RE: Freeradius-Users Digest, Vol 144, Issue 10
I am a little bit new to freeradius. I have 2 freeradius 2.1.12 servers on Ubuntu 14.04.5 servers and two old freeradius 2.1.10 servers on Ubuntu 12.04.5 On the old server we have the default site and eduroam configured. On the new servers we have a switches which is similar to default but allows authentication to our Network switches. Extra configuration is set in the authorize section for switches but this does not work on the new servers. How does freeradius know which site file to use for authentication? Does it try each file in turn and in what order? I know that each line is read and executed in turn but is there some policy or conditions that need setting to tell freeradius Out to authorize users? Is there any document links I can read? Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Networks Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.
On Wed, Apr 05, 2017 at 08:58:02AM +0000, Peter Hutchison wrote:
I have 2 freeradius 2.1.12 servers on Ubuntu 14.04.5 servers and two old freeradius 2.1.10 servers on Ubuntu 12.04.5
You're probably already aware, but they are really old, and unsupported. If nothing else there are EAP security issues in both those versions with available exploits. If you can't easily upgrade to version 3 then the latest 2.2.9, while still unsupported, is at least pretty much a drop in replacement.
On the old server we have the default site and eduroam configured.
OK, so eduroam is authenticating against 2.1.10.
On the new servers we have a switches which is similar to default but allows authentication to our Network switches.
OK, switches against 2.1.12.
Extra configuration is set in the authorize section for switches but this does not work on the new servers.
I don't follow this - you say your switches already authenticate on your new servers?
How does freeradius know which site file to use for authentication? Does it try each file in turn and in what order?
The virtual server can be set, e.g. by a virtual_server setting in the client definition. Otherwise it will fall back to using the default virtual server. Really the best thing to do is to run FreeRADIUS in debug mode. freeradius -X (radiusd -X on non Debian-based systems) and read the output. It can be daunting at first, but it tells you everything the server is doing and from where in what order. There's no better way of finding out how your config is working.
I know that each line is read and executed in turn but is there some policy or conditions that need setting to tell freeradius Out to authorize users?
I don't understand this - the whole FreeRADIUS config is basically policy on how and when to authenticate users.
Is there any document links I can read?
Try at least http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf especially chapter 4 for basic server operation, but other concepts are explained there too. Also the NetworkRADIUS documentation at http://networkradius.com/doc/current/ http://networkradius.com/doc/current/raddb/sites-available/home.html explains about virtual servers, which requests are passed through. There's lots on the wiki. Virtual servers at http://wiki.freeradius.org/config/Virtual-server, but otherwise start at http://wiki.freeradius.org/Home and look at least at the Concepts and introduction pages. The HOWTOs are also really useful. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (2)
-
Matthew Newton -
Peter Hutchison