- Freeradius-Users - lists.freeradius.org

RE: Error with free radius, as5800, and ascend data types
by Guy Davies 23 Nov '05

23 Nov '05

Oh, thanks for setting me straight, Chris :) Sounds like a pretty doomed idea to have non-standard uses of the supposedly RFC defined attributes. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Chris Parker Sent: 23 November 2005 15:53 To: FreeRadius users mailing list Subject: Re: Error with free radius, as5800, and ascend data types Cisco has an option to accept the non-standard Ascend attributes ( note, NOT the VSA's but the early Ascend attempt to use higher numbered standard attributes ). In regards to the original poster, does the filter value work if you use it in a 'users' file syntax? Also, what version of FreeRADIUS? -Chris On Nov 23, 2005, at 9:45 AM, Guy Davies wrote: > Why would FreeRADIUS return Ascend VSAs to a Cisco AS5800? I would > only expect it to return values that are either RFC attributes or > Cisco VSAs. > > Rgds, > > Guy -- Chris Parker Director, Engineering StarNet A Service of US LEC (888)212-0099 Fax (847)963-1302 Wholesale Internet Services http://www.megapop.net VoiceEclipse, The Fresh Alternative http://www.voiceeclipse.com NOTICE: Message is sent IN CONFIDENCE to addressees. It may contain information that is privileged, proprietary or confidential. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

RE: Error with free radius, as5800, and ascend data types
by Guy Davies 23 Nov '05

23 Nov '05

Why would FreeRADIUS return Ascend VSAs to a Cisco AS5800? I would only expect it to return values that are either RFC attributes or Cisco VSAs. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Matt Sent: 23 November 2005 15:12 To: freeradius-users(a)lists.freeradius.org Subject: Error with free radius, as5800, and ascend data types Hi, We have this radius-reply-attribute in our radius configuration (free-radius): ip in forward tcp est However, when someone dials up to our as5800 it generates this error: > rlm_sql: Failed to create the pair: failed to parse Ascend binary > attribute: Unknown string "est " in IP data filter est seems to be a valid Ascend attribute.. any ideas? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

3 2

User Authentication via Websitewith Apache
by Konne 23 Nov '05

23 Nov '05

hi i would like to authenticate my user via apache-ssl over a website where the user must fill in his AD username and password. only if this is correct he can access the internet. my question is, if this is possible. an what i have to use that this would be secure. like the traffic between client-ap-freeradius. eap-tls? peap/mschapv2 ... i have no idea... pls help me :-) thx Konne

3 2

www.freeradius.de - Forum
by Konne 23 Nov '05

23 Nov '05

hi, i found a freeradius forum for germans... http://www.freeradius.de ciao Konne

1 0

RE: Freeradius How to integrate Active Directory [AD IntegrationWindowsXP NTLM Tutorial]
by King, Michael 23 Nov '05

23 Nov '05

Thank you. I'm a relative new Debian addict, so I was unaware of the repercussions. I learned something today, time to go home. :-) I'll throw that into my notes. Based on the list activity in the last few days, I'm hoping to reformat, and make clearer my notes. Seems there is a need for it. Someone mentioned setting up a Wiki. I'd actually prefer that, since people can fix my mistakes. :-) > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > I don't recommend this method to the Debian users, because it > confuses dpkg about the files installed on the system and > it's not possible to uninstall the files later. I think it's > a lot better to build FreeRADIUS from sources using dpkg-buildpackage. > > $ tar zxf freeradius-1.0.5.tar.gz > $ cd freeradius-1.0.5 > $ fakeroot dpkg-buildpackage -b -uc > $ sudo dpkg -i ../freeradius_1.0.5-0_i386.deb > >

1 0

multiple 'users' files possible?
by Arne Götje (高盛華) 23 Nov '05

23 Nov '05

Hi list, is it possible with freeradius to use multiple 'users' files for authentication? For example having users devided by department and different administrators are allowed to edit only their own users file? My customer requests to use text files instead of a database... I know that a database would be the more professional solution... *sigh* Cheers Arne -- Arne Götje (高盛華) <arne(a)linux.org.tw> PGP/GnuPG key: 1024D/685D1E8C Fingerprint: 2056 F6B7 DEA8 B478 311F 1C34 6E9F D06E 685D 1E8C Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

3 6

RE: tool for testing machine authentication
by Gunther 23 Nov '05

23 Nov '05

Johan Ramm-Ericson wrote: >Hi, >having just recently succesfully setup freeradius and being somewhat >frustrated with the documentation, I >felt there may be someway I could contribute to improve it. A while back there was a thread on the mailinglist to the effect of setting up a Wiki. Has this seen any progression? If not, I'll be glad to put >in some effort to get this done. >Also, I'm willing to pitch in on writing the documentation, however my freeradius experience is so recent >that I'd probably only be able to do any good with well-defined tasks... I set up an empty wiki a few weeks ago with the intention to start a FreeRadius wiki. http://s92562228.onlinehome.us/wiki ... it is still empty ... Gunther

1 0

Clients.conf attributes, multiples users files.
by Breuer Nicolas 23 Nov '05

23 Nov '05

Hello all, I wouldlike to have only one instance of freeradiusd but with multiples "users" files. For the moment i've differents process of freeradiusd with multiples users files. I think that it's not possible for the moment but do you think it can be a possible feature for the future ? I think the easiest way is to configure the name of the auth files into the clients.conf NAS1 : file: users NAS2 : file: users2, etc.. With this type of config, we can easily manage multiple type of users/ auth with one radiusd on one port.. Nico

2 1

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by King, Michael 23 Nov '05

23 Nov '05

Hi Robin > -----Original Message----- > > I have one Debian specific error > > rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot > open shared object file: No such file or directory > radiusd.conf[9]: eap: Module instantiation failed. > > it seems that the shared object is not shipped when I did > apt-get install freeradius Ignore the freeRADIUS package. Due to license restrictions, it cannot contain the binaries for OpenSSL. We have to use the source. Download the latest release of freeRADIUS Unzip freeRADIUS Tar -zxvf freeradius-1.0.5.tar.gz Switch to the directory then ./configure --disable-shared make make install You can look at my notes if you want: http://www.mpking.com/articles.php?lng=en&pg=55 These are not a howto, just my notes to myself as I built this config 3 or 4 times in a row. Couple of notes... The krb5.conf and the samba.conf files are not perfect. They don't take advantage of the fact samba can do a DNS lookup for the activedirectory server. Like I said, they're just my notes.

2 1

Cache with proxy
by Romain GAILLEGUE 23 Nov '05

23 Nov '05

Hi, I have recently installed two freeradius servers one in server mode with MySQL authentication and an other in proxy mod. But sometime the connexion between the two servers is broken. I would like to know if it's possible to have a cache on the proxy ? Thanks Romain

2 2