May 2007 - Freeradius-Users - lists.freeradius.org

Re : Attributes mapping between LDAP and RADIUS
by Eshun Benjamin 16 May '07

16 May '07

Jian Wang wrote: > Is there an RFC standardizing the attribute mapping between LDAP and > RADIUS? look at this doc; http://docs.sun.com/source/806-4252-10/mapping.htm ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan Dekok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 16 Mai 2007, 9h28mn 38s Objet : Re: Attributes mapping between LDAP and RADIUS Jian Wang wrote: > Is there an RFC standardizing the attribute mapping between LDAP and > RADIUS? No. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

EAP-TLS Inner/Outer identity
by Keith Moores 16 May '07

16 May '07

I'm trying to find a solution to a wireless authorization issue. Background When using EAP-TLS both Windows (XP/Vista) and Mac OS supplicants by default set the outer identity equal to the user certificate Subject Alternative Name - Principle Name (OID 1.3.6.1.4.1.311.20.2.3) when it exists (not the Common Name). This is somewhat similar to S/MIME using the Subject Alternative RFC822 Name (not the Common Name). This is significant usability benefit as users don't have to enter a separated user name to connect, which in my experience a lot of supplicants require. During authentication the outer identity becomes the User-Name in FreeRadius and can be used for authorization (such as LDAP). Independently the certificate (which contains the inner identity) can be validated. We use client certificates for access to multiple services (web sites and more than one wireless networks), thus need the ability to control access to each independently. i.e. One class of users does not have any access to a particular wireless network with their user certificate but does have access to another wireless network (and/or web resources) with their user certificate. CRL are not the solution in this case as they invalidate the user certificate for all uses. Problem The outer identity can be set by the user to anything the user wants, meaning it shouldn't be trusted/used for an authorization lookup. In FreeRadius it does not appear possible to directly lookup authorization based on the inner identity, only to check the inner identity Common Name against a the outer identity, i.e. check_cert_cn = %{User-Name} Our Common Names are not unique (which seems typical of other CAs as well) so there may be two certs for different users that have the Common Name "John A. Smith" which is why our CA populates the Subject Alternative Name - Principle Name (among other fields) with the users unique user ID. http://middleware.internet2.edu/hepki-tag/pki-lite/hepki-tag-pkilite- profile-current.html#PrincipalName http://support.microsoft.com/default.aspx?scid=kb;en-us;281245 In Cisco ACS land we could accomplish this with "Certificate SAN Comparison" http://www.cisco.com/en/US/products/sw/secursw/ps2086/ products_configuration_guide_chapter09186a0080721d80.html#wp999517 Questions Is there a way to perform an authorization lookup based on the EAP- TLS inner identity Subject Alternative Name - Principle Name? Any chance for adding support for checking the outer identity against the Subject Alternative Name - Principle Name, i.e. check_cert_san = % {User-Name} I found this old comment in list archives, does the same answer still hold on access to other certificate fields? > Alan DeKok freeradius-users(a)lists.freeradius.org > Fri, 08 Apr 2005 12:46:31 -0400 > > =?iso-8859-1?Q?Alejandro_Mart=EDnez_Marcos?= <almartinez(a)sgi.es> > wrote: > > I would need an option "check_cert_uid" instead of > "check_cert_cn", > > because my client certificates don't have a cn. Is it possible > at the > > moment? In other case, how can we achieve it? > > Source code edits. > > The TLS module should really export a way to check all fields in the > certificate, via something like %{tls:....}. That way the > "check_cert_foo" stuff could go away. > > Alan DeKok. Thanks in advance, -Keith ------------------------------------------------------------------------ Keith Moores <mailto:kmm6b@virginia.edu> Network Systems ITC-Communications and Systems Division University of Virginia, ITC-2015 Ivy Rd Phone (434) 924-0621 Box 400324, Charlottesville, VA 22904-4324 Fax (434) 982-4715

1 0

Trying to apply a simple proxy_reply law
by Marc Miranda (GOWEX) 16 May '07

16 May '07

Hello freeRADIUS friends! First of all, thank you all for your great labour developing such a great software. I have a doubt and it's very important for us to resolve it ASAP. We've installed freeRADIUS in its Version 1.0.2. Our problem is that we want to apply that rule: ACCESS RADIUS --------> OUR PROXY -------------------> HOME RADIUS <-----------------------------------------------------| (Filter) If an auth packet from a home RADIUS in our proxy it's been sent to the access RADIUS, we want that Session-Timeout attribute has a maximum of 3600 seconds. That's why we want to apply the following algorithm: If Session-Timeout is null, we want to proxy it with a value of a 3600 seconds If Session-Timeout is greater than 3600 we want forward it with 3600 seconds If Session-Timeout is smaller or equals to 3600, we want to respect it I'm sorry if that's trivial, but I've been a long time reading all kind of forums and specs, docs and faqs and I can't find the solution: The problem is: * Users file only seems to work as a filter for incoming request, not outcoming ones * Attr_filter module doesn't allow to write an attribute if and only if that's NULL (not even with '=' operand which hypothetically assigns a value only when it does not exist [in users file]) * Attr_rewrite doesn't seem to work unless you put the new_attribute parameter to yes (is that a bug) and I'm not sure if its possible to use it if attribute is not attached per se Hence my doubt. I will be very pleased if you could help me. Thanks a lot in advance!!!

2 3

1.1.6 xlat :- broken
by Mike Sturdee 16 May '07

16 May '07

I have a freeradius box (version 1.1.0) with the following (working) group lookup.. On updating to 1.1.6 it appears the %{Stripped-User-Name:-%{User-Name}} part is broken.. I see in cvs there is an update to head, "radiusd/src/main/xlat.c (1.115): make ':-' work again".. I have not had luck trying to merge relevant changes to the 1.1 branch.. Could this be fixed in stable? -- radiusd.conf: ldap { ... gid = %{ldap:ldap:///dc=domain,dc=com?gidNumber?sub?(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectClass=%{Realm}))} groupname_attribute = cn groupmembership_filter = "(&(objectClass=posixGroup)(|(gidNumber=${gid})(memberUid=%{Stripped-User-Name:-%{User-Name}})))" do_xlat = yes ... } Debugging output: rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=domain,dc=com' radius_xlat: Running registered xlat function of module ldap for string 'ldap:///dc=domain,dc=com?gidNumber?sub?(&(uid=%{Stripped-User-Name' rlm_ldap: - ldap_xlat radius_xlat: 'ldap:///dc=domain,dc=com?gidNumber?sub?(&(uid=' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=domain,dc=com, with filter (&(uid= rlm_ldap: ldap_search() failed: Bad search filter: (&(uid= rlm_ldap: Search returned error rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=posixGroup)(|(gidNumber=mike)(objectClass=dialdomain)))(memberUid=mike)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=domain,dc=com, with filter (&(cn=dial1)(&(objectClass=posixGroup)(|(gidNumber=mike)(objectClass=dialdomain)))(memberUid=mike)))) rlm_ldap: ldap_search() failed: Bad search filter: (&(cn=dial1)(&(objectClass=posixGroup)(|(gidNumber=mike)(objectClass=dialdomain)))(memberUid=mike)))) rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Search returned error Thanks, -Mike

1 0

radrelay.conf - can't parse properly
by Milan Holub 16 May '07

16 May '07

Hi Alan, based on cvs head from May 10 2007: having following listen entry in radrelay.conf: listen { type = detail detail = /var/log/freeradius/radacct/radrelay/detail max_outstanding = 100 identity = radrelay } "radrelay personality" of freeradius can't parse the config properly: `freeradius -X -n radrelay` ends up with: /etc/freeradius/radrelay.conf[111]: No detail file specified in listen section when debugging: (gdb) run -X -n radrelay Starting program: /usr/sbin/freeradius -X -n radrelay [New Thread 1024 (LWP 24967)] Config: including file: /etc/freeradius/radrelay.conf FreeRADIUS Version 2.0.0-pre0, for host i386-pc-linux-gnu, built on May 10 2007 at 14:04:03 Starting - reading configuration files ... read_config_files: reading dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no snmp = no max_request_time = 30 cleanup_delay = 5 max_requests = 65536 allow_core_dumps = no log_stripped_names = no log_file = "/var/log/freeradius/radius.log" log_auth = no log_auth_badpass = no log_auth_goodpass = no pidfile = "/var/run/radiusd/radrelay.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { syslog_facility = "daemon" } } port = 1812 listen { type = "detail" identity = "radrelay" listen { max_outstanding = 100 } [Switching to Thread 1024 (LWP 24967)] Breakpoint 1, detail_parse (filename=0xbfffe550 "/etc/freeradius/radrelay.conf", lineno=111, cs=0x807b898, this=0x8150fb0) at listen.c:1227 1227 if (!data->filename) { (gdb) print data $1 = (listen_detail_t *) 0x8150fe0 (gdb) print data->filename $2 = 0x0 (gdb) print data->vps $3 = (VALUE_PAIR *) 0x0 (gdb) print data->fp $4 = (FILE *) 0x0 (gdb) print data->state $5 = 0 (gdb) print data->timestamp $6 = 0 (gdb) print data->client_ip $7 = {af = 0, ipaddr = {ip4addr = {s_addr = 0}, ip6addr = {in6_u = {u6_addr8 = '\0' <repeats 15 times>, u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, u6_addr32 = {0, 0, 0, 0}}}}} (gdb) print data->max_outstanding $8 = 100 (gdb) print data->outstanding $9 = (int *) 0x0 (gdb) continue Continuing. /etc/freeradius/radrelay.conf[111]: No detail file specified in listen section Program exited with code 01. Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 5

Acct-Type behaviour
by Milan Holub 16 May '07

16 May '07

Hi Alan, with cvs head from May 10: I had following accounting section: accounting { detail sql attr_filter.accounting_response } where all modules were invoked to process the request. then I've changed it to: accounting { detail Acct-Type RELAY { radrelay-detail } sql attr_filter.accounting_response } where radrelay-detail is defined in modules correctly and Acct-Type is set in acct_users file: DEFAULT Client-IP-Address != <SOME_IP>, Acct-Type := RELAY The goal is to log all accounting packets except of those sent from certain IP(another radius). The log file is then to be processed by "radrelay personality" of freeradius. My "problem" is that if the Acct-Type is set to RELAY then no other module from accounting{} gets called except of radrelay-detail. I thought that correct behaviour is that all modules from accounting{} should be called and if Acct-Type is set to RELAY then radrelay-detail should be called as well. In order to achieve desired behaviour my accounting{} looks now: accounting { Acct-Type RELAY { radrelay-detail detail sql attr_filter.accounting_response } detail sql attr_filter.accounting_response } Is this a bug or a feature? Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 1

EAP-SIM : symbol lookup error
by deepak kumar 16 May '07

16 May '07

Hi Alan I have downloaded freeradius 1.1.6 and configured for EAP-SIM and run successfully. but when i send a request using radeapclient to radius server i get this error " ./radiusd: symbol lookup error: /usr/local/lib/rlm_sim_files- 1.1.6.so: undefined symbol: rad_assert" I have set LD_LIBRARY_PATH, reconfigured and and rebuilt server with share disable option , but still get the same error. what is the problem, what should I do? this is log of radius ------------------------- Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:37454, id=33, length=89 User-Name = "232420100000015" NAS-IP-Address = 255.255.255.255 Message-Authenticator = 0x42014f09257d6d91d04b6e145e251adb NAS-Port = 0 EAP-Message = 0x0220001401323332343230313030303030303135 ./radiusd: symbol lookup error: /usr/local/lib/rlm_sim_files-1.1.6.so: undefined symbol: rad_assert thanks Deepak

3 5

no session showed by radwho, but user still could not login
by Trio Yulistianto 16 May '07

16 May '07

Hi all I'm newbie in freeradius, i've already installed freeradius-1.1.6, Mysql and MikroTik NAS. I'm configuring my radius 1 session for every 1 user : +----+---------------+---------------------------+-----+-------------+ | id | UserName | Attribute | op | Value | +----+---------------+---------------------------+-----+--------------+ | 57 | rsa@idola | Simultaneous-Use | := | 0 | | 42 | rsa@idola | Password | == | denpasar | +----+---------------+---------------------------+----+---------------+ The problem is sometimes user cannot login even no session rsa@idola user in Mikrotik NAS connected, I check with radwho, its shown below : [root@ladps ~]# radwho Login Name What TTY When From Location tyl@idola tyl@idola PPP S232 Mon 17:43 129.47.26 172.16.30.79 awn@idola awn@idola PPP S245 Mon 19:53 129.47.26 172.16.30.246 gde@idola gde@idola PPP S189 Mon 13:12 129.47.26 172.16.30.255 afy@idola afy@idola PPP S218 Mon 13:20 129.47.26 172.16.30.252 no session rsa@idola in that list… is'nt it ? but rsa@idola still couldnot login, this is the log from radiusd –X : Ready to process requests. Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 129.47.26.123:1088, id=8, length=179 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 252 NAS-Port-Type = Ethernet User-Name = "rsa@idola" Calling-Station-Id = "00:18:DE:69:F1:F3" Called-Station-Id = "VLAN TEST" NAS-Port-Id = "vlan_TEST" MS-CHAP-Domain = "idola" CHAP-Challenge = 0x0270131ced4933d4f26646e2946b2192 CHAP-Password = 0x016806e0edb33d434bc59078e233381b6c NAS-Identifier = "ROUTER INDUK" NAS-IP-Address = 129.47.26.123 Mikrotik-Realm = "idola" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "idola" for User-Name = "rsa@idola" rlm_realm: No such realm "idola" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 163 users: Matched entry DEFAULT at line 183 users: Matched entry DEFAULT at line 195 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: 'rsa@idola' rlm_sql (sql): sql_set_user escaped user --> 'rsa@idola' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rsa@idola' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'rsa@idola' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'rsa@idola' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'rsa@idola' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "monthlycounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "mbcounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailymbcounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "monthlymbcounter" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password matches local User-Password Processing the session section of radiusd.conf modcall: entering group session for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'rsa@idola' modcall[session]: module "radutmp" returns ok for request 1 modcall: leaving group session (returns ok) for request 1 Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 1 rlm_sql (sql): Processing sql_postauth radius_xlat: 'rsa@idola' rlm_sql (sql): sql_set_user escaped user --> 'rsa@idola' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('','rsa@idola', 'Chap-Password', 'Access-Reject', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass,reply, date) values ('', 'rsa@idola', 'Chap-Password', 'Access-Reject', NOW()) rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 modcall[post-auth]: module "sql" returns ok for request 1 modcall: leaving group REJECT (returns ok) for request 1 Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 129.47.26.123:1088, id=8, length=179 Sending Access-Reject of id 8 to 129.47.26.123 port 1088 Reply-Message := "\r\nYou are already logged in - access denied\r\n\n" Waking up in 1 seconds... I have already checked my NAS and there is no session for rsa@idola, I try with radzap and still not working… Any help please… thanks trio

6 13

RE: Freeradius-Users Digest, Vol 25, Issue 68
by khursheed Ahmed 16 May '07

16 May '07

1 0

None
by Александр Никулин 16 May '07

16 May '07

Hello How can I get all values of Cisco AVpair from NAS if there are multiple values, for example May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 54 "faxrelay-start-time=16:03:58.021 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 59 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 53 "faxrelay-stop-time=16:04:37.161 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 38 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 32 "faxrelay-max-jit-buf-depth=506" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 33 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 27 "faxrelay-jit-buf-ovflow=0" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 41 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 35 "faxrelay-init-hs-mod=V.27ter/4800" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 39 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 33 "faxrelay-mr-hs-mod=V.27ter/4800" and so on.

4 7