January 2006 - Freeradius-Users - lists.freeradius.org

EAP-TLS and user configuration
by dark0s dark0s 05 Jan '06

05 Jan '06

Hi, I must ti configure an authentication server with freeradius 1.0.5. The authentication method must be EAP-TLS. I have configured the files: eap.conf, radiusd.conf, clients.conf I would to known: 1) If I must configure /etc/raddb/users 2) How to configure /etc/raddb/users 3) Authentication operation will be showed in the any files in the system Thanks ___________________________________ Yahoo! Mail: gratis 1GB per i messaggi e allegati da 10MB http://mail.yahoo.it

1 0

authorization depending on authentication (ldap)
by tschaos＠gmx.net 05 Jan '06

05 Jan '06

Hi guys, First sorry for my bad english i am from austria ;-) i am running freeradius-1.0.2-5.5 i have a big problem here and cant solve it alone: there are 3 ldap instances: ldap1,ldap2,ldap3. and authenticate them all after another in the authentication section like this: authenticate { ldap1 ldap2 ldap3 } same in authorize-section: authorize { ldap1 ldap2 ldap3 } now my problem is, that if the user x is authenticated at ldap2 for instance the authorization fails cause the user isnt found at ldap1 (freeradius doesnt seem to try authorizing on ldap2 or ldap3) what i need would be a solution how to realize the following needs: if authentication runs over ldap1 authorize on ldap1 if authentication runs over ldap1 authorize on ldap2 if authentication runs over ldap1 authorize on ldap3 how can i do that? hope you guys can help me, i am searching for a solution for 3 days now and i havent got any ideo how to solve that :-( thanks and greetings from snowy austria! -- DSL-Aktion wegen gro�er Nachfrage bis 28.2.2006 verl�ngert: GMX DSL-Flatrate 1 Jahr kostenlos* http://www.gmx.net/de/go/dsl

3 6

RE: Fw: In which point does the FR sever send the Access-Accept orAccess-Reject packet?
by Marta Lajas 05 Jan '06

05 Jan '06

Thank you very much Bjørn. So it is after the post-auth section when the FreeRadius server decides to send an Access-Accept or an Access-Reject packet (in response of a previous Access-Request packet) depending on the result (success or not, OK or REJECT) of the authenticate method. Am I right? Best regards, Marta ----- Original Message ----- From: "Bjørn Mork" To: "FreeRadius users mailing list" Sent: Thursday, January 05, 2006 12:42 PM Subject: Re: In which point does the FR sever send the Access-Accept orAccess-Reject packet? > Marta Lajas writes: > > > I have a doubt about when FreeRadius server decides to send an > > Access-Accept or an Access-Reject packet. > > > When the authenticate module returns with a RLM_MODULE_REJECT, > > does the FR server send an Access-Reject packet? or does it occur > > later? > > > When the authenticate module returns with a RLM_MODULE_OK, does > > the FR server send the Access-Accept packet? or does it occur > > later? > > You can find the answers in src/main/modcall.c. The default > authenticate actions are: > > { > MOD_ACTION_RETURN, /* reject */ > 1, /* fail */ > MOD_ACTION_RETURN, /* ok */ > MOD_ACTION_RETURN, /* handled */ > 1, /* invalid */ > MOD_ACTION_RETURN, /* userlock */ > MOD_ACTION_RETURN, /* notfound */ > 1, /* noop */ > 1 /* updated */ > }, > > > Which means that both RLM_MODULE_REJECT and RLM_MODULE_OK will cause > an immediate return action without calling any further modules in the > authenticate section. > > Note that these actions may be modified by "redundant" or "append" > module grouping, or even configured on code by code basis. See > doc/configurable_failover > > The modules in postauth will of course still be called before sending > Access-Reject or Access-Accept. > > > Bjørn > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

1 0

Re: Installation problem Radiusd does not exist
by Kai Geek 05 Jan '06

05 Jan '06

Hello, #tar zxvf freeradius-1.0.5.tar.gz #cd freeradius-1.0.5 #./configure --localstatedir=/var --sysconfdir=/etc #make #make install for command debian; ozgur:~# apt-cache search freeradius freeradius - a high-performance and highly configurable server #apt-get install freeradius and #cd /etc/raddb #pico users #pico clients.conf for edit users and clients file, #radiusd -X ----- Original Message ----- From: "Nicolas Baradakis" <nbk(a)sitadelle.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: Installation problem Radiusd does not exist Date: Thu, 5 Jan 2006 12:47:08 +0100 > > Nicola Iotti wrote: > > > I'm installing freeradius 1.0.5 on a Debian Linux system > > I've downloaded tarball, extracted it with #tar zxvf freeradius-1.0.5.tar.gz > > I did : > > > > ./configure > > make > > make install > > You should just get the Debian binary package with "apt-get". > > If you really want to recompile FreeRADIUS from source, see the advices > on the wiki: > http://wiki.freeradius.org/index.php/FreeRADIUS_Wiki:FAQ#How_do_I_build_a_D… > > And please turn off HTML in your email client when posting to this > mailing list: http://freeradius.org/list/users.html > > -- > Nicolas Baradakis > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

Installation problem Radiusd does not exist
by Nicola Iotti 05 Jan '06

05 Jan '06

I'm installing freeradius 1.0.5 on a Debian Linux system I've downloaded tarball, extracted it with #tar zxvf freeradius-1.0.5.tar.gz I did : ./configure make make install But installation stops with following message: install: radiusd does not exist make[4]: ***[install] Error 2 Does anyone know what happened ?? Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

3 2

RE: wireless - freeradius - MS ldap
by Alhagie Puye 04 Jan '06

04 Jan '06

Can you send the results of your success login using ldapsearch? Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: > >freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius. > >org > >[mailto:freeradius-users-bounces+apuye=datawave.com@lists.fre > >eradius.org] On Behalf Of Dickson, John > >Sent: January 4, 2006 2:20 PM > >To: FreeRadius users mailing list > >Subject: RE: wireless - freeradius - MS ldap > > > >Sorry, it was a failed attempt at not sending the REAL data. > >I have verified that the ldapsearch credentials are the > >credentials used in the radiusd.conf. The user has been verified. > > > >I did have to add the details after the @ sign (using ldap search). > >Applying the same details in the radiusd.conf file and I > >still do not pass auth to the Windowz ldap. My thoughts are > >that it has something to do with "realm" section. > > > >John > > > >Using the credentials under the ldap settings for the > >radiusd.conf and cli with ldapsearch, ldapsearch produces results > > > >-----Original Message----- > >From: > >freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org > >[mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.f > >reeradius.o > >rg] On Behalf Of Alan DeKok > >Sent: Wednesday, January 04, 2006 3:36 PM > >To: FreeRadius users mailing list > >Subject: Re: wireless - freeradius - MS ldap > > > >"Dickson, John" <JDickson2(a)mccneb.edu> wrote: > >> Here is my ldap section: > >> > >> ldap { > >> server = "10.1.1.29" > >> identity = dmadmin1 > >> password = rDkf@my > > ... > > > >> This seeems to work: > >> > >> [john@magellan ~]$ ldapsearch -LLL -h > >name.serverdm.domain.edu -x -b > >> 'ou=Users,dc=name,dc=serverdm,dc=domain,dc=edu' -D > >> any-user(a)serverdm.domain.edu -w Passw0rd > > > > Hmm... did you use the same user/password information as > >the ldap config to do the ldapsearch? > > > > Nope. > > > > Are you surprised that the results are different from what > >FreeRADIUS sees? If so, why? > > > > Alan DeKok. > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

RE: wireless - freeradius - MS ldap
by Dickson, John 04 Jan '06

04 Jan '06

Sorry, it was a failed attempt at not sending the REAL data. I have verified that the ldapsearch credentials are the credentials used in the radiusd.conf. The user has been verified. I did have to add the details after the @ sign (using ldap search). Applying the same details in the radiusd.conf file and I still do not pass auth to the Windowz ldap. My thoughts are that it has something to do with "realm" section. John Using the credentials under the ldap settings for the radiusd.conf and cli with ldapsearch, ldapsearch produces results -----Original Message----- From: freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.freeradius.o rg] On Behalf Of Alan DeKok Sent: Wednesday, January 04, 2006 3:36 PM To: FreeRadius users mailing list Subject: Re: wireless - freeradius - MS ldap "Dickson, John" <JDickson2(a)mccneb.edu> wrote: > Here is my ldap section: > > ldap { > server = "10.1.1.29" > identity = dmadmin1 > password = rDkf@my ... > This seeems to work: > > [john@magellan ~]$ ldapsearch -LLL -h name.serverdm.domain.edu -x -b > 'ou=Users,dc=name,dc=serverdm,dc=domain,dc=edu' -D > any-user(a)serverdm.domain.edu -w Passw0rd Hmm... did you use the same user/password information as the ldap config to do the ldapsearch? Nope. Are you surprised that the results are different from what FreeRADIUS sees? If so, why? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: wireless - freeradius - MS ldap
by Dickson, John 04 Jan '06

04 Jan '06

Here is my ldap section: ldap { server = "10.1.1.29" identity = dmadmin1 password = rDkf@my basedn = "dc=ssotest,dc=mccsso,dc=mccneb,dc=edu" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: # password_attribute = nspmPassword # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # # edir_account_policy_check=no # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } Verify first that you can infact query Active Directory with this username/password combination. There is a utility called ldapsearch. I believe it comes with OpenLDAP. Use that to directly query AD for verification. Here is an example: ldapsearch -LLL -h name.serverdm.domain.edu -x -b 'dc=domain,dc=com''(samaccountname=powerful)' -D powerful -w userspass This seeems to work: [john@magellan ~]$ ldapsearch -LLL -h name.serverdm.domain.edu -x -b 'ou=Users,dc=name,dc=serverdm,dc=domain,dc=edu' -D any-user(a)serverdm.domain.edu -w Passw0rd No such object (32) Matched DN: DC=serverdm,DC=domain,DC=edu Additional information: 0000208D: NameErr: DSID-031001CD, problem 2001 (NO_OBJECT), data 0, best match of: 'DC=serverdm,DC=domain,DC=edu' What does your "ldap" section in radiusd.conf look like? Can you please provide copy? This will make sure that the credentials are correct or not.

2 1

huntgroups
by joao reis - cyberweb 04 Jan '06

04 Jan '06

Hi, I have a dial-up authentication and a ADSL authentication in my freeradius. the configuration is something like that: /etc/raddb/clients.conf # for the dial-up authentication: client xxx.xxx.xx.x { secret = secret shortname = server0.example.com nastype = other } client xxx.xxx.xx.x { secret = secret shortname = server1.example.com nastype = other } # for the adsl authentication: client yyy.yyy.yy.y { secret = secret shortname = server00.example.com nastype = other } client yyy.yyy.yy.y { secret = secret shortname = server01.example.com nastype = other } client yyy.yyy.yy.y { secret = secret shortname = server02.example.com nastype = other } client yyy.yyy.yy.y { secret = secret shortname = server03.example.com nastype = other } I also have 2 groups, the dialup group and the adsl group. I would like to make adsl user to connect in both services and dial-up groups to connect only in dialup. I've tryed somethings in /etc/raddb/huntgroups: dialup NAS-IP-Address == xxx.xxx.xx.x Group = dialup adsl NAS-IP-Address == xxx.xxx.xx.x Group = adsl adsl NAS-IP-Address == yyy.yyy.yy.y Group = adsl but it seems not to work. Any ideia? TIA, Joao Reis.

3 3

RE: wireless - freeradius - MS ldap
by Alhagie Puye 04 Jan '06

04 Jan '06

> >-----Original Message----- > >From: > >freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius. > >org > >[mailto:freeradius-users-bounces+apuye=datawave.com@lists.fre > >eradius.org] On Behalf Of Dickson, John > >Sent: January 4, 2006 11:32 AM > >To: FreeRadius users mailing list > >Subject: RE: wireless - freeradius - MS ldap > > > > Here is my ldap section: > > > >ldap { > > server = "10.1.1.29" > > identity = dmadmin1 > > password = rDkf@my > > basedn = "dc=ssotest,dc=mccsso,dc=mccneb,dc=edu" > > filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > > # base_filter = "(objectclass=radiusprofile)" > > > > # set this to 'yes' to use TLS encrypted connections > > # to the LDAP database by using the StartTLS extended > > # operation. > > # The StartTLS operation is supposed to be used with > >normal > > # ldap connections instead of using ldaps (port 689) > >connections > > start_tls = no > > > > # tls_cacertfile = /path/to/cacert.pem > > # tls_cacertdir = /path/to/ca/dir/ > > # tls_certfile = /path/to/radius.crt > > # tls_keyfile = /path/to/radius.key > > # tls_randfile = /path/to/rnd > > # tls_require_cert = "demand" > > > > # default_profile = "cn=radprofile,ou=dialup,o=My > >Org,c=UA" > > # profile_attribute = "radiusProfileDn" > > access_attr = "dialupAccess" > > > > # Mapping of RADIUS dictionary attributes to LDAP > > # directory attributes. > > dictionary_mapping = ${raddbdir}/ldap.attrmap > > > > ldap_connections_number = 5 > > > > # > > # NOTICE: The password_header directive is NOT case > >insensitive > > # > > # password_header = "{clear}" > > # > > # Set: > > # password_attribute = nspmPassword > > # > > # to get the user's password from a Novell eDirectory > > # backend. This will work *only if* freeRADIUS is > > # configured to build with --with-edir option. > > # > > # > > # The server can usually figure this out on its own, > >and pull > > # the correct User-Password or NT-Password from the > >database. > > # > > # Note that NT-Passwords MUST be stored as a 32-digit > >hex > > # string, and MUST start off with "0x", such as: > > # > > # 0x000102030405060708090a0b0c0d0e0f > > # > > # Without the leading "0x", NT-Passwords will not work. > > # This goes for NT-Passwords stored in SQL, too. > > # > > # password_attribute = userPassword > > # > > # Un-comment the following to disable Novell eDirectory > >account > > # policy check and intruder detection. This will work > >*only if* > > # FreeRADIUS is configured to build with --with-edir > >option. > > # > > # edir_account_policy_check=no > > # > > # groupname_attribute = cn > > # groupmembership_filter = > >"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(obj > >ectClass=Gr > >oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > > # groupmembership_attribute = radiusGroupName > > timeout = 4 > > timelimit = 3 > > net_timeout = 1 > > # compare_check_items = yes > > # do_xlat = yes > > # access_attr_used_for_allow = yes > > } > > > > > >Verify first that you can infact query Active Directory with this > >username/password combination. > > > >There is a utility called ldapsearch. I believe it comes > >with OpenLDAP. > >Use that to directly query AD for verification. > > > >Here is an example: > > > >ldapsearch -LLL -h name.serverdm.domain.edu -x -b > >'dc=domain,dc=com''(samaccountname=powerful)' -D powerful > >-w userspass > > > >This seeems to work: > > > >[john@magellan ~]$ ldapsearch -LLL -h name.serverdm.domain.edu -x -b > >'ou=Users,dc=name,dc=serverdm,dc=domain,dc=edu' -D > >any-user(a)serverdm.domain.edu -w Passw0rd > >No such object (32) > >Matched DN: DC=serverdm,DC=domain,DC=edu > >Additional information: 0000208D: NameErr: DSID-031001CD, > >problem 2001 > >(NO_OBJECT), data 0, best match of: > > 'DC=serverdm,DC=domain,DC=edu' Nope. That didn't work..... Please read up on ldapsearch "man ldapsearch". Until you can CAN verify that the username/password is correct, it won't do you any good messing with FreeRADIUS > > > > > >What does your "ldap" section in radiusd.conf look like? Can > >you please > >provide copy? > > > > > >This will make sure that the credentials are correct or not. > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0