June 2006 - Freeradius-Users - lists.freeradius.org

multiple Autz-Type
by wekz 10 Jun '06

10 Jun '06

Hello everybody. I'll tell you what i wanna do and the problem i get so you could either fix my configuration or give me some new ideas. First, I´m using freeradius 1.1.1 + ldap. What I have is this: I have three radius working in different placement of one organization, these radius authorize against three subtrees of the ldap. When a user is not found they do proxy to another radius. This work quite well. What I want: I want to have another radius ( only one ) to acct as a backup of these servers ( for configuring my ciscos with two servers ). This radius has the complete tree but it must look in each subtree depending on the NAS-IP, not in the whole ldap. If the user is not found in the corresponding subtree it must do proxy to the central radius. I don't know if I have explain it correctly, if I haven't just tell me ( I'm not an english speaker ) For this configuration I've defined three ldaps in radiusd.conf: module{ ldap ldap1{ } ldap ldap2{ } ldap ldap3{ } } ... authorize{ ... autztype customer1{ redundant { group { ldap1 { notfound = return fail = return } files mschap eap notfound = 1 fail = 1 } files } } Autz-Type customer2{ [ similar configuration as above ] } Autz-Type customer3{ [ similar configuration as above ] } } My hints file: DEFAULT NAS-IP-Address == "192.168.51.220" Autz-Type := customer1 DEFAULT NAS-IP-Address == "192.168.51.221" Autz-Type := customer2 DEFAULT NAS-IP-Address == "192.168.51.222" Autz-Type := customer3 Users: DEFAULT Proxy-to-realm := wickwar_central The problem is that it doesn't execute any of Autz-Type sections. The logs: rad_recv: Access-Request packet from host 192.168.51.221:1645, id=200, length=160 User-Name = "cadiz" Framed-MTU = 1400 Called-Station-Id = "0011.9215.c490" Calling-Station-Id = "0004.238d.4b0e" Cisco-AVPair = "ssid=perfil_tipo_a" Service-Type = Login-User Message-Authenticator = 0x27c966f01f1de90c836066e2a019c553 EAP-Message = 0x0202000a01636164697a NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "395" NAS-Port = 395 NAS-IP-Address = 192.168.51.221 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 hints: Matched DEFAULT at 59 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '/' in User-Name = "cadiz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 1 radius_xlat: '/opt/radius_LOCAL/var/log/radius/radacct/192.168.51.221/auth-detail-20060605' rlm_detail: /opt/radius_LOCAL/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/radius_LOCAL/var/log/radius/radacct/192.168.51.221/auth-detail-20060605 modcall[authorize]: module "auth_log" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [cadiz/<no User-Password attribute>] (from client ap port 395 cli 0004.238d.4b0e) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 200 to 192.168.51.221 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 200 with timestamp 44840b82 Nothing to do. Sleeping until we see a request. If anyone could give my a hand. I would be grateful. Thanks.

2 4

Re: Freeradius-Users Digest, Vol 14, Issue 45
by Gilbert Lo 10 Jun '06

10 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 44
by Gilbert Lo 09 Jun '06

09 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Multiple attributes for single user in radreply and mysql
by Majid El-Hoss 09 Jun '06

09 Jun '06

Hi, I am using freeradius behind a provisioning platform which inserts the users into a mysql database from which the radius server reads the info. I am assigning static (actual IP) and dynamic ip (255.255.255.254) addresses to the end-users by using the Framed-IP attribute in the radreply table. I also suspend/unsuspend users by using an "Auth-Type := Reject" entry, or by deleting it in an automated fashion and depending on whether the customer has paid or not his invoices. The problem that I am facing is that freeradius is not recognizing the Auth-Type entry in radreply in the presence of other attributes. Therefore, even if Auth-Type := Reject is in the radreply table, the system does not send back an Access-Reject packet, but rather an Access-Accept packet with the corresponding IP address. How can I address this so that when an Auth-Type := Reject parameter is in the database, it is automatically recognised and the user account is suspended? Thanks for your help Majid El-Hoss CONFIDENTIALITY NOTICE: This e-mail message including attachments, if any,is (are) for the intended recipient only (person or entity)and may contain confidential or proprietary information some or all of which may be legally privileged. Any unauthorised review, use, copy, print, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message and do not in any way rely on this e-mail. If you are the intended recipient but do not wish to receive communications through this medium, please so advise the sender immediately. -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.8.3/359 - Release Date: 6/8/2006

2 1

Re: Freeradius-Users Digest, Vol 14, Issue 43
by Gilbert Lo 09 Jun '06

09 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

Are possible multiple ntdomain realms??????
by wekz 09 Jun '06

09 Jun '06

And if they are, what efect has with_ntdomain_hack=yes. Does it affect to all?? Well, Hi you all I hope haven't been too direct ;) I'll getting more troubles as I do more complex configurations. I ask this because first I had to authenticate users by machine authentication. The users in this case sends User-Name like host/username and the only way I found for working this out was to use ntdomain realm with "/" as the delimiter and enable with_ntdomain_hack. The other options stripes the User-Name but then packets doesn't match EAP-Identity ( at least one of them ), that is why I used ntdomain, for being able to use with_ntdomain_hack. Now I've got pda-users that sends domain\username and if I don't use ntdomain & with_ntdomain_hack it fails. So, that's why I ask if multiple ntdomains are allowed and how. Any method or idea will be welcome. Thanks

2 2

need help from FR gurus.
by Abul Monsur Mannan 09 Jun '06

09 Jun '06

Dear FR lovers, Here is the packages I've got in RH Linux4 with freeradius-1.1.1. and mysql.I've a problem about the driver of mysql.Would you please give me some time to figure out where r the problems and what r the solutions ? [root@localhost ~]# rpm -qa|grep mysql mysqlclient10-3.23.58-4.RHEL4.1 mysql-4.1.7-4.RHEL4.1 mysql-devel-4.1.7-4.RHEL4.1 mysql-server-4.1.7-4.RHEL4.1 libdbi-dbd-mysql-0.6.5-10.RHEL4.1 mysql-bench-4.1.7-4.RHEL4.1 [root@localhost ~]# cd /usr/local/src/freeradius-1.1.1/src/modules/rlm_sql/drivers/rlm_sql_mysql [root@localhost rlm_sql_mysql]# ls config.cache config.h.in config.status configure.in Makefile.in config.h config.log configure Makefile sql_mysql.c [root@localhost lib]# cd /usr/local/src/freeradius-1.1.1/src/modules/rlm_sql [root@localhost rlm_sql]# ls conf.h configure Makefile rlm_sql.c rlm_sql.lo sql.lo config.log configure.in Makefile.in rlm_sql.h rlm_sql.o sql.o config.status drivers README rlm_sql.la sql.c stable [root@localhost rlm_sql]# cd /usr/local/src/freeradius-1.1.1/src/modules/lib [root@localhost lib]# ls notused-1.1.1.so rlm_eap_leap.so rlm_mschap.la notused.a rlm_eap_md5-1.1.1.so rlm_mschap.lai notused.la rlm_eap_md5.a rlm_mschap.so notused.lai rlm_eap_md5.la rlm_ns_mta_md5-1.1.1.so notused.so rlm_eap_md5.lai rlm_ns_mta_md5.a rlm_acct_unique-1.1.1.so rlm_eap_md5.so rlm_ns_mta_md5.la rlm_acct_unique.a rlm_eap_mschapv2-1.1.1.so rlm_ns_mta_md5.lai rlm_acct_unique.la rlm_eap_mschapv2.a rlm_ns_mta_md5.so rlm_acct_unique.lai rlm_eap_mschapv2.la rlm_otp-1.1.1.so rlm_acct_unique.so rlm_eap_mschapv2.lai rlm_otp.a rlm_always-1.1.1.so rlm_eap_mschapv2.so rlm_otp.la rlm_always.a rlm_eap_peap-1.1.1.so rlm_otp.lai rlm_always.la rlm_eap_peap.a rlm_otp.so rlm_always.lai rlm_eap_peap.la rlm_pam-1.1.1.so rlm_always.so rlm_eap_peap.lai rlm_pam.a rlm_attr_filter-1.1.1.so rlm_eap_peap.so rlm_pam.la rlm_attr_filter.a rlm_eap_sim-1.1.1.so rlm_pam.lai rlm_attr_filter.la rlm_eap_sim.a rlm_pam.so rlm_attr_filter.lai rlm_eap_sim.la rlm_pap-1.1.1.so rlm_attr_filter.so rlm_eap_sim.lai rlm_pap.a rlm_attr_rewrite-1.1.1.so rlm_eap_sim.so rlm_pap.la rlm_attr_rewrite.a rlm_eap.so rlm_pap.lai rlm_attr_rewrite.la rlm_eap_tls-1.1.1.so rlm_pap.so rlm_attr_rewrite.lai rlm_eap_tls.a rlm_passwd-1.1.1.so rlm_attr_rewrite.so rlm_eap_tls.la rlm_passwd.a rlm_chap-1.1.1.so rlm_eap_tls.lai rlm_passwd.la rlm_chap.a rlm_eap_tls.so rlm_passwd.lai rlm_chap.la rlm_eap_ttls-1.1.1.so rlm_passwd.so rlm_chap.lai rlm_eap_ttls.a rlm_perl-1.1.1.so rlm_chap.so rlm_eap_ttls.la rlm_perl.a rlm_checkval-1.1.1.so rlm_eap_ttls.lai rlm_perl.la rlm_checkval.a rlm_eap_ttls.so rlm_perl.lai rlm_checkval.la rlm_exec-1.1.1.so rlm_perl.so rlm_checkval.lai rlm_exec.a rlm_preprocess-1.1.1.so rlm_checkval.so rlm_exec.la rlm_preprocess.a rlm_counter-1.1.1.so rlm_exec.lai rlm_preprocess.la rlm_counter.a rlm_exec.so rlm_preprocess.lai rlm_counter.la rlm_expr-1.1.1.so rlm_preprocess.so rlm_counter.lai rlm_expr.a rlm_radutmp-1.1.1.so rlm_counter.so rlm_expr.la rlm_radutmp.a rlm_dbm-1.1.1.so rlm_expr.lai rlm_radutmp.la rlm_dbm.a rlm_expr.so rlm_radutmp.lai rlm_dbm_cat rlm_fastusers-1.1.1.so rlm_radutmp.so rlm_dbm.la rlm_fastusers.a rlm_realm-1.1.1.so rlm_dbm.lai rlm_fastusers.la rlm_realm.a rlm_dbm_parser rlm_fastusers.lai rlm_realm.la rlm_dbm.so rlm_fastusers.so rlm_realm.lai rlm_detail-1.1.1.so rlm_files-1.1.1.so rlm_realm.so rlm_detail.a rlm_files.a rlm_sql-1.1.1.so rlm_detail.la rlm_files.la rlm_sql.a rlm_detail.lai rlm_files.lai rlm_sqlcounter-1.1.1.so rlm_detail.so rlm_files.so rlm_sqlcounter.a rlm_digest-1.1.1.so rlm_ippool-1.1.1.so rlm_sqlcounter.la rlm_digest.a rlm_ippool.a rlm_sqlcounter.lai rlm_digest.la rlm_ippool.la rlm_sqlcounter.so rlm_digest.lai rlm_ippool.lai rlm_sql.la rlm_digest.so rlm_ippool.so rlm_sql.lai rlm_eap-1.1.1.so rlm_ippool_tool rlm_sql_log-1.1.1.so rlm_eap.a rlm_krb5-1.1.1.so rlm_sql_log.a rlm_eap_gtc-1.1.1.so rlm_krb5.a rlm_sql_log.la rlm_eap_gtc.a rlm_krb5.la rlm_sql_log.lai rlm_eap_gtc.la rlm_krb5.lai rlm_sql_log.so rlm_eap_gtc.lai rlm_krb5.so rlm_sql.so rlm_eap_gtc.so rlm_ldap-1.1.1.so rlm_unix-1.1.1.so rlm_eap.la rlm_ldap.a rlm_unix.a rlm_eap.lai rlm_ldap.la rlm_unix.la rlm_eap_leap-1.1.1.so rlm_ldap.lai rlm_unix.lai rlm_eap_leap.a rlm_ldap.so rlm_unix.so rlm_eap_leap.la rlm_mschap-1.1.1.so smbencrypt rlm_eap_leap.lai rlm_mschap.a [root@localhost lib]# cd /usr/local/src/freeradius-1.1.1/doc/examples [root@localhost examples]# ls iplanet.ldif Makefile mysql.sql oracle.sql iplanet.schema mssql.sql openldap.schema postgresql.sql After running the command in terminal window Radius-X I got the error message like below--- * * * rlm_sql (sql): "/usr/local/src/freeradius-1.1.1/src/modules/rlm_sql/drivers/rlm_sql_mysql" is NOT an SQL driver! radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1798] Unknown module "sql". radiusd.conf[1727] Failed to parse authorize section. Is there any GURU to help me out of this problem. Thank you.

3 2

NAS table fields
by Cliff Hayes 09 Jun '06

09 Jun '06

Hello, I looked through all the documentation I could find and surfed google but could not find details on what needs to go in the NAS fields. For example, in the clients.conf file, the only required fields are SECRET and SHORTNAME. In the NAS table, SHORTNAME is optional (can be NULL), and NASNAME cannot be NULL. So, do I copy what I had in the clients.conf SHORTNAME into the NAS table NASNAME? If so, what is SHORTNAME FOR? Also, what is COMMUNITY for? Which fields are used by FreeRadius and which ones are just for reference? Cliff

2 1

Re: Freeradius-Users Digest, Vol 14, Issue 42
by Gilbert Lo 09 Jun '06

09 Jun '06

I am on holiday between June 5 to June 9. I will return to my office on June 12. See you soon. Thanks, Gilbert Lo helpdesk at St. George's School

1 0

FW: Logging
by Cliff Hayes 09 Jun '06

09 Jun '06

I also tried starting radius with -y option (per readme http://www.freeradius.org/radiusd/doc/README) and still there is nothing written to the logs for a good login. -----Original Message----- From: freeradius-users-bounces+chayes=afo.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+chayes=afo.net@lists.freeradius.org]On Behalf Of Cliff Hayes Sent: Friday, June 09, 2006 11:02 AM To: FreeRadius users mailing list Subject: RE: Logging Kevin, Tried that. Unfortunately, it acts like starting radiusd with the -x option, which scrolls all output to the screen. I use Fedora 5 with radiusd configured as a service, so when I do "service radiusd start", it starts scrolling to the screen. There will not usually be a terminal window dedicated to this box. Also, attempting to stop the scrolling (CTL-C) also terminates the radiusd process. What I really need is for the data to go to the log file. log_auth_goodpass = yes does not appear to work for me for some reason. Cliff -----Original Message----- From: freeradius-users-bounces+chayes=afo.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+chayes=afo.net@lists.freeradius.org]On Behalf Of Kevin Bonner Sent: Friday, June 09, 2006 10:38 AM To: FreeRadius users mailing list Subject: Re: Logging On Friday 09 June 2006 10:57, Cliff Hayes wrote: > Chris, > > All of those 3 options you mentioned were already set. What else could be > wrong? > > Cliff Add this to radiusd.conf: debug_level = 2 (or 3) Debug level 2 gives you the same output as -xx, level 3 gives even more output (and timestamps!). Kevin Bonner - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0