- Freeradius-Users - lists.freeradius.org

access-challenge
by Srinivasa Rao Chigurupati 01 Aug '05

01 Aug '05

Hi 1. Will FreeRadius challenges with access-challenge if auth-type is PAP? If answer is it depends on some configuration, how to configure it? 2. How FreeRadius understands incoming Radius access-request packet contains PAP authentication information, CHAP authentication information or MS-CHAP authentication information or other authentication information? -- Thanks Srinivasa Rao Chigurupati

2 3

System requirements
by alfonso celestino 01 Aug '05

01 Aug '05

Hi, Can someone help me with the following problem? I need a freeradius Server for a wireless network with Approximately 15,000 users with Approximately 2,000 simultanous users and I need to know which are the system requirements(like CPU, Memory, Processor,...) for a good server performance. thanks in advance Alfonso Celestino DGSCA, UNAM ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

2 1

WRT54GS (sveasoft) with Freeradius 1.0.2
by Rajeev Pokkyarath 01 Aug '05

01 Aug '05

Hello! I am trying to use Linksys WRT54GS with Firmware_Alchemy-6.0rc3lw031 (sveasoft) against my freeradius server (1.0.2). Basically trying to setup a hotspot scenario. But eventhough I enter a valid username/password in the login page, I am not able to login. I ran the radius server in the debug mode and I see that the server is sending the Access-Accept packet (I also notice that it is re-sending it). Instead of my freeradius server, I tested against the server hosted by chillispot, (https://radius.chillispot.org/radius/) (freeradius?) and it seems to be working fine. Any thoughts that might lead me to the right direction? or any known issues? Cheers! ____________________________________________________ Start your day with Yahoo! - make it your home page http://www.yahoo.com/r/hs

2 1

OFF-TOPIC - ISDN and 56k modem users
by Kinetix 01 Aug '05

01 Aug '05

Has anyone ever used an eicon diva card for a dial-up server?? I have setup such a server using a DIVA 4BRI card in a Redhat box with mgetty 1.1.33 and pppd-2.4.3 Everything worked OK for the modem users. The dial-up server sent a NAS-Port-Type = Async to the radius server But when I tried with ISDN users I saw that the NAS-Port-Type that the dial-up server sent to radius was Async again Has anyone any idea on how to make pppd send the correct type of NAS-Port-Type to the radius server?

1 0

RE: authenticate machine accounts with ntlm_auth
by martin.p.bradley＠bt.com 01 Aug '05

01 Aug '05

>> j.cluzel wrote: >> Is it possible to authenticate a machine account with ntlm_auth ? >No. AD does not permit that. > Alan DeKok. I'm very frustrated now after spending a couple of weeks trying to get free radius to authenticate my Win2k machine accounts against active directory. :-( Alan, do you know of any way to get this working. I have been assured that Funk can do this, have you any idea how Funk are doing it. Funk costs too much. Maybe I'm not allowed to ask such questions. Regards, Martin.

5 5

Cisco WAP 1200 Accounting for 802.1X PEAP
by Colleen Morrissey 01 Aug '05

01 Aug '05

I am having difficulty getting my Cisco APs (all 1230s) to send accounting information regarding 802.1x PEAP authentications - stop/start info. Does anyone have this working? If so can you please post the AP config. I currently have the following: aaa accounting network eap_methods start-stop group rad_acct I get radius accounting information for exec on the APs (people logging directly into the AP), but not for wireless authentications. So I know I have the radius server and config setup correctly. Thanks Colleen

2 1

Authenticate as computer - Windows XP
by israel＠topazio.com 01 Aug '05

01 Aug '05

Hi, In IAS we do a policy that contain: host/*.teste.com How I can do this in Freeradius for authenticate computer account, striping the computer name for search in OpenLdap. Thanks

2 1

Computer Authentication problem
by israel＠topazio.com 01 Aug '05

01 Aug '05

Hi, I have Samba with backend for password's OpenLDAP. I want to know if there is a way to work with realm configuration based on "host/fqdn", example: host/israel.teste.com Conform example, I do search in OpenLdap based in username "uid", that is "israel". If somebody can help me, I will very thanks. Thanks.

2 1

accounting 'detail' file and EAP
by Kris Benson 01 Aug '05

01 Aug '05

Hi all, So I have FreeRadius set up (and working) to authenticate off an LDAP installation. Everything is great. I even have EAP-TTLS/PAP working, so I don't have to store the plaintext passwords. I just have one problem now: accounting data. Since I'm using TTLS, the User-Name field is not the authenticated one, and is simply whatever the user chose to put in for the outside-the-tunnel username. Has anyone come up with a way to either A) ensure the outside username matches the inside one (guaranteeing the outside one isn't falsified) or B) log the accounting details with the tunnel information? Any help would be appreciated -- thanks in advance. -kb -- Kris Benson, CCP, I.S.P. Technical Analyst, District Projects School District #57 (Prince George)

2 1

newbie questions using freeradius as wifi access point
by Will Carter 30 Jul '05

30 Jul '05

Hi, First, sorry for the long post... I am new to radius in general and freeradius and am attempting to set up a credit card based wifi access point where you can buy time to surf the internet for certain alotments of time. The configuration should kick them off when their alloted paid for time expires and redirect them to a web page so that they can buy more time. I have some questions the progress we have made and would very much appreciate any information anyone could provide. I apologize for any ignorance or assumptions about how the set up would work, as I am just fumbling through. I have set up freeradius on a linux server and I have it successfully talking to a mySQL database that has radcheck, radreply, radacct tables, etc. I am able to use the natradping utility to get accept/reject messages from it based on entries in radcheck. I have a NAS device (nomadix ag-2000w) that I can get it to correctly recognize a wireless laptop and authenticate against entries in the radius database. I am sending a session-timeout attribute in my reply message and my nas is correctly coming up with an expiration time based on that. Basically my process is like this. Login: 1. I have a separate database from radius that authenticates the user's login/password. I delete all rows from from radcheck for this user. I delete all rows from radreply for this user. I add back a radcheck record and radreply session-timeout record that corresponds to how much time left that they have paid for. Now I log them in (using an xml command to my nas). My nas correctly reports the expire time based on the session-timeout that I inserted. After the user is logged in, I add another row to radcheck that is an auth-type reject. This is so that when the nas time expires and it tries to reauthenticate with radius, it will get a reject message and not allow surfing to continue. I believe this is the wrong way to be doing things and I think radacct is the table for this but I do not understand how that table fits in or if the nas device is supposed to be inserting into radacct or what. My question here is that should I be using radacct in some way to influence the reject/accept response when the session times out for the user. By the way, if the user tries to login again, they wont be hit with the auth-type reject in their response because I am clearing out radcheck and radreply first. User is trying to add time: I update my non-radius database with how much time they have purchased. I log the user out of my nas device (using an xml command). I delete everything from radcheck and radreply for this user. I add back a radcheck record for this user. I add a session-timout record to radreply for this user that corresponds to how much additional time they just purchased. I log the user back in, resyncing the nas with the session-timeout in radius. After they are logged in again I add back a auth-type reject to radcheck so that when their time runs out again they will be kicked off. The underlying problem with this set up is that the order of the logout/login/insert reject into radcheck bits seem not to happen in order. I am issuing xml commands to my nas to do the login/logout. So sometimes it seems that the logout happens after the login xml command or the login happens after the reject row is inserted, effectively blocking the user incorrectly. Basically, I would like some advice as to where I am going wrong in the process and what is the correct way that radacct comes into play. I have my nas set up to have accounting enabled and I see radacct getting written to but I don't understand how AcctStartTime, AcctStopTime comes into play although that looks interesting. Any guidance here would be great. Thanks for any info or direction you can provide. -will

3 26