do on my test machines now and still can't seem to get working. When I add "DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To- Realm := DOMAIN" to users of the first server (I believe that's the correct place to put it). I get "rlm_eap: Request is supposed to be proxied to Realm DOMAIN. Not doing EAP." on the first server and the proxy server still says " rlm_eap: Identity does not match User-Name, setting from EAP Identity." Thanks, Kerry Tobin On Nov 4, 2008, at 1:04 PM, freeradius-users-request(a)lists.freeradius.org wrote: > > Message: 1 > Date: Tue, 04 Nov 2008 17:39:50 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Unable to authenticate to Open Directory > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <0PGr4bPr.1225816790.3478220.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > >> OK, I've tried using a proxy and now it fails on rlm_eap and says the >> User-Name doesn't match EAP Identity. Is there a way to have EAP >> processed on the local machine but authentication happen on the >> remote? Is that even the problem? >> > > DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := DOMAIN > > That will proxy only the inner tunnel. > > Ivan Kalik > Kalik Informatika ISP >

2 1

Re: Re: EAP - TLS Client Certification Stored Removable Media
by Aydın KOÇAK 04 Nov '08

04 Nov '08

Hello ; Thank you for your replays... You are rigth it isn't related radius... I can do it but it is take a time... Thank You, Aydin KOCAK.

1 0