August 2005 - Freeradius-Users - lists.freeradius.org

LDAP attributes into freeradius
by Joe H 17 Aug '05

17 Aug '05

Here is my goal: I would like to assign an attribute to certain users in ldap and have freeradius look for that attribute to determine whether or not to reply back to the NAS device with an IP address pool name. The users with the attribute set would not have the Pool sent and the users without the attribute set would have the pool sent. Here is the rule that I have set for it in the users file: DEFAULT Huntgroup-Name == "dialup" Idle-Timeout = "1800", Fall-Through = Yes DEFAULT Huntgroup-Name == "dialup", No-Pool != "1" USR-Framed_IP_Address_Pool_Name = "POOL", Idle-Timeout := "120", Fall-Through = Yes dialup is the ldap module I have setup in the radiusd.conf file. Here is that entry: ldap dialup { server = "localhost" identity = "cn=Manager,dc=domain,dc=com" password = "*********************" basedn = "ou=Users,o=domain.com,dc=domain,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no tls_mode = no dictionary_mapping = ${raddbdir}/ldap-dialup.attrmap ldap_connections_number = 288 groupname_attribute = gidNumber groupmembership_filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no } The problem I'm seeing is that radius doesn't seem to use the value of No-Pool. I have it in the ldap-dialup.attrmap as: checkItem No-Pool radiusNoPool radiusNoPool is the ldap attribute with a value of 1. Where else do I need to add the new attribute No-Pool in order for freeradius to use it? Joe H. GWI Operations.

3 2

Debian 802.1x LDAP
by Cian Phillips 17 Aug '05

17 Aug '05

Greetings. I'm trying to get a Debian (stable) box set up to authenticate users for our Cisco Wireless Control Software via LDAP. I have tried the Debian package and can get LDAP running easily. When I try to get the eap/tls stuff working it gives me an error about missing libraries. rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory I have googled this and found some messages that suggest compiling from source and using the --shared-disabled flag at compile time but I've tried building from source and can't even get LDAP working.. each time I un-comment the ldap line from the radiusd.conf file and try to start using radiusd -x I get a segfault. Ideally I would like to stick with Debian as that is what my other production servers are but would be willing to use something else if it makes easier work of this process. If anyone has gotten Debian + 802.1x + LDAP working or even just 802.1x + LDAP I could really use some pointers if even just to tell me it is or isn't possible. Thanks in advance. Cian Phillips Cian Phillips Director Network & Systems California College of the Arts Phone: (510) 594-3745 Cell: (510) 719-0091 Fax: (510) 594-3758 email: cian(a)cca.edu

4 5

Require NAS dependant radius return attributes
by Ben Thompson 17 Aug '05

17 Aug '05

> Ben Thompson wrote: > > > The trouble is I need to assign different VLAN's to users depending > > which access point they connect from. What I would like to know is if it > > is possible to use Huntgroups to look up the VLAN id based on something > > like the IP address of the access point? > > You could test the variable "Client-IP-Address" in the users file. > > testuser Client-IP-Address == 10.0.0.1, Password := "azerty" > Tunnel-Private-Group-ID:1 := 1, > Fall-Through = Yes > > testuser Client-IP-Address == 10.0.0.2, Password := "azerty" > Tunnel-Private-Group-ID:1 := 2, > Fall-Through = Yes > > -- > Nicolas Baradakis Hi Thanks for that advice. I can see that I could end up with a very large users file using this method. Is there any limit on the size of the users file? In the near future we may have something like 800000 entries in there. Is this where you would normally look to use a database backend? Thanks Ben

2 3

rlm_x99
by Iandc Davies 17 Aug '05

17 Aug '05

Hi all, Can anybody tell me what the rlm_x99 modules is and does ? It's stopping my compile at the moment and ammjust wondering whether I need it or not. Cheers Ian Davies Software Development Engineer

2 1

freeRadius Authorization
by abera 17 Aug '05

17 Aug '05

Hi, I have small newbie questions.. I want to configure freeRadius for authentication & authorization. I am able to do proper authentication. 1) I want to configure my users in multiple groups (depending on their roles). How to do that? 2) And what is the common practice for this? How this is managed in any enterprise servers / enterprise networks who uses radius server for the AAA? Thanks... Regards, abera ____________________________________________________ Start your day with Yahoo! - make it your home page http://www.yahoo.com/r/hs

1 0

FreeRadius 1.0.4 crashing when getting Request
by Sebastian Mauer 17 Aug '05

17 Aug '05

Hello there, I have a little problem with setting up FreeRADIUS with MySQL Support properly. My Linux Distro is Debian Sarge 3.1. I installed all necessary libraries and compiled FreeRadius with MySQL enabled. Then I installed all necessary MySQL tables and configured FreeRadius to do EAP-TLS with MySQL as backend. All seems to work nice until the server finally recieves a first request. The server segfaults and that's the end. I have no idea what could have gone wrong Does someone of you have an idea what to do? Sincerely, Sebastian Mauer

3 2

EAP/TLS DLINK DWL-2000AP+ Setup Problem XP Client
by Ceyhun K� 17 Aug '05

17 Aug '05

Hi, I've setup eap/tls with freeradius in my network. I'm using certificates signed by a private CA. Here is my problem: When i check validate server certificate in client's connection properties, radius an access challenge and nothing happens: Sending Access-Challenge of id 3 to 192.168.145.13:1812 EAP-Message = 0x010400350d800000002b14030100010116030100209e7c62b412a95e4583fd662183c3cfd5ff3aa01d4cf27de813dc6cc9b040fc78 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf48deff8e489ad47d9acb4c64dc756f4 With box unchecked, everything seems to be ok in freeradius logs. But just after Access-Accept packet, AP reboots and client connection dies. Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 26 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 26 modcall: group authenticate returns ok for request 26 Sending Access-Accept of id 10 to 192.168.145.13:1812 MS-MPPE-Recv-Key = 0x7ace5e49f382cd4ad52cbef684f2380b2d9982659a2779ca55e3e7f243277363 MS-MPPE-Send-Key = 0xa44f01b3c2487c7ac23853a6b1c9fb645f3cf9780ed791d772bf639eb8dc6f63 EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "wireless-12" Finished request 26 I'm confused, where to find error? My AP HW, freeradius configuration, or certificate stuff. Please guide me.

2 1

compiling CVS snapshot dies
by Koos Beens 17 Aug '05

17 Aug '05

Hello, I understand the debian package will not contain the eap modules and the latest version will die with a undefined symbol in rlm_eap_ttls/tls/peap so... I am trying to compile a cvs snapshot, in debian with command dpkg-buildpackage -us -uc -rfakeroot -b It dies with this message: ... rlm_ldap.c: In function `ldap_instantiate': rlm_ldap.c:416: warning: assignment discards qualifiers from pointer target type rlm_ldap.c:439: warning: assignment discards qualifiers from pointer target type rlm_ldap.c:444: warning: passing arg 2 of `xlat_register' from incompatible pointer type rlm_ldap.c: In function `read_mappings': rlm_ldap.c:632: warning: `pair' might be used uninitialized in this function rlm_ldap.c: In function `ldap_authorize': rlm_ldap.c:1477: error: structure has no member named `passwd_rad_attr' rlm_ldap.c:1498: error: structure has no member named `passwd_rad_attr' rlm_ldap.c: In function `ldap_authenticate': rlm_ldap.c:1663: warning: unused variable `err' rlm_ldap.c: In function `ldap_detach': rlm_ldap.c:2291: warning: passing arg 2 of `xlat_unregister' from incompatible pointer type make[7]: *** [rlm_ldap.lo] Fout 1 make[7]: Leaving directory `/home/kozy/deb-src/freeradius/freeradius-snapshot-20050807/src/modules/rlm_ldap' make[6]: *** [common] Fout 2 make[6]: Leaving directory `/home/kozy/deb-src/freeradius/freeradius-snapshot-20050807/src/modules' make[5]: *** [all] Error 2 make[5]: Leaving directory `/home/kozy/deb-src/freeradius/freeradius-snapshot-20050807/src/modules' make[4]: *** [common] Error 2 make[4]: Leaving directory `/home/kozy/deb-src/freeradius/freeradius-snapshot-20050807/src' make[3]: *** [all] Fout 2 make[3]: Leaving directory `/home/kozy/deb-src/freeradius/freeradius-snapshot-20050807/src' make[2]: *** [common] Error 2 make[2]: Leaving directory `/home/kozy/deb-src/freeradius/freeradius-snapshot-20050807' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/kozy/deb-src/freeradius/freeradius-snapshot-20050807' make: *** [build-simple] Error 2 What do I have it compile? Thanks very much for any help, Kozy.

3 3

User-Name - Reg Expr - auth-type accept
by Michael Poser 17 Aug '05

17 Aug '05

Hello, an extraction from my users file --8<-- DEFAULT User-Name =~ "^([0-9a-fA-F]){6}-([0-9a-fA-F]{6})$" Auth-Type := Accept, Reply-Message = "Hallo Regulaerer Ausdruck `%{User-Name}`" --8<-- My suggestion is: Every Mac-Address has to authenticate. But in real life it doesn't work: --8<-- rad_recv: Access-Request packet from host 10.87.80.1:3072, id=181, length=95 User-Name = "00022d-65fd60" User-Password = "geheim" NAS-IP-Address = 10.87.80.1 NAS-Identifier = "Spielzimmer" NAS-Port-Type = Wireless-802.11 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00022d-65fd60", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 77 radius_xlat: 'Hallo Regulaerer Ausdruck `00022d-65fd60`' modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [00022d-65fd60] (from client lancom-ap port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 181 to 10.87.80.1:3072 Reply-Message = "Hallo Regulaerer Ausdruck `00022d-65fd60`" Waking up in 4 seconds... --8<-- The regular expression match with the Mac-Address, but 4 lines behind it, the log says: "auth: No authenticate method (Auth-Type) configuration found for the request:" I am confused, in the users file is the statement "Auth-Type := Accept,". What is wrong? Kind regards, M. Poser

2 2

Re: expiration
by Carl Peterson 17 Aug '05

17 Aug '05

I compiled the CVS version but got the same error: Module: Instantiated sqlcounter (noresetcounter) radiusd.conf[1383] Failed to link to module 'rlm_expiration': rlm_expiration.so: cannot open shared object file: No such file or directory It would seem that I got the same version from CVS. Is there a way to change this or am I doing something wrong? foxtrot raddb # /usr/local/sbin/radiusd -v radiusd: FreeRADIUS Version 1.0.4, for host , built on Aug 6 2005 at 16:55:22 Thanks, Carl Peterson > The fix is in CVS: > >$ cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout -r release_1_0 >radiusd > > Use the "Expiration" attribute. > > Alan DeKok.

2 4