July 2005 - Freeradius-Users - lists.freeradius.org

Simultaneous-Use Problem...Excuseme
by alfonso celestino 19 Jul '05

19 Jul '05

Hi, I need your help I want to limit the number of times one user account can login; I have next in the user file: wireless User-Password == "wireless", Simultaneous-Use := 1 Aruba-User-Role = "STAFF" But de user "wireless" can login more of one times How can i solve this problem? Thanks in advance!! Advertencia: el mensaje reenviado fue incluido como archivo adjunto. --------------------------------- Do You Yahoo!? La mejor conexión a Internet y 2GB extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Simultaneous-Use Problem
by alfonso celestino 19 Jul '05

19 Jul '05

--------------------------------- Do You Yahoo!? La mejor conexión a Internet y 2GB extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

FW: TTLS and PAP
by martin.p.bradley＠bt.com 19 Jul '05

19 Jul '05

Folks, I'm trying to get TTLS/PAP working using freeradius 1.0.4. I must have it configured incorrectly because its giving a Segmentation fault just before giving the Access-Accept & EAP-Success back to the switch. I have searched the archives for a solution but not found help to sort my problem out. I have played around with the configuration but don't fully understand what I'm doing. Could someone point me to a place where I can read and understand how the authenticate and autorize sections work. The explanation in the radiusd.conf file don't seem to click with me. I don't understand is why the modcall[authorise] appear often in request processing before modcall[authenticate]. I thought the order was to authenticate a user and then once we are sure they are who they say they are then we authorise them to use the network. Thanks for any help, Martin. radiusd.conf ................ authenticate { Auth-Type PAP { pap } eap } authorize { preprocess eap files } Users file...................... "Client certificate" Auth-Type := Local, User-Password == "bradley" Service-Type = Framed-User, Framed-Compression = Van-Jacobsen-TCP-IP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 users: Matched entry DEFAULT at line 162 modcall[authorize]: module "files" returns ok for request 3 rlm_eap: EAP packet type response id 34 length 200 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type System rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'anonymous' auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 TLS_accept: SSLv3 read client key exchange A TLS_accept: SSLv3 read finished A TLS_accept: SSLv3 write change cipher spec A TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 34 to 10.230.199.248:1126 EAP-Message = 0x0123003d15800000003314030100010116030100288b7a33f454f760f4cddff2f95941 b215a6f3d73b5e422d1744b2201bee31448f10dc78f33f354476 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49b28c5e2307f384db00487f11336474 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.230.199.248:1126, id=35, length=248 User-Name = "anonymous" NAS-IP-Address = 10.230.199.248 NAS-Port = 2 State = 0x49b28c5e2307f384db00487f11336474 Calling-Station-Id = "00:06:5b:d6:ff:24" NAS-Identifier = "radius-netgear" NAS-Port-Type = Ethernet EAP-Message = 0x02230078150017030100189e2c7d7fea093fe36d2ad301f92cc2ef4cba50563b00a0a8 1703010050b5955c43a5cd51375cebde00ed386a2f4273385aa3f6b0b2c6f7e15b73a75e e8f64e15abdca0a875fd3408d3ce811a76580cee45fc540215f84bcc2f99a95cc5199a36 da952c0a76243f7f7645f4327b Message-Authenticator = 0x3ddd5d8d65f10f4a26c7db7ab52a96db X-Ascend-Token-Idle = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 users: Matched entry DEFAULT at line 162 modcall[authorize]: module "files" returns ok for request 4 rlm_eap: EAP packet type response id 35 length 120 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type System rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'anonymous' auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 users: Matched entry Client certificate at line 90 modcall[authorize]: module "files" returns ok for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 modcall: group authorize returns ok for request 4 auth: type Local auth: user supplied User-Password matches local User-Password TTLS: Got tunneled Access-Accept Segmentation fault [root@mars raddb]#

2 1

Re: Searching Subcontexts in eDir
by Mearl Danner 19 Jul '05

19 Jul '05

Check the filter statement in the ldap portion of radiusd.conf. It's searching on "uid" which in eDirectory is an integer field and isn't populated by default. Change the filter to filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" and try it. That will get you past the "object not found" message. It will then be able to return the fully qualified DN of the user. You can search on "cn" or any other ldap field that contains a unique ID. We're probably going to use uniqueID - the newer user creation API's populate it by default - in our environment because iPrint requires it. Mearl >>> jp(a)joshmp.com 7/19/2005 1:10:08 PM >>> I am running FreeRADIUS 1.0.4 on FreeBSD 4.11 authenticate/authorize users via LDAP on a NetWare 6.5 server/tree. I can successfully authenticate and authorize users if they reside in the root context (o=<rootcontext>), but authorize fails if the user is in an ou in the root context. The "identity" user in the ldap modules section is an admin equivalent. Also, if I change the basedn to the subcontext (ou=<subcontext>,o=<rootcontext>), it still fails. Relevant info from radtest: -----snip----- radtest gwaccesspo1 <password> localhost 10 testing123 -----snip----- The gwaccesspo1 user's context is as follows: cn=gwacesspo1,ou=gw,o=services Relevant info from radiusd.conf: -----snip----- server = "10.254.8.25" identity = "cn=raduser,o=services" password = "<password>" basedn = "o=services" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" -----snip----- raduser.services is an admin equivalent. Relevant info from debug: -----snip----- rlm_ldap: - authorize rlm_ldap: performing user authorization for gwaccesspo1 radius_xlat: '(uid=gwaccesspo1)' radius_xlat: 'o=services' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (uid=gwaccesspo1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed -----snip----- The "gwaccesspo1" user above resides in ou=gw,o=services. As mentioned above, even if I set the basedn to ou=gw,o=services, I still get the "object not found" error. Thanks in advance for any suggestions. Josh - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Searching Subcontexts in eDir
by jp＠joshmp.com 19 Jul '05

19 Jul '05

I am running FreeRADIUS 1.0.4 on FreeBSD 4.11 authenticate/authorize users via LDAP on a NetWare 6.5 server/tree. I can successfully authenticate and authorize users if they reside in the root context (o=<rootcontext>), but authorize fails if the user is in an ou in the root context. The "identity" user in the ldap modules section is an admin equivalent. Also, if I change the basedn to the subcontext (ou=<subcontext>,o=<rootcontext>), it still fails. Relevant info from radtest: -----snip----- radtest gwaccesspo1 <password> localhost 10 testing123 -----snip----- The gwaccesspo1 user's context is as follows: cn=gwacesspo1,ou=gw,o=services Relevant info from radiusd.conf: -----snip----- server = "10.254.8.25" identity = "cn=raduser,o=services" password = "<password>" basedn = "o=services" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" -----snip----- raduser.services is an admin equivalent. Relevant info from debug: -----snip----- rlm_ldap: - authorize rlm_ldap: performing user authorization for gwaccesspo1 radius_xlat: '(uid=gwaccesspo1)' radius_xlat: 'o=services' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (uid=gwaccesspo1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed -----snip----- The "gwaccesspo1" user above resides in ou=gw,o=services. As mentioned above, even if I set the basedn to ou=gw,o=services, I still get the "object not found" error. Thanks in advance for any suggestions. Josh

1 0

Config problem: ntlm_auth works outside of freeradius, but not in
by Ken George 19 Jul '05

19 Jul '05

The ntlm_auth command works from the command line, but not within freeradius (1.0.1) on RHEL 3.0 update 4 Below is my ntlm_auth command from within radiusd.conf and the debug output and the successful command line run of the ntlm_auth program. Where do I look for what I have misconfigured? I'm happy that I configured the client section correctly and my 3005 is now talking to freeradius, but I'll be happier when it can actually authorize. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Thread pool initialized Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. Thread 2 got semaphore Thread 2 handling request 1, (1 handled so far) User-Name = "ken george" User-Password = "262144" Vendor-3076-Attr-32 = 0x00000015 NAS-IP-Address = 10.10.61.5 NAS-Port-Type = Virtual rad_lowerpair: User-Name now 'ken george' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "ken george", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: No '\' in User-Name = "ken george", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched DEFAULT at 204 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type win_domain auth: type "win_domain" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 radius_xlat: '/usr/bin/ntlm_auth --username="ken george" --password="xxxxxx" --domain=usmisgnet' Exec-Program: /usr/bin/ntlm_auth --username="ken george" --password=" xxxxxx " --domain=usmisgnet Exec-Program output: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program-Wait: plaintext: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program: returned: 1 rlm_exec (win_domain): External script failed modcall[authenticate]: module "win_domain" returns fail for request 1 modcall: group Auth-Type returns fail for request 1 auth: Failed to validate the user. Login incorrect: [ken george] (from client VPN3005_Pri port 0) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Thread 2 waiting to be assigned a request rad_recv: Access-Request packet from host 10.10.61.5:1045, id=2, length=74 Sending Access-Reject of id 2 to 10.10.61.5:1045 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 2 with timestamp 42dd17f4 Nothing to do. Sleeping until we see a request. [root@phllnxsrv01 raddb]# /usr/bin/ntlm_auth --username="ken george" --password=" xxxxxx " --domain=usmisgnet NT_STATUS_OK: Success (0x0) Thanks! Ken George Systems and Network Engineering Mi Services Group, Inc. +1 610-230-2500 x129

2 1

radius and clients.conf?
by Will Carter 19 Jul '05

19 Jul '05

It seems that when I start radius in debug mode, it is correctly reading my clients.conf file, but when I start it normally, it is not recognizing my nas device. Its as if it's not reading the correct clients.conf. Any ideas why this would be? -will

2 1

Difference between dictionary and RFC 2865 for Attribute Class
by Andreas Engler 19 Jul '05

19 Jul '05

Hello, i wonder why the entry for Attribute Class in the dictionary file is octets. I think that is the reason why the Value of Class will be stored as hex string in detail file and sql. So i have to convert it back to ASCII to read the contents. The definition in RFC says that the Value of Class should be string. Because Alan always warn to not edit the dictionary file, i would like to know which kind of trouble i would face in changing octets to string in dictionary file. Will the value be changed in future or do i have to do it on my own and on my own risk? Thank you for response Andreas

2 1

LDAP Authorization & different VLAN
by Felice Pizzurro 19 Jul '05

19 Jul '05

Hi, I have made a system of authorization with freeradius 1.0.4 based on LDAP attribute radiusGroupName and it works perfectly! Now I have this problem: I have on my access points two VLAN named data and students. I want to create different group for the authorization to access to this VLANs. Example, I want that who have the attribute radiusGroupName = WLANdata can access to the VLAN "data"; and who have the attribute radiusGroupName=WLANstudents can access to the VLAN "students". How I can configure the huntgroups file? or I need to configure the users file? Thanks and excuse me for my english, Felice -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: aziendeinaffari.it: la risposta per tutte le esigenze delle industrie. Vieni a conoscere le 2000 imprese che ne fanno parte * Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=3610&d=19-7

2 1

Error in Dialup Admin's online users page
by Tobias Wolf 19 Jul '05

19 Jul '05

Hi, there's a mistake in user_admin.php3 of dialup_admin. Right now, it's displaying the Download value twice on the Online Users page. Once as human-readable value under Upload and once as raw bytes under Download. I found the glitch on line 196. if ($lastlog_input) $lastlog_input = bytes2str($lastlog_input); else $lastlog_input = 'not available'; if ($lastlog_output) >>>> $lastlog_input = bytes2str($lastlog_output); else $lastlog_output = 'not available'; Of course it's got to be $lastlog_output. cheers, tobias

1 0