- Freeradius-Users - lists.freeradius.org

Hash username or mac address to assign user to different vlan
by schilling 03 Mar '11

03 Mar '11

Hi All, I get dynamic VLAN assignment working in post-auth section with help/hints from a lot of list members. Now I want to do one more steps. I would like to hash the username or mac-address to distribute users to different VLANs. The idea is to use freeradius to spread the load on different smaller subnets to reduce the broadcast in bigger VLANs. For example I want to do the following if ( "%{User-Name}" !~ /@/ ) { if ( %{User-Name}%2 == 0 ) { update reply { Service-Type = "Framed-User" Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "facstaff0" } elsif ( %{User-Name}%2 == 1 ) { update reply { Service-Type = "Framed-User" Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "facstaff1" } } } Will I be able to do this in the post-auth with unlang? Thanks, Schilling ---------- Forwarded message ---------- From: schilling <schilling2006(a)gmail.com> Date: Tue, Jan 25, 2011 at 10:19 AM Subject: Re: dynamic VLAN assignment w/ mschapv2 against AD and LDAP To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> I believe I resolved this. I used eapol_test to get all wanted result, and will try on real NAS later on. The following is what I did. Basically I followed Alexander's example, Modified peap section in eap.conf to use another virtual server "auth" instead of inner-tunnel virtual server. I almost blindly copied Alexander's example in auth server except I removed the reject for the realm checks. The ldap cache pm is not needed in my case since I do not query windows AD via LDAP to get their attributes. If I want to do ldap after ntlm against AD, then Alexander's pm might be needed. Then I want to map certain attribute like employeeStatus from our iPlanet ldap server to some radius attribute, so I can manipulate it in the post-auth section. I put the following line in etc/raddb/dictionary ATTRIBUTE My-Local-employeeStatus 3000 string and the following line in etc/raddb/ldap.attrmap #FOO specific attributes replyItem My-Local-employeeStatus employeeStatus Without these two line addition, radius will complain unknown attribute. Then in the post-auth section #default will have no Tunnel attribute/value, instead, they will be configured on #the NAS to go to student VLANs. # this will cover my ldap ntPassword authentication/authorization #facstaff have employeeStatus set while student does not if ( "%{User-Name}" =~ /@/ && "%{reply:My-Local-employeeStatus}" ) { update reply { Service-Type = "Framed-User" Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "facstaff" } } #this will cover my AD ntlm auth, People in AD are all facstaff if ( "%{User-Name}" !~ /@/ ) { update reply { Service-Type = "Framed-User" Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "facstaff" } } In this way, people can map arbitrary attribute from ldap to radius, if not in dictionary/ldap.attrmap, then just defined your own. Then you have flexibility of using these attribute/value in your logic at post-auth section. Thanks all for the hints and help! Schilling

8 22

Load Balancing FreeRADIUS with CLUSTERIP
by Randy Wilson 03 Mar '11

03 Mar '11

Hi, Does anyone have any experience of load balancing two or more FreeRADIUS servers using the iptables CLUSTERIP target? For those unaware, it allows a single IP address to be assigned to multiple servers. A multicast MAC address is used so that the traffic is forwarded to each server, then iptables uses hashing to determine if the receiving server should handle the traffic. The hashing can be based on the source IP, the source IP and destination port, or the source IP and both source and destination ports. I have a pair of FreeRADIUS servers that are backed by a four node MySQL Cluster. The FreeRADIUS servers are used by our peers in a primary/secondary configuration, and the secondary only ever receives requests if the primary is unavailable. This results in the secondary server idling 99.99% of the time. I'm considering assigning a CLUSTERIP to the servers so we can make full use of the resources. Does anyone see any potential issues of using this with FreeRADIUS or know of any caveats I should be aware of? I have some production SMTP and FTP clusters that are load balanced in a similar way, with Pacemaker handling the failover, that have been running quite well for over a year. Thanks. REW

4 6

Compiling master branch
by Kristoffer Milligan 03 Mar '11

03 Mar '11

Due to the need for nested TLVs I'm trying to compile FreeRADIUS from the master branch: git clone git://git.freeradius.org/freeradius-server.git Also, I'm using FR for a WiMAX network, so I need the experimental modules: ./configure --with-experimental-modules The configuration works fine, but when I try to compile the project, it fails: root@radius:~/freeradius-server# make ......... gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/freeradius-server/src -I/root/freeradius-server/src/modules/rlm_redis -c rlm_rediswho.c -fPIC -DPIC -o .libs/rlm_rediswho.o In file included from rlm_rediswho.c:32: /root/freeradius-server/src/modules/rlm_redis/rlm_redis.h:35:29: error: hiredis/hiredis.h: No such file or directory In file included from rlm_rediswho.c:32: /root/freeradius-server/src/modules/rlm_redis/rlm_redis.h:46: error: expected specifier-qualifier-list before 'redisContext' rlm_rediswho.c: In function 'rediswho_command': rlm_rediswho.c:124: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:125: error: 'REDIS_REPLY_INTEGER' undeclared (first use in this function) rlm_rediswho.c:125: error: (Each undeclared identifier is reported only once rlm_rediswho.c:125: error: for each function it appears in.) rlm_rediswho.c:127: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:129: error: 'REDIS_REPLY_STATUS' undeclared (first use in this function) rlm_rediswho.c:130: error: 'REDIS_REPLY_STRING' undeclared (first use in this function) rlm_rediswho.c:132: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c: In function 'rediswho_accounting_start': rlm_rediswho.c:264: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:264: error: 'REDIS_REPLY_INTEGER' undeclared (first use in this function) rlm_rediswho.c:265: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c: In function 'rediswho_accounting_alive': rlm_rediswho.c:281: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:281: error: 'REDIS_REPLY_INTEGER' undeclared (first use in this function) rlm_rediswho.c:282: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c: In function 'rediswho_accounting_stop': rlm_rediswho.c:299: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:299: error: 'REDIS_REPLY_INTEGER' undeclared (first use in this function) rlm_rediswho.c:300: error: 'REDISSOCK' has no member named 'reply' make[6]: *** [rlm_rediswho.lo] Error 1 make[6]: Leaving directory `/root/freeradius-server/src/modules/rlm_rediswho' make[5]: *** [rlm_rediswho] Error 2 make[5]: Leaving directory `/root/freeradius-server/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/root/freeradius-server/src/modules' make[3]: *** [modules] Error 2 make[3]: Leaving directory `/root/freeradius-server/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/freeradius-server/src' make[1]: *** [src] Error 2 make[1]: Leaving directory `/root/freeradius-server' make: *** [all] Error 2 What lib am I missing ? Or what flag can I throw at --without-XXXX to circumvent the problem? - Kristoffer Milligan

3 2

DHCP reply problem
by Александр Подрезенко 03 Mar '11

03 Mar '11

Hello all. I tried to configure freeradius to operate as dhcp server. I have one problem. Freeradius receives DHCP-Discover and DHCP-Request packets, but replies are not sent. In logs all OK, but strace output contains error EINVAL (Invalid argument) in packet sending via sendmsg. Freeradius version is 2.1.x from git. My config file: dhcp:=========================== listen { ipaddr = * port = 67 type = dhcp interface = eth0 broadcast = yes } dhcp DHCP-Discover { linelog update reply { DHCP-Message-Type = DHCP-Offer DHCP-Domain-Name-Server = 192.168.194.169 DHCP-Domain-Name-Server = 192.168.192.53 DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 192.168.194.126 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.194.105 DHCP-Your-IP-Address = 192.168.194.106 } linelog ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 192.168.194.169 DHCP-Domain-Name-Server = 192.168.192.53 DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 192.168.194.126 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.194.105 DHCP-Your-IP-Address = 192.168.194.106 } ok } dhcp:=========================== Log fragment: freeradius -X ================== Received DHCP-Discover of id f1b3e779 from 0.0.0.0:68 to 255.255.255.255:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 4055099257 DHCP-Number-of-Seconds = 31 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:22:15:30:16:7b DHCP-Message-Type = DHCP-Discover DHCP-Requested-IP-Address = 192.168.194.106 DHCP-Hostname = "capt-eee" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Search DHCP-Parameter-Request-List = DHCP-Hostname DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Interface-MTU-Size DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = DHCP-NTP-Servers server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} [linelog] expand: %{reply:DHCP-Message-Type} -> [linelog] ... expanding second conditional [linelog] expand: %{request:DHCP-Message-Type} -> DHCP-Discover [linelog] expand: %{%{reply:DHCP-Message-Type}:-%{request:DHCP-Message-Type}} -> DHCP-Discover [linelog] expand: /var/log/radius/linelog -> /var/log/radius/linelog [linelog] expand: %{DHCP-Transaction-Id} DISCOVER: [%{DHCP-Client-Hardware-Address}] via (%{DHCP-Gateway-IP-Address}) %{DHCP-Hostname} -> 4055099257 DISCOVER: [00:22:15:30:16:7b] via (0.0.0.0) capt-eee ++[linelog] returns ok ++[reply] returns ok [linelog] expand: %{reply:DHCP-Message-Type} -> DHCP-Offer [linelog] expand: %{%{reply:DHCP-Message-Type}:-%{request:DHCP-Message-Type}} -> DHCP-Offer [linelog] expand: /var/log/radius/linelog -> /var/log/radius/linelog [linelog] expand: %{DHCP-Transaction-Id} OFFER: %{reply:DHCP-Your-IP-Address} to [%{DHCP-Client-Hardware-Address}] ... -> 4055099257 OFFER: 192.168.194.106 to [00:22:15:30:16:7b] ... ++[linelog] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Offer of id f1b3e779 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 192.168.194.126 DHCP-Domain-Name-Server = 192.168.194.169 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.194.105 Finished request 5. Cleaning up request 5 ID -239868039 with timestamp +85 Going to the next request Ready to process requests. freeradius -X ================== STRACE output ================= write(1, "Ready to process requests.\n", 27) = 27 select(20, [11 13 14 15 16 17 18 19], NULL, NULL, NULL) = 1 (in [17]) getsockname(17, {sa_family=AF_INET, sin_port=htons(67), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 recvmsg(17, {msg_name(16)={sa_family=AF_INET, sin_port=htons(68), sin_addr=inet_addr("0.0.0.0")}, msg_iov(1)=[{"\1\1\6\0\361\263\347y\0\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\0250"..., 1460}], msg_controllen=32, {cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=, ...}, msg_flags=0}, 0) = 300 write(1, "Received DHCP-Discover of id f1b"..., 76) = 76 write(1, "\tDHCP-Opcode = Client-Message\n", 30) = 30 write(1, "\tDHCP-Hardware-Type = Ethernet\n", 31) = 31 write(1, "\tDHCP-Hardware-Address-Length = "..., 34) = 34 write(1, "\tDHCP-Hop-Count = 0\n", 20) = 20 write(1, "\tDHCP-Transaction-Id = 405509925"..., 34) = 34 write(1, "\tDHCP-Number-of-Seconds = 31\n", 29) = 29 write(1, "\tDHCP-Flags = 0\n", 16) = 16 write(1, "\tDHCP-Client-IP-Address = 0.0.0."..., 34) = 34 write(1, "\tDHCP-Your-IP-Address = 0.0.0.0\n", 32) = 32 write(1, "\tDHCP-Server-IP-Address = 0.0.0."..., 34) = 34 write(1, "\tDHCP-Gateway-IP-Address = 0.0.0"..., 35) = 35 write(1, "\tDHCP-Client-Hardware-Address = "..., 50) = 50 write(1, "\tDHCP-Message-Type = DHCP-Discov"..., 35) = 35 write(1, "\tDHCP-Requested-IP-Address = 80."..., 43) = 43 write(1, "\tDHCP-Hostname = \"capt-eee\"\n", 28) = 28 write(1, "\tDHCP-Parameter-Request-List = D"..., 48) = 48 write(1, "\tDHCP-Parameter-Request-List = D"..., 54) = 54 write(1, "\tDHCP-Parameter-Request-List = D"..., 48) = 48 write(1, "\tDHCP-Parameter-Request-List = D"..., 51) = 51 write(1, "\tDHCP-Parameter-Request-List = D"..., 48) = 48 write(1, "\tDHCP-Parameter-Request-List = D"..., 55) = 55 write(1, "\tDHCP-Parameter-Request-List = D"..., 50) = 50 write(1, "\tDHCP-Parameter-Request-List = D"..., 45) = 45 write(1, "\tDHCP-Parameter-Request-List = D"..., 57) = 57 write(1, "\tDHCP-Parameter-Request-List = D"..., 44) = 44 write(1, "\tDHCP-Parameter-Request-List = D"..., 55) = 55 write(1, "\tDHCP-Parameter-Request-List = D"..., 59) = 59 write(1, "\tDHCP-Parameter-Request-List = D"..., 48) = 48 write(1, "server dhcp {\n", 14) = 14 write(1, "Trying sub-section dhcp DHCP-Dis"..., 44) = 44 write(1, "+- entering group DHCP-Discover "..., 38) = 38 write(1, "[linelog] \texpand: %{reply:DHCP-"..., 50) = 50 write(1, "[linelog] \t... expanding second "..., 44) = 44 write(1, "[linelog] \texpand: %{request:DHC"..., 65) = 65 write(1, "[linelog] \texpand: %{%{reply:DHC"..., 96) = 96 write(1, "[linelog] \texpand: /var/log/radi"..., 70) = 70 open("/var/log/radius/linelog", O_WRONLY|O_CREAT|O_APPEND, 0600) = 20 write(1, "[linelog] \texpand: %{DHCP-Transa"..., 203) = 203 write(20, "4055099257 DISCOVER: [00:22:15:3"..., 64) = 64 close(20) = 0 write(1, "++[linelog] returns ok\n", 23) = 23 write(1, "++[reply] returns ok\n", 21) = 21 write(1, "[linelog] \texpand: %{reply:DHCP-"..., 60) = 60 write(1, "[linelog] \texpand: %{%{reply:DHC"..., 93) = 93 write(1, "[linelog] \texpand: /var/log/radi"..., 70) = 70 open("/var/log/radius/linelog", O_WRONLY|O_CREAT|O_APPEND, 0600) = 20 write(1, "[linelog] \texpand: %{DHCP-Transa"..., 182) = 182 write(20, "4055099257 OFFER: 80.91.194.106 "..., 59) = 59 close(20) = 0 write(1, "++[linelog] returns ok\n", 23) = 23 write(1, "++[ok] returns ok\n", 18) = 18 write(1, "} # server dhcp\n", 16) = 16 write(1, "Sending DHCP-Offer of id f1b3e77"..., 72) = 72 write(1, "\tDHCP-Subnet-Mask = 255.255.255."..., 36) = 36 write(1, "\tDHCP-Router-Address = 80.91.194"..., 37) = 37 write(1, "\tDHCP-Domain-Name-Server = 80.91"..., 41) = 41 write(1, "\tDHCP-IP-Address-Lease-Time = 86"..., 36) = 36 write(1, "\tDHCP-DHCP-Server-Identifier = 8"..., 45) = 45 sendmsg(17, {msg_name(16)={sa_family=AF_INET, sin_port=htons(68), sin_addr=inet_addr("255.255.255.255")}, msg_iov(1)=[{"\2\1\6\0\361\263\347y\0\0\0\0\0\0\0\0P[\302jP[\302i\0\0\0\0\0\"\0250"..., 300}], msg_controllen=32, {cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=, ...}, msg_flags=0}, 0) = -1 EINVAL (Invalid argument) write(1, "Finished request 5.\n", 20) = 20 write(1, "Cleaning up request 5 ID -239868"..., 55) = 55 write(1, "Going to the next request\n", 26) = 26 wait4(-1, NULL, 0, NULL) = -1 ECHILD (No child processes) write(1, "Ready to process requests.\n", 27) = 27 STRACE output =================

2 1

PAP problem?
by Matt Langthorpe 03 Mar '11

03 Mar '11

Hi list, I'm pretty sure this issue is straight forward but I've searched the list and cant come up with an answer. I'm usuing freeradius 2.19 on cent OS 5.5 Im trying to auth users from a NAC box (Bradford campus manager) against an AD domain using freeradius. All works fine when I point an AP at freeradius, but things fail when using our NAC to forward requests to FreeRadius. I suspect the problem is that the NAC is trying to use PAP, but im not sure how to really resolve the problem. Here are my logs: Ready to process requests. rad_recv: Access-Request packet from host 129.67.147.204 port 32960, id=174, length=78 User-Name = "SAMBA_TEST" User-Password = "password" NAS-Identifier = "pmbcm01.pmb.ox.ac.uk" NAS-IP-Address = 129.67.147.204 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/129.67.147.204/auth-detail-20110303 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/129.67.147.204/auth-detail-20110303 [auth_log] expand: %t -> Thu Mar 3 11:45:17 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SAMBA_TEST", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for SAMBA_TEST [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=SAMBA_TEST)) [ldap] expand: cn=Users,dc=PMB,dc=OX,dc=AC,dc=UK -> cn=Users,dc=PMB,dc=OX,dc=AC,dc=UK rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 129.67.147.225:389, authentication 0 rlm_ldap: bind as cn=samba,cn=Users,dc=PMB,dc=OX,dc=AC,dc=UK/password to 129.67.147.225:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in cn=Users,dc=PMB,dc=OX,dc=AC,dc=UK, with filter (&(sAMAccountName=SAMBA_TEST)) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user SAMBA_TEST authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> SAMBA_TEST attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 174 to 129.67.147.204 port 32960 Waking up in 4.9 seconds. Cleaning up request 0 ID 174 with timestamp + Cheers, Matt

2 1

Using an external CA certificate
by Matt Langthorpe 03 Mar '11

03 Mar '11

Hi List, Having a bit of trouble following the official freeradius wiki when it comes to certificates. Basically I have my own certificate which I want to use. I have a ***.crt file which was sent by my issuer, and a private.pem file which was created when I made my CSR request using openssl. I have uploaded the two files into my raddb/certs folder, but am unsure as to where to point to them in my eap.conf? I notice none of the cert files listed in eap.conf have a *.crt extension which is a bit confusing. Thanks in advance, Matt

2 2

AD LDS with MS-CHAP Question
by Liem Nguyen 03 Mar '11

03 Mar '11

Hi, Hope someone can help me with this. I was successfully able to get freeradius to work with Microsoft AD LDS (new version of ADAM) with PAP and LDAP authentication. Now I'm working on getting freeradius to work with AD LDS with MS-CHAP. Anybody know if this is possible and if you do can you give me some direction on this? Thanks! Liem

2 1

Mobile IP
by Shreya Shah 03 Mar '11

03 Mar '11

Hi, We have setup freeradius for our mobile customers and is also used to provide IP's to the handsets. We are planning to setup up roaming which requires Mobile IP's. Can anyone please tell me if freeradius supports Mobile IP ? Thanks, S.

3 4

help setting up radius
by Matthew Lemons 02 Mar '11

02 Mar '11

I'm trying to update my older radius to the new specs put out by our upline provider. I need someone to do this for me. I'm not good with Radius. Wish I was but am not. This is a paying deal. -- And I am the Iconoclast, an unconventional eccentric who marches to a different drummer... but you may call me Noodle Noggin.

1 0

New User and AD Question
by McNutt, Justin M. 02 Mar '11

02 Mar '11

New member to the list, here. I have a question about AD computer-based authentication. Basically, how is it accomplished? I have Googled and Googled, but only found references to the fact that it *can* be done (mostly from archives of this list), but little reference on HOW to do it, other than that it has something to do with editing the "realms" file. I also went to #freeradius on FreeNode, but it seemed there was rarely anyone in the channel. So here I am. I'm running FreeRADIUS 2.1.7 from the RHEL 5 RPM (freeradius2-2.1.7-7.el5). It's running on an RHEL 5 virtual machine that is a member of an AD domain via Samba 3.5.4 (which was required to talk to the 2008R2 domain controllers). We have a multi-domain, single forest environment. I'm running two virtual servers, based on the defaults. I have the "campus-main" virtual server that is pretty much the exact same as the default, except that I have LDAP authentication enabled. This works perfectly and is able to authenticate users for all domains. I also have the "campus-eap" and "campus-inner-tunnel" virtual servers for EAP authentication that are the same as the "default" and "inner-tunnel" servers except for the names. (I copied them so I could make changes to the "campus-XXX" virtual servers and still have the originals for reference.) The EAP functions for clients using EAP-TTLS and EAP-PEAP work just fine for all users in all domains (authenticated via ntlm_auth) EXCEPT for the "host\\computer.domain.name" users (the computer accounts). I'd like to make this work, partly because a large number of the failed login attempts in my logs are from hosts that are valid domain members. Sooo... help? What's the basic idea behind making this work? Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test.

8 57