Re: 2.1.10 Certificate Compatibility Warning

2011-01-06 Thread Alan DeKok
Ben Wiechman wrote: I've been testing EAP-TTLS/MSCHAPv2 authentication with a network device. FreeRADIUS keeps complaining about EAP sessions not finishing with the link to the certificate compatibility wiki link, however the authentication process completes successfully. Looking at the packet

rlm_python and dynload problem

2011-01-06 Thread Aurélien Geron
Hi and happy new year to everyone, In april I wrote the message below about python modules not being able to load dynamic libraries on Debian Lenny. Alan DeKok answered that he would try to fix this in version 2.1.9, and I was very pleased to read the following message in version 2.1.9's

[authorized_macs.authorize] returns noop

2011-01-06 Thread Nagaraj Panyam
Dear experts, I setup mac_auth as in the freeradius wiki and its not working, am unable to debug further. requesting for help! It correctly sets Auth-Type to CSID. but authorized_macs.authorize] returns noop I have pasted debug output and the relevant files below. ## Debug output of

Re: rlm_python and dynload problem

2011-01-06 Thread Josip Rodin
On Thu, Jan 06, 2011 at 11:26:44AM +0100, Aurélien Geron wrote: Hi and happy new year to everyone, In april I wrote the message below about python modules not being able to load dynamic libraries on Debian Lenny. I did not have time to test this ever since, but I just did, and

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Phil Mayers
On 06/01/11 12:48, Nagaraj Panyam wrote: Dear experts, I setup mac_auth as in the freeradius wiki and its not working, am unable to debug further. Hmm. This: http://wiki.freeradius.org/index.php?title=Mac-Auth ...seems like it's a bit... over-engineered? if () unlang statements in the

multiple DNs in check_cert_issuer?

2011-01-06 Thread Hendl Stephan
Hi list, we have a freeradius server with enabled tls and an own CA. We prove the validity of the cert issuer like it is aoutlined in the example below. check_cert_issuer = /C=DE/ST=somewhere/L=someplace/O=AnyCompany No we want to change our CA and want to use two CAs for a couple of weeks. Is

Re: multiple DNs in check_cert_issuer?

2011-01-06 Thread Phil Mayers
On 06/01/11 14:36, Hendl Stephan wrote: Hi list, we have a freeradius server with enabled tls and an own CA. We prove the validity of the cert issuer like it is aoutlined in the example below. check_cert_issuer = /C=DE/ST=somewhere/L=someplace/O=AnyCompany No we want to change our CA and

Re: rlm_python and dynload problem

2011-01-06 Thread Aurélien Geron
Hi Josip, Here are a few commands that I just launched on my server: #uname -a Linux maggie 2.6.26-2-amd64 #1 SMP Thu Nov 25 04:30:55 UTC 2010 x86_64 GNU/Linux #dpkg -l | grep libltdl ii libltdl31.5.26-4+lenny1A system independent dlopen wrapper for GNU

Re: 2.1.10 Certificate Compatibility Warning

2011-01-06 Thread Ben Wiechman
On Thu, Jan 6, 2011 at 4:18 AM, Alan DeKok al...@deployingradius.com wrote: Ben Wiechman wrote: I've been testing EAP-TTLS/MSCHAPv2 authentication with a network device. FreeRADIUS keeps complaining about EAP sessions not finishing with the link to the certificate compatibility wiki link,

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Alexander Clouter
Phil Mayers p.may...@imperial.ac.uk wrote: I setup mac_auth as in the freeradius wiki and its not working, am unable to debug further. Hmm. This: http://wiki.freeradius.org/index.php?title=Mac-Auth ...seems like it's a bit... over-engineered? I think it's Arran who maintains that

first authentification fail second one works

2011-01-06 Thread Markus Burghart
Hello Guys I'm writing from Germany. I write my Bachelor Thesis about the Freeradius Projekt. I have a problem and i can't find a solution for it, at the internet by myself. I'm using version 2.1.9 of freeradius and everything works fine with the authentifications agains my Freeradius

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Phil Mayers
On 06/01/11 15:58, Alexander Clouter wrote: Phil Mayersp.may...@imperial.ac.uk wrote: I setup mac_auth as in the freeradius wiki and its not working, am unable to debug further. Hmm. This: http://wiki.freeradius.org/index.php?title=Mac-Auth ...seems like it's a bit... over-engineered? I

SoH patch (was Re: Microsoft SoH Support)

2011-01-06 Thread James J J Hooper
On 11/10/2010 22:14, James J J Hooper wrote: On 11/10/2010 12:37, Phil Mayers wrote: On 09/10/10 15:01, Garber, Neal wrote: Thanks to a lot of work by Phil Mayers, the server now has support for Microsoft SoH in PEAP, normal RADIUS (MS VPN gateway), and in DHCP. Wow! That *must* have been a

Re: rlm_python and dynload problem

2011-01-06 Thread Aurélien Geron
Hi, The workaround described in http://bugs.debian.org/416266 for perl works for python too, I just tried it: LD_PRELOAD=/usr/lib/libpython2.5.so.1 freeradius -X = works fine Thanks a lot, Aurélien Geron Le 6 janv. 2011 à 14:44, Josip Rodin a écrit : On Thu, Jan 06, 2011 at 11:26:44AM

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Alexander Clouter
Phil Mayers p.may...@imperial.ac.uk wrote: I think it's Arran who maintains that page, however the rewrite_calling_station_id looks like it was palmed off me at some stage. That *is* needed unless you are quite-quite-mad and enjoy twenty different representations for your MAC addresses in

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Arran Cudbard-Bell
On Jan 6, 2011, at 7:58 AM, Alexander Clouter wrote: Phil Mayers p.may...@imperial.ac.uk wrote: I setup mac_auth as in the freeradius wiki and its not working, am unable to debug further. Hmm. This: http://wiki.freeradius.org/index.php?title=Mac-Auth ...seems like it's a bit...

authentication work but i got no access to the protected network

2011-01-06 Thread rogge
Hi All, since a couple of days/weeks i try to setup freeradius. Now i need your help, please. I setup debian lenny with freeradius, md5, eap and users file The wlan router is a linksys wrt 54gl with dd-wrt, wpa enterprise setting the notebook is an open suse 11.0, wpa enterprise, and fix lan

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Arran Cudbard-Bell
*What* RFCness? Apparently, guessing this is Aaran spending too much absorbing the IETF website, RFC2865 says though shalt use 'Call-Check' for mac-auth, I have not read it myself. that seems overkill to you? Cisco switches use PAP instead of CHAP, but other than that whats the

Re: multiple DNs in check_cert_issuer?

2011-01-06 Thread Christ Schlacta
On 1/6/2011 06:36, Hendl Stephan wrote: Hi list, we have a freeradius server with enabled tls and an own CA. We prove the validity of the cert issuer like it is aoutlined in the example below. check_cert_issuer = /C=DE/ST=somewhere/L=someplace/O=AnyCompany No we want to change our CA and

Re: 2.1.10 Certificate Compatibility Warning

2011-01-06 Thread Alan DeKok
Ben Wiechman wrote: Am I to understand as well that it may not be a requirement for the Packet Identifier to be incremented or semi-unique, but it is probably a good best practice to recommend to the hardware vendor? Yes. Alan DeKok. - List info/subscribe/unsubscribe? See

Re: dialup_admin php notice errors

2011-01-06 Thread Alan DeKok
Todd Bateman wrote: Is CS down or the information change? I went to try to see if that was the problem, but I get a connection refused. dialup_admin hasn't used CVS for many years. The latest version is included in 2.1.10, but if you look at the git repository, the dialup_admin code hasn't

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Alexander Clouter
Arran Cudbard-Bell a.cudba...@googlemail.com wrote: I think it's Arran who maintains that page, however the rewrite_calling_station_id looks like it was palmed off me at some stage. Was not! If anything you palmed it off me! I moved 2.* long before you'd given up those ugly rewrite

Re: authentication work but i got no access to the protected network

2011-01-06 Thread Alan Buxey
hi, you cant just do an ACCEPT or plain MD5 password with 802.1X WPA/WPA2 enterprise alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Arran Cudbard-Bell
On Jan 6, 2011, at 6:17 AM, Phil Mayers wrote: On 06/01/11 12:48, Nagaraj Panyam wrote: Dear experts, I setup mac_auth as in the freeradius wiki and its not working, am unable to debug further. Hmm. This: http://wiki.freeradius.org/index.php?title=Mac-Auth ...seems like it's a

Re: rlm_python and dynload problem

2011-01-06 Thread Josip Rodin
On Thu, Jan 06, 2011 at 03:46:07PM +0100, Aurélien Geron wrote: libltdl.so.7 = /usr/lib/libltdl.so.7 (0x7f1018258000) = FreeRADIUS seems to rely on libltdl.so.7, as expected. #grep -i advise freeradius.ltrace = [no output] Apparently, the string advise is nowhere in ltrace's

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Phil Mayers
On 01/06/2011 05:48 PM, Alexander Clouter wrote: We *actually* abuse Postgres' macaddr datatype by doing this: Goddamnit, first I discover all the CIDR bits and think how great that is, but I never thought to look if there was a MAC address one. Be sure to checkout:

Re: [authorized_macs.authorize] returns noop

2011-01-06 Thread Nagaraj Panyam
Hi, In my previous mail while asking for help, I did not fully explain what I wanted to configure. So here goes: I want to configure freeradius to setup MAC based authentication for laptops and hand held devices in my organization. My first preference is to make it purely MAC based and