June 2009 - Freeradius-Users - lists.freeradius.org

Configuring Freeradius with Ldap Windows Server 2003
by Hari Novferdianto 03 Jun '09

03 Jun '09

Hi, How configuring freeradius with ldap windows server 2003 ? I do in my freeradius, when I installed it is ./configure --prefix=/usr/local/freeradius --with-modules="rlm-ldap" Until I'm configured in radiusd.conf It's Still radiusd.conf[744] Failed to link to module 'rlm_ldap': rlm_ldap.so: cannot open shared object file: No such file or directory radiusd.conf[1956] Unknown module "ldap". radiusd.conf[1956] Failed to parse "ldap" entry. I'm confused now...

2 1

freeRADIUS
by Just E. Mail 03 Jun '09

03 Jun '09

I am trying to install freeRADIUS on a CentOS 5.3 machine with PostgreSQL-8.3.7. My plan is to first install freeRADIUS and test it then setup PostgreSQL as the backend to store data. Is there any freeRADIUS RPMS V#2.1.4 or newer for CentOS? Jennifer

6 19

windows2003+freeradius+ad
by miaowang 02 Jun '09

02 Jun '09

Hello, I install freeradius on WIN2003,i want use AD as user database, how to config radiusd.conf? LDAP or NTLM_Auth? I can not find NTLM_Auth on windows 2003 , LDAP=AD? thanks ! miao 2009-06-03 miaowang

1 0

DISABLE THREAD_TLS
by Ming-Ching Tiew 02 Jun '09

02 Jun '09

I am trying to compile freeradius on uclibc, it complains of undefined symbol __tls_get_addr. So I went to modify src/include/autoconf.h, and commented #define HAVE_THREAD_TLS 1, then the compilation was successful. My question is what do I missed from disabling THREAD_TLS ? Does it mean performance impact ? Will it mean freeradius will be slower, consuming more memory or what ? Regards.

1 0

firewall
by jon jon 02 Jun '09

02 Jun '09

Does your freeradius server have to have a rc.firewall? If so does freeradius come with a script for one? jon

3 3

Unlang to switch between ldaps
by Diego Martín Capello 02 Jun '09

02 Jun '09

Hello everyone, I'm using freeradius 2.0.4 with a ldap server as a backend for authentication of users to our wireless network. I've defined two ldap "servers" in the radiusd.conf file: ..... ldap ldap_uba { server = "ldap_server" basedn = "dc=uba,dc=ar" filter = "(&(description=wireless)(mail=%{Stripped-User-Name:-%{User-Name}}))" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } ldap ldap_ccc { server = "ldap_server" basedn = "ou=CCC,dc=uba,dc=ar" filter = "(&(description=wireless)(mail=%{Stripped-User-Name:-%{User-Name}}))" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } .............. I want to switch between them based on the NAS-IP-Address of the arriving request, so I've used unlang in the authorize section: authorize { unix mschap eap { ok = return } files switch "%{NAS-IP-Address}" { case 192.168.168.11 { ldap_ccc } case { ldap_uba } } expiration logintime auth_log pap } Well, my problem is that freeradius doesn't assign or expand the NAS-IP-Address attribute with the correct value of the NAS IP which is requesting for authentication, could anyone help me with this little issue? POST of the debug mode of freeradius: rad_recv: Access-Request packet from host 192.168.168.11 port 1041, id=6, length=279 Message-Authenticator = 0x341f20c2e434d8cbd92d85defa321b38 Service-Type = Framed-User User-Name = "diego(a)ccc.uba.ar\000" Framed-MTU = 1488 State = 0x12b38bc817b592297c4cea524b70e440 Called-Station-Id = "00-13-46-7A-DB-63:REDI-UBA VLAN12" Calling-Station-Id = "00-02-72-78-90-5B" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0206003b1900170301003091d34cda32a72417c4e5e093d71f2d82fc67e0f1f3dc1483aec15e433d54c5c950e88c2f64c3fd6d8ddf656af63496d1 NAS-IP-Address = 192.168.168.11 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "ccc.uba.ar" for User-Name = "diego(a)ccc.uba.ar" rlm_realm: No such realm "ccc.uba.ar" ++[suffix] returns noop rlm_eap: EAP packet type response id 6 length 59 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - diego(a)ccc.uba.ar PEAP: Got tunneled EAP-Message EAP-Message = 0x0206001501646965676f406363632e7562612e6172 PEAP: Got tunneled identity of diego(a)ccc.uba.ar PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to diego(a)ccc.uba.ar PEAP: Sending tunneled request EAP-Message = 0x0206001501646965676f406363632e7562612e6172 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "diego(a)ccc.uba.ar" server inner-tunnel { +- entering group authorize ++[unix] returns notfound ++[mschap] returns noop rlm_eap: EAP packet type response id 6 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop expand: %{NAS-IP-Address} -> ++- entering switch %{NAS-IP-Address} +++- entering case rlm_ldap: - authorize rlm_ldap: performing user authorization for diego(a)ccc.uba.ar WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(description=wireless)(mail=%{Stripped-User-Name:-%{User-Name}})) -> (&(description=wireless)(mail=diego(a)ccc.uba.ar)) expand: dc=uba,dc=ar -> dc=uba,dc=ar rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.ccc.uba.ar:389, authentication 0 rlm_ldap: bind as / to ldap.ccc.uba.ar:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=uba,dc=ar, with filter (&(description=wireless)(mail=diego(a)ccc.uba.ar)) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute userPassword as RADIUS attribute Cleartext-Password == "pepe1234" rlm_ldap: looking for reply items in directory... rlm_ldap: user diego(a)ccc.uba.ar authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++++[ldap_uba] returns ok +++- case returns ok ++- switch %{NAS-IP-Address} returns ok ++[expiration] returns noop ++[logintime] returns noop expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.168.11/auth-detail-20090528 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.168.11/auth-detail-20090528 expand: %t -> Thu May 28 12:33:26 2009 ++[auth_log] returns ok rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x0107002a1a0107002510a707e4f41d139b10e7d9860e8e17a80e646965676f406363632e7562612e6172 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x48fe8ac948f9909b9915b8554a615778 PEAP: Processing from tunneled session code 0x8623f78 11 EAP-Message = 0x0107002a1a0107002510a707e4f41d139b10e7d9860e8e17a80e646965676f406363632e7562612e6172 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x48fe8ac948f9909b9915b8554a615778 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.168.11 port 1041 EAP-Message = 0x0107004b190017030100409a85d96e6b404149561fbe6dfb464b692f986263d5215ec98e2d84f3c1961a462dbd097150d5bba0e0f8b29fe80e038f691dee73f0352576d1cec4fe36d9a3eb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12b38bc814b492297c4cea524b70e440 Finished request 6. After making some test, debugging and drink lot of coffee I've solved the problem usign this fragment of code: switch "%{Client-IP-Address}" { case 192.168.168.11 { ldap_ccc } case { ldap_uba } } Freeradius does expand the Client-IP-Address attribute, however, I would like to know why it doesn't expand the NAS-IP-Adress attribute. Sorry for my english and lot of thanks......... -- Diego Martín Capello Administrador RedUBA Centro de Comunicación Científica Universidad de Buenos Aires

2 2

redundant/failover modules
by John Doppke 02 Jun '09

02 Jun '09

I've been reading the docs regarding failover and I'm not sure if the following is correct. It seems to process an extra query. group { redundant { ldap1-primary ldap1-failover } fail = 1 ok = return redundant { ldap2-primary ldap2-failover } } The intent is that if the user is not found in ldap1, then ldap2 is tried. Ldap2 should be skipped if ldap1 returns ok. In each block the failover should be tried if the primary doesnt respond. The failover works, but it seems that the ldap2 is tried even if ldap1 finds the user. Am I missing something? Regards, -John Doppke

1 0

FreeRADIUS in the cloud?
by Stelio Gouveia 02 Jun '09

02 Jun '09

Hi All. Has anyone had success with running FreeRADIUS in the cloud computing environment. If so, did you create your own cloud or use a vendor? Regards Stelio Gouveia -- Skyrove Software Engineer, Skyrove (Pty) Ltd Technology Top 100 Award Winner (2006) Mobile: +27 82 34 09 120 Tel: +27 861 ROVERS (0861 768 377) Fax: +27 86 6204077 Email & Gtalk: stelio(a)skyrove.com Web: www.skyrove.com This message contains confidential information. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message.

1 0

failover ldap + ldap-group attribute
by François Mehault 02 Jun '09

02 Jun '09

Hi all, I have to do a failover between 2 OpenLDAP for FreeRADIUS. I tested in Lab, and the failover works. But I have a problem, users in my ldap use group-Ldap with radiusVSA attribute for cisco. Without it, I can't be logged on my cisco. With one of my ldap, I have the Access-Accept with cisco attribute then I can be logged, but with the other ldap, there is no cisco attribute. Someone succeed to do a failover with 2 ldap and ldap-group ? I read post with the same problem and the solution is maybe to do a fail-over for ldap-group attribute. But I don't understand very well how I can do it. I show you my debug. Regards, François <15:42>[labobe2:/usr/local/etc/raddb]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on May 29 2009 at 12:21:02 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/ldap.origine including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket group = freeradius user = freeradius including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib/freeradius-2.1.4" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } client 192.168.0.199 { require_message_authenticator = no secret = "cherche" shortname = "fwlabo" nastype = "other" } client 10.96.18.4 { require_message_authenticator = no secret = "unixcherche" shortname = "labobe1" nastype = "other" } client 10.96.18.12 { require_message_authenticator = no secret = "fedoracherche" shortname = "labobe4" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldaplabobe2 ldap ldaplabobe2 { server = "10.96.18.10" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 1 timelimit = 1 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name}))" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldaplabobe2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldaplabobe2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldaplabobe2 rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x28523420 Module: Instantiating ldaplabobe1 ldap ldaplabobe1 { server = "10.96.18.4" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 1 timelimit = 1 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name}))" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldaplabobe1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldaplabobe1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldaplabobe1 rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x28523470 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=159, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radacct/192.168.0.50/auth-detail-20090602 [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/192.168.0.50/auth-detail-20090602 [auth_log] expand: %t -> Tue Jun 2 15:43:21 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "fmehault", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name})) -> (&(uid=fmehault)(radiusHuntgroupName=swLabo)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.18.4:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 10.96.18.4:389 rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name})) -> (&(uid=fmehault)(radiusHuntgroupName=swLabo)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.18.4:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 10.96.18.4:389 rlm_ldap: cn=root,dc=netplus,dc=fr bind to 10.96.18.4:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop ++- entering policy redundant {...} [ldaplabobe2] performing user authorization for fmehault [ldaplabobe2] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldaplabobe2] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusHuntgroupName=%{Huntgroup-name})) -> (&(uid=fmehault)(radiusHuntgroupName=swLabo)) [ldaplabobe2] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.18.10:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 10.96.18.10:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=netplus,dc=fr, with filter (&(uid=fmehault)(radiusHuntgroupName=swLabo)) [ldaplabobe2] looking for check items in directory... [ldaplabobe2] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldaplabobe2] Setting Auth-Type = LDAP [ldaplabobe2] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldaplabobe2] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} ++- entering policy redundant {...} [ldaplabobe2] login attempt by "fmehault" with password "toto" [ldaplabobe2] user DN: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr rlm_ldap: (re)connect to 10.96.18.10:389, authentication 1 rlm_ldap: bind as cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr/toto to 10.96.18.10:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldaplabobe2] user fmehault authenticated succesfully +++[ldaplabobe2] returns ok ++- policy redundant returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 159 to 192.168.0.50 port 1812 Finished request 0. Going to the next request Waking up in 4.9 seconds.

1 0

InnerAttributes not escaped when transmitted to outter
by Stun Box 02 Jun '09

02 Jun '09

Hey all, I'm using PEAP/Mschapv2 with Windows machines. I need the user-name of the inner-tunnel when the authentication ends to assign the vlan id. So I put in eap.conf / peap { ... use_tunneled_reply = yes ... }, and now I can have the User-name of the inner-tunnel with %{reply:User-Name}. But it seems it has not been escaped... My User-Name "DOMAIN/testx" becomes => "DOMAIN estxx" And if I try DOMAIN/user it works nicely... ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop expand: %{request:User-Name} -> ANKAMA\testx expand: %{reply:User-Name} -> ANKAMA estxx How can I escape this ? Regards, Frad G.

4 9