Re: Authenticating groups via LDAP

2010-05-23 Thread Josip Rodin
On Sat, May 22, 2010 at 07:17:29PM +0100, Alan Buxey wrote: although some would say thats the package people talking - and that the issue is only present because of how package management tools etc work. surely the best way of RPM, APT etc leaving behind all their rubbish/old-files/new-files

Re: Authenticating groups via LDAP

2010-05-23 Thread Josip Rodin
On Sat, May 22, 2010 at 01:45:59PM -0400, John Dennis wrote: rather than renaming all the config files to have a common extension and only loading those files with extension the correct extension the preferred model would be to utilize enabled,available directories. The filenames would

Re: Authenticating groups via LDAP

2010-05-23 Thread Alan DeKok
Josip Rodin wrote: IMHO just changing modules to the -enabled/-available scheme would be a good first step and it should be done first, in 2.1.10 or whenever. I'd say 2.2.0. And then move eap.conf sql.conf to raddb/modules*, too. The only reason that eap.conf sql.conf aren't in the

Re: Authenticating groups via LDAP

2010-05-23 Thread John Maher
On 05/22/2010 01:45 PM, Alan DeKok wrote: Johnny R wrote: Alan, John Maher at the first post asked if there is any resource that is particularly good at explaining how radius and its config files really works. I want just to ask it again, if possible, it there is any thread or link

Re: RADDB 2.1.7 and /etc/shadow

2010-05-23 Thread John Dennis
On 05/22/2010 05:37 PM, sbchem wrote: you and John Dennis both mentioned PAM so I went ahead and commented out the passwd entires and I am now looking at PAM per your suggestion. Installed the pam-radius client per http://freeradius.org/pam_radius_auth/ No, that's for authenticating against

Re: Authenticating groups via LDAP

2010-05-23 Thread Alan DeKok
John Maher wrote: Thanks for this information. Being very new to radius, and a bit sloppy with my wording, I was not clear about what I was looking for. It's true that the function of the different config files not that complicated. What is not clear to me, when looking at the output of

Re: RADDB 2.1.7 and /etc/shadow

2010-05-23 Thread sbchem
pam_radius_auth. It allows *other* programs to use RADIUS for authentication. It is *not* what you want. Okay, understood and removed all traces of it and changes to files I made except left Auth-Type = pam in the users file Please read the PAM module configuration: raddb/modules/pam It

Re: RADDB 2.1.7 and /etc/shadow

2010-05-23 Thread sbchem
No, that's for authenticating against radius, different beast entirely Okay, understood and removed all traces of it and changes to files I made except left Auth-Type = pam in the users file If you're using the Red Hat RPM's that shouldn't be necessary, we already include the pam configuration

Re: RADDB 2.1.7 and /etc/shadow

2010-05-23 Thread Alan DeKok
sbchem wrote: So the entry: pam_pass: function pam_authenticate FAILED for test. Reason: Module is unknown is obviously supposed to give me the clue I need but I have no idea what it means. shrug It's an error produces by the PAM subsystem. Ask them what it means. Blaming

Re: Login scripts

2010-05-23 Thread liran tal
Quite new to FR2, though you could use that unlang feature to change 'on the fly' attributes and such. By identifying the nas type you could send the correct attributes. There is another way to approach this problem and that is to include both vendor's set of attributes to the NAS in your group

Re: Authenticating groups via LDAP

2010-05-23 Thread John Maher
On 05/23/2010 11:27 AM, Alan DeKok wrote: authorization != authentication If there isn't a password... the user can't be authenticated. The debug log shows this. Yes, obviously an important distinction. But where my mind goes immediately is why is it that if I enter an incorrect

Re: Authenticating groups via LDAP

2010-05-23 Thread Alan DeKok
John Maher wrote: Yes, obviously an important distinction. But where my mind goes immediately is why is it that if I enter an incorrect password for that user that the user fails to gain access, but a correct password results in access granted?. doc/rlm_ldap explains this. But I imagine

Re: Authenticating groups via LDAP

2010-05-23 Thread Josip Rodin
On Sun, May 23, 2010 at 12:54:49PM +0200, Alan DeKok wrote: Josip Rodin wrote: IMHO just changing modules to the -enabled/-available scheme would be a good first step and it should be done first, in 2.1.10 or whenever. I'd say 2.2.0. And then move eap.conf sql.conf to raddb/modules*,

where to insert my code to return custom reply to the client

2010-05-23 Thread weiwei fang
Hi, all! I am now using a WiMAX network and I want to use freeradius+mysql (and EAP, TLS) for it. Now I need to add some new attribute (such as the service level for a single client) in the mysql database. And then the freeradius server can return the attribute to tell the AGW. I have looked up

freeradius source code architecture

2010-05-23 Thread rosect190
Does any one know any good document on the software source code architecture of freeradius? Thanks. - rosect190 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

for Alan DeKok

2010-05-23 Thread Tseveendorj Ochirlantuu
Dear Alan DeKok Sorry for asking bothering question again. I don't solved yet Simultaneous-Use. Few days ago I've installed new version FreeRADIUS 2.1.8. Before(a year ago) radutmp utility didn't show the current connected users but this time it works I get logged in users data in radutmp file

Re: freeradius source code architecture

2010-05-23 Thread Alan DeKok
rosect...@yahoo.com wrote: Does any one know any good document on the software source code architecture of freeradius? Thanks. There is none. If there was, it would be distributed with FreeRADIUS. The source code should be reasonably well organized. Alan DeKok. - List

Re: where to insert my code to return custom reply to the client

2010-05-23 Thread Alan DeKok
weiwei fang wrote: I am now using a WiMAX network and I want to use freeradius+mysql (and EAP, TLS) for it. Now I need to add some new attribute (such as the service level for a single client) in the mysql database. And then the freeradius server can return the attribute to tell the AGW. I

Re: for Alan DeKok

2010-05-23 Thread Alan DeKok
Tseveendorj Ochirlantuu wrote: I don't solved yet Simultaneous-Use. Few days ago I've installed new version FreeRADIUS 2.1.8. Before(a year ago) radutmp utility didn't show the current connected users but this time it works I get logged in users data in radutmp file Well... that isn't