Re: AP> FR> LDAP authentication reject

2012-12-27 Thread Olivier Beytrison
On 28.12.2012 08:39, Thanakorn Rattanatikul wrote: > In LDAP server , for user "sun" , store password in clear-text in this test So if you have a clear-text password in the ldap, use the ldap attribute-map to add it in the control list. Looking at the logs I guess you are running version 2.x, then

RE: AP> FR> LDAP authentication reject

2012-12-27 Thread Thanakorn Rattanatikul
In LDAP server , for user "sun" , store password in clear-text in this test. Thank you very much for your time and help. thanakorn - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: AP> FR> LDAP authentication reject

2012-12-27 Thread Olivier Beytrison
On 28.12.2012 06:17, Thanakorn Rattanatikul wrote: > I'm trying to setup the server to authenticate using LDAP. I'm having > some problem and hope to get some help from the list. > > I'm trying to setup AP->FR->LDAP. FreeRadius is new installation on > CentOS. LDAP is Sun Java System Directory Ser

Re: 802.1x computer authentication config issue/question

2012-12-27 Thread spartan1833
@Phil, Thank you very much for the code snippet - only had to make minor mods for it to work perfectly ("noop" instead of "notfound" in the reject code within the sites-enabled routine). Also I had to do an $INCLUDE in the users file that points to the tls_clients file otherwise I get unpredic

Re: 802.1x computer authentication config issue/question

2012-12-27 Thread spartan1833
@Phil, Thanks for the example - I'll do some work with it. Appreciate the additional information too...I imagine that there is a huge amount of variation within FR configurations so I get it that requests for assistance need to be as concise as possibledon't always know "exactly" what to a

Re: 802.1x computer authentication config issue/question

2012-12-27 Thread Alan DeKok
spartan1...@hushmail.com wrote: > Thanks you for the...quick reply - thought I had spelled out what I > was trying to figure out in fairly clear terms: Yes, but you didn't saw *how* you wanted this done. You needed to do user group checking. OK, FreeRADIUS isn't a database. I asked you a *sp

Re: 802.1x computer authentication config issue/question

2012-12-27 Thread spartan1833
@Phil, Thanks for the info - appreciate the professional responseI'll do some additional research. On Thu, 27 Dec 2012 10:13:43 -0500 "Phil Mayers" wrote: >On 12/27/2012 02:32 PM, spartan1...@hushmail.com wrote: > >> I played around with the users file in FreeRADIUS but it didn't >> seem

Re: Wiki requires email?

2012-12-27 Thread Alan DeKok
Phil Mayers wrote: > I can no longer log into the wiki with my github account - seems the > wiki now requires that I expose an email publicly in my github profile > (something I am not going to do). Is this intentional? What's the > rationale? Too many retards destroying the Wiki. There were

Re: 802.1x computer authentication config issue/question

2012-12-27 Thread Phil Mayers
On 12/27/2012 03:19 PM, spartan1...@hushmail.com wrote: ...but if not then ok I was simply trying to figure out if I was able to control machine-only 802.1x authentication against FreeRADIUS in a manner similar to how "simple" user authentication appears to be done (via the users file). From you

Re: 802.1x computer authentication config issue/question

2012-12-27 Thread Phil Mayers
On 12/27/2012 02:32 PM, spartan1...@hushmail.com wrote: I played around with the users file in FreeRADIUS but it didn't seem to have any effect unless I put a DEFAULT Auth-Type Reject in the file which blocked everyone regardless of what else I had in the users file. I've Googled around a bit bu

Re: 802.1x computer authentication config issue/question

2012-12-27 Thread spartan1833
Hi, Thanks you for the...quick reply - thought I had spelled out what I was trying to figure out in fairly clear terms: > or can guide me in how to do local (to the RADIUS server) > machine policies - I just want to be able to say "laptop1234...", > etc are part of a local group and are autho

Wiki requires email?

2012-12-27 Thread Phil Mayers
I can no longer log into the wiki with my github account - seems the wiki now requires that I expose an email publicly in my github profile (something I am not going to do). Is this intentional? What's the rationale? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.htm

Re: 802.1x computer authentication config issue/question

2012-12-27 Thread Alan DeKok
spartan1...@hushmail.com wrote: > 802.1x appears to be working; any laptop with the certs/config is > able to access the wired and/or wireless network and any laptop > without is denied access. However, in my previous experience with > RADIUS (IAS/NPS in the Windows world), I am able to control

802.1x computer authentication config issue/question

2012-12-27 Thread spartan1833
Hi, First post and new to FreeRadius though have been using RADIUS in the Windows world for many years. I have a small network with a Linux server and a mix of Windows XP and Windows 7 laptops that I am trying to run 802.1x authentication on. I only want to use computer/machine auth (user auth

Re: Question about the behavior of sql.conf

2012-12-27 Thread Phil Mayers
On 12/27/2012 06:00 AM, ichiro tanaka wrote: Hello I'm using freeradius 2.1.12. I'm trying to set up sql.conf. But there is one question. I made a set of 'safe-character' connection config of the sql.conf. However,the safe-character's being used in connection is the last(B) (When I use the A.but

Re: Question about the behavior of sql.conf

2012-12-27 Thread Phil Mayers
On 12/27/2012 06:20 AM, Fajar A. Nugraha wrote: On Thu, Dec 27, 2012 at 1:00 PM, ichiro tanaka wrote: I made a set of 'safe-character' connection config of the sql.conf. However,the safe-character's being used in connection is the last(B) (When I use the A.but B will be used in this case) Do

Re: Fwd: FW:

2012-12-27 Thread Alan DeKok
Arpit Jain wrote: > I am sending an Access-Request packet using radeapclient without > password, Which is allowed. > But server is sending Access-Reject to the request. > > Following are the logs of radeapclient: So... you're trying to debug the server, but looking at what the client is doi

Re:

2012-12-27 Thread Alan DeKok
Arpit Jain wrote: > Hi, > > can we send accounting request using radeapclient ?? No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

[no subject]

2012-12-27 Thread Arpit Jain
Hi, can we send accounting request using radeapclient ?? I am getting the following error: ** ** radeapclient -x 172.168.200.15 acct testing123 User-Name= " testuser " EAP-Code = Response EAP-Id = 210 EAP-Type-I

Fwd: FW:

2012-12-27 Thread Arpit Jain
Hi, I am sending an Access-Request packet using radeapclient without password,** ** I am giving the following attributes in radeapclient: User-Name= "testuser" EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = " testuser " Message-Authenticator = 0x00 ** ** ** **