On Tue, 28 Jul 2009, Ivan Kalik wrote:
Thankyou for the reply and suggestion. I've been interstate and just back
now to try it.
Create two mschap module instances, mschap_co1 with first ntlm_auth line
and mschap_co2 with second one.
ok.
Then create redundancy inside Auth-Type
MS-CHAP (default server for mschap requests, inner-tunnel for peap):
Auth-Type MS-CHAP {
if(Realm == "company1.local") {
mschap_co1
}
elsif(Realm == "company2.local") {
mschap_co2
}
else {
mschap (or reject if you don't want to try users file, sql, ldap
or other accounts)
}
}
When I do this, stop radiusd and re-run with -X, I get:
reread_config: reading radiusd.conf
Config: including file: /usr/local/etc/raddb/clients.conf
/usr/local/etc/raddb/radiusd.conf[1948]: Line is not in 'attribute = value'
format
Errors reading radiusd.conf
I then commented out most to check for stupid operator errors:
# new MSCHAP authentication.
# auths differently depending on the realm
# If none of the defined realms, use standard
Auth-Type MS-CHAP {
# if(Realm == "aae.local") {
mschap_co1
# }
# elseif(Realm == "lla.local") {
mschap_co2
# }
# else {
# mschap
# }
}
This at least got further... but not much. Here's the -X output:
# /usr/local/sbin/radiusd -X
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /usr/local/etc/raddb/clients.conf
main: prefix = "/usr/local"
main: localstatedir = "/var"
main: logdir = "/var/log"
main: libdir = "/usr/local/lib"
main: radacctdir = "/var/log/radacct"
main: hostname_lookups = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/var/log/radius.log"
main: log_auth = no
main: log_auth_badpass = yes
main: log_auth_goodpass = yes
main: pidfile = "/var/run/radiusd/radiusd.pid"
main: bind_address = 127.0.0.1 IP address [127.0.0.1]
main: user = "(null)"
main: group = "(null)"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/local/sbin/checkrad"
main: proxy_requests = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/local/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
radiusd.conf[723] Failed to link to module 'rlm_mschap_co1': Shared object
"rlm_mschap_co1.so" not found, required by "radiusd"
radiusd.conf[1949] Unknown module "mschap_co1".
radiusd.conf[1949] Failed to parse "mschap_co1" entry.
bash-2.05b#
I'm simply not familiar enough with FreeRadius to know where to go with
this - I learned enough to set it up many years ago on my own systems,
it's been rock-solid ever since and I guess I've just forgotten it all.
This particular configuration was done by someone else and is quite
different to my own. Any (further) help appreciated.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
