- Freeradius-Users - lists.freeradius.org

Freeradius + redis authorize
by Bassem Mettichi 26 Dec '17

26 Dec '17

Hello, iam using actually Freeradius 3.0.15 + redis database for accounting start, stop and interim-update all working fine for me but i need just a module for authentication and authorize, please could somoene give me an idea how to configure module rediswho to authorize access requests? means to execute auth requests + acct requests. is there any special configuration in rediswho file like this for example: authorize_check_query = "lrange radcheck|%{User-Name} 0 1000" authorize_reply_query = "lrange radreply|%{User-Name} 0 1000" Best Regards Mettichi Bassem

2 1

Freeradius 3.0.15 + redis
by Bassem Mettichi 25 Dec '17

25 Dec '17

Hello, i have installed freeradius 3.0.15 + redis database, i would like to do authenfication and accounting with redis database when i add rediswho in authorize section i get this error: /opt/freeradius/v.3.0.15/etc/raddb/sites-enabled/default[417]: "rediswho" modules aren't allowed in 'authorize' sections -- they have no such method. /opt/freeradius/v.3.0.15/etc/raddb/sites-enabled/default[274]: Errors parsing authorize section. any one has an idea about this error and how we can resolve it? Best Regards Mettichi Bassem

2 5

EAP_AKA on FR4 and Got AKA-Permanent-ID tag, but identity is not a permanent ID
by Peter Lambrechtsen 23 Dec '17

23 Dec '17

I'm playing with EAP_AKA and EAP_AKA' to see if I can get it working. Using a test sim card I got from our test lab they can also supplied me the Ki and OPC. I've defined the values in the mods-config/files/authorize. 1530990000000074(a)wlan.mnc005.mcc530.3gppnetwork.org Sim-Ki := 0x.., Sim-Opc := 0x.., Sim-SQN := 1 0530990000000074(a)wlan.mnc005.mcc530.3gppnetwork.org Sim-Ki := 0x.., Sim-Opc := 0x.., Sim-SQN := 1 I can successfully auth with EAP_SIM. (14) Received Access-Request ID 114 (14) User-Name = "1530990000000074(a)wlan.mnc005.mcc530.3gppnetwork.org" (14) Calling-Station-Id = "E0-A3-AC-A0-CC-41" (14) NAS-IP-Address = 192.168.1.240 (14) NAS-Port = 1 (14) Called-Station-Id = "00-22-7F-86-BC-E8:DaLambsTest" (14) Service-Type = Framed-User (14) Framed-MTU = 1400 (14) NAS-Port-Type = Wireless-802.11 (14) NAS-Identifier = "00-22-7F-86-BC-E8" (14) Connect-Info = "CONNECT 802.11g/n" (14) EAP-Message = 0x... (14) Ruckus-SSID = "DaLambsTest" (14) Message-Authenticator = 0xa9f5c23c47c9c2576b4dff7a96511654 (14) Running 'recv Access-Request' from file ./sites-enabled/default (14) Running 'authenticate eap' from file ./sites-enabled/default (14) authenticate eap { (14) eap - Peer sent packet with EAP method Identity (1) (14) eap - Calling submodule eap_md5 (14) eap_md5 - Issuing MD5 Challenge (14) eap - Sending EAP Request (code 1) ID 1 length 22 (14) eap (handled) (14) } # authenticate eap (handled) (15,14) Running 'authenticate eap' from file ./sites-enabled/default (15,14) authenticate eap { (15,14) eap - Peer sent packet with EAP method NAK (3) (15,14) eap - Found mutually acceptable type SIM (18) (15,14) eap - Calling submodule eap_sim (15,14) eap_sim - New EAP-SIM session (15,14) eap_sim - WARNING: Failed parsing identity, continuing anyway: Got SIM-Permanent-ID tag, but identity is not a permanent ID (15,14) eap_sim - Reentering state START (15,14) eap_sim - Sending SIM-State (15,14) eap_sim - Encoding EAP-SIM attributes (15,14) eap_sim - &EAP-SIM-Version-List = 1 (15,14) eap_sim - &EAP-SIM-Any-ID-Req = yes (15,14) eap_sim - &EAP-SIM-Subtype = SIM-Start (15,14) eap - Sending EAP Request (code 1) ID 32 length 20 (15,14) eap (handled) (15,14) } # authenticate eap (handled) (16,14) authenticate eap { (16,14) eap - Peer sent packet with EAP method SIM (18) (16,14) eap - Calling submodule eap_sim (16,14) eap_sim - Decoded EAP-SIM attributes (16,14) eap_sim - &EAP-SIM-Nonce-MT = 0x.... (16,14) eap_sim - &EAP-SIM-Selected-Version = 1 (16,14) eap_sim - &EAP-SIM-Identity = " 1530990000000074(a)wlan.mnc005.mcc530.3gppnetwork.org" (16,14) eap_sim - &EAP-SIM-Subtype = SIM-Start (16,14) eap_sim - WARNING: Failed parsing identity: Got SIM-Permanent-ID tag, but identity is not a permanent ID (16,14) eap_sim - Reentering state START (16,14) eap_sim - Sending SIM-State (16,14) eap_sim - Encoding EAP-SIM attributes (16,14) eap_sim - &EAP-SIM-Version-List = 1 (16,14) eap_sim - &EAP-SIM-Fullauth-ID-Req = yes (16,14) eap_sim - &EAP-SIM-Subtype = SIM-Start (16,14) eap - Sending EAP Request (code 1) ID 33 length 20 (16,14) eap (handled) (16,14) } # authenticate eap (handled) (17,14) authenticate eap { (17,14) eap - Peer sent packet with EAP method SIM (18) (17,14) eap - Calling submodule eap_sim (17,14) eap_sim - Decoded EAP-SIM attributes (17,14) eap_sim - &EAP-SIM-Nonce-MT = 0x... (17,14) eap_sim - &EAP-SIM-Selected-Version = 1 (17,14) eap_sim - &EAP-SIM-Identity = " 1530990000000074(a)wlan.mnc005.mcc530.3gppnetwork.org" (17,14) eap_sim - &EAP-SIM-Subtype = SIM-Start (17,14) eap_sim - WARNING: Failed parsing identity: Got SIM-Permanent-ID tag, but identity is not a permanent ID (17,14) eap_sim - Reentering state START (17,14) eap_sim - Sending SIM-State (17,14) eap_sim - Encoding EAP-SIM attributes (17,14) eap_sim - &EAP-SIM-Version-List = 1 (17,14) eap_sim - &EAP-SIM-Permanent-ID-Req = yes (17,14) eap_sim - &EAP-SIM-Subtype = SIM-Start (17,14) eap - Sending EAP Request (code 1) ID 34 length 20 (17,14) eap (handled) (17,14) } # authenticate eap (handled) (18,14) authenticate eap { (18,14) eap - Peer sent packet with EAP method SIM (18) (18,14) eap - Calling submodule eap_sim (18,14) eap_sim - Decoded EAP-SIM attributes (18,14) eap_sim - &EAP-SIM-Nonce-MT = 0x.. (18,14) eap_sim - &EAP-SIM-Selected-Version = 1 (18,14) eap_sim - &EAP-SIM-Identity = " 1530052190001474(a)wlan.mnc005.mcc530.3gppnetwork.org" (18,14) eap_sim - &EAP-SIM-Subtype = SIM-Start (18,14) eap_sim - WARNING: Failed parsing identity: Got SIM-Permanent-ID tag, but identity is not a permanent ID (18,14) eap_sim - Changed state START -> CHALLENGE (18,14) eap_sim - Acquiring GSM vector(s) (18,14) eap_sim - GSM vector[0] (18,14) eap_sim - KC : 0x.. (18,14) eap_sim - RAND : 0x.. (18,14) eap_sim - SRES : 0x.. (18,14) eap_sim - GSM vector[1] (18,14) eap_sim - KC : 0x.. (18,14) eap_sim - RAND : 0x.. (18,14) eap_sim - SRES : 0x.. (18,14) eap_sim - GSM vector[2] (18,14) eap_sim - KC : 0x.. (18,14) eap_sim - RAND : 0x.. (18,14) eap_sim - SRES : 0x.. (18,14) eap_sim - Sending SIM-Challenge (18,14) eap_sim - Encoding EAP-SIM attributes (18,14) eap_sim - &EAP-SIM-RAND = 0x.. (18,14) eap_sim - &EAP-SIM-RAND = 0x.. (18,14) eap_sim - &EAP-SIM-RAND = 0x.. (18,14) eap_sim - &EAP-SIM-Subtype = SIM-Challenge (18,14) eap_sim - &EAP-SIM-MAC = 0x (18,14) eap - Sending EAP Request (code 1) ID 35 length 80 (18,14) eap (handled) (18,14) } # authenticate eap (handled) (19,14) authenticate eap { (19,14) eap - Peer sent packet with EAP method SIM (18) (19,14) eap - Calling submodule eap_sim (19,14) eap_sim - Decoded EAP-SIM attributes (19,14) eap_sim - &EAP-SIM-MAC = 0x.. (19,14) eap_sim - &EAP-SIM-Subtype = SIM-Challenge (19,14) eap_sim - EAP-SIM-MAC matches calculated MAC (19,14) eap_sim - Changed state CHALLENGE -> SUCCESS (19,14) eap_sim - Sending SIM-Success (19,14) eap_sim - &reply:MS-MPPE-Recv-Key = 0x.. (19,14) eap_sim - &reply:MS-MPPE-Send-Key = 0x.. (19,14) eap - Sending EAP Success (code 3) ID 35 length 4 (19,14) eap - Cleaning up EAP session (19,14) eap (ok) (19,14) } # authenticate eap (ok) And EAP_SIM fails if I have the incorrect Ki/OPC pair on the server side so I know I have the correct values. But if I try and do the same on AKA or AKA' it fails. (7) User-Name = "0530990000000074(a)wlan.mnc005.mcc530.3gppnetwork.org" With AKA the first digit of the IMSI is a 0 rather than 1. (7) Running 'authenticate eap' from file ./sites-enabled/default (7) authenticate eap { (7) eap - Peer sent packet with EAP method Identity (1) (7) eap - Calling submodule eap_md5 (7) eap_md5 - Issuing MD5 Challenge (7) eap - Sending EAP Request (code 1) ID 1 length 22 (7) eap (handled) (7) } # authenticate eap (handled) (8,7) authenticate eap { (8,7) eap - Peer sent packet with EAP method NAK (3) (8,7) eap - Found mutually acceptable type AKA (23) (8,7) eap - Calling submodule eap_aka (8,7) eap_aka - Failed parsing identity, continuing anyway: Got AKA-Permanent-ID tag, but identity is not a permanent ID (8,7) eap_aka - New EAP-AKA session (8,7) eap_aka - WARNING: Identity format unknown, sending Identity request (8,7) eap_aka - Reentering state IDENTITY (8,7) eap_aka - Sending AKA-Identity (Id-Any-Req) (8,7) eap_aka - Encoding EAP-AKA attributes (8,7) eap_aka - &EAP-AKA-Subtype = AKA-Identity (8,7) eap_aka - &EAP-AKA-Any-ID-Req = yes (8,7) eap - Sending EAP Request (code 1) ID 93 length 12 (8,7) eap (handled) (9,7) authenticate eap { (9,7) eap - Peer sent packet with EAP method AKA (23) (9,7) eap - Calling submodule eap_aka (9,7) eap_aka - EAP-AKA decoded attributes (9,7) eap_aka - &EAP-AKA-Identity = " 0530990000000074(a)wlan.mnc005.mcc530.3gppnetwork.org" (9,7) eap_aka - &EAP-AKA-Subtype = AKA-Identity (9,7) eap_aka - WARNING: Failed parsing identity: Got AKA-Permanent-ID tag, but identity is not a permanent ID (9,7) eap_aka - Reentering state IDENTITY (9,7) eap_aka - Sending AKA-Identity (FullAuth-Id-Req) (9,7) eap_aka - Encoding EAP-AKA attributes (9,7) eap_aka - &EAP-AKA-Subtype = AKA-Identity (9,7) eap_aka - &EAP-AKA-Fullauth-ID-Req = yes (9,7) eap - Sending EAP Request (code 1) ID 94 length 12 (9,7) eap (handled) (9,7) } # authenticate eap (handled) (10,7) authenticate eap { (10,7) eap - Peer sent packet with EAP method AKA (23) (10,7) eap - Calling submodule eap_aka (10,7) eap_aka - EAP-AKA decoded attributes (10,7) eap_aka - &EAP-AKA-Identity = " 0530990000000074(a)wlan.mnc005.mcc530.3gppnetwork.org" (10,7) eap_aka - &EAP-AKA-Subtype = AKA-Identity (10,7) eap_aka - WARNING: Failed parsing identity: Got AKA-Permanent-ID tag, but identity is not a permanent ID (10,7) eap_aka - Reentering state IDENTITY (10,7) eap_aka - Sending AKA-Identity (Permanent-Id-Req) (10,7) eap_aka - Encoding EAP-AKA attributes (10,7) eap_aka - &EAP-AKA-Subtype = AKA-Identity (10,7) eap_aka - &EAP-AKA-Permanent-ID-Req = yes (10,7) eap - Sending EAP Request (code 1) ID 95 length 12 (10,7) eap (handled) (10,7) } # authenticate eap (handled) (11,7) authenticate eap { (11,7) eap - Peer sent packet with EAP method AKA (23) (11,7) eap - Calling submodule eap_aka (11,7) eap_aka - EAP-AKA decoded attributes (11,7) eap_aka - &EAP-AKA-Identity = " 0530990000000074(a)wlan.mnc005.mcc530.3gppnetwork.org" (11,7) eap_aka - &EAP-AKA-Subtype = AKA-Identity (11,7) eap_aka - WARNING: Failed parsing identity: Got AKA-Permanent-ID tag, but identity is not a permanent ID (11,7) eap_aka - Changed state IDENTITY -> CHALLENGE (11,7) eap_aka - Acquiring UMTS vector(s) (11,7) eap_aka - UMTS vector (11,7) eap_aka - AUTN : 0x.. (11,7) eap_aka - CK : 0x.. (11,7) eap_aka - IK : 0x.. (11,7) eap_aka - RAND : 0x.. (11,7) eap_aka - XRES : 0x.. (11,7) eap_aka - Sending AKA-Challenge (11,7) eap_aka - Encoding EAP-AKA attributes (11,7) eap_aka - &EAP-AKA-Subtype = AKA-Challenge (11,7) eap_aka - &EAP-AKA-Bidding = Prefer-AKA-Prime (11,7) eap_aka - &EAP-AKA-RAND = 0x.. (11,7) eap_aka - &EAP-AKA-AUTN = 0x.. (11,7) eap_aka - &EAP-AKA-MAC = 0x (11,7) eap_aka - &EAP-AKA-Checkcode = 0x.. (11,7) eap - Sending EAP Request (code 1) ID 96 length 96 (11,7) eap (handled) (11,7) } # authenticate eap (handled) (12,7) authenticate eap { (12,7) eap - Peer sent packet with EAP method AKA (23) (12,7) eap - Calling submodule eap_aka (12,7) eap_aka - EAP-AKA decoded attributes (12,7) eap_aka - &EAP-AKA-AUTS = 0x.. (12,7) eap_aka - &EAP-AKA-Subtype = AKA-Synchronization-Failure (12,7) eap_aka - ERROR: EAP-AKA Peer synchronization failure (12,7) eap_aka - Changed state CHALLENGE -> FAILURE-NOTIFICATION (12,7) eap_aka - Sending AKA-Notification (General-Failure) (12,7) eap_aka - Encoding EAP-AKA attributes (12,7) eap_aka - &EAP-SIM-Notification = General-Failure (12,7) eap_aka - &EAP-AKA-Subtype = AKA-Notification (12,7) eap - Sending EAP Request (code 1) ID 97 length 12 (12,7) eap (handled) (12,7) } # authenticate eap (handled) (13,7) authenticate eap { (13,7) eap - Peer sent packet with EAP method AKA (23) (13,7) eap - Calling submodule eap_aka (13,7) eap_aka - EAP-AKA decoded attributes (13,7) eap_aka - &EAP-AKA-Subtype = AKA-Notification (13,7) eap_aka - AKA-Notification ACKed, sending EAP-Failure (13,7) eap_aka - Changed state FAILURE-NOTIFICATION -> FAILURE (13,7) eap_aka - Sending EAP-Failure (13,7) eap - ERROR: Failed in EAP AKA (23) session. EAP sub-module failed (13,7) eap - Sending EAP Failure (code 4) ID 97 length 4 (13,7) eap - Cleaning up EAP session (13,7) eap (reject) (13,7) } # authenticate eap (reject) Do I need to have the sequence as a proper counter for AKA rather than just a static value? Or what else am I doing wrong?

1 0

Using Run-time variables in SQL radreply table
by Alex D. 22 Dec '17

22 Dec '17

Hi list, in my lab setup i authenticate subscribers based on DHCP Option 82 remode-id against a Freeradius 2.1.8. Our DSLAMs enrich DHCP requests with DSL line-informations like Actual-Up- and Downstream-Rates. I use these values to have a dynamic QoS configuration on my BNG. With "files" authentication module, this works like a charm... Here's my current configuration in users file: HSI/DEU.MYID.47110815 Password := "lab" ERX-CoS-Shaping-Pmt-Type = "T02 %{request:Actual-Data-Rate-Downstream}", ERX-Virtual-Router-Name = VRF-HSI-CGN In Access-Accept, %{request:Actual-Data-Rate-Downstream} is translated to the respective Downstream bandwidth: Wed Dec 20 16:24:46 2017 - User HSI/DEU.MYID.47110815 Packet-Type = Access-Accept ERX-CoS-Shaping-Pmt-Type = "T02 25693" ERX-Virtual-Router-Name = "VRF-HSI-CGN" After successful testing, i tried to migrate to SQL authentication module. But that doesn't work because in rlm_sql %{request:Actual-Data-Rate-Downstream} is just a string and is not translated. Is there a possibility to use run-time variables in SQL radreply table or is there another module i can use to reach my goal ? Thanks in advance. Regards, Alex

3 10

Attributes from DEFAULT user are always used although there's a more specific user
by Alex D. 22 Dec '17

22 Dec '17

Hello, i try to use files and SQL for authentication. In my users file, i have a DEFAULT user and a specific user 'HSI/DEU.MYID.47110815' in SQL radcheck/radreply table. If my user is authenticated, Attributes from respective user *and* from DEFAULT user are replied to the nas although there is no explicit "Fall-Through = Yes" attribute. Is that an excpected behaviour ? How can i achieve that only attributes from specific user is replied and those from DEFAULT user are only replied, when there is no accurate user. root@quagga:/opt/freeradius/etc/raddb# more users DEFAULT User-Name =~ "^HSI.*", Auth-Type := Accept Class = "Default" reply-detail-20171221: Thu Dec 21 14:43:52 2017 Packet-Type = Access-Accept Class = 0x44656661756c74 ERX-Virtual-Router-Name == "VRF-132" mysql> select * from radreply; +----+-----------------------+-------------------------+----+---------+ | id | username | attribute | op | value | +----+-----------------------+-------------------------+----+---------+ | 4 | HSI/DEU.MYID.47110815 | ERX-Virtual-Router-Name | == | VRF-132 | +----+-----------------------+-------------------------+----+---------+ Freeradius version is 2.2.10. Attached you also find a debug from the mentioned authentication request. Regards, Alex

2 3

Wrong Called-station-id in Mysql
by Marco Ramian 22 Dec '17

22 Dec '17

Hi Guys, Need your help please. i see the right called-station-id in freeradius Logs. but in Mysql table the wrong one, almost all the time (90%) see the same Mac address ( 28-6f-7f-ef-f3-33 ) as called station id in mysql ! but see right one in freeradius logs ! what can be the problem ? FreeRadius Logs : Fri Dec 22 10:10:00 2017 : Auth: Login OK: [ "e05f45657d2d/e05f45657d2d] (from client BUS port 1 cli e0-5f-45-65-7d-2d) 04-62-73-9b-19-e0:@MobiConnect-freeWiFi Mysql: "radacctid" "acctsessionid" "acctuniqueid" "username" "groupname" "realm" "nasipaddress" "nasportid" "nasporttype" "acctstarttime" "acctstoptime" "acctsessiontime" "acctauthentic" "connectinfo_start" "connectinfo_stop" "acctinputoctets" "acctoutputoctets" "calledstationid" "callingstationid" "acctterminatecause" "servicetype" "framedprotocol" "framedipaddress" "acctstartdelay" "acctstopdelay" "xascendsessionsvrkey""789" "5a3cd47c/e0:5f:45:65:7d:2d/568133" "86da51b5fbcb4136" "e0-5f-45-65-7d-2d" "" "" "172.25.31.68" "1" "Wireless-802.11" "2017-12-22 10:46:39" \N "0" "RADIUS" "" "" "0" "0" "28-6f-7f-ef-f3-33" "e0-5f-45-65-7d-2d" "" "" "" "172.16.67.157" "0" "0" "" Thank you

2 1

Freeradius 3.0.15 + redis
by Bassem Mettichi 21 Dec '17

21 Dec '17

Hello, has any one tested freeradius 3.0.15 + redis database? i have compiled freeradius 3.0.015 and i have linked redis and rediswh from mods-available to mods-enable but when i try to start freeradius debug mode i get this error: /opt/freeradius/v.3.0.15/etc/raddb/mods-enabled/redis[10]: Failed to link to module 'rlm_redis': /opt/freeradius/v.3.0.15/lib/rlm_redis.so: cannot open shared object file: No such file or directory Please i need your help could someone tell me how to correct this? Best Regards Mettichi Bassem

2 1

Revisiting June 4, 2017 thread, "WARNING: Outer and inner identities are the same."
by David Hendricks 20 Dec '17

20 Dec '17

Forgive me. I have the same issue as mentioned in the June 4, 2017 archived thread. It seems to me the issue is explained but not how to fix it. Question: Which file must be edited and in which manner to eliminate this warning about user privacy being compromised due to the same outer and inner identities? Details: 3.0.15 FreeRADIUS build, in a lab environment. My only edits are to add a user, add a client, and make fresh certificates. The NAS is an Aruba 7005 wireless controller. Authentication succeeds if I configure the client not to validate the certificate, but I see this in the freeradius -X output: (7) authenticate { (7) eap: Expiring EAP session with state 0xf00edcbdf607c57b (7) eap: Finished EAP session with state 0xf00edcbdf607c57b (7) eap: Previous EAP request found for state 0xf00edcbdf607c57b, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state WAITING FOR INNER IDENTITY (7) eap_peap: Identity - guest123 (7) eap_peap: Got inner identity 'guest123' (7) eap_peap: Setting default EAP type for tunneled EAP session (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x0209000d016775657374313233 (7) eap_peap: Setting User-Name to guest123 (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x0209000d016775657374313233 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "guest123" (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x0209000d016775657374313233 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "guest123" (7) WARNING: Outer and inner identities are the same. User privacy is compromised.

4 4

SQL module - merging radcheck/radreply
by Maxime Gerges 20 Dec '17

20 Dec '17

Hello folks, I have some quick questions regarding the freeradius SQL module and the different implemented tables. As far as I know these are the tables defined in the default SQL schema for freeradius : - radcheck : attributes in this table are only internal to freeradius and not used in the radius reply (confirm ?) - radreply : attributes in this table are used as reply attributes sent to the NAS - radgroupcheck : same as radcheck only for groups - radgroupreply : same as radreply only for groups Would it be possible to merge both tables (radcheck & radreply or radgroupcheck & radgroureply) as the attributes in radcheck would already be considered as internal and not send in the reply according to their VSA number ? As far as I know these internal attributes (located in radcheck) are considered control attributes when their VSA number is 1000+, and placed in the corresponding chain after being extracted from the database. From your point of you, does it make sense to merge both table ? Thanks for your clarification. Maxime.

2 1

RADIUS and user names
by JCA 19 Dec '17

19 Dec '17

I have configured my Linux system so that access to it over SSH is authenticated by a remote RADIUS servers. This works fine, but the user must be defined locally, and it must have a home directory. In my efforts to dispense with these requirements, I used a combination of the NSS and PAM. This works, but it requires another server out there, be it NIS, or LDAP, or something like that. Is it not possible to do what I need with a RADIUS server alone? Or is it the case tha RADIUS such does not have such capabilities?

3 2