- Freeradius-Users - lists.freeradius.org

Can Session-Timeout be used to force users to re-authenticate?
by Jason Wittlin-Cohen 06 Oct '06

06 Oct '06

Is it possible to use the Session-Timeout setting to force wireless clients to re-authenticate with the RADIUS server at a given interval? Unfortunately my Acesss Point does not provide this functionality, so I either have to do it via a supplicant such as the Funk Odyssey Client or on the Freeradius server. I am running Freeradius 1.1.3 on a Debian Sarge 3.1 system and I'm using EAP-TLS for authentication. I don't think it matters but I'm using a Buffalo WHR-G54S Wireless Router with the DD-WRT v23 SP2 firmware. I am trying to force my wireless clients to re-authenticate with the RADIUS server every 30 minutes (1800 seconds) with the Session-Timeout setting. Currently I am testing with just one user, and the Session-Timeout = 1800 setting is being sent with the Radius Access Accept message (I can see it in the Accept Accept message when I run in debug mode). However, this seems to have no affect. The user does not re-authenticate at the given interval. Here's my setting from the users file: "Jason Wittlin-Cohen" Session-Timeout = 1800

2 1

freeradius bug?
by Abel Monzon 06 Oct '06

06 Oct '06

Hello, why if I have in my clients.conf this configuration: client localhost { secret = testing123 nastype = other shortname = localhost login = test password = test } and I try #radtest test test localhost testing123 say: Sending Access-Request of id 231 to 201.220.197.66 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 231 to 201.220.197.66 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host locahost:1812, id=231, length=20 Why is Access-Reject? There is a bug of freeradius? some idea?

3 4

clients
by Abel Monzon 06 Oct '06

06 Oct '06

I have a question.... Is possible no have secret for X client? Tanx, Abel

1 0

dialup_admin
by Abel Monzon 06 Oct '06

06 Oct '06

Hello, I need administer my freeradius+mysql, and I ask: There is some utility in addition to dialup_admin? Tanx

1 0

I want to use freeradius to manage my socks5 proxy
by taft 06 Oct '06

06 Oct '06

I configured a socks5 proxy. This question for me is how to authenticate users who I permit to use my socks5 proxy and account them--such as period and data flow--- I do not know how to integrate socks5 authentication and freeradius together. Is there any one have any idea or can provide me some docs. to help me. Thank you very much -- please visit my blog http://blog.csdn.net/taft

2 3

free radius ntlm_auth problem
by Andris 06 Oct '06

06 Oct '06

Hello! I sucesfully installed a free radius server with ntlm_auth, but have one problem. I have user names in Windows 2003 domain with whitespaces like 'user 1' 'user 2' (i know this is a bit lame, but they was created about years ago and be wery hard to change), these username with whitespaces ntlm_auth string won't authorize. Usernames without whitespaces authorize succesfully. When run ntlm_auth manal and write usernames like 'user 1' than work. And i want put a NT group requirment too like a 'Domain Users' ntlm_auth string is: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" How can I fix this ? Thanks! P.S. Sorry my englisg isnt perfect :) Andris

3 2

users-file overruling anything else
by florian.prester 06 Oct '06

06 Oct '06

Hi, I am using freeradius+perl+ldap. Meaning for every request I get the users information from a LDAP-Server, run it through some perl-code to distinguish some users form others for some reason (:-)). Now my problem are users not listed in the ldap-system. I want to use the users-file to overrule the ldap-system. Meaning if a user is found in the users-file and the password matches, ignore everything else. I think I had it working already, but somehow it does not work anymore! :-( My authorization-section looks as follows: authorize { preprocess chap mschap eap # # Read the 'users' file files # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap # needed to get user information perl # needed to twist the users a little bit :-) } my users-file is standard, containing: "help" Auth-Type := Local, User-Password == "support" Idle-Timeout := 30 Thanks for your help, Florian Prester

2 1

RE: Called-Station-ID and Cisco AP's
by Garber, Neal 06 Oct '06

06 Oct '06

> LAN MAC Address: 00:17:94:EE:D8:C6 > Radio 1 MAC Address: 00:17:0F:8C:25:C0 > Radio 2 MAC Address: 00:17:0F:90:25:C0 At the risk of this sounding like a stupid question... If you do a show run in enable mode, do you see a mac-address command after the radio interface (i.e., have you manually changed the MAC addr of the radio)? It is possible to manually change it: int d0 mac-address 0017.0f8c.25c1 Even if you do this, a "sh int" command will still show the real MAC address (I just tried this on one of my test APs).

1 0

RE: Called-Station-ID and Cisco AP's
by Garber, Neal 06 Oct '06

06 Oct '06

> Thanks. What version of IOS are you running? Most are at 12.3(7)JA2. Some of our newer AP's are at 12.3(8)JA.

1 0

Need a read Free Radius admin . . .
by Troy Bernier 06 Oct '06

06 Oct '06

I am looking for a real freeradius admin who knows exactly what they are doing? Should be experienced with some references. We need advise, Setup, some maint, and support. Please send me your details. -Troy msn via daknar(a)hotmail.com

1 0