June 2005 - Freeradius-Users - lists.freeradius.org

Local (system) account creation
by Haydur 20 Jun '05

20 Jun '05

Hi there, Is there a way to have remote FreeRadius only authentication on a Linux box, and if successful, creation of a system / local account for that user. Thanks, Neod

2 1

RE: Multiple Authentication REALMS - I hope in Plain Text
by Shepherd, Dave 20 Jun '05

20 Jun '05

Alan, Thanks for the advice; "As always, start with the default configuration: it works" As I've now got it working for my standard config. However, I still seem to be getting the request marked as complete after the authorize section:- Thread 1 handling request 0, (1 handled so far) Waking up in 5 seconds... User-Name = "unextest20" User-Password = "*****" Called-Station-Id = "**********" rad_lowerpair: User-Name now 'unextest20' modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched DEFAULT at 21 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'unextest20' rlm_sql (sql): sql_set_user escaped user --> 'unextest20' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'unextest20' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 9 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'unextest20' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'unextest20' ??ORDER BY id' rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'unextest20' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 9 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 Finished request 0 This only occurs when I match the following in my users file: # NexUS RAS DEFAULT Called-Station-Id == "********", Proxy-To-Realm := "sloxldap" Fall-Through = No If I match on my other statements, the user authenticates as expected. Any thoughts as to why this might be happening. I'm on version 0.9.3. TIA Dave Shepherd > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok > Sent: 14 June 2005 18:33 > To: FreeRadius users mailing list > Subject: Re: Multiple Authentication REALMS - I hope in Plain Text > > "Shepherd, Dave" <Dave.Shepherd(a)compass-group.co.uk> wrote: > > realm SPECIAL { > > type = radius > > authhost = LOCAL > > accthost = LOCAL > > } > > In the latest versions, this is realm "LOCAL", but that doesn't make > too much difference. > > > Auth-Type { > > mschap > > } > > Are you sure? How about "Auth-Type mschap {" ... > > > modcall: group authorize returns updated for request 14 > > Finished request 14 > > Hmm... something is marking the request as done, without calling the > "authenticate" section. I have no idea why, and I don't recall ever > seeing anything like that. > > > If one of you guys has had to do something similar, or can see any > > glaring omissions in my config (which I seem to think there is) could > > you please point me in the right direction. > > As always, start with the default configuration: it works. > > Then, gradually add your edits, testing after every edit, to be sure > that it still works. Once you're done, you should have your local > configuration , and it should still work. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

radiusd sending output to stdout without -X flag
by Ken Tyler 20 Jun '05

20 Jun '05

Hi all, I have downloaded, compiled, configured the latest CVS snapshot and it works fine. I have a question, the server is logging to stdout no matter what I do. I am not running with -X flag. Any ideas? I have config setup to log to syslog, tried file also, no luck. Ken

2 1

PAM_RADIUS_AUTH.so refuses to work on some machines
by Christiaan Ehlers 20 Jun '05

20 Jun '05

Hi I have installed pam_radius_auth to work on Redhat 7.3 and it seems to work fine. I then installed (compiled) it on a Redhat 9 box and it seems to be behaving quite strange. My pam.d/sshd file looks like this #%PAM-1.0 auth sufficient pam_radius_auth.so debug auth required pam_stack.so service=system-auth auth required pam_nologin.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth session sufficient pam_radius_auth.so debug session required pam_stack.so service=system-auth session required pam_limits.so session optional pam_console.so The session (accounting) part of pam_radius_auth seems to work fine. I can see packets going to the radius server when I do a tcpdump on the client machine. This only works when I hash out the first line "auth sufficient pam_radius_auth.so debug". When the first line is not hasshed the authentication kicks in and nothing happens when I enter a username and password. I set tcpdump to sniff for all packets going to the radius server but there is nothing. My logs look like this. Jun 20 17:12:01 finpapp01 sshd[6881]: pam_radius_auth: Got user name root Jun 20 17:12:23 finpapp01 sshd[6887]: pam_radius_auth: Got user name test Jun 20 17:14:00 finpapp01 sshd[7161]: pam_radius_auth: Got user name test Jun 20 17:18:14 finpapp01 sshd[7673]: Failed password for test from 172.31.1.101 port 2276 Jun 20 17:18:45 finpapp01 sshd[7780]: Accepted password for root from 172.31.1.101 port 2277 Jun 20 17:18:45 finpapp01 sshd[7780]: pam_radius_auth: DEBUG: getservbyname(radacct, udp) returned 1108551052. Jun 20 17:18:48 finpapp01 sshd[7780]: pam_radius_auth: RADIUS server 172.31.10.1 failed to respond Jun 20 17:18:48 finpapp01 sshd[7780]: pam_radius_auth: All RADIUS servers failed to respond. Jun 20 17:22:26 finpapp01 sshd[8216]: pam_radius_auth: Got user name test Jun 20 17:24:50 finpapp01 sshd[8541]: pam_radius_auth: Got user name root Jun 20 17:28:40 finpapp01 sshd[8978]: Accepted password for root from 172.31.1.120 port 1916 ssh2 When I try and log into the box, the only info that pam_radius_auth give to the log is the "Got user name xxxx" message. What would the right syntax be for a strace command to trace this? So far I have recompiled, copy bin from other machines but nothing seems to work. Kind Regarsd Christiaan Ehlers

1 0

How to solve alive user who actually has loged off
by ??? 20 Jun '05

20 Jun '05

Hello everybody, I am using freeradius-1.0.4. In my situation, user "testuser" from domain "domain" logged from NAS 192.168.1.68, After a while,user "testuser" logged out,but the NAS did not send Accout-Stop packet(for some reason) and freeradius still thought that user "testuser" is alive,but Actually user "testuser" has logged off. I have set the Simulate-Use to 1 and now "testuser" can not log in any more from anywhere. I use radwho and it output as follows: # ./radwho -R User-Name = "testuser@domain" Acct-Session-Id = "02022911" NAS-IP-Address = 192.168.1.68 NAS-Port = 98335 Service-type = Login-User Framed-IP-Address = 0.0.0.0 Acct-Session-Time = 4112 Calling-Station-Id = "00d0-5926-e3fb" I want to do something to make freeradius to believe that user "testuser" is not alive,but do not konw how to do.Is there a way to solve the problem? Thanks!

3 2

Reid Canavan/FortErie is on Vacation
by Reid Canavan 20 Jun '05

20 Jun '05

I will be out of the office starting Mon 06/20/2005 and will not return until Mon 06/27/2005. I will respond to your message when I return.

1 0

Re: Problem with LDAP group searches
by Graham, Robert 20 Jun '05

20 Jun '05

>> I'm trying to get Freeradius configured to authenicate our vpn users >> from a Cisco 3005 concentrator against Active Directory using the ldap >> module. When I authenicated a vpn user on a per user basis - it works >> fine. However, I want authenicate not only the user, but also verify >> that the user is a member of a "group" in active directory. I was >> following Dustin Doris's suggestion on Per-Client "group" matching and >> configured the huntgroups, users, and radiusd.conf accordingly. >> However, it seems to fail doing a group lookup. I don't know if it >> matters, but the user object and group object in Active Directory are in >> different containers (OU's). Any help would be appreciated. >> > >You need to specify where the groups are located in AD. But isn't this the purpose of setting the basedn in radiusd.conf? Or is there another seeting that I need to configure for ldap group searches? > >> rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem >> users,dc=mem-ins,dc=com' radius_xlat: >> '(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM >> Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM >> Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0 >> rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mem >> users,dc=mem-ins,dc=com, with filter >> (&(cn=MEMVPNFlex)(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM >> Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM >> Users,DC=mem-ins,DC=com)))) rlm_ldap: object not found or got ambiguous >> search result rlm_ldap: ldap_release_conn: Release Id: 0 >> rlm_ldap::ldap_groupcmp: Group MEMVPNFlex not found or user is not a >> member. >> users: Matched DEFAULT at 166 > >The user was not found in that group, based on the lookup above. The user is a member of the MEMVPNFlex group in AD > >> groupname_attribute = cn >> groupmembership_filter = >> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn})) >> (&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" >> groupmembership_attribute = radiusGroupName > >You have to modify these so you can find the group memberships. For >example, how would you perform an ldapsearch from the command line to >find group memberships? Take that info and put it there. Make sure the >user you are binding with has access to read those groups. > >Hope that is a little helpful. > > >

2 1

(no subject)
by Graham, Robert 20 Jun '05

20 Jun '05

Dustin, Thanks for the response. I was kind of wondering if the location of the group in Active Directory was an issue. But that brings up another question. Doesn't a ldapsearch use the basedn as a starting point? If instance, I have the basedn set as follows in radiusd.conf: basedn = "ou=mem users,dc=mem-ins,dc=com" And the structure of our AD is: MEM-INS.COM | | |_MEM Users | | | | And why is it that it can find the user "rgraham" but not the group. > I'm trying to get Freeradius configured to authenicate our vpn users > from a Cisco 3005 concentrator against Active Directory using the ldap > module. When I authenicated a vpn user on a per user basis - it works > fine. However, I want authenicate not only the user, but also verify > that the user is a member of a "group" in active directory. I was > following Dustin Doris's suggestion on Per-Client "group" matching and > configured the huntgroups, users, and radiusd.conf accordingly. > However, it seems to fail doing a group lookup. I don't know if it > matters, but the user object and group object in Active Directory are in > different containers (OU's). Any help would be appreciated. > You need to specify where the groups are located in AD. > rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=mem > users,dc=mem-ins,dc=com' radius_xlat: > '(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM > Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM > Users,DC=mem-ins,DC=com)))' rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=mem > users,dc=mem-ins,dc=com, with filter > (&(cn=MEMVPNFlex)(|(&(objectClass=GroupOfNames)(member=CN=Rgraham,OU=Columbia,OU=MEM > Users,DC=mem-ins,DC=com))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=Rgraham,OU=Columbia,OU=MEM > Users,DC=mem-ins,DC=com)))) rlm_ldap: object not found or got ambiguous > search result rlm_ldap: ldap_release_conn: Release Id: 0 > rlm_ldap::ldap_groupcmp: Group MEMVPNFlex not found or user is not a > member. > users: Matched DEFAULT at 166 The user was not found in that group, based on the lookup above. > groupname_attribute = cn > groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn})) > (&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > groupmembership_attribute = radiusGroupName You have to modify these so you can find the group memberships. For example, how would you perform an ldapsearch from the command line to find group memberships? Take that info and put it there. Make sure the user you are binding with has access to read those groups. Hope that is a little helpful.

2 1

dialup_admin $nas_list empty
by Aaron Paetznick 19 Jun '05

19 Jun '05

I originally sent this to the list on June 12th. My original email is below. I'd write the missing code myself, but I want to make sure that somebody else isn't working on the same problem. By the way, is there somebody I should be working with directly on issues relating to dialup_admin? Thanks. ----- I'm using FreeRADIUS v1.0.2 and dialup_admin v1.70. FreeRADIUS and nas_admin.php3 in dialup_admin are using the nas table in the database correctly, but pages like user_finger.php3 user_stats.php3, stats.php3, and failed_logins.php3 are not detecting any NASes in the database. The problem seems to be caused by the $nas_list variable in each of those files being empty. I looked into it a little, and I can't see where $nas_list is even being created, aside from nas_admin.php3. I noticed that the $nas_list variable is a very new addition. I think some code needs to be added to generate $nas_list at the top of each of these files. Thanks. --Aaron

1 0

username+password wi-fi authentication with freeradius
by Milver Nisay 19 Jun '05

19 Jun '05

nice to be back again with the list. what are some pros and cons of adding user-name and password attribute together with authentication type eap/tls attributes? would appreciate some feedbacks. what i would like to achieve is for wi-fi enabled laptop to get a pop-up screen authentication, asking for username and password (besides from certificates) after getting a dynamic IP from router or radius . this process can enable us to sell the service inside an internet cafe or coffee shop, any links that can get me started and get on with the right track besides from the dead link from Mr. McKay???

2 2