- Freeradius-Users - lists.freeradius.org

Re: Windows Client Authentification bevore Domain logon
by Armin Krämer 26 Aug '05

26 Aug '05

Thanks for the answert Alan, but what do you mean that it should be made more prominent in EAP-Conf? Could you give me detailed instructions how i can get this OID to my certificates? Armin FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 25.08.05 17:35:11: Ben Walding <ben.walding(a)gmail.com> wrote: > And then I stumbled on this > > http://lists.cistron.nl/pipermail/freeradius-users/2004-July/034141.html > > 1.3.6.1.4.1.311.17.2 > > After I started adding that OID to my machine certs, everything > started working wonderfully. That OID is added by the cert creation script in the "scripts" directory, but it should be made more prominent in eap.conf, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: FreeRadius-1.04 install seg faults after install (using EAP-TLS)
by Ben Dowling 25 Aug '05

25 Aug '05

I've loaded up radiusd into gdb and the bug looks the same as http://bugs.freeradius.org/show_bug.cgi?id=98. That page says the solution is to pass configure the --disable-shared flag, which I have done, yet the bug remains. Any help would be greatly appreciated, Ben Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 22174)] 0x402a3e3a in lt_dlsym (handle=0x814ba78, symbol=0xbfffe6f8 "rlm_eap_tls") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) (gdb) (gdb) where #0 0x402a3e3a in lt_dlsym (handle=0x814ba78, symbol=0xbfffe6f8 "rlm_eap_tls") at ltdl.c:3330 #1 0x08061404 in eaptype_load () #2 0x40489ad7 in eap_instantiate (cs=0x809f8d8, instance=0x814b0b8) at rlm_eap.c:134 #3 0x080575ff in find_module_instance () #4 0x0805874a in modcall () #5 0x080587b3 in compile_modsingle () #6 0x080579f4 in find_module_instance () #7 0x08057e75 in setup_modules () #8 0x0804ff76 in main () #9 0x40337e36 in __libc_start_main () from /lib/libc.so.6

2 4

lowercase before domain match in users file
by Tariq Rashid 25 Aug '05

25 Aug '05

hi - is it possible for freeradius to match the domains/realms for proxying purposes only (ie not rewrite the User-Name): in the users file: # following is used to map subdomains of *.easynet.co.uk # to be proxied according to the realm easynet.co.uk DEFAULT User-Name =~ "@.*\.abc\.co\.uk$", Proxy-To-Realm := "abc.co.uk" can i enable a switch so that ABC.co.uk, aBc.Co.UK and so on are also matched? however, we don't want the User-Name to be rewritten as per to_lower in radiusd.conf tariq

2 1

FreeRadius-1.04 install seg faults after install (using EAP-TLS)
by Ben Dowling 25 Aug '05

25 Aug '05

Hi, I am having problems with freeradius 1.04 on debian. I previously installed the deb package, but later found out it doesn't support EAP-TLS, so had to build from source. I built it with the following command: ./configure --with-rlm_eap_tls --disable-shared && make && make install I have setup eap.conf and installed the required certificates. When starting radiusd it seems to get past loading the config and then seg faults. The output is below. Can anyone let me know what is causing the crash and how to get round it? Thanks in advance, Ben bratislava:/usr/local/etc/raddb# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "TLS" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no Segmentation fault

1 0

FreeRADIUS 1.0.4: SEGMENTATION FAULT
by BugBuster 25 Aug '05

25 Aug '05

Hi all I'm facing a strange behaviour with Freeradius. The daemon starts and is able to authenticate accounts specified in the 'raddb/users' file. But if I uncomment the sql directive in the 'authorize' section (radius.conf), the deamon does not start: radius3:/usr/local/freeradius# radius3:/usr/local/freeradius# sbin/rc.radiusd start Starting FreeRADIUS:Tue Aug 23 17:54:52 2005 : Info: Starting - reading configuration files ... (I have to press ^C to stop the rc script) Running FreeRADIUS in debug mode (radiusd -sfxxyz -l stdout) I get the "Segmentation fault" message (more details is in .txt attachment). Background information - MySQL (v. 4.0.24): the mysql user 'radius' is able to connect to localhost' and has INSERT, SELECT, DELETE, UPDATE privileges - OS: Debian Linux 3.1 (sarge), kernel 2.6.8-2-686-smp - gcc -v: 3.3.5 - configuration command: ./configure --prefix=/usr/local/freeradius \ --with-logdir=/usr/local/freeradius/logs\ --with-radacctdir=/usr/local/freeradius/logs\ --with-raddbdir=/usr/local/freeradius/raddb --with-threads\ --with-ascend-binary \ --disable-shared \ --enable-developer - gdb radiusd: .. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1076783616 (LWP 9291)] 0x080902ce in lt_dlsym (handle=0x815afc8, symbol=0x8159928 "rlm_sql_mysql") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) - /etc/hosts: has entries for both 'localhost' and the Internet host name. - strace radiusd: See radtrace-1.txt Note the message open("/usr/local/freeradius/lib/rlm_sql_mysql.la", O_RDONLY) = -1 ENOENT (No such file or directory) In fact I can't find any 'rlm_sql_mysql.la' file. No change removing the '--disable-shared' option. I'm new to FreeRADIUS and so I suspect a misconfiguration. Thanks in advance. Ciao, Davide

4 10

FreeRadius EAP-TLS
by Hamid Salim 25 Aug '05

25 Aug '05

Hi all, I have the following setup that I am struggling to make it work; Fedora core 3 FreeRadius 1.0.4 openssl .098 Dell TrueMobile 1170 Access Pointv2.3.3 Dell 802.11b/g cards for AP and supplicant Windows XP SP2 I have a 2 part question. 1.I recall reading on this forum that, Windows XP broke EAP-TLS, does this apply to SP2 also? 2. Would it make a difference if I have CVS verses non-CVS FreeRadius installed? Thanks Hamid.

2 1

Re: MySQL radacct not updated
by sean 25 Aug '05

25 Aug '05

Hi ALL, I have made no progress in resolving the radaccct problem. Radius is loading with no error messages and I've gone over the radiusd.conf and sql.conf a million times. below is the output from Radius when a client logs in. rad_recv: Access-Request packet from host 82.141.232.132:51214, id=0, length=218 --- Walking the entire request list --- Waking up in 31 seconds... Thread 2 got semaphore Thread 2 handling request 1, (1 handled so far) User-Name = "sipkek10" CHAP-Challenge = 0x8a37e2835fe0e45acf9680564cb660c3 CHAP-Password = 0x003c7507dd1f4ecf4389429af1a1e74e9d NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.14 Calling-Station-Id = "00-C0-49-5C-40-48" Called-Station-Id = "00-12-17-4A-01-A9" NAS-Identifier = "wasp1" Acct-Session-Id = "430c042e00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x6df308586dc9a8df5dc7a274fa008a88 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "sipkek10", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 radius_xlat: 'sipkek10' rlm_sql (sql): sql_set_user escaped user --> 'sipkek10' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'sipkek10' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'sipkek10' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'sipkek10' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'sipkek10' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 1 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' radius_xlat: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sipkek10'' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sipkek10'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sipkek10'' rlm_sql (sql): - sql_xlat radius_xlat: 'sipkek10' rlm_sql (sql): sql_set_user escaped user --> 'sipkek10' radius_xlat: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sipkek10'' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 1 radius_xlat: '' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user sipkek10, check_item=1800, counter=0 rlm_sqlcounter: Sent Reply-Item for user sipkek10, Type=Session-Timeout, value=1800 modcall[authorize]: module "noresetcounter" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_chap: login attempt by "sipkek10" with CHAP password rlm_chap: Using clear text password bigdogut for user sipkek10 authentication. rlm_chap: chap user sipkek10 authenticated succesfully modcall[authenticate]: module "chap" returns ok for request 1 modcall: group Auth-Type returns ok for request 1 Processing the session section of radiusd.conf modcall: entering group session for request 1 modcall[session]: module "sql" returns noop for request 1 modcall: group session returns noop for request 1 Sending Access-Accept of id 0 to 82.141.232.132:51214 Session-Timeout = 1800 Finished request 1 Going to the next request Thread 2 waiting to be assigned a request --- Walking the entire request list --- Cleaning up request 1 ID 0 with timestamp 430c7430 Nothing to do. Sleeping until we see a request. Can anyone spot something in this that might point me in the right direction? Regards, Sean

3 2

Re: Windows Client Authentification bevore Domain logon
by Armin Krämer 25 Aug '05

25 Aug '05

Hi, i found this thred yesterday and tried it out to add this OID but it had no effekt...OK maybe i made somthing wrong. Could you describe how you added this oid to your machine zertifikate? Today i built completely new root,server and client certificates depending on the article in www.linuxjournal.com/article/8095. I will post here my users file: My new generated Client Certifikates uses client10 as Client Name. Greetings Armin ## Please read the documentation file ../doc/processing_users_file,# or 'man 5 users' (after installing the server) for more information.## This file contains authentication security and configuration# information for each user. Accounting requests are NOT processed# through this file. Instead, see 'acct_users', in this directory.## The first field is the user's name and can be up to# 253 characters in length. This is followed (on the same line) with# the list of authentication requirements for that user. This can# include password, comm server name, comm server port number, protocol# type (perhaps set by the "hints" file), and huntgroup name (set by# the "huntgroups" file).## If you are not sure why a particular reply is being sent by the# server, then run the server in debugging mode (radiusd -X), and# you will see which entries in this file are matched.## When an authentication request is received from the comm server,# these values are tested. Only the first match is use! d unless the# "Fall-Through" variable is set to "Yes".## A special user named "DEFAULT" matches on all usernames.# You can have several DEFAULT entries. All entries are processed# in the order they appear in this file. The first entry that# matches the login-request will stop processing unless you use# the Fall-Through variable.## If you use the database support to turn this file into a .db or .dbm# file, the DEFAULT entries _have_ to be at the end of this file and# you can't have multiple entries for one username.## You don't need to specify a password if you set Auth-Type += System# on the list of authentication requirements. The RADIUS server# will then check the system password file.## Indented (with the tab character) lines following the first# line indicate the configuration values to be passed back to# the comm server to allow the initiation of a user session.# This can include things like the PPP configuration values# or the host to log the user onto.## You can incl! ude another `users' file with `$INCLUDE users.other'### For a list of RADIUS attributes, and links to their definitions,# see:## http://www.freeradius.org/rfc/attributes.html### Deny access for a specific user. Note that this entry MUST# be before any other 'Auth-Type' attribute which results in the user# being authenticated.## Note that there is NO 'Fall-Through' attribute, so the user will not# be given any additional resources.##lameuser Auth-Type := Reject# Reply-Message = "Your account has been disabled."## Deny access for a group of users.## Note that there is NO 'Fall-Through' attribute, so the user will not# be given any additional resources.##DEFAULT Group == "disabled", Auth-Type := Reject# Reply-Message = "Your account has been disabled."### This is a complete entry for "steve". Note that there is no Fall-Through# entry so that no DEFAULT entry will be used, and the user will NOT# get any attributes in addition to the ones listed here.##steve Auth-Type := Local, User-Password == "testing"# Service-Type = Framed-User,# Framed-Protoco! l = PPP,# Framed-IP-Address = 172.16.3.33,# Framed-IP-Netmask = 255.255.255.0,# Framed-Routing = Broadcast-Listen,# Framed-Filter-Id = "std.ppp",# Framed-MTU = 1500,# Framed-Compression = Van-Jacobsen-TCP-IP#test Auth-Type := Local, User-Password == "testing"# Service-Type = Framed-User,# Framed-Protocol = PPP,# Framed-IP-Address = 172.16.3.33,# Framed-IP-Netmask = 255.255.255.0,# Framed-Routing = Broadcast-Listen,# Framed-Filter-Id = "std.ppp",# Framed-MTU = 1500,# Framed-Compression = Van-Jacobsen-TCP-IP#DEFAULT Auth-Type := EAP-TLS #Local, User-Password == "whatever"# Reply-Message = "Default Client",# Tunnel-Medium-Type = 6,# Tunnel-Private-Group-Id = 1,# Tunnel-Type = 13Client1 Auth-Type := EAP-TLS #Local, User-Password == "whatever" Reply-Message = "Hello,%u Willkommen im Netzwerk der Firma Metaldyne", Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 1, Tunnel-Type = 13host/Client10 Auth-Type := EAP-TLS #Local, User-Password == "whatever" Reply-Message = "Client10", ! Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 1, Tunnel-Type = 13W orkstation3 Auth-Type := EAP-TLS #Local, User-Password == "whatever" Reply-Message = "client3", Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 1, Tunnel-Type = 13## This is an entry for a user with a space in their name.# Note the double quotes surrounding the name.##"John Doe" Auth-Type := Local, User-Password == "hello"# Reply-Message = "Hello, %u"## Dial user back and telnet to the default host for that port##Deg Auth-Type := Local, User-Password == "ge55ged"# Service-Type = Callback-Login-User,# Login-IP-Host = 0.0.0.0,# Callback-Number = "9,5551212",# Login-Service = Telnet,# Login-TCP-Port = Telnet## Another complete entry. After the user "dialbk" has logged in, the# connection will be broken and the user will be dialed back after which# he will get a connection to the host "timeshare1".##dialbk Auth-Type := Local, User-Password == "callme"# Service-Type = Callback-Login-User,# Login-IP-Host = timeshare1,# Login-Service = PortMaster,# Callback-Number = "9,1-800-555-! 1212"## user "swilson" will only get a static IP number if he logs in with# a framed protocol on a terminal server in Alphen (see the huntgroups file).## Note that by setting "Fall-Through", other attributes will be added from# the following DEFAULT entries##swilson Service-Type == Framed-User, Huntgroup-Name == "alphen"# Framed-IP-Address = 192.168.1.65,# Fall-Through = Yes## If the user logs in as 'username.shell', then authenticate them# against the system database, give them shell access, and stop processing# the rest of the file.##DEFAULT Suffix == ".shell", Auth-Type := System# Service-Type = Login-User,# Login-Service = Telnet,# Login-IP-Host = your.shell.machine## The rest of this file contains the several DEFAULT entries.# DEFAULT entries match with all login names.# Note that DEFAULT entries can also Fall-Through (see first entry).# A name-value pair from a DEFAULT entry will _NEVER_ override# an already existing name-value pair.### First setup all accounts to be ! checked against the UNIX /etc/passwd.# (Unless a password was already given earlier in this file).##DEFAULT Auth-Type = System# Fall-Through = 1## Set up different IP address pools for the terminal servers.# Note that the "+" behind the IP address means that this is the "base"# IP address. The Port-Id (S0, S1 etc) will be added to it.##DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen"# Framed-IP-Address = 192.168.1.32+,# Fall-Through = Yes#DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft"# Framed-IP-Address = 192.168.2.32+,# Fall-Through = Yes## Defaults for all framed connections.#DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes## Default for PPP: dynamic IP address, PPP mode, VJ-compression.# NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected# by the terminal server in which case there may not be a "P" suffix.# The terminal server sends "Framed-Protocol = PPP" for auto PPP.#DEFAULT Framed-Protocol == PPP Fr! amed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP## Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression.#DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP## Default for SLIP: dynamic IP address, SLIP mode.#DEFAULT Hint == "SLIP" Framed-Protocol = SLIP## Last default: rlogin to our main server.##DEFAULT# Service-Type = Login-User,# Login-Service = Rlogin,# Login-IP-Host = shellbox.ispdomain.com# ## # Last default: shell on the local terminal server.# ## DEFAULT# Service-Type = Shell-User# On no match, the user is denied access. FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 25.08.05 13:28:44: I also found using machine certificates to be hit and miss (some machines they'd be picked up, others they wouldn't - all XP SP2 with appropriate patches). And then I stumbled on this http://lists.cistron.nl/pipermail/freeradius-users/2004-July/034141.html 1.3.6.1.4.1.311.17.2 After I started adding that OID to my machine certs, everything started working wonderfully. I shook my fist at Microsoft that day! Cheers, Ben On 8/25/05, Steven Atkinson <atn(a)fallibroome.cheshire.sch.uk> wrote: > Armin, > > At 15:40 24/08/05, you wrote: > > >Ok, the hole day i tried to get it to work but this time when i install > >the certificate as a machine zertifikate the radius authentifikation log > >ends up with this log below. > > > >The Certificates where generated with openssl and all works fine as User > >certificates but not as computer zertificate. I set the Registry Patch > >which was diescribed in the mailing list to a value of 2. > > As Ben has suggested in another email, there are some required extensions > to the certificates to enable Windows to authenticate. How did you make > your certificates, I followed the instructions in > http://www.linuxjournal.com/article/8095. > > Steve Atkinson > > > Fallibroome High School > Priory Lane > Macclesfield > Cheshire > SK10 4AF > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Fw: FreeRadius 1.0.4
by Madhvi Gokool 25 Aug '05

25 Aug '05

----- Original Message ----- From: "Madhvi Gokool" <madhvin(a)yahoo.com> To: <freeradius-users(a)lists.cistron.nl> Sent: Thursday, August 25, 2005 10:37 AM Subject: FreeRadius 1.0.4 > Hello > We have planned to replace our cistron radius servers with Freeradius. > We have the following setup :- > 1. Users dial in to access their mail and internet or work on an > application server > 2. Users dial in to access a specific server and nothing else. > After they are authenticated , users get a static IP address . > We populate the users file manually and do not create unix users?? Can we > use huntgroups to group say mail users, internet users, if they are not > unix users? > What attribute(s) should I use to allow the users in Scenario 2 access to > their server? > > The NAS will either be a 3Com TCM or a Cisco access server > > On the access server, we can implement access-lists to allow/deny access > based on the assigned Ip addresses, but we'd prefer using RADIUS > attributes to do so. > > Tank you in advance for your help. > Madhvi

1 0

Re: freeradius proxy question
by freeradius＠reshetar.us 25 Aug '05

25 Aug '05

> > >> freeradius(a)reshetar.us wrote: >>> Greetings. I am using freeradius and want to do the following: >>> 1. proxy authentication to a secondary server for two-factor >>> authentication >>> 2. if the user is authenticated via the home server, add attributes >>> via >>> definitions from the local freeradius server from a sql database >> >> See postauth_query. >> >> Alan DeKok. >> > From what I can tell, that only enters > accounting data into the database. is there something I am missing? > > The other thing I don't get: I ran radiusd in debug mode, and saw the > following line: > > SELECT > radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op > FROM radgroupreply,usergroup WHERE usergroup.Username = 'xxxxx' AND > usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id > > This query select the attributes that I want to have sent back. However, > the reply detail logs show that the attributes are not sent. > > The only thing I can think of is that the user I am testing with is a > memmber of several groups and only one of them has attributes to return at > the moment. > > Thanks > Since no one ever got back to me on this, I assume either a. i pissed off the folks that monitor this list b. no one has the answer or c. i missed the obvious and no one wanted to point it out. The solution I came up with was to set post_proxy_authorize = yes freeradius now passes back the attributes in the sql database. Still would like to konw how to make this work with postauth_query, but I can't seem fin d any indications of how to do that..... input would be appreciated. respectfully submitted.....

2 1