- Freeradius-Users - lists.freeradius.org

Proxy on Fail.. Or intelligent proxy...Or Utilize multiple acocunt directories
by Larry Ross 09 Feb '10

09 Feb '10

Good afternoon all; I am looking at configuring FR to Auth accounts across multiple account directories. Basically I would like FR to take in PAP queries, attempt Auth against krb, then if that comes back as a fail, try a secondary Radius server (Eduroam...) or module (Shibboleth). We are looking at this as we foresee collisions occurring between accounts residing within other universities and our local guest accounts (which use email address as the principal). Any ideas where and with what I should start testing with (as in create virtual servers an d pass a single success and fail on multi fail..) Thank you Larry

3 2

Help getting rid "Info: WARNING: Child is hung for request" message
by José Manuel 09 Feb '10

09 Feb '10

Hi, I have upgraded recently one of my servers to 2.1.8 (RHEL 5), and am seeing thousands of messages like this in a day. It looks the message was introduced with patch no. 139c45b4c51c945414b53ece36bbeb42edb1b2a7 from November 29. I'm wondering what parameters should I tune to get these messages disappear (and the possible underlying problem fixed, of course). The auth backend is an openldap directory, but I have disregarded any timeout issues by running the server in debug mode. Here are some of the values I guess could be related with the cause of these messages: ------- - radiusd.conf: max_request_time = 30 cleanup_delay = 5 max_requests = 1024 thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } - proxy.conf proxy server{ retry_delay = 5 } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 11812 secret = XXXXX response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } ------- I'd appreciate some light on this issue. Except for the message, the server is behaving correctly. thanks in advance, jose manuel.

2 2

inner vs outer User-Name
by Kenneth Grady 09 Feb '10

09 Feb '10

Is there any way to authorize a user using the inner-tunnel User-Name and not the outer? I get an outer User-Name of anonymous and a reject when searching for authorized users in an ldap group. If they convolute the configuration for the device with an outer User-Name of a person in the ldap group, it authorizes them, and they can authenticate using Kerberos. Mon Feb 8 12:53:21 2010 Packet-Type = Access-Request User-Name = "anonymous" ... Mon Feb 8 12:53:21 2010 Packet-Type = Access-Accept Reply-Message = "case WAREHOUSE" Reply-Message = "not authorized for mygroup" Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "duser" ... Mon Feb 8 14:08:11 2010 Packet-Type = Access-Request User-Name = "duser" ... Mon Feb 8 14:08:11 2010 Packet-Type = Access-Accept Reply-Message = "case WAREHOUSE" Reply-Message = "Warehouse mygroup" Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "duser" /etc/raddb/sites-available/default ... case "WAREHOUSE" { update reply { reply-message += "case WAREHOUSE" } #EMPLOYEE { # need to use the inner-tunnel User-Name #} if ( EMPLOYEE-Ldap-Group == "mygroup" ) { update reply { reply-message += "Warehouse mygroup" } } else { update reply { reply-message += "not authorized for mygroup" } # update config { # Auth-Type := Reject # } } }

2 1

modify realm in authenticate section
by cd 09 Feb '10

09 Feb '10

hi is it possible to modify realm like this ? and then use the realm in users file ..see below Auth-Type ldap { group { ldap_admin { reject = 1 ok = return } if (ok) { update reply { Realm:="admin" } } ldap_peda { reject = 1 ok = return } if (ok) { update reply { Realm:="pedago" } } } } users file DEFAULT Realm=="pedago" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=20, Reply-Message="ok_hostpeda" DEFAULT Realm=="admin" Tunnel-Type=VLAN, Tunnel-Medium-Type=6, Tunnel-Private-Group-ID=10, Reply-Message="ok_hostadmin"

2 1

rlm_caching with freeradius (2.1.7 or 2.1.8)
by Max Mazur 09 Feb '10

09 Feb '10

Hi! I have some strange problems with freeradius (2.1.7 or 2.1.8) and rlm_caching. After module was compliled, it can not be loaded. Error: /etc/raddb/modules/caching[44]: Failed to link to module 'rlm_caching': file not found Error: /etc/raddb/sites-enabled/default[11]: Failed to find module "caching". But as far as I can see using strace, file realy exists, and "not found error" is "fake" error. # strace radiusd -XXX 2>&1 | grep rlm_cach open("/usr/lib/freeradius/rlm_caching.la", O_RDONLY) = 3 read(3, "# rlm_caching.la - a libtool lib"..., 4096) = 1006 open("/usr/lib/freeradius/rlm_caching-2.1.7.so", O_RDONLY) = 3 open("/usr/lib/freeradius/rlm_caching-2.1.7.so", O_RDONLY) = 3 access("/usr/lib/freeradius/rlm_caching.so", R_OK) = 0 open("/usr/lib/freeradius/rlm_caching.so", O_RDONLY) = 3 write(1, "Mon Feb 8 09:46:27 2010 : Error"..., 122Mon Feb 8 09:46:27 2010 : Error: /etc/raddb/modules/caching[44]: Failed to link to module 'rlm_caching': file not found (it possible bug in error message as I can ubderstand) All other modules loaden normally. Any ideas what I have to check? Best regards, Max Mazur

2 1

Radius Proxy Accounting
by Jeremy Brown 09 Feb '10

09 Feb '10

Hi Everyone, I'm trying to setup a FreeRadius server to act as a proxy for another DNS server, and this seems straightforward enough from the documentation, however I also want the FreeRadius proxy to send accounting information to another Radius server. I haven't seen any documentation on how to do this and I'm sure there is a simple way to configure this. Any help or pointers to some documentation would be much appreciated. Best Regards, Jeremy

2 1

Radius + PostgreSQL + MD5 Passwords
by Phillip Smith 08 Feb '10

08 Feb '10

Well I've spent the better part of the last 9 hours trying to figure this out, but I can't seem to get it.... What I am trying to do: Central FreeRADIUS server with PostgreSQL database for remote ChilliSpot appliances to auth against. My problem: I'm strongly against storing passwords in clear text so I want the passwords in PostgreSQL to be MD5 or SHA1 hashed. Everything I've read through Google seems to be indicating that for any form of encryption to work between the client and server, that the database has to use clear text passwords. I have successfully got the FreeRADIUS + PostgreSQL combination working with clear text, but I can not make the move to hashed passwords. 1) It what I am trying to do possible? 2) If so, is it possible without any significant drawbacks? 3) Any pointers in the right direction to how to achieve what I am after? Cheers, ~p

3 6

NAS Client Behind a NAT Router
by Fahd Kasri 08 Feb '10

08 Feb '10

Hi, Suppose I have a client that's behind a NAT router and uses a Freeradius server that's on another network. What ports (if any) should be redirected to the client in order to have full functionality? Thanks. -- Fahd

2 5

Run user defined scripts on client connect and disconnect
by Josh Willmarth 08 Feb '10

08 Feb '10

Hello, I have a radius server setup with version 2.1.8. Is there a way that I can have custom scripts run each time a user successfully connects to and disconnects from my radius server? If so, what environment variables can be passed to these scripts? Sorry if I missed this in the documentation, but I was unable to find the exact answer I am looking for. Thank you, Josh Willmarth

4 4

Invitation to connect on LinkedIn
by Eduardo Gui 08 Feb '10

08 Feb '10

LinkedIn ------------Eduardo Gui requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, I'd like to add you to my professional network on LinkedIn. - Eduardo Accept invitation from Eduardo Gui http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… View invitation from Eduardo Gui http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… ------------------------------------------ DID YOU KNOW that LinkedIn can find the answers to your most difficult questions? Post those vexing questions on LinkedIn Answers to tap into the knowledge of the world's foremost business experts: http://www.linkedin.com/e/ask/inv-23/ ------ (c) 2010, LinkedIn Corporation

1 0