Setting up freeradius to work with cisco aironet accesspoints in a custom environment
Hello, i am trying to setup freeradius in our quite custom environment. I already managed to get the authentication work with freeradius but not the integration in our environment. Is there a way to look into a radius request to see what information is provided? And how to use it in the SQL template or configuration? The authentication from the cisco aironet access points should be done in two ways. The first one is mac authentication and the other is leap authentication (User, Domain, Password). We have stored the information in a sql database, but in different tables. One table contains the mac-addresses (among other information about the hardware). The mac-address authentication should be done against this table. Another table contains user information like Domain, Username and Password and much of other information. The passwords are encrypted (unix password crypt). How do i manage to authenticate theses two ways with one radius server? How do i manage it, to integrate freeradius in this database environment? Any help is appreciated. Whould be also nice, if you could point out some interesting and not too long documentation on theses special topics. Thx in advance, -- Mario Lipinski VOIP: +49 511 696045510 Systemadministration Fax: +49 721 151-207196 Gymnasium Salzgitter-Bad E-Mail: mario.lipinski@gymszbad.de Internet: http://www.gymszbad.de
Mario Lipinski <mario.lipinski@gymszbad.de> wrote:
Is there a way to look into a radius request to see what information is provided?
Debug mode? Read the README's.
And how to use it in the SQL template or configuration?
The sample SQL configuration in sql.conf?
Another table contains user information like Domain, Username and Password and much of other information. The passwords are encrypted (unix password crypt).
Then you can't do LEAP.
Any help is appreciated. Whould be also nice, if you could point out some interesting and not too long documentation on theses special topics.
The server contains general information on what the configuration options are, and what they mean. The server does NOT contain detailed information on how to set up your site configuration, because every site is different. Alan DeKok.
Hello, thank you for your response. Alan DeKok schrieb:
Mario Lipinski <mario.lipinski@gymszbad.de> wrote:
And how to use it in the SQL template or configuration?
The sample SQL configuration in sql.conf?
I will have a closer look at this now. Maybe you could give me a hint how to configure Freeradius to look for MAC Addresses and EAP authentication in different tables?
Another table contains user information like Domain, Username and Password and much of other information. The passwords are encrypted (unix password crypt).
Then you can't do LEAP.
What else could i do? Is there a solution which works with unix crypt and without a ssl certification infrastructure? Can i do LEAP with Samba-Passwords (which are also stored in the db)? I think this should work in general but not with the MSChapv2 implementation in FreeRadius. Is there any way?
Any help is appreciated. Whould be also nice, if you could point out some interesting and not too long documentation on theses special topics.
The server contains general information on what the configuration options are, and what they mean. The server does NOT contain detailed information on how to set up your site configuration, because every site is different.
OK. Thats all that my writing is about. I don't know how to really get away from the sample layout. For example how to distinguish between MAC-Address and EAP authentication requests. I think the problem i atm have is, that i don't understand much about radius and so cannot point out where my problem exactly is... I will try to get some more deeper into it now. Mario
"Mario Lipinski" <mario.lipinski@gymszbad.de> wrote:
I will have a closer look at this now. Maybe you could give me a hint how to configure Freeradius to look for MAC Addresses and EAP authentication in different tables?
The sql documentation included with FreeRADIUS should say how to configure it in general. Follow those examples for your situation.
Can i do LEAP with Samba-Passwords (which are also stored in the db)?
Yes.
I think this should work in general but not with the MSChapv2 implementation in FreeRadius. Is there any way?
It works.
OK. Thats all that my writing is about. I don't know how to really get away from the sample layout. For example how to distinguish between MAC-Address and EAP authentication requests.
Read the debug log. You have the information in front of you. I don't have access to your system, so it wouild be inappropriate of me to guess. Alan DeKok.
Hello, Am Montag, den 25.07.2005, 12:57 -0400 schrieb Alan DeKok:
"Mario Lipinski" <mario.lipinski@gymszbad.de> wrote:
Can i do LEAP with Samba-Passwords (which are also stored in the db)?
Yes.
I think this should work in general but not with the MSChapv2 implementation in FreeRadius. Is there any way?
It works.
It does, now. :) Needed to use the ":=" operator and prepend "0x" to the NT-Password value. Also got it configured to work with my database structure.
OK. Thats all that my writing is about. I don't know how to really get away from the sample layout. For example how to distinguish between MAC-Address and EAP authentication requests.
Read the debug log. You have the information in front of you. I don't have access to your system, so it wouild be inappropriate of me to guess.
I am attaching two requests taken from the debug log. The first one is the request for the MAC-Address Authentication, the second one is the one for LEAP authentication (works, eap messages were cut since they might contain real user information, dunno). For the MAC-Address stuff i need to lookup the things in another database. I know i can define different sql spaces with "sql name" in the configs. But how to decide, which table use for the lookup. Both requests are of the type "Login-User". The only difference is, that the MAC-Address authentication request contains the "User-Password" attribute. I read much about comparing the values of the attributes, but how to check for their existence? If there is no better way, i might use a regex matching [0-9a-f]{12} - should work? How do i write it in the config to use "sql a" when the regex matches and to use "sql b" if not? I hope i provided all information needed to get a quick and clear answer this time. Thanks, -- Mario Lipinski VOIP: +49 511 696045510 Systemadministration Fax: +49 721 151-207196 Gymnasium Salzgitter-Bad E-Mail: mario.lipinski@gymszbad.de Internet: http://www.gymszbad.de
participants (2)
-
Alan DeKok -
Mario Lipinski