Newbie question... using different authentication sources?
Hi, I'm trying to set up a freeradius server to serve two clients, each of them an independent wireless network. The first one uses WPA2-Enterprise, and is expected to authenticate our users based on our internal LDAP server. The second one is a guest/open network, where users will pass their credentials in a captive portal, and are expected to be authenticated by a MySQL database. Problem is, both networks are covering the same area, and users of one of them is not allowed to use the other. I tried to set up radiusd.conf to include the appropriate modules, but I noticed that if the user sends a valid credential in the wrong network, it still gets authenticated. So, how can I enforce that users from NAS-IP-Address 1 get authenticated only by MySQL, and NAS-IP-Address 2 only on LDAP? I'm using FreeRADIUS 1.1.7 on Suse SLES 10 SP4. I have some machines with SLES 11 SP3, which will give me FreeRADIUS 2.1.1, but I prefer not using them by now, for several reasons.
On May 25, 2015, at 3:41 PM, José Queiroz <zekkerj@gmail.com> wrote:
I'm trying to set up a freeradius server to serve two clients, each of them an independent wireless network. The first one uses WPA2-Enterprise, and is expected to authenticate our users based on our internal LDAP server.
The second one is a guest/open network, where users will pass their credentials in a captive portal, and are expected to be authenticated by a MySQL database.
Problem is, both networks are covering the same area, and users of one of them is not allowed to use the other.
So write that as a policy. Put the users into groups, and allow group A to use authentication method A, and group B to use authentication method B,
I tried to set up radiusd.conf to include the appropriate modules, but I noticed that if the user sends a valid credential in the wrong network, it still gets authenticated.
So, how can I enforce that users from NAS-IP-Address 1 get authenticated only by MySQL, and NAS-IP-Address 2 only on LDAP?
I'm using FreeRADIUS 1.1.7 on Suse SLES 10 SP4.
Upgrade. No one will answer questions about a version of FreeRADIUS which is 8 years old.
I have some machines with SLES 11 SP3, which will give me FreeRADIUS 2.1.1, but I prefer not using them by now, for several reasons.
Don't use 2.1.1, either. Honestly, you're best off installing version 3. It's easier to configure, and has better error messages. Alan DeKok.
The same question comes from both hints... how? 2015-05-25 17:26 GMT-03:00 Alan DeKok <aland@deployingradius.com>:
On May 25, 2015, at 3:41 PM, José Queiroz <zekkerj@gmail.com> wrote:
I'm trying to set up a freeradius server to serve two clients, each of them an independent wireless network. The first one uses WPA2-Enterprise, and is expected to authenticate our users based on our internal LDAP server.
The second one is a guest/open network, where users will pass their credentials in a captive portal, and are expected to be authenticated by a MySQL database.
Problem is, both networks are covering the same area, and users of one of them is not allowed to use the other.
So write that as a policy. Put the users into groups, and allow group A to use authentication method A, and group B to use authentication method B,
I tried to set up radiusd.conf to include the appropriate modules, but I noticed that if the user sends a valid credential in the wrong network, it still gets authenticated.
So, how can I enforce that users from NAS-IP-Address 1 get authenticated only by MySQL, and NAS-IP-Address 2 only on LDAP?
I'm using FreeRADIUS 1.1.7 on Suse SLES 10 SP4.
Upgrade. No one will answer questions about a version of FreeRADIUS which is 8 years old.
I have some machines with SLES 11 SP3, which will give me FreeRADIUS 2.1.1, but I prefer not using them by now, for several reasons.
Don't use 2.1.1, either.
Honestly, you're best off installing version 3. It's easier to configure, and has better error messages.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 25, 2015, at 4:34 PM, José Queiroz <zekkerj@gmail.com> wrote:
The same question comes from both hints... how?
a) upgrade to v3. There are "download" links on freeradius.org. This shouldn't be difficult. b) read "man unlang". Look at the examples. And most importantly: c) think for yourself. If it's too much work to click "download" on freeradius.org, it's too much work for me to explain how to write policies. Alan DeKok.
You just don't know for how much time I've been downloading, searching, googling, and trying before shouting out for help. Sorry saying that, but FreeRadius have the very worst documentation I ever saw on entire Open Source Community. Yes, I know how to download a package, know how to compile it, and know how hard it is to smash a new package on an old system, with old libraries and old documentation. Unfortunately, I'm stuck to this distribution, and you just can't imagine how much I would love to low-level-format these servers and install anything with less than 5 years. But I cannot do that. And unfortunatelly, I have to use FreeRadius, also. 2015-05-25 17:40 GMT-03:00 Alan DeKok <aland@deployingradius.com>:
On May 25, 2015, at 4:34 PM, José Queiroz <zekkerj@gmail.com> wrote:
The same question comes from both hints... how?
a) upgrade to v3. There are "download" links on freeradius.org. This shouldn't be difficult.
b) read "man unlang". Look at the examples.
And most importantly:
c) think for yourself. If it's too much work to click "download" on freeradius.org, it's too much work for me to explain how to write policies.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 25, 2015, at 4:52 PM, José Queiroz <zekkerj@gmail.com> wrote:
You just don't know for how much time I've been downloading, searching, googling, and trying before shouting out for help. Sorry saying that, but FreeRadius have the very worst documentation I ever saw on entire Open Source Community.
That nonsense again? Well, you're welcome to use another open source RADIUS server. I'm sure that will be better. Or, a commercial one.
Yes, I know how to download a package, know how to compile it, and know how hard it is to smash a new package on an old system, with old libraries and old documentation.
It's trivial. Go to wiki.freeradius.org. Type "suse" into the search bar. Clock on the second link. It gives detailed instructions on how to build a Suse package. But you're right... the FreeRADIUS documentation is crap.
Unfortunately, I'm stuck to this distribution, and you just can't imagine how much I would love to low-level-format these servers and install anything with less than 5 years. But I cannot do that. And unfortunatelly, I have to use FreeRadius, also.
The stop whining, and read the existing documentation. Don't ask questions about a version of the server which is 8 years old. And if you want help, stop complaining, and start doing some work on your own. If you make it clear that your priority is getting things done, you will have the problem solved quickly. If you make it clear your priority is complaining, you will be unsubscribed from the list, and permanently banned. This list is for people who want help with FreeRADIUS. People who do nothing but complain can go somewhere else. Alan DeKok.
On May 25, 2015, at 4:52 PM, José Queiroz <zekkerj@gmail.com> wrote:
You just don't know for how much time I've been downloading, searching, googling, and trying before shouting out for help. Sorry saying that, but FreeRadius have the very worst documentation I ever saw on entire Open Source Community.
My official, considered, response to that is, go fuck yourself. -Arran
And that's why I restrained myself asking help here for so much time... unfortunately, years have passed and this list is still ruled by trolls. Sorry taking your so valuable time. 2015-05-25 18:05 GMT-03:00 Arran Cudbard-Bell <a.cudbardb@freeradius.org>:
On May 25, 2015, at 4:52 PM, José Queiroz <zekkerj@gmail.com> wrote:
You just don't know for how much time I've been downloading, searching, googling, and trying before shouting out for help. Sorry saying that, but FreeRadius have the very worst documentation I ever saw on entire Open Source Community.
My official, considered, response to that is, go fuck yourself.
-Arran
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On May 25, 2015, at 5:10 PM, José Queiroz <zekkerj@gmail.com> wrote:
And that's why I restrained myself asking help here for so much time... unfortunately, years have passed and this list is still ruled by trolls. Sorry taking your so valuable time.
This troll has a Banhammer. -Arran
2015-05-25 21:41 GMT+02:00 José Queiroz <zekkerj@gmail.com>:
Hi,
I'm trying to set up a freeradius server to serve two clients, each of them an independent wireless network. The first one uses WPA2-Enterprise, and is expected to authenticate our users based on our internal LDAP server.
The second one is a guest/open network, where users will pass their credentials in a captive portal, and are expected to be authenticated by a MySQL database.
Problem is, both networks are covering the same area, and users of one of them is not allowed to use the other.
I tried to set up radiusd.conf to include the appropriate modules, but I noticed that if the user sends a valid credential in the wrong network, it still gets authenticated.
So, how can I enforce that users from NAS-IP-Address 1 get authenticated only by MySQL, and NAS-IP-Address 2 only on LDAP?
You want to check the huntsgroup stuff. It allows you to put NAS' into groups and specify which Radius server to use for a given group. You don't have to setup multiple Radius servers, just specify virtual ones (sites-enabled) with a different port and that's it.
I'm using FreeRADIUS 1.1.7 on Suse SLES 10 SP4. I have some machines with SLES 11 SP3, which will give me FreeRADIUS 2.1.1, but I prefer not using them by now, for several reasons.
If that old version does not support huntsgroup you sadly have to upgrade. at least 2.1.12 supports it.
participants (4)
-
Alan DeKok -
Arran Cudbard-Bell -
Ben Humpert -
José Queiroz