Re: What kind of error in client-cert using EAP?

I don't know if my chiming in will make a difference or not. But windows can authenticate with a machine certificate or a user certificate If you're doing the machine certificates, please say so, I'm a little confused as to what exactly you are doing now. -Bob Thibault Le Meur wrote:

Re: Radius dies, on certificate verification

Just as a follow up, this has solved my issue. Alan DeKok wrote: Robert Myers [EMAIL PROTECTED] wrote: I got the following when running radiusd -X with openssl .0.9.7c on gentoo, radius 1.1.1-r1 1.1.3 was released a few weeks go. Try it. Alan DeKok. -- http

Radius dies, on certificate verification

I'm wondering if anyone else has seen this. My setup is as follows, Seimens controller doing .1x auth, EAP-TLS Both requests are from different users, and what I have now, is set max_requests_per_server to 300 Doesn't seem to have helped, as radwatch is reporting that another radiusd

Re: Radius dies, on certificate verification

Alan, Thanks, I will do that. Do you think this is just a quirk in 1.1.1? -Bob Alan DeKok wrote: Robert Myers [EMAIL PROTECTED] wrote: I got the following when running radiusd -X with openssl .0.9.7c on gentoo, radius 1.1.1-r1 1.1.3 was released a few weeks go. Try

Re: Regarding VLAN attributes

I realize this is about a month later. But I pass down vlan id with Tunnel-Private-Group-Id = int, where int is the vlan id. I dunno if that'll help you or not. :) -Bob radhika putty wrote: Hi.. When we use VLAN tunneled attributes how do we send the VLAN id value. For ex if i give a

CRL not working....

I'm having some odd troubles here with the check_crl = yes I've added what I think is the appropriate config file directives, I must be missing something. Here is the debug output, any help would be much appreciated -Bob rad_recv: Access-Request packet from host 192.168.2.169:1038, id=37,

Sending Access-Accept for everyone.

Is there a way to send access-accept all of the time? I've tried to do the DEFAULT in username, but that didn't seem to work for me. -Bob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

TNC Compliance

Is FreeRadius TNC compliant? -Bob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: set Tunnel Private Group ID based on OU in certificate?

What I'm doing to set these, is via the rlm_sql module. The tables are pretty straight forward, and could be manipulated programmatically. The sql tables are setup just like the users file, and has group support and all. Maybe when you issue the cert, you could do some inserts into the DB?

Re: set 'Tunnel Private Group ID' based on OU in certificate?

Well, you'd approach it the same way you'd do group authentication in the users file. Check out the users file documentation, then just understand that rlm_sql is just another users file. -Bob Carl Wahlin wrote: What I'm doing to set these, is via the rlm_sql module. The tables are pretty

Re: Client certs with MSCHAPV2 in PEAP

Does this only apply if the supplicant uses a server cert during eap/tls? The reason I ask, is that I'm using a client cert signed by my CA to do eap/tls, and it's working. I have not implemented the server cert as of yet. -Bob Alan DeKok wrote: Dave Huff [EMAIL PROTECTED] wrote: For

Re: Client certs with MSCHAPV2 in PEAP

Looks like that's set in the users file. As the entry for that email says DEFAULT. Dave Huff wrote: I would like to configure this setup using Freeradius. My WinXP client (Intel ProSET) supports this, but FR chokes on it when enabled. I've got PEAP-EAP-MSCHAPV2 working with just

Cisco EAP/TLS not working

I'm having a problem with my Cisco 2950 and EAP/TLS...I've already configured this to work on my HP 5300, so I'd assume that everything on the freeradius end is proper... However I am receiving this from the debug log: rad_recv: Access-Request packet from host 192.168.2.161:1812, id=9,

Re: Machine Authentication

I've not done PEAP yet, but I have done EAP/TLSthere is a good document on the main web page for EAP/TLS and maybe it will shoot you in the right direction. check out the news items from Oct 5, 2004, and 11 May 2004, I've used both and they are extremely helpful. -Bob Gilmour, Scott

Auth from LDAP, then add reply via SQL

I must be missing this in the documentation. If I authenticate via the users file/LDAP/SQL , is there a way to add replies from the radcheck table in sql? -Bob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Auth from LDAP, then add reply via SQL

Sorry, this would be the radreply table, not the radcheck table, as the radcheck is for checking attributes. :) My bad. :) -Bob Robert Myers wrote: I must be missing this in the documentation. If I authenticate via the users file/LDAP/SQL , is there a way to add replies from the radcheck

Re: Auth from LDAP, then add reply via SQL

a user in the 'users' file, as you could just put them in the radcheck table with the appropriate local password I was able to authenticate via EAP, then from the radcheck table, find my user, then from the radreply table get the appropriate attributes. -Bob Robert Myers wrote: I must

Question about Authentication flow.

I'm trying to understand how to send dynamic replies based on user. If I authenticate via LDAP or some other mechanism, I can authorize via the sql tables? Is that right? -Bob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Question about Authentication flow.

So let me ask you this, this allows me to set specific replies for each user. How would I go about setting replies for groups of users, when I don't know the specific usernames? Like if I'd want to assign a specific reply based on an LDAP group? -Bob Alan DeKok wrote: Robert Myers [EMAIL

Re: Question about Authentication flow.

The documentation is how I found out what questions to ask. :) Thanks for the point in the right direction. -Bob Alan DeKok wrote: Robert Myers [EMAIL PROTECTED] wrote: How would I go about setting replies for groups of users, when I don't know the specific usernames? Like if I'd want

Re: Root Certificate via ADS

This is probably really a question for a windows mailing list. :) You can install the root certificates via GPO Under Computer Configuration - Windows Settings - Security Settings - Public Key policies. The problem you're going to run into is configuring the 802.1x client on all 300

Re: EAP/TLS work but with errors

You can also add the following to a file called xpextensions RPM-vmware ssl # cat xpextensions [ xpclient_ext] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 [ xpserver_ext ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 Then when you sign the cert, you add -extfile = xpextensions That should get rid of the

Sending radius attributes....

Is there any way to send back specific radius attributes based on a sql query? So, say I have a user, and then I want to sernd back a specific attribute based on some other information. Is this a case for a custom module? -Bob - List info/subscribe/unsubscribe? See

postgres sql accounting....

Anyone seen this? I'm getting some strange errors from postgres, it's almost as if my queries aren't filled in the whole way. What am I missing? Is my switch just not returning all of the proper accounting info? -Bob --- Walking the entire request list --- Cleaning up request 2 ID 87