Hello all<br>
<br>
<b>My Goal</b>: PAP on legacy port 1645, CHAP on 1812 working simultaneously.<br>
<b>My Environment</b>: FreeRADIUS 2.0.0-pre2, LDAP user database, MySQL Accounting.<br>
<b>Problem</b>: I'm running a virtual host for each AUTH port. Each
works fine when placed in sites-enabled individually but my CHAP
virtualhost fails when both are enabled. The vhost listening on 1812
appears to be referencing an LDAP module that is not listed in it's
server{ ... } block. You will see "ou=Dialup" in the debugging output below of a CHAP request to 1812 that is only contained in the legacy PAP vhost. Any ideas are appreciated!!<br>
<br>
I have 4 LDAP servers configured, two point to a different OU on the
same servers for legacy PAP users. Is there maybe a way to change the
basedn on the fly with NAS-IP-Address as the condition? This may be
easier than sorting out my mess.<br><br>Right now i'm differentiating requests using clients.conf:<br># CHAP NAS<br><i>client x.x.x.x {<br> secret = test<br> shortname = test<br> nastype = other<br> server = alexssa_dsl
<br>}<br><br></i>#####################<br># Stripped LDAP config #<br>#####################<br>
<i>ldap <a href="http://ldap01.alexssa.net">ldap01.alexssa.net</a> {<br>
<snip><br>
basedn = "ou=users,ou=radius,dc=alexssa,dc=net"<br>
<br>
ldap <a href="http://ldap02.alexssa.net">ldap02.alexssa.net</a> {<br>
<snip><br>
basedn = "ou=users,ou=radius,dc=alexssa,dc=net"<br>
<br>
ldap ldap01.alexssa.net_dialin {<br>
<snip><br>
basedn = "ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net"<br>
}<br>
<br>
ldap ldap02.alexssa.net_dialin {<br>
<snip><br>
basedn = "ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net"<br>
}</i><br>
<br>
##############################<br>
# Below is my DSL (CHAP) vhost #<br>
##############################<br>
<i>server alexssa_dsl {<br>
listen {<br>
ipaddr = *<br>
port = 1812<br>
type = auth<br>
}<br>
<br>
listen {<br>
ipaddr = *<br>
port = 1813<br>
type = acct<br>
}<br>
<br>
authorize {<br>
if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) {<br>
update request {<br>
Stripped-User-Name = "%{1}"<br>
}<br>
}<br>
preprocess<br>
auth_log<br>
files<br>
redundant-load-balance {<br>
<a href="http://ldap01.alexssa.net">ldap01.alexssa.net</a><br>
<a href="http://ldap02.alexssa.net">ldap02.alexssa.net</a><br>
}<br>
daily<br>
chap<br>
}<br>
<br>
authenticate {<br>
Auth-Type CHAP {<br>
chap<br>
}<br>
}<br>
<br>
<br>
#<br>
# Pre-accounting. Decide which accounting type to use.<br>
#<br>
preacct {<br>
preprocess<br>
acct_unique<br>
files<br>
}<br>
<br>
#<br>
# Accounting. Log the accounting data.<br>
#<br>
accounting {<br>
# acctdetail<br>
sql<br>
# daily<br>
radutmp<br>
attr_filter.accounting_response<br>
}<br>
<br>
<br>
# Session database, used for checking Simultaneous-Use. Either the radutmp<br>
# or rlm_sql module can handle this.<br>
# The rlm_sql module is *much* faster<br>
session {<br>
radutmp<br>
}<br>
<br>
<br>
# Post-Authentication<br>
# Once we KNOW that the user has been authenticated, there are<br>
# additional steps we can take.<br>
post-auth {<br>
Post-Auth-Type REJECT {<br>
attr_filter.access_reject<br>
}<br>
}<br>
<br>
} # dsl server block</i><br>
<br clear="all">######################<br>
# Dialin (PAP) vhost #<br>
######################<br>
<i>server alexssa_dialin {<br>
listen {<br>
ipaddr = *<br>
port = 1645<br>
type = auth<br>
}<br>
<br>
listen {<br>
ipaddr = *<br>
port = 1646<br>
type = acct<br>
}<br>
<br>
authorize {<br>
if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) {<br>
update request {<br>
Stripped-User-Name = "%{1}"<br>
}<br>
}<br>
preprocess<br>
auth_log<br>
files<br>
redundant-load-balance {<br>
ldap01.alexssa.net_dialin<br>
ldap02.alexssa.net_dialin<br>
}<br>
daily<br>
pap<br>
}<br>
<br>
authenticate {<br>
Auth-Type PAP {<br>
pap<br>
}<br>
}<br>
<br>
#<br>
# Pre-accounting. Decide which accounting type to use.<br>
#<br>
preacct {<br>
preprocess<br>
acct_unique<br>
files<br>
}<br>
<br>
#<br>
# Accounting. Log the accounting data.<br>
#<br>
accounting {<br>
# acctdetail<br>
sql<br>
# daily<br>
dialup<br>
radutmp<br>
attr_filter.accounting_response<br>
}<br>
<br>
<br>
# Session database, used for checking Simultaneous-Use. Either the radutmp<br>
# or rlm_sql module can handle this.<br>
# The rlm_sql module is *much* faster<br>
session {<br>
radutmp<br>
}<br>
<br>
<br>
# Post-Authentication<br>
# Once we KNOW that the user has been authenticated, there are<br>
# additional steps we can take.<br>
post-auth {<br>
Post-Auth-Type REJECT {<br>
attr_filter.access_reject<br>
}<br>
}</i><br>
<br>
} # dialin server block<br><br>#######################################<br># debugging output of CHAP request to 1812 #<br>#######################################<br>Listening on authentication address * port 1812 as server alexssa_dsl
<br>Listening on accounting address * port 1813 as server alexssa_dsl<br>Listening on authentication address * port 1645 as server alexssa_dialin<br>Listening on accounting address * port 1646 as server alexssa_dialin<br>
Ready to process requests.<br>Nothing to do. Sleeping until we see a request.<br>rad_recv: Access-Request packet from host <a href="http://38.119.185.62">38.119.185.62</a> port 3563, id=15, length=63<br> User-Name = "
<a href="mailto:1000copyme@alexssa.net">1000copyme@alexssa.net</a>"<br> CHAP-Password = 0x0f4e646219d84c7c72d88e920c879d2a01<br>server alexssa_dsl {<br>+- entering group authorize<br>++? if ("%{User-Name}" =~ /^([^@]+)@
alexssa.net$/)<br> expand: %{User-Name} -> <a href="mailto:1000copyme@alexssa.net">1000copyme@alexssa.net</a><br>? Evaluating ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/) -> TRUE<br>++? if ("%{User-Name}" =~ /^([^@]+)@
alexssa.net$/) -> TRUE<br>++- entering if ("%{User-Name}" =~ /^([^@]+)@alexssa.net$/)<br> expand: %{1} -> 1000copyme<br>+++[request] returns notfound<br>++- if ("%{User-Name}" =~ /^([^@]+)@
alexssa.net$/) returns notfound<br>++[preprocess] returns ok<br> expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/38.119.185.62/auth-detail-20080103
<br>rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/38.119.185.62/auth-detail-20080103<br> expand: %t -> Thu Jan 3 15:19:46 2008
<br>++[auth_log] returns ok<br>rlm_ldap: Entering ldap_groupcmp()<br> expand: ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net -> ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net<br> expand: %{Stripped-User-Name} -> 1000copyme
<br> expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=1000copyme)<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: attempting LDAP reconnection<br>rlm_ldap: (re)connect to
<a href="http://ldap02.alexssa.net:389">ldap02.alexssa.net:389</a>, authentication 0<br>rlm_ldap: bind as cn=xxxxx,dc=alexssa,dc=net/xxxxxx to <a href="http://ldap02.alexssa.net:389">ldap02.alexssa.net:389</a><br>rlm_ldap: waiting for bind result ...
<br>rlm_ldap: Bind was successful<br>rlm_ldap: performing search in ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net, with filter (uid=1000copyme)<br>rlm_ldap: object not found or got ambiguous search result<br>rlm_ldap::ldap_groupcmp: search failed
<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>rlm_ldap: Entering ldap_groupcmp()<br> expand: ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net -> ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net<br> expand: %{Stripped-User-Name} -> 1000copyme
<br> expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=1000copyme)<br>rlm_ldap: ldap_get_conn: Checking Id: 0<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: performing search in ou=Dialup,ou=users,ou=radius,dc=alexssa,dc=net, with filter (uid=1000copyme)
<br>rlm_ldap: object not found or got ambiguous search result<br>rlm_ldap::ldap_groupcmp: search failed<br>rlm_ldap: ldap_release_conn: Release Id: 0<br> users: Matched entry DEFAULT at line 16<br>++[files] returns ok<br>
++- entering redundant-load-balance group<br>rlm_ldap: - authorize<br>rlm_ldap: performing user authorization for <a href="mailto:1000copyme@alexssa.net">1000copyme@alexssa.net</a><br> expand: %{Stripped-User-Name} -> 1000copyme
<br> expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=1000copyme)<br> expand: ou=users,ou=radius,dc=alexssa,dc=net -> ou=users,ou=radius,dc=alexssa,dc=net<br>rlm_ldap: ldap_get_conn: Checking Id: 0
<br>rlm_ldap: ldap_get_conn: Got Id: 0<br>rlm_ldap: attempting LDAP reconnection<br>rlm_ldap: (re)connect to <a href="http://ldap02.alexssa.net:389">ldap02.alexssa.net:389</a>, authentication 0<br>rlm_ldap: bind as cn=xxxxx,dc=alexssa,dc=net/xxxxxx to
<a href="http://ldap02.alexssa.net:389">ldap02.alexssa.net:389</a><br>rlm_ldap: waiting for bind result ...<br>rlm_ldap: Bind was successful<br>rlm_ldap: performing search in ou=users,ou=radius,dc=alexssa,dc=net, with filter (uid=1000copyme)
<br>rlm_ldap: looking for check items in directory...<br>rlm_ldap: LDAP attribute userPassword as RADIUS attribute Cleartext-Password == "test1234"<br>rlm_ldap: looking for reply items in directory...<br>rlm_ldap: user
<a href="mailto:1000copyme@alexssa.net">1000copyme@alexssa.net</a> authorized to use remote access<br>rlm_ldap: ldap_release_conn: Release Id: 0<br>+++[<a href="http://ldap02.alexssa.net">ldap02.alexssa.net</a>] returns ok
<br>++- redundant-load-balance group returns ok<br>rlm_counter: Entering module authorize code<br>rlm_counter: Could not find Check item value pair<br>++[daily] returns noop<br> rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP
<br>++[chap] returns noop<br> rad_check_password: Found Auth-Type Reject<br> rad_check_password: Auth-Type = Reject, rejecting user<br>auth: Failed to validate the user.<br>Login incorrect: [<a href="http://1000copyme@alexssa.net/">
1000copyme@alexssa.net/</a><CHAP-Password>] (from client test port 0)<br>} # server alexssa_dsl<br> Found Post-Auth-Type Reject<br>+- entering group REJECT<br> expand: %{User-Name} -> <a href="mailto:1000copyme@alexssa.net">
1000copyme@alexssa.net</a><br> attr_filter: Matched entry DEFAULT at line 11<br>++[attr_filter.access_reject] returns updated<br>Delaying reject of request 0 for 1 seconds<br>Going to the next request<br>Sending delayed reject for request 0
<br>Sending Access-Reject of id 15 to <a href="http://38.119.185.62">38.119.185.62</a> port 3563<br> Reply-Message = "Please call the helpdesk. Alexssa can be reached at 262-338-3742"<br>Waking up in 4 seconds...
<br>Cleaning up request 0 ID 15 with timestamp +17<br>Nothing to do. Sleeping until we see a request.<br><br>-- <br>Nicholas Hall<br><a href="mailto:ngharo@gmail.com">ngharo@gmail.com</a><br>262.208.6271