Am 08.11.2011 11:48, schrieb Alan DeKok:

walter harms wrote:

...

Is seems that i dont understand the concept of "realms".

largely... if you don't know what realms are, you don't need to use them.

Realms are just domain names. They are a simple way to group users together, without configuring lists of users on the server.

no my idea,

...

Can someone point me to a documentation that explains how to setup that "realms" ?

raddb/proxy.conf That is the *only* place to configure realms, and it is well documented.

i found: http://linux.die.net/man/5/rlm_realm http://wiki.freeradius.org/Proxy but i do not find the point where to place the name of the realm. re, wh

On Wed, Nov 9, 2011 at 6:42 PM, walter harms <wharms@bfs.de> wrote:

...

...

Can someone point me to a documentation that explains how to setup that "realms" ?

  raddb/proxy.conf  That is the *only* place to configure realms, and it is well documented.

i found: http://linux.die.net/man/5/rlm_realm http://wiki.freeradius.org/Proxy

but i do not find the point where to place the name of the realm.

Did you read http://wiki.freeradius.org/Proxy.conf (or proxy.conf that came with the default installation)? Like Alan said, if you don't know what realms are, you don't need to use them. If you DO need them, basically you just need to figure out what you want to do with them; for example: - AAA for users @domain-A.com will be proxied to server-a.com - users @domain-B.com will be processed locally using virtual server virtual-B - users @domain-C.com will be processed by the default server. After that, everything in proxy.conf should be self-explanatory. Regarding the names, a realm name usually matches whatever is included in user-name; e.g. if user-name is user1@domain-A.com, then you need to define a realm called "domain-A.com" on proxy.conf (see examples for "realm example.com" and "realm virtual.example.com"). However there are cases where freeradius realm names does not need to match what's in user-name, that is if: - you manually set "Proxy-To-Realm" control attribute, or - you use wildcard (see last example on proxy.conf). If you still have no idea what I'm talking about, then better describe what you need. Perhaps you don't need realms at all. -- Fajar

walter harms wrote:

mmh, i am starting to understand, i was expecting something different therefore i did not realize what i have found.

Asking good questions helps. "How do I set up realms" gets answered by "read the realm documentation". If you want something else, ask a better question.

use case: my task is to setup a radiusd for 6 realms (Again not my idea). all realms should be equal and will be used for m2m only.

That doesn't make any sense. What do you mean by "realms should be equal"? What is "m2m?

so dropping everything outside these realms would be ok. the number of "users" will be very limited. I did not expect that this would be anything complicated.

Of course it's complicated. You haven't defined what you want to do. You're using pre-existing terms (realms), but are using them wrong. Describe what you want to do *accurately*. Refer to attributes. Give examples. Alan DeKok.

walter harms wrote:

...

What do you mean by "realms should be equal"? What is "m2m?

equal = the realms will differ in names only, not in configuration

Since it's clear you don't know what realms are, I have no idea what you mean by this.

m2m = machine to machine - no user interaction

Which means... what in the context of RADIUS?

Our dial-ins (now no radiusd) are moved to a 3.party and they told me "setup a radiusd" with 6 realms". I guess the machines will get usernames, perhaps very box the same. the realm will simple reflect the region they are calling from.

That's a little better. But not enough. If you really wanted to solve the problem you would have posted the above paragraph in your first message. You would have included *everything* which might be relevant. You've refused to do that. Multiple times. It's clear you're reluctant to give any useful information which allows us to help you. You're more interested in playing 20 questions than solving your problem. My answer now is the same as in my first message: go read raddb/proxy.conf. Everything about realms is defined there. You obviously haven't read it, because *all* explanations of realms is included there. That documentation might reference terms you're not familiar with. Too bad. Those terms are *also* documented in proxy.conf. Go read it. Now stop being unhelpful, go help yourself. I'm done here. Alan DeKok.

On Wed, Nov 9, 2011 at 11:55 PM, walter harms <wharms@bfs.de> wrote:

...

  What do you mean by "realms should be equal"?  What is "m2m?

equal = the realms will differ in names only, not in configuration m2m   = machine to machine - no user interaction

radius doesn't really care whether it's a "no user interaction" or "user have to enter username and password" scenario.

...

...

so dropping everything outside these realms would be ok. the number of "users" will be very limited. I did not expect that this would be anything complicated.

It's not. Not if you know what you want :)

Our dial-ins (now no radiusd) are moved to a 3.party and they told me "setup a radiusd" with 6 realms". I guess the machines will get usernames, perhaps very box the same. the realm will simple reflect the region they are calling from.

First thing: you need to know what username the radius will get. For example: - user1@region1 - user1@region2 Next step: figure out what you want to do with them If you treat them equally, and you process AAA for them locally, then there's really no need for you to touch proxy.conf at all. By default, all realms will be handled locally. You'll only need to add the users (user1@region1, user1@region2, etc) to sql (or whatever backend you'll be using), and it should just work. If a user entry is present, and the password match, they'll pass. If the user is not in the backend (for example, if the username is incorrect, or if the realm-part is incorrect) then it will be rejected. It's as simple as that. -- Fajar