- Freeradius-Users - lists.freeradius.org

redundant-load-balance question
by Dusty Doris 25 Jan '06

25 Jan '06

Is there any way to use a redundant-load-balance w/in the users file, for something such as ldap-group? For example: Autz-Type GROUP1 { redundant-load-balance { ldap1 ldap2 ldap3 } } Then in users file DEFAULT SomeAttr == "something", GROUP1-Ldap-Group == "group", Autz-Type := GROUP1 I've tried that and it doesn't like it. Seems I have to do something like below, which gives me failover, but not load-balance. DEFAULT SomeAttr == "something", ldap1-Ldap-Group == "group"... DEFAULT SomeAttr == "something", ldap2-Ldap-Group == "group"... DEFAULT SomeAttr == "something", ldap3-Ldap-Group == "group"... OR, just setup one ldap instance that points to all the servers, such as ldap ldap1 { server = "ldap1 ldap2 ldap3" } w/ DEFAULT SomeAttr == "something", ldap1-Ldap-Group == "group" But, I'd really like to get that ldap-group setup to use the same redundant-load-balance configuration? Any ideas? Thanks Dusty Doris

2 1

ippool behavior
by Peter Manckok 25 Jan '06

25 Jan '06

Hy all :-) I am introducing in the RADIUS (and FreeRadius) world since two months ago. And now I am doing tests trying to understand all the possibilities offered by FreeRadius (congratulations to all the community, I am really impressed). Now, I am testing the rlm_ippool module. I have been looking for documentation about this module, but I have only found information in the radiusd.conf file and in some posts in the forum so excuse me if my nexts questions are stupid or yet answered. ------------ Well, my configuration is: * In radiusd.conf I have: .... modules { ... ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } ... } ... accounting { detail unix radutmp main_pool } ... post-auth { main_pool ... } * In users file I have: DEFAULT Auth-Type := Accept, Pool-Name := "main_pool" Service-Type = Framed-User, Framed-Protocol = PPP * I use the radclient utility to test the mod $ radclient -f Attributes localhost auth testing Received response ID 42, code 2, length = 44 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.3.181 Framed-IP-Netmask = 255.255.255.0 And in the Attributes file I have: User-Name = "telemati" User-Password = "telemati" NAS-IP-Address = aa.bb.cc.dd NAS-Port = 55 My debugs are: modcall: entering group post-auth for request 0 rlm_ippool: Searching for an entry for nas/port: aa.bb.cc.dd/55 rlm_ippool: Allocating ip to nas/port: aa.bb.cc.dd/55 rlm_ippool: num: 1 rlm_ippool: Allocated ip 192.168.3.181 to client on nas aa.bb.cc.dd,port 55 modcall[post-auth]: module "main_pool" returns ok for request 0 modcall: group post-auth returns ok for request 0 Sending Access-Accept of id 42 to 127.0.0.1:35183 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.3.181 Framed-IP-Netmask = 255.255.255.0 -------------- Well, my questions are: 1) Is this a correct behavior? 2) The FreeRadius assigns the IP 192.168.3.181. Why does not it start assigning the IP 192.168.1.1? 3) If I send another Access-Request packet with a different NAS-Port attribute, I observe that FreeRadius assigns an IP that is not consecutive with regard to the previous IP. Is this a correct behavior or am I doing something wrong? 4) Which is the consequence of deleting the db.ippool and db.ipindex files? 5) How does the rlm_ippool module free the IP address assigned? Sorry about the large of the mail (and my poor english) Regards, Peter ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

documentation on rlm_sql_log
by Seferovic Edvin 25 Jan '06

25 Jan '06

Hi there, I haven't been able to find any documentation on rlm_sql_log module ( doc directory, freeradius-wiki :-( ). Can somebody give me a hint where to look for it? I know it is a new module, but is there any documentation somewhere out there? Regards, Edvin Seferovic

4 3

problem starting radiusd with perl module
by maury 25 Jan '06

25 Jan '06

Hi I have problem to start radiusd with perl module authentication support. ..... Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded perl perl: module = "/etc/raddb/example.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" Segmentation fault I have installed freeradius 1.1.0 stable on redhat es 3 and I have compiled with this options: ./configure \ --with-logdir=/var/log/radius \ --with-raddbdir=/etc/raddb \ --disable-static \ --enable-shared \ --enable-ucd-snmp-compatibility \ --with-gnu-ld \ --with-threads \ --with-thread-pool \ --disable-ltdl-install \ --with-rlm-sql_mysql-include-dir=/usr/include/mysql \ --with-rlm-krb5-include-dir=/usr/kerberos/include I have configurate radiusd.conf modules { ..... .... .... $INCLUDE ${confdir}/experimental.conf } authenticate { .... .... ... perl ....... } Any idea o suggest? Thank you maury

1 1

RLM_perl and Cisco-AVPair
by Alan Lumb 25 Jan '06

25 Jan '06

Hi everyone. Im trying to get RLM_perl to respond with two Cisco-AVPair lines (what would usually be done with += in users) Unfortunately only the first seems to get sent back to the nas - debug output follows rlm_perl: Added pair Cisco-AVPair = ip:dns-servers=10.10.10.10 10.10.10.12 rlm_perl: Added pair Cisco-AVPair = ip:route=10.10.0.0 255.255.255.0 rlm_perl: Added pair Framed-IP-Address = 10.10.10.12 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = perl rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = System modcall[authenticate]: module "perl" returns ok for request 25 modcall: group Auth-Type returns ok for request 25 Sending Access-Accept of id 56 to 127.0.0.1:34529 Cisco-AVPair = "ip:dns-servers=10.10.10.10 10.10.10.12" Framed-IP-Address = 10.10.10.10 Framed-IP-Netmask = 255.255.255.255 Service-Type = Framed-User As you can see, rlm_perl logs that it is adding the pair twice but only the first is returned. I've gone so far as to looking at the code for rlm_perl and it looks to me like it should have worked from what i have done, the coder has asked for a reference to an array. my code basically does this push(@avpairs,'ip:dns-servers=$dns1 $dns2'); push(@avpairs,"ip:route=$$thisroute{network} $$thisroute{subnet}"); $RAD_REPLY{'Cisco-AVPair'}=\@avpairs; Anyone any ideas? Doesn't look like many people use rlm_perl yet

3 4

Proxy request problem
by zack musa 25 Jan '06

25 Jan '06

Hi all. I'm using FR on FC4 and FC2, MySQL and NTRADPING to test user AAA process. I wanna test user authentication for realm/proxy setup. There are some question: 1. Do i need to place the additional realm/proxy server section after the LOCAL or before it in proxy.conf? 2. I used IPAddrs instead of name.domain.com in there. does it have any effect on the proxying process? 3. is the order of clients in clients.conf matter for proxy setup?eg- localhost first and then the other realm IP (again I used IPAddrs instead of name) 4. What is the actual flow of proxy request in FR if i used MySQL instead of users file? user request->autho module->realm module->proxy.conf->remote poxy server->remote/proxy sql server->response->local server->users 5. how the server diferentiate proxy request from a local request for a user? from current local access server? situation: from NTradping using port 1814 sending authentication request with remote server's username, password which stored in remote server's sql. Database. is this possible? 6. When I rcvd this message from local server that suppose to send proxy request to the other realms/proxy: ::Ignoring request from unkwown home server 1a.1b.1c.1d what is the server doing? 7. Should I set 'no' to ignore_null and ignore_default at the suffix setting in radiusd.conf so it can pass the request other type of realm (because i used IP and not setting a name for all the proxy)? Thanks for any reply. Need an Idea to set and test proxy in-lab for now...if documentation available for such test or setup are most welcome. Rgds --------------------------------- Do you Yahoo!? With a free 1 GB, there's more in store with Yahoo! Mail.

1 0

Radius Engineer (Full time position)
by Krishna Gutti 25 Jan '06

25 Jan '06

We have a Software Engineer -Radius position available. Any one interested can forward your resume to krishna_k_gutti at yahoo.com Function Description We are looking for an experienced senior systems engineer to configure and manage our AAA (authentication, authorization, and accounting) system. Job responsibilities include configuring and maintaining our RADIUS servers, developing our mediation system, including translating session information into billable events. Candidates for this position should enjoy troubleshooting critical path systems and designing flexible solutions in a quickly evolving environment. Balancing short-term requests with long-term product requirements is required. Experience working in an organization providing AAA service, preferably an ISP or WISP, is a required. Application development in a UNIX/LINUX environment is required. This position requires expert-level Perl skills. V! ery strong SQL programming skills, including developing and optimizing stored procedures is required. The candidate should have extensive experience with XML including schema development. Required Experience and Skills · At least 3 years of AAA Server management, specifically using RADIUS, is required. · Experience processing AAA session data is required. · Expert level Perl skill is required. · PL/SQL experience is required. · Database engineering experience, including triggers, complex joins, and schema design. Perl:DBI/DBD experience. · Strong XML development experience including designing of DTDs and/or XML Schema. · Good software design skills including use of UML & Object-oriented design practices. · Ability to learn and contribute quickly, work independently. Experience leading other developers during the analysis, design, and execution phases of an engineering project is a big plus. · Experience with source control systems, such as CVS. · BS in Computer Science, or equivalent experience. Desired · Web application development experience. · Advanced Linux development skills including .rpm and kickstart configurations. Equal Oppurtunity Employer --------------------------------- Do you Yahoo!? With a free 1 GB, there's more in store with Yahoo! Mail.

1 0

SQL Issues
by Scholl, Michael 24 Jan '06

24 Jan '06

I have free radius 1.1.0 with SQL and Dial up admin. I am using 3com office connect AP that have the ability of authenticating to a radius server, I have the AP's setup as my NAS servers with a shared secret, the AP's will pass the MAC address of the wireless NIC to the radius server, I have the MAC setup as a user and all appears to be configured right, but get the following error. rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Anyone have a solution for me? Michael C. Scholl Network Administrator HIPAA Security Officer michael.scholl(a)yorkgeneral.org York General Health Care Services 2222 Lincoln Ave. York, NE 68467 (402) 362-0482 ---------- CONFIDENTIALITY NOTICE: This email message, including attachments, contains confidential information and is for the sole use of the intended recipient(s). If you have received this email in error, please notify the sender of the message. This footer also confirms that this email message has been scanned for the presence of computer viruses. Any views expressed in this message are those of the individual sender, except where the sender specifies and with authority, states them to be the views of York General Health Care Services.

1 0

EAP-TTLS and Kerberos problem
by Jakob Oestergaard 24 Jan '06

24 Jan '06

Dear list, I'm setting up FreeRADIUS so that I can authenticate WPA ("Enterprise") from a Linksys access point against Kerberos (via. RADIUS). I can get FreeRADIUS to authenticate against Kerberos (using radtest), and I can get FreeRADIUS to talk EPA-TTLS with the access point (or the WIFI notebook actually). However, I cannot get EPA-TTLS to work with Kerberos. If I put this in my users file, EAP-TTLS works and FreeRADIUS correctly sees the PAP password from the laptop: DEFAULT Auth-Type = EAP Fall-Through = 1 If I put this in my users file, Kerberos works but FreeRADIUS does not get the password from the notebook and therefore the krb5 module won't attempt authentication: DEFAULT Auth-Type = Kerberos So, is there a way to tell FreeRADIUS to both use EAP *and* attempt Kerberos authentication when it actually has a password? Any help will be much appreciated. Thank you very much -- / jakob

2 3

RE: Restricting access to a NAS
by Jonathan De Graeve 24 Jan '06

24 Jan '06

I'm doing this with huntgroups J. > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Lewis > Bergman > Verzonden: dinsdag 24 januari 2006 18:01 > Aan: FreeRadius users mailing list > Onderwerp: Re: Restricting access to a NAS > > Laker Netman wrote: > > I have a Cisco 3660 router configured for dialup AAA > > through FR (1.0.5) to access our LAN. I also have the > > login to the router itself, for admin, authenticating > > through FR (MySQL backend). > > The same DB is used for all auth, so currently anyone > > with a dialup account could also telnet into the > > router. This leaves only my 'enable' password to > > prevent problems. > > I want to configure FR to eliminate this ability for > > all but a select group of users (admins). There are > > other devices I would like to add to the list later. > > I've been looking at huntgroups as the solution, but > > was unsure how (or if) this could be handled via sql > > rather than the users file. > > > > Is anyone doing this and could provide a sample config > > layout? > > > I am not currently doing this but plan to tackle it by using something > like a realm of admin when I do get to it. So a user needing admin privs > would have to log in like user(a)admin.user to get access. > > -- > Lewis Bergman > Texas Communications > 4309 Maple St. > Abilene, TX 79602-8044 > Off. 325-691-1301 > Cell 325-439-0533 > fax 325-695-6841 > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0