- Freeradius-Users - lists.freeradius.org

Re: Freeradius + openldap + 802.1x - Solved....
by Fabio Silva 18 Mar '08

18 Mar '08

Solved.... I can authenticate in radius with my ldap user account... But now... i would like to know.. if there is any way to check the Group that the user is. I would like to configure to accept all users from the group "Users". How can i do it? Regards. On Mon, Mar 17, 2008 at 4:50 PM, Fabio Silva <fssilva(a)gmail.com> wrote: > Hi all, does someone have a howto about how to configure it?? > > I have already read this link > http://wiki.freeradius.org/index.php/Rlm_ldap but i need some more > information... > > I know that i must use the radius schema, its already configured in my > slapd.conf i created a user with this ldif sample.. > dn: cn=test,ou=users,dc=radius,dc=local > objectClass: inetOrgPerson > objectclass: radiusprofile > objectClass: top > givenName: test > cn: teste > uid: test > > I configured the clients.conf with the network that i want to use.. > client 192.168.2.0/24 { > secret = secret123 > shortname = test > } > > What else is needed to configure it? > > Someone help me? > > Regards, > -- > Fabio S. Silva > Mail: fssilva(a)gmail.com > -- Fabio S. Silva Mail: fssilva(a)gmail.com

2 1

Freeradius Execute Script
by fvt3 18 Mar '08

18 Mar '08

I understand that it is possible to have Freeradius execute a script when a user authenticate. What I want to do is to be able to pass that user name and the client's ip address to the script. This is my setup, I have freeradius with mysql setup. radgroupreply table: testprogramExec-Program-Wait==/usr/local/etc/raddb/test.pl When user Joe authenticates with his credential, radius would look in mysql and execute the test.pl script. How can I pass the user name "joe" and client's ip address to the test.pl script? ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

2 1

Postgres SQL Alarm on duplicated record
by banga 18 Mar '08

18 Mar '08

Hello. Some times my NAS resend START record to RADIUS. The And I get the alarm messages like that , because the differences in this start record is only in Start time and radacct_acctuniqueid_key are always equal for such sessions. : Wed Mar 12 18:05:10 2008 : Error: rlm_sql (sql): Couldn't insert SQL accounting START record - ERROR: duplicate key violates unique constraint "radacct_acctuniqueid_key" But, in any case all such start records are put to database. How I cat stop put such duplicate records? -- View this message in context: http://www.nabble.com/Postgres-SQL-Alarm-on-duplicated-record-tp16046727p16… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

2.0.3 - sites-enabled/inner-tunnel and sites-available/inner-tunnel
by David Wood 18 Mar '08

18 Mar '08

Hi there, I'm working on updating the FreeBSD net/freeradius2 port to 2.0.3. As always, this makes me scrutinise the changes between versions. In 2.0.3, raddb/Makefile now creates a for sites-enabled/inner-tunnel. However, sites-available/inner-tunnel, the destination of that link, isn't installed because it has been omitted from the definition of FILES in raddb/Makefile. Is this a mistake? If sites-available/inner-tunnel has been mistakenly omitted from FILES in raddb/Makefile, what about sites-available/copy-acct-to-home-server, sites-available/proxy-inner-tunnel, sites-available/buffered-sql and sites-available/vmps? Should they all be in FILES as well? If there's a problem here, I'll patch it in the FreeBSD port in anticipation of a FreeRADIUS fix in 2.0.4. Best wishes, David -- David Wood david(a)wood2.org.uk

2 1

Help me please (about freeradius+openldap+nas)
by Koko Kurniawan 18 Mar '08

18 Mar '08

i have trouble in configuration RADIUS for wireless LAN. NAS ( access point) never send User-Password to my Radius server. Can you tell me why it could be happened?? i try to use default configuration ( from freeradius), but itś still not working. i will give you my radiusd.conf and log file from radius server. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Freeradius + openldap + 802.1x
by Fabio Silva 17 Mar '08

17 Mar '08

Hi all, does someone have a howto about how to configure it?? I have already read this link http://wiki.freeradius.org/index.php/Rlm_ldap but i need some more information... I know that i must use the radius schema, its already configured in my slapd.conf i created a user with this ldif sample.. dn: cn=test,ou=users,dc=radius,dc=local objectClass: inetOrgPerson objectclass: radiusprofile objectClass: top givenName: test cn: teste uid: test I configured the clients.conf with the network that i want to use.. client 192.168.2.0/24 { secret = secret123 shortname = test } What else is needed to configure it? Someone help me? Regards, -- Fabio S. Silva Mail: fssilva(a)gmail.com

1 0

OT:securew2 problem with Vista
by Sergio Belkin 17 Mar '08

17 Mar '08

Hi, I was using with no problem securew2 3.3.3. on Windows XP but I have problems with laptops with Windows Vista, I installed the software and configured wireless network settings but login dialog box never appears, always the "fine" vista native box does it instead... Please, if someone is using this software and could get working Vista, tell me how you did it. Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 5

Rewriting Attributes with Freeradius
by mrhotstandby＠gmail.com 17 Mar '08

17 Mar '08

Hi there, i looked around and found nothing which really helped, so i'll ask you :) I want my freeradius to rewrite the vlan attributes for cetrain clients. Setup is like having all users in my ldap, with vlan etc. and all is working fine so far. Now i have an office which has other vlans due to an migration than the main office. Now i want my vlan IDs rewritten by freeradius for that office. >From what i have read, i can do it with rlm_perl or maybe with rlm_attr_rewrite, but i didn't found anything about how exactly... If someone could point me to a doc or so, would be really nice. Thanksalot! (especially for the freeradius itself :)

3 9

ntlm_auth
by Dean, Barry 17 Mar '08

17 Mar '08

I know this is not strictly a FreeRADIUS problem, but I am betting someone on this list has been here and got the tee shirt! I have joined my two RADIUS servers (FreeRADIUS 2.0.2, Solaris 10 x86, winbindd 3.0.25a) to our AD domain with the "net join" command. This worked (eventually!). Now when I test "ntlm_auth" I get the following odd goings on: Scenario A: Works Type: ntlm_auth --username=USER --password=PASSWORD --domain=DOMAIN Result: NT_STATUS_OK: Success (0x0) Scenario B: FAILS Type: ntlm_auth --username=USER --domain=DOMAIN password: <PASSWORD> Result: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) What's different about the password handling between A and B? The upshot is that the command issued by FreeRADIUS: ntlm_auth = "/usr/sfw/bin/ntlm_auth --request-nt-key --username= %{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} -- nt-response=%{mschap:NT-Response:-00}" Also fails. So my MSCHAPv2 auth is now broken. This worked with our Test AD environment fine. I am told the only difference between test/production is: 1) Production is in "native mode" 2) Production supports logins using both "USER\DOMAIN" and "USER@DOMAIN" forms. If the answer to my problem is "As the Samba list", I'll pop over there! Thanks in advance. --------------- Barry Dean Networks Team

1 0

Instability with 1.1.7 and Alcatel Wifi controllers
by Fabio Pedretti 17 Mar '08

17 Mar '08

I am using freeradius 1.1.7 at my University since some time and never had any problem. I recently added two Alcatel controllers (Alcatel 6000 and 4302) with their APs. Since that I noticed that freeradius sometimes (about once every week) hangs with 100% cpu usage or crashes after similar messages: Fri Mar 14 08:23:16 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Fri Mar 14 08:23:16 2008 : Auth: Login incorrect: [33505@students] (from client SF-alcatel-4302 port 1 cli 001302065FE2) Fri Mar 14 08:43:35 2008 : Auth: Login OK: [testpap] (from client alcatel-ext port 0 cli 000000000000) Fri Mar 14 08:51:26 2008 : Error: Discarding duplicate request from client SF-alcatel-4302:32794 - ID: 25 due to unfinished request 1155 or Tue Feb 26 09:38:46 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Tue Feb 26 09:38:46 2008 : Auth: Login incorrect: [host/fabry-722333783] (from client SC-alcatel-6000 port 1 cli 00130287CBCD) Tue Feb 26 09:39:57 2008 : Info: rlm_eap_mschapv2: Issuing Challenge Tue Feb 26 09:40:07 2008 : Error: Discarding duplicate request from client SC-alcatel-6000:32794 - ID: 85 due to unfinished request 2143 I am using a selfcompiled freeradius 1.1.7 deb package on a 64 bit Ubuntu 6.06 and I am using mysql and ldap backends. Have someone idea on what can be the problem? I'll try to compile with --enable-developer if core dumps are needed. Thanks, Fabio

3 2