- Freeradius-Users - lists.freeradius.org

EAP-TTLS and accounting
by Will Booth 25 Apr '08

25 Apr '08

Is is possible to use TTLS with accounting messages after authentication? Will

2 1

Can unlang do this?
by Chris 24 Apr '08

24 Apr '08

Should I expect something like this to do the right thing? ldap-localhost { server = "127.0.0.1" basedn = switch "%{Huntgroup-Name}" { case dsl { "ou=dsl,ou=radius,dc=viptalk,dc=net" } case { "ou=accounts,ou=viptalk,ou=net" } } } etc.... Basically, I want to set certain ldap variables based on the Huntgroup- Name. Without defining a bunch of different ldap servers, that is. Thanks.

2 9

external radius for Motorola Canopy
by James 24 Apr '08

24 Apr '08

Has anyone tried using an external radius server with Motorolas Canopy?

3 2

Problems with freeradius 802.1x and Cisco Catalyst 3560
by Omar Lopez Limonta 24 Apr '08

24 Apr '08

Hi i have some problems with authentication in Freeradius with Cisco Catalyst 3560 and 802.1x configuration. Freeradius -X -A tell me: Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=26, length=123 Ignoring request from unknown client 172.29.11.1:21645 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=26, length=123 Ignoring request from unknown client 172.29.11.1:21645 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=26, length=123 Ignoring request from unknown client 172.29.11.1:21645 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.29.11.1:21645, id=26, length=123 Ignoring request from unknown client 172.29.11.1:21645 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. My clients.conf file has this: 172.29.11.1 { secret = mecago shortname = cisco3560 nastype = other } I also test with nastype = cisco , and it doesn´t run too. In mi cisco config I have this : aaa new-model aaa authentication login default local aaa authentication dot1x default group radius aaa authorization exec default local aaa authorization network default local aaa session-id common radius-server host 172.29.11.7 auth-port 1812 acct-port 1813 timeout 3 radius-server key mecago interface FastEthernet0/5 switchport access vlan 2 switchport mode access dot1x port-control auto dot1x pae authenticator spanning-tree portfast Any one have any idea about this error? Thanks. -- Xgalaga se disfruta más sobre NetBSD sparc64 Content Rules: ///// \\\/// ///\\\ The Duke of Url. { O--O } / /\ \ \ -- / [||]

5 15

Open Directory and freeRadius
by Aaron_Hovel＠pikeschool.org 24 Apr '08

24 Apr '08

I currently have freeRadius running on a Macintosh 10.5 server. freeRadius is using opendirectory for authentication and authorization. This is working successfully. What I would like to do next is have the PrimaryGroupID or the gidNumber in Opendirectory for that particular user passed back to, in this case an Aruba Controller, so that the Aruba Controller can authorize the user based on the group membership. Any suggestions? Thank you, Aaron

2 5

MS-CHAP-Error
by Phil Mayers 24 Apr '08

24 Apr '08

All, We're rolling out a password-expiry policy here, and it's been suggested that it would be helpful for the VPN to prompt a user to change their password, rather than just lock them out. The VPN is poptop on Linux, authing to FreeRadius, which current talks to winbind and then to our w2k3 servers but may be moving to proxy the final inner mschap to IAS (all the policy checks and interesting stuff will be staying on FreeRadius - but using FR2 and a proxy plus pool of home servers seems like to give us better failure and recovery characteristics when an AD controller goes away) When we MS-CHAP an expired account we get a MS-CHAP-Error packet in the reply as expected: Sending Access-Request of id 7 to 192.168.29.34 port 1812 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" MS-CHAP-Challenge = 0xSNIP MS-CHAP2-Response = 0xSNIP Calling-Station-Id = 192.168.55.55 NAS-IP-Address = 192.168.54.54 NAS-Port = 0 Proxy-State = 0x3633 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Reject packet from host 192.168.29.34:1812, id=7, length=46 Proxy-State = 0x3633 MS-CHAP-Error = "\000E=648 R=0 V=3" ...however FreeRadius obeys the RFCs, and doesn't proxy the MS-CHAP-Error packet back to the radius client (pppd "radius.so" plugin) so my patches to pppd are unable to act on the error code. Am I wasting my time?

3 5

Freeradius/tacacs
by Hof Wesley 24 Apr '08

24 Apr '08

Hi List, I am looking for a tacacs radius solution. For some reason I can't find that much information about freeradius<->tacacs. My complete setup needs to be database driven. (ldap/ad) I want to be able to log every command a users executes, limit users into groups, limit groups into commands that they can execute. It also must be possible to set wich users can login on wich cisco. Thanks List ! Wesley

3 2

PROXY based on NAS
by rsg 24 Apr '08

24 Apr '08

Is there a method to do NAS based RADIUS proxying? It would be handy to have some server side control like this. Thanks for your thoughts

3 2

rlm_sqlippool
by rsg 24 Apr '08

24 Apr '08

When there's no NAS-Port in rad_request... the server doesn't assign an IP address; That's why in my opinion there's no Framed-IP-Address in Access-Accept message. If my reasoning is correct, I'd like to highlight that NAS-Port is not a mandatory attribute when it comes to Mobile telephony environment. Is there any workaround once again to bypass this. I can suggest one..i.e to update the Access-Request using unlang and hope it would work. auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [test/test] (from client SSS port 0 cli 44444444488) +- entering group post-auth rlm_sqlippool: unknown NAS-Port ++[sqlippool] returns noop } # server example Sending Access-Accept of id 56 to 192.168.1.4 port 1812 Primary-DNS-Server = 192.168.2.2 Secondary-DNS-Server = 192.168.2.2 Proxy-State = 0x30303338 Finished request 0.

3 14

No radtest debug output
by Chris 24 Apr '08

24 Apr '08

One system is doing this: # radtest cjl 'password' 127.0.0.1 1 secret Sending Access-Request of id 188 to 127.0.0.1 port 1812 User-Name = "cjl" User-Password = "password" NAS-IP-Address = 192.168.1.1 NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=188, length=20 The other is doing this: # radtest cjl 'password' 127.0.0.1 1 secret User-Name = "cjl" User-Password = "password" NAS-IP-Address = 192.168.1.1 NAS-Port = 1 It looks like I've done something to make DEBUG or vradlog or something stop outputting but I can't find it. Any thoughts? radtest doesn't make much sense without the debug output.

2 1