Robust Authentication Proxying

2009-07-09 Thread Philip Molter
Hi, I'm trying to setup a robust RADIUS authentication proxy. All this radius will do is proxy all auth requests to a set of four backend RADIUS handlers. I have a 2.1.6 server that I've configured with four home_server entries and one home_server_pool that load-balances across the four

Re: How to control a wpa_supplicant client request can only send to a hostapd NAS?

2009-07-09 Thread DJ HENRY
2009/7/9 Ivan Kalik > > If the network only has the NAS1 device, the CLIENT1 can pass the > > authentication. When the network have two NAS device, which one is > NAS1 > > and the other is NAS2, the CLIENT1 request can send to NAS1 and NAS2, > > then NAS1 and NAS2 all send the request

AW: Ips dont get assigned using sqlippool

2009-07-09 Thread Zemke, Kai
I created the table with the statements that come with the freeradius installation (ippool.sql) and I'm using the standard querries from ippool.conf. I continued to search the mailinglist and discovered an earlyer post where there was described a similiar problem. Concerning to this post i change

Re: EAP+PEAP SQL + MAC AUTH?

2009-07-09 Thread Ivan Kalik
> Hello guys! I was hoping you could help me with something its been > troubling me the last two days. Im using a freeradius to authtenticate > users on a WPA-Enterprise enviroment. What i would like to do now is to > add another layer of security matching the MAC address of the user as well > the

Re: Ips dont get assigned using sqlippool

2009-07-09 Thread Ivan Kalik
> Thu Jul 9 14:44:08 2009 : Debug: rlm_sql_mysql: MYSQL check_error: 1064 > received > Thu Jul 9 14:44:08 2009 : Error: sqlippool_command: database query error > in: 'UPDATE radippool SET nasipaddress = '', pool_key = 0, > callingstationid = '', username = '', expiry_time IS NULL WHERE > ex

Re: Error when multiple basedn are configured

2009-07-09 Thread Ivan Kalik
> I configured a freeradius server and this did work well with one basedn. > Now > I want to define multiple basedn. I modified the configuration as > described > in the documentation found on the web > When i start freeradius i get the following error message > > /etc/raddb/radiusd.conf[1915]: Lin

Re: Error when multiple basedn are configured

2009-07-09 Thread Alan DeKok
RamonL wrote: > I configured a freeradius server and this did work well with one basedn. Now > I want to define multiple basedn. I modified the configuration as described > in the documentation found on the web > When i start freeradius i get the following error message > > /etc/raddb/radiusd.conf

Error when multiple basedn are configured

2009-07-09 Thread RamonL
Hello NG I configured a freeradius server and this did work well with one basedn. Now I want to define multiple basedn. I modified the configuration as described in the documentation found on the web When i start freeradius i get the following error message /etc/raddb/radiusd.conf[1915]: Line is

Re: Alvarion BreezeMax BTS - Service provisioning?

2009-07-09 Thread Alan DeKok
Ben Wiechman wrote: >> At this point, it's difficult to recommend Alvarion for anything. >> Even ignoring the interop issues, they've made it clear that they're not >> interested in supporting the customers who purchased their equipment. > > Oh they'll support it... it's called turn-key professi

RE: Alvarion BreezeMax BTS - Service provisioning?

2009-07-09 Thread Ben Wiechman
> > At this point, it's difficult to recommend Alvarion for anything. > Even ignoring the interop issues, they've made it clear that they're not > interested in supporting the customers who purchased their equipment. Oh they'll support it... it's called turn-key professional services. :) Ben

RE: Alvarion BreezeMax BTS - Service provisioning?

2009-07-09 Thread Ben Wiechman
Not that I am aware of. All we've been getting out of the BTS is start and end time. There may be a way to enable additional support. No interim updates either, and I don't believe that is supported in the current version of the 16e firmware either. All you really get out of the accounting is reg

RE: Alvarion BreezeMax BTS - Service provisioning?

2009-07-09 Thread Ben Wiechman
Yes, it is the Filter-Id attribute. Sample reply: rad_recv: Access-Accept packet from host x.x.x.x:1812, id=23, length=79 Filter-Id = "n=BE_Bus_1024Kbps:v=<>:h=OFF:a=:c=OFF" Session-Timeout = 65535 Termination-Action = RADIUS-Request Although for greater security we shou

Re: Ips dont get assigned using sqlippool

2009-07-09 Thread Alan DeKok
Zemke, Kai wrote: > Thu Jul 9 14:44:08 2009 : Debug: rlm_sql_mysql: MYSQL check_error: 1064 > received That's a MySQL error. Are you using the standard queries? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

EAP+PEAP SQL + MAC AUTH?

2009-07-09 Thread Son Gus
Hello guys! I was hoping you could help me with something its been troubling me the last two days. Im using a freeradius to authtenticate users on a WPA-Enterprise enviroment. What i would like to do now is to add another layer of security matching the MAC address of the user as well the user+pa

Ips dont get assigned using sqlippool

2009-07-09 Thread Zemke, Kai
Hi, im currently configuring and testing mysqlipool for freeradius. I followed the instructions from the freeradius wiki nad have my radius server running. Im Running the server with the "-X" Option and whenever a user is connecting I get the following output: Thu Jul 9 14:44:08 2009 : Info: [

Re: Freeradius-Users Digest, Vol 51, Issue 30

2009-07-09 Thread gayathri reddy
Hi Kalik, Thanks for your help... Now i can send two Qos profiles and it's working fine. Thanks, Gayathri On Wed, Jul 8, 2009 at 3:30 PM, < freeradius-users-requ...@lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to >freeradius-users@lists.freeradius.org >

Re: FreeRadius 2.1.6 + EAP-PEAP issue

2009-07-09 Thread A . L . M . Buxey
Hi, > That entry alters User-Name and shouldn't be used with EAP. It works fine > with plain mschap but not here. > > Enable ntdomain in inner-tunnel virtual server (just under suffix) and > create a local domain in proxy.conf: > > realm csd-notebook { > } i think his issue was that REALM could

Re: FreeRadius 2.1.6 + EAP-PEAP issue

2009-07-09 Thread Ivan Kalik
> > Hi, > > I've configured modules/preprocess with > > with_ntdomain_hack = yes > > and tried again to authenticate Vista user but got as follows: > ... > [eap] Identity does not match User-Name, setting from EAP Identity. That entry alters User-Name and shouldn't be used with EAP. It works fine

Re: FreeRadius 2.1.6 + EAP-PEAP issue

2009-07-09 Thread Anatoly Oreshkin
Hi, I've configured modules/preprocess with with_ntdomain_hack = yes and tried again to authenticate Vista user but got as follows: rad_recv: Access-Request packet from host 192.168.14.240 port 3882, id=0, length=235 Message-A

Re: How to control a wpa_supplicant client request can only send to a hostapd NAS?

2009-07-09 Thread Ivan Kalik
> If the network only has the NAS1 device, the CLIENT1 can pass the > authentication. When the network have two NAS device, which one is NAS1 > and the other is NAS2, the CLIENT1 request can send to NAS1 and NAS2, > then NAS1 and NAS2 all send the request to radius. I don't know > whethe

Re: Alvarion BreezeMax BTS - Service provisioning?

2009-07-09 Thread Alan DeKok
Ben Wiechman wrote: > It's really their ASN-GW that deviates... a bit... from the standard. And > the fact that they have a strange attitude toward IOT. We asked and were > essentially told that the FR team would have to come crawling to Tel Aviv on > their bellies and beg for the chance to be forc

Re: Session-Timeout in Access-Challenge (that contains EAP-Message)

2009-07-09 Thread Nicolas Goutte
Am 08.07.2009 um 20:05 schrieb Gong Cheng: Hi Alan, thanks for the answer. (and thanks to David too). I can't seem to find 2.1.7 yet, but I will keep this in mind. I suppose that with 2.1.7, the stable version in GIT is meant, see: http://git.freeradius.org/ Have a nice day! Just as an

Re: Certificate-based client side authentication towards a website with freeradius

2009-07-09 Thread Martin Schneider
Helllo Jay > The Internet Draft address what you described in web client/Apache > server and mail client and mail server applications. The TLS-EAp > extension is leveraging existing user credential and profile in AAA > server. In addition, you have flexibility to choose different > authentication