May 2009 - Freeradius-Users - lists.freeradius.org

radiusd -X solaris eap error
by tony＠urugn.com 12 May '09

12 May '09

2 1

users authentication problem
by Andreas Bourges 12 May '09

12 May '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, ...we recently upgraded vom freeradius 0.9 to freeradius 2.1.4. Unfortunately local users cannot be authenticated anymore. This morning I used the default configuration files from 2.1.4 and started from scratch. My first objective was to get any valid response from the freeradiusd - but unluckily, without success. In the users file, I enabled the following line: lameuser Auth-Type := Reject Reply-Message = "Your account has been disabled." one entry in clients.conf for localhost testing: client localhost { ipaddr = 127.0.0.1 secret = testing123 require_message_authenticator = no nastype = other virtual_server = default } sites-enabled/default: authorize { chap suffix eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap files } I think that must be the main configuration items for my very basic test. Then I run freeradiusd -X -xx and test the user via radclient: echo "User-Name=lameuser, Password=bla, NAS-IP-Address=127.0.0.1" | radclient - -r 1 -x -s 127.0.0.1 auth 'testing123' results in: Sending Access-Request of id 20 to 127.0.0.1 port 1812 User-Name = "lameuser" Password = "bla" NAS-IP-Address = 127.0.0.1 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=20, length=20 Total approved auths: 0 Total denied auths: 1 Total lost auths: 0 The radiusd logs the following: Tue May 12 11:31:58 2009 : Debug: Listening on authentication address * port 1812 Tue May 12 11:31:58 2009 : Debug: Listening on accounting address * port 1813 Tue May 12 11:31:58 2009 : Debug: Listening on command file /var/run/freeradius/run/radiusd/radiusd.sock Tue May 12 11:31:58 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 33013, id=5, length=54 User-Name = "lameuser" User-Password = "bla" NAS-IP-Address = 127.0.0.1 Tue May 12 11:32:04 2009 : Info: server default { Tue May 12 11:32:04 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue May 12 11:32:04 2009 : Info: Failed to authenticate the user. Tue May 12 11:32:04 2009 : Info: } # server default - -> the user gets rejected, but not because of the Auth-Type := Reject setting in the users file. This is the same behaviour we observer when configuring "real" user accounts having a password associated, like the following: testuser Auth-Type := Local, Cleartext-Password == "blabla" server log says: Tue May 12 11:35:50 2009 : Info: server default { Tue May 12 11:35:50 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue May 12 11:35:50 2009 : Info: Failed to authenticate the user. Tue May 12 11:35:50 2009 : Info: } # server default Thanks for any hints troubleshooting this! Regards, Andy -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkoJQ+MACgkQRrny/uOBVy7sggCfRfAjnhIkHwQbElEUwwZWPM4L DIEAniJziPLwpdyQKAWpa/vJvGAftmq1 =4Tih -----END PGP SIGNATURE-----

3 4

Upgrade to latest freeradius release
by pcsd＠canoemail.com 12 May '09

12 May '09

Freeradius Server v2.1.4. All clients are authenticating properly, except for clients that pass a ntdomain\userid. I have configured proxy.conf, realm and inner-tunnel in the past (i.e. v2.0.5) to handle these requests without issue. As of v2.0.6 and greater, clients are no longer authenticating. The debug logs seem to indicate login success. WinXP SP3 wireless client using latest IBM Thinkvantage software. --- debug log --- rad_recv: Access-Request packet from host 10.5.251.2 port 1645, id=191, length=248 User-Name = "SMBDOM\\userid" Framed-MTU = 1400 Called-Station-Id = "0017.0fdd.e701" Calling-Station-Id = "0005.4e41.ec86" Service-Type = Login-User Message-Authenticator = 0xacbf72d2001dfb409e9924fcdc973b1f EAP-Message = 0x02090050190017030100203438196b413d6f8f767ff2592331e9f6327862d45efe5ed8 084bb77a96c2987c1703010020182885154796afcf433e43f64e253e3960dd238a412d6f a974474d9da1a75899 NAS-Port-Type = Wireless-802.11 NAS-Port = 1674 NAS-Port-Id = "1674" State = 0xb2e30b4db5ea124aad52ba89ddbd4668 NAS-IP-Address = 10.5.251.2 NAS-Identifier = "head_office_wireless_2" - entering group authorize {...} [preprocess] returns ok [chap] returns noop [mschap] returns noop [suffix] No '@' in User-Name = "SMBDOM\userid", looking up realm NULL [suffix] No such realm "NULL" [suffix] returns noop [SMBDOM] Looking up realm "SMBDOM" for User-Name = "SMBDOM\userid" [SMBDOM] Found realm "SMBDOM" [SMBDOM] Adding Stripped-User-Name = "userid" [SMBDOM] Adding Realm = "SMBDOM" [SMBDOM] Authentication realm is LOCAL. [SMBDOM] returns ok [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. [eap] returns ok Found Auth-Type = EAP - entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020900061a03 server { PEAP: Setting User-Name to SMBDOM\userid Sending tunneled request EAP-Message = 0x020900061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SMBDOM\\userid" State = 0xa2f7c944a3fed33462945b4e374f79ce server inner-tunnel { - entering group authorize {...} [chap] returns noop [mschap] returns noop [unix] returns notfound [suffix] No '@' in User-Name = "SMBDOM\userid", looking up realm NULL [suffix] No such realm "NULL" [suffix] returns noop [SMBDOM] Looking up realm "SMBDOM" for User-Name = "SMBDOM\userid" [SMBDOM] Found realm "SMBDOM" [SMBDOM] Adding Stripped-User-Name = "userid" [SMBDOM] Adding Realm = "SMBDOM" [SMBDOM] Authentication realm is LOCAL. [SMBDOM] returns ok [control] returns ok [eap] EAP packet type response id 9 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation [eap] returns updated [files] users: Matched entry userid at line 1385 [files] returns ok [expiration] returns noop [logintime] returns noop [pap] Found existing Auth-Type, not changing it. [pap] returns noop Found Auth-Type = EAP - entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler [eap] returns ok Login OK: [SMBDOM\\userid] (from client private-network-5 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 2 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "userid" [peap] Got tunneled reply RADIUS code 2 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "userid" [peap] Tunneled authentication was successful. [peap] SUCCESS [eap] returns handled Sending Access-Challenge of id 191 to 10.5.251.2 port 1645 EAP-Message = 0x010a002b19001703010020b5c3cd4e27abb67bc4536c0829ed6f45c07edbfb2f42c758 649472d7b8857cb2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb2e30b4dbae9124aad52ba89ddbd4668 Finished request 8. --- end debug log --- Thanks for any assisantance

3 2

test
by François Mehault 12 May '09

12 May '09

De : François Mehault Envoyé : mardi 12 mai 2009 11:27 À : 'freeradius-users(a)lists.freeradius.org' Cc : François Mehault Objet : RE: check-item NAS-IP-ADdress & Calling-Station-ID with openldap Hi All, I want to use FreeRadius to administer network equipement. I use also OpenLDAP to stock information about users. FreeRADIUS and OpenLDAP are installed on the same server FreeBSD 7.0. I contact a Network equipement (like catalyst cisco 2950 v12.1) with putty (ssh/telnet). To resume : Windows XP -> ssh or telnet -> Cisco 2950 (client radius/authenticator/NAS) -> EAPoRadius (I suppose) -> FreeRADIUS & OpenLDAP For the moment, I don't install/configure supplicant on the Windows XP, I don't know if it's require because I don't want to use FreeRADIUS to auhtenticate my Windows session. I have an active directory to do this. I configure slapd.conf, radius.conf, clients.conf, module ldap etc ... and it's works. And now I would like to add some check-item like NAS-IP-Address and Caliing-Station-ID. But I don't succeed :s, I use checkval to do this. I have 2 questions : - Why my calling-station-id in the request is a IP and not a MAC ? - When I authenticate on the cisco 2950, I have in my log « rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ » instead of 192.168.0.50, what is the problem ??? I think I have numerous problem, If you see one of them, could you inform me ? I am a novice with freeradius (and openldap also :s ). I could give you all information you need to help me to fix my problem. Thanks for your help, Regards Francçois MEHAULT On my cisco 2950 : aaa new-model aaa authentication login default local group radius aaa authorization exec default group radius local aaa authorization network default group radius My ldap.attrmap : checkItem Calling-Station-Id radiusCallingStationId checkItem NAS-IP-Address radiusNASIpAddress Extract of my openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/admins/fmehault loginShell: /usr/local/bin/zsh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: stagiaire radiusCallingStationId: 192.168.0.80 -> I put a IP address and not a Mac address because in the request it's a IP and not a mac, I don't know why... radiusNASIpAddress: 192.168.0.60 -> in fact, the NAS IP is 192.168.0.50, but I put .60 to have Access-Reject userPassword: {SSHA}tOoPUvtVW5O3+StoxScmQLiGFTO5l/+z <12:34>[labobe2:~]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on Apr 16 2009 at 12:03:36 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A [...] radiusd: #### Loading Clients #### client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } radiusd: #### Instantiating modules #### [...] modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "127.0.0.1" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group [...] rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x2852c240 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_checkval Module: Instantiating station-check checkval station-check { item-name = "Calling-Station-Id" check-name = "Calling-Station-Id" data-type = "string" notfound-reject = no } rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiating nas-check checkval nas-check { item-name = "NAS-IP-Address" check-name = "NAS-IP-Address" data-type = "ipaddr" notfound-reject = no } rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail [...] Then I launch my putty and log on the cisco : rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=117, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" --> it's not a MAC address, why ??? User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok [...] [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) [ldap] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: performing search in cn=stagiaire,ou=Profiles,dc=netplus,dc=fr, with filter (objectclass=radiusprofile) rlm_ldap: radiusServiceType -> Service-Type = NAS-Prompt-User [ldap] looking for check items in directory... rlm_ldap: radiusNASIpAddress -> NAS-IP-Address == 192.168.0.60 rlm_ldap: radiusCallingStationId -> Calling-Station-Id == "192.168.0.80" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 192.168.0.80 rlm_checkval: Value Name: Calling-Station-Id, Value: 192.168.0.80 ++[station-check] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ --> what is the problem ??? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.60 (I put 192.168.0.60 instead of 192.168.0.50 to be reject ) [...] Sending Access-Accept of id 117 to 192.168.0.50 port 1812 Reply-Message = "Utilisateur: fmehault, group: Stagiaire" Service-Type = NAS-Prompt-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +237 Ready to process requests.

2 2

OpenLDAP check item
by François Mehault 12 May '09

12 May '09

Hi All, I want to use FreeRadius to administer network equipement. I use also OpenLDAP to stock information about users. FreeRADIUS and OpenLDAP are installed on the same server FreeBSD 7.0. I contact a Network equipement (like catalyst cisco 2950 v12.1) with putty (ssh/telnet). To resume : Windows XP -> ssh or telnet -> Cisco 2950 (client radius/authenticator/NAS) -> EAPoRadius (I suppose) -> FreeRADIUS & OpenLDAP For the moment, I don't install/configure supplicant on the Windows XP, I don't know if it's require because I don't want to use FreeRADIUS to auhtenticate my Windows session. I have an active directory to do this. I configure slapd.conf, radius.conf, clients.conf, module ldap etc ... and it's works. And now I would like to add some check-item like NAS-IP-Address and Caliing-Station-ID. But I don't succeed :s, I use checkval to do this. I have 2 questions : - Why my calling-station-id in the request is a IP and not a MAC ? - When I authenticate on the cisco 2950, I have in my log « rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ » instead of 192.168.0.50, what is the problem ??? I think I have numerous problem, If you see one of them, could you inform me ? I am a novice with freeradius (and openldap also :s ). I could give you all information you need to help me to fix my problem. Thanks for your help, Regards Francçois MEHAULT On my cisco 2950 : aaa new-model aaa authentication login default local group radius aaa authorization exec default group radius local aaa authorization network default group radius My ldap.attrmap : checkItem Calling-Station-Id radiusCallingStationId checkItem NAS-IP-Address radiusNASIpAddress Extract of my openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/admins/fmehault loginShell: /usr/local/bin/zsh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: stagiaire radiusCallingStationId: 192.168.0.80 -> I put a IP address and not a Mac address because in the request it's a IP and not a mac, I don't know why... radiusNASIpAddress: 192.168.0.60 -> in fact, the NAS IP is 192.168.0.50, but I put .60 to have Access-Reject userPassword: {SSHA}tOoPUvtVW5O3+StoxScmQLiGFTO5l/+z <12:34>[labobe2:~]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on Apr 16 2009 at 12:03:36 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A [...] radiusd: #### Loading Clients #### client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } radiusd: #### Instantiating modules #### [...] modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "127.0.0.1" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group [...] rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x2852c240 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_checkval Module: Instantiating station-check checkval station-check { item-name = "Calling-Station-Id" check-name = "Calling-Station-Id" data-type = "string" notfound-reject = no } rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiating nas-check checkval nas-check { item-name = "NAS-IP-Address" check-name = "NAS-IP-Address" data-type = "ipaddr" notfound-reject = no } rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail [...] Then I launch my putty and log on the cisco : rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=117, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" --> it's not a MAC address, why ??? User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok [...] [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) [ldap] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: performing search in cn=stagiaire,ou=Profiles,dc=netplus,dc=fr, with filter (objectclass=radiusprofile) rlm_ldap: radiusServiceType -> Service-Type = NAS-Prompt-User [ldap] looking for check items in directory... rlm_ldap: radiusNASIpAddress -> NAS-IP-Address == 192.168.0.60 rlm_ldap: radiusCallingStationId -> Calling-Station-Id == "192.168.0.80" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 192.168.0.80 rlm_checkval: Value Name: Calling-Station-Id, Value: 192.168.0.80 ++[station-check] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ --> what is the problem ??? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.60 (I put 192.168.0.60 instead of 192.168.0.50 to be reject ) [...] Sending Access-Accept of id 117 to 192.168.0.50 port 1812 Reply-Message = "Utilisateur: fmehault, group: Stagiaire" Service-Type = NAS-Prompt-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +237 Ready to process requests.

1 0

RE: check-item NAS-IP-ADdress & Calling-Station-ID with openldap
by François Mehault 12 May '09

12 May '09

Hi All, I want to use FreeRadius to administer network equipement. I use also OpenLDAP to stock information about users. FreeRADIUS and OpenLDAP are installed on the same server FreeBSD 7.0. I contact a Network equipement (like catalyst cisco 2950 v12.1) with putty (ssh/telnet). To resume : Windows XP -> ssh or telnet -> Cisco 2950 (client radius/authenticator/NAS) -> EAPoRadius (I suppose) -> FreeRADIUS & OpenLDAP For the moment, I don't install/configure supplicant on the Windows XP, I don't know if it's require because I don't want to use FreeRADIUS to auhtenticate my Windows session. I have an active directory to do this. I configure slapd.conf, radius.conf, clients.conf, module ldap etc ... and it's works. And now I would like to add some check-item like NAS-IP-Address and Caliing-Station-ID. But I don't succeed :s, I use checkval to do this. I have 2 questions : - Why my calling-station-id in the request is a IP and not a MAC ? - When I authenticate on the cisco 2950, I have in my log « rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ » instead of 192.168.0.50, what is the problem ??? I think I have numerous problem, If you see one of them, could you inform me ? I am a novice with freeradius (and openldap also :s ). I could give you all information you need to help me to fix my problem. Thanks for your help, Regards Francçois MEHAULT On my cisco 2950 : aaa new-model aaa authentication login default local group radius aaa authorization exec default group radius local aaa authorization network default group radius My ldap.attrmap : checkItem Calling-Station-Id radiusCallingStationId checkItem NAS-IP-Address radiusNASIpAddress Extract of my openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/admins/fmehault loginShell: /usr/local/bin/zsh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: stagiaire radiusCallingStationId: 192.168.0.80 -> I put a IP address and not a Mac address because in the request it's a IP and not a mac, I don't know why... radiusNASIpAddress: 192.168.0.60 -> in fact, the NAS IP is 192.168.0.50, but I put .60 to have Access-Reject userPassword: {SSHA}tOoPUvtVW5O3+StoxScmQLiGFTO5l/+z <12:34>[labobe2:~]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on Apr 16 2009 at 12:03:36 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A [...] radiusd: #### Loading Clients #### client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } radiusd: #### Instantiating modules #### [...] modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "127.0.0.1" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group [...] rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x2852c240 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_checkval Module: Instantiating station-check checkval station-check { item-name = "Calling-Station-Id" check-name = "Calling-Station-Id" data-type = "string" notfound-reject = no } rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiating nas-check checkval nas-check { item-name = "NAS-IP-Address" check-name = "NAS-IP-Address" data-type = "ipaddr" notfound-reject = no } rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail [...] Then I launch my putty and log on the cisco : rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=117, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" --> it's not a MAC address, why ??? User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok [...] [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) [ldap] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: performing search in cn=stagiaire,ou=Profiles,dc=netplus,dc=fr, with filter (objectclass=radiusprofile) rlm_ldap: radiusServiceType -> Service-Type = NAS-Prompt-User [ldap] looking for check items in directory... rlm_ldap: radiusNASIpAddress -> NAS-IP-Address == 192.168.0.60 rlm_ldap: radiusCallingStationId -> Calling-Station-Id == "192.168.0.80" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 192.168.0.80 rlm_checkval: Value Name: Calling-Station-Id, Value: 192.168.0.80 ++[station-check] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ --> what is the problem ??? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.60 (I put 192.168.0.60 instead of 192.168.0.50 to be reject ) [...] Sending Access-Accept of id 117 to 192.168.0.50 port 1812 Reply-Message = "Utilisateur: fmehault, group: Stagiaire" Service-Type = NAS-Prompt-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +237 Ready to process requests.

1 0

NAS or supplicant, pam_radius or xsupplicant
by François Mehault 12 May '09

12 May '09

Hi All I have to install a FreeRADIUS to authenticate some users on network equipement (like a Catalyst cisco). I just want to authenticate users on the cisco switch, no vlan attribution ... So i conclude that I don't have to install/configure supplicant on my computer (windows XP), the computer I use to contact the switch via telnet/ssh. Could you confirm me that I'm right ? I would like also to authenticate users on UNIX servers. Also, I just need to authenticate the users on servers, So I conclude that I configure pam_radius on these servers and no install/configure xsupllicant. Servers are RADIUS client/NAS and no supplicant. Of course I would like to have a safe communication beetween NAS and FreeRADIUS. Could you say me if I selected the good configuration, or if I am totally wrong. I read comments in files configuration and a lot of documentation on the web, but the case described are often with supplicant - NAS - FreeRADIUS, with Authentication on the supplicant for vlan attribution. I don't understand wery well when I have to install xsupplicant or pam_radius on my server UNIX, if my Server is a supplicant or a NAS. Thanks for your help François

1 0

Implementing a "logout" sqlcounter
by Ming-Ching Tiew 12 May '09

12 May '09

I am thinking of using sqlcounter to implement a "logout" counter, ie whenever I want to logout a particular user, I set something into the database, then the sqlcounter will pick it up, and drop the existing session. OK I read in some of the older posts, one way people have implemented this feature is via then spin off radclient. This has the disadvantage in that, if the radius client is behind somekind of firewall, the server initiated radclient will have problem sending this to the radius client. Whereas the radclient continually sending accounting info to the server, I thought doing the reject at accouting will also some what accomplishing the same purpose. Any comments ?

2 1

RE: check-item NAS-IP-ADdress & Calling-Station-ID with openldap
by François Mehault 12 May '09

12 May '09

Hi All, I want to use FreeRadius to administer network equipement. I use also OpenLDAP to stock information about users. FreeRADIUS and OpenLDAP are installed on the same server FreeBSD 7.0. I contact a Network equipement (like catalyst cisco 2950 v12.1) with putty (ssh/telnet). To resume : Windows XP -> ssh or telnet -> Cisco 2950 (client radius/authenticator/NAS) -> EAPoRadius (I suppose) -> FreeRADIUS & OpenLDAP For the moment, I don't install/configure supplicant on the Windows XP, I don't know if it's require because I don't want to use FreeRADIUS to auhtenticate my Windows session. I have an active directory to do this. I configure slapd.conf, radius.conf, clients.conf, module ldap etc ... and it's works. And now I would like to add some check-item like NAS-IP-Address and Caliing-Station-ID. But I don't succeed :s, I use checkval to do this. I have 2 questions : - Why my calling-station-id in the request is a IP and not a MAC ? - When I authenticate on the cisco 2950, I have in my log « rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ » instead of 192.168.0.50, what is the problem ??? I think I have numerous problem, If you see one of them, could you inform me ? I am a novice with freeradius (and openldap also :s ). I could give you all information you need to help me to fix my problem. Thanks for your help, Regards Francçois MEHAULT On my cisco 2950 : aaa new-model aaa authentication login default local group radius aaa authorization exec default group radius local aaa authorization network default group radius My ldap.attrmap : checkItem Calling-Station-Id radiusCallingStationId checkItem NAS-IP-Address radiusNASIpAddress Extract of my openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/admins/fmehault loginShell: /usr/local/bin/zsh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: stagiaire radiusCallingStationId: 192.168.0.80 -> I put a IP address and not a Mac address because in the request it's a IP and not a mac, I don't know why... radiusNASIpAddress: 192.168.0.60 -> in fact, the NAS IP is 192.168.0.50, but I put .60 to have Access-Reject userPassword: {SSHA}tOoPUvtVW5O3+StoxScmQLiGFTO5l/+z <12:34>[labobe2:~]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on Apr 16 2009 at 12:03:36 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf [...] including configuration file /usr/local/etc/raddb/sites-enabled/control-socket group = freeradius user = freeradius including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib/freeradius-2.1.4" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "127.0.0.1" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x2852c240 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_checkval Module: Instantiating station-check checkval station-check { item-name = "Calling-Station-Id" check-name = "Calling-Station-Id" data-type = "string" notfound-reject = no } rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiating nas-check checkval nas-check { item-name = "NAS-IP-Address" check-name = "NAS-IP-Address" data-type = "ipaddr" notfound-reject = no } rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Then I launch my putty and log on the cisco : rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=117, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" --> it's not a MAC address, why ??? User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "fmehault", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (&(cn=administrateur)(|(&(objectClass=GroupOfNames)(member=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr)))) rlm_ldap: object not found rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr, with filter (objectclass=*) rlm_ldap::groupcmp: Group administrateur not found or user not a member rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (&(cn=stagiaire)(|(&(objectClass=GroupOfNames)(member=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr)))) rlm_ldap: object not found rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group stagiaire rlm_ldap: ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 224 [files] expand: Utilisateur: %{User-name}, group: Stagiaire -> Utilisateur: fmehault, group: Stagiaire ++[files] returns ok [ldap] performing user authorization for fmehault [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) [ldap] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: performing search in cn=stagiaire,ou=Profiles,dc=netplus,dc=fr, with filter (objectclass=radiusprofile) rlm_ldap: radiusServiceType -> Service-Type = NAS-Prompt-User [ldap] looking for check items in directory... rlm_ldap: radiusNASIpAddress -> NAS-IP-Address == 192.168.0.60 rlm_ldap: radiusCallingStationId -> Calling-Station-Id == "192.168.0.80" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 192.168.0.80 rlm_checkval: Value Name: Calling-Station-Id, Value: 192.168.0.80 ++[station-check] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ --> what is the problem ??? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.60 (I put 192.168.0.60 instead of 192.168.0.50 to be reject ) ++[nas-check] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} [ldap] login attempt by "fmehault" with password "toto" [ldap] user DN: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr rlm_ldap: (re)connect to 127.0.0.1:389, authentication 1 rlm_ldap: bind as cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr/toto to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap] user fmehault authenticated succesfully ++[ldap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 117 to 192.168.0.50 port 1812 Reply-Message = "Utilisateur: fmehault, group: Stagiaire" Service-Type = NAS-Prompt-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +237 Ready to process requests.

1 0

Re: Implementing a "logout" sqlcounter
by Ming-Ching Tiew 12 May '09

12 May '09

--- On Tue, 5/12/09, Ming-Ching Tiew <mctiew(a)yahoo.com> wrote: > > Whereas the radclient continually sending accounting info > to > the server, I thought doing the reject at accouting will > also some what accomplishing the same purpose. > > Any comments ? > > Further readings seems to indicate this this could possible implemented using unlang 'update disconnect' in preacct section ? Regards

1 0