Hello everyone, I've Installed by yum freeradius2-2.1.7-7.el5 but I'm can't found the ldap dirctory under /etc/raddb/.. I have creta it or install more any package ?? thank! 2011/3/5 <freeradius-users-request@lists.freeradius.org>
Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org
You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: Caching techniques with ntlm_auth usage? (EAP-PEAP-MSchapV2) (Phil Mayers) 2. Re: Freeraidus 2 (Gary Gatten) 3. Re: Caching techniques with ntlm_auth usage? (EAP-PEAP-MSchapV2) (James J J Hooper) 4. RE: mschap with ntlm_auth and Active Directory (McNutt, Justin M.) 5. Re: MS-CHAP-V2 with no retry (Alan DeKok) 6. Re: Hopefully quick question: conditional processing sneaking in and setting Auth-Type (Alan DeKok) 7. Re: Freeraidus 2 (Alan Buxey)
----------------------------------------------------------------------
Message: 1 Date: Sat, 05 Mar 2011 00:45:43 +0000 From: Phil Mayers <p.mayers@imperial.ac.uk> Subject: Re: Caching techniques with ntlm_auth usage? (EAP-PEAP-MSchapV2) To: freeradius-users@lists.freeradius.org Message-ID: <4D7187B7.5000402@imperial.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
On 03/05/2011 12:21 AM, Gary Gatten wrote:
I kinda like your caching idea, but not sure of any security implications.
It's not a workable idea. MSCHAP responses are specific to the 8-byte random challenge, which is different every time. You can't cache them.
I have (2) FR servers (each pointing to different DC) and my NAS's are configured to use both. But, iirc if AD is down on the backend FR still replies (with something) so the NAS never rolls over to the other FR server.
Yes, this is a bad idea.
Just configure samba to autodiscover the AD controllers. Winbind will cache connections and open new ones when the old ones go away.
So, I thought about some script that would use ntlm_auth every...n seconds, if it fails kill FR process (or use FR policy to act dead). When it starts working again, restart FR. This should make the NAS roll to the next FR server.
That might work, but it seems like a sledgehammer to crack a nut.
What about OpenLDAP on the FR server that's "refreshed" / sync'd to the winblows/AD? I've never tried this but assume it's doable.
It's not possible. AD controllers will only sync to other AD controllers.
At some point in the future, Samba 4 might be able to slave the LDAP database of an AD controller, but it's purely theoretical at the moment I think.
------------------------------
Message: 2 Date: Fri, 4 Mar 2011 18:54:44 -0600 From: Gary Gatten <Ggatten@waddell.com> Subject: Re: Freeraidus 2 To: "'freeradius-users@lists.freeradius.org'" <freeradius-users@lists.freeradius.org> Message-ID: < 27487_1299286485_4D7189D5_27487_3768_1_D9B37353831173459FDAA836D3B43499BD354A55@WADPMBXV0.waddell.com
Content-Type: text/plain; charset="utf-8"
Try ../sites_enabled/default; or if *eap requests it would be inner-tunnel, - I think...
From: Paulo Maia [mailto:phc.maia@gmail.com] Sent: Friday, March 04, 2011 06:43 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Freeraidus 2
Compilou o instalou via yum ? Geralmente fica em $RADIUSDIR/modules/ldap
Abs,
2011/3/4 Usu?rio do Sistema <maiconlp@ig.com.br<mailto:maiconlp@ig.com.br
Hello everyone, I'm Maicon from Brazil.
I'm in a project with Freeradius. I want to deployment authentication with certificate from my wireless users EAP-TLS but I'm finding some difficult. there is a good how to for version 2 ?? I've started with version 1.x but decided to change for version 2 and I'm not finding where I set the LDAP conection. at the older version it was inside radiusd.conf. anybody help me ??
thank!
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
<font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
Yum install freeradius2-ldap Cheers, Harry From: freeradius-users-bounces+hhoffman=ip-solutions.net@lists.freeradius.org [mailto:freeradius-users-bounces+hhoffman=ip-solutions.net@lists.freeradius. org] On Behalf Of Usuário do Sistema Sent: Wednesday, March 09, 2011 2:39 PM To: freeradius-users@lists.freeradius.org Cc: freeradius-users-request@lists.freeradius.org Subject: Re: Freeradius 2 Hello everyone, I've Installed by yum freeradius2-2.1.7-7.el5 but I'm can't found the ldap dirctory under /etc/raddb/.. I have creta it or install more any package ?? thank! 2011/3/5 <freeradius-users-request@lists.freeradius.org> Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Caching techniques with ntlm_auth usage? (EAP-PEAP-MSchapV2) (Phil Mayers) 2. Re: Freeraidus 2 (Gary Gatten) 3. Re: Caching techniques with ntlm_auth usage? (EAP-PEAP-MSchapV2) (James J J Hooper) 4. RE: mschap with ntlm_auth and Active Directory (McNutt, Justin M.) 5. Re: MS-CHAP-V2 with no retry (Alan DeKok) 6. Re: Hopefully quick question: conditional processing sneaking in and setting Auth-Type (Alan DeKok) 7. Re: Freeraidus 2 (Alan Buxey) ---------------------------------------------------------------------- Message: 1 Date: Sat, 05 Mar 2011 00:45:43 +0000 From: Phil Mayers <p.mayers@imperial.ac.uk> Subject: Re: Caching techniques with ntlm_auth usage? (EAP-PEAP-MSchapV2) To: freeradius-users@lists.freeradius.org Message-ID: <4D7187B7.5000402@imperial.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 03/05/2011 12:21 AM, Gary Gatten wrote:
I kinda like your caching idea, but not sure of any security implications.
It's not a workable idea. MSCHAP responses are specific to the 8-byte random challenge, which is different every time. You can't cache them.
I have (2) FR servers (each pointing to different DC) and my NAS's are configured to use both. But, iirc if AD is down on the backend FR still replies (with something) so the NAS never rolls over to the other FR server.
Yes, this is a bad idea. Just configure samba to autodiscover the AD controllers. Winbind will cache connections and open new ones when the old ones go away.
So, I thought about some script that would use ntlm_auth every...n seconds, if it fails kill FR process (or use FR policy to act dead). When it starts working again, restart FR. This should make the NAS roll to the next FR server.
That might work, but it seems like a sledgehammer to crack a nut.
What about OpenLDAP on the FR server that's "refreshed" / sync'd to the winblows/AD? I've never tried this but assume it's doable.
It's not possible. AD controllers will only sync to other AD controllers. At some point in the future, Samba 4 might be able to slave the LDAP database of an AD controller, but it's purely theoretical at the moment I think. ------------------------------ Message: 2 Date: Fri, 4 Mar 2011 18:54:44 -0600 From: Gary Gatten <Ggatten@waddell.com> Subject: Re: Freeraidus 2 To: "'freeradius-users@lists.freeradius.org'" <freeradius-users@lists.freeradius.org> Message-ID: <27487_1299286485_4D7189D5_27487_3768_1_D9B37353831173459FDAA836D3B43499BD35 4A55@WADPMBXV0.waddell.com> Content-Type: text/plain; charset="utf-8" Try ../sites_enabled/default; or if *eap requests it would be inner-tunnel, - I think... From: Paulo Maia [mailto:phc.maia@gmail.com] Sent: Friday, March 04, 2011 06:43 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Freeraidus 2 Compilou o instalou via yum ? Geralmente fica em $RADIUSDIR/modules/ldap Abs, 2011/3/4 Usu?rio do Sistema <maiconlp@ig.com.br<mailto:maiconlp@ig.com.br>> Hello everyone, I'm Maicon from Brazil. I'm in a project with Freeradius. I want to deployment authentication with certificate from my wireless users EAP-TLS but I'm finding some difficult. there is a good how to for version 2 ?? I've started with version 1.x but decided to change for version 2 and I'm not finding where I set the LDAP conection. at the older version it was inside radiusd.conf. anybody help me ?? thank! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
Thank Cheers Harry. it's work. now I'm configurating the freeradius with EAP-TLS. I will give reports about this case. thank! 2011/3/9 Harry Hoffman <hhoffman@ip-solutions.net>
Yum install freeradius2-ldap
Cheers,
Harry
*From:* freeradius-users-bounces+hhoffman=ip-solutions.net@ lists.freeradius.org [mailto:freeradius-users-bounces+hhoffman= ip-solutions.net@lists.freeradius.org] *On Behalf Of *Usuário do Sistema *Sent:* Wednesday, March 09, 2011 2:39 PM
*To:* freeradius-users@lists.freeradius.org *Cc:* freeradius-users-request@lists.freeradius.org *Subject:* Re: Freeradius 2
Hello everyone, I've Installed by yum freeradius2-2.1.7-7.el5 but I'm can't found the ldap dirctory under /etc/raddb/..
I have creta it or install more any package ??
thank!
2011/3/5 <freeradius-users-request@lists.freeradius.org>
Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request@lists.freeradius.org
You can reach the person managing the list at freeradius-users-owner@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: Caching techniques with ntlm_auth usage? (EAP-PEAP-MSchapV2) (Phil Mayers) 2. Re: Freeraidus 2 (Gary Gatten) 3. Re: Caching techniques with ntlm_auth usage? (EAP-PEAP-MSchapV2) (James J J Hooper) 4. RE: mschap with ntlm_auth and Active Directory (McNutt, Justin M.) 5. Re: MS-CHAP-V2 with no retry (Alan DeKok) 6. Re: Hopefully quick question: conditional processing sneaking in and setting Auth-Type (Alan DeKok) 7. Re: Freeraidus 2 (Alan Buxey)
----------------------------------------------------------------------
Message: 1 Date: Sat, 05 Mar 2011 00:45:43 +0000 From: Phil Mayers <p.mayers@imperial.ac.uk> Subject: Re: Caching techniques with ntlm_auth usage? (EAP-PEAP-MSchapV2) To: freeradius-users@lists.freeradius.org Message-ID: <4D7187B7.5000402@imperial.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
On 03/05/2011 12:21 AM, Gary Gatten wrote:
I kinda like your caching idea, but not sure of any security implications.
It's not a workable idea. MSCHAP responses are specific to the 8-byte random challenge, which is different every time. You can't cache them.
I have (2) FR servers (each pointing to different DC) and my NAS's are configured to use both. But, iirc if AD is down on the backend FR still replies (with something) so the NAS never rolls over to the other FR server.
Yes, this is a bad idea.
Just configure samba to autodiscover the AD controllers. Winbind will cache connections and open new ones when the old ones go away.
So, I thought about some script that would use ntlm_auth every...n seconds, if it fails kill FR process (or use FR policy to act dead). When it starts working again, restart FR. This should make the NAS roll to the next FR server.
That might work, but it seems like a sledgehammer to crack a nut.
What about OpenLDAP on the FR server that's "refreshed" / sync'd to the winblows/AD? I've never tried this but assume it's doable.
It's not possible. AD controllers will only sync to other AD controllers.
At some point in the future, Samba 4 might be able to slave the LDAP database of an AD controller, but it's purely theoretical at the moment I think.
------------------------------
Message: 2 Date: Fri, 4 Mar 2011 18:54:44 -0600 From: Gary Gatten <Ggatten@waddell.com> Subject: Re: Freeraidus 2 To: "'freeradius-users@lists.freeradius.org'" <freeradius-users@lists.freeradius.org> Message-ID: < 27487_1299286485_4D7189D5_27487_3768_1_D9B37353831173459FDAA836D3B43499BD354A55@WADPMBXV0.waddell.com
Content-Type: text/plain; charset="utf-8"
Try ../sites_enabled/default; or if *eap requests it would be inner-tunnel, - I think...
From: Paulo Maia [mailto:phc.maia@gmail.com] Sent: Friday, March 04, 2011 06:43 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Re: Freeraidus 2
Compilou o instalou via yum ? Geralmente fica em $RADIUSDIR/modules/ldap
Abs,
2011/3/4 Usu?rio do Sistema <maiconlp@ig.com.br<mailto:maiconlp@ig.com.br
Hello everyone, I'm Maicon from Brazil.
I'm in a project with Freeradius. I want to deployment authentication with certificate from my wireless users EAP-TLS but I'm finding some difficult. there is a good how to for version 2 ?? I've started with version 1.x but decided to change for version 2 and I'm not finding where I set the LDAP conection. at the older version it was inside radiusd.conf. anybody help me ??
thank!
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
<font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
Hey all, is there any good resources on how to actually use Freeradius2 once its installed? I have it running along with CoovaChilli as my captive portal, and daloRADIUS for the GUI (As i wil have people inputting users that have no idea about how to use command..). My problem is this: we have clients that are people in teh ir houses that connect to our wireless network, COoca login page appears and they login with the username and password that i input into daloRADIUS. I have a few clients that are small Lan Houses that want to use our system, but i am unsure if i can have them not need to login through the CoovaChilli portal, and they just get authenticated via MAC address of their Antenna? I can't find any good documentation on how to do anything with Freeradius. Thanks in Advance
Dude, you are SO gonna get flamed - put your flame suit on! Hopefully Mr. DeKok is in a good mood! ;-) So you want some users to auth with username/passwd; and others with MAC or some other means? There's been numerous posts about similar requirements, plus: Man unlang, man radiusd, etc. Also, some good info and examples embedded in the various config files and samples in the various dirs. Also wiki's... And I think. www.supportingradius.org? Not sure on the url. Dig around a bit and you'll find a $hit load of doc, and probably some good examples of others that did exactly what you want. ----- Original Message ----- From: Luke Hammond [mailto:luke@dezignbrasil.com] Sent: Friday, March 18, 2011 03:24 PM To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: Using Freeradius2 Hey all, is there any good resources on how to actually use Freeradius2 once its installed? I have it running along with CoovaChilli as my captive portal, and daloRADIUS for the GUI (As i wil have people inputting users that have no idea about how to use command..). My problem is this: we have clients that are people in teh ir houses that connect to our wireless network, COoca login page appears and they login with the username and password that i input into daloRADIUS. I have a few clients that are small Lan Houses that want to use our system, but i am unsure if i can have them not need to login through the CoovaChilli portal, and they just get authenticated via MAC address of their Antenna? I can't find any good documentation on how to do anything with Freeradius. Thanks in Advance - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
Hey thanks for the reply.. Probably should have mentioned that i know pretty much nothing about Linux, apart from using with a GUI.. Yes what you said is right, would like some people login with username/password, and some qith MAC. Ill take a look at some of those things you mentioned. Thanks. On 18/03/2011 9:19 PM, Gary Gatten wrote:
Dude, you are SO gonna get flamed - put your flame suit on! Hopefully Mr. DeKok is in a good mood! ;-)
So you want some users to auth with username/passwd; and others with MAC or some other means?
There's been numerous posts about similar requirements, plus:
Man unlang, man radiusd, etc. Also, some good info and examples embedded in the various config files and samples in the various dirs. Also wiki's... And I think. www.supportingradius.org? Not sure on the url.
Dig around a bit and you'll find a $hit load of doc, and probably some good examples of others that did exactly what you want.
----- Original Message ----- From: Luke Hammond [mailto:luke@dezignbrasil.com] Sent: Friday, March 18, 2011 03:24 PM To: FreeRadius users mailing list<freeradius-users@lists.freeradius.org> Subject: Using Freeradius2
Hey all, is there any good resources on how to actually use Freeradius2 once its installed?
I have it running along with CoovaChilli as my captive portal, and daloRADIUS for the GUI (As i wil have people inputting users that have no idea about how to use command..).
My problem is this: we have clients that are people in teh ir houses that connect to our wireless network, COoca login page appears and they login with the username and password that i input into daloRADIUS. I have a few clients that are small Lan Houses that want to use our system, but i am unsure if i can have them not need to login through the CoovaChilli portal, and they just get authenticated via MAC address of their Antenna? I can't find any good documentation on how to do anything with Freeradius.
Thanks in Advance - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
<font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Luke Hammond wrote:
Hey all, is there any good resources on how to actually use Freeradius2 once its installed?
The server does come with documentation...
My problem is this: we have clients that are people in teh ir houses that connect to our wireless network, COoca login page appears and they login with the username and password that i input into daloRADIUS. I have a few clients that are small Lan Houses that want to use our system, but i am unsure if i can have them not need to login through the CoovaChilli portal, and they just get authenticated via MAC address of their Antenna? I can't find any good documentation on how to do anything with Freeradius.
The server does *not* include documentation on how to set up your particular configuration. In this case, you can't find documentation for what you want because your problem is poorly specified. "I want to do something, but I'm not sure what, it might be like this" Figure out *exactly* what you want to do, and what pieces are involved. After that, it should be pretty straightforward. Alan DeKok.
participants (5)
-
Alan DeKok -
Gary Gatten -
Harry Hoffman -
Luke Hammond -
Usuário do Sistema