Re: [ANN] Version 3.0.0-rc0

2013-07-18 Thread John Dennis
autotools configure script issue/question: Why is udpfromto disabled by default? I thought udpfromto was necessary for correct operation in some configurations and benign otherwise. I thought the udpfromto option was added to 2.x because the issue was discovered in the middle of the 2.x release

Re: Post Auth Configurations

2013-07-18 Thread Navodit Bhardwaj
Hi To proceed with unlang, how can I ensure that the Access-Request contains specific IE. For example: - IMEI Field: 1234567890123 - Hardware Id : AC12BD54FS56TRZS506 - etc.. Also, Is there any limitation to number of parameters and size, that can be contained in any

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread Stefan Winter
Hi, I'd love to try. looking at GITHUB's master branch, I see that the latest commit was 5 months ago, and the last tag is 3_0_0_beta1 ? There's also no other branch name that suggests recent versions. Anything wrong with github? Stefan On 16.07.2013 15:15, Alan DeKok wrote: Stefan Winter

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread Arran Cudbard-Bell
On 17 Jul 2013, at 07:59, Stefan Winter stefan.win...@restena.lu wrote: Hi, I'd love to try. looking at GITHUB's master branch, I see that the latest commit was 5 months ago, and the last tag is 3_0_0_beta1 ? You're possibly looking at Alan's repo? Anything wrong with github? No, we

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread Stefan Winter
Hi, Anything wrong with github? Oh, never mind that. git.freeradius.org has a link to: http://github.com/alandekok/freeradius-server/tree/master which is probably not the best place to link to. Sure, if you read the github notice on that page it'll tell you Alan DeKok's private copy of the

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread Alan DeKok
Stefan Winter wrote: git.freeradius.org has a link to: http://github.com/alandekok/freeradius-server/tree/master Fixed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Delete one value of multiple attribute(Class)

2013-07-17 Thread Alan DeKok
Okis Chuang wrote: Actually I can write a short perl script to do this, but I try to do with pure unlang. Unlang is not really intended to do that. In fact, the reason why I need this function is that sometimes we treat some attributes as temporary variable for generating another attribute

Re: Radius is not starting

2013-07-17 Thread Arran Cudbard-Bell
radiusd: symbol lookup error: /usr/local/lib/rlm_perl-2.2.0.so: undefined symbol: Perl_Gthr_key_ptr I have googled it but could not resolved it. You can't of googled very hard... https://ask.fedoraproject.org/question/10205/why-is-the-perl_gthr_key_ptr-symbol-missing/ Arran

Re: Delete one value of multiple attribute(Class)

2013-07-17 Thread Okis Chuang
Okis Chuang wrote: Actually I can write a short perl script to do this, but I try to do with pure unlang. Unlang is not really intended to do that. In fact, the reason why I need this function is that sometimes we treat some attributes as temporary variable for generating another

Re: Delete one value of multiple attribute(Class)

2013-07-17 Thread Olivier Beytrison
On 17.07.2013 12:29, Okis Chuang wrote: But the situation I encountered is : 1.I need to save some information returned in Access-Accept from external AAA in the attribute **Class** at the section **post-auth**. So it will return back to gateway. 2.Then gateway will send Accounting-Start to my

Re: Delete one value of multiple attribute(Class)

2013-07-17 Thread Fahad Saleem
Hi Alan, Thanks for reply. Yes, I totally can understand the solution you recommend, and I've been using this skill for quite a long time. But the situation I encountered is : 1.I need to save some information returned in Access-Accept from external AAA in the attribute *Class* at the

Re: Delete one value of multiple attribute(Class)

2013-07-17 Thread Alan DeKok
Okis Chuang wrote: But the situation I encountered is : It helps to describe the situation *accurately*. Otherwise, you're wasting everyone's time. 1.I need to save some information returned in Access-Accept from external AAA in the attribute **Class** at the section **post-auth**. So

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread John Dennis
I've been going through the packaging effort for 3.0 for Fedora/RHEL. BTW, many thanks to Stefan Paetow who did an initial spec file, Stefan's work has been a big help. I'm coming up with a list of issues as I find them, more to come later, but for now ... 1) The redhat directory is populated

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread Alan DeKok
John Dennis wrote: 1) The redhat directory is populated with the old 2.x spec file, no sense in updating this until we have a good 3.x spec file, but it should be updated prior to the official 3.0 release. OK. I've pushed a simple change which gets rid of 10 years of changelog at least.

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread John Dennis
On 07/17/2013 12:26 PM, Alan DeKok wrote: John Dennis wrote: The following are installed in either /bin or /usr/sbin but there are no corresponding man pages. Every command installed needs to have a man page. dhcpclient radattr Hmm... those two probably shouldn't be installed. They're

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread Arran Cudbard-Bell
On 17 Jul 2013, at 17:47, John Dennis jden...@redhat.com wrote: On 07/17/2013 12:26 PM, Alan DeKok wrote: John Dennis wrote: The following are installed in either /bin or /usr/sbin but there are no corresponding man pages. Every command installed needs to have a man page. dhcpclient

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread Alan DeKok
John Dennis wrote: Sure it's no problem for the spec file to ignore them but I'm wondering if they are valuable for testing won't others find them useful too? If so shouldn't we keep them and add a man page? Maybe. radattr is really a test tool for RFC6929 attributes. And now for parsing

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread Alan Buxey
Hi Don't you have freeradius-utils already. .. which contains radtest etc which is very useful for admins alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread John Dennis
On 07/17/2013 04:16 PM, Alan Buxey wrote: Hi Don't you have freeradius-utils already. .. which contains radtest etc which is very useful for admins Yes, my bad, sorry, not enough coffee. John -- jden...@redhat.com - List info/subscribe/unsubscribe? See

RE: [ANN] Version 3.0.0-rc0

2013-07-17 Thread stefan.paetow
+stefan.paetow=diamond.ac...@lists.freeradius.org] on behalf of John Dennis [jden...@redhat.com] Sent: Wednesday, July 17, 2013 5:47 PM To: FreeRadius users mailing list Cc: Alan DeKok Subject: Re: [ANN] Version 3.0.0-rc0 On 07/17/2013 12:26 PM, Alan DeKok wrote: John Dennis wrote: The following

Re: [ANN] Version 3.0.0-rc0

2013-07-17 Thread Arran Cudbard-Bell
On 17 Jul 2013, at 22:42, stefan.pae...@diamond.ac.uk wrote: Sorry John, But you do have a tools package. It's called freeradius-utils. :-) I'd guess radattr probably fits nicely into that. No it's part of the internal test framework. It's really of absolutely no use to anyone except

RE: Freeradius-Users Digest, Vol 99, Issue 55

2013-07-17 Thread Okis Chuang
Hi all, Really appreciate all your kind supports and helps very much. Alan..I didn't meant to be inaccurate about describing my situation...I just don't want to blur my question with too many details. Well, I think I didn't keep the balance well. If let you feel bad, I'm very sorry about that.

Re: Delete one value of multiple attribute(Class)

2013-07-17 Thread Okis Chuang
Hi all, Really appreciate all your kind supports and helps very much. Alan..I didn't meant to be inaccurate about describing my situation...I just don't want to blur my question with too many details. Well, I think I didn't keep the balance well. If let you feel bad, I'm very sorry about

Re: [ANN] Version 3.0.0-rc0

2013-07-16 Thread Stefan Winter
Hi, If you are planning on deploying 3.0 and have an existing 2.x.x configuration you were planning to migrate when the 3.0 is released, now would be a good time to try that, and to report any issues or problematic behaviour changes you notice. Here's another thing that worked in 2.x,

Re: FreeRadius Authentication against AD or AD LDS (LDAP)

2013-07-16 Thread Alan Buxey
Hi Store the passwords in nt-hash format. Use guest usernames with a particular format so that you can use some simple unlang to select the right type of authentication rather than hitting each method and causing unnecessary load and delay alan - List info/subscribe/unsubscribe? See

Re: FW: FreeRadius Authentication against AD or AD LDS (LDAP)

2013-07-16 Thread Fajar A. Nugraha
On Tue, Jul 16, 2013 at 1:02 PM, limacher david limache...@hotmail.comwrote: Hello I'm looking for a solution to realize a FreeRadius Server, which can Authenticate against primary a AD and as second method against AD LDS (Lightweight Directory from Windows). We want for our WLAN, that in

Re: [ANN] Version 3.0.0-rc0

2013-07-16 Thread Alan DeKok
Stefan Winter wrote: Earlier, this would yield the number of characters in the incoming request's User-Password attribute, and see if it's exactly 96 Bytes. I don't know why the # triggers an unknown attribute? Looks like a bug to me... I'll take a look. Alan DeKok. - List

Re: FW: FreeRadius Authentication against AD or AD LDS (LDAP)

2013-07-16 Thread Alan DeKok
limacher david wrote: I'm looking for a solution to realize a FreeRadius Server, which can Authenticate against primary a AD and as second method against AD LDS (Lightweight Directory from Windows). Follow this guide: http://deployingradius.com/documents/configuration/active_directory.html

RE: FreeRadius Authentication against AD or AD LDS (LDAP)

2013-07-16 Thread stefan.paetow
Considering that LDS will still be running Active Directory, give your reception login(s) the permission to administer the Guest-Network OU (i.e. add/delete/edit users), and continue to use the NTLM authentication you use with the primary AD. Active Directory uses MS-CHAPv2, so using the

Re: [ANN] Version 3.0.0-rc0

2013-07-16 Thread Alan DeKok
Stefan Winter wrote: (0) ERROR: %{#User-Password} (0) ERROR: ^ Unknown attribute (0) ERROR: Evaluation of condition failed for some reason. (0)else else { (0) - entering else else {...} Earlier, this would yield the number of characters in the incoming request's User-Password

Re: Duplicated records in RADACCT with differents delay times

2013-07-16 Thread Antonio Fernández Pérez
Hi everybody, Recently I posted a problem with accounting rows duplicated. Following Arran's advices I changed radacct table, defining AcctUniqueId column as a unique index. Solved it! Now, I have the same problem but, at this time with AcctSesionId column. There are a lot of rows that have

Re: Dynamic vlan assignment with ldap groups

2013-07-16 Thread val john
Hi guys I had to also set the *use_tunneled_reply=yes* in the eap.conf to get the Dynamic vlan assignment to work On 12 July 2013 19:42, val john valjohn1...@gmail.com wrote: Hi guys , Small question , do i need to import radius ldap schema ( items like radiusprofiles ) to our ldap

Re: Delete one value of multiple attribute(Class)

2013-07-16 Thread Okis Chuang
Is there anyone can help? Actually I can write a short perl script to do this, but I try to do with pure unlang. So.if someone can told me whether this purpose can be done with only unlang, I can save lots of time on this endless trial. Lol In fact, the reason why I need this function is

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Stefan Winter
Hi, If you are planning on deploying 3.0 and have an existing 2.x.x configuration you were planning to migrate when the 3.0 is released, now would be a good time to try that, and to report any issues or problematic behaviour changes you notice. Here's one thing during make install that

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Alan DeKok
Stefan Winter wrote: Now, with 3.0.0 if I try the same trick, I get: # mv raddb raddb-noinst # make install scripts/boiler.mk:552: raddb/all.mk: No such file or directory make: *** No rule to make target `raddb/all.mk'. Stop. I understand that the urgency of preserving existing config

Re: 2.2.0 dhcp: regression

2013-07-15 Thread Eugene Grosbein
On 12.07.2013 19:07, Alan DeKok wrote: OK. But I'm not aware of any change in any code which will limit the number of sockets. 2.1.12 has not this issue with same Perl. OK. The rlm_perl module changed. It added some locks to avoid issues with Perl Clone and threads. Maybe you're

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Stefan Winter
Hi, If you are planning on deploying 3.0 and have an existing 2.x.x configuration you were planning to migrate when the 3.0 is released, now would be a good time to try that, and to report any issues or problematic behaviour changes you notice. The errors for people upgrading from 2.x are

Re: 2.2.0 dhcp: regression

2013-07-15 Thread Alan DeKok
Eugene Grosbein wrote: Basically, I solved our problem but one question persists: why is CLONE_SKIP called many times at radiusd start time? Because the rlm_perl module changed. It added code to *correctly* handle threads. Alan DeKok. - List info/subscribe/unsubscribe? See

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Stefan Winter
Hi, On 15.07.2013 10:24, Alan DeKok wrote: # mv raddb raddb-noinst # mkdir raddb # touch raddb/all.mk # make install that's easy enough, thanks! Stefan -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Arran Cudbard-Bell
On 15 Jul 2013, at 09:30, Stefan Winter stefan.win...@restena.lu wrote: Hi, If you are planning on deploying 3.0 and have an existing 2.x.x configuration you were planning to migrate when the 3.0 is released, now would be a good time to try that, and to report any issues or problematic

Re: How to get vendor-specific attribute value pairs

2013-07-15 Thread Mathieu Simon
As a short update on this topic - I thought it might be worth sharing the update since I've been successfull in getting authorized via FR to privileged exec mode on a Netgear GSM7224P (F/W 1.0.1.21). Netgear is based on Broadcom FASTPATH (MIBs tell so) - as do some Dell PowerConnect's and

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Arran Cudbard-Bell
On 15 Jul 2013, at 10:04, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: On 15 Jul 2013, at 09:30, Stefan Winter stefan.win...@restena.lu wrote: Hi, If you are planning on deploying 3.0 and have an existing 2.x.x configuration you were planning to migrate when the 3.0 is

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Stefan Winter
, so sorry if the below question is just noise... I'll have replace my sql_log instances with rlm_sql_null (*sniff*). So as I was in the process of re-weriting the first instance config, I stumbled over the 2.x parameter: sql_log sql-relay-acct-vpn { path = ${radacctdir}/sql-relay-common

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Arran Cudbard-Bell
behaviour changes you notice. I must be missing something pretty obvious, so sorry if the below question is just noise... I'll have replace my sql_log instances with rlm_sql_null (*sniff*). So as I was in the process of re-weriting the first instance config, I stumbled over the 2.x

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Arran Cudbard-Bell
was in the process of re-weriting the first instance config, I stumbled over the 2.x parameter: sql_log sql-relay-acct-vpn { path = ${radacctdir}/sql-relay-common ... } Which is useful for knowing where the text file with the queries ends up. And in 3.0.0-rc0

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Stefan Winter
Hi, I'll double check the default configs to make sure they list it and update the documentation. Fixes pushed for behaviour, and to fixup the default config files. Good news! Just wondering: the files being written to are properly locked thread waits for the lock - right? I have

Re: [ANN] Version 3.0.0-rc0

2013-07-15 Thread Arran Cudbard-Bell
On 15 Jul 2013, at 15:13, Stefan Winter stefan.win...@restena.lu wrote: Hi, I'll double check the default configs to make sure they list it and update the documentation. Fixes pushed for behaviour, and to fixup the default config files. Good news! Just wondering: the files being

Re: Fwd: radiusclient-ng in Debian

2013-07-15 Thread Alan DeKok
Daniel Pocock wrote: I just opened this report against radiusclient-ng in Debian (see below), can anybody else comment on the situation, in particular, for compatibility? Is there any urgency for Debian to update to the new client code? It has a number of bugs fixed. The old

Re: client code for long extended attributes?

2013-07-15 Thread Alan DeKok
Daniel Pocock wrote: Can anybody comment on which client code should be used for long extended attributes? I see that the freeradius-client project predates RFC 6929. By a LONG ways. There's no client code for the extended attributes. The RFC was just published. So far as I know,

Re: [again] Error [mschap] No Cleartext-Password configured. Cannot create LM-Password.

2013-07-15 Thread Alan DeKok
Holger Wesser wrote: I've googled a while and found different solutions for the error message: [mschap] No Cleartext-Password configured. Cannot create LM-Password. There's only one solution: give the server a known good password. e.g. Cleartext-Password, or NT-Password. What I've done

Re: radiusclient-ng in Debian

2013-07-15 Thread RONAN BLANEY
can M.I.T. model stats for a regional mental health service to act as a 3d shape that can represent an average that can be super imposed on other 3d models of other health services to check for odd variation. I had a consultant offer me uncompiled raw stats to prove regularity of diagnosis when

Re: Fwd: radiusclient-ng in Debian

2013-07-15 Thread Daniel Pocock
On 15/07/13 21:51, Alan DeKok wrote: Daniel Pocock wrote: I just opened this report against radiusclient-ng in Debian (see below), can anybody else comment on the situation, in particular, for compatibility? Is there any urgency for Debian to update to the new client code? It has a

Re: freeradius accept-accept with no AVP attributes

2013-07-13 Thread Alan DeKok
J KIE wrote: the radius servers on my network are receiving spikes of ACCESS-ACCEPT traffic, RADIUS servers received Access-Request packets, and send Access-Accept packets. I have been analysing traffic using tshark and noticed that some of the ACCESS-ACCEPT sent from the server back to

Re: [ANN] Version 3.0.0-rc0

2013-07-12 Thread Doug Hardie
On 11 July 2013, at 15:24, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: On 11 Jul 2013, at 22:39, Doug Hardie bc...@lafn.org wrote: On 11 July 2013, at 06:09, Fajar A. Nugraha l...@fajar.net wrote: On Thu, Jul 11, 2013 at 7:28 PM, Arran Cudbard-Bell a.cudba...@freeradius.org

Re: Loading fails without reporting an error

2013-07-12 Thread Alan DeKok
Lovaas,Steven wrote: Thanks, Adam... this got me looking at the right thing. I had a mismatch between the type of the home_server localhost (auth), and the attribute used in one of the realms pointing to the pool that references that home server (pool, instead of auth_pool). Changing the

Re: mod_auth_radius w/Apache 2.4.4 ??

2013-07-12 Thread Alan DeKok
laurence.schuler wrote: I'm trying to use mod_auth_radius(-2.0) with apache 2.4.4 and it does not appear to be working properly. It complains: [:warn] [pid 14690] AuthRadiusActive set, but no RADIUS server IP - missing AddRadiusAuth in this context?) When I have AuthRadiusAuth set, and I can

Re: How to best configure Radius for my domain ?

2013-07-12 Thread Alan DeKok
Analyser Great wrote: I am trying to setup a configuration where network admins have access to all devices and users have only access to cisco vpn. I don't wanna use local user database since I already have Ldap to authorize and Kerberos to authenticate. How do you do this in your domain

Re: Loading fails without reporting an error

2013-07-12 Thread Matthew Newton
On Fri, Jul 12, 2013 at 11:19:00AM +0200, Alan DeKok wrote: Lovaas,Steven wrote: Thanks, Adam... this got me looking at the right thing. I had a mismatch between the type of the home_server localhost (auth), and the attribute used in one of the realms pointing to the pool that

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Phil Mayers
On 12/07/13 11:17, Eugene Grosbein wrote: Please help. We need at least 1000 concurrent threads to deal with the load here. 1000 threads is a crazy number. Can you explain why you think you need that many? Are you doing very slow logic/lookups or something? Anyway, the problem is almost

Re: Loading fails without reporting an error

2013-07-12 Thread Matthew Newton
On Fri, Jul 12, 2013 at 11:24:54AM +0100, Matthew Newton wrote: On Fri, Jul 12, 2013 at 11:19:00AM +0200, Alan DeKok wrote: Lovaas,Steven wrote: I had a mismatch between the type of the home_server localhost (auth), and the attribute used in one of the realms pointing to the pool that

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Eugene Grosbein
On 12.07.2013 17:17, Eugene Grosbein wrote: Hi! We have been running FreeRADIUS 2.1.12/dhcp module with success for long time with FreeBSD 8. Our DHCP perl script opens two file descriptors (per thread): one for database connection TCP socket and one for syslog (/var/run/log unix domain

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Eugene Grosbein
On 12.07.2013 17:38, Phil Mayers wrote: On 12/07/13 11:17, Eugene Grosbein wrote: Please help. We need at least 1000 concurrent threads to deal with the load here. 1000 threads is a crazy number. Can you explain why you think you need that many? Are you doing very slow logic/lookups or

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Alan DeKok
Eugene Grosbein wrote: Forgot to mention that operating system's open files limit for freeradius is over 11000. And file descriptors are numbered starting from zero, so descriptor 1024 is really 1025th. radiusd works fine until it has descriptors 0-1023 only and breaks with creation of

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Eugene Grosbein
On 12.07.2013 18:10, Alan DeKok wrote: Eugene Grosbein wrote: Forgot to mention that operating system's open files limit for freeradius is over 11000. And file descriptors are numbered starting from zero, so descriptor 1024 is really 1025th. radiusd works fine until it has descriptors

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Phil Mayers
On 12/07/13 11:55, Eugene Grosbein wrote: On 12.07.2013 17:38, Phil Mayers wrote: On 12/07/13 11:17, Eugene Grosbein wrote: Please help. We need at least 1000 concurrent threads to deal with the load here. 1000 threads is a crazy number. Can you explain why you think you need that many?

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Alan DeKok
Eugene Grosbein wrote: Extra sockets got opened just fine, I see that with lsof/fstat here. OK. But I'm not aware of any change in any code which will limit the number of sockets. 2.1.12 has not this issue with same Perl. OK. The rlm_perl module changed. It added some locks to avoid

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Eugene Grosbein
On 12.07.2013 19:07, Alan DeKok wrote: Eugene Grosbein wrote: Extra sockets got opened just fine, I see that with lsof/fstat here. OK. But I'm not aware of any change in any code which will limit the number of sockets. 2.1.12 has not this issue with same Perl. OK. The rlm_perl

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Eugene Grosbein
On 12.07.2013 18:39, Phil Mayers wrote: Our database is powerful enough to deal with so many requests. We may easily get that many requests and want to be able to process them in parallel without needless queueing. With respect, this is a pretty basic logic. The figure of merit here is

Re: Dynamic vlan assignment with ldap groups

2013-07-12 Thread Arran Cudbard-Bell
On 12 Jul 2013, at 13:57, val john valjohn1...@gmail.com wrote: Hi guys , i have a freeradius setup that works with ldap group authentication ,i also need to configure the dynamic VLAN assignment , so i configured the users file as fallows , DEFAULT Ldap-Group ==

Re: 2.2.0 dhcp: regression

2013-07-12 Thread Eugene Grosbein
On 12.07.2013 19:57, Alan DeKok wrote: Eugene Grosbein wrote: The problem is always reproducible and have obvious hard limit correlating or consisting with number of open files. I'm not sure what changes from 2.1.12 to 2.2.0 would cause that. I understand. With one exception - we have

Re: Dynamic vlan assignment with ldap groups

2013-07-12 Thread val john
Hi guys , Small question , do i need to import radius ldap schema ( items like radiusprofiles ) to our ldap server to get this VLAN assignment work Thank You john On 12 July 2013 18:39, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: On 12 Jul 2013, at 13:57, val john

RE: Loading fails without reporting an error

2013-07-12 Thread Lovaas,Steven
@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, July 12, 2013 3:19 AM To: FreeRadius users mailing list Subject: Re: Loading fails without reporting an error Lovaas,Steven wrote: Thanks, Adam... this got me looking at the right thing. I had a mismatch between the type

Re: 3.0 regex realm syntax

2013-07-12 Thread Alan DeKok
Brian Julin wrote: Would it require too much tokenization witchdoctoring to make: realm /regexp\.edu/ { } ...work? No. We'll wait for 3.0.1, though. Also I find a note in my config file comments about some regexp availability in the hints file being in-transition and so not to use

Re: LDAP authentication filter based on source SSID

2013-07-12 Thread Olivier Beytrison
On 12.07.2013 17:03, Gustavo Vieira Oliveira wrote: I need some help with RADIUS regarding Wireless authentication with RADIUS + LDAP. Hello. which version of freeradius are you running ? I need to check if the user has permission to connect to a specific SSID, so we check a LDAP attribute

Re: LDAP authentication filter based on source SSID

2013-07-12 Thread Gustavo Vieira Oliveira
I forgot to say that we use H-REAP so we do not authenticate it in the WLC Atenciosamente, Gustavo Vieira Oliveira GETIC - Gerência de Tecnologia da Informação SUSERV - Superintendência de Serviços Compartilhados Sistema FIESC Rod. Admar Gonzaga, 2765 - Itacorubi - 88034-001 - Florianópolis -

Re: LDAP authentication filter based on source SSID

2013-07-12 Thread Gustavo Vieira Oliveira
Olivier, You don't need to set radius-server vsa send in the AP so it sends the SSID in the authentication request? Atenciosamente, Gustavo Vieira Oliveira GETIC - Gerência de Tecnologia da Informação SUSERV - Superintendência de Serviços Compartilhados Sistema FIESC Rod. Admar Gonzaga,

Re: LDAP authentication filter based on source SSID

2013-07-12 Thread Alan Buxey
Look at the requests coming from your AP in debug mode. You should see information there that can be used eg called station id with SSID appended or a VSA with the SSID name or number in it. Use that with your policy alan - List info/subscribe/unsubscribe? See

Re: LDAP authentication filter based on source SSID

2013-07-12 Thread Gustavo Vieira Oliveira
We got it working, the AP is sending the SSID with the calling station ID but only setting radius-server vsa send in the Access-point. The problem is that we have to do it manually (the Controller doesn't support it) in the AP, so when it reboots for some reason it cannot authenticate cause

Re: LDAP authentication filter based on source SSID

2013-07-12 Thread Matthew Newton
On Fri, Jul 12, 2013 at 12:48:48PM -0300, Gustavo Vieira Oliveira wrote: The problem is that we have to do it manually (the Controller doesn't support it) in the AP, so when it reboots for some reason it cannot authenticate cause the RADIUS doesn't receive the SSID. So, we need an alternative

Re: Logging Cisco config changes with FreeRadius

2013-07-12 Thread Arran Cudbard-Bell
On 12 Jul 2013, at 23:31, kyle woock kylewo...@gmail.com wrote: Freradius Users, I have installed FreeRadius on CentOS 6.4 in VMWare environment and I am pretty new to using something like FreeRadius. However I have it on my virtual machine and it is running I am able to authenticate

Re: Substring using Unlang?

2013-07-12 Thread Peter Lambrechtsen
On Wed, Jul 10, 2013 at 6:34 PM, Olivier Beytrison oliv...@heliosnet.org wrote: On 10.07.2013 07:48, Olivier Beytrison wrote: if ( ADSL-Agent-Remote-Id =~ /(.{0,31})$/ ) { if ( ADSL-Agent-Remote-Id =~ /(.{1,32})$/ ) { that's even better as it won't match an empty attribute (you never know

Re: Substring using Unlang?

2013-07-12 Thread Arran Cudbard-Bell
On 13 Jul 2013, at 00:14, Peter Lambrechtsen pe...@crypt.co.nz wrote: On Wed, Jul 10, 2013 at 6:34 PM, Olivier Beytrison oliv...@heliosnet.org wrote: On 10.07.2013 07:48, Olivier Beytrison wrote: if ( ADSL-Agent-Remote-Id =~ /(.{0,31})$/ ) { if ( ADSL-Agent-Remote-Id =~ /(.{1,32})$/ ) {

Re: Substring using Unlang?

2013-07-12 Thread Peter Lambrechtsen
for us :) IMHO those sorts of use cases really should be logged in the unlang wiki or have a generic regex examples wiki page as those sorts of problems come up all the time and it would be nice to direct people to one place that has a lot of good re-usable examples. Might go create a page when I have

Re: Dictionary type problem

2013-07-11 Thread Ming-Ching Tiew
From: Muhammad Nadeem mnadeem8...@gmail.com To: FreeRadius users mailing list freeradius-users@lists.freeradius.org Sent: Thursday, July 11, 2013 2:08 PM Subject: Dictionary type problem hi everybody I am adding some new attributes to dictionary.motorola.

Re: Dictionary type problem

2013-07-11 Thread Alan DeKok
Muhammad Nadeem wrote: it clearly indicates that it doesnot support hexadecimal type. Could anyone please tell me , whts the alternative of this. Maybe you can try reading the documentation to learn about the dictionary file format. See man dictionary. Or even read the raddb/dictionary

Re: Dictionary type problem

2013-07-11 Thread Muhammad Nadeem
thnaks ,, it is fixed On Thu, Jul 11, 2013 at 11:59 AM, Alan DeKok al...@deployingradius.comwrote: Muhammad Nadeem wrote: it clearly indicates that it doesnot support hexadecimal type. Could anyone please tell me , whts the alternative of this. Maybe you can try reading the

Re: Loading fails without reporting an error

2013-07-11 Thread Alan DeKok
Lovaas,Steven wrote: Hello again, I've successfully gotten to the point where local authentication is working well for all modes, using multiple SSIDs through two virtual servers, so I felt confident jumping into the less familiar world of proxying. Not that the concept is hard to

Re: freeradius seeing anonymous identity as username

2013-07-11 Thread Phil Mayers
On 11/07/13 09:39, sebastian buettrich wrote: is this expected behaviour, the way anonymous identities are implemented, Yes. The outer EAP virtual server only sees the anonymous identity. The inner EAP virtual server can see the real identity. - List info/subscribe/unsubscribe? See

Re: Indexing multi-valued attrbutes (was RE: 3.0)

2013-07-11 Thread Alan DeKok
Brian Julin wrote: Just to make sure it was understood during the foreach fixup patch I sent on github, I mentioned that indexed attribute accesses were broken. None of var[#] var[2] or var[*] work in xlats, unless that's been fixed recently. That's been fixed. Alan DeKok. - List

Re: Loading fails without reporting an error

2013-07-11 Thread Adam Bishop
On 11 Jul 2013, at 08:40, Alan DeKok al...@deployingradius.com wrote: Lovaas,Steven wrote: Hmm... it looks like there's a problem with the file. It doesn't stop, it *exits*. See doc/bugs. That should help finding out where it's exiting. I think I saw this issue a week or so ago - I've

Re: Changing proxy server for a specific user

2013-07-11 Thread Alan DeKok
Angel L. Mateo wrote: Now I want to create another virtual server using this DEFAULT realm, but proxying requests to another radius server. Realms are global. You cannot have two DEFAULT realms. Is there any way to do this? Maybe modifying some attribute in the request with an

Re: PEAP using different CA?

2013-07-11 Thread Mathieu Simon
Hi Fernando 2013/7/10 Fernando Hammerli fhamme...@puc-rio.br Got it now, as you said. Using the public CA certs on certificate_file (and related private key), and included the public CA chain on the CA_file (together with my own CA). Yep mostly except that I put the private key not inside

Re: [ANN] Version 3.0.0-rc0

2013-07-11 Thread Fajar A. Nugraha
On Thu, Jul 11, 2013 at 7:28 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: We are now in feature freeze for 3.0. The configuration format and behaviour for 3.0 will be stable between now and the final release. If you are planning on deploying 3.0 and have an existing 2.x.x

RE: Loading fails without reporting an error

2013-07-11 Thread Lovaas,Steven
AM To: FreeRadius users mailing list Subject: Re: Loading fails without reporting an error On 11 Jul 2013, at 08:40, Alan DeKok al...@deployingradius.com wrote: Lovaas,Steven wrote: Hmm... it looks like there's a problem with the file. It doesn't stop, it *exits*. See doc/bugs

Re: [ANN] Version 3.0.0-rc0

2013-07-11 Thread Arran Cudbard-Bell
On 11 Jul 2013, at 14:09, Fajar A. Nugraha l...@fajar.net wrote: On Thu, Jul 11, 2013 at 7:28 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: We are now in feature freeze for 3.0. The configuration format and behaviour for 3.0 will be stable between now and the final release. If

RE: [ANN] Version 3.0.0-rc0

2013-07-11 Thread stefan.paetow
Did you mean https://github.com/FreeRADIUS/freeradius- server/archive/release_3_0_0_rc0.tar.gz ? I'm afraid I'm getting a build error (from fresh): HEADER src/include/features.h HEADER src/include/missing.h HEADER src/include/tls.h CC jlibtool.c CC src/lib/dict.c CC src/lib/filters.c CC

Re: [ANN] Version 3.0.0-rc0

2013-07-11 Thread Olivier Beytrison
On 11.07.2013 16:44, stefan.pae...@diamond.ac.uk wrote: Did you mean https://github.com/FreeRADIUS/freeradius- server/archive/release_3_0_0_rc0.tar.gz ? I'm afraid I'm getting a build error (from fresh): [snip] /usr/bin/ld: cannot find -lregex collect2: ld returned 1 exit status make: ***

Re: [ANN] Version 3.0.0-rc0

2013-07-11 Thread Arran Cudbard-Bell
On 11 Jul 2013, at 16:01, Olivier Beytrison oliv...@heliosnet.org wrote: On 11.07.2013 16:44, stefan.pae...@diamond.ac.uk wrote: Did you mean https://github.com/FreeRADIUS/freeradius- server/archive/release_3_0_0_rc0.tar.gz ? I'm afraid I'm getting a build error (from fresh): [snip]

RE: [ANN] Version 3.0.0-rc0

2013-07-11 Thread stefan.paetow
[mailto:freeradius-users- bounces+stefan.paetow=diamond.ac...@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 11 July 2013 16:12 To: FreeRadius users mailing list Subject: Re: [ANN] Version 3.0.0-rc0 On 11 Jul 2013, at 16:01, Olivier Beytrison oliv...@heliosnet.org wrote

Re: [ANN] Version 3.0.0-rc0

2013-07-11 Thread Doug Hardie
On 11 July 2013, at 06:09, Fajar A. Nugraha l...@fajar.net wrote: On Thu, Jul 11, 2013 at 7:28 PM, Arran Cudbard-Bell a.cudba...@freeradius.org wrote: We are now in feature freeze for 3.0. The configuration format and behaviour for 3.0 will be stable between now and the final release.

<    5   6   7   8   9   10   11   12   13   14   >