Password Policies?

2009-09-13 Thread Justin Steward
Hi guys, Having just come from a meeting, I've not actually had a chance to do any research myself, and hoped to lean on the community a little. A concern was put forward regarding password policies for policies stored in a radius server. Now, policies like "Must be 8 characters" and "must have 2

Re: usename + password + MAC address

2009-09-13 Thread Hilton Guaraldi
Let me ask something about attr_rewrite in order to give the possibility to work with my 6 APs, and to do a rewrite of MAC to EAP-PEAP authentication. Would it be possible to write in radius.conf and default files the following, avoiding many entries in the hints file? Scenario: AP1

Re: rlm_perl still looses tags for tagged attributes even after upgrade to 2.1.6

2009-09-13 Thread Alexandr Kovalenko
Any news on that issue? How can I make any attention from developers to this issue? Thanks in advance! On Wed, Aug 26, 2009 at 2:52 AM, Alexandr Kovalenko wrote: > UP > > On Thu, Aug 20, 2009 at 10:49 AM, Alexandr > Kovalenko wrote: >> Hello, >> >> It has been stated in release notes for FR 2.1.

2.x upgrade guide

2009-09-13 Thread Alan DeKok
John Center wrote: > Hi Alan - BTW, are you going to release your 2.x upgrade guide? -John At this time, it only available via a support contract http://networkradius.com/support/ The reason is simple: I already give a lot away for free. I'm writing the book (it will be done real s

Re: need help for adding VSA dictionary in Freeradius 2.1.6

2009-09-13 Thread Alan DeKok
Salim Engin wrote: > 1- From its customer documentation; > > General > Vendor ID 637 is used for 7302 ISAM. > The vendor specific attribute type has a length of two bytes long where > the highest > byte is the project ID and the lowest byte is the project specific > attribute ID. > The project ID

Re: FreeRadius is 3 time quicker when running in full debug mode?( -X?option)

2009-09-13 Thread Alan DeKok
Mathieu Agopian wrote: > It is indeed what we've experienced with our tests: a simple "echo > 'Auth-Type := Accept'" would take up to 100ms (more) than a "return 3" > in perl or in python. Well... I'm not sure what to say about that. Try using valgrind to profile memory usage. > that does inde

Re: usename + password + MAC address

2009-09-13 Thread Hilton Guaraldi
Ok, it works, but a new problem emerged I have 6 AP´s. One of them send the MAC in the following format: 00-18-E7-41-AD-C2. The others send 0018e741adc2... Here the letters are in lowercase and if changed to uppercase the authentication fails from 5 AP´s. What must I do in radcheck table to wo

Re: Pre-release of 2.1.7

2009-09-13 Thread Alan DeKok
Thor Spruyt wrote: > Just wondering... i have an empty users file, and i use rlm_sql only to fetch > the Cleartext-Password in the authorize section, like this: > SELECT 1,username,'Cleartext-Password',password,':=' FROM account WHERE > username='thor' > > I then get this message in the debuggi

Re: Using unlang for Calling-Station-Id

2009-09-13 Thread Kanwar Ranbir Sandhu
On Sat, 2009-09-12 at 23:28 +0100, Alexander Clouter wrote: > In my system, I use the following to RFCese the incoming > Calling-Station-ID: > > if ( "%{request:Calling-Station-Id}" =~ > /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i > ) { >

Re: MAC/IP/Identity correlation through AAA and DHCP

2009-09-13 Thread Alexander Clouter
Alan DeKok wrote: > > Alexander Clouter wrote: > >> I *strongly* recommend you do not mix user and host authentication into >> one which looks like what you are slipping into doing. Computers can >> have multiple users (think of a UNIX box SSHed into), they might have an >> administrative enti

Re: MAC/IP/Identity correlation through AAA and DHCP

2009-09-13 Thread Alexander Clouter
Ben Jencks wrote: > > On Sep 12, 2009, at 18:21, Alexander Clouter wrote: > >> Ben Jencks wrote: >>> >> I *strongly* recommend you do not mix user and host authentication >> into one which looks like what you are slipping into doing. >> Computers can have multiple users (think of a UNIX box S

Re: MAC/IP/Identity correlation through AAA and DHCP

2009-09-13 Thread Alan DeKok
Alexander Clouter wrote: > I *strongly* recommend you do not mix user and host authentication into > one which looks like what you are slipping into doing. Computers can > have multiple users (think of a UNIX box SSHed into), they might have an > administrative entity which is identifiable by t