Re: Multiple Locations and configuring 2 different methods of Access

Does the gateway send RADIUS packets when people connect to it? If not, you can't use RADIUS to configure the behavior of the gateway. Im not quite sure what you mean, I know that: 1. The gateway has accounting "on" and every 3 minutes it updates the RADIUS with packets

Re: Multiple Locations and configuring 2 different methods of Access

You said that everyone gets authenticated through the web portal. Why? It's not necessary to authenticate people twice. It causes problems, as you've seen. no one gets authenticated twice, a nice looking HTML form is the only thing the web portal is. that's it. nothing more. the

Re: Multiple Locations and configuring 2 different methods of Access

, but no worries, I gave it a shot anyways. Once again, I do thank you for your time Alan. If there is someone else besides Alan out there who is trying to achieve the same thing, I would love to hear from them. Thank you all and thank you Alan. James - List info/subscribe/unsubscribe? See http

Multiple Locations and configuring 2 different methods of Access

documentation on this topic and where can I see an actual configuration example of this type of setup? If this is not possible out of the box, where can I get documentation on a work around or similar solutions? Thank you in advance for all your help, James - List info/subscribe/unsubscribe? See http

freeradius 1.0.5 - Max-All-Session, Max-Daily-Session and Max-Monthly-Session maximum value limit

Hello I am using freeradius 1.0.5, what is the maximum value of seconds allowed in the attributes: Max-All-Session, Max-Daily-Session and Max-Monthly-Session ? I cannot find this information in my research. Thank you, James - List info/subscribe/unsubscribe? See http://www.freeradius.org

Simultaneous-Use Issue

-Password = somepassword Max-All-Session = 123456 Simultaneous-Use := 1 Is there extra attributes that I need to set or configuration that I need to add in order to not let the same user login simultaneously through different machines? Thank you, James - List info/subscribe/unsubscribe? See

Re: VLAN and SSID

need. Presently you only have: radius-server vsa send accounting so the SSID is only being sent in accounting packets. (having both is fine) Regards, James -- James J J Hooper, Information Services University of Bristol -- - List info/subscribe/unsubscribe? See http://www.freeradius.org

Re: VLAN and SSID

back to the AP and if it doesn't match, then it can locally fail to authorize the user. I don't think 1200's do send the attribute by default in the access-request. To make it do so, use this command: radius-server vsa send authentication Regards, James -- James J J Hooper, Information

Re: VLAN and SSID

to set this command from the AP web interface? I haven't experience with the console setting yes, either at the console or go to this url: https://YOUR-ACCESS-POINT-ADDRESS/level/15/configure/-/radius-server/vsa/send/authentication/CR (you may need to use http instead of https) Regards, James

Re: Problem with ntlm winbind - No User-Password configured. Cannot create LM-Password

/winbindd_privileged are set correctly. (0xc022) change the permissions on /var/cache/samba/winbindd_privileged so that the user radius runs as has access to it. e.g: chgrp radiusd /var/cache/samba/winbindd_privileged chmod g+rw /var/cache/samba/winbindd_privileged Regards, James -- James J J

Re: PEAP ntlm_auth strange behaviour

problems when specifying the domain on the command line before) Regards, James -- James J J Hooper, Information Services University of Bristol -- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Freeradius + Xp Client problem

eap.conf for configuration details. (you have not enabled peap in the file) Regards, James -- James J J Hooper, Information Services University of Bristol -- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Machine Authecitation with PEAP

21419368a6b599e159c9ef21bbc4d98138946d6df29 Exec-Program output: Logon failure (0xc06d) Exec-Program-Wait: plaintext: Logon failure (0xc06d) From my experience this means the credentials the machine is sending are wrong or your version of samba is too old - get 3.0.21c (or at least 3.0.21a) Regards, James - List

Re: Machine Authecitation with PEAP

= ads.bris.ac.uk where ads.bris.ac.uk is a round robin resolving to the IPs of 11 domain controllers. Regards, James -- James J J Hooper, Information Services University of Bristol -- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Machine Authecitation with PEAP

--On 09 March 2006 23:20 + James J J Hooper [EMAIL PROTECTED] wrote: -- Message: 6 Date: Thu, 9 Mar 2006 13:17:48 -0500 From: King, Michael [EMAIL PROTECTED] Subject: Machine Authecitation with PEAP Has anyone gotten Machine Authentication with PEAP

Re: FreeRADIUS + LDAP + Wireless auth

' is a bad name, but it should work. Many thanks. I had to write the username as (.*)$ as the backslashes themselves needed escaping, but once that was done it's all working like a charm now. James. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

FreeRADIUS + LDAP + Wireless auth

Hi, I have an existing LDAP infrastructure which provides unified authentication for Windows and Linux (think Samba). I am trying to integrate WPA on a wireless access point with this using FreeRadius. The ultimate plan is that anyone who provides a valid username/password and whose

FreeRadius Cisco Pix Auth

and should be authenticated for remote access. Any pointers would be greatly appreciated. Thank you. James Taylor rad_recv: Access-Request packet from host 192.168.42.1:1025, id=62, length=94 User-Name = jtaylor NAS-IP-Address = 192.168.42.1 User-Password = * NAS-Port = 49

RE: FreeRadius Cisco Pix Auth

-Reject of id 66 to 192.168.42.1:1025 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] org] On Behalf Of Alan DeKok Sent: Wednesday, January 11, 2006 2:00 PM To: FreeRadius users mailing list Subject: Re: FreeRadius Cisco Pix Auth James Taylor [EMAIL PROTECTED] wrote

RE: FreeRadius Cisco Pix Auth

Never mind... I found it after I attached and sent the config... Thanks Alan for the heads up. James -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] org] On Behalf Of Alan DeKok Sent: Wednesday, January 11, 2006 2:00 PM To: FreeRadius users mailing list Subject: Re

Cisco-AVPair SQL accounting (attr. not duplicated)

-existent attribute. Has anyone managed to do this? If so, what is the correct syntax to use these in SQL accounting statements? Cheers, -- James Wakefield Systems Administrator +61 03 5227 6888 We have now moved head office to 8-12 Pakington Street, Geelong West. - List info/subscribe

dictionary: adding MONTHLY-TIME-LIMIT

Hi, I am trying to add MONTHLY-TIME-LIMIT to the freeradius dictionary. I will be using this parameter in the radreply table of the freeradius database. Exactly how do I add this to the freeradius dictionary? Sincerely, Don James - List info/subscribe/unsubscribe? See http

Re: dictionary: adding MONTHLY-TIME-LIMIT

Oh, yeah, right. It may as well be written in Greek. Thanks for nothing. Tuesday, December 6, 2005Tue, 6 Dec 2005 18:04:06 -050017:04-060018:04- [EMAIL PROTECTED] [EMAIL PROTECTED] don james [EMAIL PROTECTED] wrote: Exactly how do I add this to the freeradius dictionary? $ man dictionary

Re: dictionary: adding MONTHLY-TIME-LIMIT

Hi Alan, Thanks for your help. I've read all of the docs that I could find. I subscribe to the O'Reilly online books and haven't been able to find much there. I am willing to read all of the docs extant. Sincerely, Don James Tuesday, December 6, 2005Tue, 6 Dec 2005 18:43:50 -050017:43

RADIUS EAP-TLS and Samba-LDAP

HI list I am using free radius with EAP-TLS for wireless authentication then I add Samba-LDAP for primary domain controller. Both radius and Samba LDAP are working . Now when I login from my windows xp to the domain I have to connect via wired first then install the certificate to make my radius

LDAP Authentication

. Thank you for your help! James Taylor EAP-Message = 0x573bea1ceb16030100040e00 Message-Authenticator = 0x State = 0xf666044c26dce30b13ecbacd04693e18 rad_recv: Access-Request packet from host 192.168.43.106:1645, id=126, length=151 User-Name = jtaylor

RE: LDAP Authentication

] On Behalf Of James Taylor Sent: Donnerstag, 27. Oktober 2005 01:26 To: 'FreeRadius users mailing list' Subject: LDAP Authentication I am currently trying to get LDAP authentication to work properly. As I am still learning the ins-and-outs on how all this comes together I am having an issue

Logging - auth failure reason

. Thanks for your help, James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

FreeRadius/PEAP

and that is what we are trying to avoid. All my tests conclude that this functionality will not work. I am able to Auth just fine using the USERS file with a username and password. Any info or direction would be greatly appreciated. Thank you James - List info/subscribe/unsubscribe

RE: FreeRadius/PEAP

. Is that even possible? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Josh Howlett Sent: Thursday, October 13, 2005 2:25 PM To: FreeRadius users mailing list Subject: Re: FreeRadius/PEAP James, MSChapv2 needs plaintext or NTLM credentials. You won't be able

Re: Expose RADIUS packet's identifier

= yes input_pairs = request output_pairs = none program = /etc/raddb/bin/logit.sh %{Packet-Authentication-Vector} } logit called in authorize. Thanks in advance for any help you can give, James. - List info/subscribe/unsubscribe? See http

Re: Walled Garden for Users Without Realms.

; Expire 60 ; Min TTL ) ; Authoritive Nameservers [NS] NS walled-garden-server-hostname IN A aaa.bbb.ccc.ddd * IN A aaa.bbb.ccc.ddd -- Hope that helped, James Wakefield Systems Administrator +61 03 5227 6888 We have

Re: Walled Garden for Users Without Realms.

a similar thing with email by setting up a mailserver on the wildcarded IP and bouncing everything with your walled garden message. Personally, I think sending your customers an email and then putting in the web-based walled garden is enough. Cheers, James Wakefield Systems Administrator +61 03

Re: Windows Client Authentification bevore Domain logon

check this out Jeremy http://www.linuxjournal.com/article/8095 On Wed, 2005-08-31 at 14:22 +0200, Jérémy Cluzel wrote: Sorry, but I didn't find any references of this OID in the creation scripts in the scripts directory (Ca.all, CA.certs...). The only OID added seem to be 1.3.6.1.5.5.7.3.1

Re: freeradius server not responding to radtest

IP address for that box either. Have you tried defining an IP address on the server and then send your radtest to that IP? If so what was the output? James On Fri, 2005-08-26 at 15:54 +0100, Ben Dowling wrote: Hi, I have managed to get freeradius installed and running but I cannot get

FW: radwho

Hi, When run radwho, it only display the last user to log on. Why?Best regards,James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

FW: freeradius accounting

Hi One question, when A call B at the start record, the calling_station_id is A, called_station_id is B. When the call ends, B hung up first, then at the stop record, the calling_station_id should be B or A? Thanks James - List info/subscribe/unsubscribe? See http

Re: FreeRadius documentation

Thanks very much, I had done some google searches but if you try it yourself looking for FreeRadius documentation not much is pinpointed. Thanks to all of you who sent in helpful responces. James On 02/06/05, Seferovic Edvin [EMAIL PROTECTED] wrote: Please visit the www.poptop.org

FreeRadius documentation

All, Just wondering if anyone can point me towards to some good documentation for FreeRadius please? I'm wanting to build a box running Radius and using OpenLDAP for authentication detail i.e. user name, IP etc. Many thanks James -- mailto: [EMAIL PROTECTED] icq : 48613647 msn : [EMAIL

clients.conf mysql

Hi there, Is there someone who can point me in the direction of achieving this?, I have searched google to find some posts that it is possible. Ultimately it would be nice if we could store our nas information in eDirectory and use ldap. However the mysql is another idea. - List

ldap edirectory mschap config help

Hello Using ver 1.01. Upon ldap lookup we see requests like the following.. rad_recv: Access-Request packet from host 10.1.5.102:6001 id=202 length=168 User-Name = COMPUTERAMYUSER

Re: ldap edirectory mschap config help

[EMAIL PROTECTED] 03/17 11:47 am James Kelly [EMAIL PROTECTED] wrote: rad_recv: Access-Request packet from host 10.1.5.102:6001 id=202 length=168 User-Name = COMPUTERAMYUSER We are trying

MySql Authentication problems

the problem? I realize there must be an encryption setting that is wrong, so any help with is greatly appreciated. James Ecker MCSE + Internet, CNE, A+, Network+ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Authentication problems

: modcall: entering group authorize for request 1 modcall[authorize]: module preprocess returns ok for request 1 modcall[authorize]: module chap returns noop for request 1 modcall[authorize]: module mschap returns noop for request 1 If so, how can I fix the problem? James Ecker MCSE

Authentication problems

:1812, id=125, length=20 I realize there must be an encryption setting that is wrong, so any help with is greatly appreciated. James Ecker MCSE + Internet, CNE, A+, Network+ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

fedora core 3 make error

this helps.. James Ecker MCSE + Internet, CNE, A+, Network+ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: ascend-data-filter info not returned with radtest?

On Tue, 18 Jan 2005, Scott Baker wrote: I'm attempting to do a global dial-up solution and they're requiring me to use the ascend-data-filter to open up outbound port 25. Simple enough. I've configured my users file to include the attributes they provided and it seems to be accepting the data.

Re: Multiple NAS Vendors, one user-id?

On Thu, 6 Jan 2005, James Feger wrote: Okay, So I am a newbie with just enough knowledge to know this should work, and have spent a few hours reading all the different cool things RADIUS does for me. However, I cant get it to do what we need, and I am sure its lack of experience. I have read

Re: Multiple NAS Vendors, one user-id?

: [jfeger] (from client bb-stlc.jp-01 port 0) Sending Access-Accept of id 10 to X.X.X.X:2315 Finished request 0 So, what am I missing, or have out of sequence? I have tried taking Fall-Through off, I have tried putting the Huntgroup before the Groupetc... Thanks, James I think that you can't put

Re: Multiple NAS Vendors, one user-id?

) Sending Access-Accept of id 10 to X.X.X.X:2315 Finished request 0 So, what am I missing, or have out of sequence? I have tried taking Fall-Through off, I have tried putting the Huntgroup before the Groupetc... Thanks, James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list

Multiple NAS Vendors, one user-id?

username. PS - My first attempt to send this got blocked due to me sending it from the wrong email address, sorry for the DUP if the original actually makes it past moderation. Thanks, James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Multiple NAS Vendors, one user-id?

If Huntgroup = Riverstone Then send only Riverstone Attributes Am I smoking the good stuff or is this doable? Thanks, James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

rlm_python for client/nas list

Hello, I'd like to move client.conf to something that works through rlm_python. Looking at rlm_sql, this appears possible. I'm willing to update rlm_python to support this, but I can't seem to find how it binds this functionality in rlm_sql. Anyone ever try this more? James - List info

request for rlm_python configuration example

Hello, I'm looking into setting up rlm_python, but haven't been able to find any examples of what I need to add to the radiusd.conf to use it. An example would be fantastic. I'll submit a patch to include it in the src/modules/rlm_python/README as well. James - List info/subscribe/unsubscribe

Failure to link rlm_ldap

libdl.so.1 =/usr/lib/libdl.so.1 libmp.so.2 =/usr/lib/libmp.so.2 /usr/platform/SUNW,Sun-Fire-V440/lib/libc_psr.so.1 So it would appear that the necessary libraries are being found. Any suggestions would be most appreciated. Regards James ~ Systems

RE: Is there some kind of trick to make Cisco LEAP work???

Hello Folks, All I can say is WOW! Too be quite honest I had given up on making FreeRadius work with Cisco's WDS and WLSE. In my particular situation we also had a licensed Cisco ACS 3.x (now 3.3) server however, we weren't particularly happy about exposing it to an untrusted Wi-fi

post_proxy_authorize after marking proxy server dead?

= 0x32 Cleaning up request 0 ID 1 with timestamp 4149f253 Nothing to do. Sleeping until we see a request. Is there another setting to do this? Or should I provide a patch? James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

radiusd only starting a single instance?

started? Thanks, James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Redundant SQL authorize not working

/radius.log 21 Any ideas on what the problem is? James - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Modify packet type in rlm_exec?

Alan DeKok wrote: James Nedila [EMAIL PROTECTED] wrote: Can I modify the packet type in my exec module? (ie/ change an Access-Accept to an Access-Reject) You can return 1 from the script, which will cause the module to return RLM_MODULE_FAIL, and should reject the user. Thanks, that works

Re: MySQL and EAP-TLS

Alle 18:51, marted 25 maggio 2004, Alan DeKok ha scritto: James [EMAIL PROTECTED] wrote: I know that it is possible to use EAP-TLS for authentication purposes together with My-SQL for authorization. However I cannot figure out what to put in radiuscheck in lieu of the password attribute

Re: MySQL and EAP-TLS

You don't need to do anything. EAP-TLS is authenticated via certificates, and therefore needs *nothing* from MySQL. Hi Alan, as usual (unfortunately) I didn't make myself clear on describing what i need. Basically, i want to authenticate users via EAP-TLS but i need also to look up on the

MySQL and EAP-TLS

Hi to all FreeRADIUS users, I know that it is possible to use EAP-TLS for authentication purposes together with My-SQL for authorization. However I cannot figure out what to put in radiuscheck in lieu of the password attribute (using eap-tls users don't have passwords but certificates). Thank

New attributes

Hello, i need some some information about attributes... Basically what i need to know is how i can add new radius attributes in radius access-accept packet. I'll try to explain briefly what we are doing: we are developing a new wireless architecture (so we have some non-standard devices) that

Vendor Specific Problem

Hello, i want to create a new dictionary to handle new attributes. First of all i create a new file called dictionary.mine containing the following lines: VENDOR Mine 4113 ATTRIBUTE VLANid 22 string Mine then i added in the users file the line: user Auth-Type := EAP

Re: Vendor Specific Problem

Hi, Why do you need this new attribute, there's ever standard attributes to assign VLAN : Tunnel-Type = VLAN Tunnel-Medium-Type = 802 (6) Tunnel-Private-Group-ID = VLAN NAME Maybe that can help you. Fred This was just an example... i need to better understand how to create a new

ip pool infos

Hi to everybody, i need some information about how the ip-pool works in freeradius. More precisely I want to know how the address is sent to the client (is it in an attribute of a radius packet?) and what happens when there is more than one subnetwork (I mean... how does the radius server choose

Re: Authorization and authentication

Hi Alan, sorry if I bother you again but I need some explanation... Briefly the point is: can I take authorization decisions based on the realm (for instance to block the access to my local ftp server for user of a specified realm) info BEFORE proxying the authentication? If the answer is

Re: Authorization and authentication

Hi, first of all thank you for your answer. reading my post, i noticed that i was not so clear so i try to describe in more detail my problem. Let suppose we have two companies, A and B, with some traffic agreement. Now, an user belonging to the network A moves into the network B. Network B can

EAP TLS blocked: solved

Hello everyone, as you probably remember I had the following problem on the conversation between my Access Point and the client: after the EAP Change Cipher Spec message sent from the server to the client everything was blocked (I mean no more messages exchanged). However, i noted that my

Authorization and authentication

Hello, I have the following problem: how can I remote authenticate (in his home network) a user and, at the same time, authorize him locally? Basically my scenario is as follows: A mobile user belonging to the network A moves to the network B. The network B proxies the authentication request to

Re: SSL_read Error

I don't think that's the cause of the problem. See similar messages on the list. The authentication continues after that point. In the latest CVs snapshot, that error message doesn't appear any more. Alan DeKok. Hello, i think you are right, but i can't figure out where this error

Re: SSL_read Error

FreeRADIUS. It's an error message which is meaningless. Ignore it. Alan Dekok. Okay, I've figured out that this is not the problem. What i cannot really understand yet is why the conversation between the client and the remote server stopped during the change cipher spec EAP message. I

SSL_read Error

Hello! I'm using freeradius 0.93 both as proxy server and authorization server. I've configured all the required files (i.e. radiusd.conf and clients.conf) but i've got stuck 'cause of this problem: whenever the clients tries to authenticate itself to the remote server the following error is

EAP-TLS Proxies

Hello to everybody, i need to know how the ip addresses in the eap-tls packets are modified in order to allow proxying between two different domains. My scenario is the following: - two domains with an internal radius server and a border proxy. - if the client is recognised as external, his

<    1   2   3   4