March 2010 - Freeradius-Users - lists.freeradius.org

Multiple radius servers with the same CA
by sphaero 24 Mar '10

24 Mar '10

Hi All, I've been searching the archives for a while on some guidance into setting up multiple radius servers using the same CA for use with EAP/TTLS. I've generated a CA which is distributed to all the clients (i.e. SecureW2). I've got 2 radius servers for redundancy. All NAS devices have two radius server configured. I'm using the scripts from freeradius 2.0 to generate the certificates according to instructions in the README. I've setup the ca.cnf and server.cnf (not using eap/tls so I skip clients.cf). On the primary radius server I generated the certificates by issuing: make Now on the second radius server I just copy the following files: /certs/ca.pem /certs/ca.key /certs/ca.der /certs/*.cnf /certs/Makefile /certs/README /certs/xpextensions and issue: make server make dh This seems to have worked. But is this really correct? I'm renewing one radius server and did this procedure again but now I'm receiving "chain could not be validated" errors in SecureW2. Radius log seems fine however EAP communication is not finished which corresponds with the client stopping communication since it can't validate the certificate. I'm really getting lost in the SSL jungle? I would really like to understand how this is done right, since it is about security. Rg, Arnaud -- View this message in context: http://old.nabble.com/Multiple-radius-servers-with-the-same-CA-tp28013061p2… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 8

Freeradius says it is listening on port 1812, but isn't
by Matt Harlum 24 Mar '10

24 Mar '10

Hi, I'm running Freeradius 2.1.6 on MacOSX 10.5.7 on a Dual-G4 867Mhz PowerMac Since march last year I've had 2.1.6 installed however it's been switched off for the last few months. Recently I powered it back on and have run system updates etc and got to the point I am now When I launch FreeRadius it says it is listening on *:1812 for auth however my AP is unable to connect, and trying telnet on port 1812 results in "Connection Refused" I've tried reverting the configuration to default but it hasn't worked. running radiusd -x does not throw any errors Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Anyone have any ideas as to why this would be happening all of a sudden? perhaps the system updates broke it? Regards, Matt Harlum

3 4

Matthias Klosowski
by Benjamin Marvin 23 Mar '10

23 Mar '10

http://www.pucllanalodge.com/lndex.html _________________________________________________________________ Hotmail: posta elettronica con funzioni avanzate e gratuita, con la protezione Microsoft. https://signup.live.com/signup.aspx?id=60969

1 0

Opa
by Richie Lee 23 Mar '10

23 Mar '10

http://sites.google.com/site/dfsr5syhs/qchq2p _________________________________________________________________ Take your contacts everywhere http://go.microsoft.com/?linkid=9712959

1 0

Active/Inactive record in MySQL
by Paweł Pogorzelski 23 Mar '10

23 Mar '10

Hi! Is there somewhere in the mysql database (default schema) record saying that your account is active or inactive which freeradius will understand? best regards

3 2

configuring multiple ldap servers
by V Jyothi-B22245 23 Mar '10

23 Mar '10

Hi, I want to understand in freeradius with rlm_ldap, Is it possible to configure multiple LDAP servers in Freeradius and the freeradius uses different LDAP server for different requests. Is it possible to add some kind of id in radius requests, so that freeradius makes use of that ID to choose which LDAP server can be used for that request. I am new to this freeradius. Please help me to get some understanding ?? We can configure one LDAP server in freeradius radiusd.conf ldap section?? but how to configure multiple LDAP servers and what is the purpose of filter id attribute in freeradius?? Thanks Jyothi

2 3

configuration of IP address pool in free radius
by V Jyothi-B22245 23 Mar '10

23 Mar '10

Hi, I need some information IP address pool configuration. I want to configure IP address pool in freeradius and whenever I receive an accept-accept response, free RADIUS should return a Framed-IP from the configured pool. Thanks Jyothi

1 0

pap authentication for freeradius
by jittinan suwanrueangsri 23 Mar '10

23 Mar '10

Dear All I have added an user in /usr/local/etc/users and /etc/shadow but passwod in both place are different. First, I try to authenticate by pap protocol then I can login correctly by supply shell account password but can not login by supply password which reside in users file. Second,I have created another account which exits only in users file but not /etc/shadow then I can login correctly It's seem that rlm_pap module select password which reside in /etc/shadow file before /usr/local/etc/users file. How can I change freeradius configure to select password from users file first? What is different between := and == operator? I have already readed man page but it does not make me clear. Thank You

3 2

FreeRadius and RH Directory server certificate
by Natr Brazell 22 Mar '10

22 Mar '10

Anyone ever configure these two together? I find many references to OpenLDAP but none related to FDS or RHDS. I'm new to this so please just a positive push in the right direction would be appreciated. Thanks, N

2 1

LDAP Groups + SQL Authorization
by Mike Loosbrock 22 Mar '10

22 Mar '10

Hello List, Suppose the following situation: 1.) All the users and groups are stored in AD. 2.) The AD schema cannot be extended to hold RADIUS attributes. 3.) But the RADIUS attributes can be stored in a database. Is there a way to configure FreeRADIUS to compile a user's group membership via rlm_ldap and then pass that group information on to rlm_sql for group authorization? I thought about getting the user's groups by fetching the multi- valued 'memberOf' attribute from AD and then copying it to the control list via ldap.attrmap. But I don't see any way to then make rlm_sql use that attribute in an authorization query (at least in any sort of useful manner). One work-around is to periodically export the AD group membership data and rebuild the usergroup table from it. I'd really like to avoid this approach if at all possible. -- Mike Loosbrock Bethel University Network Services 651-638-6723

3 3