October 2008 - Freeradius-Users - lists.freeradius.org

Error in the negotiations
by Martin Silvero 09 Oct '08

09 Oct '08

Any suggestions for this topic guys? thanks!!!

2 1

Ldap group
by Bert Beaudin 09 Oct '08

09 Oct '08

Hello I have ldap working to authencate users to a cisci switch. I now want to limit it to group membership. Any help would be great. Here is what I have in my ldap config for the groups. # Group membership checking. Disabled by default. # groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(object Class=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = "radius" #compare_check_items = yes # do_xlat = yes #access_attr_used_for_allow = yes Here is waht I see in my logs with radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.12.8.230 port 1645, id=35, length=86 User-Name = "bbeaudin" User-Password = "xxxxxxx^" NAS-Port = 194 NAS-Port-Id = "tty194" NAS-Port-Type = Virtual Calling-Station-Id = "10.12.8.71" NAS-IP-Address = 10.12.8.230 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "bbeaudin", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated rlm_ldap: Entering ldap_groupcmp() expand: OU=Employees,DC=yipes,DC=com -> OU=Employees,DC=yipes,DC=com expand: (&(samaccountname=%{user-name})) -> (&(samaccountname=bbeaudin)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to dendc1.yipes.com:389, authentication 0 rlm_ldap: bind as bbeaudin(a)yipes.com/xxxxxxxx to dendc1.yipes.com:389 rlm_ldap: waiting for bind result ... request done: ld 0x121a6760 msgid 1 rlm_ldap: Bind was successful rlm_ldap: performing search in OU=Employees,DC=yipes,DC=com, with filter (&(samaccountname=bbeaudin)) request done: ld 0x121a6760 msgid 2 rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectC lass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUn iqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=radius,dc=yipes,dc=com, with filter (|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUn iqueNames)(uniquemember=))) request done: ld 0x121a6760 msgid 3 rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=Bert Beaudin,OU=IT Staff,OU=Employees,DC=yipes,DC=com, with filter (objectclass=*) request done: ld 0x121a6760 msgid 4 rlm_ldap::ldap_groupcmp: ldap_get_values() failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for bbeaudin expand: (&(samaccountname=%{user-name})) -> (&(samaccountname=bbeaudin)) expand: OU=Employees,DC=yipes,DC=com -> OU=Employees,DC=yipes,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Employees,DC=yipes,DC=com, with filter (&(samaccountname=bbeaudin)) request done: ld 0x121a6760 msgid 5 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Pairs do not match. Rejecting user. rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns reject Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> bbeaudin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 35 to 10.12.8.230 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 35 with timestamp +9 Ready to process requests. Thanks, Bert Beaudin Systems Administrator RelianceGlobalcom Services, Inc. Office:303-785-6641 Cell:303-478-7789 Fax:415-677-9534 bbeaudin(a)relianceglobalcom.com <mailto:bbeaudin@relianceglobalcom.com> www.relianceglobalcom.com <blocked::http://www.yipes.com/>

2 2

Problem with ntlm_auth
by Frederik.Niedernolte＠Bertelsmann.de 09 Oct '08

09 Oct '08

I have finished all steps till "user Auth-Type := ntlm_auth" from http://deployingradius.com/documents/configuration/active_directory.html . With this command I get this error message at the end of "/usr/sbin/freeradius -X": /etc/freeradius/users[1]: Parse error (check) for entry MyUser: Unknown value ntlm_auth for attribute Auth-Type Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[111]: Failed to find module "files". /etc/freeradius/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. } } Errors initializing modules The authenticate section in the /etc/freeradius/sites-enabled/default looks like this (only important part): authenticate { # # NTML_AUTH authentication. Auth-Type ntlm_auth { ntlm_auth } What is wrong and what can I do to solve the problem? Thanks in advance. Best regards, F. Niedernolte

6 23

Proxy when database value is set
by Laar, Johan van de 09 Oct '08

09 Oct '08

I've achieved the following: - A user with a username which contains a realm logs in. - Freeradius checks some radius request values like calling-station-id etc. - Freeradius will give a reject or accept depending on the above query. What I cannot achieve is: - Freeradius must proxy to request to a token server but only when it authenticated the user successfully. Any ideas? Thank you in advance. Regards, Johan van de Laar

2 1

RE: EAP-TLS & computer account(not user)
by Guk Victor 09 Oct '08

09 Oct '08

2 1

Startdate for sessions in FreeRadius with MySql?
by Bladan2000 09 Oct '08

09 Oct '08

Hello! We're using FreeRadius 1.1.7 along with MySql on an Ubuntu server. We have a web application to create users for FreeRadius and administrators can set the expire date for when a session should expire. This is achieved with the "Expiration" attribute in the table called RadCheck in the MySql database. However, a customer would like to be able to also set a "start"-date for when the session should become valid i.e. if I set 2008-10-06 it won't be possible to log in before that date. I haven't found a way to do this in FreeRadius. Does anyone have a solution for this? I thought that it might exist an attribute for "Start" as well when there is one for "Expire" but I haven't found any. The only solution I can come up with is some kind of own customized que handling for this altough I would prefer a simple attribute. Any thoughts? Johan -- View this message in context: http://www.nabble.com/Startdate-for-sessions-in-FreeRadius-with-MySql--tp19… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

config mysql with Linux PAM for SSH
by BADAOUI Nasr-Eddine (P) 09 Oct '08

09 Oct '08

Hi all, I've installed an authentication's solution using freeradius, with mysql database on RedHat 4.7. I would like users logging into other Linux Machines to have their login/passwd authenticated using mysql on freeradius server (SSH) I've seen that to authenticate successfully, the login id has to be defined locally on client Linux machines. In summary, is it mandatory to have the login id defined in the client linux machine ? other solutions ? thanks, Nasr-Eddine BADAOUI

3 2

Re: How to forward MAC-authentiation-requests over a FreeRADIUS-proxy to a FreeRADIUS-server?
by Raphael Brüngel 09 Oct '08

09 Oct '08

Hello again, here is the info I collected concerning the “It still doesn’t work” section: ***** FreeRADIUS-proxy ************************************************ ***** users: Standard entry of localhost and DEFAULT Proxy-To-Realm := "RADIUS_REALM" ***** clients.conf: client 192.168.1.58 { secret = testing123 } ***** debug: main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.58 { require_message_authenticator = no secret = "testing123" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server RADIUS_SERVER { ipaddr = 192.168.1.61 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool RADIUS_SERVER_POOL { type = fail-over home_server = RADIUS_SERVER } realm RADIUS_REALM { auth_pool = RADIUS_SERVER_POOL } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "proxy" ipaddr = 192.168.1.80 port = 1812 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on proxy address 192.168.1.80 port 1812 Ready to process requests. radtest: Local on the proxy: radtest 00-3F-08-27-10-11 00-3f-08-27-10-11 192.168.1.80 1812 testing123 Logfile of proxy: Error: Invalid packet code 1 sent to a proxy port from home server 192.168.1.80 port 40341 - ID 96 : IGNORED From FR-server to proxy: 00-3F-08-27-10-11 00-3f-08-27-10-11 192.168.1.80 1812 testing123 Logfile of proxy: Error: Invalid packet code 1 sent to a proxy port from home server 192.168.1.61 port 42477 - ID 19 : IGNORED ***** FreeRADIUS-server ************************************************ ***** users: Standard entry of localhost ***** clients.conf: client 192.168.1.80 { secret = testing123 } The FreeRADIUS-Server runs fine. I tested it with radtest and with some clients connected to my switch. ***** Comment to the proxy.conf ************************************************ The switch was not configured as home server as you can see – that’s the weird thing. You said that the proxy port is 1814 but the authentication port 1812 is not used by the proxy, correct? Is it incorrect to use port 1812 to receive proxy requests when the switch sends it to 1812, too? Thank you for your help! Best regards, Raphael Brüngel

3 2

On/Off packets
by AHMED KHIDR 08 Oct '08

08 Oct '08

Hi All , Please any one have an idea about this , I am using cisco 1721 to terminate PPPOE sessions and authentication by freeradius , when I reload the router there is no *On/Off* packets sent from cisco , so the users still online on database , How to make my cisco router send *On/Off* packets to radius ?? Regards

3 2

Install error
by Olavo Dietrich 08 Oct '08

08 Oct '08

installing v.2.1.1 I got errors. Any clues ? thanks Duan ./configure ... ... gcc version 4.1.2 20071124 (Red Hat 4.1.2-42) configure:3000: $? = 0 configure:3007: g++ -V >&5 g++: '-V' option must have argument configure:3010: $? = 1 configure:3013: checking whether we are using the GNU C++ compiler configure:3042: g++ -c conftest.cpp >&5 configure:3048: $? = 0 configure:3065: result: yes configure:3070: checking whether g++ accepts -g configure:3100: g++ -c -g conftest.cpp >&5 configure:3106: $? = 0 - Ignored: configure:3205: result: yes configure:3235: checking how to run the C preprocessor configure:3275: gcc -E conftest.c configure:3281: $? = 0 configure:3312: gcc -E conftest.c conftest.c:8:28: error: ac_nonexistent.h: No such file or directory configure:3318: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | /* end confdefs.h. */ | #include <ac_nonexistent.h> configure:3351: result: gcc -E configure:3380: gcc -E conftest.c configure:3386: $? = 0 configure:3417: gcc -E conftest.c conftest.c:8:28: error: ac_nonexistent.h: No such file or directory configure:3423: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | /* end confdefs.h. */ | #include <ac_nonexistent.h> ... .. ... configure:4417: checking whether byte ordering is bigendian configure:4450: gcc -c -g -O2 conftest.c >&5 configure:4456: $? = 0 configure:4488: gcc -c -g -O2 conftest.c >&5 conftest.c: In function 'main': conftest.c:25: error: 'not' undeclared (first use in this function) conftest.c:25: error: (Each undeclared identifier is reported only once conftest.c:25: error: for each function it appears in.) conftest.c:25: error: expected ';' before 'big' configure:4494: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | /* end confdefs.h. */ | #include <sys/types.h> | #include <sys/param.h> | | int | main () | { | #if BYTE_ORDER != BIG_ENDIAN | not big endian | #endif | | ; | return 0; | } ... ...

7 16