September 2008 - Freeradius-Users - lists.freeradius.org

Unknown AVPs
by Jeffrey Sewell 18 Sep '08

18 Sep '08

I've got a FreeRADIUS server that takes in Accounting data that is proxied to it from another server. In the Accounting packets I see AVPs that are tagged "Unknown-Attribute." I assume that's because either the originating server or the FreeRADIUS server is missing a dictionary file/entry to identify the Attribute. First question: is that assumption correct? If so, who sets that Attribute, the originator or the target? And more generally: as these are written to the MySQL DB I see that they are pulled off the packet and stored as variables that are accessible in the sql.conf file for example: AcctSessionTime = '%{Acct-Session-Time}' Is that variable pulled directly from the packet? So that whatever attribute is in the packet, it will be named %{whatever} ? I've got other data coming in that I need to store in the SQL DB and suppose that I'll need to modify the sql.conf and the radacct table in order to get them in there. Any insights/thoughts/direction would be appreciated. Jeff

2 9

XP windows Validating identity blues
by scott woodard 18 Sep '08

18 Sep '08

Hi Everyone, I just followed the steps @ http://www.howtoforge.com/wifi-authentication-accounting-with-freeradius-on… This is the output of radiusd -X -z [root@wifi ~]# radiusd -X -z Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "windose" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.0.201:2048, id=0, length=123 User-Name = "scott" NAS-IP-Address = 10.10.0.201 Called-Station-Id = "001d7e2fa43c" Calling-Station-Id = "0014a4439321" NAS-Identifier = "001d7e2fa43c" NAS-Port = 49 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a0173636f7474 Message-Authenticator = 0xc091f4c08c545d39e360712a422185d2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "scott", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "scott" rlm_realm: Proxying request from user scott to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: Request is supposed to be proxied to Realm NULL. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 There was no response configured: rejecting request 0 Server rejecting request 0. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 10.10.0.201 port 2048 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 48d17a05 Nothing to do. Sleeping until we see a request. The windows box requests credentials for connection to the network. I am using scott passwd scott as listed in the users in radius directory. What I am missing ? Thanks in advance. Scott

2 3

redundant ippools using rlm_ippool in v1.1.3
by Matthias Witte 18 Sep '08

18 Sep '08

I am stuck with v1.1.3 in this case, otherwise I would use rlm_sqlippool. I need to assign IP addresses depending on the NAS the user comes in: 'huntgroups' contains lns0x NAS-IP-Address == a.b.c.x lns0y NAS-IP-Address == a.b.c.y In 'users' I set 'Post-Auth-Type' depending on 'Huntgroup-Name' (Userdata are in a MySQL database): DEFAULT Huntgroup-Name == "lns0x", Post-Auth-Type := LNS0X Fall-Through = Yes DEFAULT Huntgroup-Name == "lns0y", Post-Auth-Type := LNS0Y Fall-Through = Yes The modules section in radiusd.conf has the ippool definitions like # subnets on lns0x ippool lns0x-00 { range-start = 192.168.111.1 range-stop = 192.168.111.6 netmask = 255.255.255.248 cache-size = 6 session-db = /var/cache/freeradius/db.pool_lns0x_00 ip-index = /var/cache/freeradius/db.index_lns0x_00 override = yes maximum-timeout = 0 } ippool lns0x-01 { range-start = 192.168.111.9 range-stop = 192.168.111.14 netmask = 255.255.255.248 cache-size = 6 session-db = /var/cache/freeradius/db.pool_lns0x_01 ip-index = /var/cache/freeradius/db.index_lns0x_01 override = yes maximum-timeout = 0 } # subnets on lns0y ippool lns0x-00 { range-start = 192.168.112.1 range-stop = 192.168.112.6 netmask = 255.255.255.248 cache-size = 6 session-db = /var/cache/freeradius/db.pool_lns0y_00 ip-index = /var/cache/freeradius/db.index_lns0y_00 override = yes maximum-timeout = 0 } ippool lns0x-01 { range-start = 192.168.112.9 range-stop = 192.168.112.14 netmask = 255.255.255.248 cache-size = 6 session-db = /var/cache/freeradius/db.pool_lns0y_01 ip-index = /var/cache/freeradius/db.index_lns0y_01 override = yes maximum-timeout = 0 } My first attempt on the post-auth Section looked like Post-Auth-Type LNS0X { redundant { lns0x-00 lns0x-01 } } Post-Auth-Type LNS0Y { redundant { lns0y-00 lns0y-01 } } This does not work because the 'Pool-Name' check attribute is missing in users. If I set Pool-Name in users, addresses are only returned from the matching poolname module until it is depleted, the alternative pool module is not called. Is it possible to achieve the intended setup with rlm_ippool or is this only possible with rlm_sqlippool? Mit freundlichem Gru�, -- Matthias Witte - witte(a)netzquadrat.de Telefon: +49 (0)211-30 20 33-18 Telefax: +49 (0)211-30 20 33-22 [netzquadrat] GmbH - Gladbacher Str. 74 - 40219 D�sseldorf HRB D�sseldorf 36121 - Gesch�ftsf�hrer: Thilo Salmon, Tim Mois Steuernummer: 106/5719/1836, Umsatzsteuer-ID: DE246863050 billiger-telefonieren.de - billiger-surfen.de - stromseite.de - sms.de

2 3

Debugging access point behaviour
by Giovanni Lovato 18 Sep '08

18 Sep '08

First of all, this is not a FR problem. I use FR 2.1.0 and it works very well! BTW, I'm trying to configure an access point to authenticate against FR, but the process fails. Maybe someone here can tell me where is the issue, so I attach the log of FR... Some details: OS: Debian Lenny FR version: 2.1.0 Authentication backend: LDAP Authentication method: WPA2-EAP TLS Note: authentication works well with other access points. Thank you! -- Giovanni Lovato <giovanni.lovato(a)aldu.net>

1 0

Re: Re: No authenticate method (Auth-Type) configuration found
by Jason 18 Sep '08

18 Sep '08

>>This is a pap request. >>preprocess, chap, mschap, suffix, eap - no pap listed in authorize section. List it last. >>Ivan Kalik >>Kalik Informatika ISP Yes, There are pap section in the configure file. but have error, too. Now, I use another version of freeradius,1.1.7, and test, every thing is OK now！ Thanks!

1 0

No authenticate method (Auth-Type) configuration found
by browan.jason 18 Sep '08

18 Sep '08

Hi all, I have got some problems when use freeradius. freeradius version: FreeRADIUS Version 1.0.5, for host , built on Sep 9 2008 at 11:11:51 My system: Fedora core 4 Kernel version: 2.6.11-1.1369_FC4 When i test the radius server, I have add something into /usr/local/etc/raddb/users like this: test1 Auth-Type := Local, User-Password == "123456" User-Password =="123456", Service-Type=Framed-User, Framed-Protocol=PPP, Framed-IP-Address=192.168.121.99, Framed-IP-Netmask=255.255.252.0 Add this into clients.conf: client 192.168.121.43{ secret = mmmmmm shortname = remote nastype = other } Then start the freeradius server and use radtest to check this server: radtest test1 123456 192.168.121.49 0 mmmmmm 192.168.121.49 is my server's IP, My local machine IP address is 192.168.121.43. But, It always failed! Following is the client's information: Sending Access-Request of id 161 to 192.168.121.49:1812 User-Name = "test1" User-Password = "123456" NAS-IP-Address = freepp NAS-Port = 0 rad_recv: Access-Reject packet from host 192.168.121.49:1812, id=161, length=20 And radius server's debuf information: rad_recv: Access-Request packet from host 192.168.121.43:32768, id=161, length=57 User-Name = "test1" User-Password = "123456" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 modcall: group authorize returns ok for request 2 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 161 to 192.168.121.43:32768 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 161 with timestamp 48d1f126 Nothing to do. Sleeping until we see a request. As you see, every time he told me "No authenticate method(Auth-Type) configuration found for the request......", I don't konw why? Could you please give me some help? Many Thanks! 2008-09-18 Jason Zhang

5 5

Authentication flow
by Sudarshan Soma 18 Sep '08

18 Sep '08

I have three authentication modules -- pam_radius_auth.so (for remote authentication) -- pam_unix ( unix local authentication) -- pam_opie (challenge/response) and other accounting modules such as pam_abl, which does user lockout/iplocking. I would like to choose a better authentication for access to my service: These are my requirements/clarifications: -- An intruder should not know how his authentication has failed(due to user locking or IP address locking or wrong passwd for remote authenticaon or for local authenticaion ), but only SecurityAdmin can see them in logs. Intruder just gets error as LOGIN failed. -- While logging to the service, should i allow user to specify authentication type such as challenge-response or local, if Radius servers are not reachable. Will this cause any kind of break in secure authentication process or does ti contrast with above. I am thinking of this to help legitimate users to get logged into the service I am kind of lost here, Can anyone please advise the better approach her. Many Thanks

2 1

Whats the best CA to use?
by jasoneswan 18 Sep '08

18 Sep '08

Are there any CA out there that will automatically be trusted by almost any client we throw at it? our problem is that when logging in each client has to specifically say "I trust this CA" when doing PEAP -- View this message in context: http://www.nabble.com/Whats-the-best-CA-to-use--tp19543005p19543005.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

LDAP Group membership check not working after upgrade to Windows Server 2003
by kesm0724 17 Sep '08

17 Sep '08

Hello All, I had FreeRADIUS Version 2.0.5 working fine until I upgraded our domain this past weekend to Server 2003. When I try to authenticate to our configured devices this morning I see the following generic error in the debug: rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fails The odd part about it is that I still have our previous 2000 domain controllers in place but it appears LDAP group checking is not working. I have only dcpromo'd the new 2003 controllers and have not made them global catalogs. Would anyone have any idea why my group checking would no longer be working? With LDAP debug turned on....not much more informative: rlm_ldap: performing user authorization for voila\webtest expand: (sAMAccountName=%{mschap:User-Name:-%{User-Name}}) -> (sAMAccountName=webtest) expand: dc=voila,dc=com -> dc=voila,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to control.voila.com:389, authentication 0 rlm_ldap: bind as cn=testuser,cn=users,dc=voila,dc=com/mypass to control.voila.com:389 rlm_ldap: waiting for bind result ... request done: ld 0x98c6708 msgid 1 rlm_ldap: Bind was successful rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=webtest) request done: ld 0x98c6708 msgid 4 request done: ld 0x98c6708 msgid 2 rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [voila\\webtest/<via Auth-Type = mschap>] (from client Test port 1176 cli xxxxxxxxx) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> voila\webtest Complete Debug: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host xxxxxxxxxxx port 1059, id=117, length=191 User-Name = "voila\\testuser" NAS-Port = 1175 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "xxxxxxxxxxx" Calling-Station-Id = "xxxxxxxxxx" Tunnel-Client-Endpoint:0 = "xxxxxxxxxxxxx" MS-CHAP-Challenge = 0x949d0f260c0a83423f766c1ba4786e6f MS-CHAP2-Response = 0x00008c51e82b0b401baffa11bbe4804841af0000000000000000b90e47cdede219ef0896903add05ea5ada973c6c8d58d431 NAS-IP-Address = xxxxxxxxxx NAS-Port-Type = Virtual +- entering group authorize ++[preprocess] returns ok expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/xxxxxxxxx/auth-detail-20080915 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/xxxxxxxxxx/auth-detail-20080915 expand: %t -> Mon Sep 15 11:52:00 2008 ++[auth_log] returns ok ++[chap] returns noop rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok rlm_realm: No '@' in User-Name = "voila\testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '"' in User-Name = "voila\testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() expand: dc=voila,dc=com -> dc=voila,dc=com expand: (sAMAccountName=%{mschap:User-Name:-%{User-Name}}) -> (sAMAccountName=testuser) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to control.voila.com:389, authentication 0 rlm_ldap: bind as cn=project,cn=users,dc=voila,dc=com/mypass to control.voila.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=testuser) rlm_ldap: ldap_search() failed: Operations error rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for voila\testuser expand: (sAMAccountName=%{mschap:User-Name:-%{User-Name}}) -> (sAMAccountName=testuser) expand: dc=voila,dc=com -> dc=voila,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to control.voila.com:389, authentication 0 rlm_ldap: bind as cn=project,cn=users,dc=voila,dc=com/mypass to control.voila.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=testuser) rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [voila\\testuser/<via Auth-Type = mschap>] (from client Test port 1175 cli xxxxxxxxxxxxx) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> voila\testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 117 to xxxxxxxxxxxx port 1059 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +18 Ready to process requests. ___________ Freeradius - 2.0.5 [root@ras modules]# rpm -qa | grep openldap openldap-devel-2.3.27-8.el5_2.4 openldap-2.3.27-8.el5_2.4 [root@ras modules]# rpm -qa | grep samba samba-common-3.0.28-1.el5_2.1 samba-3.0.28-1.el5_2.1 samba-client-3.0.28-1.el5_2.1 ______________________________________________ LDAP.CONF ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "control.voila.com" identity = "cn=testuser,cn=users,dc=voila,dc=com" password = mypass basedn = "dc=voila,dc=com" # CHANGED filter object search to look for 'SamAccountName' # filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" filter = "(sAMAccountName=%{mschap:User-Name:-%{User-Name}})" # filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 3 # # seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1 # # This subsection configures the tls related items # that control how FreeRADIUS connects to an LDAP # server. It contains all of the "tls_*" configuration # entries used in older versions of FreeRADIUS. Those # configuration entries can still be used, but we recommend # using these. # tls { # Set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # # The StartTLS operation is supposed to be # used with normal ldap connections instead of # using ldaps (port 689) connections start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # Certificate Verification requirements. Can be: # "never" (don't even bother trying) # "allow" (try, but don't fail if the cerificate # can't be verified) # "demand" (fail if the certificate doesn't verify.) # # The default is "allow" # require_cert = "demand" } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "User-Password" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap # Set password_attribute = nspmPassword to get the # user's password from a Novell eDirectory # backend. This will work ONLY IF FreeRADIUS has been # built with the --with-edir configure option. # # See also the following links: # # http://www.novell.com/coolsolutions/appnote/16745.html # https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.S… # # Novell may require TLS encrypted sessions before returning # the user's password. # # password_attribute = User-Password # Un-comment the following to disable Novell # eDirectory account policy check and intruder # detection. This will work *only if* FreeRADIUS is # configured to build with --with-edir option. # edir_account_policy_check = no # # Group membership checking. Disabled by default. # groupname_attribute = cn #groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_filter = "(|(&(objectClass=group)(member=%{check:LDAP-UserDn}))(&(objectClass=GroupOfNames)(member=%{check:LDAP-UserDn})))" groupmembership_attribute = memberOf # compare_check_items = yes do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # # THIS WILL ONLY WORK FOR PAP AUTHENTICATION. # # THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes # ldap_debug: debug flag for LDAP SDK # (see OpenLDAP documentation). Set this to enable # huge amounts of LDAP debugging on the screen. # You should only use this if you are an LDAP expert. # # default: 0x0000 (no debugging messages) # Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS) ldap_debug = 0x0028 ______________________________________________________ Samba / Windbind responses: [root@ras modules]# wbinfo -t checking the trust secret via RPC calls succeeded [root@ras modules]# wbinfo -a testuser%mypass plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user testuser%mypass with plaintext password challenge/response password authentication succeeded wbinfo -u and wbinfo -g enumerate all users/groups. -- View this message in context: http://www.nabble.com/LDAP-Group-membership-check-not-working-after-upgrade… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

radiusd dead but pid file exists
by Charlie B 17 Sep '08

17 Sep '08

Sep 15 01:07:58 rad1 kernel: radiusd[26743] general protection ip:44216fc sp:b57fe040 error:0 in libcrypto.so.0.9.8g[4398000+137000] Sep 17 08:18:21 rad1 kernel: radiusd[536] general protection ip:44216fc sp:b75f5040 error:0 in libcrypto.so.0.9.8g[4398000+137000] Help, any idea what is going on with this error? Everything other than radius is running fine however radius is dead and unresponsive. fedora 9 2.6.25.10-86.fc9.i686 samba-common-3.2.1-0.18.fc9.i386 samba-3.2.1-0.18.fc9.i386 samba-winbind-3.2.1-0.18.fc9.i386 samba-client-3.2.1-0.18.fc9.i386 freeradius-perl-2.0.5-2.fc9.i386 freeradius-krb5-2.0.5-2.fc9.i386 freeradius-ldap-2.0.5-2.fc9.i386 freeradius-2.0.5-2.fc9.i386 freeradius-utils-2.0.5-2.fc9.i386 freeradius-libs-2.0.5-2.fc9.i386

3 3