- Freeradius-Users - lists.freeradius.org

Certificates in RADIUS and EAP-TLS
by Adam Rogalski 30 Apr '06

30 Apr '06

Hi folks I was writing my thesis (about security policy in town concil) and I thougt about using RADIUS and EAP-TLS. What can I do when I dismiss someone who got his own certificate from my CA, Can I do something to block him on my radius serwer, becouse when I was making this I didn't saw option to do this best regards Adam

2 1

RE: freeradius and active directory
by King, Michael 29 Apr '06

29 Apr '06

Yes. It's called ntlm_auth You need samba installed to use it, and join the freeradius computer to the domain. (Yes, you can join Linux to an active directory domain) > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Philippe Bacquaert > Sent: Friday, April 28, 2006 4:08 PM > To: freeradius-users(a)lists.freeradius.org > Subject: freeradius and active directory > > Hello, > > Are there any tool to connect freeradius to an active > directory (kerberos and MS Ldap attributes) ? > And in this case, what is your opinion about that kind of link ? > > Thanks in advance, > Philippe Bacquaert > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Missing line in Makefile
by Dennis Skinner 28 Apr '06

28 Apr '06

I also noticed this last time and forgot about it until I was just recompiling with --enable-developer. The Makefile seems to be missing a line like this: $(INSTALL) -d -m 755 $(R)$(libdir) It probably doesn't cause any problem if you use the default prefix, but if the directory doesn't exist, make install gets angry when it tries to put files there. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

2 1

parameters to use the attribute Reply-Message
by Philippe Bacquaert 28 Apr '06

28 Apr '06

Hello, I'm searching for a list of parameters to use in the reply attribute : "Reply-Message". I've only found the example in the "users" file : %u for the UserName Thanks in advance, Philippe Bacquaert

2 1

freeradius and active directory
by Philippe Bacquaert 28 Apr '06

28 Apr '06

Hello, Are there any tool to connect freeradius to an active directory (kerberos and MS Ldap attributes) ? And in this case, what is your opinion about that kind of link ? Thanks in advance, Philippe Bacquaert

1 0

appending things to User-Name before auth
by Christopher Carver 28 Apr '06

28 Apr '06

Hello, I'd like to append @domain.com to every username before the authentication step. I have been trying to use attr_rewrite to do this but I've been unsuccessful. Is this the proper module to use? Has anyone done this before? Thanks in advance, Chris Carver

3 3

external ldap with cisco-avpair
by Nuno Reis 28 Apr '06

28 Apr '06

Hi, I use freeradius for wireless authentication, for several ssids. I have the following config on the users.config: USER User-Password == "******" Service-Type = Shell-User, cisco-avpair = "shell:priv-lvl=15", cisco-avpair+= "ssid=wifi1", cisco-avpair+= "ssid=wifi2", cisco-avpair+= "ssid=wifi3" This config permits a single sign-on solution, using the same database for wireless authencation and administrative rights. Now I want to make a integration with an external ldap, for example, active directory, however I dont have a clue how to preserve the cisco-avpairs. Should be the ldap to send it to the freeradius on every authentication request? -- View this message in context: http://www.nabble.com/external-ldap-with-cisco-avpair-t1525517.html#a4143540 Sent from the FreeRadius - User forum at Nabble.com.

2 1

Re: prepaid cards
by Sean 28 Apr '06

28 Apr '06

Hi Morder, Why don't you create a page that allows your users to change their username and password themselves. This would be very easy to do with PHP. For example a user logs on to your site with his PIN code and password and you present him/her with an option to change his details. By the way if your users are using cell/mobile phones you could add to the security by sending an SMS message that includes a confirmation code that they would need to complete the update. Regards, Sean http://swarmhotspots.com > Thanks Yves but i tried phpmyprepaid and it is a hackof dialup admin and not > realy stable , what i want is a way to let the user to be able to change his > pin code to a username for example : from 15478855 -> mark password :Zx43ed > -> stealit > > pin and password are stored in the database > > any ideas? > thanks > On 4/27/06, YvesDM <ydmlog(a)gmail.com> wrote: > > > > > > > > On 4/27/06, Mordor Networks <mordor.networks(a)gmail.com> wrote: > > > > > Hi > > i want to make prepaid system for my dialup users ex: username : 15789546 > > password 123456 > > How i can make freeradius change the pin code to a valid username in my > > database ? > > i use mysql as a backend for my radius > > ppp/pppoe > > and dialup admin > > thank u > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > Well there is something out there called phpmyprepaid which is made for > > that purpose. > > I have no experience with it, but maybe you can give it a try. > > > > Yves > > > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > >

2 1

dual-streaming interim accounting for high volume
by Tariq Rashid 28 Apr '06

28 Apr '06

hi, under high load, we are familiar with the usual problem of dropped accounting packets. this leads to retires and timeouts and possible "marked dead", either by the NAS or intermediate radius proxies. this problem is particularly pronounced when a proxy used to sent traffic to multiple home servers, one of which is slow/unresponsive. this can lead to that proxy as being seen as "dead" by many NASes. a solution would be to split the accounting radius flow, such that the proxy or other freeradius server replies immediately with an acknowledgement to the NAS, and then forwards the packet onto the target home server, not necessariy waiting for a response. a more intelligent approach may fast reply with cached replies such that rejects can be effective. illustrated: 1. [NAS] ---> acct ---> [proxy] 2. [NAS] <--- acct <--- [proxy] ----> acct ---> [target radius server] is this possible, or likely to be possible with freeradius? i know about a mechanism which uses a second process to tail the radius accounting log files, but this is fragile and prone to inconsistencies. tariq

2 1

send detail log to syslog server?
by Maqbool Hashim 28 Apr '06

28 Apr '06

Hi, Is it possible to get freeradius to send detail log data to a syslog server? Thanks

2 1