July 2009 - Freeradius-Users - lists.freeradius.org

Re: ldap and ad for 802.1x
by Ivan Kalik 01 Jul '09

01 Jul '09

>> I'm trying to figure out the necessary steps and configs to make the >> following happen. 2 groups of users, one residing in ldap with >> samba/ntlm hashes and another in AD, need to authenticate through Radius >> servers for 802.1x wireless. At this point, I have the Radius server >> successfully authenticating the users in LDAP, using their Samba >> credentials, but it's a different story with AD. I joined Samba from the >> Radius box into the AD domain and I'm able to test authentication >> successfully with ntlm_auth command, however authentication against >> Radius doesn't seem to be working. The debug output shows that any AD >> auth. attempt is going against LDAP instead. >> I'm doing it on the same box, same shared Radius config, which is >> probably related to the issue and I think that I need some way to >> enforce separation between LDAP and AD, however my next steps are not at >> clear. I would appreciate any guidance or advise on this. >> >> Thank you very much in advance. >> >> The AD-Radius guide I used came from this URL and I simply added the >> described config to the working LDAP config. >> >> http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO > > You need to create authentication fail-over. If you are sending pap > requests, replace pap in Auth-Type PAP with: > > redundant { > pap > ntlm_auth > } > > For mschap requests, create two mschap module instances - one as default > and one with ntlm_auth line enabled. Then replace mschap in Auth-Type > MS-CHAP with: > > redundant { > mschap_default > mschap_ad > } > > Ivan Kalik > Kalik Informatika ISP >

1 0

timestamp in radpostauth and radacct
by liran tal 01 Jul '09

01 Jul '09

Hey, To include information about the NAS in a listing of the radpostauth (which doesn't have an entry regarding the nas from which the request originated from) I am joining the tables based on the radacct.acctstarttime = radpostauth.date which works "part" of the time. Meaning, for most of my tests it works just fine but I've seen logs where the timestamp in both of these tables differ (for the same request ofcourse). I was hoping someone can clear this issue, what's a normal behavior here? are the timestamp supposed to be the same/different and why. Regards, Liran.

1 0

ldap double bind (rebind) problem
by Joerg Spatschil 01 Jul '09

01 Jul '09

I run FreeRADIUS Version 2.0.5, for host i686-pc-linux-gnu and testing FreeRADIUS Version 2.1.3 both on gentoo systems, I want to peap authenticate, authorize and set VLANs on a Cisco Cat 4500 according to a ldap Attribute. * What does work already: I can authenticate peap using certificates from an XP machine store as well as from the user store. Adding the machine and user to users file DEFAULT Auth-Type := EAP, User-Password == "" Service-Type = Shell-User, Fall-Through = Yes, Tunnel-Type = 13, Tunnel-Medium-Type = 6 # Tunnel-Private-Group-Id = 101 user@domain Auth-Type := EAP, User-Password == "" Service-Type = Shell-User, Fall-Through = Yes, Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 101 sets the VLAN correctly on the Cisco; removing user uses DEFAULT and works as well when the Tunnel-Private-Group-Id is enabled. * What does not work: removing the users entry and setting up ldpa: sites-enabled/MySite authorize { preprocess mschap eap { ok = return } files Autz-Type LDAP1 { ldap_client1 } ldap_client1 expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest pam unix Auth-Type LDAP1{ ldap_client1 } eap } modules/ldap ldap ldap_client1 { server = "ldapserver" identity = "cn=ldapuser,ou=users,...." password = "password" basedn = "dc=ad,..." dictionary_mapping = ${raddbdir}/ldap.attrmap filter = "(userPrincipalName=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 ldap_debug = 0xFFFF } ldap.attrmap checkItem Tunnel-Private-Group-Id comment My VLAN is in the comment Attribute: ldapsearch -h ldaserver -b "dc=casedn" -D "ldapuser@ldaserver" -w "password" -x '(userPrincipalName=user@domain)' comment --> .... comment: 101 Major problem in the debug: new result: res_errno: 1, res_error: <000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1772>, res_matched: <> read1msg: ld 0x81c1068 0 new referrals In tcpdump from ldapsearch there is one bind + one searchRequest In tcpdump from radiusd there is one bind + one searchRequest with searchResDone ... vals 101 - This is perfect. But right thereafter is an anonymous bind which uses the searchResRef and issues the same query again and fails, as it is not allowed for anonymous bind. Is there any idea how to resolve this or how to use ldap differently. Thanks Joerg

2 2

simple test,, how to go on?
by Rakotomandimby Mihamina 01 Jul '09

01 Jul '09

Hi, - Freeradius 2.0.4, packaged by Ubuntu 9.04 Jaunty, on "radius20" host. In users: [...] mihamina Cleartext-Password := "{clear}mihamina" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP [...] "clients.conf" already allows the client I launch radtest from. "radiusd.conf" is attached. When I launch $ radtest mihamina mihamina radius20 10 testing123 or $ radtest mihamina {clear}mihamina radius20 10 testing123 I get the answer: Access-Reject packet from host 41.204.103.216 port 1812 On the server, lauched with -X flag: rad_recv: Access-Request packet from host 41.204.104.9 port 54132, id=132, length=60 User-Name = "mihamina" User-Password = "mihamina" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "mihamina", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated users: Matched entry mihamina at line 86 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "mihamina" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [mihamina/mihamina] (from client quarante_un_deux_cent_quatre port 10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> mihamina attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 4 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 41.204.104.9 port 54132, id=132, length=60 Waiting to send Access-Reject to client quarante_un_deux_cent_quatre port 54132 - ID: 132 Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 132 to 41.204.104.9 port 54132 Waking up in 4.9 seconds. Cleaning up request 0 ID 132 with timestamp +29 -- Architecte Informatique Gulfsat/Blueline: Administration Système, Recherche et Développement Mob: +261 33 11 207 36 Penser à l'environnement avant d'imprimer ce message

3 3

Sending Access Accept when Request comes from a particular IP
by Mauro Iorio - Smart Soft s.r.l. 01 Jul '09

01 Jul '09

Is it possible to send an Access Accept Packet every time an Access Request is sent from a specified source ip only??? Is there an example configuration I can read? Thanks, Mauro Iorio Smart Soft s.r.l.

3 2

Nortel Dictionary update
by David Hobley 01 Jul '09

01 Jul '09

Hello, Here is an updated dictionary.nortel file, it contains the Radius attributes to be able to authenticate against their BCM platform. I wasn't certain how to submit it formally, so thought I would send it here. -- Cheers, David

2 1

about Cisco-AVPair attribute
by Tseveendorj 01 Jul '09

01 Jul '09

Hello, Sorry for asking cisco related thing. What kind of Cisco-AVPair attribute's value to known for policy based shaping. Currently I'm using following configuration with known Cisco-AVPair attribute's value ip:sub-policy-Out=1024Kbps, ip:sub-policy-In=1024Kbps policy-map 1Mbps class Match-Any-Packet police cir 1024000 bc 72000 conform-action transmit exceed-action drop So, I need to change the police to shape like below Router(config)# *policy-map shape-cbwfq * Router(config-pmap)# *class cust1 * Router(config-pmap-c)# *shape average 384000 * Router(config-pmap-c)# *bandwidth 256 * But I don't know what is the Cisco-AVPair attribute's value of shape ? Sincerely, Tseveen.

1 0