- Freeradius-Users - lists.freeradius.org

FR-1.1.3 on solaris10 strange things
by Alexander Serkin 16 Nov '06

16 Nov '06

Hi. We have strange behaviour on sparc solaris 10 server with fr-1.1.3 installed: without any visible reason the radiusd process goes to almost 100% CPU usage for 3-5 minutes. Then it comes back to normal state again (less than 1% CPU). Visually the 100% CPU load does not impact the system funcionality - there are no problems with authentication/accounting processing. The server is not hard loaded - there are not more than 2-3 requests per second on it. prstat output reports: PID USERNAME SIZE RSS STATE PRI NICE TIME CPU PROCESS/NLWP 757 radius 93M 10M run 40 0 0:56:05 99% radiusd/18 and "prstat -vm" : PID USERNAME USR SYS TRP TFL DFL LCK SLP LAT VCX ICX SCL SIG PROCESS/NLWP 757 radius 4.5 1.1 0.0 0.0 0.0 93 0.2 1.6 65 315 .24 0 radiusd/18 has anybody seen this? What can be the reason? Previously it was run on Netra-1120 with solaris 9, the subject appeared after moving to netra-240 Sol10: 5.10 Generic sun4u sparc SUNW,Netra-240 -- Alexander

3 9

prepaid accounting
by Engin Deveci 15 Nov '06

15 Nov '06

Hi, I need to find a solution for my one-time event based accounting problem. I have users which buy prepaid cards and use them to add credit to their web accounts. User download videos later using their credits. I'm asked to use radius for authentication and accounting. I couldn't figure out how I can do this with freeradius. Is it doable with freeradius? If not, please show me the way to do this. Regards, Engin Deveci

1 0

PEAPv2 Server
by MURAT SEZGIN 15 Nov '06

15 Nov '06

Hi, I am trying to implement a PEAP version 2 (draft-josefsson-pppext-eap-tls-eap-10.txt) client. I was using "Odyssey Server Administration" server for PEAP v1 and EAP-TTLS. But the server does not support PEAP v2. Is there any other server softwares which support PEAP v2? Or is there any body who tried to test PEAP v2? Regards, Murat Sezgin _________________________________________________________________ Real-time chat with your friends - Free download - MSN Messenger http://messenger.msn.com/?mkt=tr

2 2

RE: freeRADIUS on Solaris 10 - x86
by Ramm-Ericson, Johannes 15 Nov '06

15 Nov '06

-----Original Message----- > Date: Tue, 7 Nov 2006 11:37:49 +0100 (CET) > From: "Michael Messner" <michael.messner_edv(a)inode.at> > Subject: freeRADIUS on Solaris 10 - x86 > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <141.201.70.172.1162895869.wm(a)webmail.inode.at> > Content-Type: text/plain; charset=iso-8859-1 > > hey freeRADIUS users, > > now it looks much better: > > configure: WARNING: silently not building rlm_counter. > configure: WARNING: FAILURE: rlm_counter requires: libgdbm. > configure: WARNING: silently not building rlm_ippool. > configure: WARNING: FAILURE: rlm_ippool requires: libgdbm. > configure: WARNING: the comm_err library isn't found! > configure: WARNING: silently not building rlm_krb5. > configure: WARNING: FAILURE: rlm_krb5 requires: krb5. > configure: WARNING: silently not building rlm_ldap. > configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. > configure: WARNING: iodbc headers not found. Use --with-iodbc-include-dir=<path>. > configure: WARNING: sql submodule 'iodbc' disabled > configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. > configure: WARNING: sql submodule 'oracle' disabled > configure: WARNING: unixODBC headers not found. Use --with-unixodbc-include-dir=<path>. > configure: WARNING: sql submodule 'unixodbc' disabled > > I think that I need the ldap module für the active directory request, do I also need the krb5 module? > > ca mIke If you plan to authenticate against Active Directory then, yes, you _probably_ need the krb5 module. However, if you are using (for example) Quests VAS - vintela authentication system, you can authenticate against the Unix backend and don't need to compile kerberos and LDAP support. It's all a question of how you plan to set up and use your environment. Regards, JRE PS. Also, with your current configuration there are several components that you will not be ablu to use (IP Pools, Oracle SQL connectors....).

2 1

Adding queries to sql.conf and/or radiusd.conf
by Michelle Manning 15 Nov '06

15 Nov '06

Hi, I am looking to set radcheck.activeDate and radcheck.activated when a user logs in for the first time. At this same time I want to update or insert an expiration attribute for that user. I tried putting an update in the sql.conf file for the radcheck table with the queries that insert &/or update radacct. Of course it didn't work. How can I add more queries to this area and how do I let Radius know that these queries have to run at specific times like accounting_start_query and accounting_update_query. I also tried concatenation of two queries but that didn't work either. Has anyone tried this before? Any ideas for me? I also thought about putting it in radiusd.conf file. Not sure where to start there. Thanks much. Michelle Running freeRadius 1.1.3

1 0

Radius and mysql
by Marilene Lima 15 Nov '06

15 Nov '06

Hi, Thanks a lot for the response. But I have two problems. The first is my english: I am Brazilian and I might not write in english very well... ; ) The second and more important problem is this: I configured my freeradius server, I can authenticate with my users ldap... but I configured my mysql server too, but I can't to authenticate with the mysql users... the access is denied... even when the user and password is correct... ho I think that the server isn't looking for my users in mysql database. Someone knows how I can to test if the freeradius is looking for my users in my mysql database too? Thanks a lot, Marilene

3 2

machine authentication (was: Windows-Domain login without local users)
by Michael Messner 15 Nov '06

15 Nov '06

hey freeRADIUS users, I've found out that there goes something completely wrong, there is allways the ldap request! also if the user is defined in the users file like: bob Password == "bob" Reply-Message = "Hello, bob" then I try to: 11:03:49 Xradius /etc/raddb [root]radtest bob bob localhost 0 l1nux_r4d1us Sending Access-Request of id 192 to 127.0.0.1 port 1645 User-Name = "bob" User-Password = "bob" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 192 to 127.0.0.1 port 1645 User-Name = "bob" User-Password = "bob" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 ... debug output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 256000 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "yes" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User -Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --domain=%{mschap:NT-Domain}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = no rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = yes Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = yes Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded LDAP ldap: server = "141.201.43.10" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "CN=Administrator,CN=Users,DC=isalab,DC=local" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "labadmin" ldap: basedn = "CN=Users,DC=isalab,DC=local" ldap: filter = "sAMAccountName=%{Stripped-User-Name:-%{User-Name})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "memberOf" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 500 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x9a442b8 Module: Instantiated ldap (ldap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (pre_proxy_log) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (post_proxy_log) Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=233, length=55 User-Name = "bob" User-Password = "bob" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20061115' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20061115 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "bob", skipping NULL due to config. modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "bob", skipping NULL due to config. modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bob at line 171 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for bob radius_xlat: 'sAMAccountName=bob)' radius_xlat: 'CN=Users,DC=isalab,DC=local' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 141.201.43.10:389, authentication 0 rlm_ldap: bind as CN=Administrator,CN=Users,DC=isalab,DC=local/labadmin to 141.201.43.10:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in CN=Users,DC=isalab,DC=local, with filter sAMAccountName=bob) rlm_ldap: ldap_search() failed: Bad search filter: sAMAccountName=bob) rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:32769, id=233, length=55 Discarding duplicate request from client localhost:32769 - ID: 233 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 233 with timestamp 455b3ad8 Nothing to do. Sleeping until we see a request. here is my authorize section of radiusd.conf: authorize { preprocess auth_log chap mschap suffix ntdomain eap files ldap } authenticate { ... # Auth-Type LDAP { # ldap # } ... } We normaly need the ldap module to get the groups from Active Directory but if the user is directly configured in the users file there should be no ldap request to the AD! freeRADIUS: v. 1.1.3 hope somone can help me ca mIke > the testlab looks like > Windows 2003 (AD) <---> Freeradius <---> Enterasys switch/Cisco WLAN > <---> Linux/MS-Client > 802.1x via PEAP works, so the next step is machine authentication to get > also a 802.1x Domain login. > like in this post > (http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-November/05…) > we have upgradet our releases: > Samba: Version 3.0.23c > FreeRADIUS Version 1.1.2 > the supplicant is the original Windows supplicant and machine > authentication is activated. > Because we are working with the policy system from enterasys the normal > user authentication starts with a ldap request to the active directory for > group to policy mapping. > Therefore we have such user-entries: > DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", > Huntgroup-Name == "enterasys", Realm == ISALAB.local > Filter-ID == "Enterasys:version=1:mgmt=su:policy=adminrole", > Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} > in the %{Realm} - Domain, there are no restrictions for you in > this network", > Fall-Through = No > So there will be the LDAP request for the group adminrole and then it will > be sent to the switch with the above filter-ID. > This works good for user-auth, but with machine auth now there are > problems because I see the machine LDAP-request now for > host/it88.isalab.local and that fails: > ============================================= > .... > ============================================= > Then I've tested a bit with ntlm_auth: > 16:11:57 Xradius /etc/raddb [root]ntlm_auth --request-key > --domain=ISALAB.LOCAL --username=host/it88.isalab.local > password: > NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) > ... so I think this is the wrong request! > with: > 16:12:38 Xradius /etc/raddb [root]ntlm_auth --request-key > --domain=ISALAB.LOCAL --username=it88$ > password: > NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) > I get the wrong password, so I think this user/machine is available! > any ideas how to go on?!? thanks mIke

2 3

what is best among the opensource backends
by Sri 15 Nov '06

15 Nov '06

Hi list, Among the opensource ID stores(MySQL, openLDAP) for freeRadius, which one offers the optimum utilization of resources (like cpu cycles, ram etc.). Can anyone pls tell me the pros and cons of using these. Thanks in Advance. Kris

1 0

RE: huntgroup issue, multiple huntgroups per device
by Charles Tompkins 15 Nov '06

15 Nov '06

Thanks Neal! That works like a champ. Funny note: The attribute I chose to discriminate with isn't present in the accounting requests, so I had to give vpn user huntgroup a 2nd entry and attribute so accounting would work properly. I appreciate the help. Regards, -Charles -----Original Message----- From: freeradius-users-bounces+crt=thig.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+crt=thig.com@lists.freeradius.org] On Behalf Of Garber, Neal Sent: Tuesday, November 14, 2006 3:51 PM To: FreeRadius users mailing list Subject: RE: huntgroup issue, multiple huntgroups per device >Is it possible to have multiple huntgroups for the same NAS-IP-ADDRESS? >I am running into this issue trying to configure a vpn appliance that uses >the same freeRADIUS server to authenticate its users as well as its admins. Yes, but something needs to distinguish the two (another attribute). Are you saying that your appliance is using radius to authenticate VPN users as well as to authenticate admins. that are using telnet/ssh/http to administratively manage the appliance? If so, check the request attributes for each type of access. Then, you can add the attribute that lets you tell what access type the user is requesting. For instance, I have an AP that uses FR to authenticate 802.11 users as well as for local logons to the AP itself. In my case, the NAS-Port-Type allows me to discern the difference between the two types of access. For 802.11 user access, the AP sends NAS-Port-Type = "Wireless-802.11" and for local logon, the AP sends NAS-Port-Type = "Async" or "Virtual". Figure out what's different in the request and then you can have multiple NAS-IP-Address == 10.20.30.1 entries with different values in the other attribute. For example: vpn NAS-IP-Address == 10.20.30.1, NAS-Port-Type == "XXX" Group = VPNUSERS vpn-admin NAS-IP-Address == 10.20.30.1, NAS-Port-Type == "YYY" User-Name = admin1, User-Name = admin2 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

1 0

[RE]Freeradius-Users Digest, Vol 18, Issue 98
by Ana Gallardo Gómez 15 Nov '06

15 Nov '06

Sorry for my english...I had the same problem with Freeradius-OpenSSL. I´m running a Debian Sarge 3.1. My installation is:/usr/local/openssl -- > OpenSSL binaries/usr/local/radius -- > Freeradius binaries/usr/local/freeradius-1.1.3 -- > Freeradius source/usr/local/openssl-0.9.7k -- > OpenSSL sourceTo compile and install OpenSSL:/usr/local/openssl-0.9.7k/.config shared --prefix=/usr/local/openssl/usr/local/openssl-0.9.7k/make/usr/local/openssl-0.9.7k/make installCopy OpenSSL library and include files to /usr/local/lib and /usr/local/include.To compile and install Freeradius:/usr/local/freeradius-1.1.3/.configure --prefix=/usr/local/radius /usr/local/freeradius-1.1.3/make /usr/local/freeradius-1.1.3/make install :) _________________________________________________________________ Consigue el nuevo Windows Live Messenger http://get.live.com/messenger/overview

2 2