sorry, i ve got persistents problems : - i filter client certificate under authenticate section (under eap) with : Auth-Type eap { if ( "%{TLS-Client-Cert-Subject}" =~ /OU=xxxxx/ ) { reject } }. Firstly, it s' written on "default" file : Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for. But, according to me , it's not right because i don't want to enter into post-auth. It must be rejected before. secondly, with this configuration, i try to authenticate a client with certificate OU=xxxxx. According to mode debug, it seemed to work. Client (windows XP) requested 21 times without sucess. But at 22nd, it seemed authenticate sucessful because i see client which is associated to AP. after times (5-10 minutes), Client seemed to be detached and entered in authenticating loop until succeed authenticating. do you know why client success authenticating for a time ? Is it possible to avoid request of certain client ? I restrict authentication request to chooser NAS. I want to avoid clients to enter loop authentication. But these client can request authentication through NAS choosen. Cheers. From: zoumlander@hotmail.com To: freeradius-users@lists.freeradius.org Subject: RE: eap/tls questions with freeradius Date: Fri, 23 Dec 2011 10:32:54 +0000 Thanks!!!
Date: Fri, 23 Dec 2011 16:26:20 +0700 Subject: Re: eap/tls questions with freeradius From: list@fajar.net To: freeradius-users@lists.freeradius.org
On Fri, Dec 23, 2011 at 3:54 PM, vazoumana fofana <zoumlander@hotmail.com> wrote:
Do you know where i can insert script to add new fonctions like described in my previous email ? When client sends its certificate , server checks before username or certificate validity ?
Try: - http://wiki.freeradius.org/Sites%20configuration - http://freeradius.org/radiusd/man/unlang.html - http://wiki.freeradius.org/Rlm_perl
Use unlang and attributes (such as TLS-Client-Cert-Common-Name) to do whatever filtering you want. If you need complex processing, you might have to use rlm_perl as well.
-- Fajar
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html