- Freeradius-Users - lists.freeradius.org

mideye authentication
by Norbert Wegener 03 Mar '08

03 Mar '08

One of our customers uses an authentication service from Mideye, which is described this way: The end-user requests access to a protected application, and is prompted for a user name and password. If the correct credentials have been provided, a one- time password (OTP) is presented on the user's mobile phone. The user is requested to enter the OTP, and if the correct OTP is returned, access is granted. http://www.mideye.com/index.php3?bredd=268.5 It should be simple to generate a one time password, throw it into a database,send it via sms and make it available for the next time, the user requests access. The problem here seems to be, that after a first successfull authentication another one with only a new password but the already entered username has to be done. Can this be realised with an actual freeradius? If so: Where can I find documentation about it? Norbert Wegener

3 6

Fetching username and password through perl script
by johnson elangbam 03 Mar '08

03 Mar '08

hi, I am using free radius 2 along with Ms Sql 2000, I need to authenticate with perl script using my own table schema which contains only username and password. How do I read username and password from these customize table using perl script. With Regards Elangbam Johnson

2 1

(no subject)
by Xiao Peng 03 Mar '08

03 Mar '08

Hi, I'm writing codes for a EAP-TTLS client, but I have some confusions when cope with diameter AVP format; Would anyone please send me some logs of EAP-TTLS handshake? ( I mean, just the EAP-TTLS messages exchange between a server and a client, which I can use for illustration ) Thanks so much!

2 1

limiting user access by day
by Budiono U. 03 Mar '08

03 Mar '08

Hi all, I'm currently setup freeradius server for hotspot, but right now I have some problem for limiting access user to particular day. As example : user1 accessing on Monday to Friday and user2 only accesing on Saturday or Sunday. And each user is limiting for one day access only, and after that day he/she can't login again. Is there any module or attribute to setup radius for this system. Any help would be appreciated. Thank you Budiono

4 3

stay in account list after disconnecting
by Zahra Bahar 02 Mar '08

02 Mar '08

Hi, some users stay in freeradius online users list after disconnecting. Is there any idea about the problem?

2 1

Need to authenticate with Perl
by johnson elangbam 01 Mar '08

01 Mar '08

Hi, I am trying to use authentication using Perl script, I've included a section of Perl in radiusd.conf which specifies the path of the Perl script, and I've included a section like Auth-Type Perl { perl }in the /sites-enabled/default file. I need to implement the stored procedures of MsSql in Perl script so that i can call the stored procedures through perl. Please help me how to implement it.With Regards Elangbam Johnson

2 1

NAS-Group? - different replies to different NASes?
by Adrian 01 Mar '08

01 Mar '08

Hello Everyone, I need help setting up custom replies for each NAS in my organization. I.E I have NAS A and NAS B When NAS A communicates with our Radius Server (Freeradius) I want to send back Tunnel attributes on domain matching. (i.e *(a)domain.com - a set of tunnel attributes Service-Type, Tunnel-Password, Tunnel-Type...etc - not user specific). When NAS B communicates with our Radius I want to send back specific information about the user it's requesting (i.e user(a)domain.com - Framed-IP, Framed-Netmask...etc) Since both requests are addressed to domain.com how can I selectively allow only certain responses to NAS A and others to NAS B? Thanks for the help Adrian Boros

5 23

freeradius 1 mysql Attribute
by Dustin Schuemann 29 Feb '08

29 Feb '08

Im working with dialup provider that is acting as the nas and they are authenticating off my radius server. Authentication works fine. They have this fastnet program that is supposed to make the internet faster. Attached is what they told me to do. I have added it to the dynamic group in mysql and the user is part of that group. But nothing. If you run your own radius server: For those of you that run your own radius server, you must configure your radius server to authenticate the enduser. The authentication will be passed to you, via the same radius servers that authentication currently comes from for pass through radius. The customer must login to the software using their dial-up username and password. You will need to pass back to us the following attribute. (You will need to add this to your dictionary file): VENDORATTR 7000 Slipstream-Auth 1 string Set this equal to 'true' for those that have web acceleration and 'false' for those that do not. By default right now it accepts all users, so be sure to test it with setting one user equal to false and trying to login, it should deny them. Example of how this can be done (using Radiator): Add to your dictionary file at /usr/local/etc/raddb/dictionary: VENDORATTR 7000 Slipstream-Auth 1 string Next, In Radiator you will want to configure like we have listed below. The default entry should be listed after all the webcompress users but before all normal users. Example of how this can be done (Most Radius's): Open up your current dictionary file. Search for the word : cisco- avpair . This is attribute # 1 of vendor 9. You need to create a similar entry, but it should be attribute # 1 of vendor 7000. Follow the example of how the other entry is in your dictionary file. If you cannot find this attribute, it could be under a sub dictionary file. Perhaps something called dictionary.cisco . You may have some INCLUDE lines at the top of your dictionary file that call include dictionary.cisco. If so, you will want to add an INCLUDE line for something like dictionary.slipstream and then follow the example on how dictionary.cisco is setup to make your own dictionary.slipstream file and add that one attribute in it. To Accept a user (this will accept dial-up and accept slipstream): test@realm Auth-Type := Local, User-Password == "trial" Slipstream-Auth = "true" To Deny a user from Slipstream. Do not pass back the Slipstream-Auth = "true". We deny all customers that do not hae a Slipstream-Auth = "true" attribute. Dustin Schuemann . Network Engineer . . . . . . . . . . . . . . . . . . . . . . . . . . AMS/The Support Dept 400 Ann St NW Suite 102 Grand Rapids, MI 49504 p. 616.235.0725 ext. 7007 e. schuemann(a)supportdept.com

3 9

Re: header enrichment
by mauro 29 Feb '08

29 Feb '08

thanks , this can really helps my. So you suggest to investigate about supported RADIUS attributes admitelly I'm not ARADIUS expert and I don't know what VSA means. but I think we can procede togheter, also if we could find a way to introduce Freeradius into the Mobile Network. if you think we are OT please feel free to contact me privately to not disturb the list thanks very much >If there is a RADIUS attribute/VSA that can be interpreted by the >RADIUS client as containing the information required to enrich your >headers, and the client then does the right thing with the Value of >that AV pair, then yes, it can be done. If the RADIUS client cannot >take the information from a specific AVP, then no it cannot be done >without development work by your client vendor (nothing the server can >do to force it). Hope that helps, ___________________________________ L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: http://it.docs.yahoo.com/nowyoucan.html

3 2

authentication winxp over LAN throw switch cisco3560 not working
by hamid benane 29 Feb '08

29 Feb '08

hello everybody, i try many time to resolve this pb but i dont found the solution. my configuration is: freeradius-1.1.1 on fedora6+ nas switch cisco3560+ and wind xp client. On wireless, my configuration work, when i use NAS AP of cisco1200. But when i use my configuration to authenticate xp on lan network only: its not work. i saw on debug -X -A, that freeradius receive ACCES_REQUEST but when he send ACCES_CHALLENGE he cannot. on trame analysis on freerdaius, i saw that he cannot send on the port that the switch tel him to send. i m blocked on this step, and i cannot found the solution. on my configuration, i use users: "users" "password" only i havent active directory. on my switch, i dont make vlan. can some one help me. thanks for all _________________________________________________________________ Découvrez de nouvelles façons de rester en contact grâce à Windows Live! Visitez la Cité @ Live dès aujourd’hui! http://www.tonadresselive.ca/?icid=LIVEIDFRCA006

2 2