- Freeradius-Users - lists.freeradius.org

Enabling / disabling active directory users
by Iain Grant 17 Jun '10

17 Jun '10

We have on site a Windows 2008 RC2 domain controller ( 64-bit ) which I have a linux based freeradius server hanging from. My question is, other than changing the users file on the freeradius server, is there another way of disabling a user from authentication through the radius server but still allow them access via the active directory route. So for example, a user can log in quite happily on site using their windows machine. If they go offsite and try authentication via the radius server they will not be allowed. Does active directory have a flag or something that can be set against the user account to deny access via a radius link. Thanks Iain ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

3 2

Check line and radgroupcheck evaluation question
by Matt Hite 16 Jun '10

16 Jun '10

Hello, Are check lines in the "users" file short-circuit "AND" evaluated from left to right? Extrapolating this presumption out to radgroupcheck when using a MySQL database, are the check items evaluated simply in order of column id value (ie. the order they are returned from the SELECT)? authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" Just trying to wrap my head around how one might do something useful with radgroupcheck. I guess you are supposed to be able to match some condition on the row whose group matches with the lowest column ID and then subsequent rows that also have the same matching group (with higher column ID's) can be used to set attributes or look for further requisite conditions? I am actually wanting to reject connections when groups of users come in on the wrong huntgroup. I've seen significant discussion and confusion in the mailing list archives in regards to this. Most of the time I see people say "use radcheck to reject." I did spot a gem from Ivan Kalik, though, which led me down this path. >>However, the issue remains: >>I do not want the user to be rejected per se. I only want the user to be >>rejected if her own huntgroup as stored in radgroupcheck is different from >>he huntgroup of the Called-Station-Id in the radhuntgroup table. The goal >>is to prevent a user to login to a hotspot router, that does not belong to >>the huntgroup the user belongs to. > >Hm, and what do you think: > >>> Huntgroup-Name != "Test", Auth-Type := Reject > >that does? As a joke, put them in radgroupcheck and see if it does >*exactly* what you have described. Thanks for your help, -M

2 2

freeradius 2.1.9 crashes working in proxy mode
by JOE 16 Jun '10

16 Jun '10

Hi all Actually I have two servers (in cluster mode with heartbeat) working each one with two radius services, one proxy and one radius as follow: Server1: .- freeradius server 2.1.9 : listening on port 1645 , working in proxy mode with load balance configuration and point to local radius and Server2 radius - freeradius server 2.1.9: listening on port 1812, working in radius mode. Server2: .- freeradius server 2.1.9 : listening on port 1645 , working in proxy mode with load balance and point to local radius an Server1 radius - freeradius server 2.1.9: listening on port 1812, working in radius mode. Load Balance works fine but when I force shutdown of one of local radius servers the proxy crashes with a segmentation. you have any idea what is happening? Regards

3 3

Segment Fault
by David Peterson 16 Jun '10

16 Jun '10

[61490.335957] freeradius[6212]: segfault at 6c ip 00a51951 sp bfd33070 error 4 in libfreeradius-radius-2.1.8.so[a3d000+1e000] [61510.556054] freeradius[6214]: segfault at 6c ip 00a97951 sp bfab1530 error 4 in libfreeradius-radius-2.1.8.so[a83000+1e000] [62031.935361] hrtimer: interrupt took 36340206 ns Anyone know what causes this sort of crash? It happens when I access EAP. If 2.1.9 fixes this, can someone point me to an Ubuntu repository that has it available. David Peterson

2 1

Use rlm_ldap reply for the next authorization module
by JUND, Aurélien 16 Jun '10

16 Jun '10

Hello, In order to allow a user to access the service (send a Access-Accept) I need to validate several things: First the password must be OK: * The User-name and password are stored in cleartext in a ldap (I use Chap), I must get another ldap attribute wich specify the crm Id matching the username. The user must be allowed to use the service: * Daily I get a files matching a crm Id and a status (can access, cant access) => I can't have a matching between user-name / Status. The crm don't know the user-name, and the ldap don't know the client's status (only the Crm ID) I have no trouble to check the User-Name/Password using ldap and chap modules. But I can't figure out how to use the ldap reply to request the local mysql where is store the match between crm Id and status. I don't know how to use a reply of a authorization module (ldap) in an another one (sql). Since I didn't find out how to do this, I tried to add the crmID in a unused radius attribute: Callback-Number: In the ldap attrmap configuration file I added: replyItem Callback-Number SFRrelationLoginService And in the sql configuration: sql_user_name = "%{Callback-Number}" Unfortunately as expected the replyItem is only add when the reply is generate. I also tried with a checkItem without more success... Is it possible to configure the ldap module in order to store a ldapattribute in a variable usable by the mysql module ? Or to replace/add a radius attribute in the request, base on the ldap reply before the next module is compute? Examples : Goal case: echo "User-Name= toto,Chap-Password=111111", | sudo radclient -x 172.16.0.135:1812 auth secret Sending Access-Request of id 202 to 172.16.0.135 port 1812 User-Name = "toto" CHAP-Password = 0xcab5c3da9c9ebb891608c1991c2e37bea3 rad_recv: Access-Reject packet from host 172.16.0.135 port 1812, id=202, length=20 log: Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Waking up in 0.9 seconds. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: waiting for bind result ... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: Bind was successful Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: performing search in ou=EndUser,dc=USER,dc=fr, with filter (USERlogin=toto*) Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] No default NMAS login sequence Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for check items in directory... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERrelationLoginService -> Callback-Number == "siebelsIdFortoto" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERuserPassword -> Cleartext-Password == "111111" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERlogin -> User-Name == "toto" Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for reply items in directory... Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [ldapClear] user toto authorized to use remote access Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_release_conn: Release Id: 0 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[ldapClear] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: %{Callback-Number} -> Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] sql_set_user escaped user --> '' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Reserving sql socket id: 1 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '%{Callback-Number}' AND Status='1' -> SELECT Identifiant, Status FROM siebel WHERE Identifiant = '' AND Status='1' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql_mysql: query: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '' AND Status='1' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Released sql socket id: 1 Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] User not found Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[sql_crm_abv] returns notfound Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] Setting 'Auth-Type := CHAP' Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[expiration] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[logintime] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [pap] Found existing Auth-Type, not changing it. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[pap] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Entering module authorize code Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Could not find Key value pair Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[scratchcounter_lyo] returns noop Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Found Auth-Type = CHAP Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: +- entering group CHAP {...} Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] login attempt by "toto" with CHAP password Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] Using clear text password "111111" for user toto authentication. Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: [chap] chap user toto authenticated succesfully Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: Login OK: [toto/<CHAP-Password>] (from client ext port 0) Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: +- entering group post-auth {...} Jun 16 12:42:30 radius-wifi1-aub freeradius[7106]: ++[reply_log] returns ok Test addin the crmId in the request before computing => not possible in real situation, but to test everything else echo "User-Name= toto,Chap-Password=111111",Callback-Number='siebelsIdFortoto' | sudo radclient -x 172.16.0.135:1812 auth secret Sending Access-Request of id 159 to 172.16.0.135 port 1812 User-Name = "toto" CHAP-Password = 0x9fb08ff7f454d0c9998fc5dd72479940cd Callback-Number = "siebelsIdFortoto" rad_recv: Access-Accept packet from host 172.16.0.135 port 1812, id=159, length=20 log: Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 got semaphore Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 handling request 0, (1 handled so far) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group authorize {...} Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[preprocess] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[mschap] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [IPASS] No '/' in User-Name = "toto", looking up realm NULL Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [IPASS] No such realm "NULL" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[IPASS] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [suffix] No '@' in User-Name = "toto", looking up realm NULL Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [suffix] No such realm "NULL" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[suffix] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[files] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] performing user authorization for toto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: %{Stripped-User-Name} -> Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: %{User-Name} -> toto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: (USERlogin=%{%{Stripped-User-Name}:-%{User-Name}}*) -> (USERlogin=toto*) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] #011expand: ou=EndUser,dc=USER,dc=fr -> ou=EndUser,dc=USER,dc=fr Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_get_conn: Checking Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_get_conn: Got Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: attempting LDAP reconnection Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: (re)connect to 10.33.245.241:389, authentication 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: bind as cn=Radius Gp,ou=Application,dc=USER,dc=fr/radiusgp to 10.33.245.241:389 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Threads: total/active/spare threads = 5/1/4 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Waking up in 0.9 seconds. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: waiting for bind result ... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: Bind was successful Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: performing search in ou=EndUser,dc=USER,dc=fr, with filter (USERlogin=toto*) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] No default NMAS login sequence Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for check items in directory... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERrelationLoginService -> Callback-Number == "siebelsIdFortoto" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERuserPassword -> Cleartext-Password == "111111" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: USERlogin -> User-Name == "toto" Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] looking for reply items in directory... Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [ldapClear] user toto authorized to use remote access Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_ldap: ldap_release_conn: Release Id: 0 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[ldapClear] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: %{Callback-Number} -> siebelsIdFortoto Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] sql_set_user escaped user --> 'siebelsIdFortoto' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Reserving sql socket id: 1 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] #011expand: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '%{Callback-Number}' AND Status='1' -> SELECT Identifiant, Status FROM siebel WHERE Identifiant = 'siebelsIdFortoto' AND Status='1' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql_mysql: query: SELECT Identifiant, Status FROM siebel WHERE Identifiant = '=siebelsIdFortoto' AND Status='1' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sql (sql_crm_abv): Released sql socket id: 1 Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [sql_crm_abv] User siebelsIdFortoto not found Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[sql_crm_abv] returns notfound Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] Setting 'Auth-Type := CHAP' Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[expiration] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[logintime] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [pap] Found existing Auth-Type, not changing it. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[pap] returns noop Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Entering module authorize code Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: rlm_sqlcounter: Could not find Key value pair Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Found Auth-Type = CHAP Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group CHAP {...} Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] login attempt by "toto" with CHAP password Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] Using clear text password "111111" for user toto authentication. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: [chap] chap user toto authenticated succesfully Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: ++[chap] returns ok Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Login OK: [toto/<CHAP-Password>] (from client ext port 0) Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: +- entering group post-auth {...} JJun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Finished request 0. Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Going to the next request Jun 16 12:33:29 radius-wifi1-aub freeradius[7106]: Thread 4 waiting to be assigned a request Jun 16 12:33:30 radius-wifi1-aub freeradius[7106]: Waking up in 4.0 seconds. Jun 16 12:33:34 radius-wifi1-aub freeradius[7106]: Cleaning up request 0 ID 159 with timestamp +4 Jun 16 12:33:34 radius-wifi1-aub freeradius[7106]: Ready to process requests.

2 1

Getting PAP to work with ntlm_auth
by Neil Prockter 16 Jun '10

16 Jun '10

Hello I want to authenticate users against Active Directory for EAP-MSCHAPv2 and PAP. PAP is for a wireless web authentication redirection service that authenticates using PAP and its PAP I'm trying to debug not MSCHAP at present. I've been following http://deployingradius.com/documents/configuration/active_directory.html All goes well until I get towards the end. Once I remove DEFAULT Auth-Type = ntlm_auth from users PAP stops working where do I add the configuration to allow PAP to continue with ntlm_auth rather than just failing? with the setting I get success Info: +- entering group authorize {...} Info: ++[preprocess] returns ok Info: ++[chap] returns noop Info: ++[mschap] returns noop Info: [suffix] No '@' in User-Name = "np", looking up realm NULL Info: [suffix] No such realm "NULL" Info: ++[suffix] returns noop Info: [eap] No EAP-Message, not doing EAP Info: ++[eap] returns noop Info: ++[unix] returns notfound Info: [files] users: Matched entry DEFAULT at line 1 Info: ++[files] returns ok Info: ++[expiration] returns noop Info: ++[logintime] returns noop Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Info: ++[pap] returns noop Info: Found Auth-Type = ntlm_auth Info: +- entering group authenticate {...} Info: [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=ID Info: [ntlm_auth] expand: --password=%{User-Password} -> --password=SECRET Debug: Exec-Program output: NT_STATUS_OK: Success (0x0) Debug: Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Debug: Exec-Program: returned: 0 Info: ++[ntlm_auth] returns ok Info: +- entering group post-auth {...} Info: ++[exec] returns noop Sending Access-Accept of id 243 to 158.143.207.212 port 42687 without it no ntlm is attempted Info: +- entering group authorize {...} Info: ++[preprocess] returns ok Info: ++[chap] returns noop Info: ++[mschap] returns noop Info: [suffix] No '@' in User-Name = "np", looking up realm NULL Info: [suffix] No such realm "NULL" Info: ++[suffix] returns noop Info: [eap] No EAP-Message, not doing EAP Info: ++[eap] returns noop Info: ++[unix] returns notfound Info: ++[files] returns noop Info: ++[expiration] returns noop Info: ++[logintime] returns noop Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Info: ++[pap] returns noop Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Info: Failed to authenticate the user. Info: Using Post-Auth-Type Reject Info: +- entering group REJECT {...} Info: [attr_filter.access_reject] expand: %{User-Name} -> ID Debug: attr_filter: Matched entry DEFAULT at line 11 Info: ++[attr_filter.access_reject] returns updated Info: Delaying reject of request 0 for 1 seconds Debug: Going to the next request Debug: Waking up in 0.9 seconds. Info: Sending delayed reject for request 0 Sending Access-Reject of id 7 to 158.143.207.212 port 53676 TIA, Neil Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplia…

2 2

(no subject)
by Jasenko Sehanovic 16 Jun '10

16 Jun '10

Jasenko Sehanovic |t: + 387 33 768 000|f: + 387 33 768 001|m: + 387 61 103 444 Teleinformatica doo, Tvornička 3, 71000 Sarajevo, Bosnia and Herzegovina -- cid:part1.05030807.04020006@teleinformatica.ba

1 0

Re: Virtual server specific SQL schema.
by Stephen Fulton 16 Jun '10

16 Jun '10

Hi Stefan, Thanks for the suggestion, that's actually my back-up plan. The key issue is that a single MySQL server will be used, and peak-load on that server can be quite high. By creating multiple instances, I cannot scale the maximum number of sockets high enough meet the requirements. Perhaps on missing something with regard to MySQL optimization, but during testing I found increasing the maximum number of sockets was necessary to meet the performance requirements. -- Stephen On 6/15/2010 15:20, Stefan A. wrote: > Stephen, > > what's about using instances in the sql.conf like > > sql sql_virtual_1{ > database = "mysql" > driver = "rlm_sql_${database}" > server = "dbcnode2" > port="3306" > login = "user" > password = "pw" > radius_db = "dbname" > ...all the other stuff... > } > > Having several such sections, you'd be able to call them in cour virtual > server as > > authorize { > preprocess > chap > mschap > suffix > eap { > ok = return > } > unix > --> sql_virtual_1 > files > expiration > logintime > pap > } > > > You only have to exchange the values of > server = "dbcnode2" > port="3306" > login = "user" > password = "pw" > > for each instance... > > > > > Does this help? > Stefan > > > >> -----Original Message----- >> From: freeradius-users- >> bounces+a.freeradius=premit.de(a)lists.freeradius.org [mailto:freeradius- >> users-bounces+a.freeradius=premit.de(a)lists.freeradius.org] On Behalf Of >> Stephen Fulton >> Sent: Tuesday, June 15, 2010 8:43 PM >> To: freeradius user >> Subject: Virtual server specific SQL schema. >> >> Greetings, >> >> I am building an FR server using a shared MySQL database that will have >> multiple >> virtual servers. Each of the virtual servers needs to use different >> radcheck >> and radacct tables, each of which has a unique name (eg. radcheck1, >> radcheck2). >> The stated preference is that a single database be used, and the >> different >> tables reside within. For performance reasons, I would rather specify >> the DB >> server specific parameters (hostname, user/pass, maximum number of >> sockets etc) >> globally. >> >> My question: Is it possible to use a global DB configuration as >> outlined above, >> but call the schema specific info from within a virtual server? >> >> Thanks, >> >> -- Stephen >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 5

Ubuntu OpenSSL
by David Peterson 15 Jun '10

15 Jun '10

I know there is probably something easy I am missing but I cannot for the life of me get FR to compile with OpenSSL for EAP-TTLS support. Are there any how-to's on getting Ubuntu to compile OpenSSL support into FR2.1.9 David Peterson

7 11

Problems authenticating with a Cisco ASA 5510
by Daniel Davidson 15 Jun '10

15 Jun '10

We have had a radius server running for years that we use to authenticate our wireless users over wpa. It works flawlessly and connections are authenticated as shown by the log below. Mon Jun 14 14:57:40 2010 : Auth: Login OK: [miyagi72/<no User-Password attribute>] (from client 1s port 109133 cli d830.629b.3ae9) Above is an exact log entry. Now we are attempting to authenticate our new ASA 5510 with radius for our vpn, authentication with it is failing. Mon Jun 14 14:59:07 2010 : Auth: Login incorrect: [danield/password] (from client igbvpn port 26) In the example log above, I removed my password and replaced with the word "password". My guess is that the password is being thrown into the wrong field, but I have no idea how to resolve the issue. Can anyone point me in the right direction. Dan

2 3