- Freeradius-Users - lists.freeradius.org

eap authentication and cpu utilization
by Norbert Wegener 21 Feb '08

21 Feb '08

Simple authentication with login/password can be handled in large numbers with a recent cpu and freeradius. . EAP authentication on the other hand requires a great amount of cpu processing. Therefore I have a simple(?) question: Did someone already calcute the theoretically maximum number of eap authentications per second, that a recent x86 cpu is able to handle? Or did someone some practical research on that issue? Norbert Wegener

3 8

migrating from files to ldap
by Stieven.Struyf＠komatsu.eu 21 Feb '08

21 Feb '08

I am looking to migrate from text files to an ldap directory. What is the best/easiest way to do this: -setup ldap, copy all data to the ldap from the start -setup ldap and gradually migrate (is it possible to have part of the clients in flat files and others in ldap?) "This e-mail is property of the company and is supposed to contain only professional content. The company can at all times consult the content of this e-mail and the reply to this e-mail. By replying to this e-mail, you confirm your explicit agreement with the preceding." "Deze e-mail is het eigendom van de Vennootschap en wordt verondersteld enkel beroepsmatige informatie te bevatten. De Vennootschap kan ten allen tijden de inhoud van deze e-mail en van het antwoord daarop raadplegen. Door het beantwoorden van deze e-mail bevestigt U uitdrukkelijk uw akkoord met het voorafgaande."

1 0

howto freeradius with ldap
by Nikolay G. Petrov 20 Feb '08

20 Feb '08

I read a included document about freeradius to ldap, but I a forigner and difficult undersand content. Can we suggest a any content with example, how can I use group to ldap? Thanks!

2 1

Cisco AV-PAIRS
by David W Bell 20 Feb '08

20 Feb '08

Hi there. My Saga continues.... I have freeRADIUS working with openLDAP and can log into CISCO kit and pass the priv-level from the raddb/users file. Is there any way that this information can be passed from the openLDAP user details instead? I am looking to do a single-signon system and it seems a little awkward to have to change a password (as is required in the users file) in 2 locations. Thanks David

5 12

dynamic tagged and untagged vlan assignment
by Stieven.Struyf＠komatsu.eu 20 Feb '08

20 Feb '08

All, Currently i use this configuration to assign clients an ip after successfull authentication (mac authentication): user User-Password == "password" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-id = "20" This works, but now we are deploying a cisco iptel solution. The phones need to be in a tagged vlan instead of an untagged. Can i make this distinction based on radius attributes? regards, Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 "The question of whether a computer can think is no more interesting than the question of whether a submarine can swim." -- E. W. Dijkstra "This e-mail is property of the company and is supposed to contain only professional content. The company can at all times consult the content of this e-mail and the reply to this e-mail. By replying to this e-mail, you confirm your explicit agreement with the preceding." "Deze e-mail is het eigendom van de Vennootschap en wordt verondersteld enkel beroepsmatige informatie te bevatten. De Vennootschap kan ten allen tijden de inhoud van deze e-mail en van het antwoord daarop raadplegen. Door het beantwoorden van deze e-mail bevestigt U uitdrukkelijk uw akkoord met het voorafgaande."

3 4

Pharmacy mall: discount pric!
by freeradius-users＠list.xs4all.nl 20 Feb '08

20 Feb '08

1 0

Regex Ldap Group
by Rohaizam Abu Bakar 20 Feb '08

20 Feb '08

FR: 1.1.2 Openldap 2.3.X I tried to do regex match in Ldap-Group. From below users file, The "NAS-Identifier" regex works OK but for Ldap-Group match, it's not working as below DEBUG log. value to match (jarService = Y5-IPOH, NAS-Identifier=Y5-IPOH) Users file ======= NAS-Identifier =~ "Y5", ldapmain1-Ldap-Group =~ "Y5", Autz-Type := Y5 radiusd.conf ========= ldap ldapmain1 { .............. groupname_attribute = jarService groupmembership_filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" } Debug: ===== rlm_ldap: performing search in ou=CUSTOMER,ou=People,dc=xxxxx,dc=xx, with filter (&(jarService=Y5)(&(uid=bacang)(objectclass=radiusprofile))) rlm_ldap: object not found or got ambiguous search result --haizam

3 3

Re: PEAP/EAP-TTLS acquires DEFAULT reply attributes via outer identity
by Gong Cheng 20 Feb '08

20 Feb '08

I found myself not knowing how to reply directly from the post, but here is a thank you to Ivan and Phil, that works for me! thanks. -gong ----- Original Message ---- From: Gong Cheng <chengg11(a)yahoo.com> To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, February 19, 2008 3:14:13 PM Subject: PEAP/EAP-TTLS acquires DEFAULT reply attributes via outer identity Hi folks, I am working on an issue like this: In my users file, I have user1 attribute1=val1 user2 attribute2=val2 DEFAULT attribute1=def_val1 attribute2=def_val2 My intention is that - for individual users, like user1 and user2, I will get individual attributes I specified in their dedicated entries, - and for everybody else, I will get a default set of attributes. That has a problem with the 2-phase EAP methods like PEAP/EAP-TTLS. The reason is, in the first phase, the outer Identity, say "anonymous", is used and it hits the DEFAULT entry and acquires the default set of attributes, and then it proceeds to phase 2 and acquires the individual attributes. In the end, freeradius will combine the two together. So, for example, user1 will get attribute1=def_val1 attribute2=def_val2 attribute1=val1 Is there any way so that for the individual users won't acquire any attributes from DEFAULT when using methods like PEAP/EAP-TTLS? A naive solution is to put a check of DEFAULT User-Name != "anonymous" .... but it is not a reliable way since there is no guarantee that the outer id is "anonymous". I wonder if there is another way to check this in DEFAULT or if there is any other different trick to do this? thanks! -gong

1 0

PEAP/EAP-TTLS acquires DEFAULT reply attributes via outer identity
by Gong Cheng 19 Feb '08

19 Feb '08

Hi folks, I am working on an issue like this: In my users file, I have user1 attribute1=val1 user2 attribute2=val2 DEFAULT attribute1=def_val1 attribute2=def_val2 My intention is that - for individual users, like user1 and user2, I will get individual attributes I specified in their dedicated entries, - and for everybody else, I will get a default set of attributes. That has a problem with the 2-phase EAP methods like PEAP/EAP-TTLS. The reason is, in the first phase, the outer Identity, say "anonymous", is used and it hits the DEFAULT entry and acquires the default set of attributes, and then it proceeds to phase 2 and acquires the individual attributes. In the end, freeradius will combine the two together. So, for example, user1 will get attribute1=def_val1 attribute2=def_val2 attribute1=val1 Is there any way so that for the individual users won't acquire any attributes from DEFAULT when using methods like PEAP/EAP-TTLS? A naive solution is to put a check of DEFAULT User-Name != "anonymous" .... but it is not a reliable way since there is no guarantee that the outer id is "anonymous". I wonder if there is another way to check this in DEFAULT or if there is any other different trick to do this? thanks! -gong

3 2

how can I configure CHAP or PAP
by Sarp Kaya 19 Feb '08

19 Feb '08

Hello, how can I do it I don't know. I am using Antcor OS router and it has hotspot settings. I also have a pc which has ubuntu. and I installed Freeradius 1.1.6-2 but my router cannot connect to freeradius. How can I solve this?

2 3