April 2008 - Freeradius-Users - lists.freeradius.org

Ascend-Data-Filter with srcip from ippool
by Andreas Kalb (akalb) 02 Apr '08

02 Apr '08

Hello, I'm trying to use Ascend-data-filters together with IP-pool DEFAULT Pool-Name := test_pool Fall-Through = Yes DEFAULT User-Name := "test_...", Cleartext-Password := test Service-Type = Framed-User, Framed-Protocol = PPP, Session-Timeout = 65000, Idle-Timeout = 3600, Ascend-Maximum-Time = 64000, Ascend-Idle-Limit = 3600, Ascend-Data-Filter := "ip in forward srcip %{Framed-IP-Address}/32 dstip 1.1.1.2/32" The pool is working well, but the filter doesn't: Login OK: [test_001/test] (from client bb-10k port 808583209) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Searching for an entry for nas/port: 172.16.1.7/808583209 rlm_ippool: Found a stale entry for ip/port: 172.16.100.135/808583209 rlm_ippool: num: 0 rlm_ippool: Searching for an entry for nas/port: 172.16.1.7/808583209 rlm_ippool: Allocating ip to nas/port: 172.16.1.7/808583209 rlm_ippool: num: 1 rlm_ippool: Allocated ip 172.16.103.107 to client on nas 172.16.1.7,port 808583209 modcall[post-auth]: module "test_pool" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 195 to 172.16.1.7 port 21646 Service-Type = Framed-User Framed-Protocol = PPP Session-Timeout = 65000 Idle-Timeout = 3600 Ascend-Maximum-Time = 64000 Ascend-Idle-Limit = 3600 Ascend-Data-Filter := "ip in forward dstip 1.1.1.2/32 0" Framed-IP-Address = 172.16.103.107 Framed-IP-Netmask = 255.255.255.0 Looks like IP is taken from pool after users-file got processed. I wouldn't know how to change that order or where to add the filter then. Pls let me know whether this should work in some way and how to configure it then? Kind Regards, Andreas

2 11

proxy.conf and virtual_server
by Marc Boisis-Delavaud 01 Apr '08

01 Apr '08

Hello, I have two virtual server which listen on the same IP. According to realm in proxy.conf, I wich to proxy on virtual1 or virtual2. Is it possible to write this in proxy.conf ? realm toto { "proxy to virtual_server" = virtual1 }

2 2

packet of disconnect for pptpd
by sina borrami 01 Apr '08

01 Apr '08

hi ho can i send a packet of disconnect with radclient for pptpd

1 0

Two authorize instance
by Guillaume Chartrand 01 Apr '08

01 Apr '08

Hi everybody, I use freeradius 2.0.0 on red hat enterprise 3 AS and I set the authorize section to check the user credential with an sql database. This configuration works. But I want to know and how to do that if it's possible, if the user isn't the sql database, can freeradius check another database, like an ldap database. So when the user is in the sql database he gain access, if not he look in a ldap database and if he are present with valid credential, he gain access. Here my current authorize and authentification section : authorize { preprocess chap mschap unix suffix sql eap expiration logintime pap } authenticate { ntlm_auth Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } ---------------------------- Guillaume Chartrand Technicien informatique Cégep régional de Lanaudière Centre administratif, Repentigny (450) 470-0911 poste 7218

2 2

Radius and AD integration
by Ronny Egner 01 Apr '08

01 Apr '08

Hi, i recently installed freeradius to authenticate our oracle databases against active directory (AD). With 1.x everything worked fine. After an update (it is still experimental) to 2.0.3 i am getting the following messages when authenticating (see below for full startup logging): "WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly?" I´ve searched the net but i was unable to find an answer for my situation. Regadless of this message to user is granted access to the database is the password correct. If it is incorrect the access is denied. The filter is designed to check if the account is locked thus preventing locked users (in the ad) from connecting. ===== FULL LOG ====== FreeRADIUS Version 2.0.3, for host x86_64-unknown-linux-gnu, built on Apr 1 2008 at 08:16:20 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = no } } client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 172.23.0.9 { require_message_authenticator = no secret = "testing123" shortname = "agamemnon" } client 172.23.0.218 { require_message_authenticator = no secret = "testing123" shortname = "enterprise" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "ads01.siv.de" port = 389 password = "test" identity = "cn=ronnytest,cn=users,dc=siv,dc=de" net_timeout = 1 timeout = 10 timelimit = 10 tls_mode = no start_tls = no tls_require_cert = "allow" basedn = "ou=siv benutzer,DC=siv,DC=de" filter = "(&(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))))" base_filter = "(objectclass=radiusprofile)" password_attribute = "userPassword" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x643160 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 172.23.0.218 port = 0 } Listening on authentication address 172.23.0.218 port 1812 Listening on proxy address 172.23.0.218 port 1814 Ready to process requests. User-Name = "REGNER" User-Password = "157157" +- entering group authorize ++[preprocess] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for REGNER WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))))) -> (&(&(sAMAccountName=REGNER)(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))))) expand: ou=siv benutzer,DC=siv,DC=de -> ou=siv benutzer,DC=siv,DC=de rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ads01.siv.de:389, authentication 0 rlm_ldap: bind as cn=ronnytest,cn=users,dc=siv,dc=de/test to ads01.siv.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=siv benutzer,DC=siv,DC=de, with filter (&(&(sAMAccountName=REGNER)(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))))) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user REGNER authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rad_check_password: Found Auth-Type ldap auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: login attempt by "REGNER" with password "157157" rlm_ldap: user DN: CN=Ronny Egner,OU=SIV Benutzer,DC=siv,DC=de rlm_ldap: (re)connect to ads01.siv.de:389, authentication 1 rlm_ldap: bind as CN=Ronny Egner,OU=SIV Benutzer,DC=siv,DC=de/157157 to ads01.siv.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user REGNER authenticated succesfully ++[ldap] returns ok Login OK: [REGNER/157157] (from client agamemnon port 0) Finished request 0. Going to the next request Waking up in 4.9 seconds. -- Mit freundlichen Grüßen Ronny Egner Diplom-Ingenieur (BA) Systeme & Service Oracle DBA Telefon: +49 381 2524-422 Telefax: +49 381 2524-399 SIV.AG - Service für Informationsverarbeitung AG Hauptsitz: Konrad-Zuse-Str. 1, 18184 Roggentin Handelsregister: Amtsgericht Rostock, HRB 8677, Ust.-IdNr.: DE 137477226 Vorstand: Jörg Sinnig (Vorsitzender), Andreas Lehmann, Arno Weichbrodt Aufsichtsratsvorsitzender: Thomas Huth ************************************************************************* Aus Rechtsgründen ist die in dieser E-Mail gegebene Information nicht rechtsverbindlich. Eine rechtsverbindliche Bestätigung reichen wir Ihnen auf Anforderung in schriftlicher Form nach. Diese Nachricht ist ausschließlich für den Adressaten oder dessen Vertreter bestimmt. The information contained in this email is not legally binding. At your request, we will provide you with a legally binding confirmation in written form. This message is intended solely for the addressee, entity to which the email is addressed or the authorised agent. *************************************************************************

2 2

hints file and proxy.conf
by Mikhail Novikov 01 Apr '08

01 Apr '08

Hello. This is part of proxy.conf file realm DEFAULT { type = radius authhost = radius.company1.com:1600 accthost = radius.company1.com:1601 secret = testing123 } realm DEFAULT { type = radius authhost = radius.company2.com:1600 accthost = radius.company2.com:1601 secret = testing123 } Requests to radius.company1.com should be modified by rules in hints file. But requests to radius.company2.com should not. Which option have I to add to turn off modifying attributes for radius.company2.com? Thanks.

1 0

ttls with mschapv2
by Cristian Novac 01 Apr '08

01 Apr '08

Hello all, Given the log I attached, may someone tell me what's the problem authenticating my client(using ttls with mschapv2)? Towards the end of the log I get this: eaptls_verify returned 11 rlm_eap_tls: >>> Unknown TLS version [length 0002] TLS Alert write:fatal:protocol version TLS_accept:error in SSLv3 read client certificate A rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. This may be significant enough for someone experienced to figure out what's the problem. Thank you!

2 1

howto - reply items depending on check items (diffentet groups for different nas-ip-addresses)
by it00x32 01 Apr '08

01 Apr '08

Hi, Here´s my problem: I need to create some user - group memebr model to authenticate with Juniper Netscreen firewalls. Lets say i ve 10 users and 10 different customers with Firewalls. Now i need to give user 1 access to customer 1,2,3 user 2 access to customer 5.7,8 and so on. My idea is to check that with the NAS-IP-Address as the Check item and the NS-User-Group as reply item (authorisation is only granted if the reply NS-User-Group matches the one saved at the netscreen - this works - already tested!) so... somebody know how this can be done...?! i cant use multiple user entries in the users file as only the first is used .. e.g User1 Password == "OVID", NAS-IP-Address == "198.204.32.45" NS-User-Group = "access_gruppe_1" User1 Password = "OVID", NAS-IP-Address == "88.34.34.2" NS-User-Group = "access_gruppe_2" thx for your help! regards tom -- View this message in context: http://www.nabble.com/howto---reply-items-depending-on-check-items-%28diffe… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

Freeradius and OpenLDAP authentication with hashed passwords
by mel 01 Apr '08

01 Apr '08

Hi all, I've managed to setup FreeRadius with OpenLDAP. The passwords however, are hashed (e.g. "{SHA}....") in LDAP. Authenticating directly to LDAP works, but it failed with Freeradius. If the password is in plain-text, authentication is successful. Question: What are the setting in FR that I need to do in order for the authentication to work? - i.e. FR takes the plain-text password, hash it, then compared it with the one in LDAP. freeradius-2.0.1 openldap-2.3.41 Regards, --mel

2 7

SQLIPPOOL/IPPOOL prefix/range format
by rsg 01 Apr '08

01 Apr '08

Hi, SQLIPPOOL requires, maintenance of an IP address table carrying individual IPs Is there a way to handle IP prefixes (prefix/range format) so that in large networks having many different networks could main and utilze this effectively. For example it would be cumbersome if it happens to populate a table with each IP of 10.10.0.0/16. The other query is how would it affect the performance if it happens to scan through the entire table during new ip assignment of a client(e.g. mobile device). On the contrary, Perl has Net::IP for handling ip prefixes which may be better in performance when it comes to large deployments. What is your opinion please ? Is there a way/module to handle this? Thanks a lot for your thoughts/assistance. rg

2 4