proxy implementation
Dear Friends, I would like to know detail on proxy implementation. *Currently:* NAS ----> Radius stack (1812,1813). *new proxy approach: * NAS -----> Proxy Radius ------> Radius stack1 (1822,1823). 1st change: Proxy radius implementation with one home servers (stack1 ). 2nd change: Changing current radius stack to run on 1822 (auth) and 1825 (acct). What are all configuration change that I have to do for 1st change and 2nd change. As per my knowledge, *1st change includes:* 1) install new freeradius and configure to accept traffic from NAS. 2) configure proxy.conf to send auth and acct request to home server (stack1). *2nd change includes: * only change the etc/raddb/sites-enabled/inner-tunnel change it as below *listen {* * ipaddr = 127.0.0.1* * port = 18220* * type = auth* *}* Please let me know if any other configuration change that I am missing in the step 1 and 2. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1@yahoo.co.in Mobile: +919886251852
On Mon, Dec 21, 2015 at 06:55:53PM +0530, srithar jeevadurai wrote:
*2nd change includes: *
only change the etc/raddb/sites-enabled/inner-tunnel
change it as below
*listen {* * ipaddr = 127.0.0.1* * port = 18220* * type = auth* *}*
probably sites-enabled/default, not inner-tunnel.
Please let me know if any other configuration change that I am missing in the step 1 and 2.
Update relevant port in proxy.conf on proxy servers. But why change the port number when proxying? Seems a bit weird. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, I have to run proxy radius on same host and run multiple home servers on same host (for a poc that we are trying). So Proxy has to be a plain proxy to auth+acct request and forwards it to home servers. Since Home servers are running on same host, we have to change the default port for each home server radius. sites-enabled/default - is has authentic, authorization and accounting block, apart from post_proxy and pre_proxy blocks. There is no info on changing the default port from 1812 (and 1813) to different one. 1) I am installing new freeradius setup for proxy and going to modify only proxy.conf and then modifying sites-enabled/default and sites-enabled/inner-tunnel. the current running Radius stack (connect to NAS directly) has to be modified to listen different ports from default ports (1812/13). Regards, Srithar On Mon, Dec 21, 2015 at 7:43 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Mon, Dec 21, 2015 at 06:55:53PM +0530, srithar jeevadurai wrote:
*2nd change includes: *
only change the etc/raddb/sites-enabled/inner-tunnel
change it as below
*listen {* * ipaddr = 127.0.0.1* * port = 18220* * type = auth* *}*
probably sites-enabled/default, not inner-tunnel.
Please let me know if any other configuration change that I am missing in the step 1 and 2.
Update relevant port in proxy.conf on proxy servers.
But why change the port number when proxying? Seems a bit weird.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1@yahoo.co.in Mobile: +919886251852
On Tue, Dec 22, 2015 at 02:42:17PM +0530, srithar jeevadurai wrote:
sites-enabled/default - is has authentic, authorization and accounting block, apart from post_proxy and pre_proxy blocks. There is no info on changing the default port from 1812 (and 1813) to different one.
What version of FreeRADIUS? I'm guessing 2.something. In which case the default listen ports are in radiusd.conf Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, yes, I have changed the default listen ports for home servers in radiusd.conf. I couldn;t succeed with proxy implementation so I have upload the configuration that I used for the proxy setting to the freeradius user mailing list. eap module is important for proxy server ?? I couldn't compile the FR2.2.0 with EAP module so I have removed and disabled eap at all configuration file. On Tue, Dec 22, 2015 at 10:50 PM, Matthew Newton <mcn4@leicester.ac.uk> wrote:
On Tue, Dec 22, 2015 at 02:42:17PM +0530, srithar jeevadurai wrote:
sites-enabled/default - is has authentic, authorization and accounting block, apart from post_proxy and pre_proxy blocks. There is no info on changing the default port from 1812 (and 1813) to different one.
What version of FreeRADIUS? I'm guessing 2.something.
In which case the default listen ports are in radiusd.conf
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1@yahoo.co.in Mobile: +919886251852
On 22 Dec 2015, at 09:12, srithar jeevadurai <srijeevadurai1@gmail.com> wrote:
I have to run proxy radius on same host and run multiple home servers on same host (for a poc that we are trying).
You could run this all in the same FreeRADIUS instance if you like. You'd just need to create a few different inner-tunnel virtual servers (copy the file in sites-available to e.g. inner-tunnel-stack1, change the port information), and then duplicate the module config (at minimum eap) you need different, like: ./mods-available/eap eap { # Normal config ... virtual-server = inner-tunnel ... } eap.stack1 { # Altered Config ... virtual-server = inner-tunnel-stack1 ... } And replace the calls inside the stack1 inner-tunnel: ... authenticate { ... eap.stack1 ... } ... Regards, Adam Bishop gpg: 0x6609D460 jisc.ac.uk | Networkshop 44: Save the date! | 22-24 March 2016 @ University of Manchester Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
participants (3)
-
Adam Bishop -
Matthew Newton -
srithar jeevadurai