- Freeradius-Users - lists.freeradius.org

freeradius, deb (sid)
by Gabor Szelei 26 Apr '06

26 Apr '06

Hiall, I'd like to use freeradius with PEAP. from freeradius -X: rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory rlm_eap_tls.so seems to be missing. Does anyone know some debian source to get it with it? Is there some guide about how to build it and what dependencied are needed for that? br, gabor

3 2

Use of Service type attribute
by Chandra mohan 26 Apr '06

26 Apr '06

Hi, I am developing a RADIUS client for our embedded product. I would like the Radius client implementation to support the association of privilege level with individual accounts, e.g. the account "normal_user" has a privilege that allows read-only access while account "admin_user" has a privilege that allows read-write access(can changes our system configuration). Is it possible to use "Service-Type" attribute for this purpose, with "Login" value for normal_user and "Administrative" for admin_user. Please clarify. Thanks -Chandra __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

freeradius request to DHCP
by Philippe Bacquaert 26 Apr '06

26 Apr '06

Hello, I'm working on a project. I'm searching how to make freeradius (when receiving a request from a radius client) request itself a dynamic IP address to a dhcp server and write it in the attribute Framed-IP-Address. Any advice is welcome. Philippe B. Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34 /mn) ; tél : 08 92 68 13 50 (0,34/mn)

3 2

Create and Send attributes
by Carlos Peñafiel 26 Apr '06

26 Apr '06

Hello!!! I want to send from my radius server several attributes to the client, but I've been looking at the documenation. I can do that if my attribute-ID is between 1 and 100 (I guess, maybe is it 256), but also the documentation says that a new attribute has to have an ID greater than 3000. So, are not "the attributes between 100 (256) and 3000" sent to the client radius? (I guess, they could be used for local management) If it is not, how can I create an attribute with id grater that 3000 and send to the radius client? Thank in advance.

2 1

Use of Service type attribute
by Chandra mohan 26 Apr '06

26 Apr '06

Hi, I am developing a RADIUS client for our embedded product. I would like the Radius client implementation to support the association of privilege level with individual accounts, e.g. the account "normal_user" has a privilege that allows read-only access while account "admin_user" has a privilege that allows read-write access(can changes our system configuration). Is it possible to use "Service-Type" attribute for this purpose, with "Login" value for normal_user and "Administrative" for admin_user. Please clarify. Thanks -Chandra __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

unsubscribe
by Sven Juergensen 26 Apr '06

26 Apr '06

1 0

Realm question..
by TS 25 Apr '06

25 Apr '06

Hi all We have a radius setup that we use to authenticate our own adsl users as well as proxying radius to 2 other sources. Our own radius entries use a realm after each username, a typical entry is: ############ user1(a)arealm.com Password == secret Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 10.0.0.3, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP ########### Is there a way of getting radius to authenicate on the username before the @ sign and ignore the realm? Obviously if the realm is one that we proxy then it should be proxied as such and any that aren't in the proxy.conf file authenticated locally. This may sound like an odd request but in the case of users typing the realm incorrect but the username is Ok they can be authenticated still. Since we only get sent authentication requests from realms that belong to us or the people we proxy for locally it doesn't really matter what the realm is, the user still has to have the correct password to authenticate. In the case the user is one we proxy and the user types the realm incorrect then they just won't be authenticated since it wouldn't be proxied and the username would not exist in our radius users file, this is fine. I've tried adding "strip" to the LOCAL entry in proxy.conf and also just adding the entry: ############ user1 Password == secret Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 10.0.0.3, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP ########### to the radius users file but it won't authenticate. Thanks Tony

3 4

Re: freeradius & ldap with two trees
by Terry J Fike Jr 25 Apr '06

25 Apr '06

> Try this in your radiusd.conf: > > basedn = "ou=%{Huntgroup-Name},ou=radius,dc=mtaonline,dc=net" > > You will need to either rename your "dial" huntgroup to "people" to > match your ldap structure or you can change the profile OU to be dial. > Either way, this setup is working for me. > > Ben this works! thanks Ben t- -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

1 0

freeradius & ldap with two trees
by Terry J Fike Jr 25 Apr '06

25 Apr '06

Okay, i want radius to look at two trees in ldap, one tree for dial-up one tree for dsl (so a user with a static ip in dsl gets a dynamic ip in dial-up). my huntgroup is like this: dial ip1 dial ip2 dial ip on local box for testing dsl ip3 dsl ip4 dsl ip on local box for testing with the ip on local box commented out on the one i'm not testing. my users file is like so (at least, the two lines i'm testing with): DEFAULT Huntgroup-Name == dial, Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=people,dc=mtaonline,dc=net` Fall-Through = no DEFAULT Huntgroup-Name == dsl, Ldap-Group == dsl8m, User-Profile := "uid=dsl8m,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=dsl,dc=mtaonline,dc=net` Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Please call the help desk." my ldap config in the radiusd.conf is as follows: ldap { server = "private ip" identity = "cn=Manager,dc=mtaonline,dc=net" password = somepassword basedn = "ou=people,dc=mtaonline,dc=net" #basedn = "dc=mtaonline,dc=net" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = no tls_mode = no #this maps ldap attributetypes to radius attributes dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 #password_header = {clear} password_attribute = userPassword groupname_attribute = radiusGroupName groupmembership_filter = (&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile)) groupmembership_attribute = radiusGroupName timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no if i test with a user on the tree listed in basedn, it works. if i try to test with a user in a different tree, it fails. if i try a basedn one level up (so i can try to go down both trees) both users receive an Auth-Reject please call the help desk. in radiusd -X the reason is because ldap is finding multiple entries for the user (in two plus trees). i've gone through the documentation multiple times (and feel like i'm missing something). what am i doing wrong? or is there no way to do what i'm trying to do? i suppose it comes down to; is there a way to re-define the basedn in either huntgroups, or on a default line in the users file so the search comes up with a single user. thanks for your help t- -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

2 1

Making WinXP + WPA + Freeradius +LDAP work easily?
by Mark D. Montgomery II 25 Apr '06

25 Apr '06

We are trying to setup a hotspot-type system on campus for easy wireless access since we are planning to go all laptops in the near future. Right now, we are trying to get a braindead WPA setup working (couple hundred students + wep key or passkey + 2 IT people = pain). Basically, we want ANYONE to be able to hit connect on the access point and get a WPA connection (with minimal tweaking to windows settings to make it work and without them having to enter their username and pass). We will be using other methods to then authenticate valid system users so they can actually do stuff. Is there a way to have freeradius take any incoming wireless auth request and change the username and password to the wireless user on the ldap server? We tried setting up a hints file and such, but it only used the user and pass for the authentication authorization request and not for the actual authentication request. OR Is there an way to have it strip the computername\\username that windows sends down to just the username? (This is our less preferred method, as it still requires us to have all users setup their systems with their network username and pass for login) Thanks. Mark II

2 1