<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Well its no univention package, its only from the univention repo.
they dont like other repos in their system.<br>
<br>
Well i started with a fresh installation and made minimal changes. <br>
i put in the ap's in clients.conf, activated and configured ldap and
copied the certs in the correct direction. well i also activated all
the log options for better debugging.<br>
<br>
ill post two more things. the output from start with -X and the
inner-tunnel.<br>
<br>
This is the output when i start with -X:<br>
<br>
<small><small>root@srtcsvo04:/etc/univention/ssl#
/usr/sbin/freeradius -X<br>
FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on
Nov 22 2010 at 14:36:23<br>
Copyright (C) 1999-2008 The FreeRADIUS server project and
contributors. <br>
There is NO warranty; not even for MERCHANTABILITY or FITNESS
FOR A <br>
PARTICULAR PURPOSE. <br>
You may redistribute copies of FreeRADIUS under the terms of the
<br>
GNU General Public License. <br>
Starting - reading configuration files ...<br>
including configuration file /etc/freeradius/radiusd.conf<br>
including configuration file /etc/freeradius/proxy.conf<br>
including configuration file /etc/freeradius/clients.conf<br>
including configuration file /etc/freeradius/snmp.conf<br>
including configuration file /etc/freeradius/eap.conf<br>
including configuration file /etc/freeradius/policy.conf<br>
including files in directory /etc/freeradius/sites-enabled/<br>
including configuration file
/etc/freeradius/sites-enabled/inner-tunnel<br>
including configuration file
/etc/freeradius/sites-enabled/default<br>
including dictionary file /etc/freeradius/dictionary<br>
main {<br>
prefix = "/usr"<br>
localstatedir = "/var"<br>
logdir = "/var/log/freeradius"<br>
libdir = "/usr/lib/freeradius"<br>
radacctdir = "/var/log/freeradius/radacct"<br>
hostname_lookups = no<br>
max_request_time = 30<br>
cleanup_delay = 5<br>
max_requests = 1024<br>
allow_core_dumps = no<br>
pidfile = "/var/run/freeradius/freeradius.pid"<br>
user = "freerad"<br>
group = "freerad"<br>
checkrad = "/usr/sbin/checkrad"<br>
debug_level = 0<br>
proxy_requests = yes<br>
security {<br>
max_attributes = 200<br>
reject_delay = 1<br>
status_server = yes<br>
}<br>
}<br>
client localhost {<br>
ipaddr = 127.0.0.1<br>
require_message_authenticator = no<br>
secret = "***"<br>
nastype = "other"<br>
}<br>
client 10.119.12.1 {<br>
require_message_authenticator = no<br>
secret = "***"<br>
shortname = "aptcsvo01"<br>
nastype = "other"<br>
}<br>
client 10.119.12.2 {<br>
require_message_authenticator = no<br>
secret = "***"<br>
shortname = "aptcsvo02"<br>
nastype = "other"<br>
}<br>
client 10.119.12.3 {<br>
require_message_authenticator = no<br>
secret = "***"<br>
shortname = "aptcsvo03"<br>
nastype = "other"<br>
}<br>
client 10.119.12.4 {<br>
require_message_authenticator = no<br>
secret = "AhVeig1nai"<br>
shortname = "aptcsvo04"<br>
nastype = "other"<br>
}<br>
radiusd: #### Loading Realms and Home Servers ####<br>
proxy server {<br>
retry_delay = 5<br>
retry_count = 3<br>
default_fallback = no<br>
dead_time = 120<br>
wake_all_if_all_dead = no<br>
}<br>
home_server localhost {<br>
ipaddr = 127.0.0.1<br>
port = 1812<br>
type = "auth"<br>
secret = "***"<br>
response_window = 20<br>
max_outstanding = 65536<br>
zombie_period = 40<br>
status_check = "status-server"<br>
ping_check = "none"<br>
ping_interval = 30<br>
check_interval = 30<br>
num_answers_to_alive = 3<br>
num_pings_to_alive = 3<br>
revive_interval = 120<br>
status_check_timeout = 4<br>
}<br>
home_server_pool my_auth_failover {<br>
type = fail-over<br>
home_server = localhost<br>
}<br>
realm example.com {<br>
auth_pool = my_auth_failover<br>
}<br>
realm LOCAL {<br>
}<br>
radiusd: #### Instantiating modules ####<br>
instantiate {<br>
Module: Linked to module rlm_exec<br>
Module: Instantiating exec<br>
exec {<br>
wait = yes<br>
input_pairs = "request"<br>
shell_escape = yes<br>
}<br>
Module: Linked to module rlm_expr<br>
Module: Instantiating expr<br>
Module: Linked to module rlm_expiration<br>
Module: Instantiating expiration<br>
expiration {<br>
reply-message = "Password Has Expired "<br>
}<br>
Module: Linked to module rlm_logintime<br>
Module: Instantiating logintime<br>
logintime {<br>
reply-message = "You are calling outside your allowed
timespan "<br>
minimum-timeout = 60<br>
}<br>
}<br>
radiusd: #### Loading Virtual Servers ####<br>
server inner-tunnel {<br>
modules {<br>
Module: Checking authenticate {...} for more modules to load<br>
Module: Linked to module rlm_pap<br>
Module: Instantiating pap<br>
pap {<br>
encryption_scheme = "auto"<br>
auto_header = no<br>
}<br>
Module: Linked to module rlm_chap<br>
Module: Instantiating chap<br>
Module: Linked to module rlm_mschap<br>
Module: Instantiating mschap<br>
mschap {<br>
use_mppe = yes<br>
require_encryption = no<br>
require_strong = no<br>
with_ntdomain_hack = no<br>
}<br>
Module: Linked to module rlm_pam<br>
Module: Instantiating pam<br>
pam {<br>
pam_auth = "radiusd"<br>
}<br>
Module: Linked to module rlm_unix<br>
Module: Instantiating unix<br>
unix {<br>
radwtmp = "/var/log/freeradius/radwtmp"<br>
}<br>
Module: Linked to module rlm_ldap<br>
Module: Instantiating ldap<br>
ldap {<br>
server = "localhost"<br>
port = 389<br>
password = "pPWSrf5"<br>
identity = "cn=admin,dc=tcsvo,dc=local"<br>
net_timeout = 1<br>
timeout = 4<br>
timelimit = 3<br>
tls_mode = no<br>
start_tls = no<br>
tls_require_cert = "allow"<br>
tls {<br>
start_tls = yes<br>
require_cert = "allow"<br>
}<br>
basedn = "dc=tcsvo,dc=local"<br>
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"<br>
base_filter = "(objectclass=radiusprofile)"<br>
password_attribute = "sambaLmPassword,sambaNtPassword"<br>
auto_header = no<br>
access_attr = "uid"<br>
access_attr_used_for_allow = yes<br>
groupname_attribute = "cn"<br>
groupmembership_filter =
"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"<br>
dictionary_mapping = "/etc/freeradius/ldap.attrmap"<br>
ldap_debug = 0<br>
ldap_connections_number = 5<br>
compare_check_items = no<br>
do_xlat = yes<br>
edir_account_policy_check = no<br>
set_auth_type = yes<br>
}<br>
rlm_ldap: Registering ldap_groupcmp for Ldap-Group<br>
rlm_ldap: Registering ldap_xlat with xlat_name ldap<br>
rlm_ldap: reading ldap<->radius mappings from file
/etc/freeradius/ldap.attrmap<br>
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$<br>
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$<br>
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type<br>
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS
Simultaneous-Use<br>
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS
Called-Station-Id<br>
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS
Calling-Station-Id<br>
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password<br>
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password<br>
rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password<br>
rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password<br>
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT<br>
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration<br>
rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS
NAS-IP-Address<br>
rlm_ldap: LDAP userPassword mapped to RADIUS Cleartext-Password<br>
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type<br>
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS
Framed-Protocol<br>
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS
Framed-IP-Address<br>
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS
Framed-IP-Netmask<br>
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route<br>
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS
Framed-Routing<br>
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id<br>
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU<br>
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS
Framed-Compression<br>
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host<br>
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service<br>
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS
Login-TCP-Port<br>
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS
Callback-Number<br>
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id<br>
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS
Framed-IPX-Network<br>
rlm_ldap: LDAP radiusClass mapped to RADIUS Class<br>
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS
Session-Timeout<br>
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout<br>
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS
Termination-Action<br>
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS
Login-LAT-Service<br>
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS
Login-LAT-Node<br>
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS
Login-LAT-Group<br>
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS
Framed-AppleTalk-Link<br>
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS
Framed-AppleTalk-Network<br>
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS
Framed-AppleTalk-Zone<br>
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit<br>
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS
Login-LAT-Port<br>
rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message<br>
conns: 0x18a2540<br>
Module: Linked to module rlm_eap<br>
Module: Instantiating eap<br>
eap {<br>
default_eap_type = "md5"<br>
timer_expire = 60<br>
ignore_unknown_eap_types = no<br>
cisco_accounting_username_bug = no<br>
}<br>
Module: Linked to sub-module rlm_eap_md5<br>
Module: Instantiating eap-md5<br>
Module: Linked to sub-module rlm_eap_leap<br>
Module: Instantiating eap-leap<br>
Module: Linked to sub-module rlm_eap_gtc<br>
Module: Instantiating eap-gtc<br>
gtc {<br>
challenge = "Password: "<br>
auth_type = "PAP"<br>
}<br>
Module: Linked to sub-module rlm_eap_tls<br>
Module: Instantiating eap-tls<br>
tls {<br>
rsa_key_exchange = no<br>
dh_key_exchange = yes<br>
rsa_key_length = 512<br>
dh_key_length = 512<br>
verify_depth = 0<br>
pem_file_type = yes<br>
private_key_file = "/etc/freeradius/certs/private.key"<br>
certificate_file = "/etc/freeradius/certs/cert.pem"<br>
CA_file = "/etc/freeradius/certs/CAcert.pem"<br>
private_key_password = "whatever"<br>
dh_file = "/etc/freeradius/certs/dh"<br>
random_file = "/etc/freeradius/certs/random"<br>
fragment_size = 1024<br>
include_length = yes<br>
check_crl = no<br>
cipher_list = "DEFAULT"<br>
make_cert_command = "/etc/freeradius/certs/bootstrap"<br>
}<br>
Module: Linked to sub-module rlm_eap_ttls<br>
Module: Instantiating eap-ttls<br>
ttls {<br>
default_eap_type = "md5"<br>
copy_request_to_tunnel = no<br>
use_tunneled_reply = no<br>
virtual_server = "inner-tunnel"<br>
}<br>
Module: Linked to sub-module rlm_eap_peap<br>
Module: Instantiating eap-peap<br>
peap {<br>
default_eap_type = "mschapv2"<br>
copy_request_to_tunnel = no<br>
use_tunneled_reply = no<br>
proxy_tunneled_request_as_eap = yes<br>
virtual_server = "inner-tunnel"<br>
}<br>
Module: Linked to sub-module rlm_eap_mschapv2<br>
Module: Instantiating eap-mschapv2<br>
mschapv2 {<br>
with_ntdomain_hack = no<br>
}<br>
Module: Checking authorize {...} for more modules to load<br>
Module: Linked to module rlm_realm<br>
Module: Instantiating suffix<br>
realm suffix {<br>
format = "suffix"<br>
delimiter = "@"<br>
ignore_default = no<br>
ignore_null = no<br>
}<br>
Module: Linked to module rlm_files<br>
Module: Instantiating files<br>
files {<br>
usersfile = "/etc/freeradius/users"<br>
acctusersfile = "/etc/freeradius/acct_users"<br>
preproxy_usersfile = "/etc/freeradius/preproxy_users"<br>
compat = "no"<br>
}<br>
Module: Checking session {...} for more modules to load<br>
Module: Linked to module rlm_radutmp<br>
Module: Instantiating radutmp<br>
radutmp {<br>
filename = "/var/log/freeradius/radutmp"<br>
username = "%{User-Name}"<br>
case_sensitive = yes<br>
check_with_nas = yes<br>
perm = 384<br>
callerid = yes<br>
}<br>
Module: Checking post-proxy {...} for more modules to load<br>
Module: Checking post-auth {...} for more modules to load<br>
Module: Linked to module rlm_attr_filter<br>
Module: Instantiating attr_filter.access_reject<br>
attr_filter attr_filter.access_reject {<br>
attrsfile = "/etc/freeradius/attrs.access_reject"<br>
key = "%{User-Name}"<br>
}<br>
}<br>
}<br>
server {<br>
modules {<br>
Module: Checking authenticate {...} for more modules to load<br>
Module: Checking authorize {...} for more modules to load<br>
Module: Linked to module rlm_preprocess<br>
Module: Instantiating preprocess<br>
preprocess {<br>
huntgroups = "/etc/freeradius/huntgroups"<br>
hints = "/etc/freeradius/hints"<br>
with_ascend_hack = no<br>
ascend_channels_per_line = 23<br>
with_ntdomain_hack = no<br>
with_specialix_jetstream_hack = no<br>
with_cisco_vsa_hack = no<br>
with_alvarion_vsa_hack = no<br>
}<br>
Module: Checking preacct {...} for more modules to load<br>
Module: Linked to module rlm_acct_unique<br>
Module: Instantiating acct_unique<br>
acct_unique {<br>
key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port"<br>
}<br>
Module: Checking accounting {...} for more modules to load<br>
Module: Linked to module rlm_detail<br>
Module: Instantiating detail<br>
detail {<br>
detailfile =
"/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"<br>
header = "%t"<br>
detailperm = 384<br>
dirperm = 493<br>
locking = no<br>
log_packet_header = no<br>
}<br>
Module: Instantiating attr_filter.accounting_response<br>
attr_filter attr_filter.accounting_response {<br>
attrsfile = "/etc/freeradius/attrs.accounting_response"<br>
key = "%{User-Name}"<br>
}<br>
Module: Checking session {...} for more modules to load<br>
Module: Checking post-proxy {...} for more modules to load<br>
Module: Checking post-auth {...} for more modules to load<br>
}<br>
}<br>
radiusd: #### Opening IP addresses and Ports ####<br>
listen {<br>
type = "auth"<br>
ipaddr = *<br>
port = 0<br>
}<br>
listen {<br>
type = "acct"<br>
ipaddr = *<br>
port = 0<br>
}<br>
main {<br>
snmp = no<br>
smux_password = ""<br>
snmp_write_access = no<br>
}<br>
Listening on authentication address * port 1812<br>
Listening on accounting address * port 1813<br>
Listening on proxy address * port 1814<br>
Ready to process requests.</small></small><br>
<br>
and here is the inner-tunnel:<br>
<br>
<small><small>root@srtcsvo04:/etc/univention/ssl# cat
/etc/freeradius/sites-enabled/inner-tunnel <br>
# -*- text -*-<br>
######################################################################<br>
#<br>
# This is a virtual server that handles *only* inner tunnel<br>
# requests for EAP-TTLS and PEAP types.<br>
#<br>
# $Id: inner-tunnel,v 1.6 2008/03/29 21:33:12 aland Exp $<br>
#<br>
######################################################################<br>
<br>
server inner-tunnel {<br>
<br>
#<br>
# Un-comment the next section to perform test on the inner
tunnel<br>
# without needing an outer tunnel session. The tests will not
be<br>
# exactly the same as when TTLS or PEAP are used, but they will<br>
# be close enough for many tests.<br>
#<br>
#listen {<br>
# ipaddr = 127.0.0.1<br>
# port = 18120<br>
# type = auth<br>
#}<br>
<br>
<br>
# Authorization. First preprocess (hints and huntgroups files),<br>
# then realms, and finally look in the "users" file.<br>
#<br>
# The order of the realm modules will determine the order that<br>
# we try to find a matching realm.<br>
#<br>
# Make *sure* that 'preprocess' comes before any realm if you <br>
# need to setup hints for the remote radius server<br>
authorize {<br>
#<br>
# The chap module will set 'Auth-Type := CHAP' if we are<br>
# handling a CHAP request and Auth-Type has not already
been set<br>
chap<br>
<br>
#<br>
# If the users are logging in with an MS-CHAP-Challenge<br>
# attribute for authentication, the mschap module will find<br>
# the MS-CHAP-Challenge attribute, and add 'Auth-Type :=
MS-CHAP'<br>
# to the request, which will cause the server to then use<br>
# the mschap module for authentication.<br>
mschap<br>
<br>
#<br>
# Pull crypt'd passwords from /etc/passwd or /etc/shadow,<br>
# using the system API's to get the password. If you want<br>
# to read /etc/passwd or /etc/shadow directly, see the<br>
# passwd module, above.<br>
#<br>
unix<br>
<br>
#<br>
# Look for IPASS style 'realm/', and if not found, look for<br>
# '@realm', and decide whether or not to proxy, based on<br>
# that.<br>
# IPASS<br>
<br>
#<br>
# If you are using multiple kinds of realms, you probably<br>
# want to set "ignore_null = yes" for all of them.<br>
# Otherwise, when the first style of realm doesn't match,<br>
# the other styles won't be checked.<br>
#<br>
# Note that proxying the inner tunnel authentication means<br>
# that the user MAY use one identity in the outer session<br>
# (e.g. "anonymous", and a different one here<br>
# (e.g. <a class="moz-txt-link-rfc2396E" href="mailto:user@example.com">"user@example.com"</a>). The inner session will then
be<br>
# proxied elsewhere for authentication. If you are not<br>
# careful, this means that the user can cause you to
forward<br>
# the authentication to another RADIUS server, and have the<br>
# accounting logs *not* sent to the other server. This
makes<br>
# it difficult to bill people for their network activity.<br>
#<br>
suffix<br>
# ntdomain<br>
<br>
#<br>
# The "suffix" module takes care of stripping the domain<br>
# (e.g. "@example.com") from the User-Name attribute, and
the<br>
# next few lines ensure that the request is not proxied.<br>
#<br>
# If you want the inner tunnel request to be proxied,
delete<br>
# the next few lines.<br>
#<br>
update control {<br>
Proxy-To-Realm := LOCAL<br>
}<br>
<br>
#<br>
# This module takes care of EAP-MSCHAPv2 authentication.<br>
#<br>
# It also sets the EAP-Type attribute in the request<br>
# attribute list to the EAP type from the packet.<br>
#<br>
# The example below uses module failover to avoid querying
all<br>
# of the following modules if the EAP module returns "ok".<br>
# Therefore, your LDAP and/or SQL servers will not be
queried<br>
# for the many packets that go back and forth to set up
TTLS<br>
# or PEAP. The load on those servers will therefore be
reduced.<br>
#<br>
eap {<br>
ok = return<br>
}<br>
<br>
#<br>
# Read the 'users' file<br>
files<br>
<br>
#<br>
# Look in an SQL database. The schema of the database<br>
# is meant to mirror the "users" file.<br>
#<br>
# See "Authorization Queries" in sql.conf<br>
# sql<br>
<br>
#<br>
# If you are using /etc/smbpasswd, and are also doing<br>
# mschap authentication, the un-comment this line, and<br>
# configure the 'etc_smbpasswd' module, above.<br>
# etc_smbpasswd<br>
<br>
#<br>
# The ldap module will set Auth-Type to LDAP if it has not<br>
# already been set<br>
ldap<br>
<br>
#<br>
# Enforce daily limits on time spent logged in.<br>
# daily<br>
<br>
#<br>
# Use the checkval module<br>
# checkval<br>
<br>
expiration<br>
logintime<br>
<br>
#<br>
# If no other module has claimed responsibility for<br>
# authentication, then try to use PAP. This allows the<br>
# other modules listed above to add a "known good" password<br>
# to the request, and to do nothing else. The PAP module<br>
# will then see that password, and use it to do PAP<br>
# authentication.<br>
#<br>
# This module should be listed last, so that the other
modules<br>
# get a chance to set Auth-Type for themselves.<br>
#<br>
pap<br>
}<br>
<br>
<br>
# Authentication.<br>
#<br>
#<br>
# This section lists which modules are available for
authentication.<br>
# Note that it does NOT mean 'try each module in order'. It
means<br>
# that a module from the 'authorize' section adds a
configuration<br>
# attribute 'Auth-Type := FOO'. That authentication type is
then<br>
# used to pick the apropriate module from the list below.<br>
#<br>
<br>
# In general, you SHOULD NOT set the Auth-Type attribute. The
server<br>
# will figure it out on its own, and will do the right thing.
The<br>
# most common side effect of erroneously setting the Auth-Type<br>
# attribute is that one authentication method will work, but
the<br>
# others will not.<br>
#<br>
# The common reasons to set the Auth-Type attribute by hand<br>
# is to either forcibly reject the user, or forcibly accept
him.<br>
#<br>
authenticate {<br>
#<br>
# PAP authentication, when a back-end database listed<br>
# in the 'authorize' section supplies a password. The<br>
# password can be clear-text, or encrypted.<br>
Auth-Type PAP {<br>
pap<br>
}<br>
<br>
#<br>
# Most people want CHAP authentication<br>
# A back-end database listed in the 'authorize' section<br>
# MUST supply a CLEAR TEXT password. Encrypted passwords<br>
# won't work.<br>
Auth-Type CHAP {<br>
chap<br>
}<br>
<br>
#<br>
# MSCHAP authentication.<br>
Auth-Type MS-CHAP {<br>
mschap<br>
}<br>
<br>
#<br>
# Pluggable Authentication Modules.<br>
pam<br>
<br>
#<br>
# See 'man getpwent' for information on how the 'unix'<br>
# module checks the users password. Note that packets<br>
# containing CHAP-Password attributes CANNOT be
authenticated<br>
# against /etc/passwd! See the FAQ for details.<br>
# <br>
unix<br>
<br>
# Uncomment it if you want to use ldap for authentication<br>
#<br>
# Note that this means "check plain-text password against<br>
# the ldap database", which means that EAP won't work,<br>
# as it does not supply a plain-text password.<br>
Auth-Type LDAP {<br>
ldap<br>
}<br>
<br>
#<br>
# Allow EAP authentication.<br>
eap<br>
}<br>
<br>
######################################################################<br>
#<br>
# There are no accounting requests inside of EAP-TTLS or PEAP<br>
# tunnels.<br>
#<br>
######################################################################<br>
<br>
<br>
# Session database, used for checking Simultaneous-Use. Either
the radutmp <br>
# or rlm_sql module can handle this.<br>
# The rlm_sql module is *much* faster<br>
session {<br>
radutmp<br>
<br>
#<br>
# See "Simultaneous Use Checking Queries" in sql.conf<br>
# sql<br>
}<br>
<br>
<br>
# Post-Authentication<br>
# Once we KNOW that the user has been authenticated, there are<br>
# additional steps we can take.<br>
post-auth {<br>
# Note that we do NOT assign IP addresses here.<br>
# If you try to assign IP addresses for EAP authentication
types,<br>
# it WILL NOT WORK. You MUST use DHCP.<br>
<br>
#<br>
# If you want to have a log of authentication replies,<br>
# un-comment the following line, and the 'detail reply_log'<br>
# section, above.<br>
# reply_log<br>
<br>
#<br>
# After authenticating the user, do another SQL query.<br>
#<br>
# See "Authentication Logging Queries" in sql.conf<br>
# sql<br>
<br>
#<br>
# Instead of sending the query to the SQL server,<br>
# write it into a log file.<br>
#<br>
# sql_log<br>
<br>
#<br>
# Un-comment the following if you have set<br>
# 'edir_account_policy_check = yes' in the ldap module
sub-section of<br>
# the 'modules' section.<br>
#<br>
ldap<br>
<br>
#<br>
# Access-Reject packets are sent through the REJECT
sub-section of the<br>
# post-auth section.<br>
#<br>
# Add the ldap module name (or instance) if you have set <br>
# 'edir_account_policy_check = yes' in the ldap module
configuration<br>
#<br>
Post-Auth-Type REJECT {<br>
attr_filter.access_reject<br>
}<br>
<br>
#<br>
# The example policy below updates the outer tunnel reply<br>
# (usually Access-Accept) with the User-Name from the inner<br>
# tunnel User-Name. Since this section is processed in the<br>
# context of the inner tunnel, "request" here means "inner<br>
# tunnel request", and "outer.reply" means "outer tunnel<br>
# reply attributes".<br>
#<br>
# This example is most useful when the outer session
contains<br>
# a User-Name of <a class="moz-txt-link-rfc2396E" href="mailto:anonymous@....">"anonymous@...."</a>, or a MAC address. If it<br>
# is enabled, the NAS SHOULD use the inner tunnel User-Name<br>
# in subsequent accounting packets. This makes it easier
to<br>
# track user sessions, as they will all be based on the
real<br>
# name, and not on "anonymous".<br>
#<br>
# The problem with doing this is that it ALSO exposes the<br>
# real user name to any intermediate proxies. People use<br>
# "anonymous" identifiers outside of the tunnel for a very<br>
# good reason: it gives them more privacy. Setting the
reply<br>
# to contain the real user name removes ALL privacy from<br>
# their session.<br>
#<br>
# If you want privacy to remain, see the<br>
# Chargeable-User-Identity attribute from RFC 4372. In
order<br>
# to use that attribute, you will have to allocate a<br>
# per-session identifier for the user, and store it in a<br>
# long-term database (e.g. SQL). You should also use that<br>
# attribute INSTEAD of the configuration below.<br>
#<br>
#update outer.reply {<br>
# User-Name = "%{request:User-Name}"<br>
#}<br>
<br>
}<br>
<br>
#<br>
# When the server decides to proxy a request to a home server,<br>
# the proxied request is first passed through the pre-proxy<br>
# stage. This stage can re-write the request, or decide to<br>
# cancel the proxy.<br>
#<br>
# Only a few modules currently have this method.<br>
#<br>
pre-proxy {<br>
# attr_rewrite<br>
<br>
# Uncomment the following line if you want to change
attributes<br>
# as defined in the preproxy_users file.<br>
# files<br>
<br>
# Uncomment the following line if you want to filter
requests<br>
# sent to remote servers based on the rules defined in the<br>
# 'attrs.pre-proxy' file.<br>
# attr_filter.pre-proxy<br>
<br>
# If you want to have a log of packets proxied to a home<br>
# server, un-comment the following line, and the<br>
# 'detail pre_proxy_log' section, above.<br>
# pre_proxy_log<br>
}<br>
<br>
#<br>
# When the server receives a reply to a request it proxied<br>
# to a home server, the request may be massaged here, in the<br>
# post-proxy stage.<br>
#<br>
post-proxy {<br>
<br>
# If you want to have a log of replies from a home server,<br>
# un-comment the following line, and the 'detail
post_proxy_log'<br>
# section, above.<br>
# post_proxy_log<br>
<br>
# attr_rewrite<br>
<br>
# Uncomment the following line if you want to filter
replies from<br>
# remote proxies based on the rules defined in the 'attrs'
file.<br>
# attr_filter.post-proxy<br>
<br>
#<br>
# If you are proxying LEAP, you MUST configure the EAP<br>
# module, and you MUST list it here, in the post-proxy<br>
# stage.<br>
#<br>
# You MUST also use the 'nostrip' option in the 'realm'<br>
# configuration. Otherwise, the User-Name attribute<br>
# in the proxied request will not match the user name<br>
# hidden inside of the EAP packet, and the end server will<br>
# reject the EAP request.<br>
#<br>
eap<br>
<br>
#<br>
# If the server tries to proxy a request and fails, then
the<br>
# request is processed through the modules in this section.<br>
#<br>
# The main use of this section is to permit robust proxying<br>
# of accounting packets. The server can be configured to<br>
# proxy accounting packets as part of normal processing.<br>
# Then, if the home server goes down, accounting packets
can<br>
# be logged to a local "detail" file, for processing with<br>
# radrelay. When the home server comes back up, radrelay<br>
# will read the detail file, and send the packets to the<br>
# home server.<br>
#<br>
# With this configuration, the server always responds to<br>
# Accounting-Requests from the NAS, but only writes<br>
# accounting packets to disk if the home server is down.<br>
#<br>
# Post-Proxy-Type Fail {<br>
# detail<br>
# }<br>
<br>
}<br>
<br>
} # inner-tunnel server block</small></small><br>
<br>
Thanks for your help.<br>
<br>
<br>
<br>
Am 09/11/2012 09:27 AM, schrieb Fajar A. Nugraha:
<blockquote
cite="mid:CAG1y0sdqn3t7SndgtTwbv27Z06Ui19oSXLWqmcoFDOUO6gx_xQ@mail.gmail.com"
type="cite">
<pre wrap="">On Tue, Sep 11, 2012 at 2:13 PM, Mihajlo Joksimovic
<a class="moz-txt-link-rfc2396E" href="mailto:mihajlo.joksimovic@adfinis-sygroup.ch"><mihajlo.joksimovic@adfinis-sygroup.ch></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">well i cannot update the installation because its an univention
installation.
</pre>
</blockquote>
<pre wrap="">
Then ask them for help.
</pre>
<blockquote type="cite">
<pre wrap="">
i activated the sections in inner-tunnel like that.
</pre>
</blockquote>
<pre wrap="">
(sigh)
had you provided full debug log, we'd be able to see whether or not FR
REALLY picks up the inner tunnel. But you didn't provide that.
</pre>
<blockquote type="cite">
<pre wrap="">and radlogin will
connect properly to ldap. when someone wants to connect via access
point, it is not possible...
authorize {
...
#
# The ldap module will set Auth-Type to LDAP if it has not
# already been set
ldap
...
}
</pre>
</blockquote>
<pre wrap="">
your debug log contradicts your statement. Either you did not have it
in inner tunnel, or your default virtual server is broken so that it
DOESN'T use inner tunnel.
</pre>
<blockquote type="cite">
<pre wrap="">authenticate {
...
# Uncomment it if you want to use ldap for authentication
#
# Note that this means "check plain-text password against
# the ldap database", which means that EAP won't work,
# as it does not supply a plain-text password.
Auth-Type LDAP {
ldap
}
</pre>
</blockquote>
<pre wrap="">
If you store passwords as plain text, you won't need that.
If you REALLY want to solve your problem, then listen to the
suggestions. If you can't upgrade your current server, then at least
setup a NEW server for testing purposes. Do what Phil suggests: Start
with a default config. Make small changes. Check each successful
config into version control.
That way you can know where the problem is. If it's a bug in
univention package version or config file, then ask them. The default
FR setup should work with minimal changes.
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Adfinis SyGroup AG
Mihajlo Joksimovic, System Engineer
Güterstrasse 86 | CH-4053 Basel
Tel. 061 333 80 33</pre>
</body>
</html>