<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hello,<div><br></div><div>I don't get it.</div><div><br></div><div>Maybe someone sees my mistake...</div><div><br></div><div>I have freeraradius on macos x.</div><div><br></div><div>My Users file has these entries:</div><div><br></div><div>/private/raddb/users</div><div><br></div><div><div></div><blockquote type="cite"><div>#-------------------------------------------------------------------------------------------------</div><div># Allow members of group 'schueler' to WLAN-45</div><div><br></div><div>DEFAULT<span class="Apple-tab-span" style="white-space:pre"> </span>Ldap-Group == "schueler", Airespace-Wlan-Id == 4</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type := opendirectory,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Service-Type = Login-User,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Reply-Message = "Schueler: WLAN-45 accept",</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Fall-Through = 0</div><div><br></div><div>#-------------------------------------------------------------------------------------------------</div><div># Reject members of group 'schueler' from any other than WLAN-45</div><div><br></div><div>DEFAULT<span class="Apple-tab-span" style="white-space:pre"> </span>Ldap-Group == "schueler", Airespace-Wlan-Id != 4</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type := Reject,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Reply-Message = "Schueler: Wrong WLAN!!!",</div><div><br></div><div>#-------------------------------------------------------------------------------------------------</div><div># Allow members of group 'schuladministration' to WLAN-47</div><div><br></div><div>DEFAULT<span class="Apple-tab-span" style="white-space:pre"> </span>Ldap-Group == "schuladministration", Airespace-Wlan-Id == 6</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Auth-Type := opendirectory,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Service-Type = Login-User,</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Reply-Message = "schuladministration: WLAN-47 accept",</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Fall-Through = 0</div><div><br></div><div>#-------------------------------------------------------------------------------------------------</div><div># Reject all others</div><div><br></div><div>DEFAULT Auth-Type := Reject</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Reply-Message = "Access denied." </div><div><br></div><div><div>#-------------------------------------------------------------------------------------------------</div></div></blockquote><div><div><br></div><div><br></div><div>In the log file I see this:</div><div><br></div><div><blockquote type="cite"><div><font class="Apple-style-span" color="#000000">rad_recv: Access-Request packet from host 192.168.95.10:32768, id=151, length=197</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">User-Name = "w45user"</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Calling-Station-Id = "00-17-F2-E8-74-76"</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Called-Station-Id = "00-1D-70-93-05-C0:WLAN-44"</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">NAS-Port = 29</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">NAS-IP-Address = 192.168.95.10</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">NAS-Identifier = "KSHP-UG-SRV-WLC-04"</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Airespace-Wlan-Id = 3</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Service-Type = Framed-User</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Framed-MTU = 1300</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">NAS-Port-Type = Wireless-802.11</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Tunnel-Type:0 = VLAN</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Tunnel-Medium-Type:0 = IEEE-802</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Tunnel-Private-Group-Id:0 = "44"</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">EAP-Message = 0x020300061500</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">State = 0xe56af3902cf86936b5da18867203a336</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Message-Authenticator = 0x0b2df96b7f01043f6296236014935512</font></div><div><font class="Apple-style-span" color="#000000"> Processing the authorize section of radiusd.conf</font></div><div><font class="Apple-style-span" color="#000000">modcall: entering group authorize for request 43</font></div><div><font class="Apple-style-span" color="#000000"> modcall[authorize]: module "preprocess" returns ok for request 43</font></div><div><font class="Apple-style-span" color="#000000"> modcall[authorize]: module "chap" returns noop for request 43</font></div><div><font class="Apple-style-span" color="#000000"> modcall[authorize]: module "mschap" returns noop for request 43</font></div><div><font class="Apple-style-span" color="#000000"> rlm_realm: No '@' in User-Name = "w45user", looking up realm NULL</font></div><div><font class="Apple-style-span" color="#000000"> rlm_realm: No such realm "NULL"</font></div><div><font class="Apple-style-span" color="#000000"> modcall[authorize]: module "suffix" returns noop for request 43</font></div><div><font class="Apple-style-span" color="#000000"> rlm_eap: EAP packet type response id 3 length 6</font></div><div><font class="Apple-style-span" color="#000000"> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation</font></div><div><font class="Apple-style-span" color="#000000"> modcall[authorize]: module "eap" returns updated for request 43</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: Entering ldap_groupcmp()</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: 'dc=ldap,dc=ksoe,dc=edu'</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: '(uid=w45user)'</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Checking Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Got Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: performing search in dc=ldap,dc=ksoe,dc=edu, with filter (uid=w45user)</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_release_conn: Release Id: 0</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: '(&(objectClass=posixGroup)(memberUid=w45user))'</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Checking Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Got Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: performing search in dc=ldap,dc=ksoe,dc=edu, with filter (&(cn=wlan_test)(&(objectClass=posixGroup)(memberUid=w45user)))</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: object not found or got ambiguous search result</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_release_conn: Release Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_<a href="ldap::ldap_groupcmp">ldap::ldap_groupcmp</a>: Group wlan_test not found or user is not a member.</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: Entering ldap_groupcmp()</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: 'dc=ldap,dc=ksoe,dc=edu'</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: '(&(objectClass=posixGroup)(memberUid=w45user))'</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Checking Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Got Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: performing search in dc=ldap,dc=ksoe,dc=edu, with filter (&(cn=vpn_users)(&(objectClass=posixGroup)(memberUid=w45user)))</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: object not found or got ambiguous search result</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_release_conn: Release Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_<a href="ldap::ldap_groupcmp">ldap::ldap_groupcmp</a>: Group vpn_users not found or user is not a member.</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: Entering ldap_groupcmp()</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: 'dc=ldap,dc=ksoe,dc=edu'</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: '(&(objectClass=posixGroup)(memberUid=w45user))'</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Checking Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Got Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: performing search in dc=ldap,dc=ksoe,dc=edu, with filter (&(cn=angestellte)(&(objectClass=posixGroup)(memberUid=w45user)))</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: object not found or got ambiguous search result</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_release_conn: Release Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_<a href="ldap::ldap_groupcmp">ldap::ldap_groupcmp</a>: Group angestellte not found or user is not a member.</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: Entering ldap_groupcmp()</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: 'dc=ldap,dc=ksoe,dc=edu'</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: '(&(objectClass=posixGroup)(memberUid=w45user))'</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Checking Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Got Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: performing search in dc=ldap,dc=ksoe,dc=edu, with filter (&(cn=lehrer)(&(objectClass=posixGroup)(memberUid=w45user)))</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: object not found or got ambiguous search result</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_release_conn: Release Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_<a href="ldap::ldap_groupcmp">ldap::ldap_groupcmp</a>: Group lehrer not found or user is not a member.</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: Entering ldap_groupcmp()</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: 'dc=ldap,dc=ksoe,dc=edu'</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: '(&(objectClass=posixGroup)(memberUid=w45user))'</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Checking Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Got Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: performing search in dc=ldap,dc=ksoe,dc=edu, with filter (&(cn=lehrer)(&(objectClass=posixGroup)(memberUid=w45user)))</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: object not found or got ambiguous search result</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_release_conn: Release Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_<a href="ldap::ldap_groupcmp">ldap::ldap_groupcmp</a>: Group lehrer not found or user is not a member.</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: Entering ldap_groupcmp()</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: 'dc=ldap,dc=ksoe,dc=edu'</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: '(&(objectClass=posixGroup)(memberUid=w45user))'</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Checking Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Got Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: performing search in dc=ldap,dc=ksoe,dc=edu, with filter (&(cn=schueler)(&(objectClass=posixGroup)(memberUid=w45user)))</font></div><div><font class="Apple-style-span" color="#000000">rlm_<a href="ldap::ldap_groupcmp">ldap::ldap_groupcmp</a>: User found in group schueler</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_release_conn: Release Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: Entering ldap_groupcmp()</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: 'dc=ldap,dc=ksoe,dc=edu'</font></div><div><font class="Apple-style-span" color="#000000">radius_xlat: '(&(objectClass=posixGroup)(memberUid=w45user))'</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Checking Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_get_conn: Got Id: 0</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: performing search in dc=ldap,dc=ksoe,dc=edu, with filter (&(cn=schueler)(&(objectClass=posixGroup)(memberUid=w45user)))</font></div><div><font class="Apple-style-span" color="#000000">rlm_<a href="ldap::ldap_groupcmp">ldap::ldap_groupcmp</a>: User found in group schueler</font></div><div><font class="Apple-style-span" color="#000000">rlm_ldap: ldap_release_conn: Release Id: 0</font></div><div><font class="Apple-style-span" color="#000000"> users: Matched entry DEFAULT at line 260</font></div><div><font class="Apple-style-span" color="#000000"> modcall[authorize]: module "files" returns ok for request 43</font></div><div><font class="Apple-style-span" color="#000000">modcall: leaving group authorize (returns updated) for request 43</font></div><div><font class="Apple-style-span" color="#000000"> rad_check_password: Found Auth-Type EAP</font></div><div><font class="Apple-style-span" color="#000000">auth: type "EAP"</font></div><div><font class="Apple-style-span" color="#000000"> Processing the authenticate section of radiusd.conf</font></div><div><font class="Apple-style-span" color="#000000">modcall: entering group authenticate for request 43</font></div><div><font class="Apple-style-span" color="#000000"> rlm_eap: Request found, released from the list</font></div><div><font class="Apple-style-span" color="#000000"> rlm_eap: EAP/ttls</font></div><div><font class="Apple-style-span" color="#000000"> rlm_eap: processing type ttls</font></div><div><font class="Apple-style-span" color="#000000"> rlm_eap_ttls: Authenticate</font></div><div><font class="Apple-style-span" color="#000000"> rlm_eap_tls: processing TLS</font></div><div><font class="Apple-style-span" color="#000000">rlm_eap_tls: Received EAP-TLS ACK message</font></div><div><font class="Apple-style-span" color="#000000"> rlm_eap_tls: ack handshake fragment handler</font></div><div><font class="Apple-style-span" color="#000000"> eaptls_verify returned 1 </font></div><div><font class="Apple-style-span" color="#000000"> eaptls_process returned 13 </font></div><div><font class="Apple-style-span" color="#000000"> modcall[authenticate]: module "eap" returns handled for request 43</font></div><div><font class="Apple-style-span" color="#000000">modcall: leaving group authenticate (returns handled) for request 43</font></div><div><font class="Apple-style-span" color="#000000">Sending Access-Challenge of id 151 to 192.168.95.10 port 32768</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Reply-Message = "Schueler: Wrong WLAN!!!"</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">EAP-Message = 0x01040323158000000719010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">EAP-Message = 0x395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda814162</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">EAP-Message = 0x8f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3f</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">EAP-Message = 0xf1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba607144216030100040e000000</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Message-Authenticator = 0x00000000000000000000000000000000</font></div><div><span class="Apple-tab-span" style="white-space:pre"><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">State = 0x287a38ce7b69dbc51126c71ef1bd49f3</font></div><div><font class="Apple-style-span" color="#000000">Finished request 43</font></div><div><font class="Apple-style-span" color="#000000">Going to the next request</font></div><div><font class="Apple-style-span" color="#000000">Waking up in 6 seconds...</font></div></blockquote><br></div><div>As far as I can tell, I see this line:</div><div><blockquote type="cite"><div><font class="Apple-style-span" color="#000000"> users: Matched entry DEFAULT at line 260</font></div><div><font class="Apple-style-span" color="#000000"><br></font></div></blockquote>This is the line containing 'DEFAULT<span class="Apple-tab-span" style="white-space: pre; "> </span>Ldap-Group == "schueler", Airespace-Wlan-Id != 4'</div><div>which is correct.</div><div><br></div><div>So if this works (I can also read the '<span class="Apple-tab-span" style="white-space: pre; "><font class="Apple-style-span" color="#000000"> </font></span><font class="Apple-style-span" color="#000000">Reply-Message = "Schueler: Wrong WLAN!!!"', why does this user get an access?</font></div><div><br></div><div>Why does the line 'Auth-Type := Reject,' not work?</div><div><br></div><div>What do I have to do to have him beeing rejected?</div><div><br></div><div>Any ideas</div><div><br></div><div>Thanks</div><div><br></div><div>Kurt</div></div></div></body></html>