June 2006 - Freeradius-Users - lists.freeradius.org

Problems with Redundant Proxy config with FreeRadius 1.0.1-2.FC3.1 (Fedora Core 3)
by Shaun Mccullagh 26 Jun '06

26 Jun '06

Hi, I would like FreeRadius to proxy requests to two radius servers. Normally requests should go to a primary(kiezel1i), but if this is unavailable it should send requests to a secondary(kiezel2i). I'm using the config at the bottom of this message. If I shut the primary down, FreeRadius never forwards the requests to the secondary. Have I made a mistake in my config? How does FreeRadius determine if the Primary is unavailable? TIA Shaun proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 180 default_fallback = no post_proxy_authorize = yes } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm erbi.nl { type = radius authost = LOCAL acchost = LOCAL } realm zzl-ra.nl { type = radius authhost = kiezel1i:1812 accthost = kiezel1i:1812 secret = xxx ldflag = fail_over } realm zzl-ra.nl { type = radius authhost = kiezel2i:1812 accthost = kiezel2i:1812 secret = xxx ldflag = fail_over } Op dit e-mailbericht is een disclaimer van toepassing, welke te vinden is op http://www.xb.nl/disclaimer.html

1 0

Re: So how do you suppress
by Walter Reynolds 26 Jun '06

26 Jun '06

So what 'rest of the documentation' should I look at. I guess I am not seeing how I should know that the "auth_log" is a variant of the "detail" module. I am hoping i can get a better understanding of the documentations so I would not have to ask questions in the future. So for this example I saw the following: 1. Note in changelog about suppress 2. Section under 'detail' in radiusd.conf file with supress option commented out. So I now understand that I should be able to suppress information from any of the detail sections by adding an additional suppress line under that module subsection. Is this something that I should have understood to start with or is there documentation that I did not see and should read? ===================== Date: Fri, 23 Jun 2006 11:11:21 -0400 From: "Alan DeKok" <aland(a)nitros9.org> Subject: Re: Freeradius-Users Digest, Vol 14, Issue 95 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20060623151121.6DF4216E49(a)mail.nitros9.org> Walter Reynolds <waltr(a)umich.edu> wrote: > Now the question is what example config file had the suppress stanza under > the detail auth_log section as well? Mine just listed it under the detail > section so I did not know I needed to put it in both places. The rest of the documentation explains how the modules are set up. The "auth_log" module is a variant of the "detail" module. Nothing is different except the name, and the options you put into it's configuration. Alan DeKok. ====================== > Date: Thu, 22 Jun 2006 20:15:54 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: So how do you suppress > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060622191554.GC23362(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > So how do I actually suppress the user password from the detail log based > > on this? Looking at the rlm_detail file and I might as well be looking at > > a foreign language. > > you can, for example, do somthing like this in radiusd.conf > > # Write a detailed log of all accounting records received. > # > detail { > # Note that we do NOT use NAS-IP-Address here, as > # that attribute MAY BE from the originating NAS, and > # blah blah blah > detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d > > detailperm = 0600 > suppress { > User-Password > } > > } > > > detail auth_log { > detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y% > m%d > > detailperm = 0600 > suppress { > User-Password > } > > } > > its SO much easier if you read the example config files that come with the > new release as they often contain HOW to use a feature/option/argument :-) > > alan > > -- Walter Reynolds University of Michigan

2 1

RE: mpd+freeradius+AD
by Егоров Сергей 26 Jun '06

26 Jun '06

Thanks for reply. >You can use one of the three firewalls avaliable in the base system(ipfw, >ipf and pf), however mpd comes with a small dictionary that uses ipfw(8) >and you can easily define some filter bound to an interface (bound to a >username) via a radius reply attribute, let filter be a pipe(for bandwidth >control) or a packet filtering expression. That's fine for filtering vpn users access to local net. But how could I assign specific IP for specific user in AD? > Your questions don't clearly tell where your problem is. >Active Directory? mpd? or FreeRADIUS? You should define >them better in order to get help from the list. My goal is to replace VPN server, based on win2003, with FreeBSD one. WIN 2003 can do 1 and 2 in my questions, so I have to realize how to setup this in mpd + freeradius. I already authenticate users from AD group: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=EXAMPLE+VPN_Allowed". But I have several vpn groups and need to setup timeouts on each one. Also I need to I assign specific IP for specific user in AD. Looks like FreeRadius should respond for this. -----Original Message----- From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] Sent: Monday, June 26, 2006 2:22 PM To: freeradius-users(a)lists.freeradius.org Cc: Егоров Сергей Subject: Re: mpd+freeradius+AD On Monday 26 June 2006 09:55, Егоров Сергей wrote: > Hi all! I have completed setup of mpd+freeradius+AD 2003. Now my users > authenticating from Active Directory, if they are members of specific > group. But I still have some questions: > > 1. How to make a different timeouts for different groups in AD > 2. How to appoint special IP for special users > 3. How to restrict users to access only to defined IP in my network You can use one of the three firewalls avaliable in the base system(ipfw, ipf and pf), however mpd comes with a small dictionary that uses ipfw(8) and you can easily define some filter bound to an interface (bound to a username) via a radius reply attribute, let filter be a pipe(for bandwidth control) or a packet filtering expression. So, if you want different rules for different usernames ipfw is the sensible packet filter to use. You can find the radius section of mpd, here: http://www.bretterklieber.com/mpd/doc4/mpd28.html Your questions don't clearly tell where your problem is. Active Directory? mpd? or FreeRADIUS? You should define them better in order to get help from the list. HTH a bit, Nikos

2 1

mpd+freeradius+AD
by Егоров Сергей 26 Jun '06

26 Jun '06

Hi all! I have completed setup of mpd+freeradius+AD 2003. Now my users authenticating from Active Directory, if they are members of specific group. But I still have some questions: 1. How to make a different timeouts for different groups in AD 2. How to appoint special IP for special users 3. How to restrict users to access only to defined IP in my network

2 1

LDAP(Active Directory) password AND groups not working together
by duckeo 26 Jun '06

26 Jun '06

I'm pretty sure the problem lies in my interpretation of the users file documentation, but I'm now stuck. The aim is to authenticate users to their MS active directory account via LDAP, and then check that the user is a member of the WirelessVPN group -- if these two conditions meet then the user is granted access. What's happening at the moment is as long as the user EXISTS the authentication will pass, even if the password is incorrect. If the useraccount does not exist it will fail. Output from debug during a CORRECT username but INCORRECT password (blablalba): rad_recv: Access-Request packet from host 10.200.148.49:3678, id=81, length=50 User-Name = "radiustest" User-Password = "blablabla" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for radiustest radius_xlat: '(&(sAMAccountname=radiustest)(objectClass=person))' radius_xlat: 'OU=Domain Users,DC=foo,DC=bar,DC=foo,DC=bar' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Domain Users,DC=foo,DC=bar,DC=foo,DC=bar, with filter (&(sAMAccountname=radiustest)(objectClass=person)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user radiustest authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "radiustest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'OU=Domain Users,DC=foo,DC=bar,DC=foo,DC=bar' radius_xlat: '(&(objectClass=group)(member=CN=Test\\, Radius,OU=testing,OU=Domain Users,DC=foo,DC=bar,DC=foo,DC=bar))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Domain Users,DC=foo,DC=bar,DC=foo,DC=bar, with filter (&(cn=RadiusWirelessVPN)(&(objectClass=group)(member=CN=Test\\, Radius,OU=testing,OU=Domain Users,DC=foo,DC=bar,DC=foo,DC=bar))) rlm_ldap::ldap_groupcmp: User found in group RadiusWirelessVPN rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 216 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns ok for request 4 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'You are now connected FooBar Network.' Sending Access-Accept of id 81 to 10.200.148.49:3678 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Reply-Message = "You are now connected to the FooBar Network" Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 81 with timestamp 449f618f Nothing to do. Sleeping until we see a request. Configuration: radiusd.conf --- ## LDAP lookup to Microsoft Active Directory (2003) ldap { server = "Foobar.com" identity = "ServiceAccount@Foobar" password = "xxxx" basedn = "OU=Domain Users,DC=foo,DC=bar,DC=foo,DC=bar" filter = "(&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person))" timeout = 40 timelimit = 30 net_timeout = 10 # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" groupmembership_attribute = "memberOf" } users --- DEFAULT Auth-Type := LDAP, Ldap-Group == "RadiusWirelessVPN", Auth-Type := Accept Service-Type = Framed, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Reply-Message = "You are now connected to FooBar", DEFAULT Auth-Type := Reject Reply-Message = "Access Rejected - Please check your username and password and try again."

2 3

EAP-MD5 with LDAP
by Rohaizam Abu Bakar 26 Jun '06

26 Jun '06

Hi.. Using FB 6.0 FR 1.0.5 trying to configure EAP-MD5 with LDAP backend... But it keep reporting: rlm_ldap: Attribute "User-Password" is required for authentication. No EAP been processed... please see full debug log below.. Below is my config with multiple DEFAULT entry... for Wireless services & normal Dialup authentication i) users ===== DEFAULT NAS-Identifier == "Wireless-802.11", Autz-Type := Y5, Auth-Type :=Y5 DEFAULT Autz-Type := LDAP, Auth-Type := LDAP ii) eap.conf ======== eap { default_eap_type = md5 } md5 { } } iii) radiusd.conf ============ $INCLUDE ${confdir}/eap.conf authorize { eap Autz-Type LDAP { ldap1 } Autz-Type Y5 { ldapy51 } } authenticate { Auth-Type LDAP { ldap1 } Auth-Type Y5 { ldapy51 } eap } ldap ldap1 { server = "localhost" identity = "cn=root,dc=jaring,dc=my" password = xxxxxx basedn = "ou=RADIUS,ou=People,dc=jaring,dc=my" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } ldap ldapy51 { server = "localhost" identity = "cn=root,dc=jaring,dc=my" password = xxxxxx basedn = "ou=Y5,ou=People,dc=jaring,dc=my" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } rad_recv: Access-Request packet from host 202.73.10.12:1814, id=133, length=197 Framed-MTU = 1466 NAS-IP-Address = 10.220.0.2 NAS-Identifier = "OCEPOP" User-Name = "jaroce" Service-Type = Framed-User NAS-Port = 129 NAS-Port-Type = Ethernet NAS-Port-Id = "ether9_129" Called-Station-Id = "00-11-95-e1-ce-8a" Calling-Station-Id = "00-13-46-86-c3-93" Connect-Info = "CONNECT Ethernet 2Mbps Full duplex" EAP-Message = 0x02020015016a61726f6365406d793031352e636f6d Message-Authenticator = 0x6d5b3fff40ff4c920b88d100ed80a209 Proxy-State = 0x3433 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '/' in User-Name = "jaroce", skipping NULL due to config. modcall[authorize]: module "IPASS" returns noop for request 1 rlm_realm: No '@' in User-Name = "jaroce", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "jaroce" rlm_realm: Proxying request from user jaroce to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 68 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 Processing the authorize section of radiusd.conf modcall: entering group Autz-Type for request 1 modcall: entering group redundant for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for jaroce radius_xlat: '(uid=jaroce)' radius_xlat: 'ou=RADIUS,ou=People,dc=jaring,dc=my' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=RADIUS,ou=People,dc=jaring,dc=my, with filter (uid=jaroce) rlm_ldap: checking if remote access for jaroce is allowed by dialupAccess rlm_ldap: Added password j4r1ng in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFramedCompression as Framed-Compression, value Van-Jacobson-TCP-IP & op=11 rlm_ldap: Adding radiusFramedMTU as Framed-MTU, value 1500 & op=11 rlm_ldap: Adding radiusFramedProtocol as Framed-Protocol, value PPP & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: user jaroce authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 1 modcall: group redundant returns ok for request 1 modcall: group Autz-Type returns ok for request 1 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap1" returns invalid for request 1 modcall: group redundant returns invalid for request 1 modcall: group Auth-Type returns invalid for request 1 auth: Failed to validate the user. Login incorrect: [jaroce] (from client OCE_JARING port 129 cli 00-13-46-86-c3-93)

4 6

help
by sarah oveisi 25 Jun '06

25 Jun '06

hello. I couldn't run radius server. I use the following command: service radiusd start Also I couldn't see the radius database in /var/lib/mysql it seems that freeradius did not install correctly on my computer. --------------------------------- Do you Yahoo!? Everyone is raving about the all-new Yahoo! Mail Beta.

2 1

RE: Checking SSID via A/D Group
by Garber, Neal 25 Jun '06

25 Jun '06

>> FreeBSD with OpenSSL 0.9.7d-p1 17 and Samba 3.0.20b. If the server is >> joined to an >> Active Directory domain, would it be possible to not just authenticate >> user/pwd through >> Samba, but also to check for Windows group membership based upon the >> SSID > Yes. For the purposes of group checking, AD is just an LDAP >directory. You should be able to edit the LDAP group membership >checks to do this. Thank you for your quick response Alan. I'm currently using 802.1x with eap-peap and mschapv2 to a Cisco ACS to authenticate WinXP 802.11 users. Would I use eap-peap/mschapv2 and LDAP within FR to do the authentication and will this also support changing AD passwords when they are expired? Also, I've done some google searches and I read the rlm_ldap doc. I found examples on how to do checking for a static LDAP group, but can't find any examples on how to check for a dynamic group name. Can you give me an example of checking AD group membership, using rlm_ldap, where the group varies based upon the NAS group and literal string + attribute value? For example: for NAS group "mobile", user must be a member of "Mobile Users" group; for NAS group "APs" and cisco-av-pair request attr. == "ssid=myssid", the user would need to be a member of "Wireless myssid Users" group in AD (if the attribute isn't present, then reject). If this is possible, can you give me an example of how this would be done? Thanks again for your assistance.

1 0

Re: Freeradius-Users Digest, Vol 14, Issue 99 (Vacation)
by Michael Castillo 24 Jun '06

24 Jun '06

I will be out of the office from June 26 through July 7th, returning July 10th. If you have a network issue please contact Steve Fouchek at 463-2216. Thank you and have a pleasant day. Michael

1 0

sqlcounter, always does the lookup or conditional
by Dennis Skinner 23 Jun '06

23 Jun '06

I was hoping someone could save me a few cycles on a hectic Friday since my test system is down at the moment and the info in radiusd.conf doesn't mention it. With the sqlcounter module, will it always do the sql lookup on an incoming auth request or only if the check-name attribute is among the check items? The latter would really save some overhead if only a few customers were time limited. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

1 0