User Authentication via Websitewith Apache

hi i would like to authenticate my user via apache-ssl over a website where the user must fill in his AD username and password. only if this is correct he can access the internet. my question is, if this is possible. an what i have to use that this would be secure. like the traffic between

Attributes in access-challenge

Hi all, Is it "normal" that the attributes contained in the access-accept packet are also contained in the Access-Challenge packets sent by Freeradius ? Is there a way to force Freeradius to return the attributes associated to the user in the access-accept packet only ? Many thanks.

problem to authenticate via peap/mschapv2

hi i like to authenticate with my AD over peap/mschapv2... but i become following error... my clients are windowsXP SP2 with SecureW2... my test accesspoint d-link dwl900+ and freeradius 1.0.5 i dont know why they dont send the User-Password... rad_recv: Access-Request packet from host

Re: multiple 'users' files possible?

Hi, So, I have to merge the files and find another solution... ...umm, this is documented in a couple of places! have just one single 'users' file - and then within that file, pull in the user-editable oneseg $INCLUDE dept-a-users.txt $INCLUDE dept-b-users.txt alan - List

Re: Cache with proxy

Le mardi 22 novembre 2005 à 12:31 +0100, Nicolas Baradakis a écrit : Romain GAILLEGUE wrote: I have recently installed two freeradius servers one in server mode with MySQL authentication and an other in proxy mod. But sometime the connexion between the two servers is broken. I would

SQL Mac-Authentication based on Call-Check

Hello. I'm currently working on my diploma thesis, and I'm sorting some things out at the moment. The task is, to authenticate mac-adresses through a cisco catalyst 6500. A pretty new feature called mac-authentication-bypass is available in CatOS and works well with Cisco ACS 4.0 beta. Due

Re: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]

King, Michael wrote: Ignore the freeRADIUS package. Due to license restrictions, it cannot contain the binaries for OpenSSL. We have to use the source. Indeed. Download the latest release of freeRADIUS Unzip freeRADIUS Tar -zxvf freeradius-1.0.5.tar.gz Switch to the directory then

RADIUS Mac Authentication

I'm looking for a document that describes in detail the working of RADIUS MAC Authentication. (which attributes are sent in the access-request, which values should be in there etc) This because I'm going to write code to allow RADIUS MAC Authentication in our NAS. Thx in advance -- Jonathan De

Re: Clients.conf attributes, multiples users files.

Breuer Nicolas wrote: I think the easiest way is to configure the name of the auth files into the clients.conf NAS1 : file: users NAS2 : file: users2, etc.. With this type of config, we can easily manage multiple type of users/ auth with one radiusd on one port.. I'd suggest to

RE: tool for testing machine authentication

Johan Ramm-Ericson wrote: Hi, having just recently succesfully setup freeradius and being somewhat frustrated with the documentation, I felt there may be someway I could contribute to improve it. A while back there was a thread on the mailinglist to the effect of setting up a Wiki. Has this seen

Hi,

Hi, I have configured freeradius with WPA support using suse Using Windows mobile 2003 machine i could successfully authenticate. The problem is that it takes nearly 5-6 minutes to authenticate. Can anyone suggest me how to reduce the authencation time? Thanks Patrice - List

freeradius WPA Problèm

Hi, I have configured freeradius with WPA support using suse Using Windowssmobile 2003 machine i could successfully authenticate. The problem is that it takes nearly 5-6 minutes to authenticate. Can anyone suggest me how to reduce the authencation time? Thanks Patrice - List

Re: multiple 'users' files possible?

Arne Götje (高盛華) wrote: On Wednesday 23 November 2005 13:50, Lewis Bergman wrote: This is exactly my question whether this will work or the second entry will just overwrite the first one. Maybe this is a stupid question, but since you knew exactly what *might* work, have you tried it? It

Re: User Authentication via Websitewith Apache

Konne wrote: hi i would like to authenticate my user via apache-ssl over a website where the user must fill in his AD username and password. only if this is correct he can access the internet. my question is, if this is possible. an what i have to use that this would be secure. like the

RE: Freeradius How to integrate Active Directory [AD IntegrationWindowsXP NTLM Tutorial]

Thank you. I'm a relative new Debian addict, so I was unaware of the repercussions. I learned something today, time to go home. :-) I'll throw that into my notes. Based on the list activity in the last few days, I'm hoping to reformat, and make clearer my notes. Seems there is a need for

Proxy radius GTC

Hi, I know proxying for PEAP/EAP-MsChapV2 is ok with FreeRadius. Or, I want to know if proxying for PEAP/EAP-GTC is working too ? Thanks BenjO - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Error with free radius, as5800, and ascend data types

Hi, We have this radius-reply-attribute in our radius configuration (free-radius): ip in forward tcp est However, when someone dials up to our as5800 it generates this error: rlm_sql: Failed to create the pair: failed to parse Ascend binary attribute: Unknown string est in IP data filter

Wiki

Is it possible to get a wiki going on the freeradius site, or at least a link to an official-unofficial wiki. I know that people have pdf's and notes on various sites, but it would be great if the people in charge were willing to designate an official place for wiki. - List

RE: Error with free radius, as5800, and ascend data types

Why would FreeRADIUS return Ascend VSAs to a Cisco AS5800? I would only expect it to return values that are either RFC attributes or Cisco VSAs. Rgds, Guy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Sent: 23 November 2005 15:12 To:

www.freeradius.de - Forum

hi, i found a freeradius forum for germans... http://www.freeradius.de ciao Konne - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Error with free radius, as5800, and ascend data types

Cisco has an option to accept the non-standard Ascend attributes ( note, NOT the VSA's but the early Ascend attempt to use higher numbered standard attributes ). In regards to the original poster, does the filter value work if you use it in a 'users' file syntax? Also, what version of

eap with MySQL don't work

radius_xlat: '/var/log/radius/radacct/172.16.47.50/auth-detail-20051123' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.47.50/auth-detail-20051123 modcall[authorize]: module auth_log returns ok for request 3 modcall[authorize

Re: User Authentication via Websitewith Apache

hi, i´m very interesting in this too. I want the same but all user/passwd are in mysql database, how can i redirect all traffic? and i want that local MAC list are in the radius server and not in the Access Point. any help? Lewis Bergman escribió: Konne wrote: hi i would like to

Re: Error with free radius, as5800, and ascend data types

We are running FR version 1.0.5 And no, it doesn't seem to work in the users file syntax. On 11/23/05, Chris Parker [EMAIL PROTECTED] wrote: Cisco has an option to accept the non-standard Ascend attributes ( note, NOT the VSA's but the early Ascend attempt to use higher numbered standard

Freeradius WPA issue

Hi, I make test on Windows Pocket PC and Windows mobile 2003 in WPA and TKIP. The mobile 2003 is not able to be authenticated and pocket PC with need for 1070 requetes to authenticate itself. Herewith the debug Help me pease Patrice eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK

RE: Error with free radius, as5800, and ascend data types

Oh, thanks for setting me straight, Chris :) Sounds like a pretty doomed idea to have non-standard uses of the supposedly RFC defined attributes. Rgds, Guy -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Parker Sent: 23 November 2005 15:53 To:

Re: Proxy radius GTC

benjo.fr [EMAIL PROTECTED] wrote: I know proxying for PEAP/EAP-MsChapV2 is ok with FreeRadius. Or, I want to know if proxying for PEAP/EAP-GTC is working too ? Yes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Wiki

Robin Mordasiewicz [EMAIL PROTECTED] wrote: Is it possible to get a wiki going on the freeradius site, or at least a link to an official-unofficial wiki. We're looking into getting one set up this weekend. I know that people have pdf's and notes on various sites, but it would be great if

Re: eap with MySQL don't work

awal.mohamadou [EMAIL PROTECTED] wrote: i've been knocking my head on the wall searching why my freeradius server is not working. can someone help me please? The problem has nothing to do with MySQL. The client isn't receiving the response from the server. Find out why. Alan DeKok. -

Re: Hi,

Patrice PAPOT [EMAIL PROTECTED] wrote: The problem is that it takes nearly 5-6 minutes to authenticate. Can anyone suggest me how to reduce the authencation time? Find out why it's taking so long. Did you try running the server in debugging mode to see what it's doing? Alan DeKok. -

Re: Error with free radius, as5800, and ascend data types

Hrmm yeah.. see that after est? as in estnot est ? Yeah apparently there were a /n and a /r after it, which the database didn't show... ugh. On 11/23/05, Matt [EMAIL PROTECTED] wrote: Hi, We have this radius-reply-attribute in our radius configuration (free-radius): ip in forward

Re: freeradius WPA Problèm

On Wednesday 23 November 2005 07:58, Patrice PAPOT wrote: I have configured freeradius with WPA support using suse Using Windowssmobile 2003 machine i could successfully authenticate. The problem is that it takes nearly 5-6 minutes to authenticate. Can anyone suggest me how to reduce the

Re: Proxy radius GTC

Alan, Thanks for your answer. I have this architecture : Supplicant -- FreeRadius -- Radius I'have not the choice about Supplicant and Radius. When I want to do PEAP/EAP-GTC or PEAP/EAP-MsChapV2 directly with Supplicant and Radius, it doesn't work. FreeRadius is RFC-Compliant (thank you

Re: Outter User-Name for Accounting in EAP-TTLS

I am resending this 'cause nobody reponded. Any idea? Kevin I want to use FreeRadius for proxy so our map is like AP - FreeRadius - MyRadius Problem is MyRadius gets user-name=anonymous in accounting. Is there a way that we can put a real user-name to accounting? - List

Re: SQL Mac-Authentication based on Call-Check

florian broder [EMAIL PROTECTED] wrote: The only thing I'm currently unaware of is, where I can tell freeradius to use Call-Check together with mysql, I think it's somewhere in sql.conf? No, it's also in the radcheck table. Only thing that need to be done IMO is to tell radius, that there

Re: RADIUS Mac Authentication

Jonathan De Graeve [EMAIL PROTECTED] wrote: I'm looking for a document that describes in detail the working of RADIUS MAC Authentication. (which attributes are sent in the access-request, which values should be in there etc) It's not a standard, so it's not documented anywhere. This

Re: Proxy radius GTC

benjo.fr [EMAIL PROTECTED] wrote: Have you any idea about my mistake ? It would help if you described exactly what you're doing. So far, I can tell you're using PEAP, MSCHAP, and GTC with proxying, but I have no idea what protocol is used where, or what protocol you *want* to be used where.

Re: Outter User-Name for Accounting in EAP-TTLS

kevin [EMAIL PROTECTED] wrote: I am resending this 'cause nobody reponded. Any idea? Read the list archives. This question came up last week, or the week before. Alan DEKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Question about deleting old files

Hi Everyone: I have upgraded my freeradius from version 0.9.3 to the newest version. Is it safe to delete all of the files from the 0.9.3 version such as the .lib, .lib.so and .a files? Thanks! Linda PagilloDirector of Technical ServicesN2 The Net, LLC931-372-9179931-520-4031 (FAX)[EMAIL

Re: Freeradius WPA issue

On Wednesday 23 November 2005 11:09, Patrice PAPOT wrote: Hi, I make test on Windows Pocket PC and Windows mobile 2003 in WPA and TKIP. The mobile 2003 is not able to be authenticated and pocket PC with need for 1070 requetes to authenticate itself. Herewith the debug Help me pease

Re: Outter User-Name for Accounting in EAP-TTLS

i posted the same question a week a so ago, alan suggested to send the user-name back with the radius response. unfortunately this did not help, it seems that the accesspoints we were using (foundry ironpoint 200) mix them up, foundry is currently examining the case. which ap are you using?

Re: Question about deleting old files

Linda Pagillo [EMAIL PROTECTED] wrote: I have upgraded my freeradius from version 0.9.3 to the newest version. Is it safe to delete all of the files from the 0.9.3 version such as the .lib, .lib.so and .a files? Thanks! Yes. Alan DeKok. - List info/subscribe/unsubscribe? See

Re: Question about deleting old files

Thank you, sir! - Original Message - From: Alan DeKok [EMAIL PROTECTED] To: FreeRadius users mailing list freeradius-users@lists.freeradius.org Sent: Wednesday, November 23, 2005 3:28 PM Subject: Re: Question about deleting old files Linda Pagillo [EMAIL PROTECTED] wrote: I have

Re: Question about deleting old files

Alan DeKok wrote: Linda Pagillo [EMAIL PROTECTED] wrote: I have upgraded my freeradius from version 0.9.3 to the newest version. Is it safe to delete all of the files from the 0.9.3 version such as the .lib, .lib.so and .a files? Thanks! Yes. Alan DeKok. - Use package management

Re: Question about deleting old files

Thanks! - Original Message - From: Joe Maimon [EMAIL PROTECTED] To: FreeRadius users mailing list freeradius-users@lists.freeradius.org Sent: Wednesday, November 23, 2005 3:42 PM Subject: Re: Question about deleting old files Alan DeKok wrote: Linda Pagillo [EMAIL PROTECTED]

RE: SQL Mac-Authentication based on Call-Check

If I understand this correctly I could have 3 ways to do RADIUS MAC Authentication: 1) (enterasys seems to do it like this) Username == mac, password == default password set in the nas and that matches the pass in the 'radcheck' table but different from the nas secret 2) (like it seems most

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]

This is a great howto. Here is my scenario. I have a Windows2k DC that I would like to authenticate against. I have a Cisco VPN 3005 Concentrator that will be terminating VPN's. I would like to use FreeRADIUS to lock the users into groups and authenticate them against AD. I have followed the

RE: help with EAP MD5 wired authentication

Ok. I finally figured out 1. Comment out the following lines as shown below OR 2. Put your users before these lines. # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = PPP, since PPP might also be auto-detected # by the terminal server

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]

On Wed, 23 Nov 2005, Alhagie Puye wrote: I have followed the steps in the howto and everything seems to work fine but FreeRADIUS is ignoring MS-CHAP. I'm using ntradpingmaybe that's a wrong utility for this instance. I don't think you can properly test this with NTRadPing, but I have

Re: More than one sentence in accounting_stop_query

I want to make 2 SQL consultations in the accounting_stop_query field. (in sql.conf) Define a new section like that sql {...} in sql.conf (for example call it postsql), and then invoke it in radiusd.conf in accounting { ... } section: accounting { detail sql postacctsql } You see,

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]

Actually, I believe the more important questions is to authenticate against Active Directory, do you need MS-CHAP or LDAP? Thanks, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On