- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 105, Issue 101
by dilanka nayanajith 30 Jan '14

30 Jan '14

> Hi every one i am facing some problems, > > i configured radius server > i configured a client > and finally i have configured a user as well > > how do i block or deny access for users to log certain clients > > as and example -- > > User1 can log to the SWA but he should not be able to log to SWB > > please help me on this , i read so many articuls but cant fiend a way to do it authorize { if ((User-Name == 'User1') && ("%{client:shortname}" == 'SWA')) { update control { Auth-Type := 'Accept' } } } can you please tell me to which file that i want to include these cods > dilanka nayanajith > Thank you On Wed, Jan 29, 2014 at 3:21 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: cui-inner.post-auth and cui.post-auth (Alan Buxey) > 2. Does FreeRADIUS 2.1.12's ECDH support include > ECDH-RSA-AES128-SHA? (Edward Morris) > 3. Re: Help Accounting packet forwarding (battossai) > 4. How to set User access for certain clients (dilanka nayanajith) > 5. Re: Help Accounting packet forwarding (Arran Cudbard-Bell) > 6. Re: How to set User access for certain clients > (Arran Cudbard-Bell) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 28 Jan 2014 22:26:40 +0000 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org>, > stefan.paetow(a)diamond.ac.uk > Subject: Re: cui-inner.post-auth and cui.post-auth > Message-ID: <4279f9f1-e87d-4fe1-ad4a-1425371e10bd(a)email.android.com> > Content-Type: text/plain; charset="utf-8" > > I'm sure I submitted a patch for this. .. Maybe it only went into 2.x? > > alan > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. >

2 2

MS-CHAP2 Response is incorrect
by Matthew Ceroni 30 Jan '14

30 Jan '14

Hi: I have a FreeRadius server setup that is used to authenticate a WPA2-Enteprise wireless network. This is setup on a CentOS 6.5 server with FreeRadius version 2.1.12. I also followed the instructions on configuring ActiveDirectory. Everything works, 99% of the time. However after a certain amount of time running I start to get authentication failures. The log shows: Wed Jan 29 11:30:31 2014 : Debug: [eap] processing type mschapv2 Wed Jan 29 11:30:31 2014 : Debug: [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Wed Jan 29 11:30:31 2014 : Debug: [mschapv2] +- entering group MS-CHAP {...} Wed Jan 29 11:30:31 2014 : Debug: [mschapv2] modsingle[authenticate]: calling mschap (rlm_mschap) for request 21 Wed Jan 29 11:30:31 2014 : Debug: [mschap] Creating challenge hash with username: vinoth Wed Jan 29 11:30:31 2014 : Debug: [mschap] Told to do MS-CHAPv2 for vinoth with NT-Password Wed Jan 29 11:30:31 2014 : Debug: [mschap] radius_xlat: Running registered xlat function of module mschap for string 'User-Name' Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: %{mschap:User-Name} -> vinoth Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: --username=%{%{mschap:User-Name}:-%{%{User-Name}:-None}} -> --username=vinoth Wed Jan 29 11:30:31 2014 : Debug: [mschap] radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' Wed Jan 29 11:30:31 2014 : Debug: [mschap] No NT-Domain was found in the User-Name. Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: %{mschap:NT-Domain} -> Wed Jan 29 11:30:31 2014 : Debug: [mschap] ... expanding second conditional Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: --domain=%{%{mschap:NT-Domain}:-CLAIRMAIL} -> --domain=CLAIRMAIL Wed Jan 29 11:30:31 2014 : Debug: [mschap] radius_xlat: Running registered xlat function of module mschap for string 'Challenge' Wed Jan 29 11:30:31 2014 : Debug: [mschap] Creating challenge hash with username: vinoth Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: %{mschap:Challenge} -> 26bae25103c92b9d Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=26bae25103c92b9d Wed Jan 29 11:30:31 2014 : Debug: [mschap] radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: %{mschap:NT-Response} -> bc3ebc2680d1a09bd8f20d10586071f40fa03830ca779b81 Wed Jan 29 11:30:31 2014 : Debug: [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=bc3ebc2680d1a09bd8f20d10586071f40fa03830ca779b81 Wed Jan 29 11:30:31 2014 : Debug: [mschap] External script failed. Wed Jan 29 11:30:31 2014 : Debug: [mschap] FAILED: MS-CHAP2-Response is incorrect The issue is resolved by simply restarting FreeRadius. Any help on further troubleshooting would be appreciated. Thanks

2 2

Does FreeRADIUS 2.1.12's ECDH support include ECDH-RSA-AES128-SHA?
by Edward Morris 29 Jan '14

29 Jan '14

Using FreeRADIUS 2.1.12 (from debian package) and OpenSSL 1.0.1f, I've been able to successfully configure EAP-TLS with a number of ECDHE (ephemeral) cipher suites. However, my attempts to utilize ECDH (non-ephemeral) cipher suites fail with and error of "SSL3_GET_CLIENT_HELLO:no shared cipher." I've seen that same error occur both when I was attempting to employ a cipher suite not supported by FreeRADIUS (versions prior to 2.1.12 did not support any ECDHE cipher suites) and when I had a screwy configuration (e.g., attempts to use DSA cipher suites without first giving the server a DSA key). So I'm unclear on where the problem might lie. I've confirmed that the client/supplicant I'm testing with supports the ECDH cipher suite (tcpdump and wireshark shows the Client Hello message includes the cipher), and querying debian's OpenSSL ("openssl ciphers -v aECDH") confirmed it supports the cipher The only documentation I could find on this topic was the line 'ecdh_curve = "prime256v1"' in eap.conf. Any pointers or confirmation as to whether or not FreeRADIUS (any version) supports plain ECDH cipher suites would be greatly appreciated. Thanks Ed

2 2

Problem with spaces in usernames.
by Maciej Milewski 29 Jan '14

29 Jan '14

My main goal is creating EAP-TLS configuration but I wanted to be sure the easiest way is working fine. And it's not working for me. What's wrong that 3.0.0 version doesn't treat: "A Guest" the same way as aguest? They are configured this way in users file: "A Guest" Cleartext-Password := "123456" Reply-Message = "Hello %{User-Name}" aguest Cleartext-Password := "123456" Reply-Message = "Hello, %{User-Name}" and talking with radtest from other host makes following showing in debug: rad_recv: Access-Request packet from host 10.0.6.10 port 57803, id=3, length=77 User-Name = 'A Guest' User-Password = '123456' NAS-IP-Address = 10.0.6.10 NAS-Port = 0 Message-Authenticator = 0x3499158ba2be438b4e63389ffd091332 Wed Jan 29 17:20:58 2014 : Debug: (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:20:58 2014 : Debug: (0) authorize { Wed Jan 29 17:20:58 2014 : Debug: (0) filter_username filter_username { Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (User-Name != "%{tolower:%{User-Name}}") Wed Jan 29 17:20:58 2014 : Debug: %{tolower:%{User-Name}} Wed Jan 29 17:20:58 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:20:58 2014 : Debug: xlat: tolower Wed Jan 29 17:20:58 2014 : Debug: { Wed Jan 29 17:20:58 2014 : Debug: attribute: User-Name Wed Jan 29 17:20:58 2014 : Debug: { Wed Jan 29 17:20:58 2014 : Debug: ref 2 Wed Jan 29 17:20:58 2014 : Debug: list 1 Wed Jan 29 17:20:58 2014 : Debug: tag -128 Wed Jan 29 17:20:58 2014 : Debug: } Wed Jan 29 17:20:58 2014 : Debug: } Wed Jan 29 17:20:58 2014 : Debug: (0) expand: "%{tolower:%{User-Name}}" -> 'a guest' Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> TRUE Wed Jan 29 17:20:58 2014 : Debug: (0) if (User-Name != "%{tolower:%{User-Name}}") { Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[authorize]: calling reject (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[authorize]: returned from reject (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [reject] = reject Wed Jan 29 17:20:58 2014 : Debug: (0) } # if (User-Name != "%{tolower:%{User-Name}}") = reject Wed Jan 29 17:20:58 2014 : Debug: (0) } # filter_username filter_username = reject Wed Jan 29 17:20:58 2014 : Debug: (0) } # authorize = reject Wed Jan 29 17:20:58 2014 : Debug: (0) Using Post-Auth-Type Reject Wed Jan 29 17:20:58 2014 : Debug: (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:20:58 2014 : Debug: (0) Post-Auth-Type REJECT { Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Wed Jan 29 17:20:58 2014 : Debug: %{User-Name} Wed Jan 29 17:20:58 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:20:58 2014 : Debug: attribute: User-Name Wed Jan 29 17:20:58 2014 : Debug: { Wed Jan 29 17:20:58 2014 : Debug: ref 2 Wed Jan 29 17:20:58 2014 : Debug: list 1 Wed Jan 29 17:20:58 2014 : Debug: tag -128 Wed Jan 29 17:20:58 2014 : Debug: } Wed Jan 29 17:20:58 2014 : Debug: (0) attr_filter.access_reject : expand: "%{User-Name}" -> 'A Guest' Wed Jan 29 17:20:58 2014 : Debug: (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [attr_filter.access_reject] = updated Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: calling eap (rlm_eap) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: returned from eap (rlm_eap) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [eap] = noop Wed Jan 29 17:20:58 2014 : Debug: (0) remove_reply_message_if_eap remove_reply_message_if_eap { Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (reply:EAP-Message && reply:Reply-Message) Wed Jan 29 17:20:58 2014 : Debug: (0) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE Wed Jan 29 17:20:58 2014 : Debug: (0) else else { Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: calling noop (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) modsingle[post-auth]: returned from noop (rlm_always) for request 0 Wed Jan 29 17:20:58 2014 : Debug: (0) [noop] = noop Wed Jan 29 17:20:58 2014 : Debug: (0) } # else else = noop Wed Jan 29 17:20:58 2014 : Debug: (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop Wed Jan 29 17:20:58 2014 : Debug: (0) } # Post-Auth-Type REJECT = updated Wed Jan 29 17:20:58 2014 : Debug: (0) Finished request 0. Wed Jan 29 17:20:58 2014 : Debug: Waking up in 0.3 seconds. Wed Jan 29 17:20:58 2014 : Debug: Waking up in 0.6 seconds. Wed Jan 29 17:20:59 2014 : Debug: (0) Sending delayed reject Sending Access-Reject of id 3 from 10.0.6.207 port 1812 to 10.0.6.10 port 57803 Wed Jan 29 17:20:59 2014 : Debug: Waking up in 4.9 seconds. Wed Jan 29 17:21:04 2014 : Debug: (0) Cleaning up request packet ID 3 with timestamp +29 Wed Jan 29 17:21:04 2014 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.0.6.10 port 44948, id=210, length=76 User-Name = 'aguest' User-Password = '123456' NAS-IP-Address = 10.0.6.10 NAS-Port = 0 Message-Authenticator = 0xdfd5232531e2f84735f3a9b1b94c22c9 Wed Jan 29 17:21:10 2014 : Debug: (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:21:10 2014 : Debug: (1) authorize { Wed Jan 29 17:21:10 2014 : Debug: (1) filter_username filter_username { Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name != "%{tolower:%{User-Name}}") Wed Jan 29 17:21:10 2014 : Debug: %{tolower:%{User-Name}} Wed Jan 29 17:21:10 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:21:10 2014 : Debug: xlat: tolower Wed Jan 29 17:21:10 2014 : Debug: { Wed Jan 29 17:21:10 2014 : Debug: attribute: User-Name Wed Jan 29 17:21:10 2014 : Debug: { Wed Jan 29 17:21:10 2014 : Debug: ref 2 Wed Jan 29 17:21:10 2014 : Debug: list 1 Wed Jan 29 17:21:10 2014 : Debug: tag -128 Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: (1) expand: "%{tolower:%{User-Name}}" -> 'aguest' Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ / /) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ / /) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /@.*@/ ) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /@.*@/ ) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.\\./ ) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.\\./ ) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.$/) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /\\.$/) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /(a)\\./) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (User-Name =~ /(a)\\./) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) } # filter_username filter_username = notfound Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [preprocess] = ok Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling chap (rlm_chap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from chap (rlm_chap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [chap] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [mschap] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling digest (rlm_digest) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from digest (rlm_digest) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [digest] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling suffix (rlm_realm) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) suffix : No '@' in User-Name = "aguest", looking up realm NULL Wed Jan 29 17:21:10 2014 : Debug: (1) suffix : No such realm "NULL" Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [suffix] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) eap : No EAP-Message, not doing EAP Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [eap] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling files (rlm_files) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) files : users: Matched entry aguest at line 57 Wed Jan 29 17:21:10 2014 : Debug: Hello, %{User-Name} Wed Jan 29 17:21:10 2014 : Debug: Parsed xlat tree: Wed Jan 29 17:21:10 2014 : Debug: literal: 'Hello, ' Wed Jan 29 17:21:10 2014 : Debug: attribute: User-Name Wed Jan 29 17:21:10 2014 : Debug: { Wed Jan 29 17:21:10 2014 : Debug: ref 2 Wed Jan 29 17:21:10 2014 : Debug: list 1 Wed Jan 29 17:21:10 2014 : Debug: tag -128 Wed Jan 29 17:21:10 2014 : Debug: } Wed Jan 29 17:21:10 2014 : Debug: (1) files : expand: "Hello, %{User-Name}" -> 'Hello, aguest' Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from files (rlm_files) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [files] = ok Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling expiration (rlm_expiration) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from expiration (rlm_expiration) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [expiration] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling logintime (rlm_logintime) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from logintime (rlm_logintime) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [logintime] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: calling pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authorize]: returned from pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [pap] = updated Wed Jan 29 17:21:10 2014 : Debug: (1) } # authorize = updated Wed Jan 29 17:21:10 2014 : Debug: (1) Found Auth-Type = PAP Wed Jan 29 17:21:10 2014 : Debug: (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:21:10 2014 : Debug: (1) Auth-Type PAP { Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authenticate]: calling pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) pap : login attempt with password "123456" Wed Jan 29 17:21:10 2014 : Debug: (1) pap : Using clear text password "123456" Wed Jan 29 17:21:10 2014 : Debug: (1) pap : User authenticated successfully Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[authenticate]: returned from pap (rlm_pap) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [pap] = ok Wed Jan 29 17:21:10 2014 : Debug: (1) } # Auth-Type PAP = ok Wed Jan 29 17:21:10 2014 : Debug: (1) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default Wed Jan 29 17:21:10 2014 : Debug: (1) post-auth { Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: calling exec (rlm_exec) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: returned from exec (rlm_exec) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [exec] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) remove_reply_message_if_eap remove_reply_message_if_eap { Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (reply:EAP-Message && reply:Reply-Message) Wed Jan 29 17:21:10 2014 : Debug: (1) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE Wed Jan 29 17:21:10 2014 : Debug: (1) else else { Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: calling noop (rlm_always) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) modsingle[post-auth]: returned from noop (rlm_always) for request 1 Wed Jan 29 17:21:10 2014 : Debug: (1) [noop] = noop Wed Jan 29 17:21:10 2014 : Debug: (1) } # else else = noop Wed Jan 29 17:21:10 2014 : Debug: (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop Wed Jan 29 17:21:10 2014 : Debug: (1) } # post-auth = noop Sending Access-Accept of id 210 from 10.0.6.207 port 1812 to 10.0.6.10 port 44948 Reply-Message = 'Hello, aguest' Wed Jan 29 17:21:10 2014 : Debug: (1) Finished request 1. Wed Jan 29 17:21:10 2014 : Debug: Waking up in 0.3 seconds. Wed Jan 29 17:21:10 2014 : Debug: Waking up in 4.6 seconds. -- Pozdrawiam, Maciej Milewski

5 6

cui-inner.post-auth and cui.post-auth
by stefan.paetow＠diamond.ac.uk 29 Jan '14

29 Jan '14

Sorry, doing more poking around and have discovered that while the %{User-Name} attribute is turned into lower-case with %{tolower:...}, %{Operator-Name} is not. Surely to ensure consistency, shouldn't Operator-Name ALSO be turned into a lower-case? After all, 1DIAMOND.AC.UK and 1diamond.ac.uk are the same on t'Internet? Just a question... Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

4 7

How to set User access for certain clients
by dilanka nayanajith 29 Jan '14

29 Jan '14

Hi every one i am facing some problems, i configured radius server i configured a client and finally i have configured a user as well how do i block or deny access for users to log certain clients as and example -- User1 can log to the SWA but he should not be able to log to SWB please help me on this , i read so many articuls but cant fiend a way to do it -- dilanka nayanajith Thank you

3 2

How configure freeradius that check user group in Microsoft Active Direcory
by matrix30003 28 Jan '14

28 Jan '14

Hi I integrated freeradius with Microsoft Active Directory All users in Active Directory have access. How I will set freeradius that check users groups nad access accept if user belongs to groups WIFI in Active Directory.

8 15

%S short variable obsolescence
by stefan.paetow＠diamond.ac.uk 28 Jan '14

28 Jan '14

Hi, Another question... The Wiki at http://wiki.freeradius.org/config/Run%20time%20variables says that %S and others *will* be removed in the future... since I am now using %S, what future variable would be preferred for using it? The Wiki does not list one at the moment. With Regards Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

3 3

rlm_perl truncating some attributes in 3.0.1
by Leggett, Torrance I. 28 Jan '14

28 Jan '14

I'm trying to upgrade our 2.2.1 based servers to 3.0.1, but it appears that rlm_perl is truncating some attributes. Specifically Calling-Station-Id, User-Name and User-Password. Here is the debug output from the server: http://pastebin.com/GYpBS59L And here is the rlm_perl script that currently works under 2.2.1 but appears to be receiving truncated %RAD_REQUEST attributes: http://pastebin.com/auKspQcU Is this normal behavior that can be overridden at script definition time? Thanks!

2 4

SSH Logins to Cisco Switch. RADIUS/Active Directory
by Luke Ramsden 28 Jan '14

28 Jan '14

Hi, I am trying to authenticate SSH logins to my Cisco 3750 switches using RADIUS/Active Directory. I think this means I will need the Cisco switches to send an MSCHAPv2 challenge to the RADIUS server? I am struggling to achieve this and wondered if anyone else had come across this and could offer some advice? Essentially, all I want is to remotely access the switches on my network using Active Directory credentials. Are there any other/better methods if the above is not possible? Any help is greatly appreciated :-)

2 9