November 2009 - Freeradius-Users - lists.freeradius.org

Remote access control in freeradius with mysql
by cktan 30 Nov '09

30 Nov '09

Dear all, I've a freeradius server running with LDAP as the Authentication and Authorization where else Accounting running on Mysql. It was working well at the moment and I'm looking to migrate from LDAP to run fully in Mysql. Question is I need to have control on remote access for certain users. In LDAP, I used to have "dialupAccess" attribute to control the access for user and I can't find it in Mysql. I come across to radreply table but not sure which attribute should I use to have authorization for user to access. Looking for your kind information in this matter. Regards -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 1

Re: Exec and ntlm_auth
by freeradius＠corwyn.net 30 Nov '09

30 Nov '09

At 05:57 PM 11/25/2009, Rick Steeves wrote: >I have the cisco configured per that guide already . However, I >don't want to put user / password info in the users file, because >that would defeat part of the model of centralized authentication to >AD. So I want that to feed authentication back to radius > AD as well. Perhaps my question is how to integrate Per User Privilege Level You can also send the privilege level (enable mode is level 15) for individual users as a reply item to automatically put them into that level with cisco-avpair = "shell:priv-lvl=15" You can do this with an entry in your users file similar to the following youruser Cleartext-Password := "somepass" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" into the AD part, instead of into the users file? I had planned to just use AD security groups .... rick >Rick

3 8

:= Condition deprecated
by Casartello, Thomas 30 Nov '09

30 Nov '09

I've been getting the message about the := condition being deprecated soon. I was wondering if there's going to be another alternative way to accomplish the following: In my users file I have this: DEFAULT Airespace-Wlan-Id == 3, Auth-Type := ldap DEFAULT Essentially what this accomplishes is that if that attribute is 3, then they're trying to authenticate through one of our ssids which has web authentication. When it's web authentication it comes through as PAP, and I have this line to tell it to use LDAP authentication. The clients on the other SSID (Which would have the number 4) authenticate via 802.1x so those will come through as PEAP-MSCHAPv2. I just want to know an alternative way I can accomplish this once the ":=" conditional goes away. Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College (413) 572-8245 Red Hat Certified Technician (RHCT)

4 5

EAP advanced auth. methods problem
by Tomas Pelka 29 Nov '09

29 Nov '09

Hey guys, have a problem with "advanced" EAP authentication methods including PEAP, EAP-TLS, EAP-TTLS-MD5/MSCHAPV2. Certs was created with the makefile included in freeradius sources. All my experiments ending with: decapsulated EAP packet (code=4 id=4 len=4) from RADIUS server: EAP Failure Runnin as, for example ./eapol_test -c test_tls.conf -a192.168.56.3 -p1812 -stesting123 -r1 Output, eap.conf and test_tls.conf attached. Simple PAP and EAP-MD5 working properly, other EAP methods (PEP, TLS, TTLS-MD5, TTLS-MSCHAPV2) crashing on failure mentioned above. Thanks for your advices. -- Tom

5 18

Error: rlm_radutmp
by Wagner Pereira 27 Nov '09

27 Nov '09

Hi, folks. I'm trying to authenticate in a freeradius server, installed on a Debian 5.0 lenny x86_64. The freeradius version is 2.0.4 That is the message logged in my radius.log : Fri Nov 27 11:52:13 2009 : Error: rlm_radutmp: Logout for NAS cisco6500 port 0, but no Login record And my authentication method is the Debian /passwd one. Simple like that. Thanks a lot for some attention in this case. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Fone@RNP 1015-8902

2 9

LDAP auth in two sources
by Vladimir Mendelevich 27 Nov '09

27 Nov '09

Hello! radiusd: FreeRADIUS Version 1.1.3, for host x86_64-redhat-linux-gnu, built on Apr 25 2007 at 09:04:23 I need to make an authorization of some RADIUS clients in LDAP by RADIUS. Clients need only to check passwords. I can check this in ONE LDAP server at a time without problems. It's work fine. But i need some different. I need to check user/password in TWO different LDAP server. If ANY of LDAPs tell "password is ok" RADIUS must accept this userid/passwd pair. Userlists in this two LDAP have some overlap. Most (but not all) of the users presents in BOTH of LDAP servers. Passwords between LDAP servers are different. With curent configuration i get this: if username aren't found in first LDAP lets proceed to the next if username aren't found in second LDAP lets DENY access if username is found in first LDAP and password is accepted by first LDAP lets ALLOW access. if username is found in first LDAP and password aren't accepted by first LDAP lets DENY access. RADIUS doesn't check password in the second LDAP server. I know why but i doesn't know how to change this behavior. this is how looks users: --- LDAP1: uid=userid,o=org1 LDAP2: uid=userid,o=org2 --- As you can see organization is different in this two LDAP servers. I check this with "radtest" utility. /etc/raddb/radiusd.conf ------------------ modules { ldap tam { server = "ldap1.ts" basedn = "o=org1" filter = "(uid=%{User-Name})" authtype = tam start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no do_xlat = no access_attr_used_for_allow = no set_auth_type = yes } ldap lotus { server = "ldap2.ts" basedn = "o=org2" filter = "(uid=%{User-Name})" authtype = lotus start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no do_xlat = no access_attr_used_for_allow = no set_auth_type = yes } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 #suppress { # User-Password #} } } authorize { group ldap { tam { notfound = 1 noop= 2 fail = 3 reject = 4 ok = return } lotus { notfound = 1 noop= 2 fail = 3 reject = 4 ok = return } handled } } authenticate { Auth-Type tam { tam { notfound = 1 noop= 2 fail = 3 reject = 4 ok = return } handled } Auth-Type lotus { lotus { notfound = 1 noop= 2 fail = 3 reject = 4 ok = return } handled } } -------------------------- logfiles: user exist in LDAP1 and password is good in LDAP1 --- rad_recv: Access-Request packet from host 192.168.110.3:49867, id=21, length=64 User-Name = "vmendelevich" User-Password = "11111111" NAS-IP-Address = 192.168.110.3 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall: entering group ldap for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for vmendelevich radius_xlat: '(uid=vmendelevich)' radius_xlat: 'o=org1' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1.ts:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as / to ldap1.kmz.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=org1, with filter (uid=vmendelevich) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = tam rlm_ldap: user vmendelevich authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "tam" returns ok for request 0 modcall: leaving group ldap (returns ok) for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type tam auth: type "tam" Processing the authenticate section of radiusd.conf modcall: entering group tam for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "vmendelevich" with password "11111111" rlm_ldap: user DN: uid=vmendelevich,o=org1 rlm_ldap: (re)connect to ldap1.ts:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=vmendelevich,o=org1/11111111 to ldap1.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user vmendelevich authenticated succesfully modcall[authenticate]: module "tam" returns ok for request 0 modcall: leaving group tam (returns ok) for request 0 Login OK: [vmendelevich] (from client VMendelevich port 10) Sending Access-Accept of id 21 to 192.168.110.3 port 49867 Finished request 0 Going to the next request ---- user doesn't exist in LDAP1, but exist in LDAP2 and password is good in LDAP2 --- rad_recv: Access-Request packet from host 192.168.110.3:44439, id=108, length=57 User-Name = "aldap" User-Password = "22222222" NAS-IP-Address = 192.168.110.3 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall: entering group ldap for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for aldap radius_xlat: '(uid=aldap)' radius_xlat: 'o=tamknown' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=org1, with filter (uid=aldap) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "tam" returns notfound for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for aldap radius_xlat: '(uid=aldap)' radius_xlat: 'o=org2' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap2.ts:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as cn=admin ldap,o=org2/22222222 to ldap2.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=org2, with filter (uid=aldap) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = lotus rlm_ldap: user aldap authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "lotus" returns ok for request 1 modcall: leaving group ldap (returns ok) for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type lotus auth: type "lotus" Processing the authenticate section of radiusd.conf modcall: entering group lotus for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "aldap" with password "22222222" rlm_ldap: user DN: CN=Admin LDAP,O=org2 rlm_ldap: (re)connect to ldap2.ts:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as CN=Admin LDAP,O=org2/22222222 to ldap2.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user aldap authenticated succesfully modcall[authenticate]: module "lotus" returns ok for request 1 modcall: leaving group lotus (returns ok) for request 1 Login OK: [aldap] (from client VMendelevich port 10) Sending Access-Accept of id 108 to 192.168.110.3 port 44439 Finished request 1 Going to the next request --- username exist in BOTH LDAP but password can be accepted only by LDAP2 --- rad_recv: Access-Request packet from host 192.168.110.3:55540, id=92, length=64 User-Name = "vmendelevich" User-Password = "33333333" NAS-IP-Address = 192.168.110.3 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall: entering group ldap for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for vmendelevich radius_xlat: '(uid=vmendelevich)' radius_xlat: 'o=org1' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=org1, with filter (uid=vmendelevich) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = tam rlm_ldap: user vmendelevich authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "tam" returns ok for request 2 modcall: leaving group ldap (returns ok) for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type tam auth: type "tam" Processing the authenticate section of radiusd.conf modcall: entering group tam for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "vmendelevich" with password "33333333" rlm_ldap: user DN: uid=vmendelevich,o=org1 rlm_ldap: (re)connect to ldap1.ts:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=vmendelevich,o=org1/33333333 to ldap1.ts:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "tam" returns reject for request 2 modcall[authenticate]: module "handled" returns handled for request 2 modcall: leaving group tam (returns handled) for request 2 There was no response configured: rejecting request 2 Server rejecting request 2. Finished request 2 Going to the next request --- As i see i need to make something like "group" in authentication section. But i don't see how. Please advice. Thank you. UIN:9244669 Phone:+7(495)727-0982 ext.4162

2 7

How to find EAP session Id in Freeradius.
by shivashankar 27 Nov '09

27 Nov '09

hi, i am using freeradius 1.1.7 and Fedora How to find EAP session Id in Freeradius. plz help me plz find the error log Thu Nov 26 23:03:14 2009 : Debug: rlm_eap: EAP packet type response id 76 length 6 Thu Nov 26 23:03:14 2009 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Thu Nov 26 23:03:14 2009 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 29 Thu Nov 26 23:03:14 2009 : Debug: modcall[authorize]: module "eap" returns updated for request 29 Thu Nov 26 23:03:14 2009 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 29 -- View this message in context: http://old.nabble.com/How-to-find-EAP-session-Id-in-Freeradius.-tp26540587p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

home server debugging issues
by Josip Rodin 27 Nov '09

27 Nov '09

Hi, I upgraded one of our proxy servers from 2.0.4 to 2.1.7, and noticed that the proxying changed in a way that "status_check = request" logic started being critical, so this kind of stuff: Sun Nov 22 09:25:56 2009 : Error: Rejecting request 70011 due to lack of any response from home server X port 1812 ...was replaced, without a change in home server configuration, with: Tue Nov 24 06:32:01 2009 : Error: PROXY: Marking home server X port 1812 as zombie (it looks like it is dead). Tue Nov 24 06:32:03 2009 : Info: PROXY: Marking home server X port 1812 as dead. Tue Nov 24 06:32:03 2009 : Error: PROXY: Marking home server Y port 1812 as zombie (it looks like it is dead). Once this happened, I went to investigate, only to find out that our test username requests were no longer summarily rejected by those two home servers - instead they were discarded. So the marking those servers alive would never happen, and this was the obvious root of the proxying problem. It was unclear to me why didn't FreeRADIUS notice this as soon as it first happened, and when it eventually happened, why didn't it explicate the rationale. So I looked and found these in src/main/event.c: RDEBUG2("No response to status check %d from home server %s port %d", RDEBUG2("Proxying request %d to home server %s port %d", RDEBUG2("ERROR: Failed to find live home server for realm %s", RDEBUG2("Failed to find live home server for request %d", request->number); It doesn't make sense for both error and debug messages to be displayed on the same debug level. The error messages need to have priority, so that the admin actually has a chance to see them. In this particular situation, when I move from debug level 0 to 2 in order to oversee these events, I get not only these messages, but gobs of rlm_sql expansions, unlang processing logs, etc. It would be better if some of those error messages were upgraded to L_ERR, or L_PROXY, while keeping the truely informational messages as L_DBG. In fact it looks like there's only a single reference to L_PROXY in the entire file. Does this make sense, can I submit patches? -- 2. That which causes joy or happiness.

2 10

ntlm_auth and Server 2008 R2 (or, how to select a group for a proxied request)
by Meyers, Dan 27 Nov '09

27 Nov '09

Info (For the short version of what I need, skip to the last paragraph): For a while now we've been running a stable solution for our wireless system 802.1x auth involving FreeRADIUS. Specifically, when a client tries to do a PEAP/MSCHAPv2 auth the eap module of FreeRADIUS successfully negotiates and terminates the EAP tunnel, and the MSCHAPv2 data is extracted and then shelled out to ntlm_auth which talks to our domain controllers (Windows Server 2003) to verify whether the MSCHAPv2 encoded password is correct for the given username. This worked fine, right up until we upgraded our domain controllers to Windows Server 2008 R2. Suddenly, ntlm_auth stopped talking to the DC. The message we were getting back when we tried to auth (either via radius or on the command line with a simple ntlm_auth --username=<username> and then specifying the password at the prompt) was NT_STATUS_PIPE_DISCONNECTED: Named pipe dicconnected (0xc00000b0). wbinfo -u successfully gets a list of every user the DCs know about, so we can still talk to them (This is on Samba 3.4.0, the latest on Ubuntu Server 9.10). As we couldn't seem to talk to the DC directly, we instead proxied to a Windows Server 2003 RADIUS server which was on the domain, which then terminated the EAP tunnel and queried the DC for the info we needed. We'd rather not need this step, but it got around the ntlm_auth issues we were having. The problem now, is that our authorize section in our inner-tunnel (used when there is a PEAP connection) used the sql module to extract group information from the user group table of the radius postgres database. Thus we could return a radius key:value pair that would dump a user into a group based on the returned result of the group_membership_query. As we are now proxying the request instead of doing authorize ourselves, this query is not getting run and every single user is ending up in the default group. 'sql' as a module can't go into post-proxy, so i'm unsure how to get this query to be run once the Windows server has returned OK for a request. The Windows RADIUS server does not seem to have enough functionality to get the group information we require. So, I either need to work out what to do to ntlm_auth to make it play nicely with Server 2008 R2 domain controllers for user verification, or I need to work out how to get FreeRADIUS to do the group sql query and add the relevant pairs before returning the result to the client after it has got an Access-Accept from the Windows RADIUS server for the request it proxied there. Has anyone got any experience of either of these things? Thanks in advance Dan

3 2

Re: Acct-Unique-Session-Id not unique
by Vega Freeradius 26 Nov '09

26 Nov '09

Alan DeKok on Thu, 26 Nov 2009 09:08:37 -0800 Wrote: > Odds are because the Client-IP-Address is different. Everything else >in the packet looks to be the same. You are right!!! It 'was my mistake. It said "Client-IP-Address" but I was reading "Framed-IP-Address" and did not understand why hash come out different! I don't need debug :) Thank you!! Marco

1 0