- Freeradius-Users - lists.freeradius.org

differentiating radius attribute
by jerrrry＠voila.fr 01 Dec '06

01 Dec '06

Hi everybody, I'm using freeradius to authenticate and authorize users to cisco switches/routers/FW. My issue is that i want to do aaa for 3 things on the same device: device administrators login (telnet), for 802.1x EAP/MD5 (, and to manage firewall FWSM ACLs (radius attribute in the response: filter-id=acl_name). My question is how to differentiate this 3 needs by a radius attribute in the request, to be able to send in the response only the good radius authorization attribute depending on aaa type asking. Response attributes can be priv-lvl=15, filter-id=acl_name or Tunnel-Type = :1:VLAN the 3 types are configured like this on the csico devices: aaa authentification login default group radius aaa authentication 802.1x default group radius aaa authentication match acl_name interface_name radius thank tou for your help jerrrry

2 1

(no subject)
by Scott Hughes 01 Dec '06

01 Dec '06

Greetings: Are there any open source wireless clients for Windows based (2000 & XP) machines, rather than using what comes with the wireless hardware? Thank you, Scott

1 0

Mutiple Seperate nt domains
by Christian Ejlertsen 01 Dec '06

01 Dec '06

Hello all I hope this question has been asked a dozen times before. I have the following idea to a setup that I want to ask this is even possible with a freeRadius server. The scenario is multiple customers with their own windows domain servers where I want to authenticate ciscp vpn clients against the users own active directory. Hardware setup is going to be something like this, Multiple Cisco vpn clients with a single point of entry -> Cisco 4500 -> Radius Server -> multiple windows domain servers.(not in any way trusted or connected to each other). 1. a vpn client contacts the cisco box 2. the ciscop box forwards the request to the radius server for authentication. 3. the radius server somehow proxies the request to the windows domain server 4. the domain server reports back an ok to the radius server? 5. the vpn tunnel is setup. What I can understand about freeRadius is that it is possible to proxy authentication requests to other radius servers depending on domain names and other fields. Is this correct? Is this type of setup even doable with a Radius Server and if so could anyone help me in the directions of some solid howto's as I'm fairly green working with radius servers. Hope someone has some input to this type of setup. Regards Christian

2 1

radius and ethernet clients
by Norbert Grochal 01 Dec '06

01 Dec '06

I have wireless clients authorization using freeradius. Schema: Internet---linux router---access point 1 ~~~~(wds)~~~~ access point 2 ---- some wireless clinets and some ethernet clients wireless clients use wpa2/aes with eap-peap But... is it possible to authorize ethernet (not wireless) clients? Norboro

3 2

ascend-send-secret
by Fco. Javier Barrachina 01 Dec '06

01 Dec '06

Hi, I´ve installed freeradius on debian for remote access (lucent max) , authenticating users against a ldap server. The authentication looks fine, but if the user has the callback field as active, the server don´t do the callback and register the computer directly to the lan. The field Ascend-Send-Secret returns this value: rlm_ldap: Adding userpassword as Ascend-Send-Secret, value { & op=11 It seems that the Lucent don´t understand it. Any idea? Best Regards, Paco

1 0

return user group information to radius client
by ganesh subramonian 01 Dec '06

01 Dec '06

Hi I am trying to create three groups of users. I want to restrict access to functionality based on which group the user is in. For this i need to get this group information in the radius client also. Is there some standard way of telling the client that this user belongs to this group.If so how do i set this on the radius server. please help. thanks, ganesh ____________________________________________________________________________________ Do you Yahoo!? Everyone is raving about the all-new Yahoo! Mail beta. http://new.mail.yahoo.com

2 3

DEFAULT access-reject Reply-Message
by Alex M 01 Dec '06

01 Dec '06

Hi, How can I add default Reply-Message to the situation where Access-Reject was sent because of incorrect password? I looked at the user's file but it seams that I have no way to determine if access-accept or reject was sent. it only has example how to send the message to a reject group. Thanks!

2 1

Re: Problems installing
by Peter Param 01 Dec '06

01 Dec '06

ah yes. Thanks it worked. >>> steve(a)lobefin.net 12/01/06 11:21 AM >>> On Fri, Dec 01, 2006 at 10:06:07AM +1100, Peter Param said: > hi all, > > I'm trying to install FR onto a new box but am getting errors during > make. I using Linux debian 2.6.8-2-386. > > ./configure --with-openssl-libraries=/usr/local/ssl/include/openssl/ > --with-rlm-perl-lib-dir=/usr/lib/perl/ --with-snmp=no > > errors during make: > > *** Warning: Linking the shared library rlm_perl.la against the > *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not > portable! > gcc -shared .libs/rlm_perl.o -Wl,--rpath > -Wl,/root/freeradius-1.1.3/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib > /root/freeradius-1.1.3/src/lib/.libs/libradius.so -L/usr/local/lib > /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE > -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname > -Wl,rlm_perl-1.1.3.so -o .libs/rlm_perl-1.1.3.so > /usr/bin/ld: cannot find -lperl apt-get install libperl-dev -- -------------------------------------------------------------------------- | Stephen Gran | Though I'll admit readability suffers | | steve(a)lobefin.net | slightly... -- Larry Wall | | http://www.lobefin.net/~steve | in <2969(a)jato.Jpl.Nasa.Gov> | -------------------------------------------------------------------------- ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

1 0

Problems installing
by Peter Param 01 Dec '06

01 Dec '06

hi all, I'm trying to install FR onto a new box but am getting errors during make. I using Linux debian 2.6.8-2-386. ./configure --with-openssl-libraries=/usr/local/ssl/include/openssl/ --with-rlm-perl-lib-dir=/usr/lib/perl/ --with-snmp=no errors during make: *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/root/freeradius-1.1.3/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /root/freeradius-1.1.3/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.1.3.so -o .libs/rlm_perl-1.1.3.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/root/freeradius-1.1.3/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/root/freeradius-1.1.3/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/root/freeradius-1.1.3/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/root/freeradius-1.1.3/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/freeradius-1.1.3/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/root/freeradius-1.1.3' make: *** [all] Error 2 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Fail-Over to sql-lost file
by Wilmar Campos 30 Nov '06

30 Nov '06

Hello, I Just move from OpenRadius to Freeradius and I couldn't find any place to tell the accounting module to write the sql insert command into a file if the MySQL server is not available. I found a way to do it on the detail file, but not on a file to leave all the INSERT querys for later insertion. I am running freeradius 1.1.2 on a Slackweare 10.1. Kerner 2.6 Thanks for your support. Wilmar Campos

2 4