Freeradius Access Requet ID
全球无线联盟
2394263740 at qq.com
Sat Apr 21 09:44:06 CEST 2012
Matthew,
Great!
Thanks for your reply. It helps. We will use this solution.
Tom
------------------ Original ------------------
From: "freeradius-users"<freeradius-users-request at lists.freeradius.org>;
Date: Fri, Apr 20, 2012 05:30 PM
To: "freeradius-users"<freeradius-users at lists.freeradius.org>;
Subject: Freeradius-Users Digest, Vol 84, Issue 65
Send Freeradius-Users mailing list submissions to
freeradius-users at lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-request at lists.freeradius.org
You can reach the person managing the list at
freeradius-users-owner at lists.freeradius.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re:Freeradius Access Requet ID (Matthew Newton)
2. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour)
3. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Fajar A. Nugraha)
4. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Alan DeKok)
5. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (alan buxey)
6. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour)
7. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour)
8. How to grant access to a network regardless of the
username/password? (Henrik Karlsson)
----------------------------------------------------------------------
Message: 1
Date: Fri, 20 Apr 2012 08:52:15 +0100
From: Matthew Newton <mcn4 at leicester.ac.uk>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re:Freeradius Access Requet ID
Message-ID: <20120420075215.GA7240 at rootmail.cc.le.ac.uk>
Content-Type: text/plain; charset=utf-8
On Fri, Apr 20, 2012 at 03:42:09PM +0800, ?????? wrote:
> We know the post-authentication query can do something which we know who is pass.
>
> We don't have a method to log the rejected request.
Put something in the Post-Auth-Type REJECT section of post-auth to
log whatever you want.
post-auth {
Post-Auth-Type REJECT {
# here
}
}
Matthew
--
Matthew Newton, Ph.D. <mcn4 at le.ac.uk>
Systems Architect (UNIX and Networks), Network Services,
I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp at le.ac.uk>
------------------------------
Message: 2
Date: Fri, 20 Apr 2012 10:53:32 +0300
From: Wassim Zaarour <wassim.zaarour at navlink.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.
Message-ID: <CBB6EF8C.ED0C%wassim.zaarour at navlink.com>
Content-Type: text/plain; CHARSET=US-ASCII
Hi Farja,
I just checked with the ldap admin and he told me passwords are stored
with SHA encryption and not cleartext. ( can't change them to clear text)
Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with it??
If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck with
the windows laptops as they have PEAP/MSCHAPv2 only.
Any workaround?
Thanks
Wassim.
On 4/20/12 10:30 AM, "Fajar A. Nugraha" <list at fajar.net> wrote:
>On Fri, Apr 20, 2012 at 2:22 PM, Wassim Zaarour
><wassim.zaarour at navlink.com> wrote:
>
>> On 4/20/12 10:15 AM, "Fajar A. Nugraha" <list at fajar.net> wrote:
>
>>>Long version:
>>>MSCHAPv2 (which also means PEAP-MSCHAPv2) needs either:
>>>- Cleartext-Password or NT-Hash available (in LDAP, sql, users file
>>>whatever), OR
>>>- an active directory
>>>
>>>If you don't have either, then it won't work.
>>
>> Hi Farja,
>>
>> Passwords are stored as clear text in my LDAP, that should make MSCHAPv2
>> work right?
>
>Yes, if FR can find them. This part of the log says it can't:
>
>[ldap] performing search in o=navbey.com, dc=navbey,dc=com, with filter
>(uid=pk)
>[ldap] looking for check items in directory...
>[ldap] looking for reply items in directory...
>WARNING: No "known good" password was found in LDAP. Are you sure that
>the user is configured correctly?
>
>You might need to play around with the user used to login to LDAP, as
>some systems only give out passwords to admin accounts. Testing manual
>LDAP lookup using command line tool (e.g. ldapsearch) helps. If you
>CAN get your ldap server to return cleartext password with ldapsearch,
>then you should be able to configure FR to get that as well.
>
>--
>Fajar
>-
>List info/subscribe/unsubscribe? See
>http://www.freeradius.org/list/users.html
------------------------------
Message: 3
Date: Fri, 20 Apr 2012 15:01:13 +0700
From: "Fajar A. Nugraha" <list at fajar.net>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.
Message-ID:
<CAG1y0segiKtFkiE2M5xu+7kAwYtjvNc0+0PCxZTT51AuKYjJWw at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
On Fri, Apr 20, 2012 at 2:53 PM, Wassim Zaarour
<wassim.zaarour at navlink.com> wrote:
> I just checked with the ldap admin and he told me passwords are stored
> with SHA encryption and not cleartext. ( can't change them to clear text)
Figured as much :)
> Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with it??
Yes
> If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck with
> the windows laptops as they have PEAP/MSCHAPv2 only.
>
> Any workaround?
No.
Not unless you're willing to install 3rd-party supplicant on every
windows client.
--
Fajar
------------------------------
Message: 4
Date: Fri, 20 Apr 2012 10:15:03 +0200
From: Alan DeKok <aland at deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.
Message-ID: <4F911B07.50509 at deployingradius.com>
Content-Type: text/plain; charset=ISO-8859-1
Wassim Zaarour wrote:
> Hi Farja,
>
> I just checked with the ldap admin and he told me passwords are stored
> with SHA encryption and not cleartext. ( can't change them to clear text)
>
> Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with it??
>
> If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck with
> the windows laptops as they have PEAP/MSCHAPv2 only.
>
> Any workaround?
http://deployingradius.com/documents/protocols/compatibility.html
Alan DeKok.
------------------------------
Message: 5
Date: Fri, 20 Apr 2012 09:18:59 +0100
From: alan buxey <A.L.M.Buxey at lboro.ac.uk>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.
Message-ID: <20120420081859.GA11042 at lboro.ac.uk>
Content-Type: text/plain; charset=us-ascii
Hi,
> I just checked with the ldap admin and he told me passwords are stored
> with SHA encryption and not cleartext. ( can't change them to clear text)
is this LDAP or AD? if its AD then you can bind your FreeRADIUS box to the AD
as per docs on deployingradius.com - then it can use ntlm_auth to do PEAP
very happily for windows clients - its what we do for our 20k users for 802.1X
alan
------------------------------
Message: 6
Date: Fri, 20 Apr 2012 11:19:43 +0300
From: Wassim Zaarour <wassim.zaarour at navlink.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.
Message-ID: <CBB6F671.ED1B%wassim.zaarour at navlink.com>
Content-Type: text/plain; CHARSET=US-ASCII
Thanks Alan for the link,
I just ran to it few minutes back and its clear :)
Guess I'm gonna have to settle for a third party supplicant since I can't
change in the LDAP password storage config.
Thanks also for the other Alan and Farja.
On 4/20/12 11:15 AM, "Alan DeKok" <aland at deployingradius.com> wrote:
>Wassim Zaarour wrote:
>> Hi Farja,
>>
>> I just checked with the ldap admin and he told me passwords are stored
>> with SHA encryption and not cleartext. ( can't change them to clear
>>text)
>>
>> Does that means there is no way to make TTLS/PEAP/MSCHAPv2 work with
>>it??
>>
>> If I use TTLS/PAP from a Mac OS laptop, it works fine, but I'm stuck
>>with
>> the windows laptops as they have PEAP/MSCHAPv2 only.
>>
>> Any workaround?
>
>http://deployingradius.com/documents/protocols/compatibility.html
>
> Alan DeKok.
>-
>List info/subscribe/unsubscribe? See
>http://www.freeradius.org/list/users.html
------------------------------
Message: 7
Date: Fri, 20 Apr 2012 11:28:54 +0300
From: Wassim Zaarour <wassim.zaarour at navlink.com>
To: FreeRadius users mailing list
<freeradius-users at lists.freeradius.org>
Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.
Message-ID: <CBB6F8CA.ED21%wassim.zaarour at navlink.com>
Content-Type: text/plain; CHARSET=US-ASCII
It's Sun Directory Server, hence LDAP not AD.
Thanks anyways :)
On 4/20/12 11:18 AM, "alan buxey" <A.L.M.Buxey at lboro.ac.uk> wrote:
>Hi,
>
>> I just checked with the ldap admin and he told me passwords are stored
>> with SHA encryption and not cleartext. ( can't change them to clear
>>text)
>
>is this LDAP or AD? if its AD then you can bind your FreeRADIUS box to
>the AD
>as per docs on deployingradius.com - then it can use ntlm_auth to do PEAP
>very happily for windows clients - its what we do for our 20k users for
>802.1X
>
>alan
>-
>List info/subscribe/unsubscribe? See
>http://www.freeradius.org/list/users.html
------------------------------
Message: 8
Date: Fri, 20 Apr 2012 11:30:13 +0200
From: Henrik Karlsson <Henrik.Karlsson at Generic.se>
To: "freeradius-users at lists.freeradius.org"
<freeradius-users at lists.freeradius.org>
Subject: How to grant access to a network regardless of the
username/password?
Message-ID:
<5D4FE383D0CD43418076B92AA238BA8B0100EBB56656 at nova.intra.generic.se>
Content-Type: text/plain; charset="us-ascii"
Hi,
I have a dial-in system that use freeRADIUS as radius server. I have figured out how to log username and password from access requests in a SQL database. My next goal is to be able to keep on logging Username and password but accept all users regardless of username/password. The user shall not need to be listed as a user in the RADIUS server. I want to grant access for all users that dial in for access to the network, hut I need to log the username and password that they send to the RADIUS server.
Username and password are stored in a Mysql database and we use PAP.
Is it possible to make this configuration and if it is possible how do I do it.
/Henrik
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120420/c90a307b/attachment.html>
------------------------------
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
End of Freeradius-Users Digest, Vol 84, Issue 65
************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120421/16041363/attachment-0001.html>
More information about the Freeradius-Users
mailing list