- Freeradius-Users - lists.freeradius.org

Re: Proxy EAP-TTLS inner auth type
by Sayantan Bhowmick 03 Jun '05

03 Jun '05

Thanks for your help Alan. I will try this setup. -Sayantan >>> aland(a)ox.org 06/02/05 11:12 PM >>> "Sayantan Bhowmick" <sbhowmick(a)novell.com> wrote: > This talks about PEAP. Is the same possible for EAP-TTLS? Yes. > Also i could not find any information about the attribute > "proxy_tunnel_request_as_eap" mentioned in the previous mail. > Can someone please point me to any documentation on how to > configure the server to terminate the tunnel and proxy the > inner auth type. The server terminates the tunnel by default. To proxy the inner session, do: DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := "foo" Which will proxy the inner session, as-is, to realm "foo". The "proxy_tunnel_request_as_eap" is strictly for PEAP, and if set to "no", the code converts EAP-MSCHAPv2 to plain old MSCHAPv2, before proxying it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Authenticate to eDirectory
by carnold5＠nc.rr.com 03 Jun '05

03 Jun '05

Thanks for the replies. >>This is also noted on the main web page: http://www.freeradius.org Sorry about that, it seems i overlooked that :) >>See 1.0.2, which includes eDirectory integration. OK, so i uninstalled the 0.9.3 version and i downloaded the tarball and followed the instructions to compile and install v1.0.2. When i ran ./configure, i ran it with the --with-edir option. This process ran for awhile; i did see some warnings during this step but the process did not stop. Then i ran make, no options; i did see some warnings during this step but the process did not stop. Now, during the make install step i did see some warning and errors but again, the process did not stop. When it did complete, i see "error:radiusd not found". Indeed, when i do a search for raddb, i see a folder in usr/local/raddb. The weird thing is, there are 0 files in this folder. When i search for radiusd.conf, no file found. When i go to the shell prompt and type radiusd, command not found. Anybody got any ideas?

1 0

(no subject)
by Rupak 02 Jun '05

02 Jun '05

Hello ALL I am interested in installing dialup admin.I am currently running freeradius-1.0.2 with mysql that ships with redhat9.and chillispot for wireless authentication.i wanted to know where can I find good configuration resources that would help me install dialup-admin. I checked the how to's under /dialupadmin/docs/*.But did'nt find it friendly.It was specifying to create a data base named "radius".But I have already created a database named "radius" when I installed radius with mysql support.Now I don't wanna proceed until I am confident. So please help me with some resources. Thanking You Rupak

1 0

ldap.attrmap problem
by pieter.hotting 02 Jun '05

02 Jun '05

I'm using freeradius 1.0.2 to translate Radius request from a Cisco VPN server to eDirectory via LDAP. This works fine, but I'm facing problems when I try to use translation via ldap.attrmap. In the file I have defined the following: replyItem CVPN-3k-Groups rADIUSDialAccessGroup When I look at a datascope to the interaction between FreeRadius and eDirectory I see correctly the response rADIUSDialAccessGroup --> cn=E_VPN_Clients_1,ou=RmtAcc,ou=SERVICES,o=AN. However if I look at the output of radius I see: rlm_ldap: looking for reply items in directory... rlm_ldap: Adding rADIUSDialAccessGroup as CVPN-3k-Groups, value cn & op=11 This tells me that for some reason the response is stripped at the '=' sign. Can anyone point me in the right direction what I'm doing wrong? Thanks, Pieter

2 1

radclient: received response to request we did not send.
by Juan Nin 02 Jun '05

02 Jun '05

Hi, I'm trying to use radclient in order to disconnect users, with the following PHP script: <? $framed_ip = 'xxx.xxx.xxx.xxx'; $cisco_ip='aaa.aaa.aaa.aaa'; popen("/bin/echo 'Framed-IP-Address=$framed_ip' | /home/radius/bin/radclient -d /home/radius/etc/raddb/ -x $cisco_ip disconnect secret", 'w'); ?> But I receive the error: Sending Disconnect-Request of id 3 to aaa.aaa.aaa.aaa:1700 Framed-IP-Address = xxx.xxx.xxx.xxx rad_recv: Disconnect-NAK packet from host aaa.aaa.aaa.aaa:1645, id=3, length=20 radclient: received response to request we did not send. This is the tcpdump (where bbb.bbb.bbb.bbb is the IP address of the server where I'm running the script from): 21:07:59.171286 IP bbb.bbb.bbb.bbb.40122 > aaa.aaa.aaa.aaa.1700: UDP, length 26 21:07:59.315031 IP aaa.aaa.aaa.aaa.datametrics > bbb.bbb.bbb.bbb.40122: RADIUS, Unknown Command (42), id: 0x03 length: 20 On my Cisco AS5300 I've added: aaa pod server auth-type any server-key secret What can be the problem?? Thanks in advance, Juan

2 1

ldap.attrmap problem
by pieter.hotting 02 Jun '05

02 Jun '05

I'm using freeradius 1.0.2 to translate Radius request from a Cisco VPN server to eDirectory via LDAP. This works fine, but I'm facing problems when I try to use translation via ldap.attrmap. In the file I have defined the following: replyItem CVPN-3k-Groups rADIUSDialAccessGroup When I look at a datascope to the interaction between FreeRadius and eDirectory I see correctly the response rADIUSDialAccessGroup --> cn=E_VPN_Clients_1,ou=RmtAcc,ou=SERVICES,o=AN. However if I look at the output of radius I see: rlm_ldap: looking for reply items in directory... rlm_ldap: Adding rADIUSDialAccessGroup as CVPN-3k-Groups, value cn & op=11 This tells me that for some reason the response is stripped at the '=' sign. Can anyone point me in the right direction what I'm doing wrong? Thanks, Pieter

1 0

ldap.attrmap problem
by pieter.hotting 02 Jun '05

02 Jun '05

I'm using freeradius 1.0.2 to translate Radius request from a Cisco VPN server to eDirectory via LDAP. This works fine, but I'm facing problems when I try to use translation via ldap.attrmap. In the file I have defined the following: replyItem CVPN-3k-Groups rADIUSDialAccessGroup When I look at a datascope to the interaction between FreeRadius and eDirectory I see correctly the response rADIUSDialAccessGroup --> cn=E_VPN_Clients_1,ou=RmtAcc,ou=SERVICES,o=AN. However if I look at the output of radius I see: rlm_ldap: looking for reply items in directory... rlm_ldap: Adding rADIUSDialAccessGroup as CVPN-3k-Groups, value cn & op=11 This tells me that for some reason the response is stripped at the '=' sign. Can anyone point me in the right direction what I'm doing wrong? Thanks, Pieter

1 0

Connecting to Windows server running Radius from a RH Linux
by Talwar, Puneet (NIH/NIAID) 02 Jun '05

02 Jun '05

I have successfully installed FreeRadius on my RH Linux box and I am trying to figure out how I can connect to the radius server which is running on a W2k server. I have add my RH Linux box as a client on the server I have the key as well. My question is how do I configure my Linux box to talk to the Radius server? I see a lot of docs on client and server setup, but I am not able to find a doc if I have a Radius server running on W2k, what steps I need to go have my RH Linux box talk to the Radius Server user authentication. FYI, Radius server is tied into Active Directory (AD) for authentication and other services. Thanks.

2 1

Connecting, disconnects, connects and crash.. Any ideas? I'm about to explode.
by Jean-Sébastien Nicaise 02 Jun '05

02 Jun '05

This is the same thing that previous post, I've put all the debug info this time and it's quite long (812 lines), although I have clearly delimited what was happening, ie: deamon starting, first connect, second connect, then no more. Basically it connects, disconnects, connects, then crashes the AP and nothing works anymore. I am trying to make Radius work with EAP-TLS, I used openssl to generate certificates, I generated like 5-6 different sets of certificates to be sure. any help please? :S thanks, Jean-Sébastien Nicaise

1 0

Proxy EAP-TTLS inner auth type
by Sayantan Bhowmick 02 Jun '05

02 Jun '05

Hi, I was tryin to figure out if it is possible to proxy only the inner auth type of EAP-TTLS. The only information I could find on this is: http://lists.cistron.nl/pipermail/freeradius-users/2005-March/042098.html This talks about PEAP. Is the same possible for EAP-TTLS? Also i could not find any information about the attribute "proxy_tunnel_request_as_eap" mentioned in the previous mail. Can someone please point me to any documentation on how to configure the server to terminate the tunnel and proxy the inner auth type. Thanks in advance. Regards, -Sayantan

2 1