proxy.conf (from v2 to v3) - edoroam - NRO - configurations - requested - regarding
Hi all, Greetings. I configured the FreeRADIUS 3 (Centos 7) with G Suite LDAP for our University. I need to configure the eduroam for our University. Our domain name is *tanuvas.org.in <http://tanuvas.org.in/>* Our NRO gave the proxy configuration as follows. As far as I understand, the NRO’s configuration is in FreeRADIUS version 2. We requested the NRO to provide the details of one more server for fail-over. *------------------------------------------------------------------------* *realm tanuvas.org.in <http://tanuvas.org.in/> {* *authhost = LOCAL* *}* *realm DEFAULT {* * authhost= flr1.eduroam.ernet.in <http://flr1.eduroam.ernet.in/>* *secret = <<secret>>* *nostrip* *}* ----------------------------------------------------------------- I wish to configure the above in FreeRADIUS version 3. My configuration of proxy.conf as follows *#Proxy Server Configuration* proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } ------------------------------------------------------------------------------------------------ *#Home Server Configuration* home_server flr1.eduroam.ernet.in { ipaddr = 144.16.140.190 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } *------------------------------------------------------------------------------------------* *#Home Server pool Configuration* home_server_pool EDUROAM { type = fail-over home_server = flr1.eduroam.ernet.in } *-----------------------------------------------------------------------------------* *# realm configuration* realm tanuvas.org.in { auth_pool = LOCAL } realm DEFAULT { auth_pool = EDUROAM nostrip } ------------------------------------------------------------------ The questions are, 1. As I understand, the home server means the eduroam servers of NRO. Hence, I configured the home server and home server pool as above. 2. Are the above proxy and realm config correct or not? 3. Our domain name is tanuvas.org.in. I configured the realm as LOCAL 4. Realm DEFAULT points to the Home Server Pool EDUROAM. Is it correct 5. Mention the corrections required in the proxy.conf 6. Is it necessary to configure the realms NULL and LOCAL (We are having two more domains named tanuvas.ac.in and tanuvas.edu.in) Best Regards, *Thirunavukkarasu*
On Jun 20, 2021, at 3:15 PM, P.Thirunavukkarasu <drthiruna@tanuvas.org.in> wrote:
1. As I understand, the home server means the eduroam servers of NRO. Hence, I configured the home server and home server pool as above.
2. Are the above proxy and realm config correct or not?
If the server starts, yes.
3. Our domain name is tanuvas.org.in. I configured the realm as LOCAL
Yes.
4. Realm DEFAULT points to the Home Server Pool EDUROAM. Is it correct
It depends on what you want to do.
5. Mention the corrections required in the proxy.conf
I have no idea what advice to offer.
6. Is it necessary to configure the realms NULL and LOCAL
It depends on what you want to do. In general, it's impossible for us to know if your configuration is correct. It all depends on what you want to do. We recommend reading the documentation and understanding how things work, and your local requirements. We just can't build everyone's system for them. You have to understand your system. Alan DeKok.
Hi, Greetings and Thanks for the reply. 1. As I understand, the home server means the eduroam servers of NRO.
Hence, I configured the home server and home server pool as above.
2. Are the above proxy and realm config correct or not?
If the server starts, yes. *It shows "Ready to process the request" in the debugging mode.*
3. Our domain name is tanuvas.org.in. I configured the realm as LOCAL
Yes. *We need the the process the requests for our local users locally with our domain name is tanuvas.org.in <http://tanuvas.org.in> as a suffix. *
4. Realm DEFAULT points to the Home Server Pool EDUROAM. Is it correct
It depends on what you want to do. *We need to forward the request by roaming users from other Universities to the ERNET, our national level NRO for eduroam. Similarly vice-versa should happen when our users are roaming. *
6. Is it necessary to configure the realms NULL and LOCAL
It depends on what you want to do. *We need to process the this NULL and LOCAL realm locally without proxying to ERNET* *Regards* *Thirunavukkarasu*
On Jun 21, 2021, at 7:20 AM, P.Thirunavukkarasu <drthiruna@tanuvas.org.in> wrote:
*We need to forward the request by roaming users from other Universities to the ERNET, our national level NRO for eduroam. Similarly vice-versa should happen when our users are roaming. *
6. Is it necessary to configure the realms NULL and LOCAL
It depends on what you want to do. *We need to process the this NULL and LOCAL realm locally without proxying to ERNET*
Then read the documentation and do what it says. The documentation explains how to do what you want. We are NOT going to copy & paste the documentation to this list. We are NOT going to explain the documentation again. We are NOT going to write your configuration for you. Your questions make it clear that you want us to do your work for you. That's not going to happen. Alan DeKok.
Here you find the manual: https://wiki.geant.org/pages/viewpage.action?pageId=121346259 This is how I configured it: /etc/freeradius/3.0# cat sites-enabled/eduroam server eduroam { listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipv6addr = :: port = 0 } listen { type = "acct" ipv6addr = :: port = 0 } authorize { # only use filter_username from version > 3.0.7 on filter_username update request { Operator-Name := "1domain.tld" # the literal number "1" above is an important prefix! Do not change it! } # if you want detailed logging auth_log suffix } authenticate { } preacct { suffix } accounting { } post-auth { # if you want detailed logging uncomment #reply_log Post-Auth-Type REJECT { # reply_log } } pre-proxy { # if you want detailed logging uncomment #pre_proxy_log if("%{Packet-Type}" != "Accounting-Request") { attr_filter.pre-proxy } update proxy-request { NAS-Port-Type := 19 } } post-proxy { # if you want detailed logging uncomment #post_proxy_log attr_filter.post-proxy } } ------------------------------- proxy.conf (servers 1-4 are Windows NPS and don't support status-server, unlike the ftlr ones, check that with your provider) proxy server { default_fallback = no } home_server server1 { type = auth+acct ipaddr = x.x.x.x port = 1812 secret = "password" status_check = none response_window = 20 zombie_period = 20 check_interval = 6 revive_interval = 10 num_answers_to_alive = 3 } home_server server2 { type = auth+acct ipaddr = x.x.x.x port = 1812 secret = "password" status_check = none response_window = 20 zombie_period = 20 check_interval = 6 revive_interval = 10 num_answers_to_alive = 3 } home_server server3 { type = auth+acct ipaddr = x.x.x.x port = 1812 secret = "password" status_check = none response_window = 20 zombie_period = 20 check_interval = 6 revive_interval = 10 num_answers_to_alive = 3 } home_server server4 { type = auth+acct ipaddr = x.x.x.x port = 1812 secret = "password" status_check = none response_window = 20 zombie_period = 20 check_interval = 6 revive_interval = 10 num_answers_to_alive = 3 } home_server eduroam-3 { type = auth+acct ipaddr = ftlr1.x.x port = 1812 secret = password status_check = status-server response_window = 20 zombie_period = 20 check_interval = 6 num_answers_to_alive = 3 } home_server eduroam-4 { type = auth+acct ipaddr = ftlr2.x.x port = 1812 secret = password status_check = status-server response_window = 20 zombie_period = 20 check_interval = 6 num_answers_to_alive = 3 } home_server_pool EDUROAM { type = fail-over home_server = eduroam-3 home_server = eduroam-4 } home_server_pool DOMAIN1 { type = fail-over home_server = server1 home_server = server2 } home_server_pool DOMAIN2 { type = fail-over home_server = server3 home_server = server4 } realm NULL { virtual_server = auth-reject nostrip } realm domain1.tld { pool = DOMAIN1 nostrip } realm domain2.tld { pool = DOMAIN2 nostrip } realm "~.+$" { pool = EDUROAM nostrip } ----------------------------------- You also need to configure the files pre-proxy, post-proxy and of course clients.conf. Then I also suggest doing performance optimizations like this (but read the manual, those settings depend on your used server setup): vi radiusd.conf max_request_time = 20 auth = yes reject_delay = 0 max_servers = 2048 min_spare_servers = 8 max_spare_servers = 32 Kind regards Patrick -----Original Message----- From: Freeradius-Users <freeradius-users-bounces+patrick.oberli=ost.ch@lists.freeradius.org> On Behalf Of P.Thirunavukkarasu Sent: Montag, 21. Juni 2021 13:20 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: proxy.conf (from v2 to v3) - edoroam - NRO - configurations - requested - regarding Hi, Greetings and Thanks for the reply. 1. As I understand, the home server means the eduroam servers of NRO.
Hence, I configured the home server and home server pool as above.
2. Are the above proxy and realm config correct or not?
If the server starts, yes. *It shows "Ready to process the request" in the debugging mode.*
3. Our domain name is tanuvas.org.in. I configured the realm as LOCAL
Yes. *We need the the process the requests for our local users locally with our domain name is tanuvas.org.in <http://tanuvas.org.in> as a suffix. *
4. Realm DEFAULT points to the Home Server Pool EDUROAM. Is it correct
It depends on what you want to do. *We need to forward the request by roaming users from other Universities to the ERNET, our national level NRO for eduroam. Similarly vice-versa should happen when our users are roaming. *
6. Is it necessary to configure the realms NULL and LOCAL
It depends on what you want to do. *We need to process the this NULL and LOCAL realm locally without proxying to ERNET* *Regards* *Thirunavukkarasu* - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 21/06/2021 12:20, P.Thirunavukkarasu wrote:
*We need to forward the request by roaming users from other Universities to the ERNET, our national level NRO for eduroam. Similarly vice-versa should happen when our users are roaming. *
We have a good basic guide to setting up eduroam on the wiki: https://wiki.freeradius.org/guide/eduroam I would start there. If you get stuck with a particular thing, that's the time to ask, not "how to I write a complete config to do this". -- Matthew
Hi, Thank You Sorry for the misunderstanding. I am not asking you to write my code. Just I want to check my code. I am a Veterinary Faculty, not a person from IT or Computer Science Ok, I am in touch with my NRO. I am trying to debug my code. FreeRADIUS is running smoothly with my G Suite LDAP for my local users. The Only issue is eduroam. Regards,' Thirunavukkarasu
On Jun 22, 2021, at 7:42 AM, P.Thirunavukkarasu <drthiruna@tanuvas.org.in> wrote:
Sorry for the misunderstanding. I am not asking you to write my code. Just I want to check my code.
Then check it yourself. We're happy to answer questions about FreeRADIUS. We're happy to teach people. But your emails come across as "I don't know what to do, so you do it". No, we are not your personal IT consulting company. We're not going to do your job for you.
I am a Veterinary Faculty, not a person from IT or Computer Science
What does that have to do with anything? You're doing it, so you should take pride in your work, and do your job well. If this means learning about IT and FreeRADIUS, well.. then learn. Did you start off knowing everything about your current job? Or did you learn?
Ok, I am in touch with my NRO. I am trying to debug my code.
You're not asking questions about debugging the code. "Hi, I tried this, but it doesn't work, can you help me" You're asking questions about us doing your job for you. Alan DeKok.
Hi, The issue is resolved with the help of you and by NRO Thanks for the support, Thirunavukkarasu
Hi, The issue is resolved with the help of you and by NRO Thanks for the support, Thirunavukkarasu
On 22/06/2021 12:42, P.Thirunavukkarasu wrote:
Sorry for the misunderstanding. I am not asking you to write my code. Just I want to check my code. I am a Veterinary Faculty, not a person from IT or Computer Science Ok, I am in touch with my NRO. I am trying to debug my code. FreeRADIUS is running smoothly with my G Suite LDAP for my local users. The Only issue is eduroam.
Understood. But the easiest way to find out if it works or not is to try it. Then if it doesn't work and you can't understand it, come here with "I tried X and this isn't working, please could someone help explain it". Asking people here to check every line of your config is basically just asking for free consultancy. It's a lot of work, when you can just check it to see for yourself. -- Matthew
participants (4)
-
Alan DeKok -
Matthew Newton -
P.Thirunavukkarasu -
Patrick Oberli