January 2009 - Freeradius-Users - lists.freeradius.org

Strategy for grouping users for authentication
by Alex French 03 Jan '09

03 Jan '09

Hi, We are using Freeradius 1.1.7 to authenticate a large group of users for one service, with a pgsql backend. I would now like to start using our radius servers to also authenticate other groups of users for specific services, e.g. admin users who can access an apache frontend etc using PAM. My question is, what's the best way to classify and group the users to ensure that group X can access one service but group Y can access another, etc? My first thought is to use an attribute like the NAS-Id to identify the service and require certain user groups for each Nas id in the clients file. However, this does not allow any more granularity than the machine making the request -- for example, login, POP and httpd may all be on the same server but have different groups that should be able to access them. Can anyone point me in the right direction? Thanks, Alex

3 3

Tru64 SIA Compilation Failure
by J Springer 03 Jan '09

03 Jan '09

Tru64 5.1b, Patch kit 6, cc, SIA ./configure; make Is gcc required? make[6]: Entering directory /usr/install/freeradius-server-2.1.3/src/modules/rlm_unix' /usr/install/freeradius-server-2.1.3/libtool --mode=compile cc -g -DNDEBUG -I/usr/install/freeradius-server-2.1.3/src -I/usr/install/freeradius-server-2.1.3/libltdl -c rlm_unix.c mkdir .libs cc -g -DNDEBUG -I/usr/install/freeradius-server-2.1.3/src -I/usr/install/freeradius-server-2.1.3/libltdl -c rlm_unix.c -DPIC -o .libs/rlm_unix.o cc: Error: rlm_unix.c, line 340: In this statement, "name" is not declared. (undeclared) if (sia_ses_init (&ent, 1, info, NULL, name, NULL, 0, NULL) != -----------------------------------------------^ cc: Error: rlm_unix.c, line 343: In this statement, "ret" is not declared. (undeclared) if ((ret = sia_ses_authent (NULL, passwd, ent)) != SIASUCCESS) { -------------^ cc: Error: rlm_unix.c, line 343: In this statement, "passwd" is not declared. (undeclared) if ((ret = sia_ses_authent (NULL, passwd, ent)) != SIASUCCESS) { ------------------------------------------^ make[6]: *** [rlm_unix.lo] Error 1 make[6]: Leaving directory `/usr/install/freeradius-server-2.1.3/src/modules/rlm_unix'

2 1

rlm_sql_oracle and instant client 11.1 rpm install
by Alok Vimawala 03 Jan '09

03 Jan '09

Hello, I spent the last few days fighting to get FreeRadius 2.1.3 installed on a RHEL-5 box with the Oracle Instant Client + SDK rpm install. The Oracle client version is 11.1. Every time, I issued the configure command it would skip over building the rlm_sql_oracle module. I eventually modified the configure.in file in "./src/modules/rlm_sql/ drivers/rlm_sql_oracle/" I went ahead and created a patch for the directory in question, but I am not sure where to submit it to. I tried using the bugs.freeradius.org website, but it was unable to create an account (the system never emailed me with a password). If you folks can direct me to where I can do that, it would be most appreciated. Thanks, Alok ----------------------------------------------------- Alok Vimawala Senior Network Administrator Housing Information Technology Office University of Michigan avimawal(a)umich.edu

3 4

Group Authorization Question
by Mike Diggins 02 Jan '09

02 Jan '09

I have authentication working from my cisco ASA550 VPN appliance to a FreeRadius 2.1.1 server, using NTLM_AUTH for backend authentication. That all works. Now I need to add authorization into the mix. 1. On the Radius server, I want to add a group X with a list of authorized usernames. 2. On the VPN side, the user selects a profile, and logs in, but I only want members of group X to be able to connect to that profile, even if the authentication is correct. I have no idea how to make the connection between the group profile I select on the VPN side, with the group X on the radius side. I'm not even sure how (or where) to create such a group with freeRadius. Can anyone point me in the right direction? -Mike

4 7

CoA-Request and Disconnect-Request in the server
by Alan DeKok 02 Jan '09

02 Jan '09

Thanks to a sponsor (details to follow), the server now has limited support for CoA-Request and Disconnect-Request. The functionality enables you to define policies that *originate* a CoA-Request or Disconnect-Request. i.e. "if user has used their bandwidth quota for the month, disconnect them". As always, there are some caveats: * the server cannot RECEIVE CoA requests. * the server cannot therefore PROXY CoA requests * the NAS MUST support CoA for this to work * The NAS must be listed as a "home_server" of type "CoA". See raddb/sites-enabled/originate-coa for more details. Alan DeKok.

1 0

FreeRADIUS and Foxpro
by Michael Schwartzkopff 02 Jan '09

02 Jan '09

Hi, is there anybody having Foxpro as a backend database. Is this possible? Thanks for sharing your experiences. Michael Schwartzkopff.

2 1

Somewhat OT: Captive portal on acess points instead complex supplicant at level end user?
by Sergio Belkin 02 Jan '09

02 Jan '09

Hi, Currently I'm using: *OpenWRT Kamikaze in AP's *Freeradius 2.1.2 *LDAP End users either use ttls or peap on their notebooks, as I have a LDAP server, each use his username and a password. Problem with this approach is that is somewhat complex for end users, they must either install a software or do a complicated configuration (think in end users terms, please). I'd want to have a open wireless network and that each user access to captive portal and enter his username and password, that captive portal "redirects" request to freeradius and freeradius in turn queries to ldap server. I'd want to know if CoovaAP (or something similar, what?) can perform such task as portal captive installed on APs. I'd be glad to read suggestions Thanks in advance!! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

5 6