Hello list! Currently my installation of freeradius 2.0.5 only listens to realms including the "@" character. This seems to be the default behaviour; so far, so good. Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } However, I would like the rlm_realm module also to process prefixes. I know I need to configure the rlm_realm module in a way just like the following: realm prefix { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } Question: WHERE does this configuration go? I have not found any suitable configuration file. According to an outdated info in the wiki, this information is supposed to be made in the radiusd.conf ... but this information is no longer valid for version 2.0.5. Any help? Thank you! Christopher ------------------------------------------------------------------------------------- DI (FH) Nemec Christopher Österreichische Lotterien Ges.m.b.H., Rennweg 44, 1038 Wien, Österreich Netzwerk Management Telefon: +43 (1) 790 70-5567, Fax: +43 (1) 790 72-5567 ------------------------------------------------------------------------------------- Oesterreichische Lotterien Gesellschaft m.b.H., Rennweg 44, A-1038 Wien, FN 54472 g, Handelsgericht Wien, DVR-Nr: 0476706
That should already be configured in realm module configuration file (raddb/modules/realm). Ivan Kalik Kalik Informatika ISP Dana 1/9/2008, "Nemec Christopher" <Christopher.Nemec@lotterien.at> piše:
Hello list!
Currently my installation of freeradius 2.0.5 only listens to realms including the "@" character. This seems to be the default behaviour; so far, so good.
Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no }
However, I would like the rlm_realm module also to process prefixes. I know I need to configure the rlm_realm module in a way just like the following:
realm prefix { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no }
Question: WHERE does this configuration go? I have not found any suitable configuration file. According to an outdated info in the wiki, this information is supposed to be made in the radiusd.conf ... but this information is no longer valid for version 2.0.5.
Any help? Thank you! Christopher
------------------------------------------------------------------------------------- DI (FH) Nemec Christopher Österreichische Lotterien Ges.m.b.H., Rennweg 44, 1038 Wien, Österreich Netzwerk Management Telefon: +43 (1) 790 70-5567, Fax: +43 (1) 790 72-5567 -------------------------------------------------------------------------------------
Oesterreichische Lotterien Gesellschaft m.b.H., Rennweg 44, A-1038 Wien, FN 54472 g, Handelsgericht Wien, DVR-Nr: 0476706
Hi, I've seen that Windows XP does not support EAP-TTLS out of the box. I know there is at least one package (from SecureW2) that adds this to windows. Could somebody suggest me which other packages do the same? Or should I use the one from SecureW2? We intend to implement 802.1x Campus wide (or at least analyze it's viability), but due to our policies we don't want open passwords in our database, so PEAP (which uses MS-CHAP, as far as I did understand), is not a viable option, despite being the only option native to WinXP. Could somebody give me hand? Tks. -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------
Hi,
Hi,
I've seen that Windows XP does not support EAP-TTLS out of the box. I know there is at least one package (from SecureW2) that adds this to windows.
Could somebody suggest me which other packages do the same? Or should I use the one from SecureW2?
open1x.sf.net, Funk Odyssey, Cisco Supplicant (was Aegis Meetinghouse)
We intend to implement 802.1x Campus wide (or at least analyze it's viability), but due to our policies we don't want open passwords in our database, so PEAP (which uses MS-CHAP, as far as I did understand), is not a viable option, despite being the only option native to WinXP.
errm, PEAP uses MSCHAPv2 which never passes the password - its a challenge response method - and the password, depending on which resource you use, doesnt need to be cleartext either. The other option native to WinXP for 802.1X is EAP-TLS alan
A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Hi,
I've seen that Windows XP does not support EAP-TTLS out of the box. I know there is at least one package (from SecureW2) that adds this to windows.
Could somebody suggest me which other packages do the same? Or should I use the one from SecureW2?
open1x.sf.net, Funk Odyssey, Cisco Supplicant (was Aegis Meetinghouse)
We intend to implement 802.1x Campus wide (or at least analyze it's viability), but due to our policies we don't want open passwords in our database, so PEAP (which uses MS-CHAP, as far as I did understand), is not a viable option, despite being the only option native to WinXP.
errm, PEAP uses MSCHAPv2 which never passes the password - its a challenge response method - and the password, depending on which resource you use, doesnt need to be cleartext either. The other option native to WinXP for 802.1X is EAP-TLS
alan
Ok, then I got something wrong. Is there any link where I could get more details about ms-chapv2 inside PEAP, more exactly concerning this details about password? As far as I knew, ms-chapv2 would always require cleartext passwords in the database. Tks, Roberto -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------
rgreiner wrote:
Ok, then I got something wrong. Is there any link where I could get more details about ms-chapv2 inside PEAP, more exactly concerning this details about password? As far as I knew, ms-chapv2 would always require cleartext passwords in the database.
No. http://deployingradius.com/documents/protocols/compatibility.html Alan DeKok.
Hi,
Question: WHERE does this configuration go? I have not found any suitable configuration file. According to an outdated info in the wiki, this information is supposed to be made in the radiusd.conf ... but this information is no longer valid for version 2.0.5.
almost all of the functionality has been moved into 2 locations, either virtual servers (located in sites-available, to which you put a softlink from site-enabled), or modules (all located in the module directory) - in this case, realms are moved into the modules directory. you may need to 'activate' prefix or suffix to get the delimiters working. alan
Hello Alan! Here is the output of a sample RADIUS Request with the realm "host" as the prefix. It seems as if the rlm_realm is only looking for the "@" character as a delimiter. Below my output I have pasted the relevant content of the "/opt/etc/raddb/modules" file. Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.24.110.198 port 1094, id=91, length=118 User-Name = "host/habakuk" User-Password = "habakuk" NAS-IP-Address = 172.24.110.198 NAS-Port = 1101 NAS-Port-Type = Virtual Calling-Station-Id = "00-01-F4-6F-28-E0" Called-Station-Id = "00-01-F4-6F-28-E0" NAS-Port-Id = "host.0.1" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "host/habakuk", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "host/habakuk" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound /opt/etc/raddb/modules: # -*- text -*- # # $Id: realm,v 1.1 2008/05/30 09:18:46 aland Exp $ # Realm module, for proxying. # # You can have multiple instances of the realm module to # support multiple realm syntaxs at the same time. The # search order is defined by the order that the modules are listed # in the authorize and preacct sections. # # Four config options: # format - must be "prefix" or "suffix" # The special cases of "DEFAULT" # and "NULL" are allowed, too. # delimiter - must be a single character # 'realm/username' # # Using this entry, IPASS users have their realm set to "IPASS". realm IPASS { format = prefix delimiter = "/" } realm prefix { format = prefix delimiter = "/" } # 'username@realm' # realm suffix { format = suffix delimiter = "@" } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" } The corresponding configuration in the "/opt/etc/raddb/proxy.conf" file is the following: realm host { auth_pool = ias_failover } The auth_pool is configured properly and I have succesfully tested an authentication. Why is freeradius not searching for the "/" character as a delimiter? Any idea? -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+christopher.nemec=lotterien.at@lists.freeradius.org [mailto:freeradius-users-bounces+christopher.nemec=lotterien.at@lists.freeradius.org] Im Auftrag von A.L.M.Buxey@lboro.ac.uk Gesendet: Montag, 01. September 2008 21:31 An: FreeRadius users mailing list Betreff: Re: Realm delimiter characters Hi,
Question: WHERE does this configuration go? I have not found any suitable configuration file. According to an outdated info in the wiki, this information is supposed to be made in the radiusd.conf ... but this information is no longer valid for version 2.0.5.
almost all of the functionality has been moved into 2 locations, either virtual servers (located in sites-available, to which you put a softlink from site-enabled), or modules (all located in the module directory) - in this case, realms are moved into the modules directory. you may need to 'activate' prefix or suffix to get the delimiters working. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Oesterreichische Lotterien Gesellschaft m.b.H., Rennweg 44, A-1038 Wien, FN 54472 g, Handelsgericht Wien, DVR-Nr: 0476706
Nemec Christopher wrote:
Here is the output of a sample RADIUS Request with the realm "host" as the prefix. It seems as if the rlm_realm is only looking for the "@" character as a delimiter. Below my output I have pasted the relevant content of the "/opt/etc/raddb/modules" file.
You have "suffix" listed in the "authorize" section, but not "prefix". i.e. You added the "prefix" module configuration in raddb/modules/realms, but didn't tell the server to use it. Alan DeKok.
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Ivan Kalik -
Nemec Christopher -
rgreiner