- Freeradius-Users - lists.freeradius.org

Re: mysql-devel??
by Pelusa Vali 06 Apr '06

06 Apr '06

>In Debian etch the MySQL client headers are in package libmysqlclient15-dev. > >However as Peter said you should just install a binary version from >Debian with apt-get. ># apt-get install freeradius-mysql freeradius-dialupadmin > >If you really want to recompile FreeRADIUS yourself, search in the FAQ >how to build a Debian package from sources. > >> and, by the way, how may i uninstall freeradius?? > >Like any other Debian package: ># apt-get remove freeradius > >-- >Nicolas Baradakis thanks so much Nicolas, but now i have a problem i installed freeradius from sources compiling it and now i need use mysql, i tested it in another pc installing first mysql and then compiling freeradius and works great. but now, are there any way to uninstall freeradius (compiled from sources) to rebuild it to use mysql?? thanks for your help _______________________________________________________________ Halloween Humour: What did the dragon say when he saw the knight in his shining armour? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=155

1 0

rlm_ldap: object not found
by Marc Delisle 06 Apr '06

06 Apr '06

Hi, thanks to those who answered me for my previous post. It turned out to be a certificate problem. Now, freeradius binds to LDAP on Netware, but does not find any object: rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=college, with filter (uid=delislma) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed Thanks, Marc Delisle

3 3

Termination when there is no traffic
by Johnny 06 Apr '06

06 Apr '06

Hi there, I've got a little proiblem with my radius server. I use it for dial-in accounts via ISDN. I've the problem that connections are terminated automatically when no traffic is on the line. The authentification works without problems, but I do not know which parameter I have to change so that connections wont be terminated automatically anymore. Could anyone help me with this? Thank you! Regards, John

3 2

mysql-devel??
by Pelusa Vali 06 Apr '06

06 Apr '06

hi list, now i'd like to compile freeradius and later use dialup-admin, it needs mysql and in book RADIUS Jonathan Hassell says it's necessary have at least mysql-devel, but i use debian etch and cann't find such package, may be it's not necessary for debian or new mysql versions don't use it any more?? and, by the way, how may i uninstall freeradius?? thanks for your help. _______________________________________________________________ Halloween Trvia: What have bonfires got to do with Halloween? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=126

3 2

Freeradius cannot find rlm_sql_postgresql driver!
by lmyho 06 Apr '06

06 Apr '06

Hello All, I am trying to test the freeradius to work with postgresql database. Just installed freeradius 1.1.0 on debian system via 'aptitude install' command of debian. The radiusd.conf file was modified to work with postgresql and the postgresql.conf file also put in the position for FR to use. However, when I issued command to start the FR, the radius server did not start! In the log file, it shows: Error: rlm_sql (sql): Could not link driver rlm_sql_postgresql: rlm_sql_postgresql.so: cannot open shared object file: No such file or directory Error: rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. Error: radiusd.conf[6]: sql: Module instantiation failed. Error: radiusd.conf[1111] Unknown module "sql". Error: radiusd.conf[1106] Failed to parse authorize section. The last three entries seems like just the consiquences of cannot find the postgresql driver. But the first two entries make me panic! In my postgresql.conf file, the driver is listed as driver="rlm_sql_postgresql" as indicated by FR. But why I got the err of 'cannot open shared object file: No such file or directory'? Please can anyone tell what is happenning? And what should I do now?? Where is the rlm_sql_postgresql driver?? pretty panic:( Help!! Highly appreciate any help from you!! Thanks!!! leo __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 4

Re: mysql-devel??
by Pelusa Vali 06 Apr '06

06 Apr '06

>If you plan to use freeradius+mysql on debian I suggest you just install the >packages that come with it. It's not really necessary to compile it >yourself.. Thanks Peter, now my question is, i wan to use it to add security to a wlan and use hostapd and driver madwifi, so, it is not necessary to compile freeradius??, i use openssl to create certificates (use eap-peap). Second, do you know any way to uninstall freeradius in debian?? thanks again. _______________________________________________________________ What major city is located on the mouth of the Pasig river and the head of a bay with the same name as the city? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=169

1 0

FreeRadius out of the box....
by Tony Spencer 06 Apr '06

06 Apr '06

Because of the issues I've been having with authentication with Freeradius I started from scratch and used RPM to remove Freeradius and then re-installed the latest version. I needed to be able to accept both PAP and CHAP authentication, however I couldn't get it to do both and had to by default to get it to auth everyone no matter what the password should be. But I don't see this as ideal. Since I took over the radius server from someone else I'm guessing it had been changed by the previous person to the extend where only a re-install would solve the problem. I read that out of the box Freeradius would accept both PAP and CHAP authentication as long as the password was in clear text and I used "Password ==". So I re-installed Freeradius version freeradius-1.0.1-3.RHEL4.3 and convert all the entries from Auth-Type := Accept to "Password == <password>" where <password> was the users password. On testing I found users still couldn't authenticate by PAP or CHAP, I run "radiusd -X" and from what I could see its because of the Default setting: DEFAULT Auth-Type = System Fall-Through = 1 The NAS is a Cisco 7204VXR and the line for the authentication is: ppp authentication pap chap callin Here is the debug from radius ################ Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.3:1645, id=142, length=95 Framed-Protocol = PPP User-Name = "user1(a)bb.adslco.com" User-Password = "deabercyap" NAS-Port-Type = Virtual NAS-Port = 1074 Service-Type = Framed-User NAS-IP-Address = 10.0.0.3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "bb.adslco.com" for User-Name = "user1(a)bb.adslco.com" rlm_realm: No such realm "bb.adslco.com" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 users: Matched DEFAULT at 183 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 142 to 10.0.0.3:1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 142 with timestamp 443377fc Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.0.0.3:1645, id=143, length=95 Framed-Protocol = PPP User-Name = "user1(a)bb.adslco.com" User-Password = "" NAS-Port-Type = Virtual NAS-Port = 643 Service-Type = Framed-User NAS-IP-Address = 10.0.0.3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "bb.adslco.com" for User-Name = "user1(a)bb.adslco.com" rlm_realm: No such realm "bb.adslco.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 users: Matched DEFAULT at 183 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: group authenticate returns notfound for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 143 to 10.0.0.3:1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 143 with timestamp 44337809 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.0.0.3:1645, id=144, length=95 Framed-Protocol = PPP User-Name = "user2(a)bb.adslco.com" User-Password = "" NAS-Port-Type = Virtual NAS-Port = 1154 Service-Type = Framed-User NAS-IP-Address = 10.0.0.3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: Looking up realm "bb.adslco.com" for User-Name = "user2(a)bb.adslco.com" rlm_realm: No such realm "bb.adslco.com" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 users: Matched DEFAULT at 183 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: group authenticate returns notfound for request 2 auth: Failed to validate the user. Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 144 to 10.0.0.3:1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 144 with timestamp 44337821 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.0.0.3:1645, id=145, length=95 Framed-Protocol = PPP User-Name = "user2(a)bb.adslco.com" User-Password = "wewyam" NAS-Port-Type = Virtual NAS-Port = 108 Service-Type = Framed-User NAS-IP-Address = 10.0.0.3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: Looking up realm "bb.adslco.com" for User-Name = "user2(a)bb.adslco.com" rlm_realm: No such realm "bb.adslco.com" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 users: Matched DEFAULT at 183 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns ok for request 3 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 modcall[authenticate]: module "unix" returns notfound for request 3 modcall: group authenticate returns notfound for request 3 auth: Failed to validate the user. Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 145 to 10.0.0.3:1645 Waking up in 4 seconds... ####################### What do I need to change to get Freeradius to accept both PAP and CHAP authentication? Thanks Tony -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 5

ldap.attrmap question
by liz 06 Apr '06

06 Apr '06

Greetings, I have a simple question about the ldap.attrmap file. I have placed the following two lines into my ldap.attrmap.file. What I am trying to do is obtain information from an attribute in the LDAP server and then pass it to the NAS we are using. In the debug output of Radius I see it getting the attribute and setting it. However, I dont think it is sending it to the NAS. I don't see it sending it just setting it. checkItem Group-Name Description replyItem Group-Name Description Radius is setup to auth via ntlm_auth& the MS-CHAP module,then through the users file it uses LDAP ( I assume this is ok) to pull group information. I havent have yet to figure out a better way to do this. My questions are a) Is this approriate use of the ldap.attrmap file b) Is there any easier way to do this. c) What should I see when it succefsully sends an attribute to the NAS. -Filles-- ldap.attrmap checkItem Group-Name Description replyItem Group-Name Description users DEFAULT Auth-Type = LDAP Fall-Through = 1 Thanks! Liz

2 2

Freeradius and LDAP with static ips...
by Terry J Fike Jr 05 Apr '06

05 Apr '06

Okay, i have freeradius and ldap talking together quite fine. it doesn't matter if the nas is a dsl or dial-up it work correctly (huntgroups, defaults in the users file...etc) what i am wondering is there a way that if i have a user with a static ip for dsl, that i can not pull the static ip on the same account with dialup. i have group attributes for dsl and dialup, the static ip is associated with the user in ldap. below is an example dsl group from ldap and my dial-up group. also, the user i'm testing with (these are in ldif format). before moving to ldap all our dsl users were flatfiled in the users file (yea, i know how bad that is, and it is why i am pushing the move to ldap). anyways...in order to make this work we just added NAS-Identifier to the username/password line for authentication on users with static ips. this forced the system to authentice via unix authentication for dial-up. is there a way to do this in ldap without two trees (one for dsl one for dialup or one for statics, one for normal users? or ??) oh...yea...and i'll also put my defaults in from the users file. the huntgroups just list the NAS-IP-Address (for testing, 255.255.255.255 which i move to whichever group i want to work with as i'm running radtest locally on the radius server) thanks in advance t- DEFAULT Huntgroup-Name == dial, Ldap-Group == dial, User-Profile := "uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no DEFAULT Huntgroup-Name == dsl, Ldap-Group == dsl8m, User-Profile := "uid=dsl8m,ou=profiles,ou=radius,dc=mtaonline,dc=net" Fall-Through = no version: 1 # LDIF Export for: uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net # Generated by phpLDAPadmin ( http://phpldapadmin.sourceforge.net/ ) on April 5, 2006 2:00 pm # Server: My LDAP Server (10.10.0.46) # Search Scope: base # Search Filter: (objectClass=*) # Total Entries: 1 # Entry 1: uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net dn: uid=dial,ou=profiles,ou=radius,dc=mtaonline,dc=net radiusFramedCompression: Van-Jacobson-TCP-IP radiusPortLimit: 1 radiusFramedMTU: 1500 objectClass: radiusprofile radiusRateLimitRate: 0 radiusPoliceRate: 0 uid: dial radiusPoliceBurst: 15000 radiusIdleTimeout: 900 radiusFramedProtocol: PPP radiusSessionTimeout: 18000 radiusRateLimitBurst: 0 version: 1 # LDIF Export for: uid=dsl8m,ou=profiles,ou=radius,dc=mtaonline,dc=net # Generated by phpLDAPadmin ( http://phpldapadmin.sourceforge.net/ ) on April 5, 2006 2:00 pm # Server: My LDAP Server (10.10.0.46) # Search Scope: base # Search Filter: (objectClass=*) # Total Entries: 1 # Entry 1: uid=dsl8m,ou=profiles,ou=radius,dc=mtaonline,dc=net dn: uid=dsl8m,ou=profiles,ou=radius,dc=mtaonline,dc=net radiusPortLimit: 1 radiusFramedMTU: 1500 objectClass: radiusprofile radiusRateLimitRate: 8192 radiusPoliceRate: 8192 uid: dsl8m radiusPoliceBurst: 15000 radiusIdleTimeout: 0 radiusSessionTimeout: 0 radiusFramedRouting: None radiusRateLimitBurst: 15000 radiusServiceType: Framed-User version: 1 # LDIF Export for: uid=ftptest99,ou=People,dc=mtaonline,dc=net # Generated by phpLDAPadmin ( http://phpldapadmin.sourceforge.net/ ) on April 5, 2006 2:01 pm # Server: My LDAP Server (10.10.0.46) # Search Scope: base # Search Filter: (objectClass=*) # Total Entries: 1 # Entry 1: uid=ftptest99,ou=People,dc=mtaonline,dc=net dn: uid=ftptest99,ou=People,dc=mtaonline,dc=net mailLocalAddress: ftptest99(a)mtaonline.net sn: Tester userPassword: {CRYPT}XuO3ko3FEXkV6 loginShell: /bin/sh uidNumber: 2001 gidNumber: 2001 objectClass: OpenLDAPperson objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: radiusprofile objectClass: inetLocalMailRecipient objectClass: dcObject objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount uid: ftptest99 shadowLastChange: 13014 mailHost: mail.mtaonline.net mailRoutingAddress: ftptest99(a)mtaonline.net cn: Ftp99 Tester homeDirectory: /export/home/ftptest99 dc: People.mtaonline.net radiusFramedIPAddress: 192.168.200.1 radiusFramedIPNetmask: 255.255.255.0 radiusGroupName: dsl8m radiusGroupName: dial -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

1 0

rlm_ldap wont authenticate
by monish ar 05 Apr '06

05 Apr '06

I've tried to authenticate to an LDAP server through RADIUS using the rlm_ldap module.... I'm using freeradius 1.1.0 with OpenLdap 2.1.8 with a bdb backend. The problem is that rlm_ldap module binds successfully to an authentication request in the authorization section, but fails to bind when its tryin to authenticate.... log for RADIUS server is given below along with the LDAP configuration... plz help me out /** In the client terminal ,now i've tried to authenticate with user : ldapuser* [root@localhost ~]# radtest ldapuser ldapuser localhost 2 testing123 Sending Access-Request of id 119 to 127.0.0.1 port 1812 User-Name = "ldapuser" User-Password = "ldapuser" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=119, length=20 * ** ** /*/ On the server side, response to ldapuser user authentication request...* rad_recv: Access-Request packet from host 127.0.0.1:32769, id=119, length=60 User-Name = "ldapuser" User-Password = "ldapuser" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local//var/log/radius/radacct/127.0.0.1/auth-detail-20060403' rlm_detail: /usr/local//var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local//var/log/radius/radacct/127.0.0.1/auth-detail-20060403 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ldapuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 158 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for ldapuser radius_xlat: '(uid=ldapuser)' radius_xlat: 'ou=People,dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=People,dc=example,dc=com, with filter (uid=ldapuser) rlm_ldap: Added password {crypt}$1$nwby/I64$ORzJuBh4/Ec3c.FAt2oqV0 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user ldapuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "ldapuser" with password "ldapuser" rlm_ldap: user DN: uid=ldapuser,ou=People,dc=example,dc=com rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: bind as uid=ldapuser,ou=People,dc=example,dc=com/ldapuser to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: leaving group LDAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [ldapuser] (from client localhost port 2) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 119 to 127.0.0.1 port 32769 Waking up in 4 seconds... *// THE CONFIGURATION DETAILS REQUIRED FOR RLM_LDAP AUTHENTICATION ARE BELOW * * * */* **example.com.ldif (base entries added to LDAP database)* * * Dn: dc=example,dc=com Objectclass: dcObject Objectclass : organization o: Example company dc: example * * dn: cn=manager,dc=example,dc=com objectclass: organizationalRole cn: manager dn: ou=people,dc=example,dc=com ou: people description: All people in the organization objectClass: dcObject objectClass: organizationalUnit dc: example * * * * */*** ldapuser.ldif (details of user account for authentication added to the LDAP database */* * * dn: uid=ldapuser,ou=People,dc=example,dc=com uid: ldapuser cn: ldapuser objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$nwby/I64$ORzJuBh4/Ec3c.FAt2oqV0 shadowLastChange: 13238 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 503 gidNumber: 100 homeDirectory: /home/ldapuser /* *radiusd.conf (LDAP MODULE)* * * ldap { server = "localhost" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "ou=People,dc=example,dc=com" password_attribute = "userPassword" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } authorize { chap mschap eap files ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Unix Auth-Type LDAP { ldap } *Slapd.conf (ldap configuration)* * * include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args ####################################################################### # ldbm database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw {SSHA}Rt9x/xGxM5e8+RpKbvTCWYT8POUEaKwA # Indices to maintain index cn,sn,uid pres,eq,approx,sub index objectClass eq

2 2