Re: How to configure RADIUS +LDAP using SASL/Certificate based binding instead of usernames and passwords

2013-04-19 Thread pramod kulkarni
Thanks for the reply. I am new to FreeRadius and doing analysis on how to remove The identity and password attributes of LDAP module in radiusd.config and still be able to authenticate and authorize LDAP users. Is there any other option/configuration to avoid usernames and plain text passwords

Re: How to configure RADIUS +LDAP using SASL/Certificate based binding instead of usernames and passwords

2013-04-19 Thread Olivier Beytrison
? set restrictive permission on the file so that only root and freeradius can read the admin credentials for the ldap server. And do not let people log as root. Everyone do that. It works fine. Is there any other option/configuration to avoid usernames and plain text passwords in the module ldap

Re: Fwd: How to configure RADIUS +LDAP using SASL/Certificate based binding instead of usernames and passwords

2013-04-10 Thread John Dennis
On 04/10/2013 12:03 AM, pramod kulkarni wrote: Thanks John for the reply. can I use EAP-TLS method of authentication with LDAP as backend datastore to check usernames and passwords. It would be like I bind to RADIUS server with EAP-TLS method using certificate and check

Re: How to configure RADIUS +LDAP using SASL/Certificate based binding instead of usernames and passwords

2013-04-10 Thread Arran Cudbard-Bell
There are other ways to establish the trust between radiusd and LDAP beside simple binds which do not involve passwords. All of these use SASL in some form. Unfortunately rlm_ldap does not support them. I know Alan rewrote rlm_ldap recently for the upcoming 3.0 version, I don't know if

Fwd: How to configure RADIUS +LDAP using SASL/Certificate based binding instead of usernames and passwords

2013-04-09 Thread pramod kulkarni
Hi, I am working on RADIUS with LDAP as backend for authenticating users. I configured rlm_ldap on RADIUS server with username and plaintext password and I am able to authenticate RADIUS client using LDAP. But I want to configure RADIUS server with certificates instead of using usernames

Re: Fwd: How to configure RADIUS +LDAP using SASL/Certificate based binding instead of usernames and passwords

2013-04-09 Thread John Dennis
. But I want to configure RADIUS server with certificates instead of using usernames and passwords. Please guide me how to achieve this,is there any help/doc how to configure LDAP SASL bind for RADIUS Server. Waiting for your inputs. Thanks and Regards, You can't with the current rlm_ldap

Re: Fwd: How to configure RADIUS +LDAP using SASL/Certificate based binding instead of usernames and passwords

2013-04-09 Thread pramod kulkarni
Thanks John for the reply. can I use EAP-TLS method of authentication with LDAP as backend datastore to check usernames and passwords. It would be like I bind to RADIUS server with EAP-TLS method using certificate and check usernames and passwords from LDAP server if yes on EAP-TLS can you

Authentications types by usernames

2011-09-29 Thread andreapepa
). Is it possible to deny usernames used by cpe on the 2.4GHz net? Can i force username used on cpe only to pass the EAP auth too? if yes..how? it'a matter of policy.conf? Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentications-types-by-usernames

Re: Authentications types by usernames

2011-09-29 Thread Arran Cudbard-Bell
access to wired lan users ( not supplicant ). Is it possible to deny usernames used by cpe on the 2.4GHz net? Can i force username used on cpe only to pass the EAP auth too? if yes..how? it'a matter of policy.conf? Possibly, can you run the server in debugging mode and paste the output

Re: Authentications types by usernames

2011-09-29 Thread andreapepa
? -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentications-types-by-usernames-tp4852921p4853189.html Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentications types by usernames

2011-09-29 Thread Arran Cudbard-Bell
On 29 Sep 2011, at 15:56, andreapepa wrote: http://freeradius.1045715.n5.nabble.com/file/n4853189/connection5g.log connection5g.log http://freeradius.1045715.n5.nabble.com/file/n4853189/connection24.log connection24.log These are the logs, i cant see anty connect-info attributehave

Re: Authentications types by usernames

2011-09-29 Thread Fajar A. Nugraha
On Thu, Sep 29, 2011 at 8:56 PM, andreapepa andrea.p...@trentinonetwork.it wrote: http://freeradius.1045715.n5.nabble.com/file/n4853189/connection5g.log connection5g.log http://freeradius.1045715.n5.nabble.com/file/n4853189/connection24.log connection24.log These are the logs,  i cant see

Re: Authentications types by usernames

2011-09-29 Thread Arran Cudbard-Bell
On 29 Sep 2011, at 16:19, Fajar A. Nugraha wrote: On Thu, Sep 29, 2011 at 8:56 PM, andreapepa andrea.p...@trentinonetwork.it wrote: http://freeradius.1045715.n5.nabble.com/file/n4853189/connection5g.log connection5g.log http://freeradius.1045715.n5.nabble.com/file/n4853189/connection24.log

Re: Authentications types by usernames

2011-09-29 Thread andreapepa
-by-usernames-tp4852921p4853837.html Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentications types by usernames

2011-09-29 Thread andreapepa
Hi Fajar could be... but i cannot control all the types of authentication that can happens to be configured, i'm looking for some default value that cannot be changed by users -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentications-types-by-usernames

Re: Authentications types by usernames

2011-09-29 Thread Arran Cudbard-Bell
On 29 Sep 2011, at 18:23, andreapepa wrote: Yes there two kind of mikrotik nas, one is a cpe to connect users lan by 5GHz wireless bridge and the ohter is a classical access point to give access to wireless clients. I've inserted this at the end of policy section in policy.conf but seems

associating mac addresses with usernames

2011-04-10 Thread Stephen Vigus
Hi all First post to the list ;) I want to use both mac authentication and username authentication. I have both working fine separately from mysql, but I want associate certain mac addresses to certain usernames and have it authenticate with the username. I thought I could use the following

Re: associating mac addresses with usernames

2011-04-10 Thread Alan DeKok
Stephen Vigus wrote: In mysql this query would display the username associated to the mac (eg, user1@realm1), although it seems freeradius does not like this. sigh Post the debug log. Can anyone point me in the right direction so freeradius would think its user1@realm1 authenticating when

Re: associating mac addresses with usernames

2011-04-10 Thread Stephen Vigus
Hi Alan I think I'm probably doing things wrong. I realized the query I'm using is meant to count and allow anything thats not zero... not what I'm after tho. Just to double check, any sql queries I want to use are supposed to go inside sites-available/default under authorize { ? Below are the

Re: associating mac addresses with usernames

2011-04-10 Thread Stephen Vigus
Ah, managed to get it working. Changed things to look like this: if(%{sql:SELECT radusergroup.username FROM authorized_macs LEFT JOIN radusergroup ON ( authorized_macs.username = radusergroup.username ) WHERE authorized_macs.macaddr = '%{User-Name}'}){ update control { Auth-Type :=

Re: TLS authentication works, but does not check usernames against 'users'file.

2010-12-01 Thread Nolan King
It is easier for me to put explicit denies in the users file when authenticating with TLS. By default anyone with a valid cert gets in. See also certificate revocation list Andrew Bovill abov...@gmail.com 11/30/10 7:56 AM Hi, I'm trying to get WPA Enterprise EAP/TLS working with my

RE: TLS authentication works, but does not check usernames against 'users' file.

2010-11-30 Thread John McDonnell
-Original Message- On Behalf Of Andrew Bovill Hi, I'm trying to get WPA Enterprise EAP/TLS working with my wireless router. It appears that the TLS portion of the authentication works (valid certificates give me a working connection) but it does NOT appear to actually be

Re: TLS authentication works, but does not check usernames against 'users' file.

2010-11-30 Thread Andrew Bovill
On 11/30/2010 11:05 AM, John McDonnell wrote: -Original Message- On Behalf Of Andrew Bovill Hi, I'm trying to get WPA Enterprise EAP/TLS working with my wireless router. It appears that the TLS portion of the authentication works (valid certificates give me a working connection)

Re: TLS authentication works, but does not check usernames against 'users' file.

2010-11-30 Thread Phil Mayers
On 30/11/10 16:10, Andrew Bovill wrote: It just seems weird that nearly ALL of the suplicants I've used *require* me to give a username/password (or at least an Identifier + password) in addition to the unlocked certificate. Maybe a better question is: What's the point of the username/pass

Re: TLS authentication works, but does not check usernames against 'users' file.

2010-11-30 Thread Andrew Bovill
On 11/30/2010 11:15 AM, Phil Mayers wrote: On 30/11/10 16:10, Andrew Bovill wrote: It just seems weird that nearly ALL of the suplicants I've used *require* me to give a username/password (or at least an Identifier + password) in addition to the unlocked certificate. Maybe a better question

Re: TLS authentication works, but does not check usernames against 'users' file.

2010-11-30 Thread Phil Mayers
On 30/11/10 16:55, Andrew Bovill wrote: It seemed to me that it wouldn't connect if I left the Identity blank, so that may be what was confusing me. Most supplicants will use the cn=XXX from the cert as the identity, but it really makes sense to ask, because they may not be (often are not)

Re:A special user to matcheon all usernames

2010-01-16 Thread zhongwei feng
usernames .I just want to authorize sussessfully even though the username don't exist.this is for emergency while my database is destoryed,I will let all user pass through without authorizing.please give me the detail steps. thanks. - List info/subscribe/unsubscribe? See http

A special user to matcheon all usernames

2010-01-15 Thread pang_jiacai
Hi,all: I want to kown how to configure a special user to match all usernames .I just want to authorize sussessfully even though the username don't exist.this is for emergency while my database is destoryed,I will let all user pass through without authorizing.please give me the detail

Re: A special user to matcheon all usernames

2010-01-15 Thread Arran Cudbard-Bell
On 15/01/2010 20:31, pang_jiacai wrote: Hi,all: I want to kown how to configure a special user to match all usernames .I just want to authorize sussessfully even though the username don't exist.this is for emergency while my database is destoryed,I will let all user pass through without

Problem sanitising usernames in accounting

2009-10-07 Thread Jonathan Gazeley
I'm seeing a problem with stripping usernames during accounting. Accounting is done on a separate physical server from the authentication (which works fine). Most of our users don't include a domain so their accounting works normally. Some users do send the domain (UOB) and this breaks

Re: Problem sanitising usernames in accounting

2009-10-07 Thread Ivan Kalik
I'm seeing a problem with stripping usernames during accounting. Accounting is done on a separate physical server from the authentication (which works fine). Most of our users don't include a domain so their accounting works normally. Some users do send the domain (UOB) and this breaks

Re: Problem sanitising usernames in accounting

2009-10-07 Thread Jonathan Gazeley
On 10/07/2009 10:44 AM, Ivan Kalik wrote: I'm seeing a problem with stripping usernames during accounting. Accounting is done on a separate physical server from the authentication (which works fine). Most of our users don't include a domain so their accounting works normally. Some users do

Authenticating usernames with spaces using MySQL

2009-05-27 Thread Justin Menga
Hi I have an issue where I authenticate incoming DHCP requests on a broadband aggregation router using the Option 82 Port ID information as the username attribute within the RADIUS authentication request. Unfortunately the Port ID information includes spaces - and this is causing an issue where

Re: Authenticating usernames with spaces using MySQL

2009-05-27 Thread Ivan Kalik
I have an issue where I authenticate incoming DHCP requests on a broadband aggregation router using the Option 82 Port ID information as the username attribute within the RADIUS authentication request. Unfortunately the Port ID information includes spaces - and this is causing an issue

Usernames with spaces

2009-03-21 Thread Joeven Rex Dizon
I'm a relatively new freeradius user so I am not really an expert with it. I have two users in the racheck table: admin and d6 40 1a 98. Both with passwords admin198. Doing this: *radtest admin admin198 localhost 0 testing123* ..returns an Access-Accept packet. But doing this: *radtest d6 40 1a

Re: Usernames with spaces

2009-03-21 Thread tnt
I'm a relatively new freeradius user so I am not really an expert with it. I have two users in the racheck table: admin and d6 40 1a 98. Both with passwords admin198. Doing this: *radtest admin admin198 localhost 0 testing123* ...returns an Access-Accept packet. But doing this: *radtest d6 40

Re: Usernames with spaces

2009-03-21 Thread Alan DeKok
Joeven Rex Dizon wrote: I wonder why the user with spaces in the username is being rejected. Run the server in debugging mode, as suggested in the FAQ, README, INSTALL, man page, and *too* often on this list. I've read somewhere that I need to specify nospace_user. Can I edit that in the

Re: Trouble using % percent sign in usernames with MySQL auth

2008-11-05 Thread tnt
i am running into problems while using usernames which include a percent % sign. The rlm_sql_mysql module apparently translates these into the ascii of =25. So a username which was isp/somebody%somewhere gets translated into isp/somebody=25somewhere. Additionally these users are listed incorrect

Trouble using % percent sign in usernames with MySQL auth

2008-11-04 Thread Jonas Frey
Hello, i am running into problems while using usernames which include a percent % sign. The rlm_sql_mysql module apparently translates these into the ascii of =25. So a username which was isp/somebody%somewhere gets translated into isp/somebody=25somewhere. Additionally these users are listed

Stripped Usernames

2008-10-15 Thread Leander S.
Hi, where can I learn more about stripped usernames?! Thanks, Leander - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Stripped Usernames

2008-10-15 Thread tnt
What else is there to know apart from that you get it when you strip the realm from the username? Ivan Kalik Kalik Informatika ISP Dana 15/10/2008, Leander S. [EMAIL PROTECTED] piše: Hi, where can I learn more about stripped usernames?! Thanks, Leander - List info/subscribe/unsubscribe

Re: Stripped Usernames

2008-10-15 Thread Leander S.
test-system - but a szenario like described above would be very interesting for my new network environment .. so I would like to know what positiv options it might bring to stripp usernames ... and also some about proxying ... Thanks for some new be attention ;) Leander [EMAIL PROTECTED

Re: Stripped Usernames

2008-10-15 Thread tnt
alreadey a running RADIUS SQL test-system - but a szenario like described above would be very interesting for my new network environment .. so I would like to know what positiv options it might bring to stripp usernames ... and also some about proxying ... It works sort of like this: your radius

Spaces inside usernames

2008-10-14 Thread Mark J Elkins
This is on FreeRADIUS Version 1.1.7. I use 'mysql' to authenticate users. I had one customer use a name something like fred @domain.dom - ie - there is a space after 'fred' and before the '@' sign. This was being logged in my 'radacct' table with the space intact. I've since managed to find

striping usernames

2008-10-04 Thread Leander S.
Hi, where can I learn some more about striping usernames? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Fwd: rlm-perl lc usernames

2008-09-27 Thread Charlie B
Thanks Ivan :) I agree its not a perl issue but still something to correct. Organization select naming schemes for their employees and now those that begin with r would be denied access. How can I assist to correct this issue for those cases with /r Thanks This is nothing to do with perl.

Re: Fwd: rlm-perl lc usernames

2008-09-26 Thread Charlie B
Hello Alan, I have upgrade to 2.1.1 however still the same effect with perl to lc the usernames perl_pool: item 0x2043d70 asigned new request. Handled so far: 1 found interpetator at address 0x2043d70 rlm_perl: RAD_REQUEST: NAS-Port-Type = Ethernet rlm_perl: RAD_REQUEST: Service-Type = Framed

Re: Fwd: rlm-perl lc usernames

2008-09-26 Thread tnt
[suffix] No '@' in User-Name = \ aduserr, looking up realm NULL This is nothing to do with perl. There is a bug in handling \r in username. It is seen as carriage return and I can see it in sql queries (converted since it is not a safe character). Try a username that doesn't start with r and

Re: Fwd: rlm-perl lc usernames

2008-09-23 Thread Matthias Witte
On Mon, Sep 22, 2008 at 07:26:24PM +0100, [EMAIL PROTECTED] wrote: Hi, User-Name = \\raduser ^ ha. okay. with just a plain username you are safe, but with this windows case, you are dealing with \r - which is a special character. its

Re: Fwd: rlm-perl lc usernames

2008-09-23 Thread Charlie B
Thanks Alan, I have the git master tar file, do you recommend I do a git diff to try and find the differences or how best to proceed to narrow down the issue. Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Fwd: rlm-perl lc usernames

2008-09-23 Thread Alan DeKok
Charlie B wrote: I have the git master tar file, do you recommend I do a git diff to try and find the differences or how best to proceed to narrow down the issue. Huh? Why would you do a git diff? Please BUILD and RUN the server to see if the recent changes fixed it. Wandering through

Re: Fwd: rlm-perl lc usernames

2008-09-23 Thread Charlie B
Hi Alan, Where can I find tarball for freeradius-server-2.1.1? I'm going the rpm build so I can run the test. I didnt' see it on the ftp site. thx Please BUILD and RUN the server to see if the recent changes fixed it. Wandering through the source code won't help unless you know what

Re: Fwd: rlm-perl lc usernames

2008-09-23 Thread tnt
http://github.com/alandekok/freeradius-server/tree/master Ivan Kalik Kalik Informatika ISP Dana 23/9/2008, Charlie B [EMAIL PROTECTED] piše: Hi Alan, Where can I find tarball for freeradius-server-2.1.1? I'm going the rpm build so I can run the test. I didnt' see it on the ftp site. thx

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread Charlie B
Hello Ivan, How do I get it to spit it out after the change? I can get it prior to: rlm_perl: RAD_REQUEST: NAS-Port-Type = Ethernet rlm_perl: RAD_REQUEST: Service-Type = Framed-User rlm_perl: RAD_REQUEST: Calling-Station-Id = 00-15-C5-02-39-99 rlm_perl: RAD_REQUEST: Called-Station-Id =

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread Charlie B
Hello Alan, I changed the script, as per your indication to return MODULE_UPDATED rather than OK and get the following: rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Calling-Station-Id = 00-15-C5-02-39-99 rlm_perl: Added pair

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread A . L . M . Buxey
Hi, thoughts on where to go from here to get this not to alter the username and just lc it but its not altering (apart from LC'ing it) - as your other post shows. throw the daemon some uppercased username (eg with 'radtest' tool) and check the debugging to see what you see from PERL alan -

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread Charlie B
but its not altering (apart from LC'ing it) - as your other post shows. Hi Alan, it is lc'ing it, however it is also moving the r from the beginning of the username to the end of the username, which is what Im trying to stop - List info/subscribe/unsubscribe? See

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread tnt
Post the full debug for a radtest request with uppercase username. That logging function should go before you work with attributes. debug already logs what comes after. Ivan Kalik Kalik Informatika ISP Dana 22/9/2008, Charlie B [EMAIL PROTECTED] piše: but its not altering (apart from LC'ing

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread A . L . M . Buxey
Hi, Hi Alan, it is lc'ing it, however it is also moving the r from the beginning of the username to the end of the username, which is what Im trying to stop ..and from what you've posted so far, I'd say it isnt moving it. wheres the other upper case tests and debug as per requested? alan -

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread Alan DeKok
Charlie B wrote: Hi Alan, it is lc'ing it, however it is also moving the r from the beginning of the username to the end of the username, which is what Im trying to stop I think it's a bug in the code. Please try the current git tree. See git.freeradius.org for instructions on grabbing a

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread Charlie B
Post the full debug for a radtest request with uppercase username. That logging function should go before you work with attributes. debug already logs what comes after. Hello Ivan, Here is the debug using radtest radtest RadUser [EMAIL PROTECTED] localhost 10 testing123 FreeRADIUS Version

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread Charlie B
Hi Alan, I run the same config (as previous post) which works as you indicated (and Ivan) with radtest however when I use a windows client this is what I get and the rearrangement of the username rad_recv: Access-Request packet from host 10.0.1.9 port 1645, id=203, length=139

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread tnt
Here is the debug using radtest radtest RadUser [EMAIL PROTECTED] localhost 10 testing123 .. rlm_perl: RAD_REQUEST: User-Name = RadUser .. rlm_perl: Added pair User-Name = raduser .. Sending Access-Accept of id 225 to 127.0.0.1 port 38149 Tunnel-Medium-Type:0 = IEEE-802

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread A . L . M . Buxey
Hi, User-Name = \\raduser ^ ha. okay. with just a plain username you are safe, but with this windows case, you are dealing with \r - which is a special character. its getting borked elsewhere. to verify this use another username that cannot be a

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread Charlie B
Hi Alan, Did you want me to compare with git tree for 2.1 or with my current version 2.0.5? thx I think it's a bug in the code. Please try the current git tree. See git.freeradius.org for instructions on grabbing a tar file if you don't have git. Alan DeKok. - List

Re: Fwd: rlm-perl lc usernames

2008-09-22 Thread Alan DeKok
Charlie B wrote: Did you want me to compare with git tree for 2.1 or with my current version 2.0.5? thx Please download the git master branch. The fixes are in that, and not in 2.0.5. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Fwd: rlm-perl lc usernames

2008-09-20 Thread A . L . M . Buxey
Hi, Nobody :( have any tidbits to help me isolate this, obviously its not the perl script but what is altering the username. hmmm, you play with user-name and yet you return MODULE_OK.surely you've played with attributes so *SHOULD* be sending MODULE_UPDATED alan - List

Fwd: rlm-perl lc usernames

2008-09-19 Thread Charlie B
Nobody :( have any tidbits to help me isolate this, obviously its not the perl script but what is altering the username. Thanks -- Forwarded message -- From: Charlie B [EMAIL PROTECTED] Date: Thu, Sep 18, 2008 at 10:52 AM Subject: rlm-perl lc usernames To: freeradius-users

Re: Fwd: rlm-perl lc usernames

2008-09-19 Thread tnt
me isolate this, obviously its not the perl script but what is altering the username. Thanks -- Forwarded message -- From: Charlie B [EMAIL PROTECTED] Date: Thu, Sep 18, 2008 at 10:52 AM Subject: rlm-perl lc usernames To: freeradius-users@lists.freeradius.org Hello, Anyone can

rlm-perl lc usernames

2008-09-18 Thread Charlie B
Hello, Anyone can help me with this perl script (at bottom) which seem to be causing more than a simple lc, it seems to move the first character to the end... rlm_perl: Added pair User-Name = *\\raduser rlm_perl: Added pair EAP-Message = 0x02020011014e494e545c52616455736572 rlm_perl: Added

ldap lower case usernames

2008-03-03 Thread Joe Vieira
Hi, So, i am using ldap groups to handle my authorization, for wireless (peap) and the uid field in openldap is not case sensitive (caseignorematch) on the other hand memberUID (for the groups) is (caseExactIA5Match). so wicked sucky right? how can i get the user-name lower cased for

Re: ldap lower case usernames

2008-03-03 Thread Alan DeKok
Joe Vieira wrote: So, i am using ldap groups to handle my authorization, for wireless (peap) and the uid field in openldap is not case sensitive (caseignorematch) on the other hand memberUID (for the groups) is (caseExactIA5Match). so wicked sucky right? how can i get the user-name

Re: Acct-Authentic changing usernames

2008-02-15 Thread Phil Mayers
Phil Mayers wrote: We're bringing a Cisco (formerly Airespace) lightweight wireless system online, and I'm seeing some odd things in the accounting. Specifically, the usernames can change in the accounting packets. This causes the default SQL queries (at least, the ones for Postgres under

Re: Acct-Authentic changing usernames

2008-02-14 Thread Alan DeKok
Phil Mayers wrote: We're bringing a Cisco (formerly Airespace) lightweight wireless system online, and I'm seeing some odd things in the accounting. Specifically, the usernames can change in the accounting packets. The NAS is broken. Some NASes do helpful things like snoop traffic

Acct-Authentic changing usernames

2008-02-13 Thread Phil Mayers
We're bringing a Cisco (formerly Airespace) lightweight wireless system online, and I'm seeing some odd things in the accounting. Specifically, the usernames can change in the accounting packets. This causes the default SQL queries (at least, the ones for Postgres under 1.1.7) to generate

Re: Acct-Authentic changing usernames

2008-02-13 Thread Arran Cudbard-Bell
Phil Mayers wrote: We're bringing a Cisco (formerly Airespace) lightweight wireless system online, and I'm seeing some odd things in the accounting. Specifically, the usernames can change in the accounting packets. This causes the default SQL queries (at least, the ones for Postgres under

Re: Quirky question about rewriting usernames

2007-07-19 Thread Pshem Kowalczyk
Hi On 19/07/07, Cliff Cole [EMAIL PROTECTED] wrote: Hello all. Here is my issue. This is very weird and would only affect one NAS. I'm not sure freeradius is capable of this. I want a username that comes in to check for an @domainname. If the domainname is there I want it to be stripped

Re: Quirky question about rewriting usernames

2007-07-19 Thread Cliff Cole
Thanks for the reply. I'm new to free radius and have been overwhelmed with documentation the past few days. Let me explain in some logic and maybe I can make some sense as to what I'm trying to do. User authentication comes from NAS A IF the username does not have @domain.com and NAS = NAS A

Re: Quirky question about rewriting usernames

2007-07-19 Thread Cliff Cole
Once again. I am backwards on my wording, I am so sorry. This should be correct. IF the username does have @domain.com and NAS = NAS A THEN continue with username as is IF the username does not have @domain.com and NAS = NAS A THEN append the @domain.com I have been trying the hints file.

Re: Quirky question about rewriting usernames

2007-07-19 Thread tnt
Use regular expressions: http://wiki.freeradius.org/Operators Check for @ or that it doesn't end with @domain.com or whatever you fancy. Ivan Kalik Kalik Informatika ISP Dana 19/7/2007, Cliff Cole [EMAIL PROTECTED] piše: Once again. I am backwards on my wording, I am so sorry. This should

Quirky question about rewriting usernames

2007-07-18 Thread Cliff Cole
Hello all. Here is my issue. This is very weird and would only affect one NAS. I'm not sure freeradius is capable of this. I want a username that comes in to check for an @domainname. If the domainname is there I want it to be stripped and added back later. If the domainname is not there I'd

Non-ascii usernames

2007-04-25 Thread Alexander V. Klepikov
Hello, All! How do I make FreeRadius work correct with non-ascii usernames? With best regards, Alexander V. Klepikov. E-mail: [EMAIL PROTECTED] - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Non-ascii usernames

2007-04-25 Thread Alan DeKok
Alexander V. Klepikov wrote: How do I make FreeRadius work correct with non-ascii usernames? You type them in as UTF-8. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http

Re: Non-ascii usernames

2007-04-25 Thread Alexander V. Klepikov
Hello, Alan! You wrote on Wed, 25 Apr 2007 08:38:09 +0200: AD Alexander V. Klepikov wrote: How do I make FreeRadius work correct with non-ascii usernames? AD You type them in as UTF-8. This means that my NASes clients should send them in UTF-8, am I right? With best regards, Alexander V

Re: Non-ascii usernames

2007-04-25 Thread Alan DeKok
Alexander V. Klepikov wrote: This means that my NASes clients should send them in UTF-8, am I right? The NAS just sends whatever the user types into their computer. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog -

Re: Non-ascii usernames

2007-04-25 Thread Alexander V. Klepikov
Hello, Alan! You wrote on Wed, 25 Apr 2007 09:48:28 +0200: This means that my NASes clients should send them in UTF-8, am I right? AD The NAS just sends whatever the user types into their computer. I got it. Thank you! With best regards, Alexander V. Klepikov. E-mail: [EMAIL PROTECTED]

Re: Removing characters from usernames

2007-02-01 Thread Andrew Zirkel
I was thinking I could do something like this with a regular expression: User-Name =~ tr/-//d but I'm not sure where to do it and if it will work. I'm using a mysql back end so I was thinking in the sql.conf file. Has anyone done something like this before? Thanks, Andy On Jan 31, 2007, at

Re: Removing characters from usernames

2007-02-01 Thread Markus Krause
I am doing this using the attr_rewrite module in radiusd.conf, i have the following section: modules { attr_rewrite macaddress_rewrite { attribute = User-Name searchin = packet searchfor = - replacewith =

Re: Removing characters from usernames

2007-02-01 Thread Andrew Zirkel
Thanks that did the trick for User-Name and User-Password after I put what I renamed the name macaddress_rewrite to in the authorization section. Andy Zirkel On Feb 1, 2007, at 12:53 PM, Markus Krause wrote: I am doing this using the attr_rewrite module in radiusd.conf, i have the

Removing characters from usernames

2007-01-31 Thread Andrew Zirkel
Is there a way to parse the input of a username and password before it is passed to the back end database? I'm doing mac address authentication and some devices are passing the mac address with dashes, where I need to have no separation between the octets. I basically need to strip out

Blank usernames

2006-11-19 Thread Marat Rysbekov
Good day, everyone. I'm trying to setup FreeRadius 1.1.3 to assing IP-addresses based on what NAS the authorization request came from, no matter what username or password was supplied. Some of my configuration: huntgroups ... Alpha NAS-IP-Address == 192.168.10.1 Beta

Re: Blank usernames

2006-11-19 Thread Alan DeKok
Marat Rysbekov wrote: I specify the IP-pools in radiusd.conf, and it works fine, except for one thing: I get no Access-Accept reply whenever the username is left blank (any non-empty username is accepted by the server). And radiusd -X says...? So, my question: is there a way to make

Re: rewriting usernames

2006-11-17 Thread Christopher Carver
Quoting Christopher Carver [EMAIL PROTECTED]: Quoting Michael Mitchell [EMAIL PROTECTED]: Hi Chris, Christopher Carver wrote: Thanks for the reply, Kevin. You got me on the right track, but I still don't quite have it right. It seems as though the users file can only

Re: rewriting usernames

2006-11-16 Thread Christopher Carver
Quoting Kevin Bonner [EMAIL PROTECTED]: On Monday 13 November 2006 22:24, Christopher Carver wrote: Hello, How do I rewrite the value of the User-Name attribute based on Called-Station-Id? I need to do a series of these logical decisions and replace the username with

Re: rewriting usernames

2006-11-16 Thread Michael Mitchell
Hi Chris, Christopher Carver wrote: Thanks for the reply, Kevin. You got me on the right track, but I still don't quite have it right. It seems as though the users file can only manipulate Kevin's solution uses the hints file, not the users file. You'll need to enable the preprocess

Re: rewriting usernames

2006-11-16 Thread Kevin Bonner
On Thursday 16 November 2006 04:56, Christopher Carver wrote: Quoting Kevin Bonner [EMAIL PROTECTED]: Not a crazy question at all. We used a hints file entry like: ... It seems as though the users file can only manipulate reply A/V pairs. Correct. The hints file can manipulate the request

Re: rewriting usernames

2006-11-16 Thread Christopher Carver
Quoting Michael Mitchell [EMAIL PROTECTED]: Hi Chris, Christopher Carver wrote: Thanks for the reply, Kevin. You got me on the right track, but I still don't quite have it right. It seems as though the users file can only manipulate Kevin's solution uses the hints file, not the

Re: rewriting usernames

2006-11-14 Thread Michael Mitchell
Christopher Carver wrote: Hello, How do I rewrite the value of the User-Name attribute based on Called-Station-Id? I need to do a series of these logical decisions and replace the username with username@some-isp.com based on what the value of Called-Station-Id is. hmm that is a tricky one!

Re: rewriting usernames

2006-11-14 Thread Kevin Bonner
On Monday 13 November 2006 22:24, Christopher Carver wrote: Hello, How do I rewrite the value of the User-Name attribute based on Called-Station-Id? I need to do a series of these logical decisions and replace the username with username@some-isp.com based on what the value of

rewriting usernames

2006-11-13 Thread Christopher Carver
Hello, How do I rewrite the value of the User-Name attribute based on Called-Station-Id? I need to do a series of these logical decisions and replace the username with username@some-isp.com based on what the value of Called-Station-Id is. rlm_attr_rewrite seems the obvious choice, but I can't

  1   2   >