- Freeradius-Users - lists.freeradius.org

Authentication failed from Radius server
by Aravind Arjunan 07 Jan '09

07 Jan '09

Radius(freeradius) server has configured and integrated with Openldap server for user authentication in RHEL 5. Using radtest, NTRadPing and Radiustest (Utility) it is working fine. I got Access-Acept by using this utility. When i try from enduser through Wireless access point i may not able to authenticate. Wireless access point is configured with WPA for security. >From the radius debug level log and slapd log i can able to see that it can able to fetch username and it was successful but in the case of userPassword authetication was getting failed. How to send the User-Password in clear text format.? Is there any way to decrypt the userpassword in RADIUS server which was coming from access point.? here is the radius debug level log rad_recv: Access-Request packet from host 192.168.1.100:1645, id=45, length=130 * User-Name = "sivaji"* Framed-MTU = 1400 Called-Station-Id = "0023.045c.3f20" Calling-Station-Id = "001f.3c78.503a" Service-Type = Login-User Message-Authenticator = 0xd56b1bff210c624ccf5b1d5c56285f10 EAP-Message = 0x0202000b01736976616a69 NAS-Port-Type = Wireless-802.11 NAS-Port = 542 NAS-Port-Id = "542" NAS-IP-Address = 192.168.1.100 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 *rlm_realm: No '@' in User-Name = "sivaji", looking up realm NULL* * rlm_realm: No such realm "NULL"* modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 157 * modcall[authorize]: module "files" returns ok for request 0* rlm_ldap: - authorize rlm_ldap: performing user authorization for sivaji *radius_xlat: '(uid=sivaji)'* *radius_xlat: 'dc=rgipt,dc=in'* rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 *rlm_ldap: bind as / to localhost:389* *rlm_ldap: waiting for bind result ...* *rlm_ldap: Bind was successful* *rlm_ldap: performing search in dc=rgipt,dc=in, with filter (uid=sivaji)* rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... *rlm_ldap: user sivaji authorized to use remote access* rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 *rlm_ldap: - authenticate* *rlm_ldap: Attribute "User-Password" is required for authentication.* * * * modcall[authenticate]: module "ldap" returns invalid for request 0* *modcall: leaving group LDAP (returns invalid) for request 0* *auth: Failed to validate the user.* *Login incorrect: [sivaji] (from client AP port 542 cli 001f.3c78.503a)* *Delaying request 0 for 1 seconds* *Finished request 0* Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 45 to 192.168.1.100 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 45 with timestamp 4960b0d2 Nothing to do. Sleeping until we see a request.

2 3

radiusd logs good passwords even when told not to?
by Tim Eberhard 06 Jan '09

06 Jan '09

Background info: # uname -a Linux removed.com 2.6.9-67.0.22.EL #1 Wed Jul 23 17:17:45 EDT 2008 i686 i686 i386 GNU/Linux Free radius installed via a RPM: # rpm -qa | grep radius freeradius-1.0.1-3.RHEL4.5 # radiusd -v radiusd: FreeRADIUS Version 1.0.1, for host , built on Apr 25 2007 at 08:19:46 Copyright (C) 2000-2003 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. We start/stop it via the init.d script which states: RADIUSD=/usr/sbin/radiusd LOCKF=/var/lock/subsys/radiusd CONFIG=/etc/raddb/radiusd.conf Our /etc/raddb/radiusd.conf clearly states to not log passwords: # allowed values: {no, yes} # log_auth_badpass = no log_auth_goodpass = no However it's logging good password auth's still.. # ll /etc/radacct/ | wc -l 631 # cat auth-detail-20081023 Packet-Type = Access-Request <removed> User-Name = "username" User-Password = "password" NAS-IP-Address = 127.0.0.1 Client-IP-Address = 127.0.0.1 Starting it manually with debug turned on here is what I see.. # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/" main: localstatedir = "//var" main: logdir = "/var/log" main: libdir = "//lib" main: radacctdir = "/etc/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "//var/run/radiusd/radiusd.pid" main: bind_address = 192.168.1.1 IP address [192.168.1.1] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "//sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/etc/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/etc/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 192.168.1.1:1812 Listening on accounting 192.168.1.1:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.10.10:2702, id=165, length=53 User-Name = "username" User-Password = "removed" NAS-IP-Address = 10.10.10.10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/etc/radacct/10.10.10.10/auth-detail-20090106' rlm_detail: /etc/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /etc/radacct/10.10.10.10/auth-detail-20090106 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_realm: No '@' in User-Name = "username", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched DEFAULT at 153 users: Matched username at 316 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: group authenticate returns ok for request 0 Login OK: [username] (from client hostname.com port 0) Sending Access-Accept of id 165 to 10.10.10.10:2702 NS-Admin-Privilege = All-VSYS-Root-Admin Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... You can see it touched and updated the file with the new record.. # ll total 4 -rw------- 1 root root 342 Jan 6 10:17 auth-detail-20090106 So why is it doing this? How can I stop it? Ideally I would like radius to NOT store passwords in plain-text.. Any help is appreciated, thanks all! -Tim Eberhard

3 4

sending attributes from sql
by Andrew Long 05 Jan '09

05 Jan '09

Looking for a little guidance on how to send user specific attributes to over-ride NAS defaults. NAS is a Colubris MSC-3200. In their public access guide, Colubris explains how to set a welcome-url for different groups... ie. "Add the following entry to the RADIUS profile for the basic cust welcome-url=web_server_URL/basic/welcome.html goodbye-url=web_server_URL/basic/goodbye.html Add the following entry to the RADIUS profile for the premium cust welcome-url=web_server_URL/premium/welcome.html goodbye-url=web_server_URL/premium/goodbye.html" I have: mysql> select username,attribute,op,value from radreply; +-----------+--------------------+----+-----------------------------------------------------------------------+ | username | attribute | op | value | +-----------+--------------------+----+-----------------------------------------------------------------------+ | ewsandbox | Colubris-AVPair | += | access-list=loginserver,ACCEPT,tcp,192.168.10.23,all | | ewsandbox | Colubris-AVPair | += | use-access-list=loginserver | | ewsandbox | Colubris-AVPair | += | login-url=http://192.168.10.23/hotspots/ewsandbox/login.html | | ewsandbox | Colubris-AVPair | += | session-page=http://192.168.10.23/hotspots/ewsandbox/session.html | | ewsandbox | Colubris-AVPair | += | fail-page=http://192.168.10.23/hotspots/ewsandbox/fail.html | | ewsandbox | Colubris-AVPair | += | transport-page=http://192.168.10.23/hotspots/ewsandbox/transport.html | | fred | Service-Type | = | Framed-User | | fred | Framed-Protocol | = | PPP | | fred | Framed-IP-Address | = | 192.168.1.55 | | fred | Framed-IP-Netmask | = | 255.255.255.0 | | fred | Framed-Routing | = | Broadcast-Listen | | fred | Framed-Filter-Id | = | std.ppp | | fred | Framed-MTU | = | 1500 | | fred | Framed-Compression | = | Van-Jacobsen-TCP-IP | | fred | Colubris-AVPair | += | welcome-url=http://www.escapewire.com | +-----------+--------------------+----+-----------------------------------------------------------------------+ Colubris-AVPair is defined in the supplied dictionary, but I find that although the attribute is sent... Sending Access-Accept of id 217 to 192.168.10.30 port 32770 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.1.55 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Colubris-AVPair += "welcome-url=http://www.escapewire.com" MS-CHAP2-Success = 0xd9533d33434337424430333430374637464633424639433338323739464444364530324237393137333736 MS-MPPE-Recv-Key = 0xd0ceed0c246d4cf37fd9586a5098b5f4 MS-MPPE-Send-Key = 0xc7928fb94ffcb4acc06a838dfaa933f7 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 8. That the redirection is not working. I also tried with a modified radreply entry, simply using welcome-url as the attribute and op of := (after defining welcome-url in the dictionary), but this does not work either. I understand the list is not support for Colubris, but I hope someone with more experience can tell me how I might be misinterpreting the instructions. Thank you. Andrew Long FreeRADIUS Ver. 2.1.3 Backend: MySQL

1 0

[HELP] FreeRadius and External Script
by Phibee Network Operation Center 05 Jan '09

05 Jan '09

Hi i request your help because i don't understand the process of FreeRadius and i am limited in the time ;=) Very thanks to all men that accept to help me. I have installed FreeRadius and my Cisco can talk with it without problems. Now i want that FreeRadius start a perl script for get the authentification. i have read a HOWTO and used example.pl but with no real success because all request are valided. When i start manually the script, we have: ./example.pl: line 26: use: command not found ./example.pl: line 29: syntax error near unexpected token `(' ./example.pl: line 29: `use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK);' i thinks that when freeradius start the script, he have the same message and valid the connexion no ? What is the good process for create a small script ? Thanks jerome

4 7

newbie new freeradius install fails to start...
by John Williams 05 Jan '09

05 Jan '09

Hello, Maybe someone can guide me out of this maze. I have a new Fedora 10 install running on Dell intel platform. I installed freeradius.i386 0:2.1.3-1.fc10 package using yum installer. All I did before starting in debug mode was edit clients.conf and users file. I get this error at the end of the config file parse each time I attempt to start "radiusd -X" <paste> /etc/raddb/certs/bootstrap: line 15: make: command not found Exec-Program output: Exec-Program: returned: 127 rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } Errors initializing modules <end paste> If someone could help I'd be really happy. Thanks, jw

5 6

somewhat ot: Check radius server name on linux supplicant
by Sergio Belkin 05 Jan '09

05 Jan '09

Hi, I'm stuck with a problem to which I haven't found an easy solution. Let's say we use either EAP-PEAP or EAP-TTLS. Both on Windows you cave ways to check not only ca certificate but also radius server name. I've tried: *NetworkManager: It can't check radius server name. *wicd: You could use customized scripts but make things harder and replace NetworkManager which is the default network tool on modern distros. *kwlan: It's like wicd an more KDE oriented. *wpasupplicant: It can check server name! But also on Fedora 10 I haven't found a way for NetworkManager apply its config file. Mostly "modern" and end users distros don't pay attention to wpasupplicant config file. On Windows (and I am not presicely a MS fan) you can check server name either by itself or by SecureW2. On Mac it prompts you showing radius server name. Sadly, I haven't found on Linux to check radius server name. I fear this: Let's say I have a radius server which use a certificate signed by WhateverSign. You get a certificate signed by WhateverSign too. You use a trustable ca certificate, don't you? Well, you config a cheating Access Point. Then a user come and connect to that cheating Access Point. Please tell me if that risk exists and if is wothy of worrying. If it is, how I can do for check radius server name on modern distro Linux? Thanks in advance and happy new year!!!! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 1

Re:freeradius doesn't sent information to mysql
by Eric 05 Jan '09

05 Jan '09

In vpn server or accounting server? > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > > >rad_recv: Accounting-Request packet from host 10.10.10.3:11858, id=133, > >length=260 > > Acct-Status-Type = Start > > Acct-Delay-Time = 0 > > NAS-IP-Address = 10.10.10.3 > > Service-Type = Framed-User > > Framed-Protocol = PPP > > NAS-Port = 4 > > MS-RAS-Vendor = 311 > > MS-RAS-Version = "MSRASV5.20" > > NAS-Port-Type = Virtual > > Tunnel-Type:0 = PPTP > > Tunnel-Medium-Type:0 = IP > > Calling-Station-Id = "192.168.201.59" > > Tunnel-Client-Endpoint:0 = "192.168.201.59" > > Microsoft-Attr-35 = 0x4d5352415356352e3130 > > Microsoft-Attr-34 = > 0x4d535241532d302d312d34304432454332364243374334 > > Acct-Session-Id = "118382" > > User-Name = "school" > > Framed-IP-Address = 10.10.10.4 > > Framed-MTU = 1400 > > Session-Timeout = 389554 > > Idle-Timeout = 1200 > > Acct-Multi-Session-Id = "953" > > Acct-Link-Count = 1 > > Event-Timestamp = "Dec 31 2008 15:45:03 IRST" > > Acct-Authentic = RADIUS > > MS-MPPE-Encryption-Types = 0x00000000 > >Sending Accounting-Response of id 133 to 10.10.10.3 port 11858 > > > > You haven't got anything configured in the accounting section. > > Ivan Kalik > Kalik Informatika ISP > >

1 0

Bring India together
by Sunkara RaviPrakash 04 Jan '09

04 Jan '09

1 0

problem with WLAN+MYSQL
by x03ml 04 Jan '09

04 Jan '09

hello list, i have a litle problem here. I setup freeradius to work with mysql and an access point together. when i start the freeradius i have this: (a lot of output) rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to hotspot@localhost:/hotspot rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.rad_recv: Access-Request packet from host 10.10.10.251:1812, id=61, length=71 User-Name = "x03" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000801783033 NAS-IP-Address = 10.10.10.251 Message-Authenticator = 0x85068ed9e75d7bde97669e3960e6342f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: 'x03' rlm_sql (sql): sql_set_user escaped user --> 'x03' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = BINARY 'x03' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'x03' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = BINARY 'x03' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'x03' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 and the client cant authenticate. i think i dont need the MS-CHAP and Auth-Type local, but i have all of that commented in my radiusd.conf someone have a clue about this? thanks a lot if i ask for a test with radtest from a computer in lan i get success, but if i ask to ap auth me i get this in freeradius output:

2 2

Strategy for grouping users for authentication
by Alex French 03 Jan '09

03 Jan '09

Hi, We are using Freeradius 1.1.7 to authenticate a large group of users for one service, with a pgsql backend. I would now like to start using our radius servers to also authenticate other groups of users for specific services, e.g. admin users who can access an apache frontend etc using PAM. My question is, what's the best way to classify and group the users to ensure that group X can access one service but group Y can access another, etc? My first thought is to use an attribute like the NAS-Id to identify the service and require certain user groups for each Nas id in the clients file. However, this does not allow any more granularity than the machine making the request -- for example, login, POP and httpd may all be on the same server but have different groups that should be able to access them. Can anyone point me in the right direction? Thanks, Alex

3 3