Re: FreeRADIUS + Cygwin + Active Directory authentication?

2011-02-10 Thread Alan Buxey
Hi, Frankly, running Free Radius on windows sounds like a bad idea, especially should you ever need to update it or have another person (maybe 5 years down the road) change it a bit. Generally, running server process under cygwin is a lot of extra work for not much convenience. I would

Re: FreeRADIUS + Cygwin + Active Directory authentication?

2011-02-10 Thread Alan DeKok
Moe, John wrote: I'm trying to set up a FreeRADIUS server in our organization, and the corporate preference is to run on Windows. I've got FreeRADIUS to compile and have successfully completed the PAP test (from http://deployingradius.com/documents/configuration/pap.html) to make sure it

rlm_python and the Tunnel-Private-Group-Id attribute

2011-02-10 Thread Bob Brandt
Not sure if there isn't another forum or mailing list for rlm_python specifically, but... I have been using freeradius for a while now with great results, thanks! We are using a very simple configuration to authenticate users against LDAP (eDirectory) and that part works great! I am trying to

Re: rlm_python and the Tunnel-Private-Group-Id attribute

2011-02-10 Thread Alan DeKok
Bob Brandt wrote: All my testing seems to indicate it should work, but it is not. I believe the problem is in how rlm_python returns the Tunnel-Private-Group-Id attribute. As a string. The server core parses it into whatever is necessary. Date, IP address, etc. Below are the two snipets

AW: Authenticating SSH login on a Cisco IOS switch to AD

2011-02-10 Thread Schaatsbergen, Chris
Gary Would you mind if I contacted you directly (I have your e-mail) about this? I have seen a very nice discussion and reading this a second time has proven that what you describe here is exactly what we are looking for. But I would still really appreciate some help getting it to work. Thanks,

Re: rlm_python and the Tunnel-Private-Group-Id attribute

2011-02-10 Thread Bob Brandt
My only observation right now is that there is a colon (:=)in the debug of the working server. Would that make any difference? On Thu, Feb 10, 2011 at 11:09 AM, Alan DeKok al...@deployingradius.com wrote: Below are the two snipets of the debugs.  The first is from the old(working) system

Re: How to get fractions of seconds?

2011-02-10 Thread Alan DeKok
Ramon J. Castillo wrote: I see it useful too, when specifying for example response_window that instead of be 1 One second could be 1200 as in twelve hundred milliseconds. I'm surprised that would be useful. I have found some devices that time out in 3 seconds , The vendors need to

Re: AW: Authenticating SSH login on a Cisco IOS switch to AD

2011-02-10 Thread Alan DeKok
Oliver Elliott wrote: I had a look into this and as far as I could tell, the conversation between the switch and the radius server was not encrypted unless you use TACACS. Does anyone know if this conversation can be encrypted while using Freeradius, as otherwise the domain login details are

EAP and Accounting

2011-02-10 Thread David Peterson
I am working with a NAS that only sends accounting packets with the EAP style username. Other than matching up =7Bam=3D1=7df717cc32fff26ff29ca0baac5833f...@wimax.com with b...@wimax.com manually in the database are there other methods for achieving this? David - List

Re: AW: Authenticating SSH login on a Cisco IOS switch to AD

2011-02-10 Thread Gary Gatten
That's fine. I'm refreshing myself on our confs this morn, so I'll be able to help you more effeciently after that. In the mean time ensure your SAMBA works, that can take a little work. Also, obtain the SID of the AD group you want to check membership of. NTLM_AUTH says it can use the group

Re: rlm_python and the Tunnel-Private-Group-Id attribute

2011-02-10 Thread Brett Littrell
Hi Bob, I do have this running successfully with eDir. I am guessing you are using the eDir Radius schema extensions? Also, if you are using Cisco equipment, you have to send the vlan name, not the ID. Not sure if other switches require the ID. Brett Littrell Network Manager MUSD

Re: rlm_python and the Tunnel-Private-Group-Id attribute

2011-02-10 Thread Brett Littrell
Sorry, Reading a little deeper into the email, I do not have it the way you set it up. I use eDir for all the DVlan attributes and have Radius query when the user logs in. Most of the assignments are done via Radius profiles in eDir. The Cisco thing I know is the case however, was pulling

Framed-IP-Address AVP missing

2011-02-10 Thread Rajkumar R
Hi, This query is related to Cisco-7206 equipment behavior. We have a Cisco 7206(IOS12.2(33)) equipment associated with freeRadius server2.1.10. Upon PPPOE client start, dynamic IP is assigned from the IP-Pool to the PPPOE client. However this IP address, is not included in the