March 2007 - Freeradius-Users - lists.freeradius.org

freeradius, ldap error - HELP ME!
by peppeska 23 Mar '07

23 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Please freeradius User... HELP ME! So, I use a pppoe-freeradius-ldap system for access and autenticate user.. but some go wrong.. and when I try to connect me appare this error... what's wrong in my configuration? look this! this is the freeradius output Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1027, id=159, length=54 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "peppeska" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "peppeska", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for peppeska radius_xlat: '(cn=peppeska)' radius_xlat: 'dc=example' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=admin,dc=example/root to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=example, with filter (cn=peppeska) rlm_ldap: no dialupAccess attribute - access denied by default rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns userlock for request 0 modcall: leaving group authorize (returns userlock) for request 0 Invalid user (rlm_ldap: Access Attribute denies access): [peppeska/<no User-Password attribute>] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request - --- Walking the entire request list --- Waking up in 1 seconds... - --- Walking the entire request list --- Sending Access-Reject of id 159 to 127.0.0.1 port 1027 Waking up in 3 seconds... - --- Walking the entire request list --- Cleaning up request 0 ID 159 with timestamp 45ffa841 Nothing to do. Sleeping until we see a request. But the Ldap database work good! the User peppeska have the password and the direct access to ldap database work! what I must do? - -- <<<<---------------------------------------------------------->>>> |Giuseppe Moscato aka peppeska - Linux User - no html messages---| |donpeppiniello(a)tiscali.it - http://peppeska.altervista.org------| |Fingerprint = 90DC 05A8 2D65 BC04 BD1B 4C07 C389 434B 3201 319D| <<<<---------------------------------------------------------->>>> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF/6qQkA6hcnFZI/YRAlRfAKDVYKu8MkY8QSz80gnaJTkGgtnttACbBaPU wPIiKiVRmzm2c91/6a6jSjA= =ZqNs -----END PGP SIGNATURE-----

4 25

SUMMARY: ldap groups + freeradius
by Karen R McArthur 23 Mar '07

23 Mar '07

Thank you to this list! I am posting snips from my "users", "radiusd.conf" and "huntgroup" files that work. ********** huntgroups ********** admin NAS-IP-Address == 192.168.1.1 Session-Timeout = 60, Idle-Timeout = 30 public NAS-IP-Address == 192.168.1.2 NAS-IP-Address == 192.168.1.3, Idle-Timeout = 3600 vpn NAS-IP-Address == 192.168.1.4 ********** radiusd.conf ********** <snip> ldap { server = "ldap.example.com" port = xxxx identity = "cn=proxy,dc=example,dc=com" password = itsasecret basedn = "ou=People,dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member=%{ Ldap-UserDn}))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } <snip> ********** users ********** <snip> DEFAULT Auth-Type = LDAP Fall-Through = yes DEFAULT Huntgroup-Name == public, Ldap-Group == public Reply-Message = "Welcome to the dial-in service", Fall-Through = no DEFAULT Huntgroup-Name == admin, Ldap-Group == admin Reply-Message = "Welcome to the admin Termial Server", Fall-Through = no DEFAULT Huntgroup-Name == vpn, Ldap-Group == vpn Reply-Message = "Welcome to the VPN Gateway", Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "You are not authorized to use this service. If you believe you have received this message in error, please contact our Helpdesk." <snip> ***** user ldap record ***** dn: uid=user1,ou=People,dc=example,dc=com objectClass: radiusprofile radiusGroupName: public radiusGroupName: vpn radiusGroupName: admin dn: uid=user2,ou=People,dc=example,dc=com objectClass: radiusprofile radiusGroupName: public dn: uid=user3,ou=People,dc=example,dc=com objectClass: radiusprofile radiusGroupName: public radiusGroupName: vpn -- Karen R. McArthur <kmcarthu(a)bates.edu> Systems Administrator Information and Library Services, Bates College Lewiston, Maine 04240 USA ph:(207)786-8236 fax:(207)786-6057 > > RedHat EL 4 (managed through RHN, so latest available versions) > freeradius-1.0.1-3 > openldap-2.2.13-6 > > I have 4 NAS-IP-Addresses. > > My users are split into 6 groups (some are in multiple groups): public, > faculty, staff, student, vpn, and admin. > > I would like the users to get access to the NAS by virtue of being in a > group. > > 192.168.1.1 > admin > 192.168.1.2 > vpn > 192.168.1.3 & 192.168.1.4 > faculty, staff, student & public > > What steps do I need to follow to implement this? I have tried many > combinations in "huntgroups", "users", and "radiusd.conf". > > Any directions or urls to documentation would be appreciated.

1 0

What is the real meaning and use of cache-size in ippool declaration
by Florin 23 Mar '07

23 Mar '07

Hi everyone, FreeRadius 1.0.1 here, the one which comes as standard with RHEL 4. I want to use a whole class B subnet (172.16.0.0/16) in an ippool declaration to assign IP addresses from. Now it is said that the cache-size parameter should be equal to the number of IP addresses in the pool. But if I try to set it to 65536, the server won't start (it'll crash actually). So what is the **real** meaning and use of this parameter ? You have to specify the start and end of the pool, so then why set another parameter with a value that can be trivially calculated by the server anyway ? And more importantly, what are the right guidlines on setting the value for this parameter ? Making it equal to the number of IP addresses in the pool won't work and it just doesn't make any sense to me. Finally, if I change the value of this parameter, beside restarting FreeRadius, do I have to do anything else ? Do I have to delete the related database and index files in order for the change to take place ? Thank you in advance. Best regards, Florin

1 0

freeradius unistalling
by elmalhi abdelghani 23 Mar '07

23 Mar '07

Hi, how i can uninstall freeradius, i dont found make uninstall thank´s Abdelghani ELMALHI Devesestr. 1 45897 Gelsenkirchen Deutschland Tel. 00 49 176 65 84 38 50 --------------------------------- Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses.

1 0

LDAP + groups problem
by Angel L. Mateo 23 Mar '07

23 Mar '07

Hello, We are using freeradius with a ldap backend for my users. We have a few services authenticating against the radius server that need to filter some groups of users For users we have a posix schema: Our users has the posixAccount schema whith its main group in the attribute gidNumber. Something like this: dn: uid=myuser,ou=Users,dc=domain.com objectClass: posixAccount objectClass: shadowAccount objectClass: CourierMailAccount uid: myuser uidNumber: 123456 gidNumber: 1001 loginShell: /bin/bash mail: myuser(a)domain.com ... For the group entry we have: dn: cn=groupA,ou=Groups,dc=domain.com cn: groupA gidNumber: 1001 objectClass: posixGroup objectClass: top For user's secondary groups we have: dn: cn=groupB,ou=Groups,dc=domain.com cn: groupB gidNumber: 1002 objectClass: posixGroup objectClass: top memberUid: myuser so, this user belongs to groupA (main group) and groupB (secondary group). This is similar to /etc/passwd and /etc/group files. What I want is that the below users' entry reject access to user "myuser": DEFAULT Ldap-Group == "groupB", Auth-Type := Reject Reply-Message = "groupB users are not allowed to login" I am trying varios configurations but I don't get the good one. I have try to configure as: groupname_attribute = gidNumber groupmembership_filter = "(&(objectClass=posixAccount)(uid= %{Stripped-User-Name:-%{User-Name}}))" groupmembership_attribute = uid but with this configuration I can filter just by the main group (myuser is still allowed). The configuration: groupname_attribute = cn groupmembership_filter = "(&(objectClass=posixGroup)(memberUid= %{Stripped-User-Name:-%{User-Name}}))" groupmembership_attribute = memberUid seems to look just in secondary groups. Is there any way to configure taking count of main and secondary groups with this structure? Thanks in advance -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

1 0

PEAP/MSCHAPv2 and WinXP
by Damian Davalos 23 Mar '07

23 Mar '07

Hello, I have a question I can't seem to answer with the mail archives or documentation. Let me begin by explaining what I'm trying to do: - PEAP/MSCHAPv2 authentication, no client certificates, with a WinXP supplicant. - The server certificate is self-signed. >From the FAQ, I have: - Installed the hot fix from MS KB 885453 - Included the required OID 1.3.6.1.5.5.7.3.1 in the server certificate - Followed MS requirements for server certificates in KB 814394 The only way I can get this setup to work, is if I import my root certificate onto my client machine. Otherwise, I get the typical Access-Request and Access-Challenge back and forth. My question: Is importing the root certificate onto your client necessary when self-signing your own server certificate? If not, then I guess I'm still doing something wrong, but I would like to make sure before I continue to troubleshoot. Any help is greatly appreciated. Regards, Damian Davalos

6 6

Res: Res: EAP-TTLS + Post-auth clear password
by Erico Augusto 23 Mar '07

23 Mar '07

Hi, as suggested, I'm working with exec module. radiusd.conf: ... exec { post-auth:User-Password = `%{exec:/usr/local/etc/raddb/jradius.forward}` wait = yes input_pairs = request } ... the content of /usr/local/etc/raddb/jradius.forward script is just: #!/bin/bash echo 123456 so, the user's password that I'm using is 123456(inserted at secureW2 Windows XP popup), but I'm yet receiving ciphered User-Password at destination custom app... I have changing the content of jradius.forward script to #!/bin/bash echo 123456789 just to see if the password sended is the one returned by jradius.forward script, but all entries at radiusd -X shows: ... Processing the post-auth section of radiusd.conf ... rlm_jradius: packing attribute User-Password (type: 2; len: 6) ... Conclusion: the User-Password attribute is not been changed by the external script, once the length should be 9 ... some idea about what is wrong? one more point: I'm setting user's password at etc/raddb/users file (it mey be a problem, i mean ... does it fixing the password?). thanks a lot, Erico. ----- Mensagem original ---- De: Alan DeKok <aland(a)deployingradius.com> Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Enviadas: Quinta-feira, 22 de Março de 2007 5:29:24 Assunto: Re: Res: EAP-TTLS + Post-auth clear password Erico Augusto wrote: > I'm trying to forward username and password to my own app, using > post-auth section, to perform user authentication, as described below > ... is that possible? Yes. See the "exec" module. Why do you think the pap module has anything to do with it? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

2 1

RE: New Server Build
by Scott Hughes 23 Mar '07

23 Mar '07

Alan, Thanks for the reply. I am using the 'radtest' utility. The actual command I am typing (from the command line of the server itself is: "radtest test1 test1 192.168.1.5:1812 0 testing123". I am attempting to make sure everything is okay on the server itself, before attempting to connect to the server with a client. The DB structure is: 8 tables as follows: nas, radacct, radcheck, radgroupcheck, radgroupreply, radpostauth, radreply, usergroup. Scott Scott Hughes wrote: > When I run the radtest utility that comes with FR, I get an access-reject, even though the user is in the radius database. Running FR with the -X parameter, it does appear to be check the database. > > Am I testing correctly for this type of FR & MySQL setup? Likely, yes. What's in the DB, and what kinds of packets are you sending for tests? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 1

freeradius cisco command accounting
by satish patel 22 Mar '07

22 Mar '07

Dear's is there any feature in freeradius provide cisco command accouning means users run command on cisco router and radius provide me command log ?? per users i want to replace my tacace with freeradius $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 2

IP Pool management and Re-authentication
by Thibault Le Meur 22 Mar '07

22 Mar '07

Hi, I'm using a system (openvpn) with 'radiusplugin' to let FR authenticate users and manage IP Pools. Openvpn sometimes needs to renegotiate the connections and thus sends authentication requests while the connection is still active (with an already assigned IP address): this causes FR to assign a new IP address from the pool (which seems normal since FR has no way to know this is a renegotiation). I'd like to patch the openvpn-radiusplugin so that an extra attribute is sent in the Access-Accept packets so that FR will be able to differentiate Initial and Renegociation Access-Accept requests and only assign new IP address from the pool on Initial Access-Accept requests. Do you know a standard Radius attribute that could be used for this ? As far as you know, are there other NASes using such a quirk ? Does this make sense ? Thanks in advance, Thibault

3 9