August 2009 - Freeradius-Users - lists.freeradius.org

nested groups
by Nicolas.CLEMENTZ＠uha.fr 25 Aug '09

25 Aug '09

Hi, Is-it possible to search users on nested groups. For example : User1 is in group Group1, User2 is in group Group2, Group1 and Group2 are in group Group12 The users config : ... DEFAULT ldap-iut-Ldap-Group == "Group12" Tunnel-Medium-Type:1 = 6, Tunnel-Type:1 = 13, Tunnel-Private-Group-ID:1 = 636, Fall-Through = Yes ... Freeradius Server : 2.1.7 (git) Ldap server : Active directory 2008 Thanks Nicolas Clementz Université de Haute Alsace

1 0

files: How to choose SQL entry for users?
by George 25 Aug '09

25 Aug '09

Hi I am running FreeRADIUS v2.1.6. Problem is found when SQL works in 'users'. sql.conf: sql sql_auth { Some auth-queries... } sql sql_acct { Some acct-queries... } radiusd.conf: authorize { files sql_auth } users: DEFAULT SQL-Group == 'Group1' ... But files chooses sql_acct (alphabetic first) as sql entry. How to choose sql_auth?

4 8

RE: LDAP MSCHAP error
by Ivan Kalik 24 Aug '09

24 Aug '09

> Also any ideas as to how I may insert the variable from perl would be > nice. Read rlm_perl documentation. Ivan Kalik Kalik Informatika ISP

1 0

Re: Dynamic VLAN attribute in LDAP or AD?
by Gary Gatten 24 Aug '09

24 Aug '09

Agreed. I didn't know if I could do some group checking with ntlm_auth, more accurately get a list of groups a user belongs to? If I used FQDN I could prolly parse out the info I need from the user name as well: gary.neteng.waddell.... Ill try LDAP - good learning experience! ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Mon Aug 24 15:48:40 2009 Subject: RE: Dynamic VLAN attribute in LDAP or AD? > Interesting... I'm assuming I could use existing LDAP attribs and remap > them as needed? Ie: "Fax Number" could be mapped to Tunnel ID? > Extending the schema is like getting teeth pulled. Resist the temptation and extend the schema now instead of later. When you need the Fax Number, what will you do? If you don't want to tackle LDAP, you could write a script to generate a separate file of unlang if-then blocks and pull it into the FR conf file with an $INCLUDE statement. > Also, no way to do this with NTLM auth is there? No. NTLM_auth is an authentication tool that returns 0 or 1 depending on the correctness of a password. This is an authorization question - what kind of access will the authenticated user be given? > -----Original Message----- > From: Jason Alderfer [mailto:jha2@emu.edu] > Sent: Monday, August 24, 2009 2:10 PM > To: Gary Gatten > Subject: RE: Dynamic VLAN attribute in LDAP or AD? > > >> So, by looking at this more carefully I'll have to do a bunch of >> if/else's or cases? What if for instance I have 500 > departments/groups >> - 500 different vlans? I'll have to test each one? >> >> I guess what I was hoping to do was something like: >> >> Get attribute "n" for user y (where n = a value used for >> Tunnel-Private-Group-Id" > > You will need to extend your LDAP schema to include the attributes > needed > for the VLAN and make sure they are properties of the objects that you > want them to apply to. > > Then you will need to add these attributes to the FR ldap.attrmap file, > e.g. > > replyItem Tunnel-Type radiusTunnelType > replyItem Tunnel-Medium-Type radiusTunnelMediumType > replyItem Tunnel-Private-Group-Id > radiusTunnelPrivateGroupId > > Now the LDAP module should be able to set these attributes automatically > for each request if you enable it in the authorize or post-auth section. > > Jason - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 1

RE: Dynamic VLAN attribute in LDAP or AD?
by Jason Alderfer 24 Aug '09

24 Aug '09

> Interesting... I'm assuming I could use existing LDAP attribs and remap > them as needed? Ie: "Fax Number" could be mapped to Tunnel ID? > Extending the schema is like getting teeth pulled. Resist the temptation and extend the schema now instead of later. When you need the Fax Number, what will you do? If you don't want to tackle LDAP, you could write a script to generate a separate file of unlang if-then blocks and pull it into the FR conf file with an $INCLUDE statement. > Also, no way to do this with NTLM auth is there? No. NTLM_auth is an authentication tool that returns 0 or 1 depending on the correctness of a password. This is an authorization question - what kind of access will the authenticated user be given? > -----Original Message----- > From: Jason Alderfer [mailto:jha2@emu.edu] > Sent: Monday, August 24, 2009 2:10 PM > To: Gary Gatten > Subject: RE: Dynamic VLAN attribute in LDAP or AD? > > >> So, by looking at this more carefully I'll have to do a bunch of >> if/else's or cases? What if for instance I have 500 > departments/groups >> - 500 different vlans? I'll have to test each one? >> >> I guess what I was hoping to do was something like: >> >> Get attribute "n" for user y (where n = a value used for >> Tunnel-Private-Group-Id" > > You will need to extend your LDAP schema to include the attributes > needed > for the VLAN and make sure they are properties of the objects that you > want them to apply to. > > Then you will need to add these attributes to the FR ldap.attrmap file, > e.g. > > replyItem Tunnel-Type radiusTunnelType > replyItem Tunnel-Medium-Type radiusTunnelMediumType > replyItem Tunnel-Private-Group-Id > radiusTunnelPrivateGroupId > > Now the LDAP module should be able to set these attributes automatically > for each request if you enable it in the authorize or post-auth section. > > Jason

1 0

LDAP MSCHAP error
by Larry Ross 24 Aug '09

24 Aug '09

I am experiencing the following oddness I am hoping someone can shed some light on... We are using FR 2.X and LDAP for MSCHAPv2 authentication. We are storing the NT-Password Hash within LDAP, utilizing ldap.attrmap to map our LDAP variable to "NT-Password" So when an MSCHAPv2 based Auth comes in all is well, the mschap module sees mschap attributes, sets Auth to MSCHAP. rlm_ldap dives into LDAP and locates and maps "NT-Password" properly. All is well.... ALMOST... For a few lucky accounts this process comes to a halt, upon inspection we noticed that the NT-Password being copied by rlm_ldap was being truncated [From Debug output] rlm_ldap: unicodePWD -> NT-Password == 0x6f183bc46904 This is super short... Look at a successful auth rlm_ldap: unicodePWD -> NT-Password == 0xb31b12345aca32aaa607430cb7acdcb1 It appears though that there may be a bug in the string copy function of the rlm_ldap function (or whatever is responsible for copying the attributes from LDAP to Server core for MSCHAP challenge compare) We noticed the truncation upon "00" and "3d" in the NT-Password hash (so if the has was abc12300 or abc1233d all you would see is abc123) Your input is greatly appreciated. Thank you Larry

3 10

TTLS to require client cert
by Petar Marinkovic 24 Aug '09

24 Aug '09

Hi all, I need help once again. I want TTLS to require client cert. I put EAP-TLS-Require-client-cert = YES in ttls { part of eap.conf but it's not working. What I am doing wrong here?

3 4

Freeradius die-ing without any reason or log
by Johan Meiring 24 Aug '09

24 Aug '09

Hi, I have a production server running freeradius 2.0.5 on debian lenny. Basic description as follows: Server has been up for about a year. Not too busy. Approx 1.6 million interim accounting updates per month. Server runs rlm_perl only. Perl talks to sql database. All packets stored in sql, auth/start/stop/interim. Some queries do need a bit of optimization, it's on my todo list. Above info is basically so you can get an idea of how busy the server is. Now my problem: It has now happened three times that the server has just died. All three times in the past 3 months. Server is getting busier over time, and it didn't happen in the beginning, so it could be load related. When it dies there is nothing in the logs whatsoever. Just my last log entry that I made from perl, and nothing else. I also checked the system log files for things like oomkiller, nothing. Any ideas on where to start troubleshooting as to why this happens, as the logs contain nothing whatsoever? I realise this is vague, please let me know if you need more info. Obviuosly posting the full log is not going to work, as the server lasts 4-6 weeks before crashing. I have in the meantime upgraded to freeradius downloaded and compiled from git on about 2009-05-27 (identifies itself as 2.1.6, but from git about a week after the release of 2.1.6). No idea if this will resolve the issue. Thanks! -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

3 2

CoA-Ack and radclient/radiusd
by Anton G. 24 Aug '09

24 Aug '09

Hello, I have a strange problem with CoA-Ack receive I send test Coa packet to nas (juniper erx), the nas sees the packet and do corresponding action as well, and sends Coa-Ack back Nothing strange in nas debug or tcpdump But radclient says: some# /usr/local/bin/radclient -t20 -r 1 -c 1 -f ./user-81-200-27-42.rad -x 10.200.27.3:1700 coa su29 Sending CoA-Request of id 44 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" Framed-IP-Address = 10.200.27.42 ERX-Service-Activate:2 = "setmv(10.200.27.42,000e.0cb9.3140,vrf_nat1)" ERX-Service-Timeout:2 = 20 rad_recv: CoA-ACK packet from host 10.200.27.3 port 1700, id=44, length=20 radclient: received response to request we did not send. (id=44 socket 3) radclient: no response from server for ID 44 socket 3 some# I can`t clearly understand why.. And using radiusd CoA functionality i get similar behavior, but in that case i`m not sure if my config is ok to handle CoA-Ack Have update action in acconting section accounting { if ("%{Acct-Session-Id}" =~ /:/) { if ("%{Acct-Status-Type}" == "Start") { update coa { User-Name := "%{User-Name}" ERX-Virtual-Router-Name := "default:vrf_nat1" ERX-Service-Activate:2 += "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 += 20 } } } ok } and get rad_recv: Accounting-Request packet from host 10.200.27.3 port 50125, id=187, length=283 Acct-Status-Type = Start User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" Event-Timestamp = "Aug 21 2009 13:25:51 MSD" Acct-Delay-Time = 0 NAS-Identifier = "bsr01-su29" Acct-Session-Id = "0024163640:0016777349" ERX-Service-Session = "inetpublic(10.200.27.42,000e.0cb9.3141,vrf_nat1,gi5/0/0.951,0,0,20485760,20485760)" NAS-IP-Address = 10.200.27.3 Framed-IP-Address = 10.200.27.42 Calling-Station-Id = "#bsr01-su29#E50#951" NAS-Port-Type = Ethernet NAS-Port = 671089591 NAS-Port-Id = "GigabitEthernet 5/0/0.951:951" Acct-Authentic = RADIUS +- entering group preacct {...} ++[preprocess] returns ok ++[files] returns noop +- entering group accounting {...} ++? if ("%{Acct-Session-Id}" =~ /:/) expand: %{Acct-Session-Id} -> 0024163640:0016777349 ? Evaluating ("%{Acct-Session-Id}" =~ /:/) -> TRUE ++? if ("%{Acct-Session-Id}" =~ /:/) -> TRUE ++- entering if ("%{Acct-Session-Id}" =~ /:/) {...} +++? if ("%{Acct-Status-Type}" == "Start") expand: %{Acct-Status-Type} -> Start ? Evaluating ("%{Acct-Status-Type}" == "Start") -> TRUE +++? if ("%{Acct-Status-Type}" == "Start") -> TRUE +++- entering if ("%{Acct-Status-Type}" == "Start") {...} expand: %{User-Name} -> 10.200.27.42.vrf_nat1.vlan.5.0.0.951 ++++[coa] returns noop +++- if ("%{Acct-Status-Type}" == "Start") returns noop ++- if ("%{Acct-Session-Id}" =~ /:/) returns noop ++[ok] returns ok Sending Accounting-Response of id 187 to 10.200.27.3 port 50125 WARNING: Empty section. Using default return values. Sending CoA-Request of id 128 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" ERX-Service-Activate:2 = "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 = 20 ERX-Service-Statistics:2 = disabled Finished request 2. Cleaning up request 2 ID 187 with timestamp +4 Going to the next request Waking up in 2.1 seconds. Sending CoA-Request of id 128 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" ERX-Service-Activate:2 = "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 = 20 ERX-Service-Statistics:2 = disabled Waking up in 1.5 seconds. Cleaning up request 0 ID 52 with timestamp +3 Waking up in 2.7 seconds. Sending CoA-Request of id 128 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" ERX-Service-Activate:2 = "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 = 20 ERX-Service-Statistics:2 = disabled Waking up in 8.7 seconds. rad_recv: CoA-ACK packet from host 10.200.27.3 port 1700, id=128, length=20 Ignoring proxy reply that arrived after we sent a reply to the NAS Waking up in 8.3 seconds. Sending CoA-Request of id 128 to 10.200.27.3 port 1700 User-Name = "10.200.27.42.vrf_nat1.vlan.5.0.0.951" ERX-Virtual-Router-Name = "default:vrf_nat1" ERX-Service-Activate:2 = "setmv(10.200.27.42, 000e.0cb9.3141, vrf_nat1)" ERX-Service-Timeout:2 = 20 ERX-Service-Statistics:2 = disabled Waking up in 14.6 seconds. rad_recv: CoA-ACK packet from host 10.200.27.3 port 1700, id=128, length=20 Ignoring proxy reply that arrived after we sent a reply to the NAS Waking up in 14.6 seconds. No response to CoA request sent to 10.200.27.3 Found Post-Proxy-Type +- entering group Fail-CoA {...} ++[ok] returns ok Finished request 2. Cleaning up request 2 ID 187 with timestamp +4 Going to the next request ... Thanks.

5 8

Failed to add duplicate client problem
by Wegener, Norbert 24 Aug '09

24 Aug '09

We have a vpn gateway with different URLs for different user groups. For each URL a specific radius server has to be defined. Up to now those different radius servers have been installed on different machines. When trying to consolidate those servers within different virtual servers on one single machine freeradius refuses to start with the "Failed to add duplicate client xx to clients list. Maybe there's a duplicate? " message. Yes, there is a duplicate and it is on purpose. Is there a way to cirumvent this? Mit freundlichen Grüßen Norbert Wegener

2 3