- Freeradius-Users - lists.freeradius.org

RE: EAP questions
by Garber, Neal 01 Dec '06

01 Dec '06

> I have tested the signal strength possibility and that is not the issue. Anything useful in the AP logs? Also, do you have a laptop with a spectrum analyzer that can look for interference from other radio sources?

1 0

Re: (no subject)
by Stefan Winter 01 Dec '06

01 Dec '06

Hi, > Are there any open source wireless clients for Windows based (2000 & XP) > machines, rather than using what comes with the wireless hardware? Several. My favourite is at http://www.securew2.com. . Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

5 5

RE: differentiating radius attribute
by Garber, Neal 01 Dec '06

01 Dec '06

> I'm using freeradius to authenticate and authorize users to cisco switches/routers/FW. > My issue is that i want to do aaa for 3 things on the same device: device administrators login (telnet), for 802.1x EAP/MD5 (, and to manage firewall FWSM > ACLs (radius attribute in the response: filter-id=acl_name). Does this help: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg312 30.html If not then run freeradius in debug mode and look at the request attributes for each type of authentication. Then, you can configure it to process each type of authentication based upon the differences in attributes passed.

1 0

RE: DEFAULT access-reject Reply-Message
by Garber, Neal 01 Dec '06

01 Dec '06

> How can I add default Reply-Message to the situation where Access-Reject was sent because of incorrect password? > I looked at the user's file but it seams that I have no way to determine if access-accept or reject was sent... it only has example how to send the message to a reject > group. If you're using LDAP, it already creates a Module-Failure-Message request attribute upon failure. Also, I submitted bug 398 which Alan incorporated into CVS head to provide the same functionality for MS-CHAP (I assume this will be in FR 1.1.4). You could execute a Perl script in a reject section of post_auth that looks for this request attribute and, if found, set the Reply-Message reply attribute. If you're using a different authentication method, it may be possible to change the code to accomplish what you want. As someone else pointed out, it's not a good idea to tell someone they entered the wrong password as it makes brute-force password attacks easier (because you're telling them the userid is valid). I believe ntlm_auth gives a generic (invalid userid or password) response to a bad password. If the response you see is too specific, you may want to obfuscate it.. Here's an example of what you would put in radiusd.conf (this assumes you have a sub in your perl script called post_auth_reject): modules { . . . perl set_reject_message { module = /usr/local/etc/raddb/set_reject_message.pl func_post_auth = post_auth_reject } . . . } . . . post-auth { Post-Auth-Type REJECT { set_reject_message } }

2 1

differentiating radius attribute
by jerrrry＠voila.fr 01 Dec '06

01 Dec '06

Hi everybody, I'm using freeradius to authenticate and authorize users to cisco switches/routers/FW. My issue is that i want to do aaa for 3 things on the same device: device administrators login (telnet), for 802.1x EAP/MD5 (, and to manage firewall FWSM ACLs (radius attribute in the response: filter-id=acl_name). My question is how to differentiate this 3 needs by a radius attribute in the request, to be able to send in the response only the good radius authorization attribute depending on aaa type asking. Response attributes can be priv-lvl=15, filter-id=acl_name or Tunnel-Type = :1:VLAN the 3 types are configured like this on the csico devices: aaa authentification login default group radius aaa authentication 802.1x default group radius aaa authentication match acl_name interface_name radius thank tou for your help jerrrry

2 1

(no subject)
by Scott Hughes 01 Dec '06

01 Dec '06

Greetings: Are there any open source wireless clients for Windows based (2000 & XP) machines, rather than using what comes with the wireless hardware? Thank you, Scott

1 0

Mutiple Seperate nt domains
by Christian Ejlertsen 01 Dec '06

01 Dec '06

Hello all I hope this question has been asked a dozen times before. I have the following idea to a setup that I want to ask this is even possible with a freeRadius server. The scenario is multiple customers with their own windows domain servers where I want to authenticate ciscp vpn clients against the users own active directory. Hardware setup is going to be something like this, Multiple Cisco vpn clients with a single point of entry -> Cisco 4500 -> Radius Server -> multiple windows domain servers.(not in any way trusted or connected to each other). 1. a vpn client contacts the cisco box 2. the ciscop box forwards the request to the radius server for authentication. 3. the radius server somehow proxies the request to the windows domain server 4. the domain server reports back an ok to the radius server? 5. the vpn tunnel is setup. What I can understand about freeRadius is that it is possible to proxy authentication requests to other radius servers depending on domain names and other fields. Is this correct? Is this type of setup even doable with a Radius Server and if so could anyone help me in the directions of some solid howto's as I'm fairly green working with radius servers. Hope someone has some input to this type of setup. Regards Christian

2 1

radius and ethernet clients
by Norbert Grochal 01 Dec '06

01 Dec '06

I have wireless clients authorization using freeradius. Schema: Internet---linux router---access point 1 ~~~~(wds)~~~~ access point 2 ---- some wireless clinets and some ethernet clients wireless clients use wpa2/aes with eap-peap But... is it possible to authorize ethernet (not wireless) clients? Norboro

3 2

ascend-send-secret
by Fco. Javier Barrachina 01 Dec '06

01 Dec '06

Hi, I´ve installed freeradius on debian for remote access (lucent max) , authenticating users against a ldap server. The authentication looks fine, but if the user has the callback field as active, the server don´t do the callback and register the computer directly to the lan. The field Ascend-Send-Secret returns this value: rlm_ldap: Adding userpassword as Ascend-Send-Secret, value { & op=11 It seems that the Lucent don´t understand it. Any idea? Best Regards, Paco

1 0

return user group information to radius client
by ganesh subramonian 01 Dec '06

01 Dec '06

Hi I am trying to create three groups of users. I want to restrict access to functionality based on which group the user is in. For this i need to get this group information in the radius client also. Is there some standard way of telling the client that this user belongs to this group.If so how do i set this on the radius server. please help. thanks, ganesh ____________________________________________________________________________________ Do you Yahoo!? Everyone is raving about the all-new Yahoo! Mail beta. http://new.mail.yahoo.com

2 3