Fetching users from external source
Hello freeradius users, I am using freeradius2 on OpenWRT (having very little resources to operate), which is working fine. Now I'm trying to load users (usernames + passwords) from an external source for authentication in a guest network - the external source is another server which will be running a web interface and database to configure guest accounts. My approach would be to use wget/curl for fetching the users from the server (wrapped in a script), which allows the server to format the user list in a way freeradius understands it. How can I configure freeradius to execute the script on startup and use its stdout to later authenticate users against it? Of course, if there is another (better) approach on how to fetch the users, I would be happy to hear about it :) Also, guest accounts will be modified while freeradius is running. I need a way to inform freeradius (using SIGHUP?) to reload the user list from the server. Do you have a recommendation on how to achieve this in real-time? Thank you for your help!
Am Montag, 11. Mai 2015, 16:55:47 schrieb mlstfr@ntcomputer.de:
Hello freeradius users,
I am using freeradius2 on OpenWRT (having very little resources to operate), which is working fine. Now I'm trying to load users (usernames + passwords) from an external source for authentication in a guest network - the external source is another server which will be running a web interface and database to configure guest accounts. My approach would be to use wget/curl for fetching the users from the server (wrapped in a script), which allows the server to format the user list in a way freeradius understands it.
How can I configure freeradius to execute the script on startup and use its stdout to later authenticate users against it? Of course, if there is another (better) approach on how to fetch the users, I would be happy to hear about it :)
Also, guest accounts will be modified while freeradius is running. I need a way to inform freeradius (using SIGHUP?) to reload the user list from the server. Do you have a recommendation on how to achieve this in real-time?
Thank you for your help!
Why don't you just use the database connection. FR is able to talk to databases. see man rlm_sql. Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein
Also, guest accounts will be modified while freeradius is running. I need a way to inform freeradius (using SIGHUP?) to reload the user list from the server. Do you have a recommendation on how to achieve this in real-time?
Use a database. That's what databases are for! That way the server does not need to be restarted. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
Also, guest accounts will be modified while freeradius is running. I need a way to inform freeradius (using SIGHUP?) to reload the user list from the server. Do you have a recommendation on how to achieve this in real-time? Use a database. That's what databases are for! That way the server does not need to be restarted.
Having seen the amount of tables and properties in the sql module, I assumed it would be both overkill and too complicated to set up for my quite simple usage scenario. But maybe I am mistaken and it is as easy as giving freeradius the credentials and putting the usernames & passwords in a single table?
Yep. For basic username/password stuff that's all you need. One table. If you want to do other stuff , restrictions, accounting etc in the db you need to do more. But otherwise it's that simple alan
Having seen the amount of tables and properties in the sql module, I assumed it would be both overkill and too complicated to set up for my quite simple usage scenario. But maybe I am mistaken and it is as easy as giving freeradius the credentials and putting the usernames & passwords in a single table?
It is that simple really. You won't need all the tables that the SQL module exposes. The radcheck table does in a database format what the users file does, i.e. +- id -+- username ---+--- attribute ------+ op +-- value ---+ | xxxx | username1 | ClearText-Password | := | password here | +------+--------------+--------------------+----+---------------+ : : Pardon the crude ASCII art. Of course, if you don't use the password in the clear (which is a Bad Thing™), choose one of the password schemes here: http://deployingradius.com/documents/protocols/compatibility.html It will tell you which RADIUS authentication types work with which hashing type, although something like EAP-TTLS/PAP or EAP-TTLS/EAP-GTC with PAP will pretty much work with all of them. :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.
Having seen the amount of tables and properties in the sql module, I assumed it would be both overkill and too complicated to set up for my quite simple usage scenario. But maybe I am mistaken and it is as easy as giving freeradius the credentials and putting the usernames & passwords in a single table? It is that simple really. You won't need all the tables that the SQL module exposes. The radcheck table does in a database format what the users file does, i.e.
+- id -+- username ---+--- attribute ------+ op +-- value ---+ | xxxx | username1 | ClearText-Password | := | password here | +------+--------------+--------------------+----+---------------+ : : I got everything working now, though it was not possible with the radcheck table only. First, I was forced to move the freeradius server from OpenWRT to another machine, because I didn't find a way to get a SQL driver running, second, freeradius refused to operate without a radreply table. In the end I applied the complete mysql template to my database, which worked out fine, though I'm now sitting on all the tables I didn't want to have in the first place. Maybe there is a way (which I have not found) to tweak the config so the radcheck table alone is sufficient?
Anyway, thanks for your help!
participants (4)
-
Alan Buxey -
Michael Schwartzkopff -
mlstfr＠ntcomputer.de -
Stefan Paetow