- Freeradius-Users - lists.freeradius.org

freeradius and active directory
by Philippe Bacquaert 28 Apr '06

28 Apr '06

Hello, Are there any tool to connect freeradius to an active directory (kerberos and MS Ldap attributes) ? And in this case, what is your opinion about that kind of link ? Thanks in advance, Philippe Bacquaert

1 0

appending things to User-Name before auth
by Christopher Carver 28 Apr '06

28 Apr '06

Hello, I'd like to append @domain.com to every username before the authentication step. I have been trying to use attr_rewrite to do this but I've been unsuccessful. Is this the proper module to use? Has anyone done this before? Thanks in advance, Chris Carver

3 3

external ldap with cisco-avpair
by Nuno Reis 28 Apr '06

28 Apr '06

Hi, I use freeradius for wireless authentication, for several ssids. I have the following config on the users.config: USER User-Password == "******" Service-Type = Shell-User, cisco-avpair = "shell:priv-lvl=15", cisco-avpair+= "ssid=wifi1", cisco-avpair+= "ssid=wifi2", cisco-avpair+= "ssid=wifi3" This config permits a single sign-on solution, using the same database for wireless authencation and administrative rights. Now I want to make a integration with an external ldap, for example, active directory, however I dont have a clue how to preserve the cisco-avpairs. Should be the ldap to send it to the freeradius on every authentication request? -- View this message in context: http://www.nabble.com/external-ldap-with-cisco-avpair-t1525517.html#a4143540 Sent from the FreeRadius - User forum at Nabble.com.

2 1

Re: prepaid cards
by Sean 28 Apr '06

28 Apr '06

Hi Morder, Why don't you create a page that allows your users to change their username and password themselves. This would be very easy to do with PHP. For example a user logs on to your site with his PIN code and password and you present him/her with an option to change his details. By the way if your users are using cell/mobile phones you could add to the security by sending an SMS message that includes a confirmation code that they would need to complete the update. Regards, Sean http://swarmhotspots.com > Thanks Yves but i tried phpmyprepaid and it is a hackof dialup admin and not > realy stable , what i want is a way to let the user to be able to change his > pin code to a username for example : from 15478855 -> mark password :Zx43ed > -> stealit > > pin and password are stored in the database > > any ideas? > thanks > On 4/27/06, YvesDM <ydmlog(a)gmail.com> wrote: > > > > > > > > On 4/27/06, Mordor Networks <mordor.networks(a)gmail.com> wrote: > > > > > Hi > > i want to make prepaid system for my dialup users ex: username : 15789546 > > password 123456 > > How i can make freeradius change the pin code to a valid username in my > > database ? > > i use mysql as a backend for my radius > > ppp/pppoe > > and dialup admin > > thank u > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > Well there is something out there called phpmyprepaid which is made for > > that purpose. > > I have no experience with it, but maybe you can give it a try. > > > > Yves > > > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > >

2 1

dual-streaming interim accounting for high volume
by Tariq Rashid 28 Apr '06

28 Apr '06

hi, under high load, we are familiar with the usual problem of dropped accounting packets. this leads to retires and timeouts and possible "marked dead", either by the NAS or intermediate radius proxies. this problem is particularly pronounced when a proxy used to sent traffic to multiple home servers, one of which is slow/unresponsive. this can lead to that proxy as being seen as "dead" by many NASes. a solution would be to split the accounting radius flow, such that the proxy or other freeradius server replies immediately with an acknowledgement to the NAS, and then forwards the packet onto the target home server, not necessariy waiting for a response. a more intelligent approach may fast reply with cached replies such that rejects can be effective. illustrated: 1. [NAS] ---> acct ---> [proxy] 2. [NAS] <--- acct <--- [proxy] ----> acct ---> [target radius server] is this possible, or likely to be possible with freeradius? i know about a mechanism which uses a second process to tail the radius accounting log files, but this is fragile and prone to inconsistencies. tariq

2 1

send detail log to syslog server?
by Maqbool Hashim 28 Apr '06

28 Apr '06

Hi, Is it possible to get freeradius to send detail log data to a syslog server? Thanks

2 1

mysql replication vs. radrelay
by Olaf Schäfer 28 Apr '06

28 Apr '06

hello, I have a redundant radius server setup with two radius servers. On each of the servers freeradius 1.1.1 and mysql is running. If the primary server goes down the AC falls back to the secondary server. To keep the databases (except the radacct table) synchronised I use MySQL replication. But I'm not sure which is the best way to replicate the accounting information: using radrelay or mysql-replication, too? Besides the man page for radrelay says "The functions of radrelay have been added to radiusd". I couldn't find any documentation about this feature. Any hints? regards, olaf -- Olaf Schäfer <olaf.schaefer(a)gmx.com>

6 15

prepaid cards
by Mordor Networks 28 Apr '06

28 Apr '06

Hi i want to make prepaid system for my dialup users ex: username : 15789546 password 123456 How i can make freeradius change the pin code to a valid username in my database ? i use mysql as a backend for my radius ppp/pppoe and dialup admin thank u

3 3

freeradius and 2 ldap servers
by Terry J Fike Jr 28 Apr '06

28 Apr '06

Okay, i'm probably being a little dense here but just wanted to check i'm understanding this correctly. if i'm running 2 ldap servers; in the users file, do i need a default entry for each ldap server? for example: moving from a line like this with a single ldap server: DEFAULT Huntgroup-Name == People, Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=People,dc=mtaonline,dc=net` Fall-Through = no to two lines like this: DEFAULT Huntgroup-Name == People, Ldap_primary-Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=People,dc=mtaonline,dc=net` Fall-Through = no DEFAULT Huntgroup-Name == People, Ldap_secondary-Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=People,dc=mtaonline,dc=net` Fall-Through = no assuming your ldap instatiations are ldap_primary and ldap_secondary respectively. thanks in advance t- -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

2 1

wiki config examples
by Lewis Bergman 27 Apr '06

27 Apr '06

http://wiki.freeradius.org/index.php/Examples The above link is something I added to the wiki the other night. I put just a couple of meager configs in there. It seems most questions are about config so I thought if we loaded that up just maybe the same questions wouldn't be asked over and over or at least we can say, "see the wiki". -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 Off. 325-691-3301 Cell 325-439-0533 fax 325-695-6841

1 0