April 2007 - Freeradius-Users - lists.freeradius.org

freeradius with samba domain, port-access and vlan-assignment
by Christian Hohmann 12 Apr '07

12 Apr '07

Dear members, Thank you so far for your help, but I guess I have do describe my problem a second time. I try to set up a security solution for a network using freeradius. I want to port authenticate all Clients on a HP Switch and assign a vlan to each port dynamically. The WXPSP2 Hosts are members of a samba Domain, and this is the problem. I'll try to describe what is happening: If i configure the WXPSP2 for using login Username and pwd for network authentication: The host is booting and the switch asks EAP-Request. When I enter the username and pwd, windows opens "Can't find the domain controller" and finishes. This is logical, due to the fact that the Host is not legal and has no ipadress. There is no EAP Response from the Host to the switch to get an ipadress. So this is not working. I think there has to be a mechanism that reads in username and pwd, answers the eap request, get an ip adress and gain contact to the domain controller. after this the login on the domain could be done with the entered Login-information. Have you any hint how to implement such a mechanism, or have you ever done something like this? I can't imagine that i am the first one, having this problem. The work arround would be to configure network-authentication with the ComputerLogin. In this case, the WXPSP2 Host boots, gets connection to the switch, switch sends eap-request, and the host answeres with the computer information. Now the Host has port access to the switch and could gain ip adress. Now login on samba would be possible. The bad thing is, that every legal domain computer has automaticaly access to the network. ok that would be a minor disadvantage, but I can only authenticate the client one time (the switch asks only one time for authentication). If access to the port is granted, there is no second need for the switch to ask again. But i want to assign a vlan ID dynamically, depending on the USER, not on the Computer. A vlan assignment to the switch by the samba domain controller seems to be impossible because the swich doesn't participate the communication between host and samba domain controller in the same way it does between host and radius. Could you give me a hint how to exit this desaster? Thanks and regards - Christian _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

rlm_sql, readclients=yes: multiple NASes with same IP
by Milan Holub 12 Apr '07

12 Apr '07

Hi all, with currect cvs head I've observed following behaviour: - I'm using rlm_sql - clients stored in mysql DB(standard DB scheme) - in sql.conf I have "readclients=yes"(to read the nas table) We are having multiple NASes on the same IP distinguished only by different port(eg. multiple instances of nocat wlangw running on differet ports). This result in following DB records(for example): +-----+----------------+-----------+-------+-------+----------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | community | description | +-----+----------------+-----------+-------+-------+----------+-----------+-------------+ | 123 | <valid_IP> | wlan-gw51 | other | 5281 | secret | NULL | off | | 117 | <same_valid_IP> | wlan-gw51 | other | 5280 | secret | NULL | off | +-----+----------------+-----------+-------+-------+----------+-----------+-------------+ (the only difference is in the ports) We are using nas table as a bind table to another table for "usage view". Basically such NASes can serve completely different physical locations and what really determinates the location is combination of nasname and ports. Now: freeradius refuses to start with the above configuration: >>> DEBUG OUTPUT START rlm_sql (sql): Read entry nasname=<valid_IP>,shortname=wlan-gw51,secret=secret rlm_sql (sql): Adding client <valid_IP> (wlan-gw51) to clients list rlm_sql (sql): Read entry nasname=<same_valid_IP>,shortname=wlan-gw51,secret=secret rlm_sql (sql): Adding client <same_valid_IP> (wlan-gw51) to clients list rlm_sql (sql): generate_sql_clients() returned error rlm_sql (sql): Closing sqlsocket 4 rlm_sql (sql): Closing sqlsocket 3 rlm_sql (sql): Closing sqlsocket 2 rlm_sql (sql): Closing sqlsocket 1 rlm_sql (sql): Closing sqlsocket 0 radiusd.conf[10]: sql: Module instantiation failed. radiusd.conf[1896] Failed to find module "sql". radiusd.conf[1819] Failed to parse authorize section. Errors setting up modules >>> DEBUG OUTPUT END I believe that for communication of the NAS with radius only the IP is deciding for radius. I know this can be solved outside radius by creating another "bind" table in DB(binding multiple ports to one unique nas record) and changing existing applications for viewing accounting data(php+mysql). For me at the moment it's easier to persuade freeradius just to ignore such "duplicities" when reading clients by following simple patch: Index: src/main/client.c =================================================================== RCS file: /source/radiusd/src/main/client.c,v retrieving revision 1.53 diff -u -r1.53 client.c --- src/main/client.c 10 Apr 2007 14:21:24 -0000 1.53 +++ src/main/client.c 11 Apr 2007 15:36:19 -0000 @@ -225,7 +225,7 @@ * Duplicate? */ if (!rbtree_insert(clients->trees[client->prefix], client)) { - return 0; + return 1; } #ifdef WITH_SNMP I hope it helps someone. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

RE: (Solved) Re: MAC authorisation (but not authentication) via LDAP
by Alan Walters 11 Apr '07

11 Apr '07

this looks great for my purpose as well thanks very much for your help Alan, The problem for me was that when the ldapsearch failed to find the MAC address, freeradius didn't reject authorisation. The solution for me, ( I'm sure the big boys can point out how it's wrong ), was the following script.. -------snip------- #!/bin/sh if $( echo $MODULE_FAILURE_MESSAGE | grep "not found" > /dev/null ); then echo "Auth-Type := reject"; exit 0; fi -------snip------- and the following clause in radiusd.conf -------snip------- exec rejectOnNotFound { wait = yes program = "/usr/local/etc/raddb/rejectOnNotFound.sh" input_pairs = request output_pairs = config } -------snip------- which is used in the authorise section thus -------snip------- Autz-Type LdapMAC { ldapMAC rejectOnNotFound } -------snip------- As I said, works for me. Hope it helps.. Mart Alan Walters wrote: > we a trying to add mac authentication to our wireless aps radius request > comes in like so. > > rad_recv: Access-Request packet from host 10.250.100.3:1038, id=119, > length=95 > Service-Type = Framed-User > NAS-Port-Id = "wlan1" > User-Name = "00:0B:6B:56:1D:48" > User-Password = "" > NAS-Identifier = "ballyvaughan_ap_1" > NAS-IP-Address = 10.250.100.3 > > > the mac address is in a field in the ldap so i created a second > ldap.attrib.map and a new ldap autz-type. the problem is that the > user-password that is sent i blank so i added this to the users file. > like so. > > DEFAULT Huntgroup-Name == test, Autz-Type := ldapMAC, User-Password == > "", Simultaneous-Use := 1 > Fall-Through = 0 > > great now the user with authorise and authenticate from files. but what > i had hoped would happen was if they failure authorisation they would > not continue, i can see this is not the default proceedure. how can i > make this work this way. > > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > users: Matched entry DEFAULT at line 4 > modcall[authorize]: module "files" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > Found Autz-Type ldapMAC > Processing the authorize section of radiusd.conf > modcall: entering group ldapMAC for request 0 > modcall: entering group redundant for request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for 00:0B:6B:56:1D:48 > radius_xlat: '(rdwaveuserWirelessMac=00:0B:6B:56:1D:48)' > radius_xlat: 'o=clients,dc=radiowave,dc=net' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 > rlm_ldap: bind as cn=admin,dc=radiowave,dc=net/xxxxxxx to 127.0.0.1:389 > radiustest:/etc/freeradius/config-clients# > rlm_ldap: Bind was successful > rlm_ldap: performing search in o=clients,dc=radiowave,dc=net, with > filter (rdwaveuserWirelessMac=00:0B:6B:56:1D:48) > rlm_ldap: object not found or got ambiguous search result > rlm_ldap: search failed > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldapmac1" returns notfound for request 0 > modcall: leaving group redundant (returns notfound) for request 0 > modcall: leaving group ldapMAC (returns notfound) for request 0 > > > but when the authentication starts this stilll happens, below was an > idea someone had in respect to this issue or a similar one but i have no > idea how to deploy this look forward to your replys. > > auth: type Local > auth: user supplied User-Password matches local User-Password > Processing the session section of radiusd.conf > modcall: entering group session for request 0 > modcall: entering group redundant for request 0 > modcall[session]: module "sql2" returns noop for request 0 > modcall: leaving group redundant (returns noop) for request 0 > modcall: leaving group session (returns noop) for request 0 > Login OK: [00:0B:6B:56:1D:48/] (from client ballyvaughan port 0) > Sending Access-Accept of id 119 to 10.250.100.3 port 1038 > > > On Sun, 2007-02-25 at 20:05 +0000, Martin Whinnery wrote: >> Martin Whinnery wrote: >>> Markus Krause wrote: >>> >>>> Zitat von Martin Whinnery <martin.whinnery(a)sbc.ac.uk>: >>>> >>>> >>>> >>>>> Hi. >>>>> >>>>> Probly just me not understanding... >>>>> >>>>> What I want is for our switches to only allow access to MAC addresses in >>>>> our LDAP database. >>>>> >>>>> I don't want to store passwords on our LDAP host entries. >>>>> >>>>> I'm set up to check LDAP during authorisation, and it correctly returns >>>>> authorised / not authorised depending on whether the appropriate >>>>> attribute contains the right value. >>>>> >>>>> The trouble comes with authentication - either I set Auth-Type := >>>>> Accept, in which case and failed authorisation is overridden, or I allow >>>>> authentication to carry on against LDAP ( or System, or whatever ), in >>>>> which case it fails always and access is denied, even for authorised MACs. >>>>> >>>>> Is there a way to make the Authorisation part final and authoritative? >>>>> >>>>> >>>>> As I say, probly just being stoopid. >>>>> >>>>> >>>>> Mart >>>>> >>>>> >>>>> >>>>> >>>> don't no if it is a good solution, but i just do this by setting the >>>> following in radiusd.conf: >>>> >>>> authenticate { >>>> ... >>>> Auth-Type LdapMAC { >>>> ok >>>> } >>>> ... >>>> } >>>> >>>> the Auth-Type is set in users file depending on huntgroups: >>>> >>>> DEFAULT Huntgroup-Name == switch, Autz-Type := LdapMAC, Auth-Type := LdapMAC >>>> >>>> i assume there are better/smarter sollutions as one can read "don't >>>> set Auth-Type" on many places but it works here ;-) >>>> >>>> regards >>>> markus >>>> >>>> >>>> >>> Thanks Markus, >>> >>> the problem seems to be that the authorisation pass returns "notfound", >>> whereas I want it to "reject", as if it found an entry in LDAP without >>> the appropriate attribute. >>> >>> Mart >>> >>> >> This was exactly the problem. What I've done is created an exec module, >> which checks for 'not found' in MODULE_FAILURE_MESSAGE, returning >> non-zero if there's a match. So authorization *fails* rather than >> succeeds with 'not found'. >> >> I think. >> >> Anyway, it works. >> >> Thanks for all your help. >> >> Mart >> > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

radius-apache authentication problem
by Ramazan Ulker 11 Apr '07

11 Apr '07

Hi I want to implement otp authentication for a web site. Radius and otp scripts works well together but apache don't send any authentication data to radius. I followed instructions in http://www.freeradius.org/mod_auth_radius/ but apache mod_authn_file wants passwords and could not be disabled. when i removed the module no authn provider configured are seen in apache error logs. Changing AuthBasicAuthorative on or off in .htaccess didn't solve the problem. Problem stems from apache but someone solves such a problem can respond me.

2 6

rlm_sql_unixodbc: Connection failed
by elmalhi abdelghani 11 Apr '07

11 Apr '07

hi, I try to use MSSQL as database for my Freeradius server, but the connection is failed ? i have unixodbc succefly installed. so by typing radiusd -X i see this : rlm_sql_unixodbc: Connection failed so any user can connected! helps or tipps please ! Abdelghani ELMALHI Devesestr. 1 45897 Gelsenkirchen Deutschland Tel. 00 49 176 65 84 38 50 --------------------------------- Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses.

1 1

Re: add realm to user based on NAS-IP
by Arran Cudbard-Bell 11 Apr '07

11 Apr '07

> Message: 1 > Date: Sat, 31 Mar 2007 18:11:46 +0200 > From: Alexander Papenburg <freeradius(a)papenb.org> > Subject: add realm to user based on NAS-IP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <460E8842.5060302(a)papenb.org> > Content-Type: text/plain; charset=ISO-8859-15; format=flowed > > Hi all, > > i wonder if it is possible to add a realm to a username based on the > NAS-IP the request come from. > For instance: > - user "abc" logs on router 10.0.0.1 > > - router 10.0.0.1 asks a freeradius proxy for user "abc" > > - freeradius-proxy recognize the ip and add "@realm" to the username and > proxy the request to another freeradius-server based on "realm"-entry > in proxy.conf > > Unfortunatly I found many "solutions" in the past 2 hours (like > proxy-to-realm, attr_rewrite, hints...), I cant't decide which is the > right one for me. %) So help would be much appreciated. > > > Thanks in advance > > Alexander > > > If your using eap, you can't rewrite the username as then the username in the outer identity won't match the one in the eap tunnel and eap message will be rejected by your radius home server. Unless at your home server you strip the realm part of the user-name attribute off again Your best bet for this is to use the users file and the proxy-to-realm 'check-item'. so you'd have in the users file on your proxying radius server DEFAULT NAS-IP-Address == 10.0.0.1, Proxy-To-Realm = "MyRealm" User-Name = "%{User-Name}@MyRealm" Then add these to your hints file on your home radius server (though you may have to rewrite them depending on the regex engine your home server is using). # Writes stripped username to use in authorization (user@|%|/domain) DEFAULT User-Name =~ "^([[:alnum:]]*)(@|%|/)([[:alnum:].]*)$" User-Name = "%{1}" # Wrties alternate stripped username to use in authorization (domain\\user) DEFAULT User-Name =~ "^([[:alnum:].]*)\\\\\\\\([[:alnum:]]*)$" User-Name = "%{2}" Hope this helps :)

3 9

Question about 3Com 4500 series and Freeradius + Ldap
by Rafał Kamiński 11 Apr '07

11 Apr '07

Hi, Is somebody configure 3Com switch series 4500 with Freeradius + Ldap auth. ? I have some problem: In debug mode i see: ---CUT--- Sending Access-Accept of id 18 to 192.168.2.201 port 5001 MS-MPPE-Recv-Key = 0x3c9698b69511f27c53657389c3994d28fa0c2db70bd6c671dc211ba697f92a09 MS-MPPE-Send-Key = 0xb571bf6045f094fa846995c6a3e89160e6eb476cc597d4dd0c6d90cd3341ca15 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "rka" ------- But on switch and on computer, I have unauth. user :( And i don't know why ? Maybe null Message-Authenticator is wrong ? Thanks, Kamyk

1 0

freeradius and cisco hidden share
by John Baker 11 Apr '07

11 Apr '07

Hello *I'm running FreeRadius with the standard Ubuntu Breezy package that reads as freeradius 1.0.4-2. Its been the connection to the LDAP backend for authentication on an old Cisco 3640 with IOS 12.2(23) for quite a while. I'm trying to setup a new 2811 router with IOS 12.4(11)T1 and am running into a little trouble with repeating the same configuration. The setup works fine if I use a password like "testing123" on both ends. But when I use "radius-server key 7" to encrypt it breaks. The current setup does use this so I know it works. But in all the documentation I've been weeding** through** on configuring clients.conf nothing seems to mention how this kind of encryption works on the Free Radius server end. The router insists on extremely long key for this configuration. The 3640 shows one in the config. But client.conf show a much shorter one. When I try to plug the long one in clients.conf freeradius fails to startup. So how do you configure freeradius for a Cisco hidden password? Thanks * -- John Baker Network Systems Administrator Marlboro College Phone: 451-7551 off campus; 551 on campus

5 8

double free or corruption errors with 2.0.0-pre0
by matthew zeier 11 Apr '07

11 Apr '07

Grabbed 2.0.0-pre0 from CVS (the latest, I presume) on a RHEL4 system with perl 5.8.8. Running /usr/local/sbin/radiusd -X gives: radiusd: entering modules setup Module: Library search path is /usr/lib modules: Not loading pre-proxy{} section modules: Not loading post-proxy{} section *** glibc detected *** double free or corruption (fasttop): 0x08c47478 *** Aborted I found some mention of upgrading perl (default RHEL is 5.8.2, I upgraded to 5.8.8) but still get those errors after a clean compile. I'm configuring with the following: ./configure \ --enable-shared --disable-static \ --with-gnu-ld \ --with-threads \ --with-thread-pool \ --disable-ltdl-install \ --sysconfdir=/etc/ Any fix for this? -- matthew zeier | Network Engineer | Mozilla Corp. | (650)903-0800 x219

4 15

RadiusExpert Wiki
by Mike McCauley 11 Apr '07

11 Apr '07

Hi all, Open System Consultants (OSC) has established a free resource for the RADIUS user community to collect and share information about configuring and implementing RADIUS protocol devices and software. RadiusExpert:Community Portal at http://www.open.com.au/wiki/index.php/Main_Page will become the repository for all the information that often resides only in the heads of system administrators who manage and maintain the security access and authentication requirements of their networks. We welcome contributions about such topics as configuring various RADIUS devices, load balancing with RADIUS servers and wireless authentication tips from our very active user community. If you can contribute any information on any RADIUS topic to the benefit of the entire community, please feel free. This is not a trawl for customers by OSC, but a genuine attempt to assist everyone in the RADIUS community. The wiki is vendor-neutral and covers all free and commercial RADIUS servers and compatible devices. This message was posted with the assent of Alan DeKok Cheers. -- Mike McCauley mikem(a)open.com.au Open System Consultants Pty. Ltd Unix, Perl, Motif, C++, WWW 9 Bulbul Place Currumbin Waters QLD 4223 Australia http://www.open.com.au Phone +61 7 5598-7474 Fax +61 7 5598-7070

2 2