April 2007 - Freeradius-Users - lists.freeradius.org

LDAP server per realm
by Sean McNamara 16 Apr '07

16 Apr '07

Hello everyone, I'm working on finding a way to define multiple local realms and have each have a unique ldap profile associated with them. We want one associated with a particular realm, and the other to be the catchall/default case. In addition to this, we're also using EAP/TTLS, which may or not complicate the situation.. After googling a bit, I was under the impression that something along the following lines should work: Here are the relevant parts of the the files I modified: in proxy.conf: realm VLS { type = radius authhost = LOCAL accthost = LOCAL } in dictionary: VALUE Auth-Type VU 1 VALUE Auth-Type VLS 2 VALUE Autz-Type VU 1 VALUE Autz-Type VLS 2 in users: DEFAULT Domain == "VLS", Autz-Type := VLS in radiusd.conf: ldap vlsldap { .... set_auth_type = yes } ldap vuldap { .... set_auth_type = yes } authorize { ... ... Autz-Type VLS { vlsldap } vuldap ... } authenticate { ... Auth-Type VLS { vlsldap } vuldap ... } When I attempt to authenticate, regardless of whether I specify a realm or not, it only checks the vuldap servers. Any suggestions would be greatly appreciated! Thank you.. ..Sean.

2 1

password encoding flavours
by Stefan Winter 16 Apr '07

16 Apr '07

Hi, currently in the process of migrating to 1.1.6 and the User-Password replacements. We used to have several entries, and for some of them I'm not really sure what to do with... if someone could add some clarity to that it would be highly appreciated! User-Password := something => Cleartext-Password := something Crypt-Password := unixcrypt => Crypt-Password := unixcrypt (these are easy) Crypt-Password := $1$somethingveryweird => SMD5-Password := somethingveryweird (stripping the header, and $1$ meands MD5 with 12-character salt, right?) Crypt-Password := $2a$somethingveryweirdandevenlonger => ????-Password := somethingveryweirdandevenlonger (no clue here... read that $2a$ is a Blowfish crypt, but there is no Blowfish-Password attribute, but apparently right now with 1.1.3 it works anyway?) Greetings, Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

RE: Using Client-Ip-Address attribute in preprocess files
by Forrest, Michael E. 16 Apr '07

16 Apr '07

> Nope, Client-IP-Address / Packet-Src-IP-Address don't work as check > items in huntgroups or hints . Well, all I can say is that they Client-IP-Address currently works for me within the huntgroup (haven't tried the hints file). I use it for matching devices and applying policy thereafter from the users file. Am currently on 1.1.5

1 0

3COM switches and freeradius
by Molteni Davide 16 Apr '07

16 Apr '07

Please someone can post a working configuration for a 3COM switch(4500) to authenticate against freeradius? Thanks in advance

1 0

Requesting help with FR + Dynamic vlans
by Jacob Jarick 16 Apr '07

16 Apr '07

Hi, here is the current scenario: * school with wireless access * allready uses radius (soon to be freeradius) * freeradius auth's via a win2k3 Active Directory Server * teachers need to be able to log into WAP's a,b,c etc and be automatically assigned to the teachers vlan * priv students need to be able to log into WAP's a,b,c and be assigned to the priv student vlan * norm students simply need to have network access denied from WAP's a,b,c >From what Ive learnt so far today, I need to configure the radius.conf to retrieve the users group from the ADS and then return auth and map group -> vlan / tunnel ID. If some1 could provide me an example or documentation / howto I should read Id be very thankfull. Also if the scenario wasnt clear enough please say so and I will re explain. Thanks alot FR crew.

2 1

Multiple REALMS, multiple SQL
by Andrea Cerrito 16 Apr '07

16 Apr '07

Hi to this list, I'm using freeradius from few weeks, and now I need a little help to understand how to configure a proxied configuration to do what I need. My situation: [ Proxy Frontend ] -- REALM ABC >> proxied to [ My Radius Server ] | |- REALM DEF >> proxied to [ My Customer Radius ] | |- REALM GHI >> proxied to [ My Customer Radius ] The data about the realm ABC is stored in a database by another server that I manage, so I keep data without problems. The data about the realm DEF/GHI is not stored at all because I'm not managing the final servers. I cannot store data on the proxy frontend by the simple "sql" configuration because I'll start to write a lot of useless and doubled data (the real configuration is more complex then described before). How can I let the proxy write in a db just the realm DEF and GHI and ignore the realm ABC? I think it can be done in the post-proxy section of the radius.conf... But how? Thank you -- Andrea

2 2

Re: The server will carry local authentication first, despite ofproxying or not, is this correct?
by Alan DeKok 16 Apr '07

16 Apr '07

LinHai wrote: >> The server will not perform authentication before proxying. Read the >> debug log you posted to the list. > But in debug log, rlm_sql (sql) , I found 4 sql query has been carried. These sql query should not be performed > for optimizing reason, I think. No. One of the pieces of information that the SQL queries can return is that the request should be proxied. >> The server *will* process the request through some modules before >> proxying. If that is not "supposed" to happen, please explain how the >> server can proxy the request without doing *some* processing of it. > Maybe we can perform a judgement first,if the server should proxy the request,then send it to home server directly. Try to configure the server so that it proxies requests without looking at them, or without running any kind of local policy that says what requests should be proxied, and where they should be proxied to. You will not succeed. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Re: assigning vlan based on NAS and LDAP field?
by jerrrry＠voila.fr 16 Apr '07

16 Apr '07

> Message du 13/04/07 à 11h43 > De : "Kostas Kalevras" > A : mda(a)unb.ca, "FreeRadius users mailing list" > Copie à : > Objet : Re: assigning vlan based on NAS and LDAP field? > > O/H Matt Ashfield έγραψε: > HI all, > > We're using FR authenticating against LDAP to implement our wireless > solution. Basically, we are looking at the LDAP field of record type and > determining if it is a staff or a student, and assigning a vlan based on > that. Pretty simple and it works. However, there are two issues with this: > > 1. We have a sister campus, on a different network, but who are sharing the > same FR and LDAP servers for authentication. Obviously their NAS's are > different than ours because we're in different physical locations and > networks. With our current configuration, it looks like we have to define > the exact same vlans id's and the same vlan eligibility rules (ie staff get > vlan x and student get vlan y) in order for this to work. I guess I'm hoping > there is a way to assign different vlans based on the NAS ip address in > addition to the student/staff distinction. > You can use multiple ldap module instances and set Autz-Type depending on the nas ip address (or better yet huntgroups) > 2. This follows into our future wired side implementation of 802.1x. In this > case, we don't want our staff/student wired users to be assigned to the same > vlans as they would be if they were on wireless. Rather we'd prefer to break > them up based on their NAS or something like that. > > Anyways, I realize this is quite an odd situation, but probably quite > similar to what many EDU people are encountering. Any help/advice is greatly > appreaciated. > > you have to find an attribute in the radius nas request that will différenciate a wifi connection and a wired 802.1x connection: for me it is NAS-Port-Type = Wireless-802.11 for wifi and NAS-Port-Type = ethernet for wired 802.1x depending on this you send a vlan or an other in the radius response. but you still can do it depending on the nas IP Thomas Thanks > > Matt > mda(a)unb.ca > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Re: The server will carry local authentication first, despite ofproxying or not, is this correct?
by LinHai 16 Apr '07

16 Apr '07

Hi, >The server will not perform authentication before proxying. Read the >debug log you posted to the list. But in debug log, rlm_sql (sql) , I found 4 sql query has been carried. These sql query should not be performed for optimizing reason, I think. >The server *will* process the request through some modules before >proxying. If that is not "supposed" to happen, please explain how the >server can proxy the request without doing *some* processing of it. Maybe we can perform a judgement first,if the server should proxy the request,then send it to home server directly. = = = = = = = = = = = = = = = = = = = = 　　　　　　　　致礼！　　　　　　　　LinHai 　　　　　　　　lh(a)mail.tzptt.zj.cn 　　　　　　　　　　2007-04-16

1 0

Re: The server will carry local authentication first, despite of proxying or not, is this correct?
by Alan DeKok 16 Apr '07

16 Apr '07

LinHai wrote: > In radiusd.c, function "int rad_respond(REQUEST *request, RAD_REQUEST_FUNP fun)", I found such problem: > If a AUTHENTICATION_REQUEST or ACCOUNTING_REQUEST packet is received, the server will first carry the operation > (ex. authentication) itself, then send proxy request to home server, despite of proxying or not. The server will not perform authentication before proxying. Read the debug log you posted to the list. The server *will* process the request through some modules before proxying. If that is not "supposed" to happen, please explain how the server can proxy the request without doing *some* processing of it. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0