December 2006 - Freeradius-Users - lists.freeradius.org

problem with ldap search filter with '/'s (front slashes)
by Mark T. Valites 12 Dec '06

12 Dec '06

I'm trying to set up authentication to a SunOne Directory that requires not only a successful bind with by radius on behalf of the user attempting to authticate to it, but also a specified LDAP search filter to return a result as well. I can't seem to get the freeradius ldap module to return any result when the value of the attribute I'm comparing against contains a '/', as often found in the 'homeDirectory' and 'loginShell' LDAP attributes. >From the command line, the search and filter returns correctly: $ ldapsearch -v -H ldaps://ldapserver.domain.com \ -b ou=people,dc=domain,dc=com -x -D \ "uid=myuid,ou=people,dc=domain,dc=com" -W \ '(&(uid=myuid)(loginShell=/bin/tcsh))' The corresponding SunOne log: [12/Dec/2006:11:10:24 -0500] conn=4896 op=-1 msgId=-1 - fd=45 slot=45 LDAPS connection from www.xxx.yyy.zzz to xxx.yyy.zzz.www [12/Dec/2006:11:10:24 -0500] conn=4896 op=0 msgId=1 - BIND dn="uid=myuid,ou=people,dc=domain,dc=com" method=128 version=3 [12/Dec/2006:11:10:24 -0500] conn=4896 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=myuid,ou=people,dc=domain,dc=com" [12/Dec/2006:11:10:24 -0500] conn=4896 op=1 msgId=2 - SRCH base="ou=people,dc=domain,dc=com" scope=2 filter="(&(uid=myuid)(loginShell=/bin/tcsh))" attrs=ALL[12/Dec/2006:11:10:24 -0500] conn=4896 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0 [12/Dec/2006:11:10:24 -0500] conn=4896 op=2 msgId=3 - UNBIND [12/Dec/2006:11:10:24 -0500] conn=4896 op=2 msgId=-1 - closing - U1 [12/Dec/2006:11:10:25 -0500] conn=4896 op=-1 msgId=-1 - closed. A snippet from my radiusd.conf: server = "ldapserver.domain.com" basedn = "ou=people,dc=domain,dc=com" filter = "(&(uid=%u)(loginshell=/bin/tcsh))" The output from running radiusd in debug mode: rlm_ldap: - authorize rlm_ldap: performing user authorization for myuid radius_xlat: '(&(uid=myuid)(loginShell=/bin/tcsh))' radius_xlat: 'ou=people,dc=domain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldapserver.domain.com:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS Require Cert to never rlm_ldap: bind as / to ldapserver.domain.com:636 TLS certificate verification: Error, Unknown error rlm_ldap: waiting for bind result ... request 1 done rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=domain,dc=com, with filter (&(uid=myuid)(loginShell=/bin/tcsh)) request 2 done rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "ldap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "myuid" with password "mypasswd" radius_xlat: '(&(uid=myuid)(loginShell=/bin/tcsh))' radius_xlat: 'ou=people,dc=domain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=domain,dc=com, with filter (&(uid=myuid)(loginShell=/bin/tcsh)) request 3 done rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. The corresponding SunOne log: [12/Dec/2006:11:12:33 -0500] conn=4897 op=-1 msgId=-1 - fd=45 slot=45 LDAPS connection from www.xxx.yyy.zzz to xxx.yyy.zzz.www [12/Dec/2006:11:12:33 -0500] conn=4897 op=0 msgId=1 - BIND dn="" method=128 version=3 [12/Dec/2006:11:12:33 -0500] conn=4897 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="" [12/Dec/2006:11:12:33 -0500] conn=4897 op=1 msgId=2 - SRCH base="ou=people,dc=domina,dc=com" scope=2 filter="(&(uid=myuid)(loginShell=/bin/tcsh))" attrs="radiusnasipaddress radiusexpiration acctflags ntpassword lmpassword radiuscallingstationid radiuscalledstationid radiussimultaneoususe radiusauthtype radiuscheckitem radiusreplymessage radiusloginlatport radiusportlimit radiusframedappletalkzone radiusframedappletalknetwork radiusframedappletalklink radiusloginlatgroup radiusloginlatnode radiusloginlatservice radiusterminationaction radiusidletimeout radiussessiontimeout radiusclass radiusframedipxnetwork radiuscallbackid radiuscallbacknumber radiuslogintcpport radiusloginservice radiusloginiphost radiusframedcompression radiusframedmtu radiusfilterid radiusframedrouting radiusframedroute radiusframedipnetmask radiusframedipaddress radiusframedprotocol radiusservicetype radiusreplyitem" [12/Dec/2006:11:12:33 -0500] conn=4897 op=1 msgId=2 - RESULT err=0 tag=101 nentries=0 etime=0 [12/Dec/2006:11:12:33 -0500] conn=4897 op=2 msgId=3 - SRCH base="ou=people,dc=domain,dc=com" scope=2 filter="(&(uid=myuid)(loginShell=/bin/tcsh))" attrs="uid" [12/Dec/2006:11:12:33 -0500] conn=4897 op=2 msgId=3 - RESULT err=0 tag=101 nentries=0 etime=0 The filter works correctly for attributes that don't contain a '/'. I don't see anything in RFC 2254 regarding '/'s needing escaping - am I missing something? -Mark -- Mark T. Valites Senior Systems Administrator University at Buffalo

2 2

upgrade from .9 to latest
by Andrew Long 12 Dec '06

12 Dec '06

Would like to upgrade from .9 to latest build; what is recommended upgrade procedure? I have successfully built a new server (on another box) but can find no docs outlining upgrade procedure, especially such a large step. Is it possible to upgrade, or do I build a build another server on the same box? -- Regards, Andrew Long Network Support Specialist EscapeWire Solutions, LLC 617 Dingens Street Buffalo, NY 14206 Office: (716) 893-4984 Mobile: (716) 830-5169 Fax: (716) 891-4288 Web: http://www.escapewire.com E-mail: along(a)escapewire.com

2 3

Re: Counter
by Sean 12 Dec '06

12 Dec '06

Hi Alan, Thanks for all the help last night. I've made a lot of progress today. Max-Daily-Session is now being recognised as a valid attribute and users with the attribute are being authenticated. The problem I now have is that the users are being disconnected after their allocated time has expired but they can log back in again straight away instead of having to wait 24 hours. I have this in the users file DEFAULT Max-Daily-Session := 300 This in radiusd.conf $INCLUDE ${confdir}/sql.conf sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } instantiate { exec expr noresetcounter daily } Could you please give me some pointers to where I'm going wrong. I've scoured the list archives and Google looking for answers. Regards, Sean

2 1

rlm_perl - Debian sarge
by Graeme Hinchliffe 12 Dec '06

12 Dec '06

Hi, I have written a module for use with freeRADIUS which seems to work fine and dandy on my desktop Fedora box. However when I drop this module and config on one of the production (and now test) Debian Sarge boxes running the same initial config with same version of freeRADIUS I get : /usr/sbin/freeradius: relocation error: /usr/lib/perl5/auto/DBI/ DBI.so: undefined symbol: Perl_Gthr_key_ptr and freeRADIUS obvioulsy refuses to start. I have googled this and it seems to be a fairly common error with perl, alas I cannot see anything to help resolve this, so I am asking here in the hope that someone else may have thwarted this pain. I have checked and perl supports multi and threaded .. libperl-dev did not sort it .. any other suggestions ? please ? :) (that don't involve installing Fedora on there.. tho that is getting more and more tempting) Graeme

1 0

Logging into MySQL doesnt work, how enable MAC address control on MySQL
by Andrej Simko 12 Dec '06

12 Dec '06

Hello everybody I have a problem in setting up my freeradius to log all querries into database. The radacct is still empty. I read some messages from this mailing group and I found that the NAS server is not sending anything about Start time or Stop time. My naslist looks like: # NAS Name Short Name Type #---------------- ---------- ---- localhost local other and in clients.conf I have nastype = other So maybe I donnot know how to setup NAS on my server or maybe I donnot understand what does the NAS means. I am sure that we do not have any cisco or something like that so I want to authenticate only on the machine where freeradius is running. And second question. Does anybody know how to setup MAC address control from MySQL database. My idea is that when user wants to login it will need his username, password and MAC address to authenticate succesfully. Thank you for any ideas! AnDY

3 4

Problem with unprintable characters in the password
by Rafał Kamiński 12 Dec '06

12 Dec '06

Hello, I don't touch my Radius server since 2 weeks, and know when I try do some radtest, it show me Acces-Reject and in log: Mon Dec 11 14:51:47 2006 : Debug: Processing the authorize section of radiusd.conf Mon Dec 11 14:51:47 2006 : Debug: modcall: entering group authorize for request 2 Mon Dec 11 14:51:47 2006 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: - authorize Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: performing user authorization for rka Mon Dec 11 14:51:47 2006 : Debug: radius_xlat: '(uid=rka)' Mon Dec 11 14:51:47 2006 : Debug: radius_xlat: 'ou=users,dc=firm' Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: performing search in ou=users,dc=firm, with filter (uid=rka) Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: looking for check items in directory... Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: looking for reply items in directory... Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: Setting Auth-Type = ldap Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: user rka authorized to use remote access Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Dec 11 14:51:47 2006 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall[authorize]: module "ldap" returns ok for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall: leaving group authorize (returns ok) for request 2 Mon Dec 11 14:51:47 2006 : Debug: rad_check_password: Found Auth- Type ldap Mon Dec 11 14:51:47 2006 : Debug: auth: type "LDAP" Mon Dec 11 14:51:47 2006 : Debug: Processing the authenticate section of radiusd.conf Mon Dec 11 14:51:47 2006 : Debug: modcall: entering group LDAP for request 2 Mon Dec 11 14:51:47 2006 : Debug: modsingle[authenticate]: calling ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: - authenticate Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: login attempt by "rka" with password "?Pđ ,??č?ń/9?Â??" Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: user DN: uid=rka,ou=Users,dc=firm Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: (re)connect to ldap:636, authentication 1 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS mode to 1 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS CACert File to /etc/freeradius/cert/ca.pem Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS Cert File to / etc/freeradius/cert/radius.crt Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: setting TLS Key File to / etc/freeradius/cert/radius.key Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: bind as uid=rka,ou=Users,dc=firm/?Pđ ,??č?ń/9?Â?? to ldap:636 Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: waiting for bind result ... Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: Bind failed with invalid credentials Mon Dec 11 14:51:47 2006 : Debug: rlm_ldap: Mon Dec 11 14:51:47 2006 : Debug: modsingle[authenticate]: returned from ldap (rlm_ldap) for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall[authenticate]: module "ldap" returns reject for request 2 Mon Dec 11 14:51:47 2006 : Debug: modcall: leaving group LDAP (returns reject) for request 2 Mon Dec 11 14:51:47 2006 : Debug: auth: Failed to validate the user. Mon Dec 11 14:51:47 2006 : Debug: WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Mon Dec 11 14:51:47 2006 : Debug: Delaying request 2 for 1 seconds Mon Dec 11 14:51:47 2006 : Debug: Finished request 2 Mon Dec 11 14:51:47 2006 : Debug: Going to the next request Mon Dec 11 14:51:47 2006 : Debug: --- Walking the entire request list --- Mon Dec 11 14:51:47 2006 : Debug: Waking up in 1 seconds... Mon Dec 11 14:51:48 2006 : Debug: --- Walking the entire request list --- Mon Dec 11 14:51:48 2006 : Debug: Waking up in 1 seconds... Mon Dec 11 14:51:49 2006 : Debug: --- Walking the entire request list --- Last when i run that servers all was oki :( And know :( not :( Why ? I'm sure that my secret is good. Can you help me? BR Kamyk

2 1

Temporary Accounts
by Thibault Le Meur 12 Dec '06

12 Dec '06

Hi, I'm using FR 1.1.3. I'd like to use the 'files' or 'mysql' backends to store temporary radius accounts used for guest accesses. I'd like to be able to enforce: * a Day-Of-Week and Time-Of-Day policy ===> using the Login-Time attribute seems appropriate * an 'account available Not-Before / Not-After' policy ===> What is the recommended setup for this last part of the policy ? - Using the 'Expiration' attribute for the 'Not-After' part is ok, but what about the Not-Before part ? - Do I have to use the Current-Login attribute to check the Not-Before part ? If yes what is the format of this attribute ? Any pointer to a faq or a sample setup file would be appreciated ;-) Regards, Thibault

2 8

Which Variable name for sql result
by Stavros Patiniotis 11 Dec '06

11 Dec '06

Hi When radgroupcheck does its query, what variable name does it store its results in? The default sql (ie authorize_group_check_query) should be returning the GroupName, but I cannot seem to access it. Also, in doc/rlm_sql point 3c refers to the 'read_groups' directive. I'm assuing a couple of things here. (a) That this is set in sql.conf (b) By default its set to yes. Thanks. Cheers, Stavros Patiniotis EscapeNet ~ 08 8292 5200

1 0

Re: Counter
by Sean 11 Dec '06

11 Dec '06

> Read /etc/raddb/dictionary Alan, that directory doesn't exist on either of my systems. One system is running 1.0.4 and the other is running 1.1.3. I've tried searching the dictionaries for Max-All-Session, because that attribute works as does Expiration. The dictionaries that I'm searching are in /local/share/freeradius. Thanks for giving me your time with this. Do you think that there is a basic flaw in my setup? Should I delete everything and start from scratch? Are Max-Daily-Session and Max-Monthly-Session valid attributes that I can use in the same way that I use Expiration and Max-All-Session? I doubt that it is a FreeRadius problem, and more likely that I'm mistaken in how I think it works. Regards, Sean

2 1

Re: SQL Counter (Enrique Acosta)
by Sean 11 Dec '06

11 Dec '06

> 1. Fwd: SQL Counter (Enrique Acosta) Thanks Enrique. I upgraded to 1.1.3 but the error is still there. Alan gave me a hint that the attribute is not in the dictionary, so I've spent all evening searching the dictionary files looking for SQL attributes with no luck. My searches of the list archives suggest that Max-Daily-Session and Max-Monthly-Session are valid attributes. I think that the code I added to radiusd.conf is okay. I've listed it below. $INCLUDE ${confdir}/sql.conf sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } So where am I going wrong? If it was a problem in my SQL queries I wouldn't expect the following reply that comes from radius. rlm_sql (sql): Reserving sql socket id: 0 rlm_sql: Failed to create the pair: Unknown attribute "Max-Daily-Session" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns fail for request 39 modcall: group authorize returns fail for request 39 Did you ever get it to work? The guy I'm doing this for is putting me under a lot of pressure to get it finished. Regards, Sean Bracken

2 1