- Freeradius-Users - lists.freeradius.org

proxy based on number of numeric char.
by Agent Smith 27 Apr '10

27 Apr '10

I'd like to have a radius proxy setup where it can proxy users based on number of numeric characters in the userid. so for example, if the userid is abc123 (with 3 numeric char. at the end) it should proxy to an instance of radius running on the same box and if the user id is abcxxx it should proxy the request to a different instance of radius running on the same box, is this doable or did I miss something in the documentation?

2 2

Redundant Audit logs
by Natr Brazell 27 Apr '10

27 Apr '10

I have 3 geographically distributed Radius servers. I'd like all audit logs to go to a central log server. What is the best way? How do you all accomplish this? Please provide valid feedback or references. Thanks, N

2 1

accounting packets
by VU VAN HUNG 27 Apr '10

27 Apr '10

Hi all, I'm trying to implement radius accounting. I want to ask how I can know whether accounting packets are sent and received ? Hung,

2 4

Proxy EAP-TLS as non-EAP
by Alok Shingala 27 Apr '10

27 Apr '10

I am trying to setup FreeRadius server to handle EAP-TLS authentication with a WiMAX ASN GW. I have another Radius server which does not support EAP-TLS but stores the WiMAX QoS attribute values that need to be assigned to the user (user is identified by Calling-Station-ID). I have been going through all post archive for few days but have NOT been able to find a thread that directly answers my question. 1. How can I proxy the EAP-TLS request to a radius server which does not support EAP ? (I only need the Radius Attributes in the outer tunnel) 2. How can I add QoS attributes from the proxy-radius response to the outer-tunnel of the EAP-TLS response ? Highly appreciate any help from the community. Thanks and Regards, Alok

2 1

More complex Proxying
by Rosario Lumia 27 Apr '10

27 Apr '10

Hi to all, I'm not sure how can I configure freeradius to have this kind of configuration: try to account to home_server1; if fails try home_server2; else fail; A kind of failover but not exactly; my goal is to have one @realm for more authentication server. I read the "more complex configuration" but I'm not sure that I can apply this rule in proxy.conf and how. Thanks in advance. -- Rosario L.

2 3

Remote MySQL backend encryption
by Eric.Hernandez＠allegiantair.com 27 Apr '10

27 Apr '10

I see thats what I thought, I also confirmed its all clear text with tcpdump. If I were to switch my backend to an ldap system would I have encrypted traffic for user authentication with freeradius remote ldap/backend setup? Also is there a nas/radacct table equivalent in the ldap solution or is it strictly for user authentication? Message: 9 Date: Mon, 26 Apr 2010 15:04:17 -0400 From: John Dennis <jdennis(a)redhat.com> Subject: Re: Remote MySQL backend encryption To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4BD5E3B1.8060706(a)redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed On 04/26/2010 01:57 PM, Eric.Hernandez(a)allegiantair.com wrote: > Hi, > > I am trying to figure out if need to encrypt my traffic from a > FreeRadius server to a remote MySQL backend. > > I have the following setup. > > FreeRadius/MySQL (Server1) > > FreeRadius/MySQL (Server2) Both Server1 and Server2 are doing MySQL > Master to Master (ssl) Replication > > Now I want to add a third FreeRadius server without a local MySQL Backend. > > So this third server will point to either Server1 or Server2 which runs > MySQL but will these request be sent to the remote MySQL Servers in > clear text? This has nothing to do with how many MySQL servers you've got or how you're doing replication, encryption occurs on a per connection basis (e.g. connections established via rlm_sql_mysql). rlm_sql_mysql never opens an encrypted session with it's server because rlm_sql_mysql does not have an option to set SSL/TLS transport (e.g. does not call mysql_ssl_set()). That probably would be a good feature to add. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Dynamic VLAN with AD/LDAP - Best Practice / preferred option?
by Gary Gatten 27 Apr '10

27 Apr '10

Hello all, I currently have FR v2.1.6 (Yes, I'll upgrade...) running on RHEL5. I'm authenticating VPN users and Ci$co device shell access using SAMBA/ntlm_auth integration. "Everything" is working fine. My next task is assigning Dynamic VLAN ID's. I have some test accounts/ports working using the "users" file, but I'm ready to take the next step to deploy DVLANs company wide, and want to assign the ID based on an AD/LDAP attribute. I prefer not to extend the schema and ideally would be able to assign the VLAN ID based on a "Group" attribute - so I don't have to go back and populate some attribute for a couple thousand users. Anyway, there are numerous posts about this issue / similar issues. I'm wondering if there is a "Best Practice" method or "Preferred" method to accomplish this? A method known to work better than another or works as well as anything but is "easy" to implement, etc. Or, is this one of those things where there is a dozen right answers and I just need to pick one and do it? Any thoughts appreciated! TIA! Gary

2 1

Freeradius against NAS Cisco 7206-VXR
by Wagner Pereira 26 Apr '10

26 Apr '10

Hi, all. Is there a How-To explaining how to implement Radius in this NAS? The IOS version is 12.2 Thanks. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Tel. (11) 3091-8901

2 2

Remote MySQL backend encryption
by Eric.Hernandez＠allegiantair.com 26 Apr '10

26 Apr '10

Hi, I am trying to figure out if need to encrypt my traffic from a FreeRadius server to a remote MySQL backend. I have the following setup. FreeRadius/MySQL (Server1) FreeRadius/MySQL (Server2) Both Server1 and Server2 are doing MySQL Master to Master (ssl) Replication Now I want to add a third FreeRadius server without a local MySQL Backend. So this third server will point to either Server1 or Server2 which runs MySQL but will these request be sent to the remote MySQL Servers in clear text? -Thanks Eric

3 2

Using Radiusclient to implement a radius client on Windows platform?
by Joshua Lim 26 Apr '10

26 Apr '10

Hi I'm a newbie, hope someone can help me. I'm trying to implementing a radius client on Windows platform to work with freeradius. I intend to use VC++ or Delphi. radiusclient is for linux platform, can i adapt it for Windows? Grateful for any pointers. :) Rgds, Joshua

2 3