RE: Version 3.0.0 has been released

2013-10-08 Thread Garber, Neal
Congratulations! Thank you again for all of the countless hours you spend on improving the best and most flexible RADIUS server. One question though - is there a typo in the V2 upgrade link below? When I click on it I get a 404 error.. Upgrading instructions are available here:

Cache for machine authentication

2013-10-04 Thread Garber, Neal
Can someone tell me if it is possible in FR to cache in memory (for a short amount of time) Calling-Station-Id from successful machine authentications so that subsequent user authentications can test whether the user is connecting from an authorized device? This is a feature that is available

RE: ntlm_auth in freeradius

2012-05-16 Thread Garber, Neal
i cant find the ntlm_auth file in my OS , is it coming with freeradius or we have to install it separately . It's part of Samba. A simple google search for ntlm_auth would have answered that question for you. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: DHCP on FreeBSD 8.2

2012-04-21 Thread Garber, Neal
I am getting the following errors during compilation on my FreeBSD 8.2 OS: /usr/include/net/if_arp.h:47: error: expected specifier-qualifier-list before 'u_short' /usr/include/net/if_arp.h:88: error: field 'arp_pa' has incomplete type /usr/include/net/if_arp.h:89: error: field 'arp_ha' has

RE: Freeradius with multiple clients

2012-04-20 Thread Garber, Neal
yes i said that freeradius with coovachilli works but with the access point i think send another request so it fails.. Yes, you did say that. But, I have no idea what you mean by i think send another request so it fails? As I said before, read the FAQ (it will tell you to provide debug

RE: Freeradius with multiple clients

2012-04-19 Thread Garber, Neal
but i have problems to the ap... The didn't login... Do you really think this is enough information for someone to help you? Did you read the FAQ? http://wiki.freeradius.org/FAQ#It+still+doesn%27t+work%21 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Blackberry disabled server certificates query

2012-01-20 Thread Garber, Neal
if you leave the box unchecked disable server certificate validation then the blackberry connects fine if you uncheck connection fails failed to connect. You wrote, ...if you leave it unchecked... (it)... connects fine if you uncheck (it the) connection fails??? Did you mean to say if you

RE: Unlang issue

2011-07-29 Thread Garber, Neal
Try: if ((Client-IP-Address == x) || (Client-IP-Address == y)) { } No joy :-(. For now, I ended up doing: if (Called-Station-Id) { if (Client-IP-Address == x) { update request { Huntgroup-Name := }

Unlang issue

2011-07-28 Thread Garber, Neal
I'm running FR 2.1.6 (I know - I plan to upgrade later this year). Is there anything wrong syntactically with the following code or is this a bug that was fixed since 2.1.6? if (Client-IP-Address == 172.20.16.28 || Client-IP-Address == 172.20.204.10)) { update request {

RE: Unlang issue

2011-07-28 Thread Garber, Neal
Ok, thanks Alan. I'll split it into two if stmts as a workaround for now.. BTW, when posting the code and trying to make it look nicer, I mangled it. The original code really looked like this: if (Called-Station-Id (Client-IP-Address == 172.20.16.28 || \

RE: Unlang issue

2011-07-28 Thread Garber, Neal
Try: if ((Client-IP-Address == x) || (Client-IP-Address == y)) { } Thanks for the suggestion Phil. I'll give that a try.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Yet another multiple SSID setup question

2011-07-28 Thread Garber, Neal
It's failing on the inner tunnel with an error that it has no value specified for the auth type, but shouldn't that be set by the eap module? It didn't say no value, it said unknown value. The debug output showed the value of Auth-Type as eap_cuesta: Found Auth-Type = eap_cuesta WARNING:

RE: RADIUS Questions

2011-07-26 Thread Garber, Neal
You didn't give much information regarding your environment, so some of the responses below are based upon assumptions: that you manage all devices that are connecting, that they are joined to your A/D domain and that you are using the Windows supplicant. You haven't said what version of

RE: LDAP SHA1 Password, EAP-PAP and Dynamic VLAN

2011-07-26 Thread Garber, Neal
Actually i've already a configuration to dynamic assing VLAN ID with MS-CHAPv2 What reply attribute(s) are you passing to the switch in this case? I've done some tests.. can actually authenticated based on the logs and the switch info, but Dynamic VLAN isn't configured on the switch

RE: RADIUS Questions

2011-07-26 Thread Garber, Neal
I don't think that I'm using the supplicant but I could be wrong. The supplicant is the software on the client device that manages wireless profiles/connections. If Windows controls the wireless connections (Wireless Zero Config service) then you are using the Windows supplicant. I'm

RE: LEAP Authentication?

2011-06-30 Thread Garber, Neal
It does. It is a Aironet 350 device and it has internal RADIUS as well, which we are able to authenticate against(using LEAP). Is this for WLSE authentication to the AP? If not, do you have other options other than LEAP? If so, avoid LEAP as many others have said. - List

RE: Sending Reply-Message in Access-Reject (PEAP/MSCHAPv2)

2011-05-24 Thread Garber, Neal
so, in inner-tunnel post-auth, set outer.reply to be whatever you want.. you can then, in the outer layer, query/check or use that reply. There's an additional round trip after the failure which is why Phil said it needs to be saved. I had a patch to save/restore it; but, it needs rework

RE: ntlm_auth authentication results logging messages

2011-05-19 Thread Garber, Neal
I found a similar user in an old thread who submitted a patch: (http://freeradius.1045715.n5.nabble.com/Capturing-ntlm-auth-failure- reasons-in-rlm-mschap-td2791760.html) And it appears that this patch made it into the rlm_mschap.c module code: I submitted that patch and it was included in

RE: Relation between NAS and FreeRADIUS

2011-05-18 Thread Garber, Neal
I want to ask that NAS provide internet or FreeRADIUS. What does that mean? I mean i should connect internet connection to NAS or FreeRADIUS. Try rephrasing your question and provide more background on what you are trying to accomplish.. - List info/subscribe/unsubscribe? See

RE: MSCHAP / NTLM_AUTH failure on expired AD password; out of sync cached creds / AD password.

2011-05-12 Thread Garber, Neal
FR is configured to send the auth request to AD (MSCHAP only, Aruba terminates PEAP) using NTLM_AUTH.  Why do you want Aruba to terminate PEAP? If it IS expired, MSCHAP (or NTLM_AUTH) seems to always return a reject.  See below... Also, with new users an account is created with a

RE: PEAP/MSCHAPv2 failing with Windows 7

2011-05-10 Thread Garber, Neal
In the PEAP properties, EAP-MSCHAP v2, if you DISABLE automatically use my windows logon name and password and instead enter the credentials manually it works. What version of FR are you running? If it's 2.1.10, try it with 2.1.10. - List info/subscribe/unsubscribe? See

RE: PEAP/MSCHAPv2 failing with Windows 7

2011-05-10 Thread Garber, Neal
In the PEAP properties, EAP-MSCHAP v2, if you DISABLE automatically use my windows logon name and password and instead enter the credentials manually it works. Look at: http://freeradius.1045715.n5.nabble.com/MSCHAP-Authentication-Issue-td2785146.html to see if this is your problem (look

RE: PEAP/MSCHAPv2 failing with Windows 7

2011-05-10 Thread Garber, Neal
I can/will upgrade, but the symptoms lead me to believe its a windows thing. What leads you to believe an FR upgrade would fix it? I sent another response with more info. The issue I'm thinking of is one we talked about quite a while ago (I asked if you could test it). It's the one where

RE: PEAP/MSCHAPv2 failing with Windows 7

2011-05-10 Thread Garber, Neal
One additional note: the fixes that went into 2.1.10 extract (verbatim) the client username from the EAP-MSCHAPv2 response, and pass that through to the rlm_mschap module as an extra attribute. You're right Phil. It's been too long since I wrote that patch. Gary: Forget what I said about

RE: about FreeRadius+radiusmanager+mikrotik

2011-05-04 Thread Garber, Neal
some of my user trying to login Mikrotik but they cant first time.. You may find that it will be easier for people to help you if you provide specific details about the problems you are having and what you've done in an attempt to fix the problems. You should start by doing Internet searches

RE: MS-CHAPv2 password change implementation

2011-04-19 Thread Garber, Neal
I have spent the last few days writing the code to allow rlm_mschap and rlm_eap_mschapv2 to support password changes. This is huge Phil! Thanks for taking the time to write this enhancement. I will test it in our environment over the couple weeks and report findings. - List

RE: unlang question

2011-04-04 Thread Garber, Neal
i have made my modifications Perhaps if you show us the modifications, someone might be able to suggest what's wrong. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Limiting user accounts for specific devices

2010-12-02 Thread Garber, Neal
so it would need to be set per IP address or range only for the limits so that the other users in AD can be used for that Have you thought about using huntgroups to group your NAS together and then authorize based upon Huntgroup-Name? - List info/subscribe/unsubscribe? See

RE: Grant access for all users before login

2010-12-01 Thread Garber, Neal
Ok machine authentication works now with computer name from samba. i can assign vlans also. The switch port appears as up, BUT i can't ping the machine und i can't login with new users that never before use this machine (no local useraccount). Why i doesn't get network access after

RE: Grant access for all users before login

2010-11-30 Thread Garber, Neal
When a user gets his login prompt, no access to the network is allowed because they first get access when they login and freeradius can perform an ldap check with the username. But when a new user wants to login or the user uses an different computer, the user dosen't exist on this machine

RE: Logging ntlm authentication

2010-11-17 Thread Garber, Neal
Could you please share the perl scripts and the corresponding configuration in radiusd.conf like authorize and post-auth section related to these logs? Unfortunately, I would need to get a release from my company as the code belongs to them. I cannot post it at this time. You may want to

RE: Logging ntlm authentication

2010-11-10 Thread Garber, Neal
Could you please summarize what you did to log the output from ntlm_auth and MS_CHAP-Error? Sure. I should mention that other options are available now that didn't exist when I created the solution below... I have a PERL script that runs during authorize that obtains user/group or

RE: %RAD_REPLY hash problem

2010-10-29 Thread Garber, Neal
Yes, I know :) but it would be better if we can solve that I agree, but I haven't found a better solution (i.e., that's what I do to workaround the problem). - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Assign VLANS based on AD groups.

2010-10-28 Thread Garber, Neal
Now that I have authentication working. I would like to assign users to VLANS based on AD group membership. Any examples would be appreciated. Did you look here? http://wiki.freeradius.org/HP (search for Dynamic VLAN assignment) There area a number of ways to set reply attributes depending

RE: %RAD_REPLY hash problem

2010-10-26 Thread Garber, Neal
My problem is that rlm_perl duplicate an attribute in %RAD_REPLY hash. I'm not sure if this will fix it, but try: use constant RLM_MODULE_UPDATED= 8;# /* OK (pairs modified) */ then change return RLM_MODULE_OK to: return RLM_MODULE_UPDATED; If this doesn't fix it, you can always delete

RE: Proxy Issue

2010-10-17 Thread Garber, Neal
DeKok, Alan wrote: It's a permanent change. See latest git for a fix. Thanks Alan. I just retested and, uh, don't shoot the messenger, but now it dies in event.c:cleanup_delay(): Debug: Waking up in 11.4 seconds. Error: ASSERT FAILED event.c[536]: (request-child_state ==

RE: Proxy Issue

2010-10-17 Thread Garber, Neal
shrug Assertions are there to catch sanity failures. In this case, the request was treated as done without being explicitly marked done. Do a git pull. :) Looks much better - thanks again. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Proxy Issue

2010-10-15 Thread Garber, Neal
Ah... I don't usually do builds tests without pthreads. Actually, I am building/testing with pthreads. However, I was running in debug mode (radiusd -X). The problem does not occur when I don't start radiusd with -X. Some additional debug code in event.c shows the following sequence of

Proxy Issue

2010-10-14 Thread Garber, Neal
I'm testing proxying of authentications (it's not something I've done before so this could be my problem). I have a pool with 2 home servers defined in proxy.conf. For now, both servers are unreachable (blocked by a firewall). I'm using git head 2.1.x branch and I'm testing using eapol_test.

RE: Microsoft SoH Support

2010-10-09 Thread Garber, Neal
Thanks to a lot of work by Phil Mayers, the server now has support for Microsoft SoH in PEAP, normal RADIUS (MS VPN gateway), and in DHCP. Wow! That *must* have been a lot of work! Thank you Phil. Does this mean FreeRADIUS can now act as a Health Policy Server? - List

RE: Problem with MSCHAP

2010-10-08 Thread Garber, Neal
[peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. You need to look earlier in your debug output to see why it was rejected (that's what this error message means) - List info/subscribe/unsubscribe? See

RE: Last call for 2.1.10

2010-09-22 Thread Garber, Neal
Last call for 2.1.10 I haven't had a chance to rework the patch for saving replies after a PEAP/TTLS reject (been very busy at work). I'll try to get to it today; but, I assume it's too late for 2.1.10 at this point, right? - List info/subscribe/unsubscribe? See

RE: Logging ntlm authentication

2010-09-09 Thread Garber, Neal
Uh... eapol-test supports TTLS. See the FreeRADIUS source: src/tests/eap-ttls-*.conf Ugh.. I should have checked the doc. I should be able to do the TTLS change independently (i.e., you can ignore the post to the devel list related to this). Thanks for enlightening me :-) - List

RE: Logging ntlm authentication

2010-09-08 Thread Garber, Neal
Hmm... OK. The issue appears to be that the tunneled reply is saved for Access-Accept, but not Access-Reject. See accept_vps in rlm_eap_peap/*. Something similar needs to be done for reject, and for TTLS. You are a gentleman and a scholar! I have made the changes as you suggested for PEAP

RE: Logging ntlm authentication

2010-09-07 Thread Garber, Neal
but it seems the next packet sent is a Challenge, not reject/accept. Therefore the message does not persist until reject/accept time. Hmm.. It seems I've heard that before: http://lists.cistron.nl/pipermail/freeradius-users/2009-August/msg00326.html - List info/subscribe/unsubscribe? See

RE: Logging ntlm authentication

2010-09-07 Thread Garber, Neal
Fixed in 2.1.9. Great (I guess missed that in the change log). Was the change to eliminate the extra round trip? If so, would you accept a patch to set Module-Failure-Message upon failure of ntlm_auth in rlm_mschap (as was originally implemented in the fix for bug 398 in v1.1.4)? Thanks

RE: Logging ntlm authentication

2010-09-07 Thread Garber, Neal
I'll take a look... Thanks. I'd like to get some feedback on the pre-release of 2.1.10, especially the changes to the proxy code. I'll download the latest 2.1.10 tomorrow; unfortunately, I won't have a chance to test it until next week. Also, we don't use proxying, at the moment, but I

RE: Logging ntlm authentication

2010-09-07 Thread Garber, Neal
IIRC, it was to remember replies better. When the inner tunnel returns accept and the outer sends a challenge... remember the accept for later. I just cloned and built the latest 2.1.10 to do some testing. I did a PEAP-MSCHAPv2 authentication, with bad credentials, using eapol_test. What

RE: Password Policy - Expired Password - mschap

2010-08-12 Thread Garber, Neal
Understanding the security risks... is there an example of setting Post-Auth-Type REJECT {...} to override the reject force the response to Auth-Accept? If you want to change all REJECTs to ACCEPT so that authentication always succeeds, then you are effectively eliminating the

RE: Password Policy - Expired Password - mschap

2010-08-11 Thread Garber, Neal
if you enable the ldap/(opendirectory) option to require user to change password on next login the client is unable to connect. FreeRADIUS doesn't support password changes via MSCHAP. Historically, Samba didn't even support it until a couple of years ago. I believe support for this

RE: Bug #17 (MS-CHAP user names)

2010-07-27 Thread Garber, Neal
I've done some minor editing to the patches, and put them into the code for 2.1.10. I just downloaded and installed 2.1.10 on my test server. So far, everything looks good. Thank you Alan. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Freeradius2 and Samba3x

2010-07-14 Thread Garber, Neal
Sending Access-Accept of id 225 to 10.4.1.2 port 2452 Reply-Message := Authorized Users Only MS-CHAP2-Success = 0x01533d39444636303933394145343137463835384143443632443 9374137343844413541313936 MS-MPPE-Recv-Key = 0xd81d386eb6bd95dcd85badccd21036b4

RE: Freeradius2 and Samba3x

2010-07-14 Thread Garber, Neal
Any ideas about what - the server returned Access-Accept?? Is this not what you wanted? What problem are you trying to solve? That my VPN session still doesn't establish. I get back that the user can't be authenticated. What are you using as the NAS? Did you check the documentation to see

RE: FR proxy to ACS and NPS with MS CHAP v2

2010-07-14 Thread Garber, Neal
will most appreciate your expert opinion. Post debug output! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Wanted: Commercial FreeRADIUS Support

2010-06-17 Thread Garber, Neal
Have you looked here: http://networkradius.com/ Even if you aren't able to provide support, I'd be interested in any suggestions for where to get support from. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: log request to Freeradius server from unknown client

2010-05-26 Thread Garber, Neal
Hi, I'm trying to log request to my Freeradius server from unknown client... Look in the radius.log file - it is also logged there - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Configuring FreeRADIUS to use ntlm_auth for MS-CHAP

2010-04-28 Thread Garber, Neal
Why is not working ntlm_auth for ms-chap ? It would be easier to answer your question if you included the debug output for a rejected request as opposed to just the startup messages.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Freeradius With EAP-TTLS-LDAP and EAP-PEAP-AD

2010-04-13 Thread Garber, Neal
I attached the logs for freeradius -X The logs you attached just show the startup output, not an actual request that was rejected. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Log the 802.1x session

2010-04-09 Thread Garber, Neal
From what I've read, supplicants can send an EAPOL-Logoff message to If the requirement is to determine when the user disconnects, isn't this best handled by accounting data? That is, if the authenticator supports sending Accounting-Request packets to RADIUS, then when the user disconnects, it

RE: Pre-release of Version 2.1.8

2009-12-08 Thread Garber, Neal
At approximately 08:40 something happens, and a lot of servers are flagged as dead or zombie. This could of course have been caused by network problems, but there was no such problem at this time. Proxying goes over the same interface as When it fails, is it always at night? If so, could

RE: Pre-release of Version 2.1.8

2009-12-08 Thread Garber, Neal
This limit is around 8K packets in 2.1.x, and will be 64K packets in 2.2.x. So if you're getting 500 packets/s for a home server, 16s after it goes down, all 8k slots will be used. I'm not sure if this is feasible and/or easy to implement, but I thought I'd ask.. As a suggestion, can there

RE: Logins against AD failing in *most* cases. Can see why, butdon't*understand* why.

2009-12-07 Thread Garber, Neal
It never occurred to me that the Cisco controllers could be our issue... Though I have just checked with a colleague and he did try restarting them after hours yesterday, and it didn't help matters. If you can find out what setting you changed that would be ideal, but probably best to email

RE: Logins against AD failing in *most* cases. Can see why, but don't*understand* why.

2009-12-02 Thread Garber, Neal
I am perfectly willing to accept that you may be right and this may be my issue, I just don't understand how it has suddenly become a problem. Are you using a Cisco Wireless LAN Controller (WLC)? We had a similar issue with our Cisco 2112 WLC (EAP conversation stops on the NAS/supplicant

RE: showing NAS-IP of 127.0.01 instead of

2009-11-25 Thread Garber, Neal
The problem is that although the Access-Request packet is shown as coming from the correct host, that host's ip address is not showing up as the NAS-IP-Address for that request. Instead, it's showing as 127.0.0.1 as seen below: I'm wondering what could cause this? Any help is appreciated.

RE: ntlm_auth and AD authentication

2009-11-23 Thread Garber, Neal
Hmm. I have two sets of authentication I care about, VPN Users, and Cisco switches. I'd like to be able to control access to each of those separately (different AD Security Groups, and different shared keys). I'm not sure what you mean by different shared keys - can you clarify? Also,

RE: SSID based authentication

2009-11-17 Thread Garber, Neal
If I want an enduser to be able to connect to the same SSID on multiple AP´s then I can not use Called-Station-ID since it also includes information about the mac address for a specific AP. So how do I do to be able to authenticate by just using the SSID and not the mac address for a

RE: Freeradius + OpenLdap + WindowsXP(Wifi)

2009-10-13 Thread Garber, Neal
Have any idea ? Where can i find the solution ? When i trying connect freeradius server with wireless over access point i get this error: snip Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. The error you're

Update on MS-CHAP Authentication / Bug 17

2009-10-06 Thread Garber, Neal
applied (for about 6 weeks now) to two of our FR servers and haven't seen any issues. Neal -Original Message- From: Garber, Neal Sent: Friday, October 02, 2009 1:58 AM To: 'Marco D'Ettorre' Subject: RE: MS-CHAP Authentication / Bug 17 Thank you for sharing your experience Marco. At some

RE: FreeRADIUS with 2 certs/CAs etc

2009-09-30 Thread Garber, Neal
Hi Alan, First, I don't profess to be an eap expert and what follows is based upon my understanding of how eap and RADIUS work.. I'm also interested to see if anyone else has any other thoughts.. anyway, in summary, your RADIUS server has to answer to the old clients and the new clients.

RE: FreeRADIUS with 2 certs/CAs etc

2009-09-30 Thread Garber, Neal
as Alan Dekok said...deploy a new CA in advanced and then sign server with that new CA and put cert into place. I read Alan's reply and it's logical (as usual ;-) ). Perhaps it wasn't stated because it was intuitively obvious, but the only thing I would add is that when the new CA cert is

RE: Redundant SQL

2009-09-21 Thread Garber, Neal
Source code patched. Thanks.. The redundant sections work just fine for normal queries to radcheck radreply. If you're doing %{...}, then the redundant sections don't apply. Ah, now I understand. I abandoned redundant and used if/elsif instead in my dynamic_client virtual server: if

MS-CHAP Authentication / Bug 17

2009-09-21 Thread Garber, Neal
I've been running 2.1.6 in Production with the patch from Bug 17, for a month, and everything has been working fine. As a reminder, this patch corrects a bug in MS-CHAP with the calculation of the MS-CHAPv1 challenge passed to ntlm_auth. It causes inappropriate Logon Failure errors, in

RE: MS-CHAP Authentication / Bug 17

2009-09-21 Thread Garber, Neal
Alan, Thank you for taking the time to review the patch and for your feedback. has a look at this but it's only of interest for classic MS-CHAP activity rather than MSCHAPv2 in PEAP or TTLS - correct? (in this case we wouldnt use this function or be able to test this at our site...but

RE: MS-CHAP Authentication / Bug 17

2009-09-21 Thread Garber, Neal
hmm, okay - I'll only be able to introduce core systrems with this patch in place after 2nd October - we currently have a change freeze on main systems until then That's fabulous. Thanks for your time and willingness to test. - List info/subscribe/unsubscribe? See

RE: MS-CHAP Authentication / Bug 17

2009-09-21 Thread Garber, Neal
google search for 'define:delimeter' Did you mean: define:delimiter Top 2 results shown :-) You are clearly correct given the root of the word delimiter is delimit (not delimet) :-) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Lower case to Upper case in Calling-Station-Id at policy.conf

2009-09-18 Thread Garber, Neal
Did you create an alias in modules/perl that uses this script for authorize? Did you add the alias name to the authorize section of your default server? What return value are you using in the script (RLM_UPDATED)? -Original Message- From:

RE: Pre-release of 2.1.7

2009-09-08 Thread Garber, Neal
Does it apply cleanly to the current git head? I created it about 2 weeks ago against the then current git head. It changes rlm_eap_mschapv2.c, rlm_mschap.c radius.h. I don't believe any of these have changed in the past 2 weeks, so it should still apply cleanly. I've been running with it

RE: Pre-release of 2.1.7

2009-09-08 Thread Garber, Neal
It won't make 2.1.8. Please submit a bug report and attach the patch. My preference for the patch is to split it into 2-3 pieces. Bug # 17 created with separate attachments for each file changed. Messing with functionality in the MSCHAP module is a bit worrisome, as it's pretty core to a

RE: Using multiple certificates

2009-09-07 Thread Garber, Neal
I have been asked it it possible to run two SSIDs on our wireless, lets call them A and B that authorise against a FreeRADIUS server running as two virtual servers radiusA and radiusB. I have two EAP instances for the purpose of serving 2 different certificates; so, what you want to do is

RE: Pre-release of 2.1.7

2009-09-03 Thread Garber, Neal
Build it, install it, and see if there are issues. On FreeBSD 7.2 with libtool 2.2.6a: - Built - Installed - Tested EAP-PEAP/MSCHAPv2, rlm_perl with no issues so far No LD_PRELOAD needed for libperl.so with libtool 2.2.6. Do you think the MS-CHAP related patch I submitted will make 2.1.8?

RE: rlm_perl / libtool / libltdl problem

2009-08-23 Thread Garber, Neal
Of Anton Brinyov Sent: Sunday, August 23, 2009 6:17 PM To: FreeRadius users mailing list Subject: Re: rlm_perl / libtool / libltdl problem Hi, It means, there isn't solution for this problem now? Thanks, Anton 2009/8/18 Garber, Neal neal.gar...@energyeast.com: Did I mention that I hate libtool

RE: MS 8021.x PEAP failing

2009-08-20 Thread Garber, Neal
I've been playing around with conf/module files trying to strip the DOMAIN out of my login request - but no luck! Have you tried with_ntdomain_hack = yes in the mschap module config? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: MS 8021.x PEAP failing

2009-08-20 Thread Garber, Neal
Yup, that line is there. Much of the doc online is WAY out of date, so I'm wondering if by actually RTFM first I broke something? Ok. This may sound crazy and it may not be your problem, but, I thought I'd mention it anyway.. Look at the samAccountName attribute in A/D for a user that is

RE: rlm_perl / libtool / libltdl problem

2009-08-18 Thread Garber, Neal
Did I mention that I hate libtool and libltdl? They're close to *causing* more problems than they solve. Yes, on several occasions that I recall :) I share your sentiments... I actually started removing libltdl a while ago. See src/main/modules.c. Look for WITHOUT_LIBLTDL. I'll bet that

Unlang Question/Problem

2009-08-18 Thread Garber, Neal
I haven't had much sleep the past few days and just wanted another set of eyes on an issue I'm having. Also, I won't be able to do more testing until tomorrow (user/equip. unavailable) and wanted to try to fix it before then. I'm running FR 2.1.6 with patches to rlm_mschap rlm_eap_mschapv2 to

RE: MSChap via ntlm_auth problem

2009-08-17 Thread Garber, Neal
I tried to use aythentication via Active Directory domain. FreeRadius 2.1.6 return error: Try removing the single double quote () just before the last right curly brace (}) at the bottom of the mschap file - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

rlm_perl / libtool / libltdl problem

2009-08-17 Thread Garber, Neal
I've had FR 2.1.6 running on a FreeBSD 7.2 test server for some time now. When I applied the rlm_mschap / rlm_eap_mschap patch I worked on over the weekend (which is working great btw - I will upload it shortly), I now get the following error on FR startup: Can't load

RE: MSCHAP Authentication Issue

2009-08-15 Thread Garber, Neal
I will now proceed to create a patch. The MS-CHAP2-Response attribute created by rlm_eap_mschapv2 does not include the Name field from the MS-CHAP response packet (as I suspected). I thought the cleanest way to pass the Name field was to create another attribute in rlm_eap_mschapv2 before it

RE: MSCHAP Authentication Issue

2009-08-15 Thread Garber, Neal
BTW, if I should be sending these type of messages to the devel list, please let me know. I would suggest that should be the case :-) Uh, sorry about that. I rarely see anything on that list so I thought maybe it was no longer in use. - List info/subscribe/unsubscribe? See

RE: MSCHAP Authentication Issue

2009-08-15 Thread Garber, Neal
I rarely see anything on that list Ugh. I guess I would have if I looked at the sender more closely.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: PEAP / mschapv2 Error Messages

2009-08-14 Thread Garber, Neal
Depends on the NAS. But yeah, doing this breaks things. The best thing you can do is log the error in the post-auth section. In V1 of FR, the rlm_mschap module used to create a Module-Failure-Message request attribute containing the output of ntlm_auth, if ntlm_auth failed (rlm_ldap does

MSCHAP Authentication Issue

2009-08-14 Thread Garber, Neal
I realize that this issue has been brought up many times in the past. However, I believe I have new information that I haven't seen reported before.. I'm having a problem with Windows XP supplicant authenticating to FR with PEAP/MSCHAPv2 where authentication fails sometimes depending upon

RE: MSCHAP Authentication Issue

2009-08-14 Thread Garber, Neal
Well... that's a good reason to make sure we do it right. Any day where we can replace another RADIUS server with FreeRADIUS is a good day. My feelings exactly :) I suspect that it will. The mschap module should also pass the Name field when calling ntlm_auth, too. And maybe print a

RE: mschap auth for multiple realms off different domain ctlrs?

2009-07-30 Thread Garber, Neal
radiusd.conf[723] Failed to link to module 'rlm_mschap_co1': Shared object rlm_mschap_co1.so not found, required by radiusd radiusd.conf[1949] Unknown module mschap_co1. radiusd.conf[1949] Failed to parse mschap_co1 entry. Did you create 3 instances of mschap using aliases like below?

RE: rlm_perl problems]

2009-07-29 Thread Garber, Neal
I know how to patch. I was just trying to find out what was the error. Igor: I hope you weren't offended by my assumption - I wasn't sure, based upon your comment, and I was just trying to help. If I offended you, I apologize. By the way, out of curiosity, did the patch work for you on 2.1.7

RE: rlm_perl problems]

2009-07-28 Thread Garber, Neal
I didn't try it yet and i am not very good in C. Error that I and Neal had is something regarding OS or...? I don't see anyone else having this problem except me and Neal. The error is in rlm_perl and appears related to thread data management, not the O/S and not perl (I run FreeBSD and you

RE: Captive portal: can I use chap or pap in conjunction with ntlm_auth?

2009-07-28 Thread Garber, Neal
Do you have any ideas about getting chilispot to work with users who are retrieved from AD via winbind and ntlm_auth I don't know Chilispot, but if it can pass a cleartext password, then you can use ntlm_auth in a script to do the authentication. For other devices that send an A/D user and a

RE: rlm_perl problems]

2009-07-27 Thread Garber, Neal
Boian, SUCCESS! Thank you , thank you, thank you! I applied the patch to my test 2.1.6 system and it eliminated the Seg Fault and all of the strange behaviour. My perl scripts now function as they do in Production. I am extremely grateful for the time you spent debugging this issue and

RE: Error: rlm_eap: Failed to store handler

2009-07-27 Thread Garber, Neal
freeradius 2.1.1-6 crashes in a few minutes and shows this error Error: rlm_eap: Failed to store handler. There is documentation that describes what to do if FreeRadius crashes. Look in the file doc/bugs in the distribution and it gives specific instructions for using gdb to produce

RE: rlm_perl problems

2009-07-24 Thread Garber, Neal
I've been debating sending a similar message to the list as well. I am also experiencing the same problem with 2.1.6 (undefined subroutines that *clearly* exist in the script) and Seg Faults. I have reinstalled perl and then reinstalled FreeRadius to see if I can work around the issue with no

  1   2   >