- Freeradius-Users - lists.freeradius.org

Autoreply: Many simmultaneos connection with Mysql - VOIP
by gparlato＠tnet.it 09 Aug '06

09 Aug '06

Attualmente non sono in sede. Per richieste urgenti contattare lo 800 919299 o inviare una mail a info(a)tnet.it oppure a padova(a)tnet.it. Cordiali Saluti Giuseppe Parlato Area Network mailto:gparlato@tnet.it

1 0

Autoreply: Re: EAP identity - username check
by gparlato＠tnet.it 09 Aug '06

09 Aug '06

Attualmente non sono in sede. Per richieste urgenti contattare lo 800 919299 o inviare una mail a info(a)tnet.it oppure a padova(a)tnet.it. Cordiali Saluti Giuseppe Parlato Area Network mailto:gparlato@tnet.it

1 0

Autoreply: Re: Unresponsive child
by gparlato＠tnet.it 09 Aug '06

09 Aug '06

Attualmente non sono in sede. Per richieste urgenti contattare lo 800 919299 o inviare una mail a info(a)tnet.it oppure a padova(a)tnet.it. Cordiali Saluti Giuseppe Parlato Area Network mailto:gparlato@tnet.it

1 0

EAP identity - username check
by Carl Wahlin 09 Aug '06

09 Aug '06

Hello,We are trying to get machine certificates to with freeradius for WLAN.Problem:We are using the sql user database plugin as we need to return attributes (which vlan the user belongs to, QoS etc) and it all works fine untill we install the certificates as machine certs. Windows changes the User-Name to host/username and that causes the username not to be correct according to what is in the database, and also the User-Name does not match the cn in the cert. We can change the attribute with search and replace, but then EAP gives us the error "identity does not match the User-Name, setting from EAP Identity". Is there a way around this? It would be nice to be able to turn off the EAP identity - User-Name check as we really do not think it is necesary in our solution (and do not really see a security benifit of having it).Any ideas?/Carl _________________________________________________________________ Try Live.com - your fast, personalized homepage with all the things you care about in one place. http://www.live.com/getstarted

3 2

several values check
by Ruslan N. Marchenko 09 Aug '06

09 Aug '06

Hi all. Maybe its a dummy question, but i wonder, if i can supply several values to check for Access-Request? I mean following: i create a user, add Framed-IP-Address to radcheck for this user (i realy mean this user should have fixed address) and then i include this user to two groups. Each group has Service-Type attribute in radgroupcheck table, one group has value == Call-Check, while other ==Login-User. Requests with Service-Type = Login-User passes authorize section(it has lower id so compares first), but Call-Check fails with "module "sql" returns notfound for request" Is this correct behaviour and i should not use such approach? Or i can make freeradius to do that? One more question is - how to use nas table for clients? i use postgresql as a backend. -- Olimp, System Administrator IT Dept. 8 062 381-34-28 ---- Looking forward to reading yours. MRN-RIPE RUFF-EUNIC RUFF-6BONE Ruslan N. Marchenko

1 0

Bandwidth control...
by Wagner 09 Aug '06

09 Aug '06

What the best solution for "Bandwidth control + freeradius" for a WISP?... can i use freeradius to set this? what i need ? How work? Tks so much Wagner Caixeta Rodrigues

3 2

Answer
by Stefan Winter 08 Aug '06

08 Aug '06

> Does Freeradius have the ability to use multiple nodes in similar fashion > to name servers? An example of this would be a situation when the master > freeradius server is down for some reason, but the slave freeradius > server(s) continue to grant & deny access but do not receive any updates > until the master is back up. You can simply set up more than one FreeRADIUS instance. Then you have to tell your clients that more than one authentication server exists - pretty much the same as with DNS. But as with DNS, you should pay attention on how your clients will recover in case of a failure. Some may for example eternally use the "slave" even when the "master" is back up again. The reasons I use quotes is that there is no concept of superiority of one server vs. the other - they are just two equal alternatives to the client. For the "won't receive any updates" I'm not sure what you mean. > Also, if there are any HOWTO or example configurations of this type of > setup, those would be very helpful. Just setup the server twice (ideally both using _one_ authentication backend, e.g. a mySQL db on a different host that both can access) and tell your client devices about it. Greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche - Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg

3 2

Question
by Scott Hughes 08 Aug '06

08 Aug '06

I've searched around for a few weeks now and can't seem to find a clear answer to this question: Does Freeradius have the ability to use multiple nodes in similar fashion to name servers? An example of this would be a situation when the master freeradius server is down for some reason, but the slave freeradius server(s) continue to grant & deny access but do not receive any updates until the master is back up. Also, if there are any HOWTO or example configurations of this type of setup, those would be very helpful. Thanks in advance, Scott

4 4

Confused with FreeRadius + Win2000 + Linksys + EAP + Certs
by Alexandros Gougousoudis 08 Aug '06

08 Aug '06

Hi, I'am working on a FreeRadius Setup für our network since 3 weeks and I get more and more confused, even after days of RTFM. If someone could help me, I'd owe you a beer. :-) This is what I want to do: We have a Linksys Switch which can be an AP for Radius. If a PC is authenticated the Port of the Switch will work. I want to install a certificate on every PC in our network. The Supplicant should contact the AP using eap and the AP the Radius-Server (I use freeradius 1.1.0 on Suse 10.1). So the PC should have access to the network, regardless of the user which will work on it. I configured Freeradius' eap.conf to use TLS, did all certificates and installed it on the client and server. radiusd -X -A does't report an error. All Servers and Clients are in the DNS. The problem is, if I setup the authentification with EAP-Type "Smartcard or Certificate" in W2K simply nothing happens, there is no request coming to the radius server, nor an error message on the client. If I configure on the client PEAP with protected Password (and say that it should not use the Windows-Logonname in the EAP-MSCHAPv2 Dialog) I get a logon-screen and can authentify the computer (I've put a dummyuser in users files) and I see the conversation in the server-debug. If I say it should use the Windowslogonname, again nothing happens to the radius server (there is even no request to that server). I even took SecureW2 to test, with the same result. I'm doing something terribly wrong, but what could it be? Every hint is welcome! In the future I want to check also in our LDAP-Directory (we have a Samba-Domain there) if the computer exists in the domain and only then accept the certificate for authentification. But I'am lightyears away from it, did anybody do this before? thanks in advance Alex -- ServiceCenter IT - Alexandros Gougousoudis (Leiter) Gemeinsame Einrichtung der Kunsthochschule Berlin-Weissensee, Hochschule für Musik "Hanns Eisler" und der Hochschule für Schauspielkunst "Ernst Busch". Tel.: 030 / 477 05 - 444 * Fax.: 030 / 477 05 - 445

3 3

Error: TLS_accept:error in SSLv3 read client certificate A
by Özgür Kaya 08 Aug '06

08 Aug '06

Hi everybody My radius server version is 1.04 My kernel 2.6.15.1 Debian The server gave following errors: Tue Aug 8 09:55:55 2006 : Info: rlm_eap_tls: Received EAP-TLS ACK message Thank you -ozgur Tue Aug 8 09:56:26 2006 : Info: rlm_eap_tls: Length Included Tue Aug 8 09:56:26 2006 : Error: TLS_accept:error in SSLv3 read client certificate A

1 0