- Freeradius-Users - lists.freeradius.org

chillispot, apache2, freeradius: my experience and howto
by Christophe Gravier 15 Dec '05

15 Dec '05

Hello, I wrote a little "how to" of what I have done in order to make freeradius working with chilli, regarding my configuration. Because it involves several services (apache ssl, freeradius, ldap, sql, ..) I didn't really find a suitable complete how to for my needs. That's the reason why I wrote mine (in french sorry) but then translated it into english and posted it to ChilliSpot forum (http://www.chillispot.org/forum/viewtopic.php?p=3035#3035) It aims at being exhausted, explaining thing from apache, ssl chilli, freeradius and next ldap (as soon I get it working). As someone told me on the list, I should not forget freeradius wiki ! So, do you think this is valuable ? (it covers not only freeradius in fact) . If yes, where in the wiki is it suitable to propose this ? Regards, Christophe. PS: I sent this mail on chillispot ml as well. -- Christophe Gravier Laboratoire DIOM, groupe SATIn - Doctorant ISTASE - Ingénieur d'études Perso: http://perso.univ-st-etienne.fr/gravchri/ SATIn: http://www.istase.com/satin Tel : 04 7748 5034 A mediter: http://www.fsffrance.org/news/article2005-11-25.fr.html

1 0

A draft of a complete howto of my chilli experience.
by Christophe Gravier 15 Dec '05

15 Dec '05

Hello, I wrote a little "how to" of what I have done in order to make chilli working, regarding my configuration. Because it involves several services (apache ssl, freeradius, ldap, sql, ..) I didn't really find a suitable complete how to for my needs. That's the reason why I wrote mine (in french sorry) but then translated it into english and posted it to ChilliSpot forum (http://www.chillispot.org/forum/viewtopic.php?p=3035#3035) Just feel free to add your comment to get it improved and share your opinion. Regards, Christophe. -- Christophe Gravier Laboratoire DIOM, groupe SATIn - Doctorant ISTASE - Ingénieur d'études Perso: http://perso.univ-st-etienne.fr/gravchri/ SATIn: http://www.istase.com/satin Tel : 04 7748 5034 A mediter: http://www.fsffrance.org/news/article2005-11-25.fr.html

1 0

Flexible clients' addresses?
by Martin Pauly 15 Dec '05

15 Dec '05

Hi, I have some 150 new radius clients waiting at my doorstep. Unfortuantely their IP addresses are _not_ within a single Subnet. Most of them are, however grouped into a bunch of 25 pseudo-subnets of the following kind: client 192.168.<n>.240/28 { secret = somesecret shortname = somename } with n between 0 and 254. Rather than putting 25+ entries of this kind into clients.conf, I am looking for a more flexible way of client specification. I have two ways in mind to approach the problem: Approach 1: Specify a subnet mask with a "hole": client 192.168.0.240/255.255.0.28 { secret = somesecret shortname = somename } describes what I need when interpreted with bitwise netmask semantics. This is currently not supported, but for what reason -- considererd insane or simply not desired by anyone yet? Approach 2 (more general): Store the property of being a radius client in my LDAP database. I found some older postings related to this: On Jan 30, 2005, Alan walters wrote: > > We have free radius working with ldap I have been looking for a way > > to add our clients files o our ldap has anyone had any success with this reply from "Mitchell, Michael J" <Michael.Mitchell(a)team.telstra.com>: > I've actually been looking at this over the weekend. Have written some > code, but haven't tested it yet. I'm hoping to get to that today > sometime. I based it largely on what was done in the sql module, so it > may need a bit of refinement. > > I believe Kostas has it on his todo list also. I'm happy to submit a > "draft patch" for review and comment if it helps get this completed. Has there been any progress on that? I quick look at src/main/client.c has revealed nothing so far. Thanks, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 1

Forwarding Accounting Requests
by David Bickle 15 Dec '05

15 Dec '05

Hi, I am looking to have FreeRadius forward accounting stop/start packets to a third party device. I understand this can be done by configuring the proxy .conf. The problem has to do with how the accounting requests are forwarded. In other versions of Radius it is possible to forward accounting packets with an attribute setting that ensures the forwarding server doesn't listen for a response. I would like to set this same configuration in FreeRadius but it doesn't appear that this functionality. Is there a way to forward accounting request packets (start/stop) without requiring the forwarding server to listen for responses? Thanks in advance.

1 0

Multiple Home Servers
by maxim maxime 14 Dec '05

14 Dec '05

Hello, I have a 0.9.2 server working as a proxy to three ISPs. Since they've just decided to work together, they still have some dial-up users. Their new users will be generated with a proper prefix, but all of the old users (with no prefix/suffix) will go through NULL realm. Although I can have multiple NULL realms, but only if one server replies with reject, it will not go through other realms (it will fail-over if no answer). How can I tell freeradius to go to next server if the username was not found in the previous home server? It is possible with modules as mentioned in configurable_failover and changing "action on results". How about in proxy? Thanks. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

LDAP: Variables in "identity" setting
by Derrick Woo 14 Dec '05

14 Dec '05

The LDAP server we have set up is used to authenticate users based on their username and password. If I were to query from the (Linux) command line using ldapsearch, the query would appear as follows: ldapsearch -x -h ldap.domain.com -b ou=ldap,o=domain.com -D uid=XXX,ou=it,o= domain.com -w 'YYY' Where XXX is a person's username and YYY is their password. That means a person can only query their own information and not anyone elses (unless, of course, they have someone else's username and password). >From what I can see, it doesn't appear as though the %{User-Name} variable can be used within the "identity" setting in freeRADIUS 1.0.1. If that's correct, does it mean freeRadius won't be able to be used for this particular set up? If I hardcode a test username and password in the configuration as follows: server = "ldap.domain.com" identity = "uid=XXX,ou=it,o=domain.com" password = 'YYY' basedn = "ou=ldap,o=domain.com" it binds correctly. However, for our particular setup, both the username and password's used to bind to the server need to be variable at run time.

2 5

bandwidth per user (pppoe)
by TwoMan 14 Dec '05

14 Dec '05

Hi All, I have successfully set up freeradius with mysql backend, rp-pppoe concentrator, and pppd. Bandwidth control also working, but every pppd connection have the same bandwidth, because I cannot determine which user has benn connected. I use the ppp/ip-up script to control the bandwidth. The desired bandwidth is in the mysql database too, for each user. Could You help me find a way how to use different badwidth to each user? thx in advance TM

3 4

Help me configure freeradius
by thgjerde 14 Dec '05

14 Dec '05

This is what i whant to do: I have a wireless AP and and a linux server connected with a cat5 cable. I then have a number of diffrenet wireless users that should be able to talk to the linux server But they should not be able to listen in on each other. they should not need a password or certificates So what i was thinking about was to get freeradius to just allow all users to connect without checking for passwords and such. Any tips on how to do this?

1 0

Re: Freeradius-Users Digest, Vol 8, Issue 57
by Sean 14 Dec '05

14 Dec '05

Hi, I have written written a howto that explains how to setup FreeRadius and Chillispot here http://swarmhotspots.com/faq.html. If you need any help you will find contact details on the site. Regards, Sean Bracken

1 0

Proxying based on substring in username
by markcapelle＠pcmc.com 14 Dec '05

14 Dec '05

I am currently knee deep in an Active Directory domain collapse and need to figure out how to get FreeRADIUS to authenticate users as they are moved between domains. During the AD migration process users accounts are disabled in the source domain(where FreeRADIUS currently points) and enabled in the target domain. What I need to do is figure out a way to determine if a user has been moved and if they have, proxy the requests to the new domain. I see two possible ways to do this - 1 - If the user is in AD group "X" proxy the request 2 - If the username has string "m_", then remove the "m_" string and proxy the request My questions are these: which is the easiest to implement and how do I implement each? I have looked at rlm_attr_rewrite a bit and think this may be the module for the second situation. I have googled and searched the lists, unable to find anything of much help. CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of this message in whole or in part is strictly prohibited. Please inform the sender immediately and destroy the original transmittal. Thank you for your cooperation.

1 0