April 2009 - Freeradius-Users - lists.freeradius.org

VS: Chap auhtentication against LDAP
by Ville Leinonen 06 Apr '09

06 Apr '09

Hi, So i cannot do this about using freeradius, but i can make it using IAS (see link)? http://h40060.www4.hp.com/procurve/includes/application-notes/index.php?cc=… Br, Ville -----Alkuperäinen viesti----- Lähettäjä: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org puolesta: Alan DeKok Lähetetty: pe 3.4.2009 16:10 Vastaanottaja: FreeRadius users mailing list Aihe: Re: Chap auhtentication against LDAP Ville Leinonen wrote: > Does Freeradius 2.1.5 support chap authentication against ldap? No RADIUS server supports this. It's impossible. Instead, have FreeRADIUS pull the clear-text password from LDAP. FreeRADIUS can then do CHAP. If you don't have a clear-text password in LDAP, it's impossible. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Problems in redudant ldap and authorization.
by Ville Leinonen 06 Apr '09

06 Apr '09

Hi, I have a little problem in my radius configuration in my redudant ldap section rad ver is 2.1.5. redundant { ldap-srv1 ldap-srv2 notfound = reject } Gives this error message: /usr/local/etc/raddb/sites-enabled/default[167]: Entry with no value is invalid /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. Any suggestion what is wrong in my configuration? If i use individual configuration eg. ldap-srv1{ notfound = reject } Then it works. Br, Ville

2 1

FreeRadius 1.x Or 2.x
by AHMED KHIDR 06 Apr '09

06 Apr '09

Dear All, I use freeradius 1.1.7 and I am thinking of migrate to new ver. 2.x so i want to ask which ver is better ?

2 1

What can cause the "Exiting normally" without prompting
by switchport＠hotmail.com 06 Apr '09

06 Apr '09

hi, i am testing freeradius 2.1.X by radclient , when the number of requests arrive 6million+, freeradius will "Exiting normally" without prompting. the testing freeradius have pgsql module. thanks.

4 7

VS: VS: Chap auhtentication against LDAP
by Ville Leinonen 05 Apr '09

05 Apr '09

Hi, Thank you for this reply. Well then i do some scripting and pull userinfo inside ldap and export it to my radsrv. Br, Ville -----Alkuperäinen viesti----- Lähettäjä: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org puolesta: Alan DeKok Lähetetty: su 5.4.2009 16:16 Vastaanottaja: FreeRadius users mailing list Aihe: Re: VS: Chap auhtentication against LDAP Ville Leinonen wrote: > So i cannot do this about using freeradius, but i can make it > using IAS (see link)? No. You seemed to have misunderstood my response. Let me say it a different way: LDAP servers cannot do CHAP authentication. Why? Because LDAP servers are *DATABASES*. LDAP servers are not *authentication* servers. FreeRADIUS is an *AUTHENTICATION* server. Configure FreeRADIUS so that it pulls the clear-text password from LDAP. FreeRADIUS will then do CHAP authentication. If you don't have a clear-text password in LDAP, then doing CHAP authentication is impossible. It is impossible with FreeRADIUS, IAS, Cisco ACS, Juniper SBR, Radiator, and also with every other RADIUS server on the planet. And go read my web page: http://deployingradius.com/documents/protocols/compatibility.html Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Help with LDAP groupOfNames?
by Jason Antman 04 Apr '09

04 Apr '09

Hi, I've googled this to no avail (have been working on it for about 4 hours now). I'm running FreeRADIUS 1.1.0 (SuSE package) and OpenLDAP 2.3.19. I have an access point that will do captive portal, but only via RADIUS, not via LDAP natively. I already have an LDAP server running, so I just added a new groupOfNames called "WirelessUsers". Basically, *all* I want RADIUS to do is check the username and password, and assuming they are correct, either allow or deny based on whether the user is a member of "WirelessUsers". According to radtest, I have it working with LDAP, but it allows everyone with a valid username and password access, regardless of the WirelessUsers group - and I'm not seeing anything related to that group in the LDAP logs. I can't seem to find anything online for freeradius1 relating to groupOfNames, so I've just been trying random things that I found online (for raddb/users) hoping one would work. radiusd.conf: ldap { server = "127.0.0.1" basedn = "dc=example,dc=com" filter = "(&(objectClass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = cn groupmembership_filter = (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) groupmembership_attribute = "memberof" timeout = 4 timelimit = 3 net_timeout = 1 } users: #DEFAULT Auth-Type == LDAP # Fall-Through = Yes DEFAULT LDAP-Group == "WirelessUsers" Auth-Type := Reject #DEFAULT Ldap-Group != "WirelessUsers", Auth-Type := Reject # Reply-Message = "Sorry, your account has not yet been enabled for wireless access." #DEFAULT Huntgroup-Name == "wirelessusers", Ldap-Group=="WirelessUsers", Auth-Type = LDAP #DEFAULT Auth-Type := Reject #DEFAULT Ldap-Group == "WirelessUsers" # Fall-Through = no DEFAULT Ldap-Group == WirelessUsers Fall-Through = no DEFAULT Auth-Type := Reject I've tried all of the commented out stuff also, and none of it worked. All I want is (assuming username & password are correct) allow anyone who is in "WirelessUsers" group, deny everyone else. I'm sure this is horribly simple, but I just can't seem to figure it out from the docs or from extensive googling. Thanks for any help, Jason Antman

1 0

RFC 5090 support
by Andrew Krywaniuk 03 Apr '09

03 Apr '09

Hi, I have installed version 2.1.4 of FreeRadius server and I am trying to configure digest authentication for HTTP (not SIP) as per RFC 5090. In searching through the archives/wiki, I found one message from Alan stating that dictionary.rfc5090 is disabled by default because it's not supported by the server, and another message saying that "there are patches but they are not included in the main stream yet". Are the patches available for download anywhere? I haven't been able to find them (I don't mind if they are alpha quality). Another thing is that I can't even get FreeRadius to decode the digest attributes. If I $INCLUDE dictionary.rfc5090 in the master dictionary file, I get the following error at startup: 'including dictionary file /usr/local/etc/raddb/dictionary Errors reading dictionary: dict_init: /usr/local/share/freeradius/dictionary.freeradius.internal[93]: dict_init: /usr/local/share/freeradius/dictionary.freeradius.internal[93]:' I understand that the attributes are not supported yet, but I'm not sure why just including the dictionary file causes a fatal error while loading the configuration. BTW, I noticed that the list of custom attributes in the dictionary.fortinet file is out of date. Here is an updated list: ATTRIBUTE Fortinet-Group-Name 1 string ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr ATTRIBUTE Fortinet-Vdom-Name 3 string ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets ATTRIBUTE Fortinet-Interface-Name 5 string ATTRIBUTE Fortinet-Access-Profile 6 string Andrew _________________________________________________________________ Internet Explorer 8 helps keep your personal info safe. http://go.microsoft.com/?linkid=9655581

1 1

problem matching realms - for local auth not proxy
by Seamus Bridgeman 03 Apr '09

03 Apr '09

Hi Using freeradius2.1.3 for seperate Auth and Acct servers in DSL/PPPoE n/w. Using CHAP auth only and lookup via dbm file with users.txt fallback. Can successfully authenticate/authorise against specific user profiles in users dbm/txt but problems when trying to match realms. Have users dbm/txt file with list of DEFAULT realm=xxx followed by users profiles. realm matches simply returns L2TP tunnel profiles for these realms (no fallthru). No realm match (null or other domains not in proxy.conf) will do lookup and return specific user profiles (i.e matching userxx Cleartext-Password := "xxxx"). Debug shows the rlm_realms module logging error: [suffix] Looking up realm "dslip" for User-Name = "jean@dslip" [suffix] No such realm "dslip" We are not proxying to remote servers but do local auth on matching realms. Am I missing some step/module which imports the proxy.conf file - or the order of modules in authorise{} This issue occurs regardless dbm or files based lookup and in realms module.If I remove proxy.conf radius does not complain. Ive looked in maillist for similiar problems. Some reference to include suffix in preacct module but ours is Auth server only. I have spent some time testing and read man pages, searching related etc before resorting to first my first query to this maillist. Any help appreciated SeamusB Setup ---------- [1] Test users file with single record - a default realm : DEFAULT Realm == "dslip", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IP, Tunnel-Server-Endpoint:1 = "xxx.xxx.xxx.xxx", Tunnel-Client-Auth-Id:1 = "yyy", Tunnel-Password:1 = "yyy", Tunnel-Assignment-Id:1 = "dslip", Tunnel_Algorithm = 2, Tunnel_Domain = 1 Added to dbm file: /usr/local/freeradius/bin/rlm_dbm_cat -f /usr/local/freeradius/etc/raddb/users DEFAULT Realm == "dslip", Auth-Type := Accept Tunnel-Type:1 = L2TP, Tunnel-Medium-Type:1 = IPv4, Tunnel-Server-Endpoint:1 = "159.134.191.145", Tunnel-Client-Auth-Id:1 = "dslip", Tunnel-Password:1 = "unlock", Tunnel-Assignment-Id:1 = "dslip", Tunnel_Algorithm = 2, Tunnel_Domain = 1 freeradiusdsldev00# [2] proxy.conf has realm added as below and permissions 644 for radius/radadmin realm dslip { type = radius authhost = LOCAL accthost = LOCAL nostrip } [3] radiusd.conf includes reference to realm module and includes in authorise {} section. Also not including policy.conf which denies realms by default. modules { .. realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } } authorize { preprocess suffix chap group { dbm { ok = return reject = return notfound = return fail = 1 } files { ok = return reject = return notfound = return fail = return } } } [4] Radiusd -X output client freeradiusdsldev00 { require_message_authenticator = no secret = "testing123" shortname = "freeradiusdsldev00" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### radiusd: #### Loading Virtual Servers #### modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_chap Module: Instantiating chap Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/freeradius/etc/raddb/huntgroups" hints = "/usr/local/freeradius/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_dbm Module: Instantiating dbm dbm { usersfile = "/usr/local/freeradius/etc/raddb/users" byclid_length = 4 } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/freeradius/etc/raddb/users.txt" compat = "no" byclid_length = 4 } } radiusd: #### Opening IP addresses and Ports #### bind_address = * WARNING: The directive 'bind_adress' is deprecated, and will be removed in future versions of FreeRADIUS. Please edit the configuration files to use the directive 'listen'. Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. [5] Test when using radclient with test username jean@dslip which should match the realm in proxy.conf and default profile in users.db. Server debug log: rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx port 35210, id=168, length=201 User-Name = "jean@dslip" Acct-Session-Id = "5511534626" CHAP-Password = 0xa812b2813543dd45b1434328ea423c83e4 Service-Type = Framed-User Framed-Protocol = PPP +- entering group authorize {...} ++[preprocess] returns ok [suffix] Looking up realm "dslip" for User-Name = "jean@dslip" [suffix] No such realm "dslip" ++[suffix] returns noop [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++- entering group {...} rlm_dbm: try open database file: /usr/local/freeradius/etc/raddb/users rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add jean@dslip to user list rlm_dbm: User <jean@dslip> not found in database Remove jean@dslip from user list sm_parse_user.c: check for loops Add DEFAULT to user list sm_parse_user: start parsing: user: DEFAULT parse buffer: <<Realm == "dslip", Auth-Type := Accept>> rlm_dbm: recod parsed process pattern rlm_dbm: patern not matched, reply skiped Remove DEFAULT from user list +++[dbm] returns notfound ++- group returns notfound Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "jean@dslip" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Login incorrect (rlm_chap: Clear text password not available): [jean@dslip/<CHAP-Password>] (from client freeradiusdsldev00 port 3525263410 cli :xxxxxx) Sending Access-Reject of id 168 to xxx.xxx.xxx.xxx port 35210 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 168 with timestamp +5 Ready to process requests.

2 3

Chap auhtentication against LDAP
by Ville Leinonen 03 Apr '09

03 Apr '09

Hi, Does Freeradius 2.1.5 support chap authentication against ldap? If i try it here is messages what i get: Found Auth-Type = CHAP +- entering group CHAP {...} rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". ++[ldap] returns invalid Failed to authenticate the user. Br, Ville

2 1

user-Password required for ldap radius
by Basant Agarwal 03 Apr '09

03 Apr '09

Hello, I am trying to authenticate wifi users for wireless network ... for this i am using freeradius with ldap... When we run radtest on localhost, it is able to get authorised and authenticated .. it works fine but when i try from laptop(windows ) then it rejects the same user... please let me know what to do ...?? here is the debug output .. Ready to process requests. rad_recv: Access-Request packet from host 172.16.1.80:1122, id=0, length=204 Message-Authenticator = 0x3f459af06e42a2a0b7cf9c1d80092e31 Service-Type = Framed-User User-Name = "testap" Framed-MTU = 1488 Called-Station-Id = "00-15-E9-C9-F3-80:MNIT-DC-AP" Calling-Station-Id = "00-16-6F-7C-DB-2D" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b01746573746170 NAS-IP-Address = 172.16.1.80 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 159 users: Matched entry DEFAULT at line 177 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for testap radius_xlat: '(uid=testap)' radius_xlat: 'dc=mnit,dc=ac,dc=in' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 172.16.1.20:389, authentication 0 rlm_ldap: bind as uid=admin,ou=people,dc=mnit,dc=ac,dc=in/system to 172.16.1.20:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mnit,dc=ac,dc=in, with filter (uid=testap) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testap authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: leaving group LDAP (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 172.16.1.80 <http://172.16.1.80/>port 1122 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 46b1b8cb Nothing to do. Sleeping until we see a request.

3 2