Hello everyone again! Well as you may understand from the Subject I have a question about how clients.conf works. I´ve read the documentation in the file about how to add a client but when i tired to add another client it stoped working. I will try to explain how I have setup the network. I have one radius server connected to a Netgear wired switch, from that switch I have a AP(Mikrotik) connected. What I am trying to do is to add the Mikrotik into the clients.conf file but when I do i get an error at startup(dont remember the error message). Right now im instead using client 192.168.118.0/24{ } which accepts all NASes in the subnet. What i wrote in clients.conf before i changed to include a whole subnet is: client Netgear{ ipaddr = x.x.x.x netmask = 24 secret = xxxxxx require_message_authentication = no } client Mikrotik { ipaddr = x.x.x.x netmask = 24 secret = xxxxxxx require_message_authentication = no } What I am wondering about is if I have done a correct setup when trying to add several stand alone clients? Best regards/ Peter
From: freeradius-users-request@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 55, Issue 52 To: freeradius-users@lists.freeradius.org Date: Thu, 12 Nov 2009 08:43:56 +0100
Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org
You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] (Ivan Kalik) 2. Re: I need some help with freeradius 2.0.4 (Wagner Pereira) 3. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] (Wagner Pereira) 4. Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] (tnt@kalik.net) 5. SSL renegotiation ? (John) 6. Re: FreeRadius with 3COM (Guk Victor) 7. Microsoft: SmardCard or Certificate Auth (swatzy)
----------------------------------------------------------------------
Message: 1 Date: Wed, 11 Nov 2009 19:30:35 +0000 From: Ivan Kalik <tnt@kalik.net> Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <4AFB10DB.7040106@kalik.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Wagner Pereira wrote:
Dear colleagues,
I am introducing now a new information. Below is what is declared into my IOS - Cisco 6500. Is this correct?
Why don't you just read the cisco wiki page.
Ivan Kalik Kalik Informatika ISP
------------------------------
Message: 2 Date: Wed, 11 Nov 2009 17:42:15 -0200 From: Wagner Pereira <wpereira@pop-sp.rnp.br> Subject: Re: I need some help with freeradius 2.0.4 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <4AFB1397.9000002@pop-sp.rnp.br> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Ok, Ivan. I guess I removed that HTML craps now : )
Below is my new radgroupreply:
mysql> select * from radgroupreply; +----+-----------+---------------+----+-----------------------+------+ | id | groupname | attribute | op | value | Prio | +----+-----------+---------------+----+-----------------------+------+ | 3 | pop-sp | Service-Type | := | NAS-Prompt-User | | | 5 | reject | reply-message | := | Autentica??o recusada | NULL | +----+-----------+---------------+----+-----------------------+------+ 2 rows in set (0.00 sec)
Hugs,
--
Wagner Pereira
PoP-SP/RNP - Ponto de Presen?a da RNP em S?o Paulo CCE/USP - Centro de Computa??o Eletr?nica da Universidade de S?o Paulo http://www.pop-sp.rnp.br (11) 3091-8902
tnt@kalik.net escreveu:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
Enough with that HTML!!!! It produces extraordinary ammount of crap as you can see:
I did what you recommended (I guess). See below:<br>
No, you didn't. But getting closer.
| 1 | pop-sp | Framed-Compression | := | Van-Jacobson-TCP-IP
Remove *all* Framed attributes.
| 3 | pop-sp | Service-Type | := | NAS-Prompt | | <br>
That should be NAS-Prompt-User.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------
Message: 3 Date: Wed, 11 Nov 2009 17:57:18 -0200 From: Wagner Pereira <wpereira@pop-sp.rnp.br> Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <4AFB171E.4010105@pop-sp.rnp.br> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Ivan,
I already read the Cisco wiki page and I implemented what they recommend, but it's not working yet.
--
Wagner Pereira
PoP-SP/RNP - Ponto de Presen?a da RNP em S?o Paulo CCE/USP - Centro de Computa??o Eletr?nica da Universidade de S?o Paulo http://www.pop-sp.rnp.br (11) 3091-8902
Ivan Kalik escreveu:
Wagner Pereira wrote:
Dear colleagues,
I am introducing now a new information. Below is what is declared into my IOS - Cisco 6500. Is this correct?
Why don't you just read the cisco wiki page.
Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------
Message: 4 Date: Wed, 11 Nov 2009 22:01:33 -0000 (UTC) From: tnt@kalik.net Subject: Re: [Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]] To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Message-ID: <49743.87.194.16.13.1257976893.squirrel@www.kalik.net> Content-Type: text/plain;charset=iso-8859-1
I already read the Cisco wiki page and I implemented what they recommend, but it's not working yet.
Does the debug now show Nas-Prompt-User in Access-Accept packet? If it does - it's some problem on the router - debug ip ssh.
Ivan Kalik Kalik Informatika ISP
------------------------------
Message: 5 Date: Thu, 12 Nov 2009 11:01:44 +0800 (CST) From: John <elmer_radius@yahoo.com.cn> Subject: SSL renegotiation ? To: freeradius-users@lists.freeradius.org Message-ID: <145589.77590.qm@web15706.mail.cnb.yahoo.com> Content-Type: text/plain; charset="utf-8"
Hi, I found??a new man-in-the-middle attack with SSL.? http://www.sslshopper.com/article-ssl-and-tls-renegotiation-vulnerability-di... ? I am afraid if freeRADIUS use SSL renegotiation?? The freeRADIUS version is 1.1.6. We use EAP-TLS and the backend OpenLDAP server with TLS connection.? Does??freeRADIUS use SSL renegotiation ? ? Thanks. John
___________________________________________________________ ????????????????? http://card.mail.cn.yahoo.com/