- Freeradius-Users - lists.freeradius.org

Which authentication system?
by Ian Truelsen 28 Mar '07

28 Mar '07

I am trying to figure out the various authentication systems available and decide what is best for my setup. I am looking for advice. Here is what I want to do: This is for the marina that I am at and a group of 10 of us wanted internet, invested in the hardware and want to be able to access the system without logging in or anything like that. For this group, I was thinking of EAP-TLS as client side certificates would not be a problem. Being a marina, we get people in from time to time - mostly in the summer - who are only going to be there for a week or so and just want to check email or whatever. For these, I don't want to be dealing with client side certs as this raises the amount of time that I have to be administering the system exponentially. I was thinking of something along the lines of chillispot, but I have never been able to get that going, and I don't know whether the two systems can co-exist on the same AP. So, does anyone have any thoughts on what would be the best auth system to go with? I should also mention that I already have a varied group of systems to deal with, including Mac OS X, Win XP, linux and a couple of Win ME systems, so support has to be pretty broad. Thanks in advance. -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

2 1

Res: NAS-IP-Address
by Erico Augusto 28 Mar '07

28 Mar '07

well, I don't know what chillispot means until now ... googling it I can say that my application acts like that. why? thanks, Erico. ----- Mensagem original ---- De: Internet-Wifi Operador <internet-wifi(a)hotmail.com> Para: freeradius-users(a)lists.freeradius.org Enviadas: Terça-feira, 27 de Março de 2007 15:37:03 Assunto: RE: NAS-IP-Address Hi, Are you using Chillispot or something like that? Fabián >From: Erico Augusto <ericosign(a)yahoo.com.br> >Reply-To: FreeRadius users mailing list ><freeradius-users(a)lists.freeradius.org> >To: freeradius-users(a)lists.freeradius.org >Subject: NAS-IP-Address >Date: Tue, 27 Mar 2007 11:14:19 -0700 (PDT) > >Hi, > >i) during Authentication phase, NAS-IP-Address attribute is filled with >correct IP. >During Post-Auth, NAS-IP-Address is filled with loopback 127.0.0.1 Address >... >Is it possible to send the correct NAS-IP-Address during Post-Auth? How is >it possible? > >Thanks, Erico. > > > > > > >__________________________________________________ >Fale com seus amigos de graça com o novo Yahoo! Messenger >http://br.messenger.yahoo.com/ >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html _________________________________________________________________ Exercise your brain! Try Flexicon. http://games.msn.com/en/flexicon/default.htm?icid=flexicon_hmemailtaglinema… - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

2 1

NAS-IP-Address
by Erico Augusto 28 Mar '07

28 Mar '07

Hi, i) during Authentication phase, NAS-IP-Address attribute is filled with correct IP. During Post-Auth, NAS-IP-Address is filled with loopback 127.0.0.1 Address ... Is it possible to send the correct NAS-IP-Address during Post-Auth? How is it possible? Thanks, Erico. __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

3 2

RFC 4590 Compliant?
by Kevin J 28 Mar '07

28 Mar '07

Hi, I just noticed a email thread http://arcknowledge.com/gmane.comp.freeradius.devel/2006-11/msg00040.html Any update on it? Can we say FreeRadius is RFC 4590 compliant? Kevin ____________________________________________________________________________________ Don't get soaked. Take a quick peek at the forecast with the Yahoo! Search weather shortcut. http://tools.search.yahoo.com/shortcuts/#loc_weather

2 1

Failed to link to module "rlm_name" : file not found
by lishuai zhao 28 Mar '07

28 Mar '07

Hi, everyone: I added a new module named rlm_name to FreeRADIUS and produced makefile as rlm_example, also I add rlm_name to src/modules/stable. When I do ./configure; make; make install, all the process are sucessful. If I do not use module rlm_name, the radius sever can run normally. But when I add rlm_name in the modules {} of radiusd.conf and run ./radiusd -X, it says Failed to link to module "rlm_name" : file not found. All the .la .lo and .a files generated can be found in /usr/local/lib. I have been searching mailing list for a long time, but every method is useless to me. Any one can help me? Thank you very much!

2 2

Using Radius for SIP accounting
by Murray Hooper 27 Mar '07

27 Mar '07

Is there a way to get telephony disconnect cause ie "User busy" in radius accounting? I am using a Cantata IMG1010 and looking for a more telephony based result that "service unavailable". Any suggestions? Thanks murray

3 2

dialupadmin url hash problem
by Holger Goßmann 27 Mar '07

27 Mar '07

Hi, i have freeradius/mysql/dialup_admin running with one problem i cannot solve. I've already searched the web and the archives and cannot find the answer. The interface is running fine except for users containing a hash "#" in the name, for example user1#domain. All other users which do not contain this character are working fine. I can search the database using the find.php3 script to get the list of all users, but if i try to edit one using the link provided by the search page, the interface returns "user name [user1] does not exists" because of the hash in the url. I think it is interpreted as location hash. Example: https://127.0.0.1/radius/user_admin.php3?login=user1#domain The request in the access log of the webserver is just https://127.0.0.1/radius/user_admin.php3?login=user1 thats why dialup_admin cannot find the user. If i enter the username into the edit user field it is working. The same problem exists when trying to use the "administer selected user" button in the show group menu. Anyone already had this problem or any ideas how to solve it? Versions: freeradius 1.0.2-4sarge3 freeradius-dialup_admin (tried from 1.1.3-3 up to 1.62) mysql 4.0.24-10sarge2 regards, Holger

2 1

Re: LDAP + CHAP problem
by Sam Schultz 27 Mar '07

27 Mar '07

> I have implement freeradius with LDAP + cisco VPDN my problem > is my authentication working with PAP but when i try for authentication > from CHAP it is not working error is password not clear text so i have > read many document about it and ppl talking about store passwd in > clear text but also i have ass passwd in clear text still it is not > working As I understand it, (open)ldap doesn't ever divulge the password in hash form or otherwise to freeradius. That is, the authorization & authentication is done by the ldap server, which returns valid or invalid for the credentials freeradius proxied. There may be a way to make this work, but I wouldn't know how. MSCHAP, or MSCHAPv2 can be made to work via samba's winbind daemon, if you have access to an active directory domain. -- Click for free info on online doctorate degrees and make $250k/ year http://tagline.hushmail.com/fc/CAaCXv1ZYZ31cCIxIwDH31ZLLgc9RVOq/

1 0

Proxy Radius
by Luis Galan 27 Mar '07

27 Mar '07

Hello! I need to configure freeradius as a proxy server only for users that ends in "@domain1.com". This users must be authenticated by its home server (external proxy) but users must received an ip address from my pool. (We give internet service to customer from another country with its dialup username , some kind of roaming service) For the rest of users it should authenticate itself. Then I have configured the following: proxy.conf: # Realm for domain1.com realm domain1.com { type = radius authhost = radius.domain1.com:1812 accthost = radius.domain1.com:1813 secret = mysecret nostrip } radius.conf: proxy_requests = yes $INCLUDE ${confdir}/proxy.conf modules{ . . . files { usersfile = ${confdir}/users } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = yes } . . . } authorize { . . . suffix . . files . . } preacct { . . suffix . . files } pre-proxy { files } Users: DEFAULT Suffix="domain1.com", Pool-Name := "mypoolDialup" Service-Type = Framed-User, Framed-Protocol = PPP, Service-Type = Framed-User, Framed-Routing = Broadcast-Listen, Framed-Compression = Van-Jacobson-TCP-IP, Fall-Through = Yes Is it correct?

1 0

RE: How to send the accounting messages
by Josh Howlett 27 Mar '07

27 Mar '07

> Also can you please tell me how to send different accounting messages. Consult your NAS documentation. josh.

1 0