Re: Freeradius EAP TTLS

2007-04-10 Thread Alan DeKok
[EMAIL PROTECTED] wrote: I'm quite new to Freeradius and EAP. I'm currently trying to test out EAP TTLS between Free radius and Cisco AP 1200 and a EAP client. Is it possibe to use test server certificates to do this? Yes. Does anyone have a sample configuration of Freeradius to do this?

Re: two database

2007-04-10 Thread Nirmal
Thanks Mr. Alan Dekok and Mr. Arran Cudbard-Bell for your help. i tried the same and its working gr8. Thanks, i appreciate your help. Nirmal Patel +91-9323704733 Arran Cudbard-Bell [EMAIL PROTECTED] wrote: Nirmal wrote: can i use two sql database in sql.conf for free

Re: two database

2007-04-10 Thread Nirmal
Thanks Mr. Alan Dekok and Mr. Arran Cudbard-Bell for your help. i tried the same and its working gr8. Thanks, i appreciate your help. Nirmal Patel +91-9323704733 Arran Cudbard-Bell [EMAIL PROTECTED] wrote: Nirmal wrote: can i use two sql database in sql.conf for free

Re: Very Newbie question

2007-04-10 Thread Antuan Avdioukhine
On Mon, Mar 26, 2007 at 09:23:49PM +0100, [EMAIL PROTECTED] wrote: Did I understand you correctly? After discovering documentstion and reading this mailing list I gueas that you meas something like this: For 2nd category I'm using entries in 'users' file something about: internalAuth-type

freeradius with samba domain and port-access

2007-04-10 Thread Christian Hohmann
Dear List-Members, I’m trying to setup a port access control using freeradius, but I can’t succeed so far. I’m looking for a solution fitting the following points: Port authentication trough an hp switch, dynamic vlan assignment by the freeradius server. I solved the problem for clients that

RE: Very Newbie question

2007-04-10 Thread Ivan Kalik
Something like that. You can check what are you receiveing as Calling-Station-Id for the second group in debug mode (radiusd -X). Normally it is a phone number or MAC address. And watch out for the syntax: Calling-Station-Id should be check item so it should go on the first line. Syntax is:

freeradiusd segfaulting on HUP (check_crl enabled)

2007-04-10 Thread inverse
}/certs/crl/root.pem CA_path = ${raddbdir}/certs/crl dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random check_cert_cn = %{User-Name} check_crl = yes latest (today's freeradius-server-snapshot-20070410

Re: freeradius with samba domain and port-access

2007-04-10 Thread Alan DeKok
Christian Hohmann wrote: Now the Problem: Some workstations are added to a samba managed domain and can only login on the samba service. It seems to me, that the winxpsp2 supplicant first wants to authenticate at the samba server. But the switch doesn�t allow the connection, because the port

freeradius mssql problem

2007-04-10 Thread satish patel
Dear I have many time posted question about freeradius mssql but i didnt get any satisfied ans i am again going to explain my problem i have freeradius version 1.1.0 with runing mssql windows and problem is acct-stop packet i have cisco NAS vpdn configuration users login and start

Re: Alternate proxying methods.

2007-04-10 Thread Arran Cudbard-Bell
There was an implementation of it in 0.1 or 0.2, but it was removed because is caused a great many problems in the server core. I had a feeling it might be that, it seems it would break with the rather linear flow of freeradius. I had assumed that it would copy the incoming packet to

Re: Problem with mschap, ntlm_auth and a conditional syntax

2007-04-10 Thread Alan DeKok
Lukasz Lacinski wrote: Below is my previous e-mail, but with output from freeradius in format easier to read. I use ntlm_auth in mschapv2 (freeradius 20070409) by the following line in radiusd.conf: ntlm_auth = /usr/local/eduroam/progs/ntlm/ntlm_auth.pl --request-nt-key

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Alan DeKok
Alan DeKok wrote: I've just committed massive changes to the server core. The diff is about 3k lines, and doesn't include deleted or added files. More code changes today: Multiple requests are proxied to a home server. If the home server is marked dead while the NAS is retransmitting

Re: Alternate proxying methods.

2007-04-10 Thread Alan DeKok
Arran Cudbard-Bell wrote: Ah but this would send all the accounting data out to the jrs proxies, for which jrs might not look on us too kindly for . Only a relatively small amount of accounting data would actually need to go off site... for users from other institutions using our wireless

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Arran Cudbard-Bell
/list/users.html attr_filter: Matched entry jrs at line 74 modcall[pre-proxy]: module attr_filter.pre-proxy returns updated for request 13 radius_xlat: '/usr/local/freeradius/var/log//20070410/pre-proxy-detail' rlm_detail: /usr/local/freeradius/var/log//%Y%m%d/pre-proxy-detail expands to /usr

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Arran Cudbard-Bell
Arran Cudbard-Bell wrote: Alan DeKok wrote: Alan DeKok wrote: I've just committed massive changes to the server core. The diff is about 3k lines, and doesn't include deleted or added files. More code changes today: Multiple requests are proxied to a home

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Alan DeKok
Arran Cudbard-Bell wrote: ... FAILURE: Home server 194.83.56.249 port 1812 is dead. RETRY: Proxying request 13 to different home server 194.82.174.185 port 1812 ... Didn't do that before :S Yup. $ cvs update $ make :) Also, if you have SNMP enabled, it now prints out that it's

Re: freeradius with samba domain and port-access (Christian)

2007-04-10 Thread Alan DeKok
The Windows clients can be configured to log on with machine credentials. For this, they will need accounts in AD. This has been tested to work with FreeRADIUS for a while. I haven't done it myself, but search the net docs. It does work. Once that happens, the switch thinks that the

Re: two database

2007-04-10 Thread Thor Spruyt
http://wiki.freeradius.org/Rlm_sql - Original Message - From: Nirmal To: FreeRadius users mailing list Sent: Monday, April 09, 2007 1:53 PM Subject: Re: two database can i use two sql database in sql.conf for free radius version 0.9 ? currently i m using freeradius 0.9

Re: 1.1.5 double free or corruption

2007-04-10 Thread ChristosH
I'm getting a similar error, except mine's 0x09fc4f10. Apparently this has to do with the Perl library (and means we'll have to recompile) but I have no idea how to upgrade that. I'm on CentOS 4.4 and have run the auto-updater, am on the CentOS Plus repository and have MySQL installed. Thor

Re: double free or corruption errors with 2.0.0-pre0

2007-04-10 Thread ChristosH
I think you need to step back and relax, Mat. If a developer can't get the situation reproduced or even debug info on it, they'll be helpless. Do also realize this is an open source free utility that doesn't come with any guaranteed support. Was this a problem for you in 1.1.4? I know for me it

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Arran Cudbard-Bell
Alan DeKok wrote: Got another one for you :P rlm_detail: /usr/local/freeradius/var/log//%Y%m%d/pre-proxy-detail expands to /usr/local/freeradius/var/log//20070410/pre-proxy-detail radius_xlat: 'Tue Apr 10 18:34:28 2007' modcall[pre-proxy]: module pre_proxy_log returns ok for request 31

Re: freeradius with samba domain and port-access (Christian)

2007-04-10 Thread Arran Cudbard-Bell
Thanks for help. I think so too, but I have no idea how or even if it is possible. The WXPSP2 Client with user authentication is not able to authanticate against the freeradius. There is not even a request arriving on the freeradius. If I toggle to Identify with ComputerInformation if

Re: add realm to user based on NAS-IP

2007-04-10 Thread Alexander Papenburg
Hi Arran, hi Alexander and hi Freeradius-List, I ran into problems regarding to the Proxy-to-realm thing... :( My Setup: 10.0.0.1 A cisco Router 10.0.1.20 My Terminal 192.168.0.1 Radius (Home Server) 192.168.0.2 Radius (Proxy) At first a successful login with username [EMAIL PROTECTED]:

Re: 1.1.5 double free or corruption

2007-04-10 Thread Roberto Greiner
ChristosH wrote: I'm getting a similar error, except mine's 0x09fc4f10. Apparently this has to do with the Perl library (and means we'll have to recompile) but I have no idea how to upgrade that. I'm on CentOS 4.4 and have run the auto-updater, am on the CentOS Plus repository and have MySQL

Re: 1.1.5 double free or corruption

2007-04-10 Thread ChristosH
Roberto Greiner wrote: MALLOC_CHECK_=0 Now, is that done in the configure (./configure --MALLOC_CHECK_=0), at the make (MALLOC_CHECK_=0) or at the runtime? -- View this message in context: http://www.nabble.com/1.1.5-double-free-or-corruption-tf3378130.html#a9925976 Sent from the

Re: add realm to user based on NAS-IP

2007-04-10 Thread Arran Cudbard-Bell
Alexander Papenburg wrote: Hi Arran, hi Alexander and hi Freeradius-List, I ran into problems regarding to the Proxy-to-realm thing... :( My Setup: 10.0.0.1 A cisco Router 10.0.1.20 My Terminal 192.168.0.1 Radius (Home Server) 192.168.0.2 Radius (Proxy) At first a successful login

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Kevin Bonner
On Tuesday 10 April 2007 13:51:29 Arran Cudbard-Bell wrote: and finally, how do you define a binding for the snmp module it's on, but I never explicitly bound it to anywhere :| unlike auth/acct that are bound with listen sections. Seems like there may be a need for a small extension to

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Arran Cudbard-Bell
Kevin Bonner wrote: On Tuesday 10 April 2007 13:51:29 Arran Cudbard-Bell wrote: and finally, how do you define a binding for the snmp module it's on, but I never explicitly bound it to anywhere :| unlike auth/acct that are bound with listen sections. Seems like there may be a need for

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Arran Cudbard-Bell
Arran Cudbard-Bell wrote: Kevin Bonner wrote: On Tuesday 10 April 2007 13:51:29 Arran Cudbard-Bell wrote: and finally, how do you define a binding for the snmp module it's on, but I never explicitly bound it to anywhere :| unlike auth/acct that are bound with listen

Re: double free or corruption errors with 2.0.0-pre0

2007-04-10 Thread Alan DeKok
ChristosH wrote: Alan, you said 1.1.6 will be addressing this specific issue, or is it something I should continue looking into? There is a known double free in 1.1.5 that will be fixed in 1.1.6. That should be released this week. Do you have a schedule posted for 2.0.0. Soon. At this

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Alan DeKok
Arran Cudbard-Bell wrote: ... Assertion failed in event.c, line 669 Hmm... OK. Happens after all the home servers have been marked as dead, and you have an incoming request... though could be when it's firing off a ping check event. Either way it's repeatable, and *only* happens when

Re: add realm to user based on NAS-IP

2007-04-10 Thread Arran Cudbard-Bell
Alexander Papenburg wrote: You should also comment out any rlm_realm instances in the authorize section. The Problem is, suffix is already commented out in authorize section. IMHO the user [EMAIL PROTECTED] (see 1st try) won't work either. - List info/subscribe/unsubscribe? See

Re: Problem with mschap, ntlm_auth and a conditional syntax

2007-04-10 Thread Lukasz Lacinski
Alan DeKok wrote: I've committed a fix to CVS head. Please re-test. OK. I'm going to test it as soon as possible. It means when SIGSEGV will not be so fast ;-) Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port

Re: returning VSA from exec-prog-wait

2007-04-10 Thread Alan DeKok
Murray Hooper wrote: Can I return VSA(106) from a script called from exec-prog-wait? I am trying to echo H323-redirect-number= but the NAS does not see this as VSA 106 If you run the serber in debugging mode, as suggested in the FAQ, README, and INSTALL, you will see the results of

Re: Version 2.0 is a lot closer to reality...

2007-04-10 Thread Alan DeKok
Arran Cudbard-Bell wrote: Assertion failed in event.c, line 669 ... Happens after all the home servers have been marked as dead, and you have an incoming request... though could be when it's firing off a ping check event. Either way it's repeatable, and *only* happens when all home servers