- Freeradius-Users - lists.freeradius.org

Re:NAP
by Zulzig 20 Nov '14

20 Nov '14

Hey Alan, i have tested your suggestion, but i'm in front of the same bug, that i said in my last message. the radius server send to the switch the incorrect information.. it send the last valor instead of to use the new. may be i need to upgrade my version to the 2.2.5 or I missed something. thank

2 1

RE:NAP with Freeradius
by Zulzig 20 Nov '14

20 Nov '14

Hey Alan, i have tested your suggestion, but i'm in front of the same bug, that i said in my last message. the radius server send to the switch the incorrect information.. it send the last valor instead of to use the new. may be i need to upgrade my version to the 2.2.5 or I missed something. thank

1 0

Compare request:Calling-Station-Id with control:Calling-Station-Id
by Stabla, Daniel 20 Nov '14

20 Nov '14

Hello, we have a problem that the check if (&request:Calling-Station-Id == &control:Calling-Station-Id) fails, because control:Calling-Station-Id is empty in freeradius 3.0.x. We have a file which contains a list like this one: userXNAS-Identifier =~ "someAP*", Calling-Station-Id += "00-11-22-33-44-55" userX2NAS-Identifier =~ "someAP*", Calling-Station-Id += "00-12-23-34-45-56" and this works well with checkval on freeradius 2.x So what do we need to get this to work with freeradius 3.x ? Kind regards. D. Stabla

2 1

Comments before 3.0.5?
by Alan DeKok 20 Nov '14

20 Nov '14

We're going to release 3.0.5 soon. Please double-check that there are no last-minute issues. We've added a large number of regression tests to the source. They can't catch everything. So some manual double-checking is useful. Alan DeKok.

2 1

Freeradius version 2.1.12 with TTLS support
by Prasad Jadhav 20 Nov '14

20 Nov '14

Hi, I configured the freeradius version 2.1.12 with TTLS support. Note: for testing purpose using self signed certificate having following question 1. do I need to create certificate for per client machine base or per client username base. 2. Which certificates need to install on client side (OS: Windows 8) for TTLS Regards, Prasad Jadhav Alepo Technologies Pvt. Ltd. www.alepo.com<https://west.exch021.serverdata.net/owa/redir.aspx?C=519fb39324ec491582fa0b…> [Description: Description: cid:image001.png@01CAF37B.1103A920] _____________________________ Office: +91 22 61085000 Extn - 217 Skype ID : prasad9920 ________________________________ This email (message and any attachment) is confidential and may be privileged. If you are not certain that you are the intended recipient, please notify the sender immediately by replying to this message, and delete all copies of this message and attachments. Any other use of this email by you is prohibited. ________________________________

1 0

Error in user authentication : Freeradius + MySQL - Failed to create the pair: Invalid vendor name in attribute name "Password"
by Karuppasamy, Senthil 19 Nov '14

19 Nov '14

Hi, Followed the diff forum threads and have managed to link the Freeradius to look for users from a Mysql DB but am still not able to successfully authenticate users in this setup.I get the following error on receiving a user request Received Access-Request Id 24 from 10.127.6.21:59169 to 10.127.6.244:1645 length 76 User-Name = 'test' User-Password = 'test' NAS-IP-Address = 10.127.6.21 Service-Type = Administrative-User Calling-Station-Id = '10.120.92.40' NAS-Port-Type = Virtual (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "test", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) sql : EXPAND %{User-Name} (1) sql : --> test (1) sql : SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (4) (1) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id desc (1) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc' rlm_sql: Failed to create the pair: Invalid vendor name in attribute name "Password" rlm_sql (sql): Error parsing user data from database result (1) ERROR: sql : SQL query error But the user exists in the DB as we can see from the following output : SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id desc; +----+----------+-----------+-------+----+ | id | username | attribute | value | op | +----+----------+-----------+-------+----+ | 2 | test | Password | test | := | | 1 | test | Auth-Type | Local | := | +----+----------+-----------+-------+----+ 2 rows in set (0.00 sec) I have attached the configuration files along with this mail. Any help in this would be very much appreciated. Senthil KSK ________________________________ DISCLAIMER: This e-mail and any attachments to it may contain confidential and proprietary material and is solely for the use of the intended recipient. Any review, use, disclosure, distribution or copying of this transmittal is prohibited except by or on behalf of the intended recipient. If you have received this transmittal in error, please notify the sender and destroy this e-mail and any attachments and all copies, whether electronic or printed.

4 12

Verify Certificate
by Munroe Sollog 19 Nov '14

19 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When using 802.1x to authenticate clients to Active Directory using PEAP. It seems that even when using a complete trust chain for a certificate (a real honest-to-god certificate) the clients still get prompted to 'verify' the certificate. It would seem like this behavior is by design, as the user is still expected to confirm that the certificate is what they expect to see (similar to how ssh works). Setting aside the common user doesn't do any of that checking, and setting aside a managed computer environment (Active directory) can side load the certificate on the client automatically. Is my experience accurate, and if so how do people deal with this annoyance that I feel is perpetuating the 'ignore certificate alerts' behavior normal users have? For reference I have posted images of the certificate alert. http://i.imgur.com/gNOpBJ0.jpg - -- Munroe Sollog LTS - Network Analyst x85002 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJUbLTRAAoJEPbbZiWCKDVC1JcIAIYRcVbBVEyX1JvtboawuQBb bl14QohEhGg0W0dXbckaKXjJSZNoztvUXe1k/ckBlb6kG5v6uGZoOuEoLF11VrNT ISRYcJf3lBzFK4xg1ZABC8jVzpgS2a+UiGs0YmafuyvY6+hQAnvveVp1S8OtCs6I SsZtCUR4phxHvonUN/gKAYL2kaGKQcKDGED47hzXop3a/iUM63eFm1L9vz331lCr x9t9yN+yZTeJcfGPvJRd4AV03ALWgmnq9RbGcmMGvWpRXN9XpdDmtrgh4ml2RtcG 5JIkuxm4PtrxcVprRRzsQJCSv2Vejc8lJ8LsyuepoAFBw2pc6r18/MSRLvAwE6k= =H44Y -----END PGP SIGNATURE-----

1 0

Re: mac address in data vlan - drop
by A.L.M.Buxey＠lboro.ac.uk 19 Nov '14

19 Nov '14

Hi, > if ("%{User-Name}" =~ /^001ef7/) { > > > > update reply { > > Cisco-AVPair = "device-traffic-class=voice" rather than relying on the User-Name you might be able to do something more elegant - check the request to see if theres anything obvious/nice in it > And all works but when I plug off computer from CiscoPhone and plag in in > again, so computer mac-address is droped... because the port on the switch hasnt changed - the phone port PC has - check the phone settings for passthrough - but this isnt FreeRADIUS issue - this is all Cisco stuff. check eg http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/rel… alan

1 0

Freeradius 2.1.12-6 test issue
by Clive Allen 19 Nov '14

19 Nov '14

3 3

RE: mac address in data vlan - drop
by Alan Buxey 19 Nov '14

19 Nov '14

Cisco issue. Freeradius is sending back access-accept. Your issue sounds familiar to something I've seen with pass through before. Verify the behaviour with a change to the auth type on the switch eg multi-host alan

1 0