July 2005 - Freeradius-Users - lists.freeradius.org

Re: Multiple Root Contexts
by jp＠joshmp.com 20 Jul '05

20 Jul '05

Great, that worked. Thanks. Quoting Mearl Danner <jmdanner(a)samford.edu>: > > Might try downloading this and reading. It's very helpful. > > http://www.novell.com/documentation/edir_radius/pdfdoc/radadmin/radadmin.pdf > > > If that's 3 separate "o=" at the root of the tree, the this from the above > document. > > > Example for Creating Multiple Instances of LDAP Module > > If you want multiple search bases, you can create multiple LDAP modules, by > using the following > syntax in the module section of the radiusd.conf. > > modules { > ........... > ........... > ldap ldap1 { > attribute = value > attribute = value > ............... > ............... > } > ldap ldap2 { > attribute = value > attribute = value > ............... > ............... > } > ldap ldap3 { > attribute = value > attribute = value > ............... > ............... > } > } > > You can use the configured modules in authorize, authenticate and > post-authenticate sections by > specifying the module name and instance name. For example: > > authorize{ > ..... > ..... > ldap ldap1 > ldap ldap2 > ..... > ..... > }

1 0

Re: No communication between FreeRadius and Chilli
by sean 20 Jul '05

20 Jul '05

Hi, I have Chilli configured to run on Linksys WRT54G AP. I can access the Radius server at radius.chillispot.org with no problems. I have configured FreeRadius to run on a server also running Apache and MySQL.The FreeRadius installation compiled and runs with no errors and Radtest works fine, allowing me to authenticate users. The problem is that Chilli can't communicate with my Radius server. Ethereal tells me that the destination is unreachable when replying to the Chilli box. This is part of the Ethereal output:- No. Time Source Destination Protocol Info 540 142.622909 192.168.1.6 82.141.232.132 RADIUS Access Request(1) (id=0, l=195) Frame 540 (237 bytes on wire, 237 bytes captured) Ethernet II, Src: 00:12:17:b7:a1:71, Dst: 00:00:c5:b1:0c:0c Internet Protocol, Src Addr: 192.168.1.6 (192.168.1.6), Dst Addr: 82.141.232.132 (82.141.232.132) User Datagram Protocol, Src Port: 2051 (2051), Dst Port: radius (1812) Radius Protocol No. Time Source Destination Protocol Info 541 142.623743 82.141.232.132 192.168.1.6 ICMP Destination unreachable Frame 541 (70 bytes on wire, 70 bytes captured) Ethernet II, Src: 00:00:c5:b1:0c:0c, Dst: 00:12:17:b7:a1:71 Internet Protocol, Src Addr: 82.141.232.132 (82.141.232.132), Dst Addr: 192.168.1.6 (192.168.1.6) Internet Control Message Protocol The Radius server and the Chilli AP get their IP's from DHCP on a Caymen DSL modem with static IP. The Modem is 82.141.232.132. The Radius server is 192.168.1.2 and the Chilli AP is 192.168.1.6, its internal address is 192.168.10.1. I'd really appreciate any suggestions anyone might have to help me resolve this. Regards Sean

2 1

attribute checking with AD
by Stefan Winter 20 Jul '05

20 Jul '05

Hello, after having almost successfully set-up authorize {} and authenticate {} section to do AD clear-text logins, only a small problem remains: We want to allow access for only a subset of the AD users. These users are distinguished from the others by the following criterion (you don't want to know why): if the AD attribute "Department" begins with the character "7", the user is allowed access, otherwise not. So far I mapped "Department" as a checkItem to one of our Vendor-Specific attributes in ldap.attrmap and _wanted_ to do regexp matching in the users file for that Vendor-Specific attribute after authorize->ldap passed through. DEFAULT Our-Vendor-Specific-Thing =~ [^7].*, Auth-Type := Reject This doesn't work (sorry, no debug output available, not my machine). Now I wonder: is there another possibility to do regexp matching against items that are retrieved from AD or LDAP? Unfortunately just checking the attributes delivered by the NAS is not enough. Greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu tél.: +352 424409-1 http://www.restena.lu fax: +352 422473

2 1

Multiple Appearing of the same Attribute & variables
by Metz, Frederic 20 Jul '05

20 Jul '05

Hi, I have a Radius Packet with one Vendor Specific Attribute coming twice in that packet. Since I am writing the information into Mysql database, I wanted to know how to address the first and the second ? I saw that %{Attribute[index]} should work, but it doesn't. The entry (seen in Debug mode) is empty. I am using Radius 1.0.4. What's wrong with my conf ? Frederic

2 1

Freeradius restart snmp
by Reza Toghraee 20 Jul '05

20 Jul '05

Hello Is there any way to restart freeradius 1.0.4 using SNMP ? Regards Reza

2 1

Multiple Root Contexts
by jp＠joshmp.com 20 Jul '05

20 Jul '05

Here is my setup: FreeBSD 4.11 server with FreeRADIUS 1.0.4 authorizing/authenticating users in an eDirectory Tree on a NetWare 6.5 server. My issue: There are three root contexts in the tree. If I set the basedn to context1, I can successfully authorize/authenticate users in context1, but I need FreeRADIUS to search all three contexts for users, and I can't figure out a way to add all three as a basedn at the same time. Thanks in advance, Josh

1 0

re: Searching Subcontexts in eDir
by jp＠joshmp.com 20 Jul '05

20 Jul '05

Sayantan, It was a password error. Thanks. Josh Quoting Sayantan Bhowmick <sbhowmick(a)novell.com>: > Hi, > If you are getting a reply with ldapsearch then you should be able > to authenticate as that user. One of the possible causes of the -669 > error is an invalid password. So check the password and make sure you > are able to log in as that user. > > -Sayantan

1 0

Nas-Port-Type quesiton
by Jandre Olivier 20 Jul '05

20 Jul '05

Hi guys, I use freeradius with poptop, just a question that im trying to figure out, My radius server sees the NAS-Port-Type as Async whenever a vpn connectio is made, is there anyway to change this to let radius see for example as a "vpn" nas-port-type .Must this port-type come from my vpn server? Thanks J -- Regards Jandre "Some people are alive only because it is illegal to kill them." _____________________________________________________

2 3

Raddb missing
by Sharina Ibrahim 20 Jul '05

20 Jul '05

Hi guys, I just started installing freeradius from the Debian package. I'm quiet confused because after I installed the package, I can't found raddb , does raddb exist only when we install Freeradius from source and not from the debian package? Hopefully you guys can help me as I am quiet new in Debian and Freeradius. Thank you. Sincerely, Sharina

2 1

freeradius as radius and proxy radius server
by marc racal 20 Jul '05

20 Jul '05

hi all, can freeradius work as a radius server and at the same time as a proxy radius server? if this is possible, has anyone found good links/resources on how to set this up? thanks. regards, marc

2 1