- Freeradius-Users - lists.freeradius.org

I will be out of the office from Wednesday May 30 until Monday
by along 30 May '07

30 May '07

I will be out of the office from Wednesday May 30 until Monday June 4. Please use my cell number if you require immediate assistance. You may also call the main office number (716) 893-4984 to speak with someone else. I will receive your e-mail during this period and will try to get back to you as soon as possible. Thank You. Andrew Long

1 0

I will be out of the office from Wednesday May 30 until Monday
by along 30 May '07

30 May '07

I will be out of the office from Wednesday May 30 until Monday June 4. Please use my cell number if you require immediate assistance. You may also call the main office number (716) 893-4984 to speak with someone else. I will receive your e-mail during this period and will try to get back to you as soon as possible. Thank You. Andrew Long

1 0

The EAP-TLS packet will contain more data than we can process
by Jan Schermer / ET NETERA 30 May '07

30 May '07

Hi, I'm setting up a Mikrotik wireless AP with a freeradius server behind it and EAP-TLS, client connects "fine" (those errors are meaningless, right? can I get rid of them?): Tue May 29 11:47:56 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Tue May 29 11:47:56 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Tue May 29 11:47:59 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Tue May 29 11:48:00 2007 : Auth: Login OK: [Jan Schermer/<no User-Password attribute>] (from client internal-rec port 0) but after a while, the connection is renegotiated (maybe because of weak signal), but then it starts failing: Tue May 29 12:01:12 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Tue May 29 12:01:12 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Tue May 29 12:01:16 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Tue May 29 12:01:16 2007 : Auth: Login OK: [Jan Schermer/<no User-Password attribute>] (from client internal-rec port 0) Tue May 29 12:01:41 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Tue May 29 12:01:41 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Tue May 29 12:02:42 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Tue May 29 12:02:42 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Tue May 29 12:02:44 2007 : Error: rlm_eap_tls: The EAP-TLS packet will contain more data than we can process. Tue May 29 12:02:44 2007 : Auth: Login incorrect: [Jan Schermer/<no User-Password attribute>] (from client internal-rec port 0) Tue May 29 12:02:53 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Tue May 29 12:02:53 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Tue May 29 12:02:55 2007 : Error: rlm_eap_tls: The EAP-TLS packet will contain more data than we can process. Tue May 29 12:02:55 2007 : Auth: Login incorrect: [Jan Schermer/<no User-Password attribute>] (from client internal-rec port 0) Tue May 29 12:03:08 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Tue May 29 12:03:08 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Tue May 29 12:03:09 2007 : Error: rlm_eap_tls: The EAP-TLS packet will contain more data than we can process. Tue May 29 12:03:09 2007 : Auth: Login incorrect: [Jan Schermer/<no User-Password attribute>] (from client internal-rec port 0) What might be the cause of this? I suspect that Mikrotik corrupts the packets somehow... I'm using freeradius 1.1.3-3 (debian etch version with EAP-TLS enabled) Thanks -- Jan Schermer Linux Administrator ET NETERA | smart e-business solutions jan.schermer(a)etnetera.cz +420 608022225 ~ [ www.ahold.cz | www.annonce.cz | www.datart.cz ] [ www.knizniweb.cz | www.siemens.cz | www.cz.o2.com ] Created by ET NETERA | Powered by jNetPublish

2 3

RE: Gigaword support
by eugene＠snowball.co.za 30 May '07

30 May '07

Thank you! It would be nice if FreeRadius could have more support for Gigawords built in! -----Original Message----- From: freeradius-users-bounces+eugene=snowball.co.za(a)lists.freeradius.org [mailto:freeradius-users-bounces+eugene=snowball.co.za@lists.freeradius.org] On Behalf Of tnt(a)kalik.co.yu Sent: 22 May 2007 11:15 PM To: FreeRadius users mailing list Subject: Re: Gigaword support Have a look at this: http://www.netexpertise.eu/en/FreeRadius/GigaWords.html Ivan Kalik Kalik Informatika ISP Dana 22/5/2007, "eugene(a)snowball.co.za" <eugene(a)snowball.co.za> piše: >I would like to have updated mysql querries for FreeRadius that >supports gigawords. > >Please assist. > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

I will be out of the office from Wednesday May 30 until Monday
by along 30 May '07

30 May '07

I will be out of the office from Wednesday May 30 until Monday June 4. Please use my cell number if you require immediate assistance. You may also call the main office number (716) 893-4984 to speak with someone else. I will receive your e-mail during this period and will try to get back to you as soon as possible. Thank You. Andrew Long

1 0

I will be out of the office from Wednesday May 30 until Monday
by along 30 May '07

30 May '07

I will be out of the office from Wednesday May 30 until Monday June 4. Please use my cell number if you require immediate assistance. You may also call the main office number (716) 893-4984 to speak with someone else. I will receive your e-mail during this period and will try to get back to you as soon as possible. Thank You. Andrew Long

1 0

Re: Freeradius-Users Digest, Vol 25, Issue 140
by Mati Katz 30 May '07

30 May '07

> > > > >The simple answer is don't use dynamic hosts. > > >FreeRADIUS reads the clients file once at startup, resolves the IP's and > >then stores those. It won't know about the new IP until the daemon is > >restarted (or in theory HUP'ed when that is fixed). > > >If you must use dynamic hosts, then you will need to specify an IP range > >like this: > > >client 192.168.0.0/24 { > > secret = testing123-1 > > shortname = private-network-1 > >} > > >That would allow a NAS to have any of 254 different IP's and still be > >able to talk to FreeRADIUS. It would also allow anyone else on those > >IP's who wants to talk to you NAS and can figure out the secret to > >potentially do naughty things. Thanks Dennis, i understand what you say but i thought that there is a way to use dynamic Dns because not all people have static IP , here in Israel at least. I understand that using a range of Ip is not secure , isn't it ?

2 1

I will be out of the office from Wednesday May 30 until Monday
by along 30 May '07

30 May '07

I will be out of the office from Wednesday May 30 until Monday June 4. Please use my cell number if you require immediate assistance. You may also call the main office number (716) 893-4984 to speak with someone else. I will receive your e-mail during this period and will try to get back to you as soon as possible. Thank You. Andrew Long

1 0

I will be out of the office from Wednesday May 30 until Monday
by along 30 May '07

30 May '07

I will be out of the office from Wednesday May 30 until Monday June 4. Please use my cell number if you require immediate assistance. You may also call the main office number (716) 893-4984 to speak with someone else. I will receive your e-mail during this period and will try to get back to you as soon as possible. Thank You. Andrew Long

1 0

Dynamic VLAN-id setting on wireless AP
by Jan Schermer / ET NETERA 30 May '07

30 May '07

Hi, I want to tag VLANs on the wireless AP (Mikrotik OS) according to radius criteria (type of autentization, DN in certificate etc.). Does someone here have experience with that? It seems easy enough to do on the freeradius side, but how is this supposed to work on the wireless AP side? (I know, this is not a Mikrotik mailing list, sorry in advance :). Does the AP really have to be smart enough to tag packets per-client? Should it work out of the box? Is it secure to mix clients from different security domains? Any experience appreciated, thanks -- Jan Schermer Linux Administrator ET NETERA | smart e-business solutions jan.schermer(a)etnetera.cz +420 608022225 ~ [ www.ahold.cz | www.annonce.cz | www.datart.cz ] [ www.knizniweb.cz | www.siemens.cz | www.cz.o2.com ] Created by ET NETERA | Powered by jNetPublish

3 4