Hi Alan, Thanks for the reply .But I am still getting the same errors.I have put the lines as follows. I did not put any balnk lines in between . the editor in the mail is shoing like that. DEFAULT EAP-Sim-Rand1 = 0x89abcbeef9abcdef89abcdef89abcdef EAP-Sim-Rand2 = 0x9abcdef89abcdef89abcdef89abcdef8, EAP-Sim-Rand3 = 0xabcdef89abcdef89abcdef89abcdef89, EAP-Sim-SRES1 = 0x1234abcd, EAP-Sim-SRES2 = 0x234abcd1, EAP-Sim-SRES3 = 0x34abcd12, EAP-Sim-KC1 = 0x0011223344556677, EAP-Sim-KC2 = 0x1021324354657687, EAP-Sim-KC3 = 0x30415263748596a7 I am getting the following errors [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items Module: Checking session {...} for more modules to load Regards, Kalyani -----Original Message----- From: freeradius-users-bounces+kagarigi=cisco.com@lists.freeradius.org [mailto:freeradius-users-bounces+kagarigi=cisco.com@lists.freeradius.org ] On Behalf Of freeradius-users-request@lists.freeradius.org Sent: Monday, May 26, 2008 3:30 PM To: freeradius-users@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 37, Issue 125 Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED] (Riccardo Veraldi) 2. chap for ldap (Zahra Bahar) 3. Re: need info on EAP-SIM (A.L.M.Buxey@lboro.ac.uk) ---------------------------------------------------------------------- Message: 1 Date: Mon, 26 May 2008 11:26:26 +0200 From: Riccardo Veraldi <Riccardo.Veraldi@cnaf.infn.it> Subject: Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED] To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <483A8242.3030708@cnaf.infn.it> Content-Type: text/plain; charset=ISO-8859-1; format=flowed I wrote a rule in users file to reject login for users being in a certain grup, but still access is given DEFAULT Ldap-Group == "cn=rjgroup", Auth-Type := Reject Reply-Message = "Sorry, you are not allowed to have dialup access" user can authenticate succesfully with EAP-TLS. User is found in LDAP tree, user is part of ldap group rjgroup, but still is not being rejected. What am I missing ? thanks Riccardo Alan DeKok ha scritto:
Riccardo Veraldi wrote:
Not all the people having a certificate should authenticate on my WiFi infrastructure. These certificates are for general purpose, so also for EAP-TLS,
Then your PKI system is wrong. You should NOT issue certificates for multiple purposes.
You should issue RADIUS (EAP-TLS) certificates ONLY to the people who are allowed to use EAP-TLS.
but some user in my case should not be authenticated. To select which are the users to be authenticated and which are not, I wanted to use LDAP properties. If a user is in the LDAP directory it should pass, if it is not, it should be refused, but at the end, I am unable to do it.
Did you read my statement about using LDAP groups? Do you know what an LDAP group is?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------ Message: 2 Date: Mon, 26 May 2008 14:02:15 +0330 (IRST) From: Zahra Bahar <zahra_bahar@ec.iut.ac.ir> Subject: chap for ldap To: freeradius-users@lists.freeradius.org Message-ID: <30958651.75851211797935796.JavaMail.root@mta.iut.ac.ir> Content-Type: text/plain; charset=utf-8 Hi, we have freeradius using ldap for authorization and authentication. can we have chap for security between NAS and radius and then pap between radius and ldap server? ------------------------------ Message: 3 Date: Mon, 26 May 2008 10:44:09 +0100 From: A.L.M.Buxey@lboro.ac.uk Subject: Re: need info on EAP-SIM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <20080526094409.GA8435@lboro.ac.uk> Content-Type: text/plain; charset=us-ascii hi, put the first check on the same line as DEFAULT and remove all those blank lines from between each check alan ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 37, Issue 125 *************************************************
Kalyani Garigipati (kagarigi) wrote:
Thanks for the reply .But I am still getting the same errors.I have put the lines as follows. I did not put any balnk lines in between . the editor in the mail is shoing like that.
DEFAULT EAP-Sim-Rand1 = 0x89abcbeef9abcdef89abcdef89abcdef EAP-Sim-Rand2 = 0x9abcdef89abcdef89abcdef89abcdef8,
Please read the "man" page for the "users" file. The format of an entry is NOT free-form. The first line is special, and is different than the rest of the lines.
I am getting the following errors [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items
What part of that message is unclear? You need to put the attributes onto the first line, along with the DEFAULT. Do NOT put them on separate lines as you have done already. Alan DeKok.
Am 26.05.2008 um 12:17 schrieb Kalyani Garigipati (kagarigi):
Hi Alan,
Thanks for the reply .But I am still getting the same errors.I have put the lines as follows. I did not put any balnk lines in between . the editor in the mail is shoing like that.
DEFAULT EAP-Sim-Rand1 = 0x89abcbeef9abcdef89abcdef89abcdef EAP-Sim-Rand2 = 0x9abcdef89abcdef89abcdef89abcdef8, EAP-Sim-Rand3 = 0xabcdef89abcdef89abcdef89abcdef89, EAP-Sim-SRES1 = 0x1234abcd, EAP-Sim-SRES2 = 0x234abcd1, EAP-Sim-SRES3 = 0x34abcd12, EAP-Sim-KC1 = 0x0011223344556677, EAP-Sim-KC2 = 0x1021324354657687, EAP-Sim-KC3 = 0x30415263748596a7
I am getting the following errors [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items [/usr/local/etc/raddb/users]:203 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user "DEFAULT". This attribute MUST go on the first line with the other check items Module: Checking session {...} for more modules to load
Have you try to put *everything* in one line?
Regards, Kalyani
-----Original Message----- From: freeradius-users-bounces+kagarigi=cisco.com@lists.freeradius.org [mailto:freeradius-users-bounces +kagarigi=cisco.com@lists.freeradius.org ] On Behalf Of freeradius-users-request@lists.freeradius.org Sent: Monday, May 26, 2008 3:30 PM To: freeradius-users@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 37, Issue 125
Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org
You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED] (Riccardo Veraldi) 2. chap for ldap (Zahra Bahar) 3. Re: need info on EAP-SIM (A.L.M.Buxey@lboro.ac.uk)
----------------------------------------------------------------------
Message: 1 Date: Mon, 26 May 2008 11:26:26 +0200 From: Riccardo Veraldi <Riccardo.Veraldi@cnaf.infn.it> Subject: Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED] To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <483A8242.3030708@cnaf.infn.it> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
I wrote a rule in users file to reject login for users being in a certain grup, but still access is given
DEFAULT Ldap-Group == "cn=rjgroup", Auth-Type := Reject Reply-Message = "Sorry, you are not allowed to have dialup access"
user can authenticate succesfully with EAP-TLS. User is found in LDAP tree, user is part of ldap group rjgroup, but still is not being rejected. What am I missing ?
thanks
Riccardo
Alan DeKok ha scritto:
Riccardo Veraldi wrote:
Not all the people having a certificate should authenticate on my WiFi infrastructure. These certificates are for general purpose, so also for EAP-TLS,
Then your PKI system is wrong. You should NOT issue certificates for multiple purposes.
You should issue RADIUS (EAP-TLS) certificates ONLY to the people who are allowed to use EAP-TLS.
but some user in my case should not be authenticated. To select which are the users to be authenticated and which are not, I wanted to use LDAP properties. If a user is in the LDAP directory it should pass, if it is not, it should be refused, but at the end, I am unable to do it.
Did you read my statement about using LDAP groups? Do you know what an LDAP group is?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------
Message: 2 Date: Mon, 26 May 2008 14:02:15 +0330 (IRST) From: Zahra Bahar <zahra_bahar@ec.iut.ac.ir> Subject: chap for ldap To: freeradius-users@lists.freeradius.org Message-ID: <30958651.75851211797935796.JavaMail.root@mta.iut.ac.ir> Content-Type: text/plain; charset=utf-8
Hi, we have freeradius using ldap for authorization and authentication. can we have chap for security between NAS and radius and then pap between radius and ldap server?
------------------------------
Message: 3 Date: Mon, 26 May 2008 10:44:09 +0100 From: A.L.M.Buxey@lboro.ac.uk Subject: Re: need info on EAP-SIM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Message-ID: <20080526094409.GA8435@lboro.ac.uk> Content-Type: text/plain; charset=us-ascii
hi,
put the first check on the same line as DEFAULT and remove all those blank lines from between each check
alan
------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
End of Freeradius-Users Digest, Vol 37, Issue 125 *************************************************
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html
Nicolas Goutte extragroup GmbH - Karlsruhe Waldstr. 49 76133 Karlsruhe Germany Geschäftsführer: Stephan Mönninghoff, Hans Martin Kern, Tilman Haerdle Registergericht: Amtsgericht Münster / HRB: 5624 Steuer Nr.: 337/5903/0421 / UstID: DE 204607841
DEFAULT EAP-Sim-Rand1 = 0x89abcbeef9abcdef89abcdef89abcdef EAP-Sim-Rand2 = 0x9abcdef89abcdef89abcdef89abcdef8, EAP-Sim-Rand3 = 0xabcdef89abcdef89abcdef89abcdef89, EAP-Sim-SRES1 = 0x1234abcd, EAP-Sim-SRES2 = 0x234abcd1, EAP-Sim-SRES3 = 0x34abcd12, EAP-Sim-KC1 = 0x0011223344556677, EAP-Sim-KC2 = 0x1021324354657687, EAP-Sim-KC3 = 0x30415263748596a7
There is no comma after that first attribute. Ivan Kalik Kalik Informatika ISP
participants (4)
-
Alan DeKok -
Ivan Kalik -
Kalyani Garigipati (kagarigi) -
Nicolas Goutte