- Freeradius-Users - lists.freeradius.org

Re: problem with NT-Password and LDAP
by Ana Gallardo Gómez 28 Dec '06

28 Dec '06

>Ana Gallardo Gómez wrote: >> Hello, my problem is, i have a Freeradius server that retrieves the >> authentication information from an OpenLDAP server; in this server the >> NT-Password atributte has 252 characters (32 characters from NT-hash + >> white spaces) >Why not just update the entries in LDAP to remove the space? >Alan DeKok. Well, I can not modify the LDAP server, I only can use it, so, while I ask the LDAP administrator to modify this atribute, I would like to modify in Freeradius server. I have read that there is a module to rewrite the value of an atribute on fly, but I can´t find how to use it. I have a regular expression to modify... I have a ssript perl to modify... but I don´t know how to use it. Thank you _________________________________________________________________ Consigue el nuevo Windows Live Messenger http://get.live.com/messenger/overview

2 1

RE: proxy authentication
by Dubi Lego 28 Dec '06

28 Dec '06

Our solution is to provide lawful information, according to a Court request on user's activity on the net. In order to do that we need to intercept their AAA activity and the actual data activity. The problem we are having is to collect the AAA activity for Authentication. We have found the way to forward the accounting data from the RADIUS to our RADIUS proxy and so we are notified on Session Start and Session End, but we need also to be notified on any attempt of a user to authenticate through the RADIUS. Are you familiar with any solution to do that? Thanks in advance for your help, Dubi -----Original Message----- From: freeradius-users-bounces+dlego=allot.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+dlego=allot.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, December 27, 2006 9:33 PM To: FreeRadius users mailing list Subject: Re: proxy authentication Dubi Lego wrote: > I will clarify my question. > Is it possible to forward all AAA messages including replies to another > server which will only listen to messages and won't be active. The short answer is that RADIUS doesn't do that. I'm not aware of *any* server, WWW, FTP, DNS, or otherwise that can do this. What you can do is to log all of the requests & responses to a "detail" file, and then copy that file somewhere else. Perhaps you might try explaining *why* you want this solution. What problem are you trying to solve? Why do you believe that this solution is the best one for the problem? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 3

Deploying Radius Blog site
by King, Michael 28 Dec '06

28 Dec '06

Alan, Your deploying radius blog site is showing: MySQL error! Error establishing a database connection! (Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2)) 1. Are you sure you have typed the correct user/password? 2. Are you sure that you have typed the correct hostname? 3. Are you sure that the database server is running?

3 2

Ola lista!
by Marcao Nacional 27 Dec '06

27 Dec '06

Ola lista, Gostaria de saber se tem algume brasileiro nessa lista! _________________________________________________________________ Insta-le já o Windows Live Messenger. A nova geração do messenger. http://get.live.com/messenger/overview

1 0

Can't compile modules rlm_eap_peap and rlm_eap_tls
by adreas Polyxronopoulos 27 Dec '06

27 Dec '06

Hi everybody , I am trying to set up freeradius-1.1.3 and to support PEAP/MSCHAPV2 i need to compile 2 modules which aren't build with ./configure ,make , make install. These modules are rlm_eap_peap and rlm_eap_tls in /usr/local/src/freeradius-1.1.3/src/modules/rlm_eap/types/ directory. Then i do : root@apolyxrono2:/usr/local/src/freeradius-1.1.3/src/modules/rlm_eap/types/rlm_eap_peap# ./configure and the output is: checking for OpenSSL support... no configure: WARNING: silently not building rlm_eap_peap. configure: WARNING: FAILURE: rlm_eap_peap requires: OpenSSL. configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged I have installed libssl0.9.8 , libssl-dev and openssl . Can anyone help me because i don't have a lot of time !!! thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com ___________________________________________________________ Try the all-new Yahoo! Mail. "The New Version is radically easier to use" – The Wall Street Journal http://uk.docs.yahoo.com/nowyoucan.html

2 1

RE: proxy authentication
by Dubi Lego 27 Dec '06

27 Dec '06

I will clarify my question. Is it possible to forward all AAA messages including replies to another server which will only listen to messages and won't be active. -----Original Message----- From: freeradius-users-bounces+dlego=allot.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+dlego=allot.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, December 26, 2006 6:48 PM To: FreeRadius users mailing list Subject: Re: proxy authentication Dubi Lego wrote: > Is it possible to proxy all authentication messages to specific remote > server including replies (Access-Reject, Access-Accept)? What do you mean by that? Proxying normally involves forwarding client requests to another server, and returning replies from that server back to the client. What you seem to be asking for is something else entirely. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

automated response
by Olaf Becker 27 Dec '06

27 Dec '06

I am currently out of the office and will return January 2.

1 0

problem with NT-Password and LDAP
by Ana Gallardo Gómez 27 Dec '06

27 Dec '06

Hello, my problem is, i have a Freeradius server that retrieves the authentication information from an OpenLDAP server; in this server the NT-Password atributte has 252 characters (32 characters from NT-hash + white spaces), and the NT-Password generated in ms-chap has 32 characters. How can I remove the white spaces from NT-Password in the ldap module?Debug information:...rlm_ldap: performing search in ou=xxx,dc=xxx,dc=xxx, with filter (cn=xxxx) rlm_ldap: Added password xxx in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding ntPassword as NT-Password, value 06B11E3D941021E1A5C51C6868F2F0E6 & op=21...After that "LOGIN INCORRECT".Sorry for my english.Thank you very much. _________________________________________________________________ ¡Ya está aquí Windows Live Spaces! Ahora podrás crear fácilmente tu propio sitio Web. http://spaces.live.com/signup.aspx

2 1

Re: Questions from a totally ignorant n00b
by Gene Mosley 26 Dec '06

26 Dec '06

Alan, I read the FAQ section which you posted (http://wiki.freeradius.org/index.php/FAQ#How_do_I_deny_access_to_a_specific…) It talks about denying access to a specific user, or a group of users - which is not what I need. I need to deny access to specific IP addresses - not specific users. Anyone from any IP address should be able to authenticate (which is the default) - but nobody should be able to authenticate from specific IP addresses. If I have servers: 10.11.12.1 10.11.12.2 10.11.12.3 10.11.12.4 Then Bob should be able to authenticate from all of them - UNLESS for some reason I wanted to block authentication from 10.11.12.4 - then what would I need to do in order to make it so that anyone trying to authenticate from 10.11.12.4 would be rejected (again, based on the IP address, not their user name or group)? ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, December 21, 2006 3:22:12 PM Subject: Re: Questions from a totally ignorant n00b Gene Mosley wrote: > > What I am looking for is to allow a user ("bob") to authenticate > from any system he uses UNLESS that system is blocked from authenticating. Perhaps you could try reading the FAQ entry I pointed to earlier. It tells you how to do exactly that. > It seems that AIX RADIUS cannot do this - can FreeRADIUS? Have you been reading my responses? > Can FreeRADIUS be configured to allow/disallow authentication based > on the source IP address that the user is coming from and NOT the user > account itself (allowing "bob" to authenticate from "server1" which is > not 'banned', but not allowing "bob" to authenticate from "server2" > which is 'banned')? > And, if so - how? Go read my messages, and the FAQ entry I posted? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

proxy authentication
by Dubi Lego 26 Dec '06

26 Dec '06

Hi all, Is it possible to proxy all authentication messages to specific remote server including replies (Access-Reject, Access-Accept)?

2 1