RADIUS configuration based on source IP

2011-08-30 Thread Jan . Weiss
>I have a variety of Cisco devices that require mutually incompatible values in >a certain RADIUS attribute, Cisco-AVPair. The way I have dealt with this in >the past is with huntgroups -- I assign our engineer group on huntgroup1 to >have Cisco-AVPair set to shell:roles=network-admin, while by

Re: EAP-TLS/PEAP authentication problem(can not reply correct attribute)

2011-08-30 Thread Arran Cudbard-Bell
On 31 Aug 2011, at 08:11, Arran Cudbard-Bell wrote: > > On 31 Aug 2011, at 04:37, gary wrote: > >> Hi All >> I have NAS client which support WISPr standard working with freeradius >> 2.1.10+MySQL 5.5 install on Fedora OS. >> I create my test certificate and configure EAP-TLS/PEAP authenticatio

Re: RADIUS configuration based on source IP

2011-08-30 Thread Arran Cudbard-Bell
> > Proxies are not an issue today. They may be an issue in the future, > though. It's likely that my proxy will itself by running freeradius. > Does Client-IP-Address have the same problem with proxies? Yes. > If yes, is > there a workaround I can use on the proxy itself to populate > NAS-IP

Re: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details

2011-08-30 Thread Arran Cudbard-Bell
Ignore the warnings they're harmless. If you want to fix it then wrap another set of curly braces %{} around the conditional expansion. -Arran On 31 Aug 2011, at 06:54, EasyHorpak.com wrote: > This error by the update query has ":-" but on my update query it have not > ":-" . > Why debug s

Re: EAP-TLS/PEAP authentication problem(can not reply correct attribute)

2011-08-30 Thread Arran Cudbard-Bell
On 31 Aug 2011, at 04:37, gary wrote: > Hi All > I have NAS client which support WISPr standard working with freeradius > 2.1.10+MySQL 5.5 install on Fedora OS. > I create my test certificate and configure EAP-TLS/PEAP authentication well > in my setup. > I am using WINDOWS XP as client pc it c

WARNING: Deprecated conditional expansion ":-". See "man unlang" for details

2011-08-30 Thread EasyHorpak.com
This error by the update query has? ":-"? but? on my update query it have not ":-" . Why debug still show errors and insert instead update !! my debug .. Wed Aug 31 11:45:08 2011 : Info: +- entering group accounting {...} Wed Aug 31 11:45:08 2011 : Info:

EAP-TLS/PEAP authentication problem(can not reply correct attribute)

2011-08-30 Thread gary
Hi All I have NAS client which support WISPr standard working with freeradius 2.1.10+MySQL 5.5 install on Fedora OS. I create my test certificate and configure EAP-TLS/PEAP authentication well in my setup. I am using WINDOWS XP as client pc it can pass authentication but freeradius can not reply

Re: RADIUS configuration based on source IP

2011-08-30 Thread Morty
On Tue, Aug 30, 2011 at 06:43:40PM +0200, Arran Cudbard-Bell wrote: > On 30 Aug 2011, at 18:21, Morty wrote: > > but this device apparently also doesn't set > > NAS-IP-Address or NAS-Identifier, so the usual huntgroup mechanism > > doesn't work. > Then its not in compliance with RFC 2865 and you

RE: Example configuration that proxy PEAP MSCHAPv2 to an IAS server

2011-08-30 Thread Danner, Mearl
Might be the LAN Manager authentication level on the 2K8 servers. It needs to be "downgraded". Probably to "Send LM and NTLM". Samba used to put a note about that in the documentation. > It still bugs that ntlm_auth would not authenticate to the domain > controllers the challenge and nt-res

Re: Example configuration that proxy PEAP MSCHAPv2 to an IAS server

2011-08-30 Thread Alan DeKok
Glenn Machin wrote: > It still bugs that ntlm_auth would not authenticate to the domain > controllers the challenge and nt-response. It could be a Samba bug. See comments in eap.conf. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Certificate problems? Freeradius 2.1.10 on Debian squeeze

2011-08-30 Thread John Dunning
On 05/08/2011 17:00, John Dunning wrote: Greetings all, We've been running freeradius 1.x on Debian Lenny for some time with great success authenticating against Novell eDirectory/LDAP. Our Linux guru has moved on to exciting new opportunities and while the rest of us are decent at linux we're

Re: Example configuration that proxy PEAP MSCHAPv2 to an IAS server

2011-08-30 Thread Glenn Machin
Phil - thanks for the feedback. I just ended up proxying out to the IAS server usernames starting with "DOMAIN\". I configured the freeradius server to not support mschapv2 but will support PEAP/GTC EAP/TLS. It seems to be working fine with the Macs, iPads and Linux systems while the wind

Re: RADIUS configuration based on source IP

2011-08-30 Thread Arran Cudbard-Bell
On 30 Aug 2011, at 18:21, Morty wrote: > I have a variety of Cisco devices that require mutually incompatible > values in a certain RADIUS attribute, Cisco-AVPair. The way I have > dealt with this in the past is with huntgroups -- I assign our > engineer group on huntgroup1 to have Cisco-AVPair

Re: Symbol "Perl_hv_undef_flags" problem using rlm_perl

2011-08-30 Thread John Dennis
On 08/30/2011 05:06 AM, david.suarezde...@telefonica.es wrote: Greetings, I have installed a Debian 6 stable on a 64b machine. Using the factory freeradius-2.1.10 and perl-5.10.1 I got a symbol lookup problem, which sounded weird enough... So I downloaded both last stable versions (Freeradius-

RADIUS configuration based on source IP

2011-08-30 Thread Morty
I have a variety of Cisco devices that require mutually incompatible values in a certain RADIUS attribute, Cisco-AVPair. The way I have dealt with this in the past is with huntgroups -- I assign our engineer group on huntgroup1 to have Cisco-AVPair set to shell:roles=network-admin, while by defaul

Re: AP and user IP

2011-08-30 Thread Alan DeKok
Gabriele Cardosi wrote: > I created a testing user and set up the client "secret", and I am able > to connect the device (a mobile phone) to the access point > authenticating it with the freeradius, but in the log what I see is the > client's (i.e. the access point) IP, the clients (AP) mac, and th

Re: AP and remote IP

2011-08-30 Thread Arran Cudbard-Bell
On 30 Aug 2011, at 09:43, Gabriele Cardosi wrote: > Hi All, > I am a complete noob about radius - and freeradius, so please forgive if the > question is silly. > For a project I would like to develop, I would need to be able to retrieve > the ip of a device wireless-connected to an access poin

Re: problem with chillispot

2011-08-30 Thread Arran Cudbard-Bell
On 30 Aug 2011, at 07:21, Goke M Aruna wrote: > Hello Alan, > Is it bug on freeradius v2? > I got the chillispot working with freeradius 1.7 then and still tested > same recently but v2 of radius give same error while v1 work > seamlessly. I compiled this on centos 5.6. There's a dissector in W

AP and remote IP

2011-08-30 Thread Gabriele Cardosi
Hi All, I am a complete noob about radius - and freeradius, so please forgive if the question is silly. For a project I would like to develop, I would need to be able to retrieve the ip of a device wireless-connected to an access point that use freeradius for "authentication". I created a test

AP and user IP

2011-08-30 Thread Gabriele Cardosi
Hi All, I am a complete noob about radius - and freeradius, so please forgive if the question is silly. For a project I would like to develop, I would need to be able to retrieve the ip of a device wireless-connected to an access point that use freeradius for "authentication". I created a test