- Freeradius-Users - lists.freeradius.org

Re: sql groups authorization
by Happyfrog 06 Jun '07

06 Jun '07

Hello Ivan, Thanks for the reply. I've tried that configuration too, but there was some problem (don't remember exactly), and finally decided to keep all the information in the database. With best regards, Andrew. > Why not you use huntgroups: > > HGdial NAS-IP-Address == dial NAS IP > SQL-Group = dialup, > ... other dial groups > > HGWiFi NAS-IP-Address == WiFi NAS IP > SQL-Group = wifi, > ... other wifi groups > > etc. > > Ivan Kalik > Kalik Informatika ISP

1 0

sql groups authorization
by Happyfrog 06 Jun '07

06 Jun '07

Hello Gurus, I need to set up FR with SQL (Postgres) backend storing all users/groups information except clients.conf. Groups are mission-critical, because the same user can come from different NASes (WiFi, Dial-Up, VPDN) and should get different settings (IP addresses etc). Access to different services is granting through radusergroup table, where user belong or not belong to corresponding group. If user doesn't belong do group 'dialup' but come from Dial-Up NAS, it should be rejected even with correct password. That access idea seems to me very simple, but I've spend many days getting it to work state. First of all, i realized that documented rlm_sql `read_groups' directive don't affect on sql_config structure read_groups member. This patch fixes that issue: diff ./src/modules/rlm_sql/rlm_sql.c.orig ./src/modules/rlm_sql/rlm_sql.c 104a105,106 > {"read_groups", PW_TYPE_BOOLEAN, > offsetof(SQL_CONFIG,read_groups), NULL, "yes"}, Well, that didn't fix the problem. Now rlm_sql successfully find the user in radcheck table, setting found=1, and then check groups. The problem is that found remains =1 in case of group check failure (rlm_sql_process_groups returns 0). diff ./src/modules/rlm_sql/rlm_sql.c.orig ./src/modules/rlm_sql/rlm_sql.c This patch fixes that issue (line numbers are correct for original file without first patch): 988a989,991 > } else { > /* no matched group found => decline the user */ > found = 0; Well, that also didn't fix the problem. Now rlm_sql returns RLM_MODULE_NOTFOUND, but for FR it doesn'd mean 'reject the user immediately', and after processing of next modules, the user is accepted without any groups. This patch fixes that issue: diff ./src/modules/rlm_sql/rlm_sql.c.orig ./src/modules/rlm_sql/rlm_sql.c 1044c1044 < return RLM_MODULE_NOTFOUND; --- > return RLM_MODULE_REJECT; After that patch the FR (CVS 20070605) is working as expected. here is some database data: radchek table contains only user passwords: # select * from radcheck; id | username | attribute | op | value ----+-------------+----------------+----+------------------------------------ 1 | guest | Crypt-Password | == | $....... ... radreply table is empty radusergroup table contains user to groups mappings: # select * from radusergroup; username | groupname | priority -------------+---------------+---------- guest | dialup_guests | 3 ... radgroupcheck table contains attributes to distinguish NASes, set Pool-Names and some other unimportant things: # select * from radgroupcheck; id | groupname | attribute | op | value ----+----------------+------------------+----+------------------ 3 | dialup_guests | NAS-IP-Address | == | 192.168.0.1 7 | dialup_guests | Pool-Name | := | dialup_pool ... radgroupreply table contains nothing special: # select * from radgroupreply; id | groupname | attribute | op | value ----+---------------+-----------------+----+------- 1 | dialup_guests | Session-Timeout | := | 900 ... I'm pretty sure that there is more straight way to do the same thing. If someone have another solution, please tell. I would be happy if this info will help somebody. Any comments are greatly appreciated. Best regards, Andrew.

2 1

RE: EAP-TLS problem
by Wolfgang Burger 06 Jun '07

06 Jun '07

On Tue, 5 Jun 2007 17:37:23 +0100 (BST) shantanu choudhary <shantanu_843(a)yahoo.co.in> wrote: > If u know really gud online help >available please let me kno Try http://homepage.mac.com/andreaswolf/public/wpaeap.html It won´t make you understand certificates. But it allows you to set up a running solution. >From there, it´s easier to figure out, what you have actually done with all those scripts. Regards Wolfgang Burger

1 0

Dynamic VLAN-Assigning with Dell PowerConnect 3448
by André Graf 06 Jun '07

06 Jun '07

Hi List Since hours i am trying to get dynamic vlan-assigning working with a Dell PowerConnect 3448 Switch and Freeradius 1.1.6. In my Users-File I have the following Default-Entry (like seen in some other tutorials, often used with Cisco-devices). DEFAULT Auth-Type := EAP Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 110 The authentication succeed, but I don't fall in to the defined VLAN. (I always fall in to the Switch-Default-VLAN #1) Are there some kind of "special" settings with this DELL-Switch or is there an other solution for my problem? Thank you for your answers! Greetings Andre

2 2

EAP-TLS problem
by shantanu choudhary 06 Jun '07

06 Jun '07

hi all, i m trying to get EAP-TLS working for free radius, but i m not able to figure out how to handle all those certificates. Can u tell me how are u using those certificates and are u using openssl for generating those certificates and do need to run openssl explicitly along with radius server to check client certifiates, and how to transfere those certificates to client. there is lot of help available and i tried few with some unsuccessful attempts. If u know really gud online help available please let me know... regards shantanu --------------------------------- Download prohibited? No problem! CHAT from any browser, without download.

2 1

configuration
by parfait kouassi nda 06 Jun '07

06 Jun '07

i want to configure my freeradius server to be a proxy server! can i have the config of the modification of freeradius's files? My proxy's server must turn with IAS of windows server 2003! thanks! _________________________________________________________________ MSN Messenger : discutez en direct avec vos amis ! http://www.msn.fr/msger/default.asp

3 4

log file for eap-tls with free radius 1.1.6
by anoop_c＠sifycorp.com 05 Jun '07

05 Jun '07

Hi In log file i am not able to get anyhting.First time i got one log saying its started and all. After that if again i start the server no logs are coming.But if i run in debug mode (RADIUS -X) its throwing all procedure and user is able to connect also Due to this i am unabe to change my prodution server from Navis radius to free radius Regards Anoop

1 0

Reject realm-based vol.2
by Nicola Iotti 05 Jun '07

05 Jun '07

Hi all, thank you for answers...but I think my problem is a little different...we have to reject request with a specified realm, not without realm. I mean for example we have to reject immediately requests with realm = 'office01' and to proxy requests with realm = 'office02' Regards >Hi all, > we use Freeradius as proxy based on prefix realm. >We have to send an immediate reject reply to requests with a specified >realm >At the moment our freeradius proxy sends these requests to an IP >address >assigned to nothing...Is there a better way to do this?

2 1

Binding variable (Oracle)
by Сергей Липин 05 Jun '07

05 Jun '07

Hi all, I'm use FreeRadius as DHCP server (sqlippool). Data Base is Oracle 10g. Freeradius+Oracle. How to use binding variable in Oracle?

1 0

Reject realm-based
by Nicola Iotti 05 Jun '07

05 Jun '07

Hi all, we use Freeradius as proxy based on prefix realm. We have to send an immediate reject reply to requests with a specified realm At the moment our freeradius proxy sends these requests to an IP address assigned to nothing...Is there a better way to do this?

2 1