Re: VSA extension

2009-11-02 Thread Peter Lambrechtsen
On Tue, Nov 3, 2009 at 12:42 PM, Larry Ross wrote: > Hello All; > > I am trying to add a new vendor to the dictionary directory. I created the > file in /usr/local/share/freeradius/dictionary.procera contents below. The > vendor in question provided their Vendor ID > Did you also add the incl

VSA extension

2009-11-02 Thread Larry Ross
Hello All; I am trying to add a new vendor to the dictionary directory. I created the file in /usr/local/share/freeradius/dictionary.procera contents below. The vendor in question provided their Vendor ID # -*- text -*- #

RE: Dynamic VLANing and anonymous identity on re-auth?

2009-11-02 Thread Palmer J.D.F.
> if you are doing the authorise in the main virtual server after the > inner-tunnel has done its business, then you must copy the User-Name > to an internal attribute that can be used in the post-auth section > (for example) Does the inner-tunnel get called on a re-auth? As said the only time I

Re: Multiple servers

2009-11-02 Thread Ivan Kalik
> I recently spotted that freeradius 2.0 can do multiple instances in one > go. I have two raddb directories that works for each server at the > moment is there easy way to make them instances on the same server? > I looked at the example configuration files but I did not find any > server clauses

Re: Re: EAP session matching the State variable

2009-11-02 Thread marco perugini
thank a lot for your feedback alan! marco Alan DeKok ha scritto: marco perugini wrote: is there a way to restart eap session? is there some script to run to have EAP restarted from scratch? Your supplicant needs to re-start the EAP session. This is a question for y

Multiple servers

2009-11-02 Thread Paul Ryszka
Hello, I recently spotted that freeradius 2.0 can do multiple instances in one go. I have two raddb directories that works for each server at the moment is there easy way to make them instances on the same server? I looked at the example configuration files but I did not find any server clauses o

Logging Error Messages in SQL

2009-11-02 Thread Jeff Fern
All, We are running Freeradius 2.1.7, some of our clients aren't properly configured, and we sometimes see errors like this in /var/log/radius.log: Mon Nov 2 16:23:04 2009 : Error: TLS Alert read:fatal:unknown CA Mon Nov 2 16:23:04 2009 : Error: TLS_accept:failed in SSLv3 read client certif

Client Certificates

2009-11-02 Thread Paul Ryszka
Hello, Do I need separate certificate for each client or can I use one cert for all clients ? Is there easy way to generate bunch of them using supplied scripts ? Regards Paul - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: EAP session matching the State variable

2009-11-02 Thread Alan DeKok
marco perugini wrote: > is there a way to restart eap session? is there some script to run to > have EAP > restarted from scratch? Your supplicant needs to re-start the EAP session. This is a question for your local OS vendor. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.fre

Re: Dynamic VLANing and anonymous identity on re-auth?

2009-11-02 Thread Alan Buxey
Hi, > Hi all, > > Is it possible to use anonymous outer identities with dynamic VLANing? > > We have a problem with reauths when using anonymous outers, the initial > login is fine and the VLAN is assigned using sql.authorize, but re-auths > only seem to use the outer identity and hence no VLAN i

Dynamic VLANing and anonymous identity on re-auth?

2009-11-02 Thread Palmer J.D.F.
Hi all, Is it possible to use anonymous outer identities with dynamic VLANing? We have a problem with reauths when using anonymous outers, the initial login is fine and the VLAN is assigned using sql.authorize, but re-auths only seem to use the outer identity and hence no VLAN information is sent

Re: 802.1x Strange active directory with MSCHAP issue

2009-11-02 Thread sea you
Hi, I read the FAQ earlier, and I regenerate the certificates based on the readme (altough the xpextensions was there as far as i know), however the solution was what Ivan suggested that I should downgrade to samba 3.0. Now im a happy freeradius user, thanks guys, now trying to do ldap group looku

Re: Send Reject When User Logged In Already

2009-11-02 Thread boyali kus
Yes this is exactly what I want. Thank you Ivan! > If you don't want checkrad.pl to check with NAS (ie only look in the > radacct table) set nastype as other in clints.conf. > > Ivan Kalik > Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Send Reject When User Logged In Already

2009-11-02 Thread Ivan Kalik
> Here is the debug output: > > .. > ++[mschap] returns ok > +- entering group session {...} > [sql] expand: %{User-Name} -> usertr2048 > [sql] sql_set_user escaped user --> 'usertr2048' > [sql] expand: SELECT COUNT(*) FROM > radacct

Re: Send Reject When User Logged In Already

2009-11-02 Thread boyali kus
Hello Again, Here is the debug output: .. ++[mschap] returns ok +- entering group session {...} [sql] expand: %{User-Name} -> usertr2048 [sql] sql_set_user escaped user --> 'usertr2048' [sql] expand: SELECT COUNT(*) FROM radacct WH

Re: checking user connect time

2009-11-02 Thread Ivan Kalik
> Can you let me know where can we check the time for which a particular > user is connected, basically this is required so that we can advice the > customer if his ISDN line is connected for too long. SELECT (now() - AcctStartTime) FROM radacct WHERE UserName='some_user' AND AcctStopTime IS NULL

Re: Re: EAP session matching the State variable

2009-11-02 Thread marco perugini
Alan DeKok ha scritto: marco perugini wrote: hi list, i use freeradius [v 2.1.1] in wimax context and from yesterday this message is driving me crazy: "EAP session matching the State variable". That's "NO eap session matching..." here's the use-case: i do a