- Freeradius-Users - lists.freeradius.org

Session-Timeout conditionally appearing
by Tuc at T-B-O-H.NET 23 May '08

23 May '08

Hi, I've run this on FR2.0.3 and 2.0.4, MySQL and Postgresql, and I seem to see a pattern. I'm not sure if its the correct behaviour or not. Using counters, I add "Max-All-Session := 123" into my database for a user. when I run radtest, I get : setup# radtest hotspot ICANSEE localhost 1212 testing123 User-Name = "hotspot" User-Password = "ICANSEE" NAS-IP-Address = 192.168.3.128 NAS-Port = 1212 Idle-Timeout = 900 I would think I would see a : Session-Timeout = 123 If, though, I add a record for a 122 second session into radacct and run again, I see : setup# radtest hotspot ICANSEE localhost 1212 testing123 User-Name = "hotspot" User-Password = "ICANSEE" NAS-IP-Address = 192.168.3.128 NAS-Port = 1212 Idle-Timeout = 900 Session-Timeout = 1 Is Session-Timeout not showing due to misconfiguration on my part (Fairly stock configuration), or because of some other reason? Thanks, Tuc

3 3

unable to authenticate
by David Trinh 23 May '08

23 May '08

I would like to test the security feature 802.1x EAP-TLS of our product. I set up FreeRadius and used the demo certificates. However, the server keeps rejecting access. I noticed that the server complains about <no User Password attribute>, but the wireless device (supplicant) does not have a place for me to enter the password, only the login. So how to I configure FreeRadius to ignore the password attribute? Please help. I have included the debug log and the user.conf file. Here is the log when run in debug mode: Ready to process requests. rad_recv: Access-Request packet from host 192.168.254.26:1026, id=4, length=208 Message-Authenticator = 0x9075ab275b5d9dca389e8646e992305e Service-Type = Framed-User User-Name = "FreeRADIUS.net-Client" Framed-MTU = 1488 Called-Station-Id = "00-0B-6B-85-C3-68:radius" Calling-Station-Id = "00-0B-6B-84-44-C7" NAS-Identifier = "TEst" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204001a01467265655241444955532e6e65742d436c69656e74 NAS-IP-Address = 192.168.254.26 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '../var/log/radius/radacct/192.168.254.26/auth-detail-20080522.log' rlm_detail: ../var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d.log expands to ../var/log/radius/radacct/192.168.254.26/auth-detail-20080522. log modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "FreeRADIUS.net-Client", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 4 length 26 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry FreeRADIUS.net-Client at line 95 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 4 to 192.168.254.26 port 1026 EAP-Message = 0x010500060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x81d7452a456ad519df0020eba90a201b Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.254.26:1026, id=5, length=206 Message-Authenticator = 0xb6900d65edf9c188d8eb45a273d4ceb0 Service-Type = Framed-User User-Name = "FreeRADIUS.net-Client" Framed-MTU = 1488 State = 0x81d7452a456ad519df0020eba90a201b Called-Station-Id = "00-0B-6B-85-C3-68:radius" Calling-Station-Id = "00-0B-6B-84-44-C7" NAS-Identifier = "TEst" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020500060300 NAS-IP-Address = 192.168.254.26 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '../var/log/radius/radacct/192.168.254.26/auth-detail-20080522.log' rlm_detail: ../var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d.log expands to ../var/log/radius/radacct/192.168.254.26/auth-detail-20080522. log modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "FreeRADIUS.net-Client", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry FreeRADIUS.net-Client at line 95 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: NAK asked for bad type 0 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group authenticate (returns invalid) for request 1 auth: Failed to validate the user. Login incorrect: [FreeRADIUS.net-Client/<no User-Password attribute>] (from client radius port 1 cli 00-0B-6B-84-44-C7) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.254.26:1026, id=5, length=206 Sending Access-Reject of id 5 to 192.168.254.26 port 1026 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- ##########This is the user.conf################# .... ############# RFC3580 ################ ## Also the "eap.conf" MUST be modified to include the follow line: ## "use_tunneled_reply = yes" ## the default is "use_tunneled_reply = no" ## this allow the "Tunnel*" AV's to be passed outside the eap tunnel ## otherwise the switch will NOT see the VLAN to place the port into #### Comments added by Jeff Reilly #### testuser User-Password == "testpw" #FreeRADIUS.net-Client User-Password == "demo" rfc3580 User-Password == "demo" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "1", Reply-Message = "Hello, %u" FreeRADIUS.net-Client Auth-Type := EAP # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # #steve Auth-Type := Local, User-Password == "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # #"John Doe" Auth-Type := Local, User-Password == "hello" # Reply-Message = "Hello, %u" # # Dial user back and telnet to the default host for that port # #Deg Auth-Type := Local, User-Password == "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Auth-Type := Local, User-Password == "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # against the system database, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell", Auth-Type := System # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # First setup all accounts to be checked against the UNIX /etc/passwd. # (Unless a password was already given earlier in this file). # DEFAULT Auth-Type = System Fall-Through = 1 # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Defaults for all framed connections. # DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = No # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Shell-User # On no match, the user is denied access.

2 1

multiple sessions with static IP assignment
by Flamur Rogova 23 May '08

23 May '08

Hi, I have the following situation: each user can have 2 simultaneous sessions, but they must have static IPs (consecutive) for both sessions. For example, "users" file entries would look like this: test1 Cleartext-Password :="test1", Simultaneous-Use := 2 Framed-Ip-Address := "192.168.0.1", (other reply attributes...) test1 Cleartext-Password :="test1", Simultaneous-Use := 2 Framed-Ip-Address := "192.168.0.2", (other reply attributes...) Is something like this possible ? thanks, Flamur

2 1

[1.1.0 -> 2.0.4] How to authenticate users like foo@ldap with LDAP server?
by Clark J. Wang 23 May '08

23 May '08

In FreeRADIUS 1.1, I can ask LDAP server to authenticate users with name foo@ldap by configuring like this: --- File: hints --- DEFAULT Suffix == "ldap", Strip-User-Name = Yes Hint = "ldap" --- File: users --- DEFAULT Hint == "ldap", Auth-Type := LDAP -- File: radiusd.conf --- modules { ldap { ... } } authorize { ... # ldap ... } authenticate { ... Auth-Type LDAP { ldap } ... } After upgrading to 2.0.4, when starting `radiusd -X' it failed with error: /usr/local/FreeRADIUS-2.0.4/etc/raddb/users[179]: Parse error (check) for entry DEFAULT: Unknown value LDAP for attribute Auth-Type 2.0.4 does not support this usage any longer?

1 0

confirmation
by sushma 23 May '08

23 May '08

help

1 0

MySQL noresetcounter / No reply-name or count attribute?
by Tuc at T-B-O-H.NET 22 May '08

22 May '08

Hi, I've noticed on the default FR 2.0.4 MySQL counter.conf file, for the "sqlcounter noresetcounter" , there isn't a "count-attribute" of "Acct-Session-Time" or a reply-name of something like "Session-Timeout". The dailycounter and monthlycounter both have a reply-name . Is this for a reason, and if so why? I'm just trying to grok why it might not have one compared to the others. Thanks, Tuc

1 0

Exec-Program-Wait Don't work
by Roberto Salazar M. 22 May '08

22 May '08

Regards: Sorry my english! I'm using Exec-Program-Wait for session control and printing a "Session-Timeout = 0" parameter, but don' work. In cistron radius, I received logs in radius.log: Tue Sep 4 17:26:57 2007 : Debug: Exec-Program output Session-Timeout:=100 Tue Sep 4 17:26:57 2007 : Debug: Exec-Program-Wait: value-pairs: ,Session-Timeout:=100 But now, I don't received nothing. How I can activate this log in radius.log? _________________________________________________________________ Blog your life in 3D with Windows Live Writer. http://www.windowslive.com/overview.html?ocid=TXT_TAGLM_Wave2_wl_writer_022…

1 0

Re: EAP TLS testing using eapol_test
by Naunidh S Chadha 22 May '08

22 May '08

Hi Alan Thanks for the reply. The client certificates are made by using "make client.pem" command. This is the should create the certificates signed by the server certificate of Freeradius. Since the root CA is same for both Freeradius and eapol_test, I am not sure what is going wrong, do you think it could be the eapol config? I will paste it here again. network={ ssid="1x-test" key_mgmt=WPA-EAP eap=TLS identity="user(a)example.com" ca_cert="/usr/local/etc/raddb/certs/ca.pem" (even tried with server.pem as CA) client_cert="/usr/local/etc/raddb/certs/user(a)example.com.pem<http://lists.freeradius.org/mailman/listinfo/freeradius-users> " private_key="/usr/local/etc/raddb/certs/client.key" private_key_passwd="whatever" eapol_flags=3 } Thanks Naunidh On Thu, May 22, 2008 at 10:56 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: EAP TLS testing using eapol_test (Alan DeKok) > 2. Re: Need to understand flow (Alan DeKok) > 3. Re: radius x509 authentication + LDAP ? (Alan DeKok) > 4. Re: Need to understand flow (Tuc at T-B-O-H.NET <http://t-b-o-h.net/> > ) > 5. Re : Dynamic VLAN and FreeRadius (Joel MBA OYONE) > 6. Re: Re : Dynamic VLAN and FreeRadius (Joe Vieira) > 7. Re : Re : Dynamic VLAN and FreeRadius (Joel MBA OYONE) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 22 May 2008 17:06:03 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: EAP TLS testing using eapol_test > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <48358BDB.1040506(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Naunidh S Chadha wrote: > ... > > Wed May 21 19:31:19 2008 : *Error: --> verify error:num=20:unable to get > > local issuer certificate* > > Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Alert > [length > > 0002], fatal unknown_ca > > The certificate supplied by the client was not signed by a CA that > FreeRADIUS recognises. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Thu, 22 May 2008 17:08:54 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Need to understand flow > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <48358C86.8030309(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Tuc at T-B-O-H.NET <http://t-b-o-h.net/> wrote: > > I'm having to write my own validation and accounting for a device, > > Don't. Please. There are a number of RADIUS libraries available, > including freeradius-client, on freeradius.org. It's supported, it > works, and it's in use by a number of products. > > > and I need to understand a little about the flow. Is there a good > reference > > for this? I don't have to support much, basically user/pass > authentication, > > updating accounting, timeout, logoff. > > See the RFC's. > > > I believe I next need to send an accounting_start packet. Some > > of the items I'm not sure where they come from (Acct-Session-Id, > > Acct-Unique-Session-Id) or how they might be generated. > > This is not a mailing list for general RADIUS questions. The RFC's > exist. Please read them. > > If you're doing this for a customer, you're getting paid. Don't > expect anyone here to help you (for free) to create your product that > has nothing to do with FreeRADIUS. > > Alan DeKok. > > > ------------------------------ > > Message: 3 > Date: Thu, 22 May 2008 17:10:07 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: radius x509 authentication + LDAP ? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <48358CCF.9000701(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Riccardo Veraldi wrote: > > After authentication I would like to chack the common name or email > > address propertires of te certificate againsta LDAP, to authorize the > > user connection. > > It comes in the User-Name attribute. > > > is it possible to do this ? > > I tyed but it seems not working in my configuration. > > any hints ? > > Give us more information? > > Q: Hi, I tried to do stuff, but it didn't work. How do I fix it? > A: Uh... your guess is as good as mine. > > Alan DeKok. > > > ------------------------------ > > Message: 4 > Date: Thu, 22 May 2008 11:37:27 -0400 (EDT) > From: "Tuc at T-B-O-H.NET <http://t-b-o-h.net/>" <ml(a)t-b-o-h.net> > Subject: Re: Need to understand flow > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <200805221537.m4MFbRmn039038(a)himinbjorg.tucs-beachin-obx-house.com> > Content-Type: text/plain; charset=us-ascii > > > > I'm having to write my own validation and accounting for a device, > > > > Don't. Please. There are a number of RADIUS libraries available, > > including freeradius-client, on freeradius.org. It's supported, it > > works, and it's in use by a number of products. > > > I have no issue using a library. Right now I'm working with > Net::Radius. But to use it I need to understand the flow since it only > seems to be able to assemble and disassemble the packets, not tell me how > to do it. > > > > > and I need to understand a little about the flow. Is there a good > reference > > > for this? I don't have to support much, basically user/pass > authentication, > > > updating accounting, timeout, logoff. > > > > See the RFC's. > > > Ok. I was hoping for something more than RFC's, but if thats the > starting point, off I'll go. > > > > > I believe I next need to send an accounting_start packet. Some > > > of the items I'm not sure where they come from (Acct-Session-Id, > > > Acct-Unique-Session-Id) or how they might be generated. > > > > This is not a mailing list for general RADIUS questions. The RFC's > > exist. Please read them. > > > Jawol. > > > > If you're doing this for a customer, you're getting paid. Don't > > expect anyone here to help you (for free) to create your product that > > has nothing to do with FreeRADIUS. > > > Actually, no, I'm not doing this for a customer. I'm doing it > for an OpenSource/Sourceforge project, but I really appreciate your > support in it all. > > Tuc > > > ------------------------------ > > Message: 5 > Date: Thu, 22 May 2008 15:49:50 +0000 (GMT) > From: Joel MBA OYONE <mba_oyone(a)yahoo.fr> > Subject: Re : Dynamic VLAN and FreeRadius > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <994857.8869.qm(a)web26108.mail.ukl.yahoo.com> > Content-Type: text/plain; charset="utf-8" > > Alan, > > I possess a device from D-Link (DWS-3024). it is a wireless switch > controler, and the documentation says that: > - One SSID has to be affect to one VLAN on the profile. > - An Access point could be configured with up to 8 ifferent SSIDs and it > is possible to affect each SSID on its own network (below is a link which > show you the config page) or all SSID on the same network. maybe i didn't > read it correctly, so here is the link (see page 89-90 and maybe 91 too.): > ftp://ftp.dlink.fr/DWS/DWS-3024/Manuel/DWS-3000_Series_User_Manual_v2.00.pdf > > i asked you stuffs about SSIDs/VLAN cause all my APs (about 30) will > receive the same profile, and the profile will have 3 differents SSIDS with > diffrents security access levels and network from the wireless switch. > > for example, in the same room, associated to the same AP, students and > teachers will connect to diffrent SSIDs coming from that same AP, and some > will have to athenticate via EAP-PEAP, other will require EAP-TLS. > > this other short file explain point to point what is my config and waht i > am trying to do: > ftp://ftp.dlink.fr/DWS/DWS-3024/QIG/QIG_DWS-3024_WPA2.pdf > read it and maybe you could understand me. > > > regards > > > Joel MBA OYONE wrote: > >> No. VLAN assignment is after SSID association, and after 802.1x > >> authentication. > > > > OK, is it possible to associate in SSID_1 and be assigned to a different > > VLAN than the we are associated in ? > > That doesn't make sense. SSID's aren't tied to VLANs, unless you > configure them that way. > > > (exemple, when i am associated to > > SSID_1, which belongs to VLAN100, > > No... SSID's have nothing to do with VLAN's. > > > RADIUS sends me > > "Tunnel-Private-Group-ID = 200", which belongs to another SSID, what > > would happen and would authentication process success?) > > Read your NAS documentation to see how to do VLAN assignment, and how > it interacts with SSID's. > > > - if i am assigned to another couple of SSID/VLAN than the one i am > > connected now by RADIUS, would authentication process restart at the > > beginning? > > Stop talking about "SSID/VLAN". They are separate things. > > When you do VLAN assignment with RADIUS, you do NOT need to > re-authenticate. > > > - is it possible to do EAP-TLS, EAP-PEAP and EAP-MD5 without the use of > > 802.1x when RADIUS is the authentication Server for a supplicant? > > What does that mean? > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > __________________________________________________ > Do You Yahoo!? > En finir avec le spam? Yahoo! Mail vous offre la meilleure protection > possible contre les messages non sollicit?s > http://mail.yahoo.fr Yahoo! Mail >

1 0

Re : Re : Re : Dynamic VLAN and FreeRadius
by Joel MBA OYONE 22 May '08

22 May '08

Um... i think i just sent an empty response, sorry about that and thank you for this clear explanation. i just will change my NAS! (but i will call d-link before ). see ya! Joel MBA OYONE wrote: > We all agree that assocation is made before authentication process, in > order to RADIUS to be able to do its stuffs. but the fact is that it > doesn't work, Then your NAS is broken. Buy a real NAS that supports VLAN assignment. > and i was wondering what would be the result if i set: > "Tunnel-Private-Group-ID = 100" (when the SSID were i am connected is > assiged to VLAN 200, according to how my device work) . We told you what the result was: We don't know. Go read your NAS documentation. If it doesn't say, it's because your NAS is broken. > i learnt freeradius stuffs and with the help of the guys here, i am now > able to setup it correctly!!! Access point authentication works well, > but end-users authentication doing some EAP fails but stay without no > response after the access-challenge!! (saying no correct login/password > find, or requiring client certificate, depending if i am doing tls or > peap). This is in the FAQ, and in the comments in eap.conf. > please note that it deons'nt tell me that my certificates are incorrect, Windows doesn't do that. It just stops doing EAP. Please stop trying to figure it out. Believe what we're saying. We've seen your situation hundreds of times. It's nothing new. > - About the limitations of the device, i posted on d-link support a week > ago and i am still waiting for the answer. Exactly. Buy a device that is *documented* as doing VLAN assignment. > Any people interested in help could just read page 200 - 209 of this > documents and give advices. Sorry. Buy a real NAS that works. You're wasting your time trying to make a broken NAS do VLAN assignment. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

Re : Re : Re : Dynamic VLAN and FreeRadius
by Joel MBA OYONE 22 May '08

22 May '08

MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 22 Mai 2008, 17h37mn 46s Objet : Re: Re : Re : Dynamic VLAN and FreeRadius Joel MBA OYONE wrote: > We all agree that assocation is made before authentication process, in > order to RADIUS to be able to do its stuffs. but the fact is that it > doesn't work, Then your NAS is broken. Buy a real NAS that supports VLAN assignment. > and i was wondering what would be the result if i set: > "Tunnel-Private-Group-ID = 100" (when the SSID were i am connected is > assiged to VLAN 200, according to how my device work) . We told you what the result was: We don't know. Go read your NAS documentation. If it doesn't say, it's because your NAS is broken. > i learnt freeradius stuffs and with the help of the guys here, i am now > able to setup it correctly!!! Access point authentication works well, > but end-users authentication doing some EAP fails but stay without no > response after the access-challenge!! (saying no correct login/password > find, or requiring client certificate, depending if i am doing tls or > peap). This is in the FAQ, and in the comments in eap.conf. > please note that it deons'nt tell me that my certificates are incorrect, Windows doesn't do that. It just stops doing EAP. Please stop trying to figure it out. Believe what we're saying. We've seen your situation hundreds of times. It's nothing new. > - About the limitations of the device, i posted on d-link support a week > ago and i am still waiting for the answer. Exactly. Buy a device that is *documented* as doing VLAN assignment. > Any people interested in help could just read page 200 - 209 of this > documents and give advices. Sorry. Buy a real NAS that works. You're wasting your time trying to make a broken NAS do VLAN assignment. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0