Apologies, but I am confused about this. .. As I understand it the prefix realm should match my PCs output of PC12345\NAME and create a Stripped-User-Name with just the NAME in it. But this does not seem be working ... rlm_realm: Looking up realm "PC012292" for User-Name = "PC012292\ITSBMR" rlm_realm: No such realm "PC012292" ++[prefix] returns noop It seems to be looking for a realm with the name my PC, but this will be different for each PC so do I need some kind of wild card entry in the realms ? In my authorize section of sites-enabled/default I have enabled ... prefix and in modules/realm I have this corresponding section ... realm prefix{ format = prefix delimiter = "\\" } Regards, Bruce Richardson From: <tnt@kalik.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Date: 03/09/2008 22:20 Subject: Re: eDirectory + peap + LDAP + Cisco AP1242 + Windows XP(SP3) prefix again? http://lists.freeradius.org/pipermail/freeradius-users/2008-September/msg000... Ivan Kalik Kalik Informatika ISP Dana 3/9/2008, "Bruce_M_Richardson@biscuits.com" <Bruce_M_Richardson@biscuits.com> piše:

Hi,

having read scores of posts to this and other lists I am almost there,

many

of you have helped already without knowing it.

I'm using FreeRADIUS Version 2.0.5, compiled with the eDir extension.

I can get it to work if I un-tick the box on XP that says "Automatically use my Windows login name and password (if any)"

but if I tick that box then my PC sends the user name as PC12345\name

Obviously I need to use "Stripped-User-Name" and apparently this gets filled in by the realms module. But I can't see what to change so that the Stripped-User-Name gets filled in correctly.

Any ideas would be appreciated.

Regards,

Bruce Richardson

Please consider the environment - do you really need to print this email? ________________________________________________________________________________________ This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE ________________________________________________________________________________________

Hi, I don't necessarily want to use realms, it just says in the documentation that is the way it should be done. If there is a simpler way, I'm happy to use it, as I said before this is the last part of the puzzle and I just want to roll it out. So should I create a realm called DEFAULT, or is DEFAULT a parameter to be used with a realm ? This is all new to me and I am climbing a steep learning curve. prefix is before suffix, I assumed that it would match first. Regards, Bruce Richardson From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Date: 04/09/2008 13:17 Subject: Re: eDirectory + peap + LDAP + Cisco AP1242 + Windows XP(SP3) Bruce_M_Richardson@biscuits.com wrote:

As I understand it the prefix realm should match my PCs output of PC12345\NAME and create a Stripped-User-Name with just the NAME in it.

If the realm is already defined. Realms are usually used for proxying, where there are a small number of essentially static realms.

It seems to be looking for a realm with the name my PC, but this will be different for each PC so do I need some kind of wild card entry in the realms ?

Yes. DEFAULT.

In my authorize section of sites-enabled/default I have enabled ...

prefix

Before or after the "suffix" entry? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Please consider the environment - do you really need to print this email? ________________________________________________________________________________________ This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE ________________________________________________________________________________________

OK, this makes a little more sense now, I added .. realm DEFAULT { } to proxy.conf, I now get .... rlm_realm: Looking up realm "HOST" for User-Name = "HOST\NAME" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "NAME" rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. ++[prefix] returns ok I needed to add with_ntdomain_hack = yes to the mschap file and now everything works !!!!! Many thanks to Alan Regards, Bruce Richardson From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Date: 04/09/2008 16:22 Subject: Re: eDirectory + peap + LDAP + Cisco AP1242 + Windows XP(SP3) Bruce_M_Richardson@biscuits.com wrote:

So should I create a realm called DEFAULT, or is DEFAULT a parameter to be used with a realm ?

Read raddb/proxy.conf. Look for DEFAULT.

prefix is before suffix, I assumed that it would match first.

Yes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Please consider the environment - do you really need to print this email? ________________________________________________________________________________________ This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE ________________________________________________________________________________________

hello can anyone tell me the difference between hotspot system and radius servers in hotspot system client connecting directly to the ap then when they want to connect explorer open a page that ask username and password

.. which are then authenticated by radius server :-p (OK, it can be done against local file as well) Difference is in NAS choice of protocols: captive portals tend to use chap, while APs tend to use eap methods.

i ask this question becauser still i cant understant the certificates, am i have to install certificates on client rather i use mschapv2 in documents it says peap dont need to client side certificates, because windows have it from sp1 we already have sp2 but when try to connect it doesnt,

http://wiki.freeradius.org/FAQ#It_still_doesn.27t_work.21 peap doesn't need client certificates but if you are using self-signed certificates you need to import CA certificate to user machines. http://deployingradius.com/ Ivan Kalik Kalik Informatika ISP