- Freeradius-Users - lists.freeradius.org

RE: FreeRadius - setting up
by Min Qiu 31 Jan '06

31 Jan '06

Fedora Core 4 has prebuild rpm freeradius-1.0.4.-1.FC4.1 "yum install freeradius" will do it. Hope this will help, Min > -----Original Message----- > From: > freeradius-users-bounces+mqiu=globalinternetworking.com@lists. > freeradius.org > [mailto:freeradius-users-bounces+mqiu=globalinternetworking.co > m(a)lists.freeradius.org] On Behalf Of Timolthy Keithy > Sent: Tuesday, January 31, 2006 4:19 PM > To: freeradius-users(a)lists.freeradius.org > Subject: FreeRadius - setting up > > > Hi, I am trying to build the FreeRadius under Fedora > Core 4, I found many info on how to buil FreeRadius on > the Internet, which includes freeradius.org, and I > tried several times and different info from websites > but still without luck. > > Anyone has any info with step-by-step on how to build > the Freeradius from scratch please share or point to > where I can obtain those correct info, I would like to > set it to work with PEAP, LEAP, TLS, and TTLS. > > FreeRadius 1.x and OpenSSL, etc... > > Very appreciated in advance, > > Timolthy > > > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam protection around > http://mail.yahoo.com > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Re: New accounting database each month
by Sean 31 Jan '06

31 Jan '06

Yes. I can do that for you.

1 0

Re: Capturing the inner authentication ID for Radius
by CHui 31 Jan '06

31 Jan '06

>"CHui" <CHui(a)lbl.gov> wrote: >> Although it seems to work for me, I am not sure about the use of attribute >> Class for tracking user ID would interfere with other operation (like the > one attribute Class was originally designed for)? > > It was designed for local sites to do whatever they wanted. So you're doing the right thing. > >> Also, the attribute Class is of type Octet. Does anyone know of a way to >> convert it to text in SQL? > > Edit the dictionary, and change "octets" to "string". > > Alan DeKok. Never thought of simply changing the attribute type in the dictionary file. Works great. Thanks. I use the "use_tunneled_reply = yes" in eap.conf to capture the user name inside of the tunnel. I have observed that the Class attribute now contained both the outer identity and the user name from inside the tunnel. >From the debug output: Sending Access-Accept of id 170 to 198.128.24.10:1645 Class = "SomeoneElse" Cisco-AVPair = "ssid=CiscoTestAP" Session-Timeout = 60 Class = "chui.guest" MS-MPPE-Recv-Key = 0x... MS-MPPE-Send-Key = 0x... EAP-Message = 0x03070004 Message-Authenticator = 0x... User-Name = "SomeoneElse" Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 198.128.24.10:1646, id=112, length=262 Acct-Session-Id = "0600000000000204" Called-Station-Id = "0014.a800.44c0" Calling-Station-Id = "0002.2d27.05e2" Cisco-AVPair = "ssid= CiscoTestAP" Cisco-AVPair = "vlan-id=0" Cisco-AVPair = "nas-location=unspecified" User-Name = "SomeoneElse" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "708" NAS-Port = 708 Class = "SomeoneElse" Class = "chui.guest" Service-Type = Framed-User NAS-IP-Address = 198.128.24.10 Acct-Delay-Time = 0 In the users file, I have the default entry as follows: DEFAULT Class = "{User-Name}", Fall-Through = No What should I do to get the Tunnel user name only instead of both send as reply attribute "Class"? Thanks Cedric

2 1

Accounting status type
by Priscilla B 31 Jan '06

31 Jan '06

Hi, just short question. Where should I put the acct-status-type? is it in users file? Many thanks Priscilla __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

rlm_perl
by Chris Knipe 31 Jan '06

31 Jan '06

Hi, Is there any way to get rlm_perl to work with binary code, instead of source? I currently have a perl script executing via rlm_perl that does some fancy stuff in authentication and accounting. Due to popular demand, I now have 3rd parties interested in this code, but I don't feel it is secure enough to provide these vendors with the open source perl code. I don't believe I can accomplish with rlm_exec what I do in rlm_perl, so I'm kinda hoping that someone would have a solution here for me that would allow rlm_perl (or a similar module perhaps), to execute compiled code. Hope I make sense, and that someone can shed some light and pointers for me. Thanks, Chris.

4 4

Stop current session.
by ujin 31 Jan '06

31 Jan '06

How to disconnect on SNMP current session on NAS if the user it is authorized and to be on-line. I think it it is possible to make 1. To use rlm_perl and in parameter acounting will specify a script which to disconnect on snmp session. Whether and there are still variants?

1 0

why encryption schemes for pap
by DilipSimha.N.M 31 Jan '06

31 Jan '06

hi, why are encryption schemes for pap required? it is supposed to be clear-text under all circumstances right??? we can see in radiusd.conf.. # PAP module to authenticate users based on their stored password # # Supports multiple encryption schemes # clear: Clear text # crypt: Unix crypt # md5: MD5 ecnryption # sha1: SHA1 encryption. # DEFAULT: crypt pap { encryption_scheme = crypt } so why is this required?? --DilipSimha

2 1

problems with encryption_scheme in radiusd.conf file
by DilipSimha.N.M 31 Jan '06

31 Jan '06

hi, in the radiusd.conf file... under modules/pap encryption_scheme variable can be set to any value, and has no effect!!! what is it used for??? i tried.... encryption_scheme=clear and put in users file: netd Crypt-Password = 12NKz5XM5JeKI Service-Type = Framed-User but this also works!!!! how can encryption-scheme=clear allow crypt passwords??? (so if it supports all methods, then what is the need of this variable?) --DilipSimha

2 1

Radius acct info to SQUID
by Shain Lee 31 Jan '06

31 Jan '06

Hello , Can we parse , radius accounting information to a proxy directly ? please help Thank you, Shaine. --------------------------------- Win a BlackBerry device from O2 with Yahoo!. Enter now.

1 0

Calling-Station-Id in EAP/PEAP ??
by Norbert Grochal 30 Jan '06

30 Jan '06

Hi! Is it possible to use verification of Calling-Station-Id in EAP/PEAP ? My users file: foo Auth-Type := EAP, User-Password == "mypass", Calling-Station-Id == "0123456789ab" and I have an error: rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select When I use := insteed of == in Calling-Station-Id == "anything" then freeradius always authorize me, so I think it doesn't chceck it... -- Norboro

3 3