freerqdisu2 and peap-eap-tls

Hello, I am considering if it is worth to use PEAP with eap-tls in the inner tunnel, so peap-eap-tls. I find it useful for windows people authenticationg in the eduroam environment. Anyway I did not find documentation about it aside this note http://wiki.freeradius.org/EAP-PEAP and I would

Re: how to disable a particular EAP type in freeradius2 for a particular ESSID ?

On 2/10/12 6:54 PM, Alan Buxey wrote: Yes. Perfectly possible...just need to make copies of the 'files' module file, then give it is name (as per docs), then out a different users file in the second copy. In the virtual server you can then call the copy of the files module that uses that

how to disable a particular EAP type in freeradius2 for a particular ESSID ?

Hello, I have a radius infrastructure with multiple ESSID. in particular I have the eduroam ESSID and another local ESSID. They are managed by my freeradius2 server with 2 virtual-server instances, one for eduroam and the other for my local ESSID. Both are 802.1x infrastructures. I have always

Re: how to disable a particular EAP type in freeradius2 for a particular ESSID ?

On 2/10/12 12:57 PM, Phil Mayers wrote: On 10/02/12 11:33, Riccardo Veraldi wrote: Hello, I have a radius infrastructure with multiple ESSID. in particular I have the eduroam ESSID and another local ESSID. They are managed by my freeradius2 server with 2 virtual-server instances, one

Re: DH parameter generation hanging

On 3/14/11 6:14 PM, Alan DeKok wrote: Riccardo Veraldi wrote: the problem is when starting freeradius, it hangs forever when generating DH parameters. Any clue on this problem ? $ cd /etc/raddb/certs $ ./bootstrap Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org

DH parameter generation hanging

Hello, freeradius 2.1.10 here on soekris net5501 radiusd: FreeRADIUS Version 2.1.10, for host i386-unknown-openbsd4.9, built on Mar 11 2011 at 11:20:43 the problem is when starting freeradius, it hangs forever when generating DH parameters. Any clue on this problem ? thank you Rick

Re: Supplicant for Windows (XP, Vista and W7)

A good one but it is not free J Brandon Polley wrote: SecureW2 is a good one rrperez rrpe...@apc.edu.ph 8/20/2010 12:22 AM Hi, Does anyone knows a supplicant that might work on windows platforms such as XP, Vista and Windows 7? -- View this message in context:

Re: freeradius2 with EAP-TLS and LDAP authorization

For starting it should be enough but what I am not able to do is to set up the correct sequence. First I need to extract the CN field (which can be done and I Already did and I can set up a list of allowed CN in hte users file), and after I need to do an LDAP query to check for authorization.

freeradius2 with EAP-TLS and LDAP authorization ?

Hello, is it possible in some way to use EAP-TLS X509 authentication together with LDAP authorization in freeradius2 ? Actually freeradius2 allows EAP-TLS authentication, but if I wanted to extract the emailAddress or CN field from the X509 certificate and authorize it against my LDAP tree

freeradius Kerberos config in users file ?

Hello, I ahve jsut a question. if I configure freeradius2 with krb5 authentication and I use the following users file, the authentication works using radtest DEFAULTAuth-Type := Kerberos but it fails using EAP (EAP-TTLS) telling USer-PAssword attribute is missing... rlm_ldap:

freeradius Kerberos config in users file ?

Hello, I have just a question. if I configure freeradius2 with krb5 authentication and I use the following users file, the authentication works using radtest DEFAULTAuth-Type := Kerberos but it fails using EAP (EAP-TTLS) telling USer-PAssword attribute is missing... rlm_ldap:

Re: freeradius Kerberos config in users file ?

thank you, now it is much more clear to me Rick Alan DeKok wrote: Riccardo Veraldi wrote: if I configure freeradius2 with krb5 authentication and I use the following users file, the authentication works using radtest DEFAULTAuth-Type := Kerberos See man users about

Re: Help connecting to remote ldap server

Raymond Norton wrote: I successfully configured freeradius (version 1.x Ubuntu) to use ldap on a localhost via WPA. I am trying to setup version 2.1 (Ubuntu) to use a remote ldap server now. The module loads fine and I made what I believed were the correct changes to connect to the remote

setting freeradius2 to AD authentication

Hello, configuring freeradius2 to authenticate using AD as described by Enrik http://archives.free.net.ph/message/20060104.153134.68c5be76.en.html should it work with PEAP also ? or it works only eith EAP-TTLS ? The method is different from the one reported in the freeradius wiki

Re: setting freeradius2 to AD authentication

: Riccardo Veraldi wrote: configuring freeradius2 to authenticate using AD as described by Enrik http://archives.free.net.ph/message/20060104.153134.68c5be76.en.html From 2006. Why?. should it work with PEAP also ? or it works only eith EAP-TTLS ? No ide. The method

Re: problem migrating to freeradius2 with LDAP/krb5 Authorization/Authentication

Alan DeKok wrote: Riccardo Veraldi wrote: radtest u...@myrealm.org password localhost 10 testing123 ... [r...@radius ~]# kinit user Password for u...@myrealmg.org: The realm names are different. Is this intentional? Try placing the name password into a text file

Re: problem migrating to freeradius2 with LDAP/krb5 Authorization/Authentication

I removed the EAP line and keep only the Kerberos line in users DEFAULTAuth-Type := Kerberos I have this error using radtest: radtest u...@myrealm.org password localhost 10 testing123 Sat Jun 19 23:53:10 2010 : Auth: rlm_krb5: [user] krb5_rd_req() failed: Wrong principal in

Re: problem migrating to freeradius2 with LDAP/krb5 Authorization/Authentication

here is the log after correcting file users: [pap] WARNING! No known good password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Kerberos +- entering group Kerberos {...} rlm_krb5: [user] krb5_rd_req() failed: Wrong principal in request

problem migrating to freeradius2 with LDAP/krb5 Authorization/Authentication

Hello, i moved my old freeradius 1.x server to freeradius 2 I am on CentOS5.5 freeradius2-utils-2.1.7-7.el5 freeradius2-mysql-2.1.7-7.el5 freeradius2-2.1.7-7.el5 freeradius2-postgresql-2.1.7-7.el5 freeradius2-python-2.1.7-7.el5 freeradius2-unixODBC-2.1.7-7.el5 freeradius2-krb5-2.1.7-7.el5

Re: 802.1x -Radius -Ldap

check this out http://www.clearfoundation.com/docs/howtos/setting_up_freeradius2_to_use_ldap Kyle Plimack wrote: I’m trying to use ldap to authorize/authenticate my users into the wireless network using 802.1x. I just created a fresh installation of freeradius 2.1.7. We use Centos

checking DN of user certificate

Hello, when using EAP-TLS I would like to check the DN of hte user certificate and in particulare I need to check the Locality (L) string to matcha particular string. Is it possible in some way ? thanks Rick - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: filter anonymous identity

Alan DeKok wrote: Riccardo Veraldi wrote: Unfortunately I am bound to 1.1.7 version in my whole infrastructure That's sad. It means you can't take advantage of the many new features in 2.1. how can I copy inner identity and send it to access-accept? See

filter anonymous identity

Hello, on radius 1.1.x I have some users autenticating using an outer identity. This is annoying to me because in the radius.log file I cannot identify easily who is the real user autenticating, since outer identity can be anything. How can I forbid in freeradius configuration to use an outer

Re: filter anonymous identity

Unfortunately I am bound to 1.1.7 version in my whole infrastructure how can I copy inner identity and send it to access-accept? Thanks Il giorno 25/mag/09, alle ore 18:52, Ivan Kalik t...@kalik.net ha scritto: Hello, on radius 1.1.x I have some users autenticating using an outer

problem with proxying

Hello, freeradius 1.1.3 on CentOS 5.2 I have problem with proxying. In a normal proxying configuration when the username contains a domain different from local defined one the request is proxied to the DEFAULT proxy entry. Here instead proxy does not happen and I have this warning in the logs:

blocking anonymous outer identity

Hello, I have some anonymous outer identity in the autentication log of freeradius. I use freeradius version 2.0 with EAP-TTLS and 802.1x on hte supplicant side. how can I forbid users to use an anonymous identity or to use an outer identity different from the real identity used for

PEAP version 1

Hello, new network manager version prompt for PEAP version 0 or version 1. Is there support for PEAP version 1 on freeradius ? thanks Riccardo - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED]

I will try to put all the people I do not want to authenticate to a specific LDAP group, anyway I do not know how to do it using the users file to reject a specific LDAP group thanks Riccardo Alan DeKok wrote: Riccardo Veraldi wrote: Not all the people having a certificate should

Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED]

which has X509 certificate with a OU different from a certain value ? thanks Rick Alan DeKok wrote: Riccardo Veraldi wrote: but still authentication is succesful using EAP-TLS even if user is not in LDAP Directory. any hints ? That's how EAP-TLS works. If you issued them

Re: radius x509 authentication + LDAP ?

451 cli 001e.5271.e700) Sending Access-Accept of id 73 to 192.168.252.13:1645 my correct username in LDAP is veraldi thank you very much Riccardo Alan DeKok ha scritto: Riccardo Veraldi wrote: After authentication I would like to chack the common name or email address propertires of te

Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED]

: UNCLASSIFIED -Original Message- From: [EMAIL PROTECTED] eradius.org [mailto:freeradius-users- [EMAIL PROTECTED] On Behalf Of Riccardo Veraldi Sent: Friday, 23 May 2008 16:43 To: FreeRadius users mailing list Subject: Re: radius x509 authentication + LDAP ? I have

Re: radius x509 authentication + LDAP ? [SEC=UNCLASSIFIED]

i tryed to set access_attr = uid access_attr_used_for_allow = yes but still authentication is succesful using EAP-TLS even if user is not in LDAP Directory. any hints ? thanks Rick Riccardo Veraldi ha scritto: ok changing the ldap filter everything seems to work and I am authorized

radius x509 authentication + LDAP ?

Hello, I am actually using freeradius with EAP-TLS and x509 user certificat authentication. After authentication I would like to chack the common name or email address propertires of te certificate againsta LDAP, to authorize the user connection. is it possible to do this ? I tyed but it

EAP TLS Authentication with eToken

Hello, anyone has used eToken Aladdin 64k with EAP-TLS authentication using wpa_supplicant ? thank you Rick - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

radius user-password on the wire

Hello, I used wireshark to sniff communication between my radisu server and the user-password attribute is encrypted 3e ca 2d b0 97 2b b3 f9 0c e9 fc e7 e0 ed e9 fd to test if this is strong enough I wanted to ask if there is a way to decrypt

Re: How to enable only EAP-TTLS type and not EAP-TLS?

I think there is a cleaner way. I enabled only EAP-TTLS and disabled EAP-TLS just puttting this lin in /etc/radddb/users DEFAULTEAP-Type == EAP-TLS, Auth-Type := Reject It works, I think Alan gave me this hint 1 year ago, maybe it could be put in the FAQ since it is an interesting

Re: How to enable only EAP-TTLS type and not EAP-TLS?

Yes this is much better, but anyway I had disabled PEAP in eap.conf. thanks Rick Arran Cudbard-Bell ha scritto: Riccardo Veraldi wrote: I think there is a cleaner way. I enabled only EAP-TTLS and disabled EAP-TLS just puttting this lin in /etc/radddb/users DEFAULTEAP-Type == EAP

problem with EAP-TTLS logging passwords

Hello, I use EAP-TTLS with PAP in my radius proxy infrastructure. The problem is that with option log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes passwords are logged on the intermediate radius servers and also on the final hub radius server since I have a tree radius server

EAP-TLS issues

Hello, I would like to authorize users based on their certificate. Actually is only possible to look at CN using freeradius. Is there any plan to support looking at the complete DN of the certificate so that is possible to check for Locality field or other fileds inside hte certificate subject ?

problems with freeradius 1.0.5

hell oI upgraded from freeradius 1.0.2 to 1.0.5 and nothing works anymore I have this error: radiusd.conf[1682] Unknown Auth-Type Pam in authenticate section. commenting out pam thne I Got this radiusd.conf[1682] Unknown Auth-Type System in authenticate section. and so if I comment out unix

Re: problems with freeradius 1.0.5

Yes these are the messages running radiusd -A -X any hints ? thanks Rick Doug Hardie wrote: On Dec 15, 2005, at 05:42, Riccardo Veraldi wrote: hell oI upgraded from freeradius 1.0.2 to 1.0.5 and nothing works anymore I have this error: radiusd.conf[1682] Unknown Auth-Type Pam

Re: problems with freeradius 1.0.5

was replaced in the upgrade but didn't properly clean up the file. Riccardo Veraldi wrote: Yes these are the messages running radiusd -A -X any hints ? thanks Rick Doug Hardie wrote: On Dec 15, 2005, at 05:42, Riccardo Veraldi wrote: hell oI upgraded from freeradius 1.0.2 to 1.0.5 and nothing

parsing certificate fields ?

Hello, I am using freeradius with 802.11i, everything works fine qith certificate authentication but I Can only parse the CN of the certificate I would like to parse for Locality L field. the new version 1.0.5 support this ? thanks Rick - List info/subscribe/unsubscribe? See

radiusd TLS error

Hello, my users authenticate with EAP-TLS and everything is working fine, but I Always have errors like this in hte log file Fri Sep 30 10:45:33 2005 : Error: TLS_accept:error in SSLv3 read client certificate A what could it be related to ? thanks Rick - List

MAC os X and Cisco TKIP + WEP

Hello, while all my wireless cards workes perfectly with Cisco 1200 AP I have a lot of problems with MAC os X. I configured my Cisco 1200 AP to work with TKIP+WEP128 and Open Authentication with EAP with freeradius server to support both old WEP And newer WPA clients. MAC os X airport extreeme

mac os x with TLS or TTLs problems

Hello, I am using mac os X supplicant with freeradius. The authentication with EAP-TLS or EAP-TTLS succeeds and goes perfectly. the problem is that the mac os X supplicant keeps tring to re-authenticate every 6 seconds endlessly... and this happens aftert succesfull previous authentication. I

verify server certificate XP supplicant ?

Hello, I am using EAP-TLS. Windows XP, Cisco 1200 AP, freeradius. Everything is working fine unless I enable the verify server certificate checkbox on XP. In this case I am not authenticated anymore by the radius server. I Cannot understand why. I have the CA certificate installed I cannot

TLS not tunneled inside TLS

chap returns noop for request 18 modcall[authorize]: module mschap returns noop for request 18 rlm_realm: No '@' in User-Name = Riccardo Veraldi, looking up realm NULL rlm_realm: No such realm NULL modcall[authorize]: module suffix returns noop for request 18 rlm_eap: EAP packet type

EAP-TLS with Freeradius, how to check locality ?

Hello, I would like to authenticate my users who have a certificate but I want to check the /L field (locality name) of the certificate and not the user name which is the /CN of the certificate. is there a way to do this with Freeradius ? thank you Rick - List info/subscribe/unsubscribe? See

Re: MD5 encoded password will not validate

I am very interested in htis topic too but have no idea how to help you :) Actualyl I am interested if this work with utherntication type EAP Rick Quoting Mike Lampson [EMAIL PROTECTED]: Hello all, I tried to ask this question on Friday and didn't receive an answer, so let me try to

peap module

Hello, I am using freeredius 0.9.3 I tryed to configure peap authentication but I ahve this error: rlm_eap: Failed to link EAP-Type/peap: Shared object rlm_eap_peap.so not found radiusd.conf[600]: eap: Module instantiation failed. I am using freeradius on FreeBSD. Perhaps I nee to use

Re: Cisco catalyst + freeradius failing all the time

secret key is correct I am sure. thanks Rick Albert Silva Gibert wrote: I don't know but chek the secret key from the switch and radius. Albert On Fri, 6 Feb 2004, Riccardo Veraldi wrote: I have a big problem with windows XP + cisco catalyst + freeradius. ACtually I am unable

EAP/TLS getting repeated Access-Challenge messages

Hi all, I'm trying to set up EAP/TLS authentication with freeradius 0.9.3 on linux RH 8, an Access Point Cisco 350 (firmware 11.23T) and Windows XP SP1 with a D-link DWL-650 card as a supplicant. The setup is exactly the one described in the excellent document

Re: authentication problem with XP supplicant + CISCO catalyst and freeradius

] (from client sw-v port 0 cli ?) Sending Access-Accept of id 200 to 192.84.145.6:1812 EAP-Message = 0x03010004 Message-Authenticator = 0x Finished request 1 On Thu, 5 Feb 2004, Riccardo Veraldi wrote: Fatto... comunque al mio problema non ha