December 2005 - Freeradius-Users - lists.freeradius.org

bug in rlm_ldap?
by Norbert Wegener 16 Dec '05

16 Dec '05

I want to add a checkitem from an ldap request and use it, when later the users file is processed. Therefore I added checkItem User-Category primaryGroupID to ldap.attrmap The users file contains nothing but: ###################################### HOST/lnxad.tde002.sitest.net User-Category != 515 Fall-Through = No, HOST/lnxad.tde002.sitest.net User-Category == 515 Fall-Through = No, HOST/lnxad.tde002.sitest.net Auth-Type := Reject ###################################### radiusd -AX : .... rlm_ldap: looking for check items in directory... ldap_get_values ldap_get_values ..... ldap_get_values rlm_ldap: Adding LDAP attribute primaryGroupID as RADIUS attribute User-Category == 515 ldap_get_values rlm_ldap: looking for reply items in directory... ldap_get_values ... ldap_get_values ldap_get_values rlm_ldap: Adding LDAP attribute primaryGroupID as RADIUS attribute User-Category = 515 ldap_get_values rlm_ldap: user HOST/lnxad.tde002.sitest.net authorized to use remote access ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 users: Matched entry HOST/lnxad.tde002.sitest.net at line 12 This is the last entry of the users file with Auth-Type := Reject Neither of the entries containing the checkitem User-Category matches. Am I doing something wrong? Norbert Wegener

2 5

allowed characters in User-Password?
by Nils-Henner Krueger 16 Dec '05

16 Dec '05

I tried to replace a very old Livingston RADIUS installation by FreeRadius 1.0.1 (using the Solaris pkg from Blastwave). I used the "compat = cistron" directive to simply continue with the existing users file for a first test. At first sight everything worked fine but after following the log for a while it turns out that (too) many users were rejected. All the rejected accounts have a "%" sign in the User-Password. Are there any restrictions on the character set used for the User-Password attribute? Which special chars are forbidden? Where can I find information on that subject? How can I get around this problem? There are a few thousand dialin accounts, out of them about 300 have a "%" in the password so I can't simply call them and solve that directly, not speaking about other chars that might make trouble, too. Thanks for help! nhk

2 5

Freeradius and LDAP : to be continued
by Christophe Gravier 16 Dec '05

16 Dec '05

Hello, From the last things settled today about ldap support for freeradius on the list, I succeeded in configuring the ldap backend for freeradius. At least, radtest provides me an Accept response ! Nevertheless, with the front chillispot, I can't login, freeradius tells: rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ist-guizay.univ-st-etienne.fr:389, authentication 0 rlm_ldap: bind as / to ist-guizay.univ-st-etienne.fr:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=person,o=istase,c=fr, with filter (uid=gravier.christophe) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gravier.christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. That's pretty strange since it does work with radtest (But I see a plain text password being sent to openldap :s). Anyway, the problem comes from : rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". But I DO have told: password_attribute = "userPassword" for my ldap server in /etc/freeradius/radiusd.conf I mean, there's no configuration in chillispot expect the radius server IP to match users against. What's the difference between a radtest and a authentification via chillispot ? Apart from this chilli-freeradius problem (towards radtest), how can I make freeradius sent a hash as password ? (my userPassword is hash using SHA). There is a porposal here : http://lists.cistron.nl/pipermail/freeradius-users/2002-October/012169.html, but I don't want to use CHAP since my userPassword in SHA encrypted. I tried to comment in authorize section the chap and mschap part (I'll never use it). (same error). (I must say I followed http://www.linuxhomenetworking.com/linux-adv/ldap.htm#_Toc92561284 howto for configuring ldap for freeradius). Please, feel free to point me some directions to search. Best regards, Christophe.

7 21

RE: FreeRadius cannot Authenticate to Windows AD
by Alhagie Puye 16 Dec '05

16 Dec '05

Put quotes around the password....one thing I learned. That will take you further. I have a working config. So, please let me know if you are still running into problems. P.S. I will be posting a doc on the wiki once I'm done with testing. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Michael Calizo Sent: December 15, 2005 8:26 PM To: Freeradius-Users(a)lists.freeradius.org Subject: FreeRadius cannot Authenticate to Windows AD Hi Guru's, I have installed freeradius and used each LDAP module to authenticate to WINDOWS 2003 AD. The problem is it cant do the authentication, seems that i missed the radius.conf LDAP module configuration which causes the LDAP module to failed when connecting to MSAD. Below is my radius.conf config file. Hoping that you guys can help me, coz i have been googling all day for this config and i can not make this thing work... Thnx in advance.. radius.conf: ldap { server = "oberon.chikka.ph" # identity = "cn=admin,o=My Org,c=UA" identity = "cn=backops,cn=Admin,dc=chikka,dc=ph" password = _bant@3a-@n # password = mypass basedn = "dc=chikka,dc=ph" # filter = "(SamAccountName=%{Stripped-User-Name:-%{User-Name}})" #filter = "(SamAccountName=%U)" #filter = "(SamAccountName=%u)" # base_filter = "(objectclass=radiusprofile)" base_filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(memberOf=Admin,D C=chikka,DC=ph))" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" ictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } Here is my the radiusd -X -A LOG... rad_recv: Access-Request packet from host 192.168.1.13:37146, id=42, length=59 User-Name = "myaccount" User-Password = "mypass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "myaccount", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "myaccount" with password "mypass" radius_xlat: '(&(sAMAccountName=myaccount)' radius_xlat: 'dc=domain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.1:389, authentication 0 rlm_ldap: bind as cn=backops,cn=Admin,dc=domain,dc=com/passofbackops to 192.168.1.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns fail for request 0 modcall: group Auth-Type returns fail for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 42 to 192.168.1.13:37146 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 42 with timestamp 43a23bb5 Nothing to do. Sleeping until we see a request. -- Mike Calizo Registered Linux User # 365113 _________________________________________________ Even the longest journey has to start with a small first-step This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

3 2

Re: Freeradius-Users Digest, Vol 8, Issue 71 (Away from the office)
by Robert Wills 16 Dec '05

16 Dec '05

I am away from the office, returning on the 9th of January 2006, if you have any urgent problems please forward them to SWRC IT (it(a)bunbury.training.wa.gov.au) Or Call 9780 7314 . See you soon Robert

1 0

several LDAP servers to authenticate ?
by Frank Bonnet 16 Dec '05

16 Dec '05

Hello I actually use freeradius to authenticate wi-fi users thru the chillispot software. Our freeradius server use our LDAP as backend and everything runs well now I would like to know if it is possible to use _several_ LDAP servers with freeradius with a kind of the following mechanism : If the login is not found on our local LDAP server it will be search on the next LDAP server in a list and so on until all LDAP servers have been searched ? Thanks a lot -- Regards Frank

3 2

FreeRadius cannot Authenticate to Windows AD
by Michael Calizo 15 Dec '05

15 Dec '05

Hi Guru's, I have installed freeradius and used each LDAP module to authenticate to WINDOWS 2003 AD. The problem is it cant do the authentication, seems that i missed the radius.conf LDAP module configuration which causes the LDAP module to failed when connecting to MSAD. Below is my radius.conf config file. Hoping that you guys can help me, coz i have been googling all day for this config and i can not make this thing work... Thnx in advance.. radius.conf: ldap { server = "oberon.chikka.ph" # identity = "cn=admin,o=My Org,c=UA" identity = "cn=backops,cn=Admin,dc=chikka,dc=ph" password = _bant@3a-@n # password = mypass basedn = "dc=chikka,dc=ph" # filter = "(SamAccountName=%{Stripped-User-Name:-%{User-Name}})" #filter = "(SamAccountName=%U)" #filter = "(SamAccountName=%u)" # base_filter = "(objectclass=radiusprofile)" base_filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(memberOf=Admin,DC=chikka,DC=ph))" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" ictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } Here is my the radiusd -X -A LOG... rad_recv: Access-Request packet from host 192.168.1.13:37146, id=42, length=59 User-Name = "myaccount" User-Password = "mypass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "myaccount", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "myaccount" with password "mypass" radius_xlat: '(&(sAMAccountName=myaccount)' radius_xlat: 'dc=domain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.1:389, authentication 0 rlm_ldap: bind as cn=backops,cn=Admin,dc=domain,dc=com/passofbackops to 192.168.1.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns fail for request 0 modcall: group Auth-Type returns fail for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 42 to 192.168.1.13:37146 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 42 with timestamp 43a23bb5 Nothing to do. Sleeping until we see a request. -- Mike Calizo Registered Linux User # 365113 _________________________________________________ Even the longest journey has to start with a small first-step

1 0

Reply message from the sqlcounter module
by Gunther 15 Dec '05

15 Dec '05

Just added the sqlcounter to my FreeRadius configuration. Stumbled over the "Your maximum never usage time has been reached" reply message for my noresetcounter (refer to doc/rlm_sqlcounter). Changed it to: "Your maximum access time has been reached" for the 'never' case. Here my Q&D solution: Change in freeradius-1.0.5/src/modules/rlm_sqlcounter/rlm_sqlcounter.c diff rlm_sqlcounter.c rlm_sqlcounter.c.ORIG 668,672c668 < if (strcmp(data->reset, "never") == 0) { < snprintf(msg, sizeof(msg), "Your maximum access time has been reached"); < } else { < snprintf(msg, sizeof(msg), "Your maximum %s usage time has been reached", data->reset); < } --- > snprintf(msg, sizeof(msg), "Your maximum %s usage time has been reached", data->reset);

1 0

Checkitems
by Norbert Wegener 15 Dec '05

15 Dec '05

Maybe my last question was unclear this morning. Therefore I would like to rephrase it: Checkitems may be defined via ldap.attrmap e.g. like: checkItem User-Category primaryGroupID Those items, retrieved from an ldapserver and thus not part of the request: Are they supposed to be accessible by following modules? In a case like this in radiusd.conf: authorize { ldap { notfound = return } files } Should the files module have access to to a check item User-Category ? Thanks Norbert Wegener

2 1

problems with freeradius 1.0.5
by Riccardo Veraldi 15 Dec '05

15 Dec '05

hell oI upgraded from freeradius 1.0.2 to 1.0.5 and nothing works anymore I have this error: radiusd.conf[1682] Unknown Auth-Type "Pam" in authenticate section. commenting out pam thne I Got this radiusd.conf[1682] Unknown Auth-Type "System" in authenticate section. and so if I comment out "unix" in the radiusd.conf fiel I get this error: rlm_eap_gtc: Unknown Auth-Type PAP rlm_eap: Failed to initialize type gtc anyone has some hints ?? thank you Rick

3 4