- Freeradius-Users - lists.freeradius.org

sql database in freeradius-1.1.1 ???
by ho 11 Apr '06

11 Apr '06

Hi, am i right that the database schemes under e.g. src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql are lost in version 1.1.1, which i've downloaded 2 says ago? I've tried a find, but didn't have a match. Can i use the same schema i've downloaded with version 1.0.4? Best regards marco

3 3

Allow linking against OpenSSL? (Was Re: [GENERAL] Debian package for freeradius_postgresql module)
by Tyler MacDonald 11 Apr '06

11 Apr '06

Greetings FreeRadius people, This discussion started on the postgresql's "pgsql-general" mailing list. The problem here is that the freeradius-postgresql package needs to link against libpgsql, which means that it may be indirectly linked against openssl. There is a conflict between OpenSSL's BSD license and the GPL which means that it's not legal to distribute a copy of GPL code that is linked in this way. It appears that several other GPL apps have added a special clause to their license that allows them to be linked against OpenSSL. Could this be done for freeradius/freeradius-postgresql as well? This could pave the way towards enhanced freeradius support in Debian, specifically the addition of freeradius-postgresql to Debian's mainline. For your reference, here is the start of the thread on the pgsql-general list that got us to this point: http://archives.postgresql.org/pgsql-general/2006-04/msg00247.php Thanks, Tyler Tom Lane <tgl(a)sss.pgh.pa.us> wrote: > > I don't think so. I got curious and looked at what's on my Ubuntu > > system: Courier IMAP is GPL with an additional clause that explicitly > > allows linking with OpenSSL; Postfix has an Apache-ish license; Exim > > is GPL and also explicitly allows linking with OpenSSL; Cyrus IMAP is > > BSDish; Apache is non-GPL... I can't think offhand of anything that > > is GPL and links with OpenSSL without an explicit clause permitting > > same. > Hm. So can we lobby freeradius to tweak their license similarly?

5 19

How to implement radius with mysql
by Alejandro Sanchez 11 Apr '06

11 Apr '06

Hello. I am a new user of free radius the version that i use is 1.0.4-1. Anybody knows where can i find help to enable mysql with radius? Thank's Alex. ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

RE: How do I set up simple AD integration?
by Burton, Steven 11 Apr '06

11 Apr '06

> -----Original Message----- > From: > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > ists.freer > adius.org > [mailto:freeradius-users-bounces+sburton=shepherd-construction > .co.uk@lis > ts.freeradius.org]On Behalf Of Burton, Steven > Sent: 11 April 2006 16:15 > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > > > > -----Original Message----- > > From: > > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > > ists.freer > > adius.org > > [mailto:freeradius-users-bounces+sburton=shepherd-construction > > .co.uk@lis > > ts.freeradius.org]On Behalf Of King, Michael > > Sent: 11 April 2006 15:40 > > To: FreeRadius users mailing list > > Subject: RE: How do I set up simple AD integration? > > > > > > > > > > Is there a how-to or tutorial for this simple case? I have > > > searched this list and google generally. I have read the > > > articles referred to on the FreeRadius home page and several > > > others and I still can't see how the configuration works. Any > > > and all help gratefully received. > > > > > > Steve. > > > > > > > > > As for the simple how to, they're a few, but none that I > > would consider > > easy to follow. > > > > What your looking for this the following lines: (I have > > two ntlm_auth > > Lines, the original that is commented out, and the one that I > > use. They > > are long, so they will break across lines, but they are not > > that way in > > my config file) > > > > > > # Windows sends us a username in the form of > > # DOMAIN\user, but sends the challenge response > > # based on only the user portion. This hack > > # corrects for that incorrect behavior. > > # > > with_ntdomain_hack = yes > > > > # The module can perform authentication itself, OR > > # use a Windows Domain Controller. This > configuration > > # directive tells the module to call the ntlm_auth > > # program, which will do the authentication, > > and return > > # the NT-Key. Note that you MUST have > "winbindd" and > > # "nmbd" running on the local machine for ntlm_auth > > # to work. See the ntlm_auth program documentation > > # for details. > > # > > # Be VERY careful when editing the following line! > > # > > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key > > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00}" > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} > > --nt-response=%{mschap:NT-Response}" > > This stanza is a enclosed with the mschap section, still > nothing ventured.... > I changed the line and unfolded it and ran radiusd -X. The > first request didn't match anything usefull and was rejected > by System. I tried again but ticked the box 'CHAP' on > NTRadPing and got the output: > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/var" > main: logdir = "/var/log" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "/usr/local/bin/ntlm_auth > --request-nt-key --username=%{mschap:User-Name} > --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/log/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/usr/local/etc/raddb/certs/dh" > tls: random_file = "/usr/local/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, > NAS-IP-Address, Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host > 192.168.50.127:3337, id=18, length=48 > User-Name = "burst01" > CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > rlm_chap: Setting 'Auth-Type := CHAP' > modcall[authorize]: module "chap" returns ok for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type CHAP > auth: type "CHAP" > Processing the authenticate section of radiusd.conf > modcall: entering group CHAP for request 0 > rlm_chap: login attempt by "burst01" with CHAP password > rlm_chap: Could not find clear text password for user burst01 > modcall[authenticate]: module "chap" returns invalid for request 0 > modcall: leaving group CHAP (returns invalid) for request 0 > auth: Failed to validate the user. > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 18 to 192.168.50.127 port 3337 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 18 with timestamp 443bc5b9 > Nothing to do. Sleeping until we see a request. > > I think I'll put a protocol analyser on this (when I've time) > and see what is passing between the PC and RADIUS and what > (if anything) is passing between RADIUS and AD. > A quick look seems to show that the radius server does not contact a DC between the request and the subsequent rejection. Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

RE: How do I set up simple AD integration?
by King, Michael 11 Apr '06

11 Apr '06

You would still need with_ntdomain_hack = yes But that isn't your actual problem. It never called ntlm_auth > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Burton, Steven > Sent: Tuesday, April 11, 2006 11:15 AM > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > > > -----Original Message----- > > From: > > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > > ists.freer > > adius.org > > [mailto:freeradius-users-bounces+sburton=shepherd-construction > > .co.uk@lis > > ts.freeradius.org]On Behalf Of King, Michael > > Sent: 11 April 2006 15:40 > > To: FreeRadius users mailing list > > Subject: RE: How do I set up simple AD integration? > > > > > > > > > > Is there a how-to or tutorial for this simple case? I > have searched > > > this list and google generally. I have read the articles > referred to > > > on the FreeRadius home page and several others and I > still can't see > > > how the configuration works. Any and all help gratefully received. > > > > > > Steve. > > > > > > > > > As for the simple how to, they're a few, but none that I would > > consider easy to follow. > > > > What your looking for this the following lines: (I have two > > ntlm_auth Lines, the original that is commented out, and > the one that > > I use. They are long, so they will break across lines, but > they are > > not that way in my config file) > > > > > > # Windows sends us a username in the form of > > # DOMAIN\user, but sends the challenge response > > # based on only the user portion. This hack > > # corrects for that incorrect behavior. > > # > > with_ntdomain_hack = yes > > > > # The module can perform authentication itself, OR > > # use a Windows Domain Controller. This > configuration > > # directive tells the module to call the ntlm_auth > > # program, which will do the authentication, and > > return > > # the NT-Key. Note that you MUST have > "winbindd" and > > # "nmbd" running on the local machine for ntlm_auth > > # to work. See the ntlm_auth program documentation > > # for details. > > # > > # Be VERY careful when editing the following line! > > # > > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key > > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00}" > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} > > --nt-response=%{mschap:NT-Response}" > > This stanza is a enclosed with the mschap section, still > nothing ventured.... > I changed the line and unfolded it and ran radiusd -X. The > first request didn't match anything usefull and was rejected > by System. I tried again but ticked the box 'CHAP' on > NTRadPing and got the output: > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/var" > main: logdir = "/var/log" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "/usr/local/bin/ntlm_auth > --request-nt-key --username=%{mschap:User-Name} > --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/log/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/usr/local/etc/raddb/certs/dh" > tls: random_file = "/usr/local/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, > NAS-IP-Address, Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host > 192.168.50.127:3337, id=18, length=48 > User-Name = "burst01" > CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > rlm_chap: Setting 'Auth-Type := CHAP' > modcall[authorize]: module "chap" returns ok for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type CHAP > auth: type "CHAP" > Processing the authenticate section of radiusd.conf > modcall: entering group CHAP for request 0 > rlm_chap: login attempt by "burst01" with CHAP password > rlm_chap: Could not find clear text password for user burst01 > modcall[authenticate]: module "chap" returns invalid for request 0 > modcall: leaving group CHAP (returns invalid) for request 0 > auth: Failed to validate the user. > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 18 to 192.168.50.127 port 3337 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 18 with timestamp 443bc5b9 Nothing > to do. Sleeping until we see a request. > > I think I'll put a protocol analyser on this (when I've time) > and see what is passing between the PC and RADIUS and what > (if anything) is passing between RADIUS and AD. > > Steve. > > ______________________________________________________________________ > This email has been scanned by the MessageLabs Email Security System. > For more information please visit > http://www.messagelabs.com/email > ______________________________________________________________________ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

RE: How do I set up simple AD integration?
by Burton, Steven 11 Apr '06

11 Apr '06

> -----Original Message----- > From: > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > ists.freer > adius.org > [mailto:freeradius-users-bounces+sburton=shepherd-construction > .co.uk@lis > ts.freeradius.org]On Behalf Of King, Michael > Sent: 11 April 2006 15:40 > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > > > > Is there a how-to or tutorial for this simple case? I have > > searched this list and google generally. I have read the > > articles referred to on the FreeRadius home page and several > > others and I still can't see how the configuration works. Any > > and all help gratefully received. > > > > Steve. > > > > > As for the simple how to, they're a few, but none that I > would consider > easy to follow. > > What your looking for this the following lines: (I have > two ntlm_auth > Lines, the original that is commented out, and the one that I > use. They > are long, so they will break across lines, but they are not > that way in > my config file) > > > # Windows sends us a username in the form of > # DOMAIN\user, but sends the challenge response > # based on only the user portion. This hack > # corrects for that incorrect behavior. > # > with_ntdomain_hack = yes > > # The module can perform authentication itself, OR > # use a Windows Domain Controller. This configuration > # directive tells the module to call the ntlm_auth > # program, which will do the authentication, > and return > # the NT-Key. Note that you MUST have "winbindd" and > # "nmbd" running on the local machine for ntlm_auth > # to work. See the ntlm_auth program documentation > # for details. > # > # Be VERY careful when editing the following line! > # > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00}" > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} > --nt-response=%{mschap:NT-Response}" This stanza is a enclosed with the mschap section, still nothing ventured.... I changed the line and unfolded it and ran radiusd -X. The first request didn't match anything usefull and was rejected by System. I tried again but ticked the box 'CHAP' on NTRadPing and got the output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.50.127:3337, id=18, length=48 User-Name = "burst01" CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "burst01" with CHAP password rlm_chap: Could not find clear text password for user burst01 modcall[authenticate]: module "chap" returns invalid for request 0 modcall: leaving group CHAP (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 18 to 192.168.50.127 port 3337 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 18 with timestamp 443bc5b9 Nothing to do. Sleeping until we see a request. I think I'll put a protocol analyser on this (when I've time) and see what is passing between the PC and RADIUS and what (if anything) is passing between RADIUS and AD. Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

3 2

RE: How do I set up simple AD integration?
by King, Michael 11 Apr '06

11 Apr '06

> > Is there a how-to or tutorial for this simple case? I have > searched this list and google generally. I have read the > articles referred to on the FreeRadius home page and several > others and I still can't see how the configuration works. Any > and all help gratefully received. > > Steve. > As for the simple how to, they're a few, but none that I would consider easy to follow. What your looking for this the following lines: (I have two ntlm_auth Lines, the original that is commented out, and the one that I use. They are long, so they will break across lines, but they are not that way in my config file) # Windows sends us a username in the form of # DOMAIN\user, but sends the challenge response # based on only the user portion. This hack # corrects for that incorrect behavior. # with_ntdomain_hack = yes # The module can perform authentication itself, OR # use a Windows Domain Controller. This configuration # directive tells the module to call the ntlm_auth # program, which will do the authentication, and return # the NT-Key. Note that you MUST have "winbindd" and # "nmbd" running on the local machine for ntlm_auth # to work. See the ntlm_auth program documentation # for details. # # Be VERY careful when editing the following line! # #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}"

1 0

How do I set up simple AD integration?
by Burton, Steven 11 Apr '06

11 Apr '06

Hi, I am trying to set up FreeRadius 1.1.1 on FreeBSD 6.0 REL with user integration with Active directory for a Windows 2003 domain currently in Win2000 mixed mode. My final object is to authenticate user-connections through a wireless AP. I have setup Samba 3 and successfully joined the Windows domain. I have tried: # wbinfo -u # wbinfo -g # wbinfo -a username%password # ntlm_auth --request-nt-key --domain=<domain> --username= <username> and all ran/authenticated successfully. I have built and installed FreeRadius 1.1.1 from the FreeBSD port and copied: acct_users clients.conf dictionary eap.conf hints huntgroups preproxy_users proxy.conf radiusd.conf realms snmp.conf sql.conf users from the *.sample files provided and added my PC as a client (for NTRadPing) and a 802.11g AP with matching shared secrets and type 'other' I have uncommented the example user 'steve' in users and I can get an 'Access-Accept' using NTRadPing with Steve's credentials so I know that local users are working. If I point NTRadPing at our Funk SBR server and my Windows username and password I can get an 'Access-Accept' so, initially, I would like to emulate this operation before I get involved with MSCHAPv2 PEAP etc. However, although I can see tantalizing references to 'ntlm_auth' and 'ntdomain' and the like in various files I cannot see how to trigger an AD lookup from a RADIUS request. So far all I have achieved is: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.50.127:2888, id=15, length=47 User-Name = "burst01" User-Password = "mypassword" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 15 to 192.168.50.127 port 2888 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 15 with timestamp 443bb1ca Nothing to do. Sleeping until we see a request. which is indistinguishable from nothing :-( Is there a how-to or tutorial for this simple case? I have searched this list and googled generally. I have read the articles referred to on the FreeRadius home page and several others and I still can't see how the configuration works. Any and all help gratefully received. Steve. S Burton BSc(Hons) MIEE MBCS MIEEE Network Manager Shepherd Construction Ltd Head Office Frederick House, Fulford Road, York, YO10 4EA Tel: 01904 660391 Fax: 01904 660577 Web: www.shepherd-construction.co.uk Registered number: 201860 England Registered address: Huntington House, Jockey Lane, Huntington, York YO32 9XW The views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of the company. This email and any files transmitted with it are confidential and are intended solely for the individual or entity to which they are addressed. If you have received this e-mail in error, please notify sclcomp(a)shepherd-construction.co.uk quoting the name of the sender. Whilst every care has been taken to check this outgoing e-mail for viruses it is seen as your responsibility to check and sweep it, and any attachments, for viruses on receipt. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1

problem with oracle scheme - table radacct
by Mathieu Legare 11 Apr '06

11 Apr '06

Using freeradius 1.1.0 on RHEL 4.0 update 3 with Oracle 9 database backend for accounting, we discovered the following problem while trying to add our wireless stuff to our RADIUS system. We've been using the current setup for PPP login with a Cisco access server without any problem. So the NAS is a Nortel WLAN Security Switch 2380 (more or less a Trapeze device if i am not mistaken). The WLAN switch sends a "start accounting" packet, unfortunalety the content of the %{NAS-Port-Id} variable that the WLAN switch sends seems to be in the following format: "2049/1" which is NOT a NUMERIC(12) (or integer if using the MySQL driver). This cause an ORA-01722 error . We've changed the NasPortId field type to VARCHAR2(15) to fix the problem. I really don't know if changing the type of the NasPortId field to varchar2 can introduce other problems, so far we haven't notice any. Thanks and have a nice day, --

2 1

Cisco AP 1240AG - PEAP/MSCHAPv2 with ntlm_auth
by Konne 11 Apr '06

11 Apr '06

hi my situation: ive Windows 2003 Server Domaincontrollers. i use freeradius who authenticates the clients in the domain with ntlm_auth. only users they will be in the group "wireless" have access to the wireless: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=DOMAIN\\WIRELESS" my question is now: how can i realize that ive 2 ssid, one ssid=administrators, and the other ssid=users, i omit the "--require-membership-of=DOMAIN\\WIRELESS" on the ntlm authentication and make two groups in the active directory: -- wireless_admin - ssid1=adminis -- wireless_users - ssid2=users when the user is a member of admins he become the vlan and the ssid for Administrators, and when the user is a member of users he become the vlan and the ssid for Users. is that possible to configure it in the "/etc/raddb/users" like following, but without user1, instead of this a group... user1 Auth-Type := EAP Cisco-AVPair := "ssid=admins", Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN user2 Auth-Type := EAP Cisco-AVPair := "ssid=users", Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN somone has experience to associate ntlm and group differentiation... and how can i do that the Admins can also login via shell, and the user only authentication no shell or something like that? thx Konne

1 0