- Freeradius-Users - lists.freeradius.org

Use of Service type attribute
by Chandra mohan 26 Apr '06

26 Apr '06

Hi, I am developing a RADIUS client for our embedded product. I would like the Radius client implementation to support the association of privilege level with individual accounts, e.g. the account "normal_user" has a privilege that allows read-only access while account "admin_user" has a privilege that allows read-write access(can changes our system configuration). Is it possible to use "Service-Type" attribute for this purpose, with "Login" value for normal_user and "Administrative" for admin_user. Please clarify. Thanks -Chandra __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

unsubscribe
by Sven Juergensen 26 Apr '06

26 Apr '06

1 0

Realm question..
by TS 25 Apr '06

25 Apr '06

Hi all We have a radius setup that we use to authenticate our own adsl users as well as proxying radius to 2 other sources. Our own radius entries use a realm after each username, a typical entry is: ############ user1(a)arealm.com Password == secret Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 10.0.0.3, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP ########### Is there a way of getting radius to authenicate on the username before the @ sign and ignore the realm? Obviously if the realm is one that we proxy then it should be proxied as such and any that aren't in the proxy.conf file authenticated locally. This may sound like an odd request but in the case of users typing the realm incorrect but the username is Ok they can be authenticated still. Since we only get sent authentication requests from realms that belong to us or the people we proxy for locally it doesn't really matter what the realm is, the user still has to have the correct password to authenticate. In the case the user is one we proxy and the user types the realm incorrect then they just won't be authenticated since it wouldn't be proxied and the username would not exist in our radius users file, this is fine. I've tried adding "strip" to the LOCAL entry in proxy.conf and also just adding the entry: ############ user1 Password == secret Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 10.0.0.3, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP ########### to the radius users file but it won't authenticate. Thanks Tony

3 4

Re: freeradius & ldap with two trees
by Terry J Fike Jr 25 Apr '06

25 Apr '06

> Try this in your radiusd.conf: > > basedn = "ou=%{Huntgroup-Name},ou=radius,dc=mtaonline,dc=net" > > You will need to either rename your "dial" huntgroup to "people" to > match your ldap structure or you can change the profile OU to be dial. > Either way, this setup is working for me. > > Ben this works! thanks Ben t- -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

1 0

freeradius & ldap with two trees
by Terry J Fike Jr 25 Apr '06

25 Apr '06

Okay, i want radius to look at two trees in ldap, one tree for dial-up one tree for dsl (so a user with a static ip in dsl gets a dynamic ip in dial-up). my huntgroup is like this: dial ip1 dial ip2 dial ip on local box for testing dsl ip3 dsl ip4 dsl ip on local box for testing with the ip on local box commented out on the one i'm not testing. my users file is like so (at least, the two lines i'm testing with): DEFAULT Huntgroup-Name == dial, Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=people,dc=mtaonline,dc=net` Fall-Through = no DEFAULT Huntgroup-Name == dsl, Ldap-Group == dsl8m, User-Profile := "uid=dsl8m,ou=profiles,ou=radius,dc=mtaonline,dc=net", Ldap-UserDN := `uid=%{User-Name},ou=dsl,dc=mtaonline,dc=net` Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Please call the help desk." my ldap config in the radiusd.conf is as follows: ldap { server = "private ip" identity = "cn=Manager,dc=mtaonline,dc=net" password = somepassword basedn = "ou=people,dc=mtaonline,dc=net" #basedn = "dc=mtaonline,dc=net" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = no tls_mode = no #this maps ldap attributetypes to radius attributes dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 120 ldap_cache_size = 0 ldap_connections_number = 10 #password_header = {clear} password_attribute = userPassword groupname_attribute = radiusGroupName groupmembership_filter = (&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile)) groupmembership_attribute = radiusGroupName timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no if i test with a user on the tree listed in basedn, it works. if i try to test with a user in a different tree, it fails. if i try a basedn one level up (so i can try to go down both trees) both users receive an Auth-Reject please call the help desk. in radiusd -X the reason is because ldap is finding multiple entries for the user (in two plus trees). i've gone through the documentation multiple times (and feel like i'm missing something). what am i doing wrong? or is there no way to do what i'm trying to do? i suppose it comes down to; is there a way to re-define the basedn in either huntgroups, or on a default line in the users file so the search comes up with a single user. thanks for your help t- -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

2 1

Making WinXP + WPA + Freeradius +LDAP work easily?
by Mark D. Montgomery II 25 Apr '06

25 Apr '06

We are trying to setup a hotspot-type system on campus for easy wireless access since we are planning to go all laptops in the near future. Right now, we are trying to get a braindead WPA setup working (couple hundred students + wep key or passkey + 2 IT people = pain). Basically, we want ANYONE to be able to hit connect on the access point and get a WPA connection (with minimal tweaking to windows settings to make it work and without them having to enter their username and pass). We will be using other methods to then authenticate valid system users so they can actually do stuff. Is there a way to have freeradius take any incoming wireless auth request and change the username and password to the wireless user on the ldap server? We tried setting up a hints file and such, but it only used the user and pass for the authentication authorization request and not for the actual authentication request. OR Is there an way to have it strip the computername\\username that windows sends down to just the username? (This is our less preferred method, as it still requires us to have all users setup their systems with their network username and pass for login) Thanks. Mark II

2 1

eap.conf - eap-tls CA_file =
by Sochacki, Kevin 25 Apr '06

25 Apr '06

Hi All, In eap.conf under the tls section the comments for 'CA_file =' says it's a list. Can someone tell me what the separator is? I'm assuming it's a space, I have looked around but have not found any reference. Also, are the 'private_key_file' and 'certificate_file' parameters list too? Thanks, Kevin Sochacki

2 1

Allowed and forbitten users in a NAS.
by Santiago Balaguer García 25 Apr '06

25 Apr '06

I have a freeradius 1.1.0 and a DB with all my users. I have two kinds of users: * users who can connect to all hotspots * user who can only connect to one or some hotspots. Actually I can use a script in Exec-Program-Wait property to differenciate, but I don't seem a very clean method. However, I don't know another method for diferenciating users. Any idea??? _________________________________________________________________ Moda para esta temporada. Ponte al día de todas las tendencias. http://www.msn.es/Mujer/moda/default.asp

3 2

Freeradius and mysql
by Mario Casola 25 Apr '06

25 Apr '06

Hello, I've installed freeradius and I've configured it to comunicate with mysql...all work fine, but I don't understand the meaning of the mysql database structure and all the possible values I can put in the database...if someone could illuminate me. Thanks in advance

3 2

Client certs with MSCHAPV2 in PEAP
by Dave Huff 25 Apr '06

25 Apr '06

I would like to configure this setup using Freeradius. My WinXP client (Intel ProSET) supports this, but FR chokes on it when enabled. I've got PEAP-EAP-MSCHAPV2 working with just password authentication. I noted this http://www.opensubscriber.com/message/freeradius-users@lists.freeradius.org/ 1873393.html but was unable to figure out where the DEFAULT EAP-TLS-Require-Client-Cert := Yes should be set. Relative Linux/Freeradius noob, FC4/2.6.15-1.1831 Freeradius 1.0.4 Thanks, Dan H

5 10