- Freeradius-Users - lists.freeradius.org

problem with Dell connection manager?
by Matt Ashfield 02 May '07

02 May '07

HI All We are running our wireless using FR to authenticate against LDAP. A user can login on a laptop, no problem, but when he then goes to a Dell laptop which uses a Dell Connection Manager program, it fails. The odd thing is is that in both cases there is an Access-Accept packet going out, except for the Dell, it does not assign a vlan (which is probably why it's failing). Since it's the same userID loggin in, I'm not sure why the vlan is not being passed. The only thing I can see is that the username field in the Access-Request is preceeded by "\\" in the case of the Dell, and not so in the case of the working laptop. Here's the Access-Request from the one that works: rad_recv: Access-Request packet from host 172.17.0.1:20001, id=166, length=144 NAS-Port-Id = "2049/1" Calling-Station-Id = "00-15-E9-D9-94-85" Called-Station-Id = "00-15-E8-E0-E6-00:Wireless@UNB" Service-Type = Framed-User EAP-Message = 0x02010008016d6461 User-Name = "mda" NAS-Port = 4596 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 172.17.0.1 And here is the Access-Request from the one that does not work (notice the username field): rad_recv: Access-Request packet from host 172.17.0.1:20001, id=161, length=146 NAS-Port-Id = "2049/1" Calling-Station-Id = "00-13-02-77-97-CB" Called-Station-Id = "00-15-E8-E0-E6-00:Wireless@UNB" Service-Type = Framed-User EAP-Message = 0x02010009015c6d6461 User-Name = "\\mda" NAS-Port = 4593 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "nortel" NAS-IP-Address = 172.17.0.1 In both cases there is an access-accept, but vlan is only returned in the case of the first one. Any ideas on a workaround? Thanks for any advice. Cheers Matt Ashfield mda(a)unb.ca

2 2

Re : EAP-TTLS PEAP MCHAPv2
by Eshun Benjamin 02 May '07

02 May '07

I have appended the intermediate cert to the server cert but I got the same result. ----- Message d'origine ---- De : "Reimer Karlsen-Masur, DFN-CERT" <karlsen-masur(a)dfn-cert.de> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 2 Mai 2007, 9h40mn 59s Objet : Re: EAP-TTLS PEAP MCHAPv2 Hey. Append all intermediate CA certificates onto the end of the file specified with the "certificate_file" option in the eap.conf files eap->tls section. This file usually hold your RADIUS server certificate and can additionally hold the chain certificates as well. Eshun Benjamin wrote: > > I am using an enterprise certificate which has intermediate CA. The root > CA is well known (verisign) and already on the MAC keychain access(3.3) > by default. MAC recognises the certificate and its validity but > complains of "The server certificate is not trusted because there > are no explicit trust settings". If I click continue or always trust it > works fine but I want to get rid of this prompt without clicking > continue or always trust to give it smooth and uninteractive log on. -- Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

EAP-TTLS PEAP MCHAPv2
by Eshun Benjamin 02 May '07

02 May '07

Any one has an idea of how to get rid of "The server certificate is not trusted because there are no explicit trust settings" on MAC OSX 10.4.9 without selecting "always trust these freecertificate" ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

4 3

Re : EAP-TTLS PEAP MCHAPv2
by Eshun Benjamin 02 May '07

02 May '07

I am using an enterprise certificate which has intermediate CA. The root CA is well known (verisign) and already on the MAC keychain access(3.3) by default. MAC recognises the certificate and its validity but complains of "The server certificate is not trusted because there are no explicit trust settings". If I click continue or always trust it works fine but I want to get rid of this prompt without clicking continue or always trust to give it smooth and uninteractive log on. ----- Message d'origine ---- De : Guy Davies <aguydavies(a)gmail.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 30 Avril 2007, 20h54mn 41s Objet : Re: EAP-TTLS PEAP MCHAPv2 Or, if you're using an Enterprise CA with a self signed cert, then make sure that the CA's cert is installed on your Mac. I do this at home and it's fine once you've installed the CA's cert. Rgds, Guy On 30/04/07, Peter Nixon <listuser(a)peternixon.net> wrote: > On Mon 30 Apr 2007, Eshun Benjamin wrote: > > Any one has an idea of how to get rid of > > "The server certificate is not trusted because there are no explicit > > trust settings" > > > > on MAC OSX 10.4.9 without selecting "always trust these freecertificate" > > Yep. Buy a certificate that your machine trusts :-) > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

Re: No available IP Addresses in the pool ...
by Florin 02 May '07

02 May '07

Hi Thibault, Hi Alan, Thank you very much for coming back to me on this. > If not, confirm that the pool module name is defined in > the acctounting{} section of radiusd.conf and that your > NAS sends accounting Stop messages. The accounting is performed on a different machine (physically) so no poolname is be defined under the acctounting{} section. Which also means that the machine I have problems with will never see accounting packets. For some security reasons outside of my control, this setup cannot be changed. I'll have a look at the rlm_ippool_tool tool. Thanks. > I wonder what it would take to convince RedHat to use a > version that wasn't almost THREE YEARS out of date. Will the latest version of freeradius **really** help in this scenario ? How ? Could it automatically free up IP addresses from the pool based on a timer ? I cannot go "astray" from RHEL binaries and compile a new freeradius version on a production server (24x7x365) without a hell of a good reason. I hope you can understand me. Thanks again guys and I am looking forward for your opinions :-) Regards, Florin

3 2

Different Groups
by Norman Zhang 02 May '07

02 May '07

Is there a way to set FreeRADIUS to authenticate against specific group of users for certain devices. For example, DEFAULT Auth-Type = System Fall-Through = Yes, cisco-avpair = "shell:priv-lvl=1", Service-Type = NAS-Prompt-User DEFAULT Group == router-rw cisco-avpair := "shell:priv-lvl=15" DEFAULT Group == fw-admin cisco-avpair := "shell:priv-lvl=15" Can I have the PIX to authenticate only against group fw-admin? Norman

2 3

Configure freeradius with authentication
by vicente barrientos 01 May '07

01 May '07

2 1

Help stuck on error: rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf
by shrikant Bhat 01 May '07

01 May '07

How did u resolve this issue? thanks SB

3 2

Howto Freeradius+Authentication, help me.
by vicente barrientos 01 May '07

01 May '07

1 0

Re: SQL for return attributes only?
by Hugh Messenger 30 Apr '07

30 Apr '07

Phil Mayers <p.mayers(a)imperial.ac.uk> wrote: > Hugh Messenger wrote: >> Is it possible with freeradius to use SQL to retrieve certain return >> attributes (in this case rate limiting values for PPPOE sessions), >> whilst still handling authentication through PAM? > > > Yes. Great! Thanks for the pointers, very much appreciated. I got the basic AD authentication going with pam/winbind, about to dive head first into the SQL docs, armed with your suggestions and a powerful need to get this going by Friday. No doubt I'll be back soon with more questions, but I'll give it The Good Old College Try before I bug you any more. -- hugh

1 0