- Freeradius-Users - lists.freeradius.org

unsubscribe
by Atmesh.Srivastava＠t-systems.com 22 Nov '06

22 Nov '06

1 0

automated response
by along 22 Nov '06

22 Nov '06

I will be out of town from Tue 11/21 at 5pm until the morning of Monday November 27. If this is an emergency, you may contact Chris Hart-Nova at <chartnova(a)escapewire.com>. I will have limited access via mobile phone at (716) 830-5169. Have a nice holiday.

1 0

NTLM_Auth will not work from within FreeRadius
by Neal Bullins 21 Nov '06

21 Nov '06

Hey All, I am trying to configure FreeRadius (on Debian) to authenticate against Samba. Running NTLM_Auth from the command line results in a valid login. However FreeRADIUS call to ntlm_auth results in a Logon failure. From the command line I run: /usr/bin/ntlm_auth --request-nt-key --domain=MyDom --username=radtest (MyDom is not the actual Domain but still works when I use it in place of the actual domain???) And then I enter the correct password and the result is “NT_STATUS_OK: Success (0x0)”. The debug output from freeradius is: Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain=MyDom --username=radtest --challenge=3bdc9461e268b957 --ntresponse=d618ee49ab97f0ea5cc9c491904dbbbea5a56eb5c9cc0608 Exec-Program output: Logon failure (0xc000006d) I would assume that there is some sort of problem with the creation of the challenge/response but that is difficult to test. I have tried two different usernames/passwords and both combinations result in the same error. Any suggestions? Thanks

3 3

Help needed on FreeRadius SQLCounter
by sagar.patil＠bt.com 21 Nov '06

21 Nov '06

Hi All, I have got sqlcounters working with mysql database. I want to sell 15 mins, 30 mins, 1 hour, 2 hour vouchers and I want Freeradius to lock all users who even use 1 min of their voucher time every 24 hours. The vouchers are valid only for 24 hours after logging into network first time. The current options for reset= never & daily which don't work for me. Daily= Will reset midnight and allow user to login next day Never = Will allow user to use time forever until he exceeds "session-timeout" value. Thanks, Sagar

3 2

rewriting usernames
by Christopher Carver 21 Nov '06

21 Nov '06

Hello, How do I rewrite the value of the User-Name attribute based on Called-Station-Id? I need to do a series of these logical decisions and replace the username with username@<some-isp.com> based on what the value of Called-Station-Id is. rlm_attr_rewrite seems the obvious choice, but I can't figure out how to use various instances of that module only when Called-Station-Id has a certain value. It seems like a strange thing to need to do, but I've thought about our problem and this is really the only scalable way. I can give a lot of background as to why, but I figured I would ask the question first. So, does anyone have any ideas? Also, thank you for all the hard work on Freeradius. Its a great piece of software. Thanks Chris Carver

4 9

Filtering strange character sequences out of usernames
by Barry A Byrne 21 Nov '06

21 Nov '06

Hello The user names arriving at Freeradius from the server has strange character sequences in them. For instance, the user's realm starts with =3D28 Is there a way of filtering out or converting these sequences to something human-readable? Thank you Barry Barry A Byrne Network Applications and Public Services Cable & Wireless Direct Dial: +44 (0) 1344 812046 Mobile: +44 (0) 7900 164 620 Switchboard: +44 (0) 20 7206 5555 <http://www.cw.com/> www.cw.com

2 1

LDAP and SQL
by Tobias Hug 21 Nov '06

21 Nov '06

I'm authenticating wireless users with freeradius against an os x ldap server. This works all well. But I also want to check if the device (mac address) is allowed to connect. How do I configure Freeradius to Authenticate Users against ldap and check the mac address in an SQL-Database? Thanks Tobias

2 1

distinction between users on different AP (talking to the same radius server)
by liran tal 21 Nov '06

21 Nov '06

Hey everyone, I was just wondering for your opinion on this issue- I want to spread several access points in different locations (they all talk to a central radius) and then i want to distinct one location from another for example user foo can login from either location but id like to make the distinction from which ap he got connected from... whats the best way to do that? I was thinking of one method which is to configure in each AP a different subnet mask for the DHCP allocations and then make the distinction based on that but I'm looking for a more elegant way. Thanks guys, Liran.

3 5

Re: huntgroups question
by Michael Mitchell 21 Nov '06

21 Nov '06

Frank Cusack wrote: > On November 21, 2006 8:48:30 AM +1100 Michael Mitchell wrote: > >> >> dial Client-IP-Address =~ 192.168.1..* >> dsl Client-IP-Address =~ 192.168.2..* > > > > warning, the first of those captures 100 /24's, the second 56 /24's. > Ahh yes, so it does. Thanks for pointing that out Frank! But the example still stands, you can do regular expressions in the huntgroups file - just be careful with your regular expressions. :) cheers, Mike

1 0

Re: huntgroups question
by Michael Mitchell 21 Nov '06

21 Nov '06

Alexandru Dincov wrote: > knows if there are any limitations in huntgroups size? Are there other > solutions to have huntgroups functionality (access control based on > NAS-IP-Address or Client-IP-Address) using IP address ranges? Hi Alex, You can do regular expression matches in the huntgroups file. For example: dial Client-IP-Address =~ 192.168.1..* dsl Client-IP-Address =~ 192.168.2..* Maybe that can get you close to what you want? Oh and by the way, these types of questions should be asked on the FreeRADIUS Users list. cheers, Mike

2 1