<div>HI list,</div>
<div> </div>
<div>In few weeks i try to configure freeradius with ldap, but no sucess.</div>
<div>Ok ok, i read many about this, but no work.</div>
<div> </div>
<div>Only authenticate Local, but need authenticate only with LDAP.</div>
<div> </div>
<div>See bellow my radiusd.conf</div>
<div> </div>
<p>prefix = /usr<br>exec_prefix = /usr<br>sysconfdir = /etc<br>localstatedir = /var<br>sbindir = ${exec_prefix}/sbin<br>logdir = /var/log/freeradius<br>raddbdir = /etc/freeradius<br>radacctdir = ${logdir}/radacct<br>confdir = ${raddbdir}<br>
run_dir = ${localstatedir}/run/freeradius<br>log_file = ${logdir}/radius.log<br>libdir = /usr/lib/freeradius<br>pidfile = ${run_dir}/freeradius.pid</p>
<p>user = freerad<br>group = freerad</p>
<p>max_request_time = 30</p>
<p>delete_blocked_requests = no</p>
<p>cleanup_delay = 5</p>
<p>max_requests = 1024</p>
<p>#bind_address = *</p>
<p>#port = 0</p>
<p>hostname_lookups = no</p>
<p>allow_core_dumps = no</p>
<p>regular_expressions = yes<br>extended_expressions = yes</p>
<p>log_stripped_names = no</p>
<p>log_auth = yes</p>
<p>log_auth_badpass = no<br>log_auth_goodpass = no</p>
<p>usercollide = no</p>
<p>lower_user = yes<br>lower_pass = yes</p>
<p>nospace_user = no<br>nospace_pass = no</p>
<p>checkrad = ${sbindir}/checkrad</p>
<p>listen {<br> type = auth<br> ipaddr = 10.12.60.19<br> port = 0<br>}</p>
<p>listen {<br> type = acct<br> ipaddr = 10.12.60.19<br> port = 0<br>}</p>
<p> </p>
<p>security {<br> max_attributes = 200</p>
<p> reject_delay = 1</p>
<p> status_server = no<br>}</p>
<p>proxy_requests = yes<br>$INCLUDE ${confdir}/proxy.conf<br>$INCLUDE ${confdir}/clients.conf</p>
<p>snmp = no<br>$INCLUDE ${confdir}/snmp.conf</p>
<p>thread pool {<br> start_servers = 5</p>
<p> max_servers = 32</p>
<p> min_spare_servers = 3<br> max_spare_servers = 10</p>
<p> max_requests_per_server = 0<br>}</p>
<p>modules {<br> pap {<br> encryption_scheme = crypt<br> }<br> chap {<br> authtype = CHAP<br> }</p>
<p> pam {<br> pam_auth = radiusd<br> }</p>
<p> unix {<br> cache = no<br> cache_reload = 600<br> radwtmp = ${logdir}/radwtmp<br> }<br> <br> $INCLUDE ${confdir}/eap.conf<br> mschap {<br> }</p>
<p> ldap {<br> server = "ldap.intra proxy.intra localhost"<br> identity = "uid=vpnpptp,ou=sistemas,dc=policiacivil,dc=rs,dc=gov,dc=br"<br> password = dfjk129!@<br>
basedn = "dc=policiacivil,dc=rs,dc=gov,dc=br"<br> filter = "(uid=%u)"<br> start_tls = no<br> dictionary_mapping = ${raddbdir}/ldap.attrmap<br>
ldap_connections_number = 5<br> password_attribute = userPassword<br> groupname_attribute = radiusgroupname<br> groupmembership_filter = (&(objectclass=posixGroup)(memberuid=%u))<br>
timeout = 4<br> timelimit = 3<br> net_timeout = 1<br> set_auth_type = yes<br> }</p>
<p><br> <br>#ldap {<br># server = "localhost"<br># identity = "cn=admin,dc=fabrica,dc=corp"<br># password = 123<br># basedn = "ou=Usuarios,dc=fabrica,dc=corp"<br># filter = "(uid=%u)" <br>
# start_tls = no<br># dictionary_mapping = ${raddbdir}/ldap.attrmap<br># ldap_cache_timeout = 120<br># ldap_cache_size = 0<br># ldap_connections_number = 10<br># password_attribute = userPassword<br># timeout = 3<br>
# timelimit = 5<br># net_timeout = 1<br># compare_check_items = no<br># access_attr_used_for_allow = yes<br># set_auth_type = yes<br># }</p>
<p># realm LOCAL {<br># format = prefix<br># delimiter = "/"<br># ignore_default = no<br># ignore_null = no<br># }<br>#<br># realm suffix {<br># format = suffix<br># delimiter = "@"<br># ignore_default = no<br>
# ignore_null = no<br># }<br>#<br># realm realmpercent {<br># format = suffix<br># delimiter = "%"<br># ignore_default = no<br># ignore_null = no<br># }<br>#<br># realm ntdomain {<br># format = prefix<br># delimiter = "\\"<br>
# ignore_default = no<br># ignore_null = no<br># } </p>
<p> checkval {<br> item-name = Calling-Station-Id<br> check-name = Calling-Station-Id<br> data-type = string<br> }</p>
<p> preprocess {<br> huntgroups = ${confdir}/huntgroups<br> hints = ${confdir}/hints<br> with_ascend_hack = no<br> ascend_channels_per_line = 23<br> with_ntdomain_hack = no<br> with_specialix_jetstream_hack = no<br>
with_cisco_vsa_hack = no<br> }</p>
<p> files {<br> usersfile = ${confdir}/users<br> acctusersfile = ${confdir}/acct_users<br> preproxy_usersfile = ${confdir}/preproxy_users<br> compat = no<br> }</p>
<p> detail {<br> detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d<br> detailperm = 0600<br> }</p>
<p> acct_unique {</p>
<p> key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Port"<br> }</p>
<p><br># $INCLUDE ${confdir}/sql.conf<br> radutmp {<br> filename = ${logdir}/radutmp<br> username = %{User-Name}<br> case_sensitive = yes<br> check_with_nas = yes <br> perm = 0600<br> callerid = "yes"<br>
}</p>
<p> radutmp sradutmp {<br> filename = ${logdir}/sradutmp<br> perm = 0644<br> callerid = "no"<br> }</p>
<p> attr_filter {<br> attrsfile = ${confdir}/attrs<br> }</p>
<p> counter daily {<br> filename = ${raddbdir}/db.daily<br> key = User-Name<br> count-attribute = Acct-Session-Time<br> reset = daily<br> counter-name = Daily-Session-Time<br> check-name = Max-Daily-Session<br> allowed-servicetype = Framed-User<br>
cache-size = 5000<br> }</p>
<p> sqlcounter dailycounter {<br> counter-name = Daily-Session-Time<br> check-name = Max-Daily-Session<br> sqlmod-inst = sql<br> key = User-Name<br> reset = daily</p>
<p> query = "SELECT SUM(AcctSessionTime - \<br> GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \<br> FROM radacct WHERE UserName='%{%k}' AND \<br> UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"<br>
}</p>
<p> sqlcounter monthlycounter {<br> counter-name = Monthly-Session-Time<br> check-name = Max-Monthly-Session<br> sqlmod-inst = sql<br> key = User-Name<br> reset = monthly<br> query = "SELECT SUM(AcctSessionTime - \<br>
GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \<br> FROM radacct WHERE UserName='%{%k}' AND \<br> UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'"<br>
}</p>
<p> always fail {<br> rcode = fail<br> }<br> always reject {<br> rcode = reject<br> }<br> always ok {<br> rcode = ok<br> simulcount = 0<br> mpp = no<br> }</p>
<p> expr {<br> }</p>
<p> digest {<br> }</p>
<p> exec {<br> wait = yes<br> input_pairs = request<br> }</p>
<p> exec echo {<br> wait = yes</p>
<p> program = "/bin/echo %{User-Name}"</p>
<p> input_pairs = request</p>
<p> output_pairs = reply</p>
<p> }</p>
<p> ippool main_pool {<br> range-start = 192.168.1.1<br> range-stop = 192.168.3.254<br> netmask = 255.255.255.0<br> cache-size = 800<br> session-db = ${raddbdir}/db.ippool<br> ip-index = ${raddbdir}/db.ipindex<br> override = no<br>
maximum-timeout = 0<br> }<br>}</p>
<p>instantiate {<br> exec<br> expr<br>}</p>
<p>authorize {<br> preprocess<br> mschap<br># suffix<br> files<br> ldap<br>}</p>
<p>authenticate {<br> Auth-Type PAP {<br> pap<br> }</p>
<p> Auth-Type CHAP {<br> chap<br> }</p>
<p> Auth-Type MS-CHAP {<br> mschap<br>}<br> ldap<br> unix<br> eap<br>}</p>
<p>preacct {<br> preprocess<br> acct_unique<br># suffix<br> files<br>}</p>
<p>accounting {<br> detail<br> radutmp<br>}<br>session {<br> radutmp <br>}</p>
<p>post-auth {<br>}</p>
<p>pre-proxy {<br>}</p>
<p>post-proxy {<br> eap<br>} <br></p>
<div>realy need help.</div>
<div> </div>
<div>THanks for advance!</div>