- Freeradius-Users - lists.freeradius.org

RE: Re: freeradius -peap ad/ldap
by Sam Schultz 15 Mar '07

15 Mar '07

>> DEFAULT <check_items (ex: Realm == 'your_domain')> >> Autz-Type := <your_ldap_instance (ex: ldap)>, >> Auth-Type := <module_instance_for_authentication> >so i did what you recommended, which makes sense to do... i have >Autz-type := eap, and in debug mode i get this clearly an access- reject >follows. > >auth: No authenticate method (Auth-Type) configuration found for the >request: Rejecting the user >auth: Failed to validate the user. First off, eap shouldn't be used this way. The top line of eap.conf clearly states: "Whatever you do, do NOT set 'Auth-Type := EAP'. The server is smart enough to figure this out on its own" Typical modules that would be used here are things like 'files', 'ldap', or 'sql'. There are also special types like 'Local' & 'System', which you'd have to use one of if you were using an sql table to store user credentials. The second thing you have to understand is the difference between modules & instances. An instance is a specific configuration of a module. The instance itself has a name that is user-specified. I suggest you read through the configurable_failover document, which is usually in /usr/share/doc/freeradius-<version>, it isn't long and offers pretty good insight into how freeradius' configuration gets processed. Also, if you need to use a seperate back-end for authentication, maybe you should tell us what you need to use so we can give you more specific answers. -- Click for free info on online degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1WBTC2SZD08y4Fk4U6rprEfbhG/

2 1

(no subject)
by markcapelle＠pcmc.com 15 Mar '07

15 Mar '07

Actually, I don't think this will help since the wireless controller IP that freeradius "sees" is *not* in the 192.168.100.* range. This controller uses LWAPP, so the IP ranges that the wireless networks use are totally contained within the wireless infrastructure, which means that the NAS IP is actually the LAN IP address of the controller. Again, it appears the only way for my to determine that the client request is coming from the wrong subnet is via the "cli" value. If Cisco would just fix the guest wireless implementation to only look at the internal database or give you an option to specify this, all would be well. But... since they don't, I have to figure out how to break RADIUS for one subnet and yet allow it to function for the rest. -----Original Message----- From: Sam Schultz [mailto:segfault90@hushmail.com] Sent: Thursday, March 15, 2007 12:46 PM To: freeradius-users(a)lists.freeradius.org; Capelle, Mark (PCMC-GB) Subject: Re: Reject authentication attempts based on "cli" value? An entry like this in your 'users' file should work: DEFAULT NASIPAddress =~ "192.168.100.*" Auth-Type := Reject I'm not sure '*' is the appropriate regular expression character for freeradius, but you should be able to verify that pretty quickly from the documentation. Operator information itself can be found on: http://wiki.freeradius.org/Operators On Thu, 15 Mar 2007 11:23:23 -0500 markcapelle(a)pcmc.com wrote: >It is a Cisco WLAN 4402. For reference, here is a log entry from a >user connecting from the Guest network: > > Thu Mar 15 07:10:52 2007 : Auth: Login OK: [guestuser] (from client >PCMCWLANCTRLR1 port 0 cli 192.168.100.101) > >And here is a log entry from someone connecting via 802.1x on another >network: > > Thu Mar 15 07:26:36 2007 : Auth: Login OK: [DOMAIN\\guestuser] (from >client PCMCWLANCTRLR1 port 1 cli 00-12-F0-19-6E-B3) > >As you can see the only way I have to differentiate these two auth >attempts is via the "cli" value. 192.168.100.x is the subnet range of >my Guest network. I want all auth attempts from 192.168.100.x to be >rejected. > >Hope someone can help me out with this. > >Thanks. > >>Date: Thu, 15 Mar 2007 10:55:55 -0400 >>From: "King, Michael" <MKing(a)bridgew.edu> >>Subject: RE: >>To: "FreeRadius users mailing list" >> <freeradius-users(a)lists.freeradius.org> >>Message-ID: >> ><6641F169E241EA40B29DE7BFAD24674DA7A43B(a)EXCH2.campus.bridgew.edu> >>Content-Type: text/plain; charset="iso-8859-1" >> >>What manufacturer makes the NAS (the wireless controller?) >> >>I would look to the Called-Station field. Usually (Based on >Cisco AP's) >this is the MAC of the AP, followed by the SSID they connected to. >> >>> -----Original Message----- >>> From: >>> freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or >>> g >>> [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer >>> adius.org] On Behalf Of markcapelle(a)pcmc.com >>> Sent: Thursday, March 15, 2007 10:48 AM >>> To: freeradius-users(a)lists.freeradius.org >>> Subject: >>> >>> I have a situation where I have a wireless controller that >services >>> multiple wireless networks (vlans).? When the controller >contacts the >>> RADIUS server with an authentication request, it does so with >the IP >>> address of the controller as the client address.? The problem >is I >>> have a guest network that has lower security than my other >wireless >>> networks.? The guest network has it's own user/password >database >>> stored in the controller, but the way authentication occurs is >that it >>> checks RADIUS for the user first and assumes it will fail, then >will >>> use the internal database.? The issue with this is that if one >of my >>> users jumps on the guest network, they are authenticated which >is not >>> what I want to happen.? Looking at the logs, I noticed that all >the >>> guest network users have the IP address of the client in the >"cli" >>> field.? My guest network is a totally different VLAN and IP >subnet. >>> >>> Is there a way to key off of the "cli" field and then make it >so that >>> all requests from clients with a specific subnet in this field >are not >>> authenticated?? This would stop my internal users from >connecting, but >>> allow the correct users (those in the internal DB) to still get >>> connected. >>> >>> Thanks. >>> CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets >or >>> privileged, undisclosed or otherwise confidential information. >If you >>> have received this e-mail in error, you are hereby notified >that any >>> review, copying or distribution of this message in whole or in >part is >>> strictly prohibited. >>> Please inform the sender immediately and destroy the original >>> transmittal. Thank you for your cooperation. >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >>> > CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or >privileged, undisclosed or otherwise confidential information. If you >have received this e-mail in error, you are hereby notified that any >review, copying or distribution of this message in whole or in part is >strictly prohibited. Please inform the sender immediately and destroy >the original transmittal. Thank you for your cooperation. > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of this message in whole or in part is strictly prohibited. Please inform the sender immediately and destroy the original transmittal. Thank you for your cooperation.

1 0

Fedora RPM build issue
by Chris Moody 15 Mar '07

15 Mar '07

Greetings all, I am trying to create an RPM of Freeradius 1.1.5 for a Fedora Core 6 install, and following the instructions in the Wiki, the build process dies with this at the end: c/include -Ilibeap -c rlm_eap.c -fPIC -DPIC -o .libs/rlm_eap.o In file included from rlm_eap.c:26: rlm_eap.h:26:18: error: ltdl.h: No such file or directory In file included from rlm_eap.c:26: rlm_eap.h:36: error: expected specifier-qualifier-list before 'lt_dlhandle' rlm_eap.c: In function 'eap_authenticate': rlm_eap.c:285: warning: passing argument 5 of 'request_data_add' from incompatible pointer type rlm_eap.c:308: warning: passing argument 5 of 'request_data_add' from incompatible pointer type rlm_eap.c:388: warning: pointer targets in passing argument 2 of 'pairmake' differ in signedness rlm_eap.c: In function 'eap_post_proxy': rlm_eap.c:547: warning: pointer targets in passing argument 2 of 'pairmake' differ in signedness rlm_eap.c:580: warning: pointer targets in passing argument 1 of 'strncasecmp' differ in signedness rlm_eap.c:605: warning: pointer targets in passing argument 4 of 'rad_tunnel_pwdecode' differ in signedness rlm_eap.c:616: warning: pointer targets in passing argument 1 of 'rad_tunnel_pwencode' differ in signedness rlm_eap.c:616: warning: pointer targets in passing argument 4 of 'rad_tunnel_pwencode' differ in signedness gmake[6]: *** [rlm_eap.lo] Error 1 gmake[6]: Leaving directory `/root/rpmbuild/BUILD/freeradius-1.1.5/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/rpmbuild/BUILD/freeradius-1.1.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/rpmbuild/BUILD/freeradius-1.1.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/rpmbuild/BUILD/freeradius-1.1.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/rpmbuild/BUILD/freeradius-1.1.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/rpmbuild/BUILD/freeradius-1.1.5' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.72903 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.72903 (%build) Not being a wiz at this, I'm at a dead end. Any help? Thanks! -C

2 2

Re: freeradius -peap ad/ldap
by Sam Schultz 15 Mar '07

15 Mar '07

On Thu, 15 Mar 2007 10:57:29 -0500 joe vieira <jvieira(a)clarku.edu> wrote: >Alan DeKok wrote: >> joe vieira wrote: >> >>> i have eap-peap authentication working against our ad domain. >peachy >>> keen. what i would like to be able to do is, in our openldap >>> environment, store attributes for retrieval by radius, cisco >stuff/ >>> etc... i assume the way to do this would be to use the >authorization >>> sections, but if you add ldap to that then it automatically >adds ldap >>> authentication...which i don't want.. >>> >> >> Upgrade to a newer version of the server, which doesn't do >that. >> >which versions would that be? OK, I think I understand what you're asking. If you want to use LDAP for authorization ONLY, and something else for authentication, you could put an entry like this in your 'users' file: DEFAULT <check_items (ex: Realm == 'your_domain')> Autz-Type := <your_ldap_instance (ex: ldap)>, Auth-Type := <module_instance_for_authentication> Setting Autz-Type forces a certain type of authorization. Setting Auth-Type forces a certain type of authentication. Doing this in a DEFAULT entry causes ALL users that have Fall-Through set to yes to be passed through the specified authorization & authentication method. This could also be set on a per-user basis by changing DEFAULT to the a given user's username. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click here for free information on nursing jobs, up to $150/hour http://tagline.hushmail.com/fc/CAaCXv1Rz1mAIkYFfrrMgKeHIMrG3Yzo/

2 1

Compile problems on Solaris 10
by Paul Goodman 15 Mar '07

15 Mar '07

I am trying to compile the pam_radius-1.3.16 modules on a Solaris 10 system, but when I run make, I get the following error: gcc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o In file included from pam_radius_auth.h:23, from pam_radius_auth.c:63: md5.h:21: error: syntax error before 'u_int32_t' md5.h:21: warning: no semicolon at end of struct or union md5.h:22: warning: type defaults to 'int' in declaration of 'bits' md5.h:22: warning: data definition has no type or storage class md5.h:24: error: syntax error before '}' token md5.h:29: error: syntax error before 'buf' pam_radius_auth.c: In function 'get_random_vector': pam_radius_auth.c:350: error: storage size of 'my_md5' isn't known pam_radius_auth.c:350: warning: unused variable 'my_md5' pam_radius_auth.c: In function 'get_accounting_vector': pam_radius_auth.c:382: error: storage size of 'my_md5' isn't known pam_radius_auth.c:382: warning: unused variable 'my_md5' pam_radius_auth.c: In function 'verify_packet': pam_radius_auth.c:400: error: storage size of 'my_md5' isn't known pam_radius_auth.c:400: warning: unused variable 'my_md5' pam_radius_auth.c: In function 'add_password': pam_radius_auth.c:497: error: storage size of 'md5_secret' isn't known pam_radius_auth.c:497: error: storage size of 'my_md5' isn't known pam_radius_auth.c:497: warning: unused variable 'my_md5' pam_radius_auth.c:497: warning: unused variable 'md5_secret' pam_radius_auth.c: In function 'rad_converse': pam_radius_auth.c:1016: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1019: warning: passing argument 2 of 'conv->conv' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_authenticate': pam_radius_auth.c:1071: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1099: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1113: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1146: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c: In function 'pam_private_session': pam_radius_auth.c:1267: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1288: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_chauthtok': pam_radius_auth.c:1374: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1395: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1404: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1409: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type gmake: *** [pam_radius_auth.o] Error 1 The same is true when I use the Sun cc (Studio 11 compiler). I am using gcc 4.0.2 (the most recent version I could get to run on Solaris). Output of uname -a is: SunOS xxxx 5.10 Generic_118833-36 sun4u sparc SUNW,A70 Does anyone have a suggestion as to how to modify the header file to make it work or know where I can find pre-compiled modules for Solaris?

2 2

Re: Fedora RPM build issue
by Sam Schultz 15 Mar '07

15 Mar '07

On Thu, 15 Mar 2007 12:17:11 -0500 Chris Moody <Chris.Moody@axiom- tech.net> wrote: >Greetings all, > >I am trying to create an RPM of Freeradius 1.1.5 for a Fedora Core >6 >install, and following the instructions in the Wiki, the build >process >dies with this at the end: > >c/include -Ilibeap -c rlm_eap.c -fPIC -DPIC -o .libs/rlm_eap.o In >file >included from rlm_eap.c:26: >rlm_eap.h:26:18: error: ltdl.h: No such file or directory In file Your problem is you don't have libtdl-devel installed, and maybe not even libtdl. The errors that come up after this point are probably just the compiler's laments about not having the libtdl includes (There could be errors, too. I stopped looking after the line above) >included from rlm_eap.c:26: >rlm_eap.h:36: error: expected specifier-qualifier-list before >'lt_dlhandle' >rlm_eap.c: In function 'eap_authenticate': >rlm_eap.c:285: warning: passing argument 5 of 'request_data_add' >from >incompatible pointer type >rlm_eap.c:308: warning: passing argument 5 of 'request_data_add' >from >incompatible pointer type >rlm_eap.c:388: warning: pointer targets in passing argument 2 of >'pairmake' differ in signedness >rlm_eap.c: In function 'eap_post_proxy': >rlm_eap.c:547: warning: pointer targets in passing argument 2 of >'pairmake' differ in signedness >rlm_eap.c:580: warning: pointer targets in passing argument 1 of >'strncasecmp' differ in signedness >rlm_eap.c:605: warning: pointer targets in passing argument 4 of >'rad_tunnel_pwdecode' differ in signedness >rlm_eap.c:616: warning: pointer targets in passing argument 1 of >'rad_tunnel_pwencode' differ in signedness >rlm_eap.c:616: warning: pointer targets in passing argument 4 of >'rad_tunnel_pwencode' differ in signedness >gmake[6]: *** [rlm_eap.lo] Error 1 >gmake[6]: Leaving directory >`/root/rpmbuild/BUILD/freeradius-1.1.5/src/modules/rlm_eap' >gmake[5]: *** [common] Error 2 >gmake[5]: Leaving directory >`/root/rpmbuild/BUILD/freeradius-1.1.5/src/modules' >gmake[4]: *** [all] Error 2 >gmake[4]: Leaving directory >`/root/rpmbuild/BUILD/freeradius-1.1.5/src/modules' >gmake[3]: *** [common] Error 2 >gmake[3]: Leaving directory `/root/rpmbuild/BUILD/freeradius- >1.1.5/src' >gmake[2]: *** [all] Error 2 >gmake[2]: Leaving directory `/root/rpmbuild/BUILD/freeradius- >1.1.5/src' >gmake[1]: *** [common] Error 2 >gmake[1]: Leaving directory `/root/rpmbuild/BUILD/freeradius- >1.1.5' >make: *** [all] Error 2 >error: Bad exit status from /var/tmp/rpm-tmp.72903 (%build) > > >RPM build errors: > Bad exit status from /var/tmp/rpm-tmp.72903 (%build) > >Not being a wiz at this, I'm at a dead end. Any help? > >Thanks! > >-C > > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on online masters degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S74nxrxmtHSCjwCfRWR2eI8wV/

1 0

Re: RE : EAP-TTLS outer identity & accounting
by Sam Schultz 15 Mar '07

15 Mar '07

On Thu, 15 Mar 2007 10:51:17 -0500 Alan DeKok <aland(a)deployingradius.com> wrote: >Sam Schultz wrote: >> An entry like: >> >> DEFAULT Realm == "test", Autz-Type := sql-test >> User-Name = "%{User-Name}" > > Please read "man users" for the definition and meaning of >operators. > > You want: > >DEFAULT ... > User-Name := ... Actually, the example above was a typo. The 'User-Name =' line was 'User-Name :=' during testing, which is the part that is confusing, since the documentation states: Attribute := Value Always matches as a check item, and replaces in the configuration items any attribute of the same name. If no attribute of that name appears in the request, then this attribute is added. As a reply item, it has an identical meaning, but for the reply items, instead of the request items. According to this passage from the operators web page (http://wiki.freeradius.org/Operators) I would expect the original 'anonymous@test' entry to be replaced by 'test@test', and not be appended to the list like what is apparently happening. >... >> Followed by Accounting-Requests that still contain the anonymous > >> entry, >> so it is still using the oldest (first?) User-Name attribute. Is > >> there any way at all to REMOVE already set attributes so they >aren't >> re-sent to the NAS? > > The documentation helps in these matters. The documentation helps ONLY if the documentation is consistent with the application's design, and ONLY if the NASes at the other end adhere to the RADIUS standard. Of course, I would chalk this up to a mistake in my configuration before asserting the former. The output of fr's output seems to rule out the latter. > > Alan DeKok. >-- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on online masters degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S74oLy1CA3gAXs15s3QyaHS8N/

1 0

freeradius -peap ad/ldap
by joe vieira 15 Mar '07

15 Mar '07

Hi all, I'm using the RHEL build of freeradius 1.0.1. I'm trying to do something that might seem totally stupid, so let me know if i am (no need to flame). I'm new to freeradius so bear with me a bit. i have eap-peap authentication working against our ad domain. peachy keen. what i would like to be able to do is, in our openldap environment, store attributes for retrieval by radius, cisco stuff/ etc... i assume the way to do this would be to use the authorization sections, but if you add ldap to that then it automatically adds ldap authentication...which i don't want.. ideas? Joe Vieira UNIX Systems Administrator Clark University

2 2

Re: RE : EAP-TTLS outer identity & accounting
by Sam Schultz 15 Mar '07

15 Mar '07

An entry like: DEFAULT Realm == "test", Autz-Type := sql-test User-Name = "%{User-Name}" does add a new User-Name attribute with the proper value, but I need a way to delete the anonymous@ entry still, because I Access-Accepts like this: Sending Access-Accept of id 134 to 192.168.0.5 port 5190 User-Name := "anonymous@test" User-Name := "test@test" Followed by Accounting-Requests that still contain the anonymous entry, so it is still using the oldest (first?) User-Name attribute. Is there any way at all to REMOVE already set attributes so they aren't re-sent to the NAS? For that matter, shouldn't the "use_tunneled_reply = yes" in the ttls module configuration have kept me from having this problem? I also have copy_request_to_tunnel set to yes, but I doubt that should be causing a problem like this. On Wed, 14 Mar 2007 13:03:21 -0500 Sam Schultz <segfault90(a)hushmail.com> wrote: >On Wed, 14 Mar 2007 11:25:20 -0500 Thibault Le Meur ><Thibault.LeMeur(a)supelec.fr> wrote: >>> -----Message d'origine----- >>> De : >>> freeradius-users-bounces+thibault.lemeur=supelec.fr(a)lists.free >>> radius.org >>> [mailto:freeradius-users-bounces+thibault.lemeur=supelec.fr@li >>> sts.freeradius.org] De la part de Sam Schultz >>> Envoyé : mercredi 14 mars 2007 17:13 >>> À : freeradius-users(a)lists.freeradius.org >>> Objet : Re: EAP-TTLS outer identity & accounting >>> >>> >>> >>> >>> On Tue, 13 Mar 2007 13:15:52 -0500 Alan DeKok >>> <aland(a)deployingradius.com> wrote: >>> >Sam Schultz wrote: >>> >> >>> >> This should be solvable by adding something like >>> >> 'User-Name = %{User-Name}' to the DEFAULT entries in the >>users >>> >file, >>> >> correct? >>> > >>> > Yes. >>> >>> One of my users file DEFAULT entries look like this: >>> >>> DEFAULT Realm == "test", Autz-Type := sql-test, User- >>Name = >>> "%u" >>> >>> However, FreeRADIUS tells me this: >>> >>> Error: Invalid operator for item User-Name: reverting to '==' >>> >>> I assume I'm not supposed to forcibly change User-Name, so what >>> attribute would I set to return the correct username to the >NAS? >> >>> I know there is a run-time variable %(reply:User-Name}, would I >>> need to somehow update it with the correct value for User-Name >>> instead? >> >>Yes, by simply adding the User-Name = XXX to the reply items >(that >>is to say >>not on the first line). Try something like this: > >This didn't make much sense at first, but I think I understand it >now. >What you're saying is that the first line is only for check items, >which is why I couldn't set User-Name there. The second line and >beyond >then are for, what? Reply items ONLY, or check & reply items? Is >this >documented anywhere? I just did a quick check through the >freeradius >doc directory, and only found a rlm_fastusers document which didn't >have anything to say about format restrictions. > >> >>DEFAULT Realm == "test", Autz-Type := sql-test >> User-Name=`%{User-Name}` >> >>HTH, >>Thibault >> >> >> >>- >>List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html > >-- >Click for free info on online degrees and make $150K/ year >http://tagline.hushmail.com/fc/CAaCXv1S7YfNF4AEzCH38YxSm8GfpqO2/ > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on getting an MBA and make $200K/ year http://tagline.hushmail.com/fc/CAaCXv1I825CIGoNlzaFbOgSCtxLP6kM/

2 1

Re: freeradius -peap ad/ldap
by Sam Schultz 15 Mar '07

15 Mar '07

On Thu, 15 Mar 2007 10:16:14 -0500 joe vieira <jvieira(a)clarku.edu> wrote: >Hi all, > >I'm using the RHEL build of freeradius 1.0.1. I'm trying to do You really should upgrade that. If I recall correctly, there were some nasty bugs in the early 1.0.x builds. >something that might seem totally stupid, so let me know if i am >(no >need to flame). I'm new to freeradius so bear with me a bit. > We were all new at some point, some people just forget that :) >i have eap-peap authentication working against our ad domain. >peachy >keen. what i would like to be able to do is, in our openldap >environment, store attributes for retrieval by radius, cisco >stuff/ >etc... i assume the way to do this would be to use the >authorization >sections, but if you add ldap to that then it automatically adds >ldap >authentication...which i don't want.. > >ideas? You could try using one of the SQL modules. Unlike ldap, the sql modules only retrieve attributes from an sql table, and sets the attributes for use by later modules (or freeradius, if the 'Auth-Type := Local' has been set) > >Joe Vieira >UNIX Systems Administrator >Clark University >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on online doctorate degrees and make $250k/ year http://tagline.hushmail.com/fc/CAaCXv1ZYZztVZng17ISIErfsWIIfBi9/

1 0