Re: Controlling access to my Wireless network.

Hi, The document you gave is good, except for the client certificate part. I don't want to have to give certificates out to everyone on my wireless network. Is there a way to get around this? err no. EAP-TLS uses client and server certificates. if you want to use just the server cert then

Re: Controlling access to my Wireless network.

Hi, network, mac xp. I wouldn't mind using plain text passwords if that could be forced. The only configurations that get close to working get as far as machapv2, then fail because of no nt/lm password. If I could use the password from my ldap connection which seems to be working nicely,

RE: EAP testing without AP?

Thanks for all advice. Result of testing using eapol_test is okay, except error OpenSSL: tls_connection_handshake - Failed to read possible Application Data error::lib(0):func(0):reason(0) is found: --- cut here --- [snipped] SSL:

RE: EAP testing without AP?

On Wed, 2007-09-19 at 16:40 +0800, ST Wong (ITSC) wrote: Thanks for all advice. Result of testing using eapol_test is okay, except error OpenSSL: tls_connection_handshake - Failed to read possible Application Data error::lib(0):func(0):reason(0) is found:

Re: Denying user from authentication

That won't work with EAP-TLS. As you found out. Ivan Kalik Kalik Informatika ISP Dana 19/9/2007, [EMAIL PROTECTED] [EMAIL PROTECTED] piše: HI Thank you for the response.But as per users file configuration it should deny the user if i include that user name-reject file.Do i need to do any

Re: Limit users traffic quota via radius

This is not correct. You may use SNMP, or you may use a RADIUS Change of Authority/Packet of Disconnect request... Regards Peter On Wed 19 Sep 2007, Willie Yeo wrote: You need SNMP to disconnect the link, not Radius. The only other way I can think of is that, if you can use an external

Re: Proxy server config with PAP or CHAP

Amit Jain wrote: Now the above configuration works when I have PAP as authentication method. Now I need to have EAP MD5 auth between user and free radius server and PAP or CHAP between free radius server and Radius server. Converting EAP-MD5 to PAP is impossible. Converting EAP-MD5 to

Re: EAP testing without AP?

ST Wong (ITSC) wrote: Thanks for all advice. Result of testing using eapol_test is okay, except error OpenSSL: tls_connection_handshake - Failed to read possible Application Data error::lib(0):func(0):reason(0) is found: ... However, the rest of debug message seems to be normal.

Re: Denying user from authentication

Hi Please explain brief about certificate revocation process as i am new to it.I have used openssl for creating certificates, Regards Anoop Message: 3 Date: Wed, 19 Sep 2007 10:36:18 +0100 From: [EMAIL PROTECTED] Subject: Re: Denying user from authentication To: \FreeRadius users mailing

RFC 3579 and Access-Accepts

Hello, it seems that FreeRADIUS is sending an EAP-Message fragment along with its Access-Accepts, as in: Packet-Type = Access-Accept Wed Sep 19 11:59:25 2007 MS-MPPE-Recv-Key = stuff MS-MPPE-Send-Key = morestuff EAP-Message = 0x03070004 Message-Authenticator =

Re: Denying user from authentication

[EMAIL PROTECTED] wrote: Hi Please explain brief about certificate revocation process as i am new to it.I have used openssl for creating certificates, Go read the OpenSSL pages. They document it quite nicely. Alan DeKok. - List info/subscribe/unsubscribe? See

odd user authenticated...

Hello, Here is the run down on my set up. RHEL5 64bit - freeradius 1.1.6, samba 3.0.23c-2, using peap(ms-chapv2)/ ntlm_auth for authentication and ldap for authorization. so I have ntlm_auth configured and working correctly. everytime a specific user logs in, i see this directly after

RE: RFC 3579 and Access-Accepts

Hi Stefan, Whereas RFC 3579 , chapter 2.6.5 says: An EAP-Message/EAP-Request/Notification SHOULD NOT be included within an Access-Accept or Access-Reject packet. I think this is a case of mis-reading the (confusing?) notation used by the RFC. What the RFC is saying is that you are not

RE: Proxy server config with PAP or CHAP

Thanks for the reply. But it was a surprise to me as, I thought when I forward to request to another radius server, I should be able to choose the authentication method. I thought some thing to configure by Auth-Type configuration ??? Regards, Amit Jain -Original Message- From: [EMAIL

Re: Freeradius +MS Win XP (EAP) problems

2007/9/19, Alan DeKok [EMAIL PROTECTED]: Sergio Belkin wrote: I want to configure freeradius (Linux) in order to authenticate and authorize MS Windows XP clients (people connect to Access Point Linksys). I am using EAP-PEAP and MSCHAP fron Windows. If I perform radtest from linux clients

Re: Limit users traffic quota via radius

Hi, so basically all I need is a RFC 3576-compliant radius server and the correct vsa specific of cisco device? What I do not understand is if : )the radius check the quota (but how and how often?) and then push the disconnect to the device, or )the device, once the user is authenticathed,

Re: Controlling access to my Wireless network

network, mac xp. I wouldn't mind using plain text passwords if that could be forced. The only configurations that get close to working get as far as machapv2, then fail because of no nt/lm password. If I could use the password from my ldap connection which seems to be working nicely,

Re: Freeradius +MS Win XP (EAP) problems

Sergio Belkin wrote: Thanks Alan for the advice, but please fix me if I'm wrong, if I'm using ttls (not tls) is needed client certificate too? TTLS doesn't need client certificates. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: RFC 3579 and Access-Accepts

Stefan Winter wrote: it seems that FreeRADIUS is sending an EAP-Message fragment along with its Access-Accepts, as in: ... Whereas RFC 3579 , chapter 2.6.5 says: An EAP-Message/EAP-Request/Notification SHOULD NOT be included within an Access-Accept or Access-Reject packet. See Appendix

Freeradius and Windows Vista

I am running FR version 1.1.7 along with OpenSSL 0.9.8c on Debian. Authentication from XP works flawlessly and from what I have been able to tell from, with these versions I should be able to have Vista do PEAP/MSChapv2 authentication via Freeradius. However, it still seems that Vista stops the

PAM authenticacion and groups

Hi, I have freeradius configured to authenticate users with PAM working fine. Now I want to add group membership checking. I have the followind users entry: DEFAULT Auth-type = PAM, Group-name == netadmin Service-Type = Login-User, Cisco-AVPair = shell:priv-lvl=15,

Re: Freeradius and Windows Vista

Neal Bullins wrote: I am running FR version 1.1.7 along with OpenSSL 0.9.8c on Debian. Authentication from XP works flawlessly and from what I have been able to tell from, with these versions I should be able to have Vista do PEAP/MSChapv2 authentication via Freeradius. However, it still

New dictionary for huawei-3com

Hello, 3Com is now also using #25506 (H3C - huawei-3com) vendor attribute in a new firmware (3.3.0) for 3c5500G switches. This patch adds appropriate dictionary and also moves hp to be properly sorted. Best regards, Krzysztof Olędzki diff -Nur

RE: Freeradius and Windows Vista

Make sure you're using a recent version of samba. Many distros still shib with older versions that won't work. josh. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Alan DeKok Sent: 19 September 2007 17:09 To: FreeRadius users mailing list

Re: PAM authenticacion and groups

2007/9/19, Alan DeKok [EMAIL PROTECTED]: Diego Woitasen wrote: ... That doesn't work. And what do you mean by that? See the FAQ. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html That entry/configuration I read the FAQ and I can't

Re: PAM authenticacion and groups

Diego Woitasen wrote: That entry/configuration I read the FAQ and I can't see nothing interesting. The question is, radius uses nsswitch to check group membership using PAM authenticacion? Q: Hi I tried to do stuff, but it didn't work. Why? A: WTF? It's difficult to help you if you

Re: Configuring FreeRADIUS to use ntlm_auth

Alan: Great ... you have reason ... My NAS was configured to send only PAP request. I reconfigured it to accept MS-CHAP and my FreeRadius works well. Best Regards. Charles. Alan DeKok [EMAIL PROTECTED] Enviado Por: [EMAIL PROTECTED] 17/09/2007 16:28 Favor responder a FreeRadius users

Re: PAM authenticacion and groups

2007/9/19, Alan DeKok [EMAIL PROTECTED]: Diego Woitasen wrote: That entry/configuration I read the FAQ and I can't see nothing interesting. The question is, radius uses nsswitch to check group membership using PAM authenticacion? Q: Hi I tried to do stuff, but it didn't work. Why?

RE: Limit users traffic quota via radius

You can tell the NAS to send accounting updates every so often (every hour for example with: aaa accounting update periodic 60 on Cisco) and calculate the amount of traffic each user has consumed with an SQL query in the Radius database. Another option is to query the NAS with SNMP. Check this to

FreeRADIUS and iODBC

You must use a DSN of 'radius' in odbc.ini when using the iodbc SQL module. You can't use any other name. I have this working against MSSQL. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose

Re: Freeradius and Windows Vista

Hi, I am running FR version 1.1.7 along with OpenSSL 0.9.8c on Debian. Authentication from XP works flawlessly and from what I have been able to tell from, with these versions I should be able to have Vista do PEAP/MSChapv2 authentication via Freeradius. However, it still seems that Vista

Re: PAM authenticacion and groups

Groups are a part of authorization so there is no conflict with any authentication method. You can use ldap (Ldap-Group), sql(Sql-Group), unix (Group) ... Ivan Kalik Kalik Informatika ISP Dana 19/9/2007, Diego Woitasen [EMAIL PROTECTED] piše: 2007/9/19, Alan DeKok [EMAIL PROTECTED]: Diego

RE: EAP testing without AP?

I'm running freeradius 1.1.7 and wpa_supplicant 0.5.8. Seems the message was printed by tls_openssl.c in wpa_supplicant.Thanks. /ST -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Alan DeKok Sent: Wednesday, September 19, 2007 6:19 PM To:

Re: odd user authenticated...

Joe Vieira wrote: Hello, Here is the run down on my set up. RHEL5 64bit - freeradius 1.1.6, samba 3.0.23c-2, using peap(ms-chapv2)/ ntlm_auth for authentication and ldap for authorization. so I have ntlm_auth configured and working correctly. everytime a specific user logs in, i see

Re: Proxy server config with PAP or CHAP

Amit Jain wrote: Thanks for the reply. But it was a surprise to me as, I thought when I forward to request to another radius server, I should be able to choose the authentication method. What gave you that idea? I thought some thing to configure by Auth-Type configuration ??? No, that

Do we like the same books?

I just joined Shelfari to connect with other book lovers. Come see the books I love and see if we have any in common. Then pick my next book so I can keep on reading. Click below to join my group of friends on Shelfari!